- dovecot - dovecot.org

[Dovecot] errors after 1.0a3 -> 1.0a4
by Jakob Hirsch 31 Oct '05

31 Oct '05

Hi, somebody else seeing these? Oct 21 09:14:06 ymmv dovecot: imap-login: Login: user=<xxxx>, method=CRAM-MD5, rip=84.162.151.124, lip=85.214.25.134, TLS Oct 21 09:14:07 ymmv dovecot: imap-login: epoll_ctl(): No such file or directory Oct 21 09:14:07 ymmv dovecot: child 11419 (login) returned error 89 mailbox access fails after that. Had this already yesterday, then downgraded to alpha3 and it worked again, upgraded again and it kept working. Strange thing is, access through squirrelmail works perfect, but using Thunderbird gives these errors. I'm using maildir with epoll and inotify, if that matters.

3 7

[Dovecot] login_user & first_valid_uid
by Alexander Shikoff 30 Oct '05

30 Oct '05

Hi all, I have next settings in .conf file ... # # Login user for SQL-based virtual users # login_user = dovecot first_valid_uid = 100 first_valid_gid = 100 ... System user dovecot has UID/GID = 101/101. But every time when user logins I see in log file Oct 29 15:51:25 orion dovecot: Logins with login process UID 101 (user elnino) not permitted (see login_user in config file). Oct 29 15:51:25 orion dovecot: auth(default): Growing pool 'plain_auth_request' with: 1024 Why dovecot generate these warnings and how I can get rid of them? Thanks in advance, Alexander -- Kind Regards, Alexander Shikoff minotaur(a)crete.org.ua

4 8

[Dovecot] [info] Spamcop listing
by /dev/rob0 30 Oct '05

30 Oct '05

Smtp1.song.fi and smtp2.song.fi, our list servers, seem to have gotten listed in the bl.spamcop.net RBL. Spamcop listings are temporary and will time out, and because of occasional major false positives (or perhaps collateral damage?) like this I don't use it to reject mail. Anyone who IS using Spamcop to reject mail has missed much of today's list traffic. -- mail to this address is discarded unless "/dev/rob0" or "not-spam" is in Subject: header

8 13

[Dovecot] Dovecot Alpha 4
by Marcus Don 30 Oct '05

30 Oct '05

Hi We've been using Dovecot as our primary IMAP and POP3 server for around 70,000 users for a couple of months now. On the whole, we've been very pleased with the performance of Dovecot - and are extremely grateful to the developers! However, we have had a few issues, some of which we have yet to resolve. We chose Dovecot because it was the only IMAP/POP3 server we could find that supported direct mysql authentication and both mboxes and maildirs. With exim as our main SMTP server, we were able to convert the inboxes and imap folders for all 70,000 users from mboxes to maildirs without any downtime whatsoever! For those who are interested, we have a cluster of 5 web/imap servers (running our own webmail software) and a further 5 pop servers all placed behind 2 Zeus load balancers and running RHEL 4 (actually CentOS 4.1). Storage is provided by an EMC Clariion device, which is mounted via NFS onto all servers in the cluster over gigabit ethernet. 1. index files The main problem has always been the index files becoming corrupted. This seems to have improved with the Alpha 4 release, but still happens for several users each day. Perhaps it would be possible for Dovecot to just delete index files and re-create them when they are corrupted, rather than just erroring? Also, how do you turn off index files altogether? Even when mail_never_cache_fields is set for all available fields, they still get created. Another issue relating to the index files is that, if a user is deleted and then another user created with the same name, dovecot doesn't have permissions to re-write the index files, because it has a different uid. So, whenever a user is deleted, we have to delete the index files from every machine in the cluster. We could store index files on the NFS device, but this would affect performance (and might cause locking problems). A better solution would be to make the uid one of the variables available in default_mail_env. By naming index files by uid rather than username, this wouldn't be an issue. 2. initgroups() We use an nss-mysql to store all non-administrative system users in a mysql database. We often encounter problems with applications that use the initgroups() function, since this returns all users and groups - which in our case returns masses of data from mysql. When using mysql (or ldap etc) for authentication, it would be useful if there were an option to prevent additional system lookups. At present, we have to comment out the following in /src/lib/restrict-access.c, or the server load goes through the roof: if (initgroups(env, gid) != 0) { i_fatal("initgroups(%s, %s) failed: %m", env, dec2str(gid)); } 3. base_dir permissions bug Since the alpha 4 release, it seems that the permissions dovecot automatically sets for the base_dir are not sufficient to allow the authentication user to access sockets, unless this user belongs to the same group as the login user - which is contrary to the instructions in the documentation. I'm pretty sure this is a bug, but perhaps someone could confirm. 4. authentication caching Also since the alpha 4 release, we have found that, once the authentication cache is full, all subsequent login attempts for users that haven't been cached return "password mismatch". I though this might be a conflict with nscd, but it happens whether nscd is running or not. So, for the time being, we have had to disable the authentication cache. I'd be very keen to hear from anyone who has any feedback on any of the points above. Thanks Marcus -- Marcus Don Applications Development Manager Namesco Limited Main Line: +44 (0)870 120 8888 Main Fax: +44 (0)870 120 8008 Tech Support: +44 (0)870 162 4950 Email: mdon(a)names.co.uk Website: http://www.names.co.uk Address: Acton House, Perdiswell Park, Worcester, WR3 7GD This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the sender immediately. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited. Please note that any views or opinions presented in this email are solely those of the author and do not necessarily represent those of the company. Finally, the recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email. ------------------------------------------------------------------------ --------------------------------------- | Free Dial-up - no need to register! | --------------------------------------- Namesco Limited provides Free dialup access to anyone that wishes to use it. You do not even have to be a customer, there is no need to register and is especially handy if you are unable to connect with your current provider. Simply use the following details: Dialup Number: 0844 535 2100* Username: namesco Password: easydialup * Local call rate charges apply, 33% Cheaper than BT's 0845 local call rate. If you need any help in configuring the Free Dial-up service on your computer, please do not hesitate to call us on 0870 162 4950.

4 4

[Dovecot] Dovecot RPMs for Redhat Enterprise 3 repository?
by Erick Perez 30 Oct '05

30 Oct '05

Where can I find RPMs for RHEL 3? -- ------------------------------------------- Erick Perez Linux User 376588 http://counter.li.org/ (Get counted!!!) Panama, Republic of Panama

3 3

[Dovecot] Dovecot reports zero messages erroneously
by Chris Spiegel 29 Oct '05

29 Oct '05

On October 11, Mark Farmer reported a problem about not being able to see new mails. I'm running into the same issue. Even though cur/ and new/ contain messages, Dovecot reports that there aren't any. This problem seemed to start happening in alpha3 (and persists in alpha4). When I revert back to alpha2, the messages show up again. It looks like a problem with the dovecot.index* files. When I delete them, alpha4 can serve up the mails just fine, and will in fact keep working for a little while. Eventually (within a few hours, although I'm not sure what causes it), dovecot thinks things are empty again. Like Mark, I'm using Postfix.. I'm not sure if that has anything to do with the problem but I thought it'd be worth pointing out. If there are any specific things you'd like me to do to try to pin down this problem, let me know. Chris

2 4

[Dovecot] Some errors with 1.0.alpha4
by Nicolas STRANSKY 29 Oct '05

29 Oct '05

Hi, I'm getting three types of errors with latest Dovecot compiled for x86_64 GNU/Linux Debian. Oct 29 12:47:57 rouge imap-login: unable to dlopen /usr/lib/sasl2/libntlm.so.2: /usr/lib/sasl2/libntlm.so.2: failed to map segment from shared object: Cannot allocate memory Oct 29 12:47:57 rouge pop3-login: unable to dlopen /usr/lib/sasl2/libntlm.so.2: /usr/lib/sasl2/libntlm.so.2: failed to map segment from shared object: Cannot allocate memory I have no idea why there is this error, but it comes each time a user logs in, with no other severe effect. Oct 29 01:28:54 rouge dovecot: imap(glondu): pool_system_malloc(): Out of memory Oct 29 01:28:54 rouge dovecot: child 5642 (imap) returned error 83 (Out of memory) Oct 29 01:38:10 rouge dovecot: imap(glondu): pool_system_malloc(): Out of memory Oct 29 01:38:10 rouge dovecot: child 5639 (imap) returned error 83 (Out of memory) Oct 29 01:49:22 rouge dovecot: imap(glondu): pool_system_malloc(): Out of memory Oct 29 01:49:22 rouge dovecot: child 8839 (imap) returned error 83 (Out of memory) The mailbox for this user is not bigger that 10MB and dovecot mail_process_size is set to default setting so I don't see why there could be a "Out of memory" error. Oct 28 18:00:45 rouge dovecot: imap(vidal): Lost transaction log file /var/dovecot-indexes/vidal/.INBOX/dovecot.index.log seq 1 Oct 28 18:00:45 rouge dovecot: imap(vidal): Lost transaction log file /var/dovecot-indexes/vidal/.INBOX/dovecot.index.log seq 1 Oct 28 18:00:56 rouge dovecot: imap(vidal): Lost transaction log file /var/dovecot-indexes/vidal/.INBOX/dovecot.index.log seq 1 Oct 28 18:00:56 rouge dovecot: imap(vidal): Lost transaction log file /var/dovecot-indexes/vidal/.INBOX/dovecot.index.log seq 1 This error caused the user's mailbox to be unreadable, and erasing the indexes resolved the problem, but I would have expected Dovecot to have done it itself if the indexes were corrupted ? Hope this feedback helps, -- Nico

1 0

[Dovecot] Basic Configuration
by Ashvin Meetoo 29 Oct '05

29 Oct '05

Hi, Been setting up a backup mail server just in case... using FC4... basic configuration... postfix/dovecot... imap pop3... When I send an external email, example(a)gmail.com, everything works well. When I send an internal email, i.e. to another user, user receives a blank email? Everytime he clicks on get mail a new empty email is added... checked /<user>/Mailbox/new folder email is there and header is ok. What can be the matter? Did this thousand times before and even reinstalled FC4... same problem. Also, I have tried: echo test | mail root but mail gives me : No mail for root Help please. __________________________________ Yahoo! Mail - PC Magazine Editors' Choice 2005 http://mail.yahoo.com

1 0

[Dovecot] dovecot-lda cvs
by Rene Luria 28 Oct '05

28 Oct '05

I am using dovecot-lda from cvs (checked out on september the 21st) and dovecot 1.0alpha2 (not yet upgraded ok). I have a strange feeling about "redirect" feature. Let's see two sieve scripts examples: # ex1 require ["fileinto", "vacation"]; if header :is ["blabla"] "blabla" { fileinto "blabla"; } redirect "user(a)domain.com"; keep; # ex2 require ["fileinto", "vacation"]; redirect "user(a)domain.com"; keep; In both cases, I redirect mail to an external address, keeping a copy. (this would emulate redirect :copy "user(a)domain.com"; which is still not implemented). In first example I run a test on headers, but not on the second. The effect is that in the second example, the forwarded mail is "complete" (exactly the original one with routing header modified), but in the first one, the forwared mail is completely messed up: no Subject header, and so on. This could be because as tests are run on the incoming mail, the working in memory of the mail is changed, and then, forwarded. So when no tests are run, the mail remains intact. How can I deal with this ? Is there some nice hotfix that would prevent a few (like 100'000) users to kill me ? Best regards. -- Rene Luria

3 5

[Dovecot] 1.0alpha3: fcntl() complaints?
by Jeff A. Earickson 28 Oct '05

28 Oct '05

Hi, Since installing 1.0alpha3 this morning, I've seen this syslog complaint a few times. Anything to worry about? A "server too busy" issue? imap(user): fcntl() failed with mbox file /var/mail/user: Resource temporarily unavailable Jeff Earickson Colby College

2 4

[Dovecot] DoveCot 1.0a3 hangs at login
by Justin Finkelstein 28 Oct '05

28 Oct '05

I've just upgraded to 1.0a3 via a freebsd port, and I've begun to notice odd behaviour from Dovecot. After converting my config file settings over to the new format, everything runs fine for an hour or so, then dovecot stops responding: oot@toejamfootball# telnet localhost 143 Trying ::1... telnet: connect to address ::1: Connection refused Trying 127.0.0.1... Connected to localhost. Escape character is '^]'. * OK Dovecot ready. 1 login justin(a)redwiredesign.com password [dovecot then just stops doing anything] * BYE Disconnected for inactivity. Connection closed by foreign host. in the logs, it says: Oct 13 09:43:22 toejamfootball dovecot: imap-login: Disconnected: Inactivity: method=PLAIN, rip=192.168.2.11, lip=192.168.2.43 Oct 13 09:43:22 toejamfootball dovecot: auth(default): client in: AUTH 1 PLAIN service=IMAP lip=192.168.2.43 rip=192.168.2.11 resp=AGp1c3RpbkByZWR3aXJlZGVzaWduLmNvLnVrAHBhc3N3b3Jk Oct 13 09:43:22 toejamfootball dovecot: auth-worker(default): sql(x,192.168.2.11): query: SELECT username AS user, MD5(clear) AS password FROM users LEFT JOIN domains ON domains.domain_id = users.domain_id WHERE domain="x" AND username="x" AND users.enabled = 1 AND domains.enabled = 1 Oct 13 09:43:22 toejamfootball dovecot: auth(default): pam(justin(a)x,192.168.2.11): pam_authenticate() failed: authentication error Any clues? I don't use pam for auth anyway, so I just ignore that. When I restart the server and login again it's fine. j.

2 1

[Dovecot] 1.0.alpha3 plaintext authentication problem
by Sergey Redin 28 Oct '05

28 Oct '05

Hello everyone, Since the upgrade to 1.0.alpha3 I experience a strange problem with plaintext authentication. I successfully login first few (2-5) times after the dovecot restart, and then on a reason I cannot login any more (both via POP3 and IMAP). I tried to find out what could be the reason for this but I failed. Nothing is changed inside the user's home directory or /var/run/dovecot, but I cannot login any more. I guess there is something wrong inside dovecot-auth od dovecot process itself. I just start to receive "01 NO Authentication failed." or "-ERR Authentication failed." from dovecot and "Authenticate PLAIN failed: Unsupported authentication mechanism.: method=PLAIN" in my logs, even though I used the same PLAIN two minutes ago without a problem. Here is my dovecot.conf: nevoservice# egrep -v '^[ ]*(\#.*)?$' /usr/local/etc/dovecot.conf protocols = imap pop3 ssl_disable = no ssl_cert_file = /etc/mail/certs/server.crt ssl_key_file = /etc/mail/certs/server.key disable_plaintext_auth = no log_path = /var/log/dovecot/log info_log_path = /var/log/dovecot/info login_user = dovecot login_processes_count = 1 verbose_proctitle = no first_valid_gid = 0 mail_extra_groups = mail mail_debug=yes default_mail_env = mbox:/var/mail/%u maildir_copy_with_hardlinks = yes protocol imap { imap_client_workarounds = delay-newmail outlook-idle netscape-eoh tb-extra-mailbox-sep } protocol pop3 { pop3_uidl_format = %08Xu%08Xv pop3_client_workarounds = outlook-no-nuls oe-ns-eoh } auth_verbose = yes auth_debug = yes auth default { mechanisms = plain passdb passwd-file { args = /usr/local/etc/dovecot.passwd } userdb passwd-file { args = /usr/local/etc/dovecot.passwd } user = root } Here are two lines in dovecot.passwd which define the user that I use: wail:password-hash:1050:1032:Administrator wail.spb.ru:/home/wail.spb.ru:::/var/mail/wail wail@nevoservice.ispvds.com:password-hash:1050:1032:Administrator wail.spb.ru:/home/wail.spb.ru:::/var/mail/wail A few lines from my /var/log/dovecot/info file: dovecot: Oct 10 02:03:11 Info: auth(default): client in: AUTH 1 PLAIN service=POP3 lip=82.146.50.34 rip=82.146.63.23 resp=AHdhaWwAVGxNSFRuUlI2 dovecot: Oct 10 02:03:11 Info: auth(default): client out: OK 1 user=wail dovecot: Oct 10 02:03:11 Info: auth(default): master in: REQUEST 3 53919 1 dovecot: Oct 10 02:03:11 Info: auth(default): master out: USER 3 wail uid=1050 gid=1032 home=/home/wail.spb.ru mail=/var/mail/wail dovecot: Oct 10 02:03:11 Info: pop3(wail): Effective uid=1050, gid=1032 dovecot: Oct 10 02:03:11 Info: pop3(wail): maildir autodetect: stat(/var/mail/wail/cur) failed: Not a directory dovecot: Oct 10 02:03:11 Info: pop3(wail): mbox autodetect: data=/var/mail/wail dovecot: Oct 10 02:03:11 Info: pop3(wail): mbox autodetect: INBOX file: yes (/var/mail/wail) dovecot: Oct 10 02:03:11 Info: pop3(wail): mbox: data=/var/mail/wail dovecot: Oct 10 02:03:11 Info: pop3(wail): mbox: root exists (/home/wail.spb.ru/mail) dovecot: Oct 10 02:03:11 Info: pop3(wail): mbox: root=/home/wail.spb.ru/mail, index=/home/wail.spb.ru/mail, inbox=/var/mail/wail dovecot: Oct 10 02:03:11 Info: pop3-login: Login: user=<wail>, method=PLAIN, rip=82.146.63.23, lip=82.146.50.34 dovecot: Oct 10 02:03:13 Info: pop3(wail): Logout. top=0/0, retr=0/ del=0/3, size=5372 dovecot: Oct 10 02:03:20 Info: auth(default): client in: AUTH 1 PLAIN service=POP3 lip=82.146.50.34 rip=82.146.63.23 resp=AHdhaWwAVGxNSFRuUlI2 dovecot: Oct 10 02:03:20 Info: auth(default): client out: OK 1 user=wail dovecot: Oct 10 02:03:20 Info: auth(default): master in: REQUEST 4 53918 1 dovecot: Oct 10 02:03:20 Info: auth(default): master out: USER 4 wail uid=1050 gid=1032 home=/home/wail.spb.ru mail=/var/mail/wail dovecot: Oct 10 02:03:20 Info: pop3(wail): Effective uid=1050, gid=1032 dovecot: Oct 10 02:03:20 Info: pop3(wail): maildir autodetect: stat(/var/mail/wail/cur) failed: Not a directory dovecot: Oct 10 02:03:20 Info: pop3(wail): mbox autodetect: data=/var/mail/wail dovecot: Oct 10 02:03:20 Info: pop3(wail): mbox autodetect: INBOX file: yes (/var/mail/wail) dovecot: Oct 10 02:03:20 Info: pop3(wail): mbox: data=/var/mail/wail dovecot: Oct 10 02:03:20 Info: pop3(wail): mbox: root exists (/home/wail.spb.ru/mail) dovecot: Oct 10 02:03:20 Info: pop3(wail): mbox: root=/home/wail.spb.ru/mail, index=/home/wail.spb.ru/mail, inbox=/var/mail/wail dovecot: Oct 10 02:03:20 Info: pop3-login: Login: user=<wail>, method=PLAIN, rip=82.146.63.23, lip=82.146.50.34 dovecot: Oct 10 02:03:21 Info: pop3(wail): Logout. top=0/0, retr=0/ del=0/3, size=5372 dovecot: Oct 10 02:03:28 Info: pop3-login: Authenticate PLAIN failed: Unsupported authentication mechanism.: method=PLAIN, rip=82.146.63.23, lip=82.146.50.34 dovecot: Oct 10 02:03:30 Info: pop3-login: Aborted login: method=PLAIN, rip=82.146.63.23, lip=82.146.50.34 We see here two successfull logins with PLAIN and then suddenly PLAIN becomes unsupported. I run dovecot 1.0.alpha3 on FreeBSD 4.11, it was installed from ports and then I edited dovecot.conf (and created dovecot.passwd). Any help would be really appreciated. Sergey Redin.

2 1

Re: [Dovecot] Dovecot Alpha 4
by Tomi Hakala 28 Oct '05

28 Oct '05

Marcus Don wrote: > How confident are you of the CVS? Any idea when the next (perhaps beta?) > release will be? I run CVS code most of the time, but only with handful of users and with them it has been working OK. I wouldn't use CVS code in production without thorough stress testing in a lab first. >>Have you thought of clustered file system to go with your Dovecot >>hosts and CLARiiON device? > I'm not sure why this would benefit us at the moment. Before we switched to > maildirs, the bottleneck we were experiencing at busy times was the ethernet > speed, not the storage device speed. > Is there another reason you suggested this? No, I'm just not very fond of NFS myself but it seems that for you it is doing job pretty well. Your CLARiiON is a normal SAN device and you have some singe host providing NFS? It didn't quite open to me how your mail spool is set up, is it some meta LUN distributed over two disk arrays or do you just have one huge LUN and mirror it between two arrays? -- Tomi Hakala

1 0

[Dovecot] problem with thunderbird
by Alfonso Sparano 28 Oct '05

28 Oct '05

Hi all, I've a problem with thunderbird 1.0.6/7/1.5 and dovecot pop3 I've tried dovecot alpha 3 and 1.0 stable but neither one is capable of downloading mails. Nothing is written into the log. I've tried also to delete dovecot.index* and dovecot-uidlist into the Maildir directory. The cur directory contains more than 8100 messages (single files) Anyone has founded this problem? Alfonso

3 3

[Dovecot] Corrupted index cache file [...] invalid record size
by Lorens 28 Oct '05

28 Oct '05

I get this error every single time some of my users log in: Error: POP3(${user}): Corrupted index cache file /${userdir}/dovecot.index.cache: invalid record size The named file seems to be deleted as soon as corruption is found. This only affects some users. I thought the affected users had in common that they are using POP3 in "leave-messages-on-server" mode, and that their mailboxes are big ( > 100 MB). However I've found a few counterexamples, few and far between (not every login) but still. Google's no help, for once :-) Could this be a locking problem, a bug with big Maildirs (counterexamples being few), or what? I know some of my users have had problems logging several IMAP clients into the smae account at the same time, wouldn't put it past some of those with problems to be trying the same with POP. I know that a detected cache corruption is merely that, but I find the error message annoying :-) Configuration: v1.0-stable (0.99.20050712-2 from debian unstable) Maildir only Default locking (nothing mentioned in conf file) Access over NFS mmap_disable = yes (wiki says to disable mmap to use indexes on NFS). Thanks for any pointers.

2 1

[Dovecot] 1.0alpha3: assert and core
by Jeff A. Earickson 28 Oct '05

28 Oct '05

Hi, An assert and core with 1.0alpha3 on Solaris 9, mbox format, imap only, compiled with gcc 4.0.1. The syslog message was: imap(user): file message-body-search.c: line 393 (message_body_search_ctx): assertion failed: (input->v_offset <= part->physical_pos) gdb core dump analysis is attached. Jeff Earickson Colby College

2 1

[Dovecot] hangup with corrupted indexes
by Sergey Redin 28 Oct '05

28 Oct '05

Hello everyone, I remember that Timo wrote in this maillist that if index files are corrupted, dovecot should be OK and just recreate it. So I report here a bug: I have corrupted indexes which make pop3 and imap processes to hangup right after the first list command. The process does not respond and eats 90% of CPU. Just unpack http://redin.info/dovecot-corrupted-index.tgz (10 Kb) into a user's IMAP root (I have mbox storage, but the same thing for maildir with this indexes), do the chown, and try to check the email. I know that the problem can be fixed by removing the index files or using INDEX=MEMORY, but it is claimed that dovecot is failsafe and can deal with any kind of corrupted index files. This is the only reason why I report it here. I have 1.0.alpha4 on FreeBSD 4.11 (installed from ports). Best regards, Sergey Redin.

2 1

[Dovecot] Dovecot problems on Debian
by Jaldhar H. Vyas 28 Oct '05

28 Oct '05

If you have been bitten by bug #334180 and dovecot 1.0alpha3-2.0.1 rest assured the problem is being worked on. In the meantime you should downgrade to -2 which can be found at: http://snapshot.debian.net/archive/2005/10/08/debian/pool/main/d/dovecot/ -- Jaldhar H. Vyas <jaldhar(a)debian.org> La Salle Debain - http://www.braincells.com/debian/

1 0

[Dovecot] Weirdness with authentication/1.0a4.
by Ashley Penney 28 Oct '05

28 Oct '05

Hi, FreeBSD has recently upgraded their port from 0.99 to 1.0a4, and this has caused me an absolute nightmare of a situation. In a nutshell I replaced my conf with the -example, and modified almost nothing. I made some SSL certs and put them in place, left it with imap/pop/pam etc. Whenever users tried to connect to the remote address, cara.untaken.net, I would get: Oct 27 18:31:14 cara dovecot: Dovecot v1.0.alpha4 starting up Oct 27 18:31:33 cara dovecot: imap-login: Login failed: Plaintext authentication disabled: rip=217.206.62.50, lip=217.206.62.50 Oct 27 18:31:33 cara dovecot: imap-login: Disconnected: rip=217.206.62.50, lip=2 17.206.62.50 However, plaintext authenication was most definitely not disabled. Using www.untaken.net/mail/ which is hosted on the same box as dovecot I could get this plaintext failure constantly using cara.untaken.net, but switching to 'localhost' instead would work fine, despite being the same physical machine. I'm baffled at what could cause this, I put my currently conf over at www.untaken.net/dovecot/ just for reference, I've modified various bits now from the default in a desperate attempt to get it working. Has anyone else seen anything like it? -- <EisernLint> i am considering taking pilates classes.

2 1

[Dovecot] Authentication using native MySQL PASSWORD() function
by Tom Sommer 28 Oct '05

28 Oct '05

Hi, I have a little problem, I need to adapt a setup that currently uses the native MySQL PASSWORD() function to encrypt passwords for e-mail accounts. I plan on using Dovecot with SQL to authenticate on my server, is there a password scheme that fits this authentication method? Any help is appreciated -- Tom Sommer

3 11

[Dovecot] Strange Disconnect Problem
by Marc Perkel 27 Oct '05

27 Oct '05

It's only happening with one user but for some reason I can't get this person logged in. And I'm using his ID on my computer and my ID works. Using two different IMAP clients. What would be causeing the "disconnected" to happen? dovecot: Oct 17 10:56:43 Info: imap-login: Login: user=<lowsley(a)cbsyellowpgs.com>, method=PLAIN, rip=65.37.192.182, lip=69.50.231.10 dovecot: Oct 17 10:56:47 Info: imap-login: Disconnected: user=<john(a)sembrot.com>, method=PLAIN, rip=204.95.16.61, lip=69.50.231.10

2 1

[Dovecot] Shared Folder usage alpha3
by Ralf Zerres 27 Oct '05

27 Oct '05

Dear List, this is my first mail to this list. I'v tried to carefully review all given information towards the Shared Folder subject I could find in the archive / mailing list / wiki. And so far I'm also aware that Timo hasn't put it on the active tasklist for the 1.0 release. Citing the track http://dovecot.org/pipermail/dovecot/2003-October/002493.html I was wandering, wether any further attempt has been made, to use the given functionality for real work. To be more precise, wether anybody has done - delivery of mailboxes to a shared maildir - offering these maildirs through a given namespace Before bothering here without any local experience, I'v set up a dov-server (1.0alpha3) on a debian sid. As an MTA postfix is doing the job. Within postfix I did set up a virtual domain and the needed maps (mailbox, alias). I'm able to deliver successful with the standard postfix functionality to the given filesystem structure (fs=ext3). If it is on any help, I can post the relevant config files. As good practice, all mail is delivered to given mailbox-owner with 0600 permission for the new subdir. Hence, can't be seen by any shared-maildir user (unless owner uid matches:) >From here on I'v tried to switch from debians default postfix delivery-strategy (mailbox_command = procmail -a "$EXTENSION") to given dovcot deliver process (mailbox_command = /usr/lib/dovecot/deliver). The primary aim is to define a strategy to deliver with 0660 rights which will enable group read-write access to the given Mailstore. I have adopted the dovecot.conf enableing a listening socket ... default_mail_env = maildir:/home/%u/Maildir: \ INDEX=/home/%u/MaildirIndex namespace private { separator = / prefix = inbox = yes } namespace public { # the prefix needs to be postponed with the separator prefix = Public/ # the location path given as [<mailbox-type>:]<path>/mailbox location = maildir:/home/SharedMaildirs separator = / inbox = no hidden = no } auth default { ... # using deliver through a socket socket listen { master { path = /var/run/dovecot/auth-master mode = 0666 } } } and configured the subsequent dovecot-deliver.conf ... auth_socket_path = /var/run/dovecot/auth-master mail = maildir:%h/Maildir/ umask = 0007 auth_verbose = yes use_syslog = yes just to see, whether a manual call /usr/lib/dovecot/dovecot-deliver -d <user> <testmail would do the trick. Well, I got the delivered mail, but files are not installed with the etimated previledges. Can someone can point me to the clou? Greetings Ralf PS: I also read about posix-acl's support. But my test's didn't allow a successful read ....

2 1

[Dovecot] Alpha4 pre-release, please upgrade
by Timo Sirainen 27 Oct '05

27 Oct '05

Please try if http://dovecot.org/nightly/dovecot-latest.tar.gz (or the CVS directly) works with you. I made a lot of changes to dovecot-auth, so I wouldn't want to make alpha4 release without some more testing in different environments. I'll release alpha4 in a few days, but it'll be basically same as this unless more bugs get fixed. Some of the changes include: - IMAP: We might have sent extra EXPUNGE messages when output buffer got full. This could have caused various sorts of very bad behavior. This is the main reason why everyone should upgrade as soon as possible. - POP3: We sent duplicate replies for LIST command when output buffer got full. Probably caused Thunderbird's duplicate deletion bugs? (Although I thought someone checked that Dovecot's reply was correct when the bug occurred?) - pop3_uidl_format setting is now required to be explicitly set in configuration file for pop3 to work at all. I want to get rid of the old default setting which breaks Outlooks, and simply changing the default would break existing setups. - Multiple passdbs and userdbs of same type can now be added with different parameters. Some people asked about this earlier. - Authentication cache works now with other than SQL and LDAP passdbs. Some passdbs such as PAM require some additional settings to work. See example config file. - Some other fixes to authentication cache related to failure handling and non-plaintext authentication. - deny passdb wasn't working for non-plaintext authentication.

8 21

[Dovecot] auth
by Riccardo Bini 27 Oct '05

27 Oct '05

It's possible to have an auth order so if the first is true skip the other ones? Bye Rick

2 1

[Dovecot] pop3 behaviour
by Krzysztof Janiszewski - IT Partner 27 Oct '05

27 Oct '05

Hi! I'v installed dovecot over um-pop3 today. Dovecot has only pop3 enabled. imap will be enabled later. But there is one issue - on some accounts, after receiving mail to Outlook Express, mail is not deleted from /var/mail/username mbox file, and on most it is deleted. Why it works in that way? Best regards Krzysztof

2 1

[Dovecot] how to configure dovecot, Error
by Roland Schmid 27 Oct '05

27 Oct '05

Hi, we are using Squirrelmail, imapd is dovecot. OS is Debian Sarge. When I want to login with Squirrelmail the connection to the imap-server is aborted. /var/log/mail.log gives the these log-entries: Oct 25 14:39:36 webserver dovecot: imap(rs.messegrafik-schreiber.de): mbox: Can't create root IMAP folder /home/rs.messegrafik-schreiber.de/mail: Permission denied Oct 25 14:39:36 webserver dovecot: imap(rs.messegrafik-schreiber.de): MAIL environment missing and autodetection failed (home /home/rs.messegrafik-schreiber.de) Oct 25 14:39:36 webserver dovecot: imap-login: Login: user=<rs.messegrafik-schreiber.de>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, secured Oct 25 14:39:36 webserver dovecot: child 31339 (imap) returned error 89 Need help, thanks. Roland

2 1

[Dovecot] Pop3 Pipeing
by Mark Smith 27 Oct '05

27 Oct '05

How would I go about and setup pop3 pipeing with dovecot I have instaled Perldesk and there instructions is for only Exim or Sendmail. Regards, _________________________________________________________________ MSN Messenger 7.5 is now out. Download it for FREE here. http://messenger.msn.co.uk

2 1

[Dovecot] 1.0alpha4: mbox-lock asserts and cores
by Jeff A. Earickson 27 Oct '05

27 Oct '05

Timo, I upgraded from alpha3 to alpha4 yesterday, and I am seeing a few of the following asserts: imap(user): file mbox-lock.c: line 379 (mbox_lock_fcntl): assertion failed: (lock_type == F_UNLCK) Gdb info on a couple of the cores is attached. It looks like the arg lock_type for mbox_lock_fcntl() is not getting passed in correctly, like the enum "enum mbox_lock_type type" in mbox_lock_list() is not getting set or used correctly so that lock_data[type].func is wrong. Hmmm. My setup: Solaris 9, mbox, dovecot built with gcc 4.0.2. The filesystem for INBOXes is NFS mounted from another Solaris 9 system, but the index files reside on local filesystems. My setting for "lock_method = fcntl", per your release notes. I did not change the default setting of "mmap_disable = no" because my index files are local. Jeff Earickson Colby College

2 1

[Dovecot] USER environment missing
by Ed 27 Oct '05

27 Oct '05

I am new to dovecot, and while I have the pop server running fine, I am having trouble with the imap server. It starts, but when I try to connect, I get an error: telnet localhost imap Trying 127.0.0.1... Connected to localhost.localdomain. Escape character is '^]'. imap(??): Fatal: USER environment missing Connection closed by foreign host. Not sure where to start on this one. (or what to show you). I am running under Ubuntu Linux, usiang postfix, fetchmail, etc.. (not sure that matters). -- No virus found in this outgoing message. Checked by AVG Anti-Virus. Version: 7.0.344 / Virus Database: 267.12.4/143 - Release Date: 10/19/2005

2 1

[Dovecot] alpha4 and zlib-plugin?
by Jeff A. Earickson 27 Oct '05

27 Oct '05

Hi, I saw the zlib-plugin reference in the alpha4 ChangeLog notes are searched the list for info about it. The only reference I found was from Timo back in March 2005. Questions: 1) Is this going to become a standard part of version 1.0? 2) Any plans or ability to make it read/write to a gzipped mailbox, or is this possible? Or will it always be read-only? 3) How does a mailbox get gzipped? From within dovecot somehow, or only by external action? Jeff Earickson Colby College

3 2

Re: [Dovecot] pop3 behaviour
by Krzysztof Janiszewski - IT Partner 26 Oct '05

26 Oct '05

Hello! > Do you have reason to believe that the clients are issuing a delete > command and that the mail is incorrectly being left on the server OR do > they have a 'keep mail on server' option checked? I'm sure thet they have 'keep mail on server' unchecked. When uw-ipop3d was used, mail was correctly deleted. Best regards Krzysztof

1 0

[Dovecot] Two "pre-migration" questions
by Alan Mead 26 Oct '05

26 Oct '05

I have read the migration docs. They seem to relate to migrating from one imap product to dovecot on the same server. I'm interested in migrating my Maildir-formatted email from one server to another. 1. Can I tar my ~/mail directory on serverX.com, untar it on a different physical serverY.com (initially with a different domain name), and still see my mail when I access imap.serverY.com <http://imap.serverY.com> (dovecot's running on serverY.com .. but let me know if there are any tricks that I need to make this work). 2. If I maintain large mailboxes and check my mail frequently, how does the dovecot server load compare to something like apache or Samba? I ask because I have a vanity domain that I mostly use for email and I want to ensure that I can migrate my precious emails to a new service provider. And the provider that I'm considering offers low-cost virtual dedicated servers but meters usage (including RAM and CPU). One of the reasons I have question #1 is that the server name seems to be part of the email file names... amead:/home/amead> ls mail/cur | head -2 2022292282.22297_0.vulcan.rootr.net:2,S 2022312282.3225_0.vulcan.rootr.net:2,S (rootr.net <http://rootr.net> is my current provider, not my vanity domain; vulcan is the name of their mailserver) I don't know what effect this will have, if any? Thanks! -Alan

3 3

[Dovecot] [Fwd: Dovecot disconnecting users at login for inactivity]
by Chris Liljenstolpe 25 Oct '05

25 Oct '05

3 3

[Dovecot] choosing syslog facility?
by Dominik Werder 25 Oct '05

25 Oct '05

Hello! How can I log dovecots messages into a separate file? Is it possible to set a custom syslog facility name somehow? I can't set the log file in dovecot because dovecot does not automatically rotate the logs like syslog does.. thank you! Dominik

4 4

[Dovecot] alpha4 - Unknown passdb driver 'pam'
by Willem Riede 25 Oct '05

25 Oct '05

Does anybody see this? Oct 24 19:41:44 athena dovecot: Dovecot v1.0.alpha4 starting up Oct 24 19:41:45 athena dovecot: Auth process died too early - shutting down Oct 24 19:41:45 athena dovecot: auth(default): Unknown passdb driver 'pam' Oct 24 19:41:45 athena dovecot: child 3374 (auth) returned error 89 This is on Fedora FC5-devel x86_64 (opteron), which is certainly pam based. FWIW, if I switch to passwd dovecot alph4 runs fine (so far). Regards, Willem Riede.

2 1

[Dovecot] Pop3 Pipeing
by Mark Smith 24 Oct '05

24 Oct '05

Does anyone know how to pipe with dovecot-pop3d? Please help Thanks _________________________________________________________________ Be the first to hear what's new at MSN - sign up to our free newsletters! http://www.msn.co.uk/newsletters

1 0

[Dovecot] debian dovecot upgrade
by Brent Clark 24 Oct '05

24 Oct '05

Hi all I find this highly upsetting, I just upgrade my debian dovecot, and I specified that I dont want to upgrade the conf file. and on restarting, I get this in my syslog. Oct 24 17:33:33 mail dovecot: Dovecot v1.0.alpha3 starting up Oct 24 17:33:34 mail dovecot: Login process died too early - shutting down Oct 24 17:33:34 mail dovecot: imap-login: Can't load certificate file /etc/ssl/certs/dovecot.pem: error:25066067:DSO support routines:DLFCN_LOAD:could not load the shared library Oct 24 17:33:34 mail dovecot: imap-login: Can't load certificate file /etc/ssl/certs/dovecot.pem: error:25066067:DSO support routines:DLFCN_LOAD:could not load the shared library Oct 24 17:33:34 mail dovecot: child 5983 (login) returned error 89 Oct 24 17:33:34 mail dovecot: child 5985 (login) returned error 89 mail:~# Wierd thing is, at no time am I asking for ssl, and in my conf file I have it hashed out. mail:~# cat /etc/dovecot/dovecot.conf | grep ssl # --with-ssldir=/etc/ssl #ssl_listen = #ssl_disable = no #ssl_cert_file = /etc/ssl/certs/dovecot.pem #ssl_key_file = /etc/ssl/private/dovecot.pem #ssl_ca_file = #ssl_verify_client_cert = no #ssl_parameters_file = /var/run/dovecot/ssl-parameters.dat #ssl_parameters_regenerate = 24 #ssl_cipher_list = all:!LOW #verbose_ssl = no #ssl_require_client_cert = no mail:~# I tried on the command line # dovecot -F -c dovecot.conf my version is: mail:~# dovecot --version 1.0.alpha3 mail:~# Would anyone perhaps know why I cant get the daemon started. Kind Regards Brent Clark

2 2

[Dovecot] dual auth with real users and virtual users
by Erick Perez 24 Oct '05

24 Oct '05

Hi, im using 0.99 stable in RPM form, Im using this for postfix+dovecot+real unix users, now i tried to enable virtual support with this: protocols = imap pop3 ssl_disable = yes log_path = /var/log/dovecot.log info_log_path = /var/log/dovecot.info login_user = dovecot mail_extra_groups = mail auth = default auth_mechanisms = plain auth_passdb = pam auth_userdb = passwd auth_userdb = passwd-file /etc/vhosts/userdb auth_passdb = passwd-file /etc/vhosts/passwd The above configuration works for local users but is not working for virtual users, it produces the error: dovecot-auth: Oct 21 00:19:14 Info: PAM: pam_authenticate(erickperez) failed: Authentication failure obviously the user erickperez exists in /etc/vhosts/userdb so PAM will fail. Im using 0.99 release. Thanks, -- ------------------------------------------- Erick Perez Linux User 376588 http://counter.li.org/ (Get counted!!!) Panama, Republic of Panama

2 2

[Dovecot] 1.0alpha4: drowning in asserts/cores
by Jeff A. Earickson 24 Oct '05

24 Oct '05

Timo, I have had to drop back to alpha3 because I found a pile of core files on my imap server this morning, from the weekend. They are all from the assert: imap(user): file mbox-lock.c: line 379 (mbox_lock_fcntl): assertion failed: (lock_type == F_UNLCK) I reported this issue to the list last Friday. Help... Jeff Earickson Colby College

1 0

[Dovecot] Case of %n (feauture request)
by Alexander Shikoff 24 Oct '05

24 Oct '05

Hello, I'm using dovecot not for a long time but I've newer seen most powerful and handy POP3/IMAP server. Thank Timo for dovecot; thank community for help! I would like to notice that %n is case-sensitive: it always stores user part of login without case conversions. As a result there are some inconveniences with virtual user organization, for example: password_query = SELECT `password` FROM `users` WHERE login = '%u' user_query = SELECT "mbox:/var/mail/virtual/%d/%n:INBOX=/var/mail/virtual/%d/%n:INDEX=MEMORY" AS `mail`, 101 AS `uid`, 101 AS `gid` FROM users WHERE login = '%u' In this example authentication works perfectly but user can not access it's mailbox because all mailbox names are lower-case. I think it would be more handy to make %d, %n and %u aliases lower-case and introduce three new aliases %D %N %U which store values without case conversions. But I'm not enough skilled in C to write a patch... and now I'm waiting for comments on this and answer from the developer. Thanks in advance, Alexander. -- Kind Regards, Alexander Shikoff minotaur(a)crete.org.ua

2 2

Re: [Dovecot] Same email recieved
by Bob Hope 24 Oct '05

24 Oct '05

Andrew Hutchings wrote: > On Fri, 2005-10-14 at 12:46 -0500, Bob Hope wrote: > >> They are using Outlook. I'm not seeing anything about UIDs of mails >> in dovecot.conf. I'm using dovecot 0.99.14 presently. >> >> Regards, >> >> Savage >> > > > Ah, afraid I can't really help then, I haven't used the .99 series of > Dovecot for over a year now and there seem to be quite a few issues with > it. > > Regards > Andrew > -- > Andrew Hutchings (A-Wing) - Linux Guru > Netserve Consultants - http://www.domaincity.co.uk/ > Linux CDs and DVDs - http://www.linuxiso.co.uk/ > Random quote 1: "Microsoft is not the answer. Microsoft is the question. > NO (or Linux) is the answer." - Unknown > > > > Well, I suppose I could upgrade to 1.0 then. I'll give that a try and drop a note here if it works. Thanks, Savage

1 1

[Dovecot] dovecot + postfix + freebsd help
by glemme 23 Oct '05

23 Oct '05

Hi. I'm currently setting up dovecot to work with my server. My inboxes from postfix are stored in /usr/var/spool/mail/ and then the username, so for me that would be / usr/var/spool/mail/viktor my homedirectory is /usr/home/glemme/homes/viktor/ so from what i can understand. My settings should be: default_mail_env = mbox:%h/Mail:INBOX:/usr/var/spool/mail/%u But guess what, I am probably wrong. my mailapp tells me my inbox is empty and my log claims this: dovecot: Oct 22 16:39:35 Info: imap(viktor: Effective uid=1015, gid=1004 dovecot: Oct 22 16:39:35 Info: imap(viktor: mbox: data=/usr/home/ glemme/homes/viktor/Mail:INBOX:/usr/var/spool/mail/viktor dovecot: Oct 22 16:39:35 Info: imap(viktor): mbox: INBOX defaulted to /usr/home/glemme/homes/viktor/Mail/inbox dovecot: Oct 22 16:39:35 Info: imap(viktor): mbox: root=/usr/home/ glemme/homes/viktor/Mail, index=/usr/home/glemme/homes/viktor/Mail, inbox=/usr/home/glemme/homes/viktor/Mail/inbox Why is it defaulting from the right INBOX to the wrong one? HELP! /glemme

2 1

[Dovecot] 1.0alpha2: how to reject specific users?
by Jeff A. Earickson 21 Oct '05

21 Oct '05

Hi, In Qualcomm's qpopper, you can specify a list of users to reject at authentication, even if they are otherwise valid, by putting them in a file (/etc/pop.nonauth). I use this to occasionally ban users who bang on the system needlessly until they Get a Clue. I looked thru the wiki.dovecot.org/Authentication pages and didn't see anything like this feature. Does it exist in 1.0? BTW, running 1.0alpha2 in production since Sunday night, working great. Zero core dumps, only minor chatter about "Corrupted index cache file" in the syslog, no problems. Jeff Earickson Colby College

3 7

[Dovecot] latest dovecot rpm for RedHat Enterprise 3
by Erick Perez 21 Oct '05

21 Oct '05

Does anyone have a repository with the latest dovecot for RHEL3 ? I have only found dovecot-1.0.0.4-200502 which is for february 2005. I dont know how to build rpms from .tar so i will not venture on that without some magic tool. Thanks,

1 0

[Dovecot] Performance issues in Alpha4 gone
by Daniel 21 Oct '05

21 Oct '05

Hi The performance issues I noticed on my system/setup with Alpha3 seem to be gone with Alpha4. As soon as I installed it I noticed imap seemed more responsive. Just thought I would let the list know. Regards Daniel

2 1

[Dovecot] imaps on alternate ports
by Andrew D. Clark 21 Oct '05

21 Oct '05

I'm trying to test out dovecot 1.0 alpha 3 prior to an upgrade from dovecot-0.99.14, but I cannot get imaps listening on anything other than 993. I've tried putting listen = *:2023 in the global section or in the imap { } section. No luck. What is the proper format for a config that only runs imaps and only listens on a particular port? -- Andrew Clark Campus Network Programmer University of California, Santa Barbara andrew.clark(a)ucsb.edu (805) 893-5311

2 1

[Dovecot] alpha4: flock change
by Jeff A. Earickson 20 Oct '05

20 Oct '05

Timo, The comments in dovecot-example.conf regarding lock_method for Solaris users needs to note your change. Your changelog says: - Default lock_method changed to flock instead of the old fcntl. Solaris users will need to set it back to fcntl. This makes sure that Dovecot's indexes aren't accidentally used with NFS. But there is no warning about this in the file for Solaris users. There should be; it will bite somebody later. Jeff Earickson Colby College

1 0

[Dovecot] [PATCH] Support for GSSAPI SASL Mechanism
by Jelmer Vernooij 20 Oct '05

20 Oct '05

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi, Attached is a patch against current CVS that adds support for the GSSAPI SASL mechanism. It was written from scratch, after reading the patch from Colin Walters against a much older version of dovecot. Other then support for the 'GSSAPI' mechanism, it contains the following changes: - - Added 'auth_krb5_keytab' option for overriding default keytab location. The gssapi library already uses the environment variable KRB5_KTNAME to allow overriding of the keytab location, so I didn't have to make any changes on the login process side. - - Added 'need_passdb' member to mech_module and allow having no passdb's specified if no mechanisms need them (only useful for GSSAPI at the moment) Cheers, Jelmer - -- Jelmer Vernooij <jelmer(a)samba.org> -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.2 (GNU/Linux) iD8DBQFDVgaEPa9Uoh7vUnYRAscGAJ9Fa4E5ze5IX3UeAfjwg7kzj5tgtQCcDva7 O5VTeOeJ7zpmHullxQN6q1Y= =60w7 -----END PGP SIGNATURE----- Index: configure.in =================================================================== RCS file: /home/cvs/dovecot/configure.in,v retrieving revision 1.214 diff -u -r1.214 configure.in --- configure.in 23 Sep 2005 13:28:40 -0000 1.214 +++ configure.in 19 Oct 2005 08:25:31 -0000 @@ -118,6 +118,15 @@ fi, want_bsdauth=yes) +AC_ARG_WITH(gssapi, +[ --with-gssapi Build with GSSAPI authentication support (default)], + if test x$withval = xno; then + want_gssapi=no + else + want_gssapi_yes + fi, + want_gssapi=yes) + AC_ARG_WITH(ldap, [ --with-ldap Build with LDAP support], if test x$withval = xno; then @@ -1192,6 +1201,17 @@ ]) fi +have_gssapi=no +if test $want_gssapi = yes; then + AC_CHECK_PROG(KRB5CONFIG, krb5-config, YES, NO) + if test $KRB5CONFIG = YES; then + AUTH_LIBS="$AUTH_LIBS `krb5-config --libs gssapi`" + AUTH_CFLAGS="$AUTH_CFLAGS `krb5-config --cflags gssapi`" + AC_DEFINE(MECH_GSSAPI,, Build with GSSAPI support) + have_gssapi=yes + fi +fi + if test $want_ldap = yes; then AC_CHECK_LIB(ldap, ldap_init, [ AC_CHECK_HEADER(ldap.h, [ @@ -1486,5 +1506,6 @@ echo "Building with IPv6 support .......... : $want_ipv6" echo "Building with pop3 server ........... : $want_pop3d" echo "Building with mail delivery agent .. : $want_deliver" +echo "Building with GSSAPI support ........ : $have_gssapi" echo "Building with user database modules . :$userdb" echo "Building with password lookup modules :$passdb" Index: dovecot-example.conf =================================================================== RCS file: /home/cvs/dovecot/dovecot-example.conf,v retrieving revision 1.155 diff -u -r1.155 dovecot-example.conf --- dovecot-example.conf 16 Oct 2005 14:59:12 -0000 1.155 +++ dovecot-example.conf 19 Oct 2005 08:25:31 -0000 @@ -568,9 +568,13 @@ # automatically created and destroyed as needed. #auth_worker_max_count = 30 +# Kerberos keytab to use for the GSSAPI mechanism. Will use the system +# default (usually /etc/krb5.keytab) if not specified. +#auth_krb5_keytab = + auth default { # Space separated list of wanted authentication mechanisms: - # plain digest-md5 cram-md5 apop anonymous + # plain digest-md5 cram-md5 apop anonymous gssapi mechanisms = plain # Index: src/auth/Makefile.am =================================================================== RCS file: /home/cvs/dovecot/src/auth/Makefile.am,v retrieving revision 1.47 diff -u -r1.47 Makefile.am --- src/auth/Makefile.am 7 Aug 2005 11:41:19 -0000 1.47 +++ src/auth/Makefile.am 19 Oct 2005 08:25:31 -0000 @@ -54,6 +54,7 @@ mech-cram-md5.c \ mech-digest-md5.c \ mech-ntlm.c \ + mech-gssapi.c \ mech-rpa.c \ mech-apop.c \ passdb.c \ Index: src/auth/auth.c =================================================================== RCS file: /home/cvs/dovecot/src/auth/auth.c,v retrieving revision 1.19 diff -u -r1.19 auth.c --- src/auth/auth.c 16 Oct 2005 14:06:59 -0000 1.19 +++ src/auth/auth.c 19 Oct 2005 08:25:31 -0000 @@ -56,8 +56,6 @@ } t_pop(); - if (auth->passdbs == NULL) - i_fatal("No password databases set"); if (auth->userdbs == NULL) i_fatal("No user databases set"); return auth; @@ -130,6 +128,9 @@ struct mech_module_list *list; for (list = auth->mech_modules; list != NULL; list = list->next) { + if (list->module.need_passdb && + !auth->passdbs) + break; if (list->module.passdb_need_plain && !auth_passdb_list_have_plain(auth)) break; Index: src/auth/mech-anonymous.c =================================================================== RCS file: /home/cvs/dovecot/src/auth/mech-anonymous.c,v retrieving revision 1.13 diff -u -r1.13 mech-anonymous.c --- src/auth/mech-anonymous.c 23 Apr 2005 09:11:49 -0000 1.13 +++ src/auth/mech-anonymous.c 19 Oct 2005 08:25:31 -0000 @@ -57,6 +57,7 @@ MEMBER(flags) MECH_SEC_ANONYMOUS, + MEMBER(need_passdb) TRUE, MEMBER(passdb_need_plain) FALSE, MEMBER(passdb_need_credentials) FALSE, Index: src/auth/mech-apop.c =================================================================== RCS file: /home/cvs/dovecot/src/auth/mech-apop.c,v retrieving revision 1.16 diff -u -r1.16 mech-apop.c --- src/auth/mech-apop.c 23 Apr 2005 09:11:49 -0000 1.16 +++ src/auth/mech-apop.c 19 Oct 2005 08:25:31 -0000 @@ -162,6 +162,7 @@ MEMBER(flags) MECH_SEC_PRIVATE | MECH_SEC_DICTIONARY | MECH_SEC_ACTIVE, + MEMBER(need_passdb) TRUE, MEMBER(passdb_need_plain) FALSE, MEMBER(passdb_need_credentials) TRUE, Index: src/auth/mech-cram-md5.c =================================================================== RCS file: /home/cvs/dovecot/src/auth/mech-cram-md5.c,v retrieving revision 1.20 diff -u -r1.20 mech-cram-md5.c --- src/auth/mech-cram-md5.c 8 Jan 2005 21:37:32 -0000 1.20 +++ src/auth/mech-cram-md5.c 19 Oct 2005 08:25:32 -0000 @@ -191,6 +191,7 @@ MEMBER(flags) MECH_SEC_DICTIONARY | MECH_SEC_ACTIVE, + MEMBER(need_passdb) TRUE, MEMBER(passdb_need_plain) FALSE, MEMBER(passdb_need_credentials) TRUE, Index: src/auth/mech-digest-md5.c =================================================================== RCS file: /home/cvs/dovecot/src/auth/mech-digest-md5.c,v retrieving revision 1.34 diff -u -r1.34 mech-digest-md5.c --- src/auth/mech-digest-md5.c 8 Jan 2005 21:37:32 -0000 1.34 +++ src/auth/mech-digest-md5.c 19 Oct 2005 08:25:32 -0000 @@ -619,6 +619,7 @@ MEMBER(flags) MECH_SEC_DICTIONARY | MECH_SEC_ACTIVE | MECH_SEC_MUTUAL_AUTH, + MEMBER(need_passdb) TRUE, MEMBER(passdb_need_plain) FALSE, MEMBER(passdb_need_credentials) TRUE, Index: src/auth/mech-login.c =================================================================== RCS file: /home/cvs/dovecot/src/auth/mech-login.c,v retrieving revision 1.12 diff -u -r1.12 mech-login.c --- src/auth/mech-login.c 23 Apr 2005 09:11:49 -0000 1.12 +++ src/auth/mech-login.c 19 Oct 2005 08:25:32 -0000 @@ -87,6 +87,7 @@ MEMBER(flags) MECH_SEC_PLAINTEXT, + MEMBER(need_passdb) TRUE, MEMBER(passdb_need_plain) TRUE, MEMBER(passdb_need_credentials) FALSE, Index: src/auth/mech-ntlm.c =================================================================== RCS file: /home/cvs/dovecot/src/auth/mech-ntlm.c,v retrieving revision 1.19 diff -u -r1.19 mech-ntlm.c --- src/auth/mech-ntlm.c 23 Apr 2005 09:11:49 -0000 1.19 +++ src/auth/mech-ntlm.c 19 Oct 2005 08:25:32 -0000 @@ -281,6 +281,7 @@ MEMBER(flags) MECH_SEC_DICTIONARY | MECH_SEC_ACTIVE, + MEMBER(need_passdb) TRUE, MEMBER(passdb_need_plain) FALSE, MEMBER(passdb_need_credentials) TRUE, Index: src/auth/mech-plain.c =================================================================== RCS file: /home/cvs/dovecot/src/auth/mech-plain.c,v retrieving revision 1.31 diff -u -r1.31 mech-plain.c --- src/auth/mech-plain.c 23 Apr 2005 09:11:49 -0000 1.31 +++ src/auth/mech-plain.c 19 Oct 2005 08:25:32 -0000 @@ -103,6 +103,7 @@ MEMBER(flags) MECH_SEC_PLAINTEXT, + MEMBER(need_passdb) TRUE, MEMBER(passdb_need_plain) TRUE, MEMBER(passdb_need_credentials) FALSE, Index: src/auth/mech-rpa.c =================================================================== RCS file: /home/cvs/dovecot/src/auth/mech-rpa.c,v retrieving revision 1.19 diff -u -r1.19 mech-rpa.c --- src/auth/mech-rpa.c 23 Apr 2005 09:11:49 -0000 1.19 +++ src/auth/mech-rpa.c 19 Oct 2005 08:25:32 -0000 @@ -614,6 +614,7 @@ MEMBER(flags) MECH_SEC_DICTIONARY | MECH_SEC_ACTIVE | MECH_SEC_MUTUAL_AUTH, + MEMBER(need_passdb) TRUE, MEMBER(passdb_need_plain) FALSE, MEMBER(passdb_need_credentials) TRUE, Index: src/auth/mech.c =================================================================== RCS file: /home/cvs/dovecot/src/auth/mech.c,v retrieving revision 1.54 diff -u -r1.54 mech.c --- src/auth/mech.c 7 Jan 2005 19:55:50 -0000 1.54 +++ src/auth/mech.c 19 Oct 2005 08:25:32 -0000 @@ -54,6 +54,9 @@ extern struct mech_module mech_ntlm; extern struct mech_module mech_rpa; extern struct mech_module mech_anonymous; +#ifdef MECH_GSSAPI +extern struct mech_module mech_gssapi; +#endif void mech_init(void) { @@ -65,6 +68,9 @@ mech_register_module(&mech_ntlm); mech_register_module(&mech_rpa); mech_register_module(&mech_anonymous); +#ifdef MECH_GSSAPI + mech_register_module(&mech_gssapi); +#endif } void mech_deinit(void) @@ -77,4 +83,7 @@ mech_unregister_module(&mech_ntlm); mech_unregister_module(&mech_rpa); mech_unregister_module(&mech_anonymous); +#ifdef MECH_GSSAPI + mech_unregister_module(&mech_gssapi); +#endif } Index: src/auth/mech.h =================================================================== RCS file: /home/cvs/dovecot/src/auth/mech.h,v retrieving revision 1.35 diff -u -r1.35 mech.h --- src/auth/mech.h 9 Jan 2005 16:54:48 -0000 1.35 +++ src/auth/mech.h 19 Oct 2005 08:25:32 -0000 @@ -24,6 +24,7 @@ const char *mech_name; enum mech_security_flags flags; + unsigned int need_passdb:1; unsigned int passdb_need_plain:1; unsigned int passdb_need_credentials:1; Index: src/master/auth-process.c =================================================================== RCS file: /home/cvs/dovecot/src/master/auth-process.c,v retrieving revision 1.82 diff -u -r1.82 auth-process.c --- src/master/auth-process.c 1 Oct 2005 10:52:16 -0000 1.82 +++ src/master/auth-process.c 19 Oct 2005 08:25:33 -0000 @@ -458,6 +458,8 @@ env_put("SSL_REQUIRE_CLIENT_CERT=1"); if (set->ssl_username_from_cert) env_put("SSL_USERNAME_FROM_CERT=1"); + if (set->krb5_keytab) + env_put(t_strconcat("KRB5_KTNAME=", set->krb5_keytab, NULL)); restrict_process_size(set->process_size, (unsigned int)-1); } Index: src/master/master-settings.c =================================================================== RCS file: /home/cvs/dovecot/src/master/master-settings.c,v retrieving revision 1.92 diff -u -r1.92 master-settings.c --- src/master/master-settings.c 16 Oct 2005 14:59:17 -0000 1.92 +++ src/master/master-settings.c 19 Oct 2005 08:25:33 -0000 @@ -155,6 +155,7 @@ DEF(SET_STR, username_chars), DEF(SET_STR, username_translation), DEF(SET_STR, anonymous_username), + DEF(SET_STR, krb5_keytab), DEF(SET_BOOL, verbose), DEF(SET_BOOL, debug), @@ -353,6 +354,7 @@ MEMBER(username_chars) "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ01234567890.-_@", MEMBER(username_translation) "", MEMBER(anonymous_username) "anonymous", + MEMBER(krb5_keytab) NULL, MEMBER(verbose) FALSE, MEMBER(debug) FALSE, Index: src/master/master-settings.h =================================================================== RCS file: /home/cvs/dovecot/src/master/master-settings.h,v retrieving revision 1.60 diff -u -r1.60 master-settings.h --- src/master/master-settings.h 1 Oct 2005 10:52:16 -0000 1.60 +++ src/master/master-settings.h 19 Oct 2005 08:25:33 -0000 @@ -162,6 +162,7 @@ const char *username_chars; const char *username_translation; const char *anonymous_username; + const char *krb5_keytab; int verbose, debug; int ssl_require_client_cert; --- /dev/null 2005-10-17 12:49:06.896857000 +0200 +++ src/auth/mech-gssapi.c 2005-10-19 10:17:45.000000000 +0200 @@ -0,0 +1,321 @@ +/* + * GSSAPI Module + * + * Copyright (c) 2005 Jelmer Vernooij <jelmer(a)samba.org> + * + * Related standards: + * - draft-ietf-sasl-gssapi-03 + * - RFC2222 + * + * Some parts inspired by an older patch from Colin Walters + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU Lesser General Public License as published + * by the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + */ + +#include "common.h" +#include "mech.h" +#include "passdb.h" +#include "str.h" +#include "buffer.h" +#include "hex-binary.h" +#include "safe-memset.h" +#include "hostpid.h" + +#ifdef MECH_GSSAPI + +#include <gssapi/gssapi.h> + +struct gssapi_auth_request { + struct auth_request auth_request; + gss_ctx_id_t gss_ctx; + gss_cred_id_t service_cred; + + enum { + GSS_STATE_SEC_CONTEXT, + GSS_STATE_WRAP, + GSS_STATE_UNWRAP + } sasl_gssapi_state; + + gss_name_t src_name; + + pool_t pool; +}; + +static void auth_request_log_gss_error(struct auth_request *request, OM_uint32 status_value, int status_type, const char *description) +{ + OM_uint32 message_context = 0; + OM_uint32 major_status, minor_status; + gss_buffer_desc status_string; + + do { + major_status = gss_display_status(&minor_status, status_value, + status_type, GSS_C_NO_OID, &message_context, + &status_string); + + auth_request_log_error(request, "gssapi", "While %s: %s", + description, (char *)status_string.value); + + major_status = gss_release_buffer(&minor_status, &status_string); + } while (message_context != 0); +} + +static struct auth_request *mech_gssapi_auth_new(void) +{ + struct gssapi_auth_request *request; + pool_t pool; + + pool = pool_alloconly_create("gssapi_auth_request", 512); + request = p_new(pool, struct gssapi_auth_request, 1); + request->pool = pool; + + request->gss_ctx = GSS_C_NO_CONTEXT; + + request->auth_request.pool = pool; + return &request->auth_request; +} + +static OM_uint32 obtain_service_credentials(struct auth_request *request, gss_cred_id_t *ret) +{ + OM_uint32 major_status, minor_status; + string_t *principal_name; + gss_buffer_desc inbuf; + gss_name_t gss_principal; + + principal_name = t_str_new(40); + str_append(principal_name, t_str_lcase(request->service)); + str_append(principal_name, "@"); + str_append(principal_name, my_hostname); + + auth_request_log_info(request, "gssapi", + "Obtaining credentials for %s", str_c(principal_name)); + + inbuf.length = str_len(principal_name); + inbuf.value = (void*) str_c(principal_name); + + major_status = gss_import_name(&minor_status, &inbuf, + GSS_C_NT_HOSTBASED_SERVICE, &gss_principal); + + str_free(principal_name); + + if (GSS_ERROR(major_status)) { + auth_request_log_gss_error(request, major_status, GSS_C_GSS_CODE, + "importing principal name"); + return major_status; + } + + major_status = gss_acquire_cred(&minor_status, gss_principal, 0, + GSS_C_NULL_OID_SET, GSS_C_ACCEPT, ret, NULL, NULL); + + if (GSS_ERROR(major_status)) { + auth_request_log_gss_error(request, major_status, GSS_C_GSS_CODE, + "acquiring service credentials"); + auth_request_log_gss_error(request, minor_status, GSS_C_MECH_CODE, + "acquiring service credentials"); + return major_status; + } + + gss_release_name(&minor_status, gss_principal); + + return major_status; +} + +static void gssapi_sec_context(struct gssapi_auth_request *request, + gss_buffer_desc inbuf) +{ + OM_uint32 major_status, minor_status; + gss_buffer_desc outbuf; + + major_status = gss_accept_sec_context ( + &minor_status, + &request->gss_ctx, + request->service_cred, + &inbuf, + GSS_C_NO_CHANNEL_BINDINGS, + &request->src_name, + NULL, /* mech_type */ + &outbuf, + NULL, /* ret_flags */ + NULL, /* time_rec */ + NULL /* delegated_cred_handle */ + ); + + if (GSS_ERROR(major_status)) { + auth_request_log_gss_error(&request->auth_request, major_status, GSS_C_GSS_CODE, + "processing incoming data"); + auth_request_log_gss_error(&request->auth_request, minor_status, GSS_C_MECH_CODE, + "processing incoming data"); + + auth_request_fail(&request->auth_request); + return; + } + + if (major_status == GSS_S_COMPLETE) { + request->sasl_gssapi_state = GSS_STATE_WRAP; + auth_request_log_info(&request->auth_request, "gssapi", + "security context state completed."); + } else { + auth_request_log_info(&request->auth_request, "gssapi", + "Processed incoming packet correctly, waiting for another."); + } + + request->auth_request.callback(&request->auth_request, + AUTH_CLIENT_RESULT_CONTINUE, + outbuf.value, outbuf.length); + + major_status = gss_release_buffer(&minor_status, &outbuf); +} + +static void gssapi_wrap(struct gssapi_auth_request *request, + gss_buffer_desc inbuf) +{ + OM_uint32 major_status, minor_status; + gss_buffer_desc outbuf; + char ret[4]; + + /* The clients return data should be empty here */ + + ret[0] = 0x01; /* Only authentication, no integrity or confidentiality protection (yet?) */ + ret[1] = 0xFF; + ret[2] = 0xFF; + ret[3] = 0xFF; + + inbuf.length = 4; + inbuf.value = ret; + + major_status = gss_wrap(&minor_status, request->gss_ctx, 0, + GSS_C_QOP_DEFAULT, + &inbuf, NULL, &outbuf); + + if (GSS_ERROR(major_status)) { + auth_request_log_gss_error(&request->auth_request, major_status, GSS_C_GSS_CODE, + "sending security layer negotiation"); + auth_request_log_gss_error(&request->auth_request, minor_status, GSS_C_MECH_CODE, + "sending security layer negotiation"); + auth_request_fail(&request->auth_request); + return; + } + + auth_request_log_info(&request->auth_request, "gssapi", + "Negotiated security layer"); + + request->auth_request.callback(&request->auth_request, + AUTH_CLIENT_RESULT_CONTINUE, + outbuf.value, outbuf.length); + + major_status = gss_release_buffer(&minor_status, &outbuf); + + request->sasl_gssapi_state = GSS_STATE_UNWRAP; +} + +static void gssapi_unwrap(struct gssapi_auth_request *request, + gss_buffer_desc inbuf) +{ + OM_uint32 major_status, minor_status; + gss_buffer_desc outbuf; + + major_status = gss_unwrap(&minor_status, request->gss_ctx, + &inbuf, &outbuf, NULL, NULL); + + if (GSS_ERROR(major_status)) { + auth_request_log_gss_error(&request->auth_request, major_status, GSS_C_GSS_CODE, + "final negotiation: gss_unwrap"); + auth_request_fail(&request->auth_request); + return; + } + + if (outbuf.length <= 4) { + auth_request_log_error(&request->auth_request, "gssapi", + "Invalid response length"); + auth_request_fail(&request->auth_request); + return; + } + + request->auth_request.user = p_strndup(request->auth_request.pool, + ((unsigned char*) outbuf.value)+4, + outbuf.length-4); + + auth_request_success(&request->auth_request, NULL, 0); +} + +static void +mech_gssapi_auth_continue(struct auth_request *request, + const unsigned char *data, size_t data_size) +{ + struct gssapi_auth_request *gssapi_request = + (struct gssapi_auth_request *)request; + gss_buffer_desc inbuf; + + inbuf.value = (char*) data; + inbuf.length = data_size; + + switch (gssapi_request->sasl_gssapi_state) { + case GSS_STATE_SEC_CONTEXT: gssapi_sec_context(gssapi_request, inbuf); break; + case GSS_STATE_WRAP: gssapi_wrap(gssapi_request, inbuf); break; + case GSS_STATE_UNWRAP: gssapi_unwrap(gssapi_request, inbuf); break; + } +} + +static void +mech_gssapi_auth_initial(struct auth_request *request, + const unsigned char *data, size_t data_size) +{ + OM_uint32 major_status; + struct gssapi_auth_request *gssapi_request = + (struct gssapi_auth_request *)request; + + major_status = obtain_service_credentials(request, &gssapi_request->service_cred); + + if (GSS_ERROR(major_status)) { + auth_request_internal_failure(request); + return; + } + gssapi_request->src_name = GSS_C_NO_NAME; + + gssapi_request->sasl_gssapi_state = GSS_STATE_SEC_CONTEXT; + + if (data_size == 0) { + /* The client should go first */ + request->callback(request, + AUTH_CLIENT_RESULT_CONTINUE, + NULL, 0); + } else { + mech_gssapi_auth_continue(request, data, data_size); + } +} + + +static void +mech_gssapi_auth_free(struct auth_request *request) +{ + OM_uint32 major_status, minor_status; + struct gssapi_auth_request *gssapi_request = + (struct gssapi_auth_request *)request; + + major_status = gss_delete_sec_context(&minor_status, + &gssapi_request->gss_ctx, + GSS_C_NO_BUFFER); + + major_status = gss_release_cred(&minor_status, &gssapi_request->service_cred); + + pool_unref(request->pool); +} + +const struct mech_module mech_gssapi = { + "GSSAPI", + + MEMBER(flags) 0, + + MEMBER(need_passdb) FALSE, + MEMBER(passdb_need_plain) FALSE, + MEMBER(passdb_need_credentials) FALSE, + + mech_gssapi_auth_new, + mech_gssapi_auth_initial, + mech_gssapi_auth_continue, + mech_gssapi_auth_free +}; + +#endif Index: AUTHORS =================================================================== RCS file: /home/cvs/dovecot/AUTHORS,v retrieving revision 1.11 diff -u -r1.11 AUTHORS --- AUTHORS 19 Aug 2004 03:56:01 -0000 1.11 +++ AUTHORS 19 Oct 2005 08:38:49 -0000 @@ -12,6 +12,8 @@ Joshua Goodall <joshua(a)roughtrade.net> (src/auth/password-scheme-cram-md5.c, src/util/dovecotpw.c) +Jelmer Vernooij <jelmer(a)samba.org> (src/auth/mech-gssapi.c) + This product includes software developed by Computing Services at Carnegie Mellon University (http://www.cmu.edu/computing/) (src/lib/base64.c, src/lib/mkgmtime.c)

3 10

[Dovecot] "passdb" userdb
by Thomas Hummel 20 Oct '05

20 Oct '05

Hello Timo, How exactly would translate the "passdb" userdb example which is in the Wiki for SQL auth with LDAP auth, both in dovecot.conf and dovecot-ldap.conf ? -- Thomas Hummel | Institut Pasteur <hummel(a)pasteur.fr> | Pôle informatique - systèmes et réseau

2 3

[Dovecot] Large IMAP operations tend to timeout and cause problems?
by Alen Salamun 20 Oct '05

20 Oct '05

Hello all! I have moved from Courier-IMAP to Dovecot some month ago. It is quite stable on everyday use (1.0alpha4) but it has constant problems with large IMAP/SSL operations. We use Maildir format. For example if I select 400 messages, mark them deleted and use "purge command" in Thunderbird (to actually delete them) TB starts to do something and runs and runs and runs....Then I get script timed out errror and I have to restart TB. That never happened with Courier-Imap. Same thing happens for example moving 1000msgs to another folder or something like that. Another thing is still that from time to time dovecot indexes get corrupted and users can't access some folders. Then I have to delete dovecot* in that Maildir folder and it works again. Any thoughts on that please? BR, Alen

4 4