- dovecot - dovecot.org

[Dovecot] 1.0.alpha3 plaintext authentication problem
by Sergey Redin 28 Oct '05

28 Oct '05

Hello everyone, Since the upgrade to 1.0.alpha3 I experience a strange problem with plaintext authentication. I successfully login first few (2-5) times after the dovecot restart, and then on a reason I cannot login any more (both via POP3 and IMAP). I tried to find out what could be the reason for this but I failed. Nothing is changed inside the user's home directory or /var/run/dovecot, but I cannot login any more. I guess there is something wrong inside dovecot-auth od dovecot process itself. I just start to receive "01 NO Authentication failed." or "-ERR Authentication failed." from dovecot and "Authenticate PLAIN failed: Unsupported authentication mechanism.: method=PLAIN" in my logs, even though I used the same PLAIN two minutes ago without a problem. Here is my dovecot.conf: nevoservice# egrep -v '^[ ]*(\#.*)?$' /usr/local/etc/dovecot.conf protocols = imap pop3 ssl_disable = no ssl_cert_file = /etc/mail/certs/server.crt ssl_key_file = /etc/mail/certs/server.key disable_plaintext_auth = no log_path = /var/log/dovecot/log info_log_path = /var/log/dovecot/info login_user = dovecot login_processes_count = 1 verbose_proctitle = no first_valid_gid = 0 mail_extra_groups = mail mail_debug=yes default_mail_env = mbox:/var/mail/%u maildir_copy_with_hardlinks = yes protocol imap { imap_client_workarounds = delay-newmail outlook-idle netscape-eoh tb-extra-mailbox-sep } protocol pop3 { pop3_uidl_format = %08Xu%08Xv pop3_client_workarounds = outlook-no-nuls oe-ns-eoh } auth_verbose = yes auth_debug = yes auth default { mechanisms = plain passdb passwd-file { args = /usr/local/etc/dovecot.passwd } userdb passwd-file { args = /usr/local/etc/dovecot.passwd } user = root } Here are two lines in dovecot.passwd which define the user that I use: wail:password-hash:1050:1032:Administrator wail.spb.ru:/home/wail.spb.ru:::/var/mail/wail wail@nevoservice.ispvds.com:password-hash:1050:1032:Administrator wail.spb.ru:/home/wail.spb.ru:::/var/mail/wail A few lines from my /var/log/dovecot/info file: dovecot: Oct 10 02:03:11 Info: auth(default): client in: AUTH 1 PLAIN service=POP3 lip=82.146.50.34 rip=82.146.63.23 resp=AHdhaWwAVGxNSFRuUlI2 dovecot: Oct 10 02:03:11 Info: auth(default): client out: OK 1 user=wail dovecot: Oct 10 02:03:11 Info: auth(default): master in: REQUEST 3 53919 1 dovecot: Oct 10 02:03:11 Info: auth(default): master out: USER 3 wail uid=1050 gid=1032 home=/home/wail.spb.ru mail=/var/mail/wail dovecot: Oct 10 02:03:11 Info: pop3(wail): Effective uid=1050, gid=1032 dovecot: Oct 10 02:03:11 Info: pop3(wail): maildir autodetect: stat(/var/mail/wail/cur) failed: Not a directory dovecot: Oct 10 02:03:11 Info: pop3(wail): mbox autodetect: data=/var/mail/wail dovecot: Oct 10 02:03:11 Info: pop3(wail): mbox autodetect: INBOX file: yes (/var/mail/wail) dovecot: Oct 10 02:03:11 Info: pop3(wail): mbox: data=/var/mail/wail dovecot: Oct 10 02:03:11 Info: pop3(wail): mbox: root exists (/home/wail.spb.ru/mail) dovecot: Oct 10 02:03:11 Info: pop3(wail): mbox: root=/home/wail.spb.ru/mail, index=/home/wail.spb.ru/mail, inbox=/var/mail/wail dovecot: Oct 10 02:03:11 Info: pop3-login: Login: user=<wail>, method=PLAIN, rip=82.146.63.23, lip=82.146.50.34 dovecot: Oct 10 02:03:13 Info: pop3(wail): Logout. top=0/0, retr=0/ del=0/3, size=5372 dovecot: Oct 10 02:03:20 Info: auth(default): client in: AUTH 1 PLAIN service=POP3 lip=82.146.50.34 rip=82.146.63.23 resp=AHdhaWwAVGxNSFRuUlI2 dovecot: Oct 10 02:03:20 Info: auth(default): client out: OK 1 user=wail dovecot: Oct 10 02:03:20 Info: auth(default): master in: REQUEST 4 53918 1 dovecot: Oct 10 02:03:20 Info: auth(default): master out: USER 4 wail uid=1050 gid=1032 home=/home/wail.spb.ru mail=/var/mail/wail dovecot: Oct 10 02:03:20 Info: pop3(wail): Effective uid=1050, gid=1032 dovecot: Oct 10 02:03:20 Info: pop3(wail): maildir autodetect: stat(/var/mail/wail/cur) failed: Not a directory dovecot: Oct 10 02:03:20 Info: pop3(wail): mbox autodetect: data=/var/mail/wail dovecot: Oct 10 02:03:20 Info: pop3(wail): mbox autodetect: INBOX file: yes (/var/mail/wail) dovecot: Oct 10 02:03:20 Info: pop3(wail): mbox: data=/var/mail/wail dovecot: Oct 10 02:03:20 Info: pop3(wail): mbox: root exists (/home/wail.spb.ru/mail) dovecot: Oct 10 02:03:20 Info: pop3(wail): mbox: root=/home/wail.spb.ru/mail, index=/home/wail.spb.ru/mail, inbox=/var/mail/wail dovecot: Oct 10 02:03:20 Info: pop3-login: Login: user=<wail>, method=PLAIN, rip=82.146.63.23, lip=82.146.50.34 dovecot: Oct 10 02:03:21 Info: pop3(wail): Logout. top=0/0, retr=0/ del=0/3, size=5372 dovecot: Oct 10 02:03:28 Info: pop3-login: Authenticate PLAIN failed: Unsupported authentication mechanism.: method=PLAIN, rip=82.146.63.23, lip=82.146.50.34 dovecot: Oct 10 02:03:30 Info: pop3-login: Aborted login: method=PLAIN, rip=82.146.63.23, lip=82.146.50.34 We see here two successfull logins with PLAIN and then suddenly PLAIN becomes unsupported. I run dovecot 1.0.alpha3 on FreeBSD 4.11, it was installed from ports and then I edited dovecot.conf (and created dovecot.passwd). Any help would be really appreciated. Sergey Redin.

2 1

Re: [Dovecot] Dovecot Alpha 4
by Tomi Hakala 28 Oct '05

28 Oct '05

Marcus Don wrote: > How confident are you of the CVS? Any idea when the next (perhaps beta?) > release will be? I run CVS code most of the time, but only with handful of users and with them it has been working OK. I wouldn't use CVS code in production without thorough stress testing in a lab first. >>Have you thought of clustered file system to go with your Dovecot >>hosts and CLARiiON device? > I'm not sure why this would benefit us at the moment. Before we switched to > maildirs, the bottleneck we were experiencing at busy times was the ethernet > speed, not the storage device speed. > Is there another reason you suggested this? No, I'm just not very fond of NFS myself but it seems that for you it is doing job pretty well. Your CLARiiON is a normal SAN device and you have some singe host providing NFS? It didn't quite open to me how your mail spool is set up, is it some meta LUN distributed over two disk arrays or do you just have one huge LUN and mirror it between two arrays? -- Tomi Hakala

1 0

[Dovecot] problem with thunderbird
by Alfonso Sparano 28 Oct '05

28 Oct '05

Hi all, I've a problem with thunderbird 1.0.6/7/1.5 and dovecot pop3 I've tried dovecot alpha 3 and 1.0 stable but neither one is capable of downloading mails. Nothing is written into the log. I've tried also to delete dovecot.index* and dovecot-uidlist into the Maildir directory. The cur directory contains more than 8100 messages (single files) Anyone has founded this problem? Alfonso

3 3

[Dovecot] Corrupted index cache file [...] invalid record size
by Lorens 28 Oct '05

28 Oct '05

I get this error every single time some of my users log in: Error: POP3(${user}): Corrupted index cache file /${userdir}/dovecot.index.cache: invalid record size The named file seems to be deleted as soon as corruption is found. This only affects some users. I thought the affected users had in common that they are using POP3 in "leave-messages-on-server" mode, and that their mailboxes are big ( > 100 MB). However I've found a few counterexamples, few and far between (not every login) but still. Google's no help, for once :-) Could this be a locking problem, a bug with big Maildirs (counterexamples being few), or what? I know some of my users have had problems logging several IMAP clients into the smae account at the same time, wouldn't put it past some of those with problems to be trying the same with POP. I know that a detected cache corruption is merely that, but I find the error message annoying :-) Configuration: v1.0-stable (0.99.20050712-2 from debian unstable) Maildir only Default locking (nothing mentioned in conf file) Access over NFS mmap_disable = yes (wiki says to disable mmap to use indexes on NFS). Thanks for any pointers.

2 1

[Dovecot] 1.0alpha3: assert and core
by Jeff A. Earickson 28 Oct '05

28 Oct '05

Hi, An assert and core with 1.0alpha3 on Solaris 9, mbox format, imap only, compiled with gcc 4.0.1. The syslog message was: imap(user): file message-body-search.c: line 393 (message_body_search_ctx): assertion failed: (input->v_offset <= part->physical_pos) gdb core dump analysis is attached. Jeff Earickson Colby College

2 1

[Dovecot] hangup with corrupted indexes
by Sergey Redin 28 Oct '05

28 Oct '05

Hello everyone, I remember that Timo wrote in this maillist that if index files are corrupted, dovecot should be OK and just recreate it. So I report here a bug: I have corrupted indexes which make pop3 and imap processes to hangup right after the first list command. The process does not respond and eats 90% of CPU. Just unpack http://redin.info/dovecot-corrupted-index.tgz (10 Kb) into a user's IMAP root (I have mbox storage, but the same thing for maildir with this indexes), do the chown, and try to check the email. I know that the problem can be fixed by removing the index files or using INDEX=MEMORY, but it is claimed that dovecot is failsafe and can deal with any kind of corrupted index files. This is the only reason why I report it here. I have 1.0.alpha4 on FreeBSD 4.11 (installed from ports). Best regards, Sergey Redin.

2 1

[Dovecot] Dovecot problems on Debian
by Jaldhar H. Vyas 28 Oct '05

28 Oct '05

If you have been bitten by bug #334180 and dovecot 1.0alpha3-2.0.1 rest assured the problem is being worked on. In the meantime you should downgrade to -2 which can be found at: http://snapshot.debian.net/archive/2005/10/08/debian/pool/main/d/dovecot/ -- Jaldhar H. Vyas <jaldhar(a)debian.org> La Salle Debain - http://www.braincells.com/debian/

1 0

[Dovecot] Weirdness with authentication/1.0a4.
by Ashley Penney 28 Oct '05

28 Oct '05

Hi, FreeBSD has recently upgraded their port from 0.99 to 1.0a4, and this has caused me an absolute nightmare of a situation. In a nutshell I replaced my conf with the -example, and modified almost nothing. I made some SSL certs and put them in place, left it with imap/pop/pam etc. Whenever users tried to connect to the remote address, cara.untaken.net, I would get: Oct 27 18:31:14 cara dovecot: Dovecot v1.0.alpha4 starting up Oct 27 18:31:33 cara dovecot: imap-login: Login failed: Plaintext authentication disabled: rip=217.206.62.50, lip=217.206.62.50 Oct 27 18:31:33 cara dovecot: imap-login: Disconnected: rip=217.206.62.50, lip=2 17.206.62.50 However, plaintext authenication was most definitely not disabled. Using www.untaken.net/mail/ which is hosted on the same box as dovecot I could get this plaintext failure constantly using cara.untaken.net, but switching to 'localhost' instead would work fine, despite being the same physical machine. I'm baffled at what could cause this, I put my currently conf over at www.untaken.net/dovecot/ just for reference, I've modified various bits now from the default in a desperate attempt to get it working. Has anyone else seen anything like it? -- <EisernLint> i am considering taking pilates classes.

2 1

[Dovecot] Authentication using native MySQL PASSWORD() function
by Tom Sommer 28 Oct '05

28 Oct '05

Hi, I have a little problem, I need to adapt a setup that currently uses the native MySQL PASSWORD() function to encrypt passwords for e-mail accounts. I plan on using Dovecot with SQL to authenticate on my server, is there a password scheme that fits this authentication method? Any help is appreciated -- Tom Sommer

3 11

[Dovecot] Strange Disconnect Problem
by Marc Perkel 27 Oct '05

27 Oct '05

It's only happening with one user but for some reason I can't get this person logged in. And I'm using his ID on my computer and my ID works. Using two different IMAP clients. What would be causeing the "disconnected" to happen? dovecot: Oct 17 10:56:43 Info: imap-login: Login: user=<lowsley(a)cbsyellowpgs.com>, method=PLAIN, rip=65.37.192.182, lip=69.50.231.10 dovecot: Oct 17 10:56:47 Info: imap-login: Disconnected: user=<john(a)sembrot.com>, method=PLAIN, rip=204.95.16.61, lip=69.50.231.10

2 1

[Dovecot] Shared Folder usage alpha3
by Ralf Zerres 27 Oct '05

27 Oct '05

Dear List, this is my first mail to this list. I'v tried to carefully review all given information towards the Shared Folder subject I could find in the archive / mailing list / wiki. And so far I'm also aware that Timo hasn't put it on the active tasklist for the 1.0 release. Citing the track http://dovecot.org/pipermail/dovecot/2003-October/002493.html I was wandering, wether any further attempt has been made, to use the given functionality for real work. To be more precise, wether anybody has done - delivery of mailboxes to a shared maildir - offering these maildirs through a given namespace Before bothering here without any local experience, I'v set up a dov-server (1.0alpha3) on a debian sid. As an MTA postfix is doing the job. Within postfix I did set up a virtual domain and the needed maps (mailbox, alias). I'm able to deliver successful with the standard postfix functionality to the given filesystem structure (fs=ext3). If it is on any help, I can post the relevant config files. As good practice, all mail is delivered to given mailbox-owner with 0600 permission for the new subdir. Hence, can't be seen by any shared-maildir user (unless owner uid matches:) >From here on I'v tried to switch from debians default postfix delivery-strategy (mailbox_command = procmail -a "$EXTENSION") to given dovcot deliver process (mailbox_command = /usr/lib/dovecot/deliver). The primary aim is to define a strategy to deliver with 0660 rights which will enable group read-write access to the given Mailstore. I have adopted the dovecot.conf enableing a listening socket ... default_mail_env = maildir:/home/%u/Maildir: \ INDEX=/home/%u/MaildirIndex namespace private { separator = / prefix = inbox = yes } namespace public { # the prefix needs to be postponed with the separator prefix = Public/ # the location path given as [<mailbox-type>:]<path>/mailbox location = maildir:/home/SharedMaildirs separator = / inbox = no hidden = no } auth default { ... # using deliver through a socket socket listen { master { path = /var/run/dovecot/auth-master mode = 0666 } } } and configured the subsequent dovecot-deliver.conf ... auth_socket_path = /var/run/dovecot/auth-master mail = maildir:%h/Maildir/ umask = 0007 auth_verbose = yes use_syslog = yes just to see, whether a manual call /usr/lib/dovecot/dovecot-deliver -d <user> <testmail would do the trick. Well, I got the delivered mail, but files are not installed with the etimated previledges. Can someone can point me to the clou? Greetings Ralf PS: I also read about posix-acl's support. But my test's didn't allow a successful read ....

2 1

[Dovecot] Alpha4 pre-release, please upgrade
by Timo Sirainen 27 Oct '05

27 Oct '05

Please try if http://dovecot.org/nightly/dovecot-latest.tar.gz (or the CVS directly) works with you. I made a lot of changes to dovecot-auth, so I wouldn't want to make alpha4 release without some more testing in different environments. I'll release alpha4 in a few days, but it'll be basically same as this unless more bugs get fixed. Some of the changes include: - IMAP: We might have sent extra EXPUNGE messages when output buffer got full. This could have caused various sorts of very bad behavior. This is the main reason why everyone should upgrade as soon as possible. - POP3: We sent duplicate replies for LIST command when output buffer got full. Probably caused Thunderbird's duplicate deletion bugs? (Although I thought someone checked that Dovecot's reply was correct when the bug occurred?) - pop3_uidl_format setting is now required to be explicitly set in configuration file for pop3 to work at all. I want to get rid of the old default setting which breaks Outlooks, and simply changing the default would break existing setups. - Multiple passdbs and userdbs of same type can now be added with different parameters. Some people asked about this earlier. - Authentication cache works now with other than SQL and LDAP passdbs. Some passdbs such as PAM require some additional settings to work. See example config file. - Some other fixes to authentication cache related to failure handling and non-plaintext authentication. - deny passdb wasn't working for non-plaintext authentication.

8 21

[Dovecot] auth
by Riccardo Bini 27 Oct '05

27 Oct '05

It's possible to have an auth order so if the first is true skip the other ones? Bye Rick

2 1

[Dovecot] pop3 behaviour
by Krzysztof Janiszewski - IT Partner 27 Oct '05

27 Oct '05

Hi! I'v installed dovecot over um-pop3 today. Dovecot has only pop3 enabled. imap will be enabled later. But there is one issue - on some accounts, after receiving mail to Outlook Express, mail is not deleted from /var/mail/username mbox file, and on most it is deleted. Why it works in that way? Best regards Krzysztof

2 1

[Dovecot] how to configure dovecot, Error
by Roland Schmid 27 Oct '05

27 Oct '05

Hi, we are using Squirrelmail, imapd is dovecot. OS is Debian Sarge. When I want to login with Squirrelmail the connection to the imap-server is aborted. /var/log/mail.log gives the these log-entries: Oct 25 14:39:36 webserver dovecot: imap(rs.messegrafik-schreiber.de): mbox: Can't create root IMAP folder /home/rs.messegrafik-schreiber.de/mail: Permission denied Oct 25 14:39:36 webserver dovecot: imap(rs.messegrafik-schreiber.de): MAIL environment missing and autodetection failed (home /home/rs.messegrafik-schreiber.de) Oct 25 14:39:36 webserver dovecot: imap-login: Login: user=<rs.messegrafik-schreiber.de>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, secured Oct 25 14:39:36 webserver dovecot: child 31339 (imap) returned error 89 Need help, thanks. Roland

2 1

[Dovecot] Pop3 Pipeing
by Mark Smith 27 Oct '05

27 Oct '05

How would I go about and setup pop3 pipeing with dovecot I have instaled Perldesk and there instructions is for only Exim or Sendmail. Regards, _________________________________________________________________ MSN Messenger 7.5 is now out. Download it for FREE here. http://messenger.msn.co.uk

2 1

[Dovecot] 1.0alpha4: mbox-lock asserts and cores
by Jeff A. Earickson 27 Oct '05

27 Oct '05

Timo, I upgraded from alpha3 to alpha4 yesterday, and I am seeing a few of the following asserts: imap(user): file mbox-lock.c: line 379 (mbox_lock_fcntl): assertion failed: (lock_type == F_UNLCK) Gdb info on a couple of the cores is attached. It looks like the arg lock_type for mbox_lock_fcntl() is not getting passed in correctly, like the enum "enum mbox_lock_type type" in mbox_lock_list() is not getting set or used correctly so that lock_data[type].func is wrong. Hmmm. My setup: Solaris 9, mbox, dovecot built with gcc 4.0.2. The filesystem for INBOXes is NFS mounted from another Solaris 9 system, but the index files reside on local filesystems. My setting for "lock_method = fcntl", per your release notes. I did not change the default setting of "mmap_disable = no" because my index files are local. Jeff Earickson Colby College

2 1

[Dovecot] USER environment missing
by Ed 27 Oct '05

27 Oct '05

I am new to dovecot, and while I have the pop server running fine, I am having trouble with the imap server. It starts, but when I try to connect, I get an error: telnet localhost imap Trying 127.0.0.1... Connected to localhost.localdomain. Escape character is '^]'. imap(??): Fatal: USER environment missing Connection closed by foreign host. Not sure where to start on this one. (or what to show you). I am running under Ubuntu Linux, usiang postfix, fetchmail, etc.. (not sure that matters). -- No virus found in this outgoing message. Checked by AVG Anti-Virus. Version: 7.0.344 / Virus Database: 267.12.4/143 - Release Date: 10/19/2005

2 1

[Dovecot] alpha4 and zlib-plugin?
by Jeff A. Earickson 27 Oct '05

27 Oct '05

Hi, I saw the zlib-plugin reference in the alpha4 ChangeLog notes are searched the list for info about it. The only reference I found was from Timo back in March 2005. Questions: 1) Is this going to become a standard part of version 1.0? 2) Any plans or ability to make it read/write to a gzipped mailbox, or is this possible? Or will it always be read-only? 3) How does a mailbox get gzipped? From within dovecot somehow, or only by external action? Jeff Earickson Colby College

3 2

Re: [Dovecot] pop3 behaviour
by Krzysztof Janiszewski - IT Partner 26 Oct '05

26 Oct '05

Hello! > Do you have reason to believe that the clients are issuing a delete > command and that the mail is incorrectly being left on the server OR do > they have a 'keep mail on server' option checked? I'm sure thet they have 'keep mail on server' unchecked. When uw-ipop3d was used, mail was correctly deleted. Best regards Krzysztof

1 0

[Dovecot] Two "pre-migration" questions
by Alan Mead 26 Oct '05

26 Oct '05

I have read the migration docs. They seem to relate to migrating from one imap product to dovecot on the same server. I'm interested in migrating my Maildir-formatted email from one server to another. 1. Can I tar my ~/mail directory on serverX.com, untar it on a different physical serverY.com (initially with a different domain name), and still see my mail when I access imap.serverY.com <http://imap.serverY.com> (dovecot's running on serverY.com .. but let me know if there are any tricks that I need to make this work). 2. If I maintain large mailboxes and check my mail frequently, how does the dovecot server load compare to something like apache or Samba? I ask because I have a vanity domain that I mostly use for email and I want to ensure that I can migrate my precious emails to a new service provider. And the provider that I'm considering offers low-cost virtual dedicated servers but meters usage (including RAM and CPU). One of the reasons I have question #1 is that the server name seems to be part of the email file names... amead:/home/amead> ls mail/cur | head -2 2022292282.22297_0.vulcan.rootr.net:2,S 2022312282.3225_0.vulcan.rootr.net:2,S (rootr.net <http://rootr.net> is my current provider, not my vanity domain; vulcan is the name of their mailserver) I don't know what effect this will have, if any? Thanks! -Alan

3 3

[Dovecot] [Fwd: Dovecot disconnecting users at login for inactivity]
by Chris Liljenstolpe 25 Oct '05

25 Oct '05

3 3

[Dovecot] choosing syslog facility?
by Dominik Werder 25 Oct '05

25 Oct '05

Hello! How can I log dovecots messages into a separate file? Is it possible to set a custom syslog facility name somehow? I can't set the log file in dovecot because dovecot does not automatically rotate the logs like syslog does.. thank you! Dominik

4 4

[Dovecot] alpha4 - Unknown passdb driver 'pam'
by Willem Riede 25 Oct '05

25 Oct '05

Does anybody see this? Oct 24 19:41:44 athena dovecot: Dovecot v1.0.alpha4 starting up Oct 24 19:41:45 athena dovecot: Auth process died too early - shutting down Oct 24 19:41:45 athena dovecot: auth(default): Unknown passdb driver 'pam' Oct 24 19:41:45 athena dovecot: child 3374 (auth) returned error 89 This is on Fedora FC5-devel x86_64 (opteron), which is certainly pam based. FWIW, if I switch to passwd dovecot alph4 runs fine (so far). Regards, Willem Riede.

2 1

[Dovecot] Pop3 Pipeing
by Mark Smith 24 Oct '05

24 Oct '05

Does anyone know how to pipe with dovecot-pop3d? Please help Thanks _________________________________________________________________ Be the first to hear what's new at MSN - sign up to our free newsletters! http://www.msn.co.uk/newsletters

1 0

[Dovecot] debian dovecot upgrade
by Brent Clark 24 Oct '05

24 Oct '05

Hi all I find this highly upsetting, I just upgrade my debian dovecot, and I specified that I dont want to upgrade the conf file. and on restarting, I get this in my syslog. Oct 24 17:33:33 mail dovecot: Dovecot v1.0.alpha3 starting up Oct 24 17:33:34 mail dovecot: Login process died too early - shutting down Oct 24 17:33:34 mail dovecot: imap-login: Can't load certificate file /etc/ssl/certs/dovecot.pem: error:25066067:DSO support routines:DLFCN_LOAD:could not load the shared library Oct 24 17:33:34 mail dovecot: imap-login: Can't load certificate file /etc/ssl/certs/dovecot.pem: error:25066067:DSO support routines:DLFCN_LOAD:could not load the shared library Oct 24 17:33:34 mail dovecot: child 5983 (login) returned error 89 Oct 24 17:33:34 mail dovecot: child 5985 (login) returned error 89 mail:~# Wierd thing is, at no time am I asking for ssl, and in my conf file I have it hashed out. mail:~# cat /etc/dovecot/dovecot.conf | grep ssl # --with-ssldir=/etc/ssl #ssl_listen = #ssl_disable = no #ssl_cert_file = /etc/ssl/certs/dovecot.pem #ssl_key_file = /etc/ssl/private/dovecot.pem #ssl_ca_file = #ssl_verify_client_cert = no #ssl_parameters_file = /var/run/dovecot/ssl-parameters.dat #ssl_parameters_regenerate = 24 #ssl_cipher_list = all:!LOW #verbose_ssl = no #ssl_require_client_cert = no mail:~# I tried on the command line # dovecot -F -c dovecot.conf my version is: mail:~# dovecot --version 1.0.alpha3 mail:~# Would anyone perhaps know why I cant get the daemon started. Kind Regards Brent Clark

2 2

[Dovecot] dual auth with real users and virtual users
by Erick Perez 24 Oct '05

24 Oct '05

Hi, im using 0.99 stable in RPM form, Im using this for postfix+dovecot+real unix users, now i tried to enable virtual support with this: protocols = imap pop3 ssl_disable = yes log_path = /var/log/dovecot.log info_log_path = /var/log/dovecot.info login_user = dovecot mail_extra_groups = mail auth = default auth_mechanisms = plain auth_passdb = pam auth_userdb = passwd auth_userdb = passwd-file /etc/vhosts/userdb auth_passdb = passwd-file /etc/vhosts/passwd The above configuration works for local users but is not working for virtual users, it produces the error: dovecot-auth: Oct 21 00:19:14 Info: PAM: pam_authenticate(erickperez) failed: Authentication failure obviously the user erickperez exists in /etc/vhosts/userdb so PAM will fail. Im using 0.99 release. Thanks, -- ------------------------------------------- Erick Perez Linux User 376588 http://counter.li.org/ (Get counted!!!) Panama, Republic of Panama

2 2

[Dovecot] 1.0alpha4: drowning in asserts/cores
by Jeff A. Earickson 24 Oct '05

24 Oct '05

Timo, I have had to drop back to alpha3 because I found a pile of core files on my imap server this morning, from the weekend. They are all from the assert: imap(user): file mbox-lock.c: line 379 (mbox_lock_fcntl): assertion failed: (lock_type == F_UNLCK) I reported this issue to the list last Friday. Help... Jeff Earickson Colby College

1 0

[Dovecot] Case of %n (feauture request)
by Alexander Shikoff 24 Oct '05

24 Oct '05

Hello, I'm using dovecot not for a long time but I've newer seen most powerful and handy POP3/IMAP server. Thank Timo for dovecot; thank community for help! I would like to notice that %n is case-sensitive: it always stores user part of login without case conversions. As a result there are some inconveniences with virtual user organization, for example: password_query = SELECT `password` FROM `users` WHERE login = '%u' user_query = SELECT "mbox:/var/mail/virtual/%d/%n:INBOX=/var/mail/virtual/%d/%n:INDEX=MEMORY" AS `mail`, 101 AS `uid`, 101 AS `gid` FROM users WHERE login = '%u' In this example authentication works perfectly but user can not access it's mailbox because all mailbox names are lower-case. I think it would be more handy to make %d, %n and %u aliases lower-case and introduce three new aliases %D %N %U which store values without case conversions. But I'm not enough skilled in C to write a patch... and now I'm waiting for comments on this and answer from the developer. Thanks in advance, Alexander. -- Kind Regards, Alexander Shikoff minotaur(a)crete.org.ua

2 2

Re: [Dovecot] Same email recieved
by Bob Hope 24 Oct '05

24 Oct '05

Andrew Hutchings wrote: > On Fri, 2005-10-14 at 12:46 -0500, Bob Hope wrote: > >> They are using Outlook. I'm not seeing anything about UIDs of mails >> in dovecot.conf. I'm using dovecot 0.99.14 presently. >> >> Regards, >> >> Savage >> > > > Ah, afraid I can't really help then, I haven't used the .99 series of > Dovecot for over a year now and there seem to be quite a few issues with > it. > > Regards > Andrew > -- > Andrew Hutchings (A-Wing) - Linux Guru > Netserve Consultants - http://www.domaincity.co.uk/ > Linux CDs and DVDs - http://www.linuxiso.co.uk/ > Random quote 1: "Microsoft is not the answer. Microsoft is the question. > NO (or Linux) is the answer." - Unknown > > > > Well, I suppose I could upgrade to 1.0 then. I'll give that a try and drop a note here if it works. Thanks, Savage

1 1

[Dovecot] dovecot + postfix + freebsd help
by glemme 23 Oct '05

23 Oct '05

Hi. I'm currently setting up dovecot to work with my server. My inboxes from postfix are stored in /usr/var/spool/mail/ and then the username, so for me that would be / usr/var/spool/mail/viktor my homedirectory is /usr/home/glemme/homes/viktor/ so from what i can understand. My settings should be: default_mail_env = mbox:%h/Mail:INBOX:/usr/var/spool/mail/%u But guess what, I am probably wrong. my mailapp tells me my inbox is empty and my log claims this: dovecot: Oct 22 16:39:35 Info: imap(viktor: Effective uid=1015, gid=1004 dovecot: Oct 22 16:39:35 Info: imap(viktor: mbox: data=/usr/home/ glemme/homes/viktor/Mail:INBOX:/usr/var/spool/mail/viktor dovecot: Oct 22 16:39:35 Info: imap(viktor): mbox: INBOX defaulted to /usr/home/glemme/homes/viktor/Mail/inbox dovecot: Oct 22 16:39:35 Info: imap(viktor): mbox: root=/usr/home/ glemme/homes/viktor/Mail, index=/usr/home/glemme/homes/viktor/Mail, inbox=/usr/home/glemme/homes/viktor/Mail/inbox Why is it defaulting from the right INBOX to the wrong one? HELP! /glemme

2 1

[Dovecot] 1.0alpha2: how to reject specific users?
by Jeff A. Earickson 21 Oct '05

21 Oct '05

Hi, In Qualcomm's qpopper, you can specify a list of users to reject at authentication, even if they are otherwise valid, by putting them in a file (/etc/pop.nonauth). I use this to occasionally ban users who bang on the system needlessly until they Get a Clue. I looked thru the wiki.dovecot.org/Authentication pages and didn't see anything like this feature. Does it exist in 1.0? BTW, running 1.0alpha2 in production since Sunday night, working great. Zero core dumps, only minor chatter about "Corrupted index cache file" in the syslog, no problems. Jeff Earickson Colby College

3 7

[Dovecot] latest dovecot rpm for RedHat Enterprise 3
by Erick Perez 21 Oct '05

21 Oct '05

Does anyone have a repository with the latest dovecot for RHEL3 ? I have only found dovecot-1.0.0.4-200502 which is for february 2005. I dont know how to build rpms from .tar so i will not venture on that without some magic tool. Thanks,

1 0

[Dovecot] Performance issues in Alpha4 gone
by Daniel 21 Oct '05

21 Oct '05

Hi The performance issues I noticed on my system/setup with Alpha3 seem to be gone with Alpha4. As soon as I installed it I noticed imap seemed more responsive. Just thought I would let the list know. Regards Daniel

2 1

[Dovecot] imaps on alternate ports
by Andrew D. Clark 21 Oct '05

21 Oct '05

I'm trying to test out dovecot 1.0 alpha 3 prior to an upgrade from dovecot-0.99.14, but I cannot get imaps listening on anything other than 993. I've tried putting listen = *:2023 in the global section or in the imap { } section. No luck. What is the proper format for a config that only runs imaps and only listens on a particular port? -- Andrew Clark Campus Network Programmer University of California, Santa Barbara andrew.clark(a)ucsb.edu (805) 893-5311

2 1

[Dovecot] alpha4: flock change
by Jeff A. Earickson 20 Oct '05

20 Oct '05

Timo, The comments in dovecot-example.conf regarding lock_method for Solaris users needs to note your change. Your changelog says: - Default lock_method changed to flock instead of the old fcntl. Solaris users will need to set it back to fcntl. This makes sure that Dovecot's indexes aren't accidentally used with NFS. But there is no warning about this in the file for Solaris users. There should be; it will bite somebody later. Jeff Earickson Colby College

1 0

[Dovecot] [PATCH] Support for GSSAPI SASL Mechanism
by Jelmer Vernooij 20 Oct '05

20 Oct '05

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi, Attached is a patch against current CVS that adds support for the GSSAPI SASL mechanism. It was written from scratch, after reading the patch from Colin Walters against a much older version of dovecot. Other then support for the 'GSSAPI' mechanism, it contains the following changes: - - Added 'auth_krb5_keytab' option for overriding default keytab location. The gssapi library already uses the environment variable KRB5_KTNAME to allow overriding of the keytab location, so I didn't have to make any changes on the login process side. - - Added 'need_passdb' member to mech_module and allow having no passdb's specified if no mechanisms need them (only useful for GSSAPI at the moment) Cheers, Jelmer - -- Jelmer Vernooij <jelmer(a)samba.org> -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.2 (GNU/Linux) iD8DBQFDVgaEPa9Uoh7vUnYRAscGAJ9Fa4E5ze5IX3UeAfjwg7kzj5tgtQCcDva7 O5VTeOeJ7zpmHullxQN6q1Y= =60w7 -----END PGP SIGNATURE----- Index: configure.in =================================================================== RCS file: /home/cvs/dovecot/configure.in,v retrieving revision 1.214 diff -u -r1.214 configure.in --- configure.in 23 Sep 2005 13:28:40 -0000 1.214 +++ configure.in 19 Oct 2005 08:25:31 -0000 @@ -118,6 +118,15 @@ fi, want_bsdauth=yes) +AC_ARG_WITH(gssapi, +[ --with-gssapi Build with GSSAPI authentication support (default)], + if test x$withval = xno; then + want_gssapi=no + else + want_gssapi_yes + fi, + want_gssapi=yes) + AC_ARG_WITH(ldap, [ --with-ldap Build with LDAP support], if test x$withval = xno; then @@ -1192,6 +1201,17 @@ ]) fi +have_gssapi=no +if test $want_gssapi = yes; then + AC_CHECK_PROG(KRB5CONFIG, krb5-config, YES, NO) + if test $KRB5CONFIG = YES; then + AUTH_LIBS="$AUTH_LIBS `krb5-config --libs gssapi`" + AUTH_CFLAGS="$AUTH_CFLAGS `krb5-config --cflags gssapi`" + AC_DEFINE(MECH_GSSAPI,, Build with GSSAPI support) + have_gssapi=yes + fi +fi + if test $want_ldap = yes; then AC_CHECK_LIB(ldap, ldap_init, [ AC_CHECK_HEADER(ldap.h, [ @@ -1486,5 +1506,6 @@ echo "Building with IPv6 support .......... : $want_ipv6" echo "Building with pop3 server ........... : $want_pop3d" echo "Building with mail delivery agent .. : $want_deliver" +echo "Building with GSSAPI support ........ : $have_gssapi" echo "Building with user database modules . :$userdb" echo "Building with password lookup modules :$passdb" Index: dovecot-example.conf =================================================================== RCS file: /home/cvs/dovecot/dovecot-example.conf,v retrieving revision 1.155 diff -u -r1.155 dovecot-example.conf --- dovecot-example.conf 16 Oct 2005 14:59:12 -0000 1.155 +++ dovecot-example.conf 19 Oct 2005 08:25:31 -0000 @@ -568,9 +568,13 @@ # automatically created and destroyed as needed. #auth_worker_max_count = 30 +# Kerberos keytab to use for the GSSAPI mechanism. Will use the system +# default (usually /etc/krb5.keytab) if not specified. +#auth_krb5_keytab = + auth default { # Space separated list of wanted authentication mechanisms: - # plain digest-md5 cram-md5 apop anonymous + # plain digest-md5 cram-md5 apop anonymous gssapi mechanisms = plain # Index: src/auth/Makefile.am =================================================================== RCS file: /home/cvs/dovecot/src/auth/Makefile.am,v retrieving revision 1.47 diff -u -r1.47 Makefile.am --- src/auth/Makefile.am 7 Aug 2005 11:41:19 -0000 1.47 +++ src/auth/Makefile.am 19 Oct 2005 08:25:31 -0000 @@ -54,6 +54,7 @@ mech-cram-md5.c \ mech-digest-md5.c \ mech-ntlm.c \ + mech-gssapi.c \ mech-rpa.c \ mech-apop.c \ passdb.c \ Index: src/auth/auth.c =================================================================== RCS file: /home/cvs/dovecot/src/auth/auth.c,v retrieving revision 1.19 diff -u -r1.19 auth.c --- src/auth/auth.c 16 Oct 2005 14:06:59 -0000 1.19 +++ src/auth/auth.c 19 Oct 2005 08:25:31 -0000 @@ -56,8 +56,6 @@ } t_pop(); - if (auth->passdbs == NULL) - i_fatal("No password databases set"); if (auth->userdbs == NULL) i_fatal("No user databases set"); return auth; @@ -130,6 +128,9 @@ struct mech_module_list *list; for (list = auth->mech_modules; list != NULL; list = list->next) { + if (list->module.need_passdb && + !auth->passdbs) + break; if (list->module.passdb_need_plain && !auth_passdb_list_have_plain(auth)) break; Index: src/auth/mech-anonymous.c =================================================================== RCS file: /home/cvs/dovecot/src/auth/mech-anonymous.c,v retrieving revision 1.13 diff -u -r1.13 mech-anonymous.c --- src/auth/mech-anonymous.c 23 Apr 2005 09:11:49 -0000 1.13 +++ src/auth/mech-anonymous.c 19 Oct 2005 08:25:31 -0000 @@ -57,6 +57,7 @@ MEMBER(flags) MECH_SEC_ANONYMOUS, + MEMBER(need_passdb) TRUE, MEMBER(passdb_need_plain) FALSE, MEMBER(passdb_need_credentials) FALSE, Index: src/auth/mech-apop.c =================================================================== RCS file: /home/cvs/dovecot/src/auth/mech-apop.c,v retrieving revision 1.16 diff -u -r1.16 mech-apop.c --- src/auth/mech-apop.c 23 Apr 2005 09:11:49 -0000 1.16 +++ src/auth/mech-apop.c 19 Oct 2005 08:25:31 -0000 @@ -162,6 +162,7 @@ MEMBER(flags) MECH_SEC_PRIVATE | MECH_SEC_DICTIONARY | MECH_SEC_ACTIVE, + MEMBER(need_passdb) TRUE, MEMBER(passdb_need_plain) FALSE, MEMBER(passdb_need_credentials) TRUE, Index: src/auth/mech-cram-md5.c =================================================================== RCS file: /home/cvs/dovecot/src/auth/mech-cram-md5.c,v retrieving revision 1.20 diff -u -r1.20 mech-cram-md5.c --- src/auth/mech-cram-md5.c 8 Jan 2005 21:37:32 -0000 1.20 +++ src/auth/mech-cram-md5.c 19 Oct 2005 08:25:32 -0000 @@ -191,6 +191,7 @@ MEMBER(flags) MECH_SEC_DICTIONARY | MECH_SEC_ACTIVE, + MEMBER(need_passdb) TRUE, MEMBER(passdb_need_plain) FALSE, MEMBER(passdb_need_credentials) TRUE, Index: src/auth/mech-digest-md5.c =================================================================== RCS file: /home/cvs/dovecot/src/auth/mech-digest-md5.c,v retrieving revision 1.34 diff -u -r1.34 mech-digest-md5.c --- src/auth/mech-digest-md5.c 8 Jan 2005 21:37:32 -0000 1.34 +++ src/auth/mech-digest-md5.c 19 Oct 2005 08:25:32 -0000 @@ -619,6 +619,7 @@ MEMBER(flags) MECH_SEC_DICTIONARY | MECH_SEC_ACTIVE | MECH_SEC_MUTUAL_AUTH, + MEMBER(need_passdb) TRUE, MEMBER(passdb_need_plain) FALSE, MEMBER(passdb_need_credentials) TRUE, Index: src/auth/mech-login.c =================================================================== RCS file: /home/cvs/dovecot/src/auth/mech-login.c,v retrieving revision 1.12 diff -u -r1.12 mech-login.c --- src/auth/mech-login.c 23 Apr 2005 09:11:49 -0000 1.12 +++ src/auth/mech-login.c 19 Oct 2005 08:25:32 -0000 @@ -87,6 +87,7 @@ MEMBER(flags) MECH_SEC_PLAINTEXT, + MEMBER(need_passdb) TRUE, MEMBER(passdb_need_plain) TRUE, MEMBER(passdb_need_credentials) FALSE, Index: src/auth/mech-ntlm.c =================================================================== RCS file: /home/cvs/dovecot/src/auth/mech-ntlm.c,v retrieving revision 1.19 diff -u -r1.19 mech-ntlm.c --- src/auth/mech-ntlm.c 23 Apr 2005 09:11:49 -0000 1.19 +++ src/auth/mech-ntlm.c 19 Oct 2005 08:25:32 -0000 @@ -281,6 +281,7 @@ MEMBER(flags) MECH_SEC_DICTIONARY | MECH_SEC_ACTIVE, + MEMBER(need_passdb) TRUE, MEMBER(passdb_need_plain) FALSE, MEMBER(passdb_need_credentials) TRUE, Index: src/auth/mech-plain.c =================================================================== RCS file: /home/cvs/dovecot/src/auth/mech-plain.c,v retrieving revision 1.31 diff -u -r1.31 mech-plain.c --- src/auth/mech-plain.c 23 Apr 2005 09:11:49 -0000 1.31 +++ src/auth/mech-plain.c 19 Oct 2005 08:25:32 -0000 @@ -103,6 +103,7 @@ MEMBER(flags) MECH_SEC_PLAINTEXT, + MEMBER(need_passdb) TRUE, MEMBER(passdb_need_plain) TRUE, MEMBER(passdb_need_credentials) FALSE, Index: src/auth/mech-rpa.c =================================================================== RCS file: /home/cvs/dovecot/src/auth/mech-rpa.c,v retrieving revision 1.19 diff -u -r1.19 mech-rpa.c --- src/auth/mech-rpa.c 23 Apr 2005 09:11:49 -0000 1.19 +++ src/auth/mech-rpa.c 19 Oct 2005 08:25:32 -0000 @@ -614,6 +614,7 @@ MEMBER(flags) MECH_SEC_DICTIONARY | MECH_SEC_ACTIVE | MECH_SEC_MUTUAL_AUTH, + MEMBER(need_passdb) TRUE, MEMBER(passdb_need_plain) FALSE, MEMBER(passdb_need_credentials) TRUE, Index: src/auth/mech.c =================================================================== RCS file: /home/cvs/dovecot/src/auth/mech.c,v retrieving revision 1.54 diff -u -r1.54 mech.c --- src/auth/mech.c 7 Jan 2005 19:55:50 -0000 1.54 +++ src/auth/mech.c 19 Oct 2005 08:25:32 -0000 @@ -54,6 +54,9 @@ extern struct mech_module mech_ntlm; extern struct mech_module mech_rpa; extern struct mech_module mech_anonymous; +#ifdef MECH_GSSAPI +extern struct mech_module mech_gssapi; +#endif void mech_init(void) { @@ -65,6 +68,9 @@ mech_register_module(&mech_ntlm); mech_register_module(&mech_rpa); mech_register_module(&mech_anonymous); +#ifdef MECH_GSSAPI + mech_register_module(&mech_gssapi); +#endif } void mech_deinit(void) @@ -77,4 +83,7 @@ mech_unregister_module(&mech_ntlm); mech_unregister_module(&mech_rpa); mech_unregister_module(&mech_anonymous); +#ifdef MECH_GSSAPI + mech_unregister_module(&mech_gssapi); +#endif } Index: src/auth/mech.h =================================================================== RCS file: /home/cvs/dovecot/src/auth/mech.h,v retrieving revision 1.35 diff -u -r1.35 mech.h --- src/auth/mech.h 9 Jan 2005 16:54:48 -0000 1.35 +++ src/auth/mech.h 19 Oct 2005 08:25:32 -0000 @@ -24,6 +24,7 @@ const char *mech_name; enum mech_security_flags flags; + unsigned int need_passdb:1; unsigned int passdb_need_plain:1; unsigned int passdb_need_credentials:1; Index: src/master/auth-process.c =================================================================== RCS file: /home/cvs/dovecot/src/master/auth-process.c,v retrieving revision 1.82 diff -u -r1.82 auth-process.c --- src/master/auth-process.c 1 Oct 2005 10:52:16 -0000 1.82 +++ src/master/auth-process.c 19 Oct 2005 08:25:33 -0000 @@ -458,6 +458,8 @@ env_put("SSL_REQUIRE_CLIENT_CERT=1"); if (set->ssl_username_from_cert) env_put("SSL_USERNAME_FROM_CERT=1"); + if (set->krb5_keytab) + env_put(t_strconcat("KRB5_KTNAME=", set->krb5_keytab, NULL)); restrict_process_size(set->process_size, (unsigned int)-1); } Index: src/master/master-settings.c =================================================================== RCS file: /home/cvs/dovecot/src/master/master-settings.c,v retrieving revision 1.92 diff -u -r1.92 master-settings.c --- src/master/master-settings.c 16 Oct 2005 14:59:17 -0000 1.92 +++ src/master/master-settings.c 19 Oct 2005 08:25:33 -0000 @@ -155,6 +155,7 @@ DEF(SET_STR, username_chars), DEF(SET_STR, username_translation), DEF(SET_STR, anonymous_username), + DEF(SET_STR, krb5_keytab), DEF(SET_BOOL, verbose), DEF(SET_BOOL, debug), @@ -353,6 +354,7 @@ MEMBER(username_chars) "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ01234567890.-_@", MEMBER(username_translation) "", MEMBER(anonymous_username) "anonymous", + MEMBER(krb5_keytab) NULL, MEMBER(verbose) FALSE, MEMBER(debug) FALSE, Index: src/master/master-settings.h =================================================================== RCS file: /home/cvs/dovecot/src/master/master-settings.h,v retrieving revision 1.60 diff -u -r1.60 master-settings.h --- src/master/master-settings.h 1 Oct 2005 10:52:16 -0000 1.60 +++ src/master/master-settings.h 19 Oct 2005 08:25:33 -0000 @@ -162,6 +162,7 @@ const char *username_chars; const char *username_translation; const char *anonymous_username; + const char *krb5_keytab; int verbose, debug; int ssl_require_client_cert; --- /dev/null 2005-10-17 12:49:06.896857000 +0200 +++ src/auth/mech-gssapi.c 2005-10-19 10:17:45.000000000 +0200 @@ -0,0 +1,321 @@ +/* + * GSSAPI Module + * + * Copyright (c) 2005 Jelmer Vernooij <jelmer(a)samba.org> + * + * Related standards: + * - draft-ietf-sasl-gssapi-03 + * - RFC2222 + * + * Some parts inspired by an older patch from Colin Walters + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU Lesser General Public License as published + * by the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + */ + +#include "common.h" +#include "mech.h" +#include "passdb.h" +#include "str.h" +#include "buffer.h" +#include "hex-binary.h" +#include "safe-memset.h" +#include "hostpid.h" + +#ifdef MECH_GSSAPI + +#include <gssapi/gssapi.h> + +struct gssapi_auth_request { + struct auth_request auth_request; + gss_ctx_id_t gss_ctx; + gss_cred_id_t service_cred; + + enum { + GSS_STATE_SEC_CONTEXT, + GSS_STATE_WRAP, + GSS_STATE_UNWRAP + } sasl_gssapi_state; + + gss_name_t src_name; + + pool_t pool; +}; + +static void auth_request_log_gss_error(struct auth_request *request, OM_uint32 status_value, int status_type, const char *description) +{ + OM_uint32 message_context = 0; + OM_uint32 major_status, minor_status; + gss_buffer_desc status_string; + + do { + major_status = gss_display_status(&minor_status, status_value, + status_type, GSS_C_NO_OID, &message_context, + &status_string); + + auth_request_log_error(request, "gssapi", "While %s: %s", + description, (char *)status_string.value); + + major_status = gss_release_buffer(&minor_status, &status_string); + } while (message_context != 0); +} + +static struct auth_request *mech_gssapi_auth_new(void) +{ + struct gssapi_auth_request *request; + pool_t pool; + + pool = pool_alloconly_create("gssapi_auth_request", 512); + request = p_new(pool, struct gssapi_auth_request, 1); + request->pool = pool; + + request->gss_ctx = GSS_C_NO_CONTEXT; + + request->auth_request.pool = pool; + return &request->auth_request; +} + +static OM_uint32 obtain_service_credentials(struct auth_request *request, gss_cred_id_t *ret) +{ + OM_uint32 major_status, minor_status; + string_t *principal_name; + gss_buffer_desc inbuf; + gss_name_t gss_principal; + + principal_name = t_str_new(40); + str_append(principal_name, t_str_lcase(request->service)); + str_append(principal_name, "@"); + str_append(principal_name, my_hostname); + + auth_request_log_info(request, "gssapi", + "Obtaining credentials for %s", str_c(principal_name)); + + inbuf.length = str_len(principal_name); + inbuf.value = (void*) str_c(principal_name); + + major_status = gss_import_name(&minor_status, &inbuf, + GSS_C_NT_HOSTBASED_SERVICE, &gss_principal); + + str_free(principal_name); + + if (GSS_ERROR(major_status)) { + auth_request_log_gss_error(request, major_status, GSS_C_GSS_CODE, + "importing principal name"); + return major_status; + } + + major_status = gss_acquire_cred(&minor_status, gss_principal, 0, + GSS_C_NULL_OID_SET, GSS_C_ACCEPT, ret, NULL, NULL); + + if (GSS_ERROR(major_status)) { + auth_request_log_gss_error(request, major_status, GSS_C_GSS_CODE, + "acquiring service credentials"); + auth_request_log_gss_error(request, minor_status, GSS_C_MECH_CODE, + "acquiring service credentials"); + return major_status; + } + + gss_release_name(&minor_status, gss_principal); + + return major_status; +} + +static void gssapi_sec_context(struct gssapi_auth_request *request, + gss_buffer_desc inbuf) +{ + OM_uint32 major_status, minor_status; + gss_buffer_desc outbuf; + + major_status = gss_accept_sec_context ( + &minor_status, + &request->gss_ctx, + request->service_cred, + &inbuf, + GSS_C_NO_CHANNEL_BINDINGS, + &request->src_name, + NULL, /* mech_type */ + &outbuf, + NULL, /* ret_flags */ + NULL, /* time_rec */ + NULL /* delegated_cred_handle */ + ); + + if (GSS_ERROR(major_status)) { + auth_request_log_gss_error(&request->auth_request, major_status, GSS_C_GSS_CODE, + "processing incoming data"); + auth_request_log_gss_error(&request->auth_request, minor_status, GSS_C_MECH_CODE, + "processing incoming data"); + + auth_request_fail(&request->auth_request); + return; + } + + if (major_status == GSS_S_COMPLETE) { + request->sasl_gssapi_state = GSS_STATE_WRAP; + auth_request_log_info(&request->auth_request, "gssapi", + "security context state completed."); + } else { + auth_request_log_info(&request->auth_request, "gssapi", + "Processed incoming packet correctly, waiting for another."); + } + + request->auth_request.callback(&request->auth_request, + AUTH_CLIENT_RESULT_CONTINUE, + outbuf.value, outbuf.length); + + major_status = gss_release_buffer(&minor_status, &outbuf); +} + +static void gssapi_wrap(struct gssapi_auth_request *request, + gss_buffer_desc inbuf) +{ + OM_uint32 major_status, minor_status; + gss_buffer_desc outbuf; + char ret[4]; + + /* The clients return data should be empty here */ + + ret[0] = 0x01; /* Only authentication, no integrity or confidentiality protection (yet?) */ + ret[1] = 0xFF; + ret[2] = 0xFF; + ret[3] = 0xFF; + + inbuf.length = 4; + inbuf.value = ret; + + major_status = gss_wrap(&minor_status, request->gss_ctx, 0, + GSS_C_QOP_DEFAULT, + &inbuf, NULL, &outbuf); + + if (GSS_ERROR(major_status)) { + auth_request_log_gss_error(&request->auth_request, major_status, GSS_C_GSS_CODE, + "sending security layer negotiation"); + auth_request_log_gss_error(&request->auth_request, minor_status, GSS_C_MECH_CODE, + "sending security layer negotiation"); + auth_request_fail(&request->auth_request); + return; + } + + auth_request_log_info(&request->auth_request, "gssapi", + "Negotiated security layer"); + + request->auth_request.callback(&request->auth_request, + AUTH_CLIENT_RESULT_CONTINUE, + outbuf.value, outbuf.length); + + major_status = gss_release_buffer(&minor_status, &outbuf); + + request->sasl_gssapi_state = GSS_STATE_UNWRAP; +} + +static void gssapi_unwrap(struct gssapi_auth_request *request, + gss_buffer_desc inbuf) +{ + OM_uint32 major_status, minor_status; + gss_buffer_desc outbuf; + + major_status = gss_unwrap(&minor_status, request->gss_ctx, + &inbuf, &outbuf, NULL, NULL); + + if (GSS_ERROR(major_status)) { + auth_request_log_gss_error(&request->auth_request, major_status, GSS_C_GSS_CODE, + "final negotiation: gss_unwrap"); + auth_request_fail(&request->auth_request); + return; + } + + if (outbuf.length <= 4) { + auth_request_log_error(&request->auth_request, "gssapi", + "Invalid response length"); + auth_request_fail(&request->auth_request); + return; + } + + request->auth_request.user = p_strndup(request->auth_request.pool, + ((unsigned char*) outbuf.value)+4, + outbuf.length-4); + + auth_request_success(&request->auth_request, NULL, 0); +} + +static void +mech_gssapi_auth_continue(struct auth_request *request, + const unsigned char *data, size_t data_size) +{ + struct gssapi_auth_request *gssapi_request = + (struct gssapi_auth_request *)request; + gss_buffer_desc inbuf; + + inbuf.value = (char*) data; + inbuf.length = data_size; + + switch (gssapi_request->sasl_gssapi_state) { + case GSS_STATE_SEC_CONTEXT: gssapi_sec_context(gssapi_request, inbuf); break; + case GSS_STATE_WRAP: gssapi_wrap(gssapi_request, inbuf); break; + case GSS_STATE_UNWRAP: gssapi_unwrap(gssapi_request, inbuf); break; + } +} + +static void +mech_gssapi_auth_initial(struct auth_request *request, + const unsigned char *data, size_t data_size) +{ + OM_uint32 major_status; + struct gssapi_auth_request *gssapi_request = + (struct gssapi_auth_request *)request; + + major_status = obtain_service_credentials(request, &gssapi_request->service_cred); + + if (GSS_ERROR(major_status)) { + auth_request_internal_failure(request); + return; + } + gssapi_request->src_name = GSS_C_NO_NAME; + + gssapi_request->sasl_gssapi_state = GSS_STATE_SEC_CONTEXT; + + if (data_size == 0) { + /* The client should go first */ + request->callback(request, + AUTH_CLIENT_RESULT_CONTINUE, + NULL, 0); + } else { + mech_gssapi_auth_continue(request, data, data_size); + } +} + + +static void +mech_gssapi_auth_free(struct auth_request *request) +{ + OM_uint32 major_status, minor_status; + struct gssapi_auth_request *gssapi_request = + (struct gssapi_auth_request *)request; + + major_status = gss_delete_sec_context(&minor_status, + &gssapi_request->gss_ctx, + GSS_C_NO_BUFFER); + + major_status = gss_release_cred(&minor_status, &gssapi_request->service_cred); + + pool_unref(request->pool); +} + +const struct mech_module mech_gssapi = { + "GSSAPI", + + MEMBER(flags) 0, + + MEMBER(need_passdb) FALSE, + MEMBER(passdb_need_plain) FALSE, + MEMBER(passdb_need_credentials) FALSE, + + mech_gssapi_auth_new, + mech_gssapi_auth_initial, + mech_gssapi_auth_continue, + mech_gssapi_auth_free +}; + +#endif Index: AUTHORS =================================================================== RCS file: /home/cvs/dovecot/AUTHORS,v retrieving revision 1.11 diff -u -r1.11 AUTHORS --- AUTHORS 19 Aug 2004 03:56:01 -0000 1.11 +++ AUTHORS 19 Oct 2005 08:38:49 -0000 @@ -12,6 +12,8 @@ Joshua Goodall <joshua(a)roughtrade.net> (src/auth/password-scheme-cram-md5.c, src/util/dovecotpw.c) +Jelmer Vernooij <jelmer(a)samba.org> (src/auth/mech-gssapi.c) + This product includes software developed by Computing Services at Carnegie Mellon University (http://www.cmu.edu/computing/) (src/lib/base64.c, src/lib/mkgmtime.c)

3 10

[Dovecot] "passdb" userdb
by Thomas Hummel 20 Oct '05

20 Oct '05

Hello Timo, How exactly would translate the "passdb" userdb example which is in the Wiki for SQL auth with LDAP auth, both in dovecot.conf and dovecot-ldap.conf ? -- Thomas Hummel | Institut Pasteur <hummel(a)pasteur.fr> | Pôle informatique - systèmes et réseau

2 3

[Dovecot] Large IMAP operations tend to timeout and cause problems?
by Alen Salamun 20 Oct '05

20 Oct '05

Hello all! I have moved from Courier-IMAP to Dovecot some month ago. It is quite stable on everyday use (1.0alpha4) but it has constant problems with large IMAP/SSL operations. We use Maildir format. For example if I select 400 messages, mark them deleted and use "purge command" in Thunderbird (to actually delete them) TB starts to do something and runs and runs and runs....Then I get script timed out errror and I have to restart TB. That never happened with Courier-Imap. Same thing happens for example moving 1000msgs to another folder or something like that. Another thing is still that from time to time dovecot indexes get corrupted and users can't access some folders. Then I have to delete dovecot* in that Maildir folder and it works again. Any thoughts on that please? BR, Alen

4 4

[Dovecot] Alpha1..2.. and 3 with Tru64
by Alfonso Sparano 20 Oct '05

20 Oct '05

Hi all, I've found a little problem to compile dovecot on a tru64 os v5.1. The problem is the lack of the "inttypes.h" into the included header in the project. Without this include the make process will fail because it can't find the uint32 type. So is sufficient to add the line '#include <inttypes.h>' in the src/lib/lib.h of the tgz distribution package. Alfonso Sparano

3 2

[Dovecot] passwd and virtual users
by Erick Perez 20 Oct '05

20 Oct '05

Hi, im runnign dovecot 0.99.14 with standard pop3 auth and a default .conf file. Everything works fine. But now I need to enable virtual users for several domains in the same server while keeping the local auth. my postfix is already working for the virtual domains. What do i need to modify to enable /etc/passwd auth (already done) and virtual domains auth? in the virtual part, i have no idea. Thanks, -- ------------------------------------------- Erick Perez

1 0

[Dovecot] Failed authentication to a mysql database (bug or PEBKAC?)
by jigen 19 Oct '05

19 Oct '05

Hi, dovecot has a little crazy behaviour connecting to a mysql db: if you specify "127.0.0.1" as host instead of "localhost" it seems to work, also with a password. BUT, if you assign host=localhost without a password, it works too (as Ger Visschers says).... One more question: how I can specify more different mysql-db conteining different users? I try in the following way: passdb sql { args = /etc/dovecot/dovecot-mysql_django.conf args = /etc/dovecot/dovecot-mysql_debord.conf } and also: passdb sql { args = /etc/dovecot/dovecot-mysql_debord.conf } passdb sql { args = /etc/dovecot/dovecot-mysql_django.conf } but it always seems to remember only the last args value and it tries to connect only one db... bye jigen -- jigen <jigen(a)metalabs.org> MeTA~LAbS

3 2

[Dovecot] Message not found errors
by Andrew Hutchings 19 Oct '05

19 Oct '05

Hi, I'm getting a very small amount of users getting message not found errors while downloading mail via POP. By the time they inform me and I switch on rawloging for them it works again. Any ideas where this is going wrong? Or at least a way I can diagnose it? It seems to have been happening since Alpha 1. Currently using pre-release of Alpha4. Regards Andrew -- Andrew Hutchings (A-Wing) - Linux Guru Netserve Consultants - http://www.domaincity.co.uk/ Linux CDs and DVDs - http://www.linuxiso.co.uk/ Random quote 192: Geeks like learning new things, and when they pop out at the end of the process they're entirely brainwashed. - The way that MicroSoft's trainers view technical staff.

1 1

[Dovecot] 1 user has random pam auth issues
by Obantec Support 19 Oct '05

19 Oct '05

Hi Dovecot 1.0 stable on FC3 i see this in my logs from 1 user Oct 19 07:20:36 proteus2a dovecot(pam_unix)[2937]: authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=1.2.3.4 user=testuser IP & user changed by me. at other times he has no issues. no other users are reporting this. could it be his ADSL is flaky or is there another scenario. Mark

1 0

[Dovecot] Pocket Outlook weirdness
by Vadim Zaliva 19 Oct '05

19 Oct '05

Hi! I am trying to access my IMAP server running dovecot from my Pocket PC running PocketOutlook. I observe very strange behavior: it starts to fetch messages from INBOX and shows list them on the screen as it fetches, then all messages disappear from the screen and it says "fetching folders". After the end of update operation it shows me empty list of messages. Have anybody have seen such problem? In general, are there reports of successful pocket outlook + dovecot users? Any suggestions are appreciated! I really want to make this thing work. Sincerely, Vadim

1 0

[Dovecot] v. minor bug alpha4pre
by Andrew Hutchings 19 Oct '05

19 Oct '05

Hi, When upgrading to Alpha4pre I also changed UIDL format from %08Xv%08Xu to %08Xu%08Xv to be in line with future dovecot default. This caused the following error to happen on about 1% of mailboxes: file ostream-file.c: line 370 (stream_send_io): assertion failed: (fstream->io != NULL) Deleting dovecot-uidlist and indexes fixes this so its more of an FYI really. I always delete indexes on an upgrade anyway so I'm pretty sure interpretation of the uidlist file if the problem. Regards Andrew -- Andrew Hutchings (A-Wing) - Linux Guru Netserve Consultants - http://www.domaincity.co.uk/ Linux CDs and DVDs - http://www.linuxiso.co.uk/ Random quote 3: "We are MicroSoft. You will be assimilated. Resistance is futile." - Unknown

2 2

[Dovecot] Moving old files
by Jon 19 Oct '05

19 Oct '05

Hi, I wish to automatically remove mail files not accessed for some time. I have done this in the file system and it works fine although it is a bit slow when the mail client access the mailbox after changes. Are there any way of having dovecot moving the files so that index and subscriptions are kept more same? Can one use Dovecot from the command line? Best Regards - Jon

2 1

[Dovecot] POP Question
by Marc Perkel 18 Oct '05

18 Oct '05

After upgrading to Alpha 4 I have two people complaining about a POP problem. Aparently they are getting their email sent to them over and over. They have it set to "leave messages on server" but apparently whatever keeps track of that is broken. So - how is it determined with POP what is new and what is read?

4 4

[Dovecot] qpoppers XUIDL
by Dominik Werder 18 Oct '05

18 Oct '05

Hello, does anybody know how to make XUIDLs compatible to qpopper? I'm migrating from qpopper and one of my test-migration-accounts leaves the mail on the server. As soon as I switch to dovecot it downloads the mails again and again.. bye! Dominik

2 2

[Dovecot] Numpty question about EXISTS...
by Steve [Dovecot] 18 Oct '05

18 Oct '05

I'm fiddling with Ruby and its IMAP class. I'm trying to write something which (at this stage) can be thought of as a variant on xbiff which doesn't need poll the server to establish the presence of new mail... I'd like to establish a notification when the contents of a folder changes... which is likely to be when a different IMAP client moves a message into a new folder. I've been lead to believe that I can use the "EXISTS" response to trigger the 'new message present in IMAP folder" event in my program... but I don't seem to receive them when I would expect to when connected to my Dovecot server. I get one "EXISTS" message when I call "select" - but that's it - it doesn't seem to notice when another client moves messages in/out of the folder. Are my assumptions about IMAP incorrect - i.e. must I still poll? Can Dovecot be configured to send EXIST responses (or any other form of notification) when messages are moved into a folder? Any hints appreciated. Steve

3 3