- dovecot - dovecot.org

[Dovecot] Dovecot SLOW in imaptest without any apparent reason
by FABIO FERRARI 10 Jul '13

10 Jul '13

Hello, I'm migrating a mail server from a centos 5 cluster architecture to a centos 6 cluster architecture. The new cluster involves faster machines then the old cluster, and a virtual machine. I use dovecot-2.0.9-5.el6.x86_64, while the old cluster uses dovecot-2.0.1-1_118.el5. Tha mail server uses mysql for the users database, and a local ldap for authentication. The storage is also much faster in the new cluster: OLD SERVER: date; dd if=/dev/zero of=/cl/prova.bin bs=102400 count=10240; sync; date Wed Jun 26 15:43:53 CEST 2013 10240+0 records in 10240+0 records out 1048576000 bytes (1.0 GB) copied, 30.0202 seconds, 34.9 MB/s Wed Jun 26 15:44:28 CEST 2013 --> 1GB / 35 secs = about 29.25 MB/sec NEW SERVER: date; dd if=/dev/zero of=/cl/prova.bin bs=102400 count=102400; sync; date mar 25 giu 2013, 15.46.36, CEST 102400+0 records in 102400+0 records out 10485760000 bytes (10 GB) copied, 62,5143 s, 168 MB/s mar 25 giu 2013, 15.48.33, CEST [root@eta ~]# ---> 10GB / 117secs = about 85.47MB/sec An 'ls -l' in the user direcotry is also much faster, when the ldap/sssd cache is populated: OLD SERVER: real 0m8.540s user 0m1.229s sys 0m0.699s NEW SERER: real 0m3.938s user 0m0.250s sys 0m0.151s But my imaptest is much slower: ./imaptest user=XXXXXXX pass=XXXXXXX secs=120 seed=123 mbox=./dovecot-crlf OLD SERVER: Totals: Logi List Stat Sele Fetc Fet2 Stor Dele Expu Appe Logo 100% 50% 50% 100% 100% 100% 50% 100% 100% 100% 100% 30% 5% 1122 559 547 1121 1121 1568 136 900 1121 1121 2244 NEW SERVER Totals: Logi List Stat Sele Fetc Fet2 Stor Dele Expu Appe Logo 100% 50% 50% 100% 100% 100% 50% 100% 100% 100% 100% 30% 5% 390 210 185 389 389 589 49 320 389 389 780 The configuration is exactly the same in the 2 clusters, that is: ----------- # 2.0.1: /etc/dovecot/dovecot.conf # OS: Linux 2.6.18-348.3.1.el5 x86_64 Red Hat Enterprise Linux Server release 5.9 (Tikanga) xfs auth_cache_size = 1024 auth_cache_ttl = 21600 s auth_debug = yes auth_debug_passwords = yes auth_master_user_separator = * auth_mechanisms = plain login auth_socket_path = /var/run/dovecot/auth-userdb auth_verbose = yes base_dir = /var/run/dovecot/ disable_plaintext_auth = no hostname = mail.unimore.it info_log_path = /var/log/dovecot.log lda_mailbox_autocreate = yes log_path = /var/log/dovecot.log mail_debug = yes mail_location = maildir:/cl/mail/vhosts/sms.unimo.it/%Ln/Maildir mail_plugins = $mail_plugins quota mailbox_idle_check_interval = 60 s mbox_write_locks = fcntl namespace { inbox = yes location = prefix = INBOX. separator = . type = private } passdb { args = /usr/local/etc/dovecot.masterusers driver = passwd-file master = yes } passdb { args = dovecot driver = pam } plugin { quota = maildir:User quota quota_exceeded_message = Quota exceeded (mailbox is full) quota_rule = *:storage=200MB quota_rule2 = *:messages=100000 quota_rule3 = INBOX.Trash:storage=+100M quota_warning = storage=90%% quota-warning 90 %u quota_warning2 = storage=85%% quota-warning 85 %u quota_warning3 = messages=95%% quota-warning 95 %u quota_warning4 = messages=80%% quota-warning 80 %u setting_name = quota } postmaster_address = postmaster(a)unimore.it quota_full_tempfail = yes service anvil { client_limit = 199999 process_limit = 1 } service auth { client_limit = 21224 unix_listener auth-userdb { mode = 0600 user = vmail } } service imap-login { inet_listener imap { port = 143 } inet_listener imaps { port = 993 } process_limit = 10000 } service imap { process_limit = 10000 } service pop3-login { inet_listener pop3 { port = 110 } inet_listener pop3s { port = 995 } } service pop3 { process_limit = 1024 } service quota-warning { executable = script /usr/local/bin/quota-warning.sh unix_listener quota-warning { group = vmail user = vmail } user = dovecot } ssl_ca = </etc/pki/tls/certs/ca_unimore_tcs.pem ssl_cert = </etc/pki/tls/certs/mailposta1.pem ssl_key = </etc/pki/tls/certs/mailposta1.key userdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } verbose_ssl = yes protocol lda { mail_plugins = $mail_plugins quota } protocol imap { mail_plugins = $mail_plugins } protocol pop3 { mail_plugins = $mail_plugins quota pop3_client_workarounds = outlook-no-nuls oe-ns-eoh pop3_uidl_format = %08Xu%08Xv } ----------- Is anyone able to tell me what I have to check? thanks in advance Fabio Ferrari

2 1

[Dovecot] Strange Problems when deleting folders.
by Davide Bozzelli 10 Jul '13

10 Jul '13

Hi I'm experiencing a strange problem on my dovecot 2.0.21 setup. When i delete a folder "foo" it was correctly moved in the trash folder. If i try to delete from it the folder "foo" from the trash it gets renamed "foo1". If I try to dlete "foo1" it gets renamed foo11, and the operation could be continued figured out in an endless loop. This happens both from thunderbird and sogo (a webmail). Is it a known bug or a misconfiguration ? Thx in advance

2 1

[Dovecot] Migrating domain using IMAPc
by Breno Moreira 10 Jul '13

10 Jul '13

Hi list, I'm trying to do a domain migration using the imapc feature, but i'm having some problems and I really don't know what is happening. So if you guys could help me with a path to solve this, I will be glad. I'm using Dovecot 2.1.7 in a Debian Wheezy machine. The command I'm using is: dsync -Dv -o imapc_features=rfc822.size -o imapc_host=IP -o imapc_port=143 -o imapc_username='breno.moreira(a)mav.com.br' -o imapc_password='pass' -u breno.moreira(a)mav.com.br mirror imapc:/tmp/dsync-imapc and what I got with the logs is: doveadm(root): Debug: Loading modules from directory: /usr/lib/dovecot/modules doveadm(root): Debug: Module loaded: /usr/lib/dovecot/modules/lib20_zlib_plugin.so doveadm(root): Debug: Loading modules from directory: /usr/lib/dovecot/modules/doveadm doveadm(root): Debug: Skipping module doveadm_acl_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/lib10_doveadm_acl_plugin.so: undefined symbol: acl_user_module (this is usually intentional, so just ignore this message) doveadm(root): Debug: Skipping module doveadm_expire_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/lib10_doveadm_expire_plugin.so: undefined symbol: expire_set_deinit (this is usually intentio nal, so just ignore this message) doveadm(root): Debug: Skipping module doveadm_quota_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/lib10_doveadm_quota_plugin.so: undefined symbol: quota_user_module (this is usually intentiona l, so just ignore this message) doveadm(root): Debug: Module loaded: /usr/lib/dovecot/modules/doveadm/lib10_doveadm_zlib_plugin.so doveadm(root): Debug: Skipping module doveadm_fts_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/lib20_doveadm_fts_plugin.so: undefined symbol: fts_backend_rescan (this is usually intentional, so just ignore this message) doveadm(breno.moreira(a)mav.com.br): Debug: Added userdb setting: mail=sdbox:~/:ALT=/srv/dovehdodd/dovecot/mav.com.br/breno.moreira doveadm(breno.moreira(a)mav.com.br): Debug: Effective uid=5000, gid=5000, home=/srv/dovessdodd/dovecot/mav.com.br/breno.moreira doveadm(breno.moreira(a)mav.com.br): Debug: Namespace : type=private, prefix=INBOX., sep=., inbox=yes, hidden=no, list=yes, subscriptions=yes location=sdbox:~/:ALT=/srv/dovehdodd/dovecot/mav.com.br/breno.moreira doveadm(breno.moreira(a)mav.com.br): Debug: fs: root=/srv/dovessdodd/dovecot/ mav.com.br/breno.moreira, index=, control=, inbox=, alt=/srv/dovehdodd/dovecot/mav.com.br/breno.moreira dsync(breno.moreira(a)mav.com.br): Debug: Effective uid=5000, gid=5000, home=/srv/dovessdodd/dovecot/mav.com.br/breno.moreira dsync(breno.moreira(a)mav.com.br): Debug: Namespace : type=private, prefix=INBOX., sep=., inbox=yes, hidden=no, list=yes, subscriptions=yes location=imapc:/tmp/dsync-imapc dsync(breno.moreira(a)mav.com.br): Debug: imapc: root=/tmp/dsync-imapc, index=, control=, inbox=, alt= dsync(breno.moreira(a)mav.com.br): Debug: maildir++: root=/tmp/dsync-imapc, index=, control=, inbox=, alt= dsync(breno.moreira(a)mav.com.br): Debug: imapc(187.115.200.155:143): Looking up IP address dsync(breno.moreira(a)mav.com.br): Debug: imapc(187.115.200.155:143): Connecting to 187.115.200.155:143 dsync(breno.moreira(a)mav.com.br): Debug: imapc(187.115.200.155:143): Server capabilities: IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE STARTTLS AUTH=PLAIN AUTH=LOGIN dsync(breno.moreira(a)mav.com.br): Debug: imapc(187.115.200.155:143): Authenticating as breno.moreira(a)mav.com.br dsync(breno.moreira(a)mav.com.br): Debug: imapc(187.115.200.155:143): Server capabilities: IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE SORT SORT=DISPLAY THREAD=REFERENCES THREAD=REFS MULTIAPPEND UNSELECT I DLE CHILDREN NAMESPACE UIDPLUS LIST-EXTENDED I18NLEVEL=1 CONDSTORE QRESYNC ESEARCH ESORT SEARCHRES WITHIN CONTEXT=SEARCH LIST-STATUS dsync(breno.moreira(a)mav.com.br): Debug: imapc(187.115.200.155:143): Authenticated successfully dsync(breno.moreira(a)mav.com.br): Debug: Namespace INBOX.: Using permissions from /srv/dovessdodd/dovecot/mav.com.br/breno.moreira: mode=0700 gid=-1 dsync(breno.moreira(a)mav.com.br): Debug: Namespace INBOX.: Using permissions from /tmp/dsync-imapc: mode=0755 gid=-1 dsync(breno.moreira(a)mav.com.br): Error: Can't create mailbox INBOX: Empty mailbox name. dsync(breno.moreira(a)mav.com.br): Info: INBOX: only in dest (guid=c92f64f79f0d1ed01e6d5b314f04886c) dsync(breno.moreira(a)mav.com.br): Info: INBOX: only in source (guid=f4c6a715e8b1d551112d000042e5307d) dsync(breno.moreira(a)mav.com.br): Error: Mailbox INBOX changed its GUID (c92f64f79f0d1ed01e6d5b314f04886c -> f4c6a715e8b1d551112d000042e5307d) dsync(breno.moreira(a)mav.com.br): Error: msg iteration failed: Couldn't open mailbox c92f64f79f0d1ed01e6d5b314f04886c dsync(breno.moreira(a)mav.com.br): Error: Mailbox INBOX changed its GUID (c92f64f79f0d1ed01e6d5b314f04886c -> f4c6a715e8b1d551112d000042e5307d) dsync(breno.moreira(a)mav.com.br): Debug: imapc(187.115.200.155:143): Looking up IP address dsync(breno.moreira(a)mav.com.br): Debug: imapc(187.115.200.155:143): Connecting to 187.115.200.155:143 dsync(breno.moreira(a)mav.com.br): Debug: imapc(187.115.200.155:143): Server capabilities: IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE STARTTLS AUTH=PLAIN AUTH=LOGIN dsync(breno.moreira(a)mav.com.br): Debug: imapc(187.115.200.155:143): Authenticating as breno.moreira(a)mav.com.br dsync(breno.moreira(a)mav.com.br): Debug: imapc(187.115.200.155:143): Server capabilities: IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE SORT SORT=DISPLAY THREAD=REFERENCES THREAD=REFS MULTIAPPEND UNSELECT I DLE CHILDREN NAMESPACE UIDPLUS LIST-EXTENDED I18NLEVEL=1 CONDSTORE QRESYNC ESEARCH ESORT SEARCHRES WITHIN CONTEXT=SEARCH LIST-STATUS dsync(breno.moreira(a)mav.com.br): Debug: imapc(187.115.200.155:143): Authenticated successfully dsync(breno.moreira(a)mav.com.br): Panic: file mail-storage.c: line 794 (mailbox_check_mismatching_separators): assertion failed: (vname[0] == ns->prefix[ns->prefix_len-1]) dsync(breno.moreira(a)mav.com.br): Error: Raw backtrace: /usr/lib/dovecot/libdovecot.so.0(+0x4373a) [0x7f21a814b73a] -> /usr/lib/dovecot/libdovecot.so.0(default_fatal_handler+0x2a) [0x7f21a814b7fa] -> /usr/lib/dove cot/libdovecot.so.0(i_fatal+0) [0x7f21a81237e2] -> /usr/lib/dovecot/libdovecot-storage.so.0(+0x7ce8e) [0x7f21a8411e8e] -> /usr/lib/dovecot/libdovecot-storage.so.0(mailbox_open+0x18) [0x7f21a8411ed8] -> /usr/lib/d ovecot/libdovecot-storage.so.0(imapc_mailbox_sync_init+0x95) [0x7f21a83fd235] -> /usr/lib/dovecot/libdovecot-storage.so.0(mailbox_sync_init+0x33) [0x7f21a8410e23] -> /usr/lib/dovecot/libdovecot-storage.so.0(mailb ox_sync+0x27) [0x7f21a8410f47] -> /usr/bin/dsync(+0x2ef11) [0x7f21a8b20f11] -> /usr/bin/dsync(+0x2f03f) [0x7f21a8b2103f] -> /usr/bin/dsync(+0x30ac4) [0x7f21a8b22ac4] -> /usr/bin/dsync(dsync_worker_msg_iter_next+0x34) [0x7f21a8b1ffb4] -> /usr/bin/dsync(+0x292b4) [0x7f21a8b1b2b4] -> /usr/bin/dsync(+0x29352) [0x7f21a8b1b352] -> /usr/bin/dsync(dsync_brain_msg_sync_more+0x450) [0x7f21a8b1b7c0] -> /usr/bin/dsync(dsync_brain_sync+0xc21) [0x7f21a8b1a6c1] -> /usr/bin/dsync(+0x28e01) [0x7f21a8b1ae01] -> /usr/bin/dsync(dsync_brain_sync+0x7b7) [0x7f21a8b1a257] -> /usr/bin/dsync(+0x28c98) [0x7f21a8b1ac98] -> /usr/bin/dsync(dsync_brain_sync+0x7f8) [0x7f21a8b1a298] -> /usr/bin/dsync(dsync_brain_sync_all+0x18) [0x7f21a8b1ae68] -> /usr/bin/dsync(+0x25f76) [0x7f21a8b17f76] -> /usr/bin/dsync(+0x26461) [0x7f21a8b18461] -> /usr/bin/dsync(+0x13486) [0x7f21a8b05486] -> /usr/bin/dsync(+0x13f51) [0x7f21a8b05f51] -> /usr/bin/dsync(doveadm_mail_try_run+0x159) [0x7f21a8b063e9] -> /usr/bin/dsync(main+0x3a1) [0x7f21a8b05031] -> /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xfd) [0x7f21a7d9cead] Aborted Best Regards, -- --------------------------------------------------------------------- Breno Moreira “O êxito na vida não se mede pelo que você conquistou, mas sim pelas dificuldades que superou no caminho.” * Abraham Lincoln*

3 2

[Dovecot] LMTP Proxy
by Cassidy Larson 10 Jul '13

10 Jul '13

Trying to figure out Proxying with LMTP to a few back end storage servers for quota checking before accepting email delivery on the front end nodes. If I connect to the back end server directly via telnet, everything works great. If I use a front-end server to proxy to the back end server, I don't get the same result. Running 2.2.4 on both front and back end servers. Any help would be appreciated. ------ backend dovecot.log: dovecot: lmtp(72274): Error: userdb lookup(user@host*masteruser): Disconnected unexpectedly dovecot: auth: Fatal: master: service(auth): child 72272 killed with signal 11 (core not dumped) ------ front end dovecot.log: dovecot: lmtp(7495): Debug: auth input: user=user(a)host.comnopassword=<hidden> host=<backend_server_ip> destuser= user(a)host.com*masteruser nologin=Y nodelay=Y proxy=Y pass=<hidden> port=2525 ------ front end dovecot.conf: lmtp_proxy = yes protocols = lmtp protocol lmtp { postmaster_address = postmaster(a)mydomain.com mail_plugins = quota passdb { args = /usr/local/etc/dovecot/dovecot-sql.conf driver = sql } } service lmtp { client_limit = 5 executable = lmtp idle_kill = 0 process_limit = 0 process_min_avail = 0 protocol = lmtp service_count = 0 inet_listener lmtp { address = <frontend_server_ip> port = 2525 } } ------ backend dovecot.conf: auth_master_user_separator = * lmtp_rcpt_check_quota = yes passdb { args = /usr/local/etc/dovecot/dovecot-sql.conf driver = sql master = yes } userdb { args = /usr/local/etc/dovecot/dovecot-sql.conf driver = sql } service lmtp { client_limit = 5 executable = lmtp -L idle_kill = 0 process_limit = 0 process_min_avail = 0 protocol = lmtp service_count = 0 inet_listener lmtp { address = <backend_server_ip> port = 2525 } } protocol lmtp { info_log_path = /var/log/dovecot-lmtp.log postmaster_address = postmaster(a)infowest.com mail_plugins = quota }

3 4

[Dovecot] Non-blocking file_dotlock_open() in quota-maildir question
by do1＠yandex.ru 10 Jul '13

10 Jul '13

Hello, Is it safe to change lines in plugins/quota/quota-maildir.c::maildirsize_write() from fd = file_dotlock_open_group(.., DOTLOCK_CREATE_FLAG_NONBLOCK, ..); to fd = file_dotlock_open_group(.., 0, ..); ? Rationale is: exim+cpanel frequently leave stale maldirsize.lock, but when quota plugin try to dotlock maildirsize, it do this with NONBLOCK flag and just once, so first lock fails with EAGAIN and second may never happen. (When last mail is over quota this also prevent user from further receiving any mail because quota remain exceeded, forver. This is annoing problem.) I wonder if it is possible to do easy fix problem by removing NONBLOCK flag, but as I don't understand why this NONBLOCK flag is used in the first place I decided to ask developers in the list for approval. If removing NONBLOCK flag is not possible I will just call file_dotlock_open_group() twice if first one return -1 with EAGAIN. Best regards, Don.

2 1

[Dovecot] Mailbox statistics (sdbox / indexes) (+ wiki2 frontpage notes)
by Jeroen Massar 10 Jul '13

10 Jul '13

Hi, I used to, with a simple script, loop over the filenames in a Maildir, grab the From from the contents of the file and grab the flags (especially "READ" and "REPLIED") from the filename, but after moving to sdbox these flags are hidden in the index file. Is there anyway to get these out of there programmatically without having to resort to using an imap-client or is that the way to go? (I am effectively counting who has sent the most mail to a mailbox and how many of the the messages have been and have not been replied to; thus another answer would be: "I got a stats program for mailboxes") Greets, Jeroen PS: just reverted the wiki2 Frontpage, apparently even bots know who the author of the IMAP protocol is (leading me to believe that that check does not work): http://wiki2.dovecot.org/FrontPage?action=info I could not find a "revert" button thus copied&pasta'd the previous edition in there. PS2: there seems to be a master.wiki2.dovecot.org and a wiki2.dovecot.org; logging in on the one does not log in on the other, and accounts on the one are different from the other, and it seems cookies go missing also somewhere, hence why an IP is logged and not my account (which I used to have, now was missing and thus I recreated, but needed to do that on both boxes)

3 2

[Dovecot] [PATCH] login-common: Add support for ECDH/ECDHE cipher suites
by David Hicks 10 Jul '13

10 Jul '13

# HG changeset patch # User David Hicks <david(a)hicks.id.au> # Date 1373085976 -36000 # Sat Jul 06 14:46:16 2013 +1000 # Node ID ccd83f38e4b484ae18f69ea08631eefcaf6a4a4e # Parent 1fbac590b9d4dc05d81247515477bfe6192c262c login-common: Add support for ECDH/ECDHE cipher suites ECDH temporary key parameter selection must be performed during OpenSSL context initialisation before ECDH and ECDHE cipher suites can be used. OpenSSL >= 1.0.2 automatically handles ECDH temporary key parameter selection. For OpenSSL < 1.0.2 we must manually specify a named elliptic curve that Dovecot will use to generate an ephemeral key pair. By default we try to use the same named curve as that used in the server's private EC key file. If this attempt fails, a fall back curve of NIST P-384 (secp384r1) is used instead. RFC 6460 states that NIST P-384 MUST be used for cipher suites that include AES-256. For cipher suites that include AES-128, RFC 6460 states that NIST P-256 MUST be used. No matter which curve is used as a fall back option, Dovecot will be non-compliant. The reason for selecting NIST P-384 as a fall back curve is to ensure that the non-compliance is in the form of providing too great a level of security for AES-128 cipher suites rather than too little security for AES-256 cipher suites. diff -r 1fbac590b9d4 -r ccd83f38e4b4 src/login-common/ssl-proxy-openssl.c --- a/src/login-common/ssl-proxy-openssl.c Fri Jun 28 19:48:37 2013 +0300 +++ b/src/login-common/ssl-proxy-openssl.c Sat Jul 06 14:46:16 2013 +1000 @@ -119,6 +119,10 @@ const struct master_service_ssl_settings *ssl_set); static void ssl_server_context_deinit(struct ssl_server_context **_ctx); +static void ssl_proxy_ctx_set_crypto_params(SSL_CTX *ssl_ctx, + const struct master_service_ssl_settings *set); +static int ssl_proxy_ctx_get_pkey_ec_curve_name(const struct master_service_ssl_settings *set); + static unsigned int ssl_server_context_hash(const struct ssl_server_context *ctx) { unsigned int i, g, h = 0; @@ -993,11 +997,58 @@ store = SSL_CTX_get_cert_store(ssl_ctx); load_ca(store, set->ssl_ca, load_xnames ? &xnames : NULL); } + ssl_proxy_ctx_set_crypto_params(ssl_ctx, set); SSL_CTX_set_info_callback(ssl_ctx, ssl_info_callback); + return xnames; +} + +static void +ssl_proxy_ctx_set_crypto_params(SSL_CTX *ssl_ctx, + const struct master_service_ssl_settings *set) +{ +#if !defined(OPENSSL_NO_ECDH) && OPENSSL_VERSION_NUMBER >= 0x10000000L && OPENSSL_VERSION_NUMBER < 0x10002000L + EC_KEY *ecdh; + int nid; + const char *curve_name; +#endif if (SSL_CTX_need_tmp_RSA(ssl_ctx)) SSL_CTX_set_tmp_rsa_callback(ssl_ctx, ssl_gen_rsa_key); SSL_CTX_set_tmp_dh_callback(ssl_ctx, ssl_tmp_dh_callback); - return xnames; +#if !defined(OPENSSL_NO_ECDH) + /* In the non-recommended situation where ECDH cipher suites are being + used instead of ECDHE, do not reuse the same ECDH key pair for + different sessions. This option improves forward secrecy. */ + SSL_CTX_set_options(ssl_ctx, SSL_OP_SINGLE_ECDH_USE); +#endif +#if !defined(OPENSSL_NO_ECDH) && OPENSSL_VERSION_NUMBER >= 0x10002000L + /* OpenSSL >= 1.0.2 automatically handles ECDH temporary key parameter + selection. */ + SSL_CTX_set_ecdh_auto(ssl_ctx, 1); +#elif !defined(OPENSSL_NO_ECDH) && OPENSSL_VERSION_NUMBER >= 0x10000000L + /* For OpenSSL < 1.0.2, ECDH temporary key parameter selection must be + performed manually. Attempt to select the same curve as that used + in the server's private EC key file. Otherwise fall back to the + NIST P-384 (secp384r1) curve to be compliant with RFC 6460 when + AES-256 TLS cipher suites are in use. This fall back option does + however make Dovecot non-compliant with RFC 6460 which requires + curve NIST P-256 (prime256v1) be used when AES-128 TLS cipher + suites are in use. At least the non-compliance is in the form of + providing too much security rather than too little. */ + nid = ssl_proxy_ctx_get_pkey_ec_curve_name(set); + ecdh = EC_KEY_new_by_curve_name(nid); + if (ecdh == NULL) { + /* Fall back option */ + nid = NID_secp384r1; + ecdh = EC_KEY_new_by_curve_name(nid); + } + if ((curve_name = OBJ_nid2sn(nid)) != NULL) + i_debug("SSL: elliptic curve %s will be used for ECDH and" + " ECDHE key exchanges", curve_name); + if (ecdh != NULL) { + SSL_CTX_set_tmp_ecdh(ssl_ctx, ecdh); + EC_KEY_free(ecdh); + } +#endif } static void @@ -1084,6 +1135,28 @@ } static int +ssl_proxy_ctx_get_pkey_ec_curve_name(const struct master_service_ssl_settings *set) +{ + int nid = 0; +#if !defined(OPENSSL_NO_ECDH) && OPENSSL_VERSION_NUMBER >= 0x10000000L && OPENSSL_VERSION_NUMBER < 0x10002000L + EVP_PKEY *pkey; + const char *password; + EC_KEY *eckey; + EC_GROUP *ecgrp; + + password = *set->ssl_key_password != '\0' ? set->ssl_key_password : + getenv(MASTER_SSL_KEY_PASSWORD_ENV); + pkey = ssl_proxy_load_key(set->ssl_key, password); + if (pkey != NULL && + (eckey = EVP_PKEY_get1_EC_KEY(pkey)) != NULL && + (ecgrp = EC_KEY_get0_group(eckey)) != NULL) + nid = EC_GROUP_get_curve_name(ecgrp); + EVP_PKEY_free(pkey); +#endif + return nid; +} + +static int ssl_proxy_ctx_use_certificate_chain(SSL_CTX *ctx, const char *cert) { /* mostly just copy&pasted from SSL_CTX_use_certificate_chain_file() */ @@ -1209,7 +1282,6 @@ #endif ssl_proxy_ctx_use_key(ctx->ctx, ssl_set); - SSL_CTX_set_info_callback(ctx->ctx, ssl_info_callback); if (ctx->verify_client_cert) ssl_proxy_ctx_verify_client(ctx->ctx, xnames);

2 1

[Dovecot] dovecot.index disappeared
by Metro Domain Admin 10 Jul '13

10 Jul '13

Hello, One of my users just mysteriously lost all files from his inbox. I have "mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename" but couldn't find any evidence of accidental file or folder deletion. I logged in to find that ~user/mdbox/mailboxes/INBOX/dbox-Mails/dovecot.index and its backup were tiny, only 552 bytes, when the folder had thousands of messages. Other folders were left intact. We are running 2.1.15 (mdbox) on Ubuntu 12.10 using ext4. The system was rebooted about 10 days before and the full INBOX was definitely seen since the reboot. I'm just looking for ideas about what might have happened. Thanks, Tony

2 1

[Dovecot] Right way to share some global mailboxes
by Dieter Knopf 09 Jul '13

09 Jul '13

Hello, i'm using Dovecot since a long time but now I need to share folders for global mail adresses like info@ and support@ between all users. What is the right way to share this mailboxes between many users (everyone with own read flag). My config for location is: mail_location = maildir:/home/vmail/%d/%n:INDEX=/home/vmail-indexes/%d/%n And now i have a folder like /home/vmail/bar.com/foo for sharing... Thanks!

3 3

Re: [Dovecot] Anyone know dovecot?
by Reindl Harald 09 Jul '13

09 Jul '13

Am 09.07.2013 13:52, schrieb Tom Horsley: > I keep getting this sort of garbage cluttering my logs: > > dovecot: master: Warning: /ada/denmark is no longer mounted. See http://wiki2.dovecot.org/Mountpoints: 1 Time(s) > > I have indeed seen the wiki page mentioned, and even > tried what it says, but nothing seems to "stick". > Any time a filesystem gets mounted, I apparently > also have to invoke doveadm yet again to make > it ignore the new dadgum filesystem. (The wildcards > mentioned in that web page seem only to apply to > existing filesystems, not new mounts). > > Is there a way to just make it stop forever? no, i asked on the dovecot list why this happens since dovecot 2.0 and upstream believes it is a good idea to assume that every random mounted FS could be relevant for email because it *may* be referred in a config-include instead throw only a fatal error if this is the case and something can not be accessed

1 0