- dovecot - dovecot.org

[Dovecot] Dovecot + SELinux permission problems
by Johnny 24 Jun '13

24 Jun '13

Hi, I have set-up dovecot on a F17 box and am encountering weirdnesses with SELinux (who isn't??). Again, I am trying to refrain from disabling SWLinux all together, however tempting, but am stuck in troubleshooting and hope for some ideas... With SELinux set to permissive, I can connect to dovecot and log in to access my mail as expected. With SELinux enforcing, I can connect to dovecot, but cannot login to access mail. The log states ,---- log_path = /var/log/dovecot (set in 10-logging.conf) | Jun 23 15:43:58 imap-login: Info: Login: user=<johndoe>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, mpid=15189, secured, session=<xJl+U9PfvgB/AAAB> | Jun 23 15:43:58 imap(johndoe): Error: chdir(/home/user/data1/Maildir//) failed: Permission denied (euid=1000(user) egid=1000(user) missing +w perm: /home/user/data1/Maildir// stat(/home/user/data1/Maildir//) failed: Permission denied) | Jun 23 15:43:58 imap(johndoe): Error: chdir(/home/user/data1/Maildir/) failed: Permission denied | Jun 23 15:43:58 imap(johndoe): Error: user johndoe: Initialization failed: Namespace '': stat(/home/user/data1/Maildir//johndoe) failed: Permission denied (euid=1000(user) egid=1000(user) missing +w perm: /home/user/data1/Maildir//johndoe stat(/home/user/data1/Maildir//johndoe) failed: Permission denied) | Jun 23 15:43:58 imap(johndoe): Error: Invalid user settings. Refer to server log for more information. `---- Only thing I can grasp is *write permission* error. ls -l on the Maildirs shows this should not be the case for uid 1000. ,---- ls -l | drwxrwxr-x. 11 user user 4096 Jul 8 2012 Maildir | \> drwx------. 19 user user 4096 Feb 5 09:04 johndoe `---- I have no idea what the server log is referring to, in the debug log I get ,---- debug_log_path = /var/log/dovecot_debug (set in 10-logging.conf) | Jun 23 15:43:58 imap: Debug: Added userdb setting: mail=maildir:~/johndoe | Jun 23 15:43:58 imap(johndoe): Debug: Effective uid=1000, gid=1000, home=/home/user/data1/Maildir/ | Jun 23 15:43:58 imap(johndoe): Debug: Namespace inbox: type=private, prefix=, sep=., inbox=yes, hidden=no, list=yes, subscriptions=yes location=maildir:~/johndoe | Jun 23 15:43:58 imap(johndoe): Debug: maildir++: root=/home/user/data1/Maildir//johndoe, index=, control=, inbox=/home/user/data1/Maildir//johndoe, alt= `---- I had thought SELinux would log something, but /var/log/audit/audit.log is blank... Where to go from here?? Any ideas appreciated... -- Johnny

2 2

[Dovecot] Preoccupied at the moment
by Stephan Bosch 23 Jun '13

23 Jun '13

Hi, Something's come up and I am preoccupied at the moment until the 2nd of July. I won't be answering Dovecot mailing list until then (maybe a day or two earlier). Regards, Stephan.

1 0

[Dovecot] tables between dovecot and postfix and a paradoxical question
by Mohsen Pahlevanzadeh 23 Jun '13

23 Jun '13

Dear all, I read we create the following table in wiki2 : CREATE TABLE users ( userid VARCHAR(128) NOT NULL, domain VARCHAR(128) NOT NULL, password VARCHAR(64) NOT NULL, home VARCHAR(255) NOT NULL, uid INTEGER NOT NULL, gid INTEGER NOT NULL ); But i read the following text in the official postfix documentation : "DO create tables with each matching item as a key and with an arbitrary value. With SQL databases it is not uncommon to return the key itself or a constant value." ref: http://www.postfix.org/mysql_table.5.html How can i combine together? --mohsen

3 2

[Dovecot] use Alternative Storage as a cloud mail service
by ♥ NiNJA ♂ 22 Jun '13

22 Jun '13

Hi all I'm trying to create a mail service provider I like to know is it possible to have some servers as storage servers And automatically put email datas on the servers Something like having 3 servers , If server two get full , Automatically use server three If it's possible give me some solutions to use I like to use CentOS OS on my servers Thanks in advance

1 0

[Dovecot] Problem with virtual user mailbox initialization
by Denis Kasak 22 Jun '13

22 Jun '13

Hello, I'm trying to set up a postfix/dovecot server where postfix hands over incoming mail to dovecot using lmtp virtual transport via a Unix socket. Dovecot is then supposed to write the mail to /var/mail/<domain>/<user>/ using a virtual users setup. It seems to work except for failing when the mailbox is supposed to be initially created: Jun 22 03:25:04 lmtp(2400, dkasak(a)foo.org) Error: user dkasak(a)foo.org: Initialization failed: Namespace '': mkdir(/var/mail/foo.org/dkasak) failed: Permission denied (euid=5000(postman) egid=5000(postman) missing +w perm: /var/mail, we're not in group 6(mail), dir owned by 0:6 mode=0775) As can be seen from the error message, I've set mail_uid and mail_gid to account/group postman. /var/mail/ is empty and owned by root:mail so I've also set mail_privileged_group = mail. I was under the impression that mail_privileged_group is used precisely for these situations (when dotlocking or initial creation of the mailbox fail due to insufficient privileges), but it still doesn't work. If I either set mail_gid = mail, or set mail_access_groups = mail, or create foo.org/ owned by postman:postman by hand, it works as expected. Here is the complete configuration: # 2.2.2: /usr/local/etc/dovecot/dovecot.conf # OS: FreeBSD 9.1-RELEASE-p4 i386 ufs base_dir = /var/run/dovecot/ mail_gid = postman mail_location = maildir:/var/mail/%d/%n/:LAYOUT=fs mail_privileged_group = mail mail_uid = postman managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = separator = / type = private } passdb { args = scheme=CRYPT username_format=%u /etc/dovecot/users driver = passwd-file } plugin { sieve = ~/.dovecot.sieve sieve_dir = ~/sieve } protocols = imap lmtp service auth-worker { user = $default_internal_user } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } } service imap-login { inet_listener imap { port = 143 } } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0660 user = postfix } } ssl = required ssl_cert = </etc/ssl/certs/dovecot.pem ssl_key = </etc/ssl/private/dovecot.pem userdb { args = username_format=%u /etc/dovecot/users default_fields = quota_rule=*:storage=2G driver = passwd-file } protocol imap { mail_plugins = " notify mail_log" } Any ideas? -- Denis Kasak

1 0

Re: [Dovecot] Calling dovecot-lda from within Antispam pipe script (bash) seems to have no effect
by Joseph Tam 22 Jun '13

22 Jun '13

Ben Johnson <ben(a)indietorrent.org> writes: > I added debugging output to the script, which now prints the environment > variables. My script now outputs the following: > ... > CONFIG_FILE=/var/run/dovecot/config > ... > Does anything jump-out at you? You didn't provide the analogous output from the interactive shell to see the differences (for example, USER might be being used), but from your later strace, I guess CONFIG_FILE has something to do with it. These threads seems relevant http://www.dovecot.org/list/dovecot/2011-May/059127.html http://www.mail-archive.com/dovecot@dovecot.org/msg38349.html That thread poster solved his problem by commenting out service imap-postlogin { # user = $default_internal_user ... } but I have no idea if it works, or whether it's a good idea, for your case. More docs http://wiki2.dovecot.org/PostLoginScripting Joseph Tam <jtam.home(a)gmail.com>

1 0

[Dovecot] Getting NTLM authentication for Postfix SMTP clients to work
by Matthew Larsen 22 Jun '13

22 Jun '13

I'm trying to get NTLM authentication working with Dovecot to authenticate Postfix SMTP clients. I can authenticate postfix smtp clients using the plain text login mechanism through winbind. However, using the NTLM mechanism gives me an error in my maillog that says: "dovecot: auth: winbind(?,10.20.2.0): user not authenticated: NT_STATUS_UNSUCCESSFUL". At this point, I'm rather stuck. It appears PAM and winbind work for authenticating with AD because it works with the plain text mechanism, but I'm missing something with the NTLM authentication method. Any suggestions as to what I've got wrong, or other logging I can turn up / examine that might shed some light on this? When I use the LOGIN mechanism I see this in the mail logging and the message is relayed: Jun 21 13:12:58 SBSMTPNV05 postfix/smtpd[1501]: connect from nvit01b.mydomain.com[10.20.2.**0] Jun 21 13:12:58 SBSMTPNV05 dovecot: auth: Debug: auth client connected (pid=1501) Jun 21 13:12:58 SBSMTPNV05 dovecot: auth: Debug: client in: AUTH#0111#011PLAIN#011service=**smtp#011nologin#011lip=10.20.**4 .12#011rip=10.20.2.0#011resp=**AG[...snip...]g== Jun 21 13:12:58 SBSMTPNV05 dovecot: auth: Debug: pam(myusername,10.20.2.0): lookup service=dovecot Jun 21 13:12:58 SBSMTPNV05 dovecot: auth: Debug: pam(myusername,10.20.2.0): #1/1 style=1 msg=Password: Jun 21 13:12:58 SBSMTPNV05 dovecot: auth: Debug: client out: OK#0111#011user=myusername Jun 21 13:12:58 SBSMTPNV05 postfix/smtpd[1501]: 54EAF8059B: client= nvit01b.mydomain.com[**10.20.2.0], sasl_method=PLAIN, sasl_username=myusername Jun 21 13:12:58 SBSMTPNV05 postfix/cleanup[1504]: 54EAF8059B: message-id=< 51C4B3C8.30008(a)**domain1.com <51C4B3C8.30008(a)domain1.com>> Jun 21 13:12:58 SBSMTPNV05 postfix/qmgr[1499]: 54EAF8059B: from=< someone(a)domain1.com>, size=2700, nrcpt=1 (queue active) Jun 21 13:12:58 SBSMTPNV05 postfix/smtpd[1501]: disconnect from nvit01b.mydomain.com[10.20.2.**0] Jun 21 13:12:59 SBSMTPNV05 postfix/smtp[1505]: 54EAF8059B: to=< someone(a)gmail.com>, relay=gmail-smtp-in.l.google.**com<http://gmail-smtp-in.l.google.com/>[74.125.25.27]:25, delay=1.2, delays=0.23/0.04/0.16/0.72, dsn=2.0.0, status=sent (250 2.0.0 OK 1371845579 wf5si3786287pab.138 - gsmtp) Jun 21 13:12:59 SBSMTPNV05 postfix/qmgr[1499]: 54EAF8059B: removed I also see this in the secure log: Jun 21 13:12:58 SBSMTPNV05 auth: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=myusername rhost=10.20.2.0 user=myusername Jun 21 13:12:58 SBSMTPNV05 auth: pam_winbind(dovecot:auth): getting password (0x00000010) Jun 21 13:12:58 SBSMTPNV05 auth: pam_winbind(dovecot:auth): pam_get_item returned a password Jun 21 13:12:58 SBSMTPNV05 auth: pam_winbind(dovecot:auth): user 'myusername' granted access Jun 21 13:12:58 SBSMTPNV05 auth: pam_winbind(dovecot:account): user 'myusername' granted access However, when I switch the mechanism to NTLM in the Thurnderbird MUA I see this: Jun 21 13:15:46 SBSMTPNV05 postfix/smtpd[1506]: connect from nvit01b.mydomain.com[10.20.2.**0] Jun 21 13:15:46 SBSMTPNV05 dovecot: auth: Debug: Loading modules from directory: /usr/lib64/dovecot/auth Jun 21 13:15:46 SBSMTPNV05 dovecot: auth: Debug: Module loaded: /usr/lib64/dovecot/auth/**libauthdb_ldap.so Jun 21 13:15:46 SBSMTPNV05 dovecot: auth: Debug: Module loaded: /usr/lib64/dovecot/auth/**libdriver_sqlite.so Jun 21 13:15:46 SBSMTPNV05 dovecot: auth: Debug: Module loaded: /usr/lib64/dovecot/auth/**libmech_gssapi.so Jun 21 13:15:46 SBSMTPNV05 dovecot: auth: Debug: auth client connected (pid=1506) Jun 21 13:15:46 SBSMTPNV05 dovecot: auth: Debug: client in: AUTH#0111#011NTLM#011service=**smtp#011nologin#011lip=10.20.**4. 12#011rip=10.20.2.0#011resp=**TlRMT[...snip...]A= Jun 21 13:15:46 SBSMTPNV05 dovecot: auth: Debug: client out: CONT#0111#011TlRMT[[...snip...**]A Jun 21 13:15:46 SBSMTPNV05 dovecot: auth: Debug: client in: CONT#0111#011TlRMT[...snip...]**A= Jun 21 13:15:46 SBSMTPNV05 dovecot: auth: winbind(?,10.20.2.0): user not authenticated: NT_STATUS_UNSUCCESSFUL Jun 21 13:15:48 SBSMTPNV05 postfix/smtpd[1506]: warning: nvit01b.mydomain.com[10.20.2.**0]: SASL NTLM authentication failed: TlRMT[...snip...]A Jun 21 13:15:48 SBSMTPNV05 dovecot: auth: Debug: client out: FAIL#0111 Jun 21 13:15:49 SBSMTPNV05 postfix/smtpd[1506]: disconnect from nvit01b.mydomain.com[10.20.2.**0] with nothing in the secure log and I don't see anything show up in the winbind logs either. I've reviewed these pages as reference, and I'm not sure what I'm missing: http://wiki2.dovecot.org/**HowTo/ActiveDirectoryNtlm<http://wiki2.dovecot.org/HowTo/ActiveDirectoryNtlm> http://wiki2.dovecot.org/**Authentication/Mechanisms/NTLM<http://wiki2.dovecot.org/Authentication/Mechanisms/NTLM> http://www.dovecot.org/list/**dovecot/2008-December/035630.**html<http://www.dovecot.org/list/dovecot/2008-December/035630.html> http://www.dovecot.org/list/**dovecot/2010-February/046763.**html<http://www.dovecot.org/list/dovecot/2010-February/046763.html> http://blog.al-shami.net/2008/**05/freebsd-postfix-dovecot-** and-active-directory/<http://blog.al-shami.net/2008/05/freebsd-postfix-dovecot-and-active-directo…> http://wiki2.dovecot.org/**HowTo/PostfixAndDovecotSASL<http://wiki2.dovecot.org/HowTo/PostfixAndDovecotSASL> Here's some of my relevant configuration as I understand it: I've joined the computer to the AD domain. The wbinfo tests work fine: # wbinfo -t checking the trust secret for domain MYDOMAIN via RPC calls succeeded # doveconf -n # 2.0.9: /etc/dovecot/dovecot.conf # OS: Linux 2.6.32-358.11.1.el6.x86_64 x86_64 CentOS release 6.4 (Final) auth_debug_passwords = yes auth_mechanisms = plain ntlm login auth_use_winbind = yes auth_username_format = %Lu listen = * mbox_write_locks = fcntl passdb { driver = pam } service auth { unix_listener /var/spool/postfix/private/**auth { group = postfix mode = 0666 user = postfix } } ssl_cert = </etc/pki/dovecot/certs/**dovecot.pem ssl_key = </etc/pki/dovecot/private/**dovecot.pem userdb { driver = passwd } //////////////////// # postconf -n alias_database = hash:/etc/aliases alias_maps = hash:/etc/aliases command_directory = /usr/sbin config_directory = /etc/postfix daemon_directory = /usr/libexec/postfix data_directory = /var/lib/postfix debug_peer_level = 7 html_directory = no inet_interfaces = all inet_protocols = ipv4 line_length_limit = 6144 mail_owner = postfix mailq_path = /usr/bin/mailq.postfix manpage_directory = /usr/share/man mydestination = $myhostname, localhost.$mydomain, localhost myhostname = srvsbsmtp05.mydomain.com newaliases_path = /usr/bin/newaliases.postfix queue_directory = /var/spool/postfix readme_directory = /usr/share/doc/postfix-2.6.6/**README_FILES sample_directory = /usr/share/doc/postfix-2.6.6/**samples sendmail_path = /usr/sbin/sendmail.postfix setgid_group = postdrop smtpd_recipient_restrictions = permit_sasl_authenticated,**reje ct_unauth_destination smtpd_sasl_auth_enable = yes smtpd_sasl_path = private/auth smtpd_sasl_type = dovecot unknown_local_recipient_**reject_code = 550 ///////////////////// # cat /etc/krb5.conf [logging] default = FILE:/var/log/krb5libs.log kdc = FILE:/var/log/krb5kdc.log admin_server = FILE:/var/log/kadmind.log [libdefaults] default_realm = MYDOMAIN.COM <http://mydomain.com/> dns_lookup_realm = true dns_lookup_kdc = true ticket_lifetime = 24h renew_lifetime = 7d forwardable = true [domain_realm] .mydomain.com = MYDOMAIN.COM <http://mydomain.com/> mydomain.com = MYDOMAIN.COM <http://mydomain.com/> //////////////////// system keytab: # klist -ke Keytab name: FILE:/etc/krb5.keytab KVNO Principal ---- ------------------------------**------------------------------** -------------- 3 host/sbsmtpnv05.mydomain.com(a)**MYDOMAIN.COM<sbsmtpnv05.mydomain.com(a)MYDOMAIN.COM> (des-cbc-crc) 3 host/sbsmtpnv05.mydomain.com(a)**MYDOMAIN.COM<sbsmtpnv05.mydomain.com(a)MYDOMAIN.COM> (des-cbc-md5) 3 host/sbsmtpnv05.mydomain.com(a)**MYDOMAIN.COM<sbsmtpnv05.mydomain.com(a)MYDOMAIN.COM> (arcfour-hmac) 3 host/sbsmtpnv05.mydomain.com(a)**MYDOMAIN.COM<sbsmtpnv05.mydomain.com(a)MYDOMAIN.COM> (aes128-cts-hmac-sha1-96) 3 host/sbsmtpnv05.mydomain.com(a)**MYDOMAIN.COM<sbsmtpnv05.mydomain.com(a)MYDOMAIN.COM> (aes256-cts-hmac-sha1-96) 3 host/sbsmtpnv05(a)MYDOMAIN.COM (des-cbc-crc) 3 host/sbsmtpnv05(a)MYDOMAIN.COM (des-cbc-md5) 3 host/sbsmtpnv05(a)MYDOMAIN.COM (arcfour-hmac) 3 host/sbsmtpnv05(a)MYDOMAIN.COM (aes128-cts-hmac-sha1-96) 3 host/sbsmtpnv05(a)MYDOMAIN.COM (aes256-cts-hmac-sha1-96) 3 SBSMTPNV05$(a)MYDOMAIN.COM <http://mydomain.com/> (des-cbc-crc) 3 SBSMTPNV05$(a)MYDOMAIN.COM <http://mydomain.com/> (des-cbc-md5) 3 SBSMTPNV05$(a)MYDOMAIN.COM <http://mydomain.com/> (arcfour-hmac) 3 SBSMTPNV05$(a)MYDOMAIN.COM <http://mydomain.com/> (aes128-cts-hmac-sha1-96) 3 SBSMTPNV05$(a)MYDOMAIN.COM <http://mydomain.com/> (aes256-cts-hmac-sha1-96) 5 smtp/sbsmtpnv05.mydomain.com(a)**MYDOMAIN.COM<sbsmtpnv05.mydomain.com(a)MYDOMAIN.COM> (des-cbc-crc) 5 smtp/sbsmtpnv05.mydomain.com(a)**MYDOMAIN.COM<sbsmtpnv05.mydomain.com(a)MYDOMAIN.COM> (des-cbc-md5) 5 smtp/sbsmtpnv05.mydomain.com(a)**MYDOMAIN.COM<sbsmtpnv05.mydomain.com(a)MYDOMAIN.COM> (arcfour-hmac) 5 smtp/sbsmtpnv05.mydomain.com(a)**MYDOMAIN.COM<sbsmtpnv05.mydomain.com(a)MYDOMAIN.COM> (aes128-cts-hmac-sha1-96) 5 smtp/sbsmtpnv05.mydomain.com(a)**MYDOMAIN.COM<sbsmtpnv05.mydomain.com(a)MYDOMAIN.COM> (aes256-cts-hmac-sha1-96) //////////////////// Samba config: [global] workgroup = MYDOMAIN realm = MYDOMAIN.COM <http://mydomain.com/> server string = Samba Server Version %v security = ADS kerberos method = system keytab log file = /var/log/samba/log.%m max log size = 50 printcap name = /dev/null domain master = No template shell = /bin/bash winbind separator = + winbind use default domain = Yes idmap config * : range = 10000-50000 idmap config * : backend = tdb printing = bsd cups options = raw print command = lpr -r -P'%p' %s lpq command = lpq -P'%p' lprm command = lprm -P'%p' %j

1 0

[Dovecot] Sieve Plugin Setup
by Denny Jones 22 Jun '13

22 Jun '13

I've got an existing setup that I want to add Sieve filtering to. I'm on QmailToaster: qmailadmin-toaster-1.2.16-1.4.0 I using Dovecot version 2.0.11 I'm looking for a good tutorial for installing Sieve Rules functionality on an existing system. Anybody know of one? Anybody else done this? Do I just install the latest Dovecot-sieve plugin release with wget, etc? What kind of configuration can I expect to have to go through. Do I have to reconfigure Dovecot to work in conjunction with the Sieve plugin? I'm hoping to find someone else has done this that can help me navigate the waters so-to-speak. Thanks in advance, Denny

2 1

[Dovecot] Pound Sign # in password
by Jackie Lowery 21 Jun '13

21 Jun '13

Is there any way to use a pound sign # in my postfix user password in the dovecot sql configuration file.

2 2

Re: [Dovecot] Calling dovecot-lda from within Antispam pipe script (bash) seems to have no effect
by Joseph Tam 21 Jun '13

21 Jun '13

Ben Johnson writes: > It really boils-down to the fact that I can call the following on the > command-line and it functions as expected: > > su vmail -c '/usr/lib/dovecot/deliver -a "sa-training(a)example.com" -d > "sa-training(a)example.com" -m "Training.SPAM" -p > "/tmp/sendmail-msg-25794.txt"' > > Yet, when I attempt to do the exact same thing from within the pipe > script that Dovecot Antispam calls, I receive exit code 75 from > deliver/dovecot-lda and absolutely nothing is logged, with exception of > the information of which I'm already aware (logged to syslog). Have you also checked the environment variables? I think dovecot-lda gets some information from them. Also, it's possible the PATH or some other critical environment variables is different, causing the difference in outcome. Joseph Tam <jtam.home(a)gmail.com>

2 1