- dovecot - dovecot.org

[Dovecot] Configure dovecot to provide SASL authentication
by Peter Skensved 21 May '13

21 May '13

Hi, I'm trying to get dovecot to provide SASL authentication for postfix My setup appears to be working but I'm not 100% certain I've got it right. I've come across several examples for dovecot version 1 but I'm running 2.0.9. The output of doveconf -n is here : 2.0.9: /etc/dovecot/dovecot.conf # OS: Linux 2.6.32-279.2.1.el6.x86_64 x86_64 CentOS release 6.3 (Final) auth_debug = yes auth_verbose = yes disable_plaintext_auth = no mbox_write_locks = fcntl passdb { driver = pam } protocols = imap service auth { unix_listener /var/spool/postfix/private/auth { mode = 0666 } } ssl_cert = </etc/pki/dovecot/certs/dovecot.pem ssl_key = </etc/pki/dovecot/private/dovecot.pem userdb { driver = passwd } Specifically : are the "service auth", userdb and passdb sections correct ? And the mode ? Or is it too permissive ? For completeness the postfix setup is here : smtpd_sasl_auth_enable = yes broken_sasl_auth_clients = yes smtpd_sasl_type = dovecot smtpd_sasl_path = private/auth smtpd_sasl_security_options = noanonymous # smtpd_delay_reject = yes smtpd_helo_required = yes smtpd_helo_restrictions = permit_mynetworks, reject_non_fqdn_helo_hostname, reject_invalid_helo_hostname, permit # smtpd_sender_restrictions = permit_mynetworks, reject_non_fqdn_sender, reject_unknown_sender_domain, permit # smtpd_recipient_restrictions = reject_unauth_pipelining, reject_non_fqdn_recipient, reject_unknown_recipient_domain, permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination, permit # peter ---- Peter Skensved Dept. of Physics, Queen's University, Kingston, Ontario, Canada

3 2

[Dovecot] How to configure ssl cert chain in dovecot 10-ssl.conf file
by Bu Xiaobing 21 May '13

21 May '13

Hi there, Does anyone know how to do this: "Put all the certificates in the ssl_cert file. For example when using a certificate signed by TDC the correct order is: Dovecot's public certificate TDC SSL Server CA TDC Internet Root CA Globalsign Partners CA " I try to set these parameters in the conf.d/10-ssl.conf as below, but it seems doesn't work. --- ssl_cert = </etc/pki/dovecot/certs/mail.mymailserver.com.crt ssl_cert = </etc/ssl/certs/dovecot/sub.class1.server.ca.pem ssl_cert = </etc/ssl/certs/dovecot/ca.pem ---- I even cat mail.mymailserver.com.crt sub.class1.server.ca.pem certs/dovecot/ca.pem into one singe file, and define ssl_cert = < /path/to/the/singcertfile.pem, but it doesn't work too. In my apache httpd server httpd.conf file I can define: -- SSLCertificateChainFile /etc/pki/dovecot/certs/sub.class1.server.ca.pem SSLCACertificateFile /etc/pki/dovecot/certs/ca.pem -- And it well work fine. Thinks for any suggest. Bu Xiaobing

2 3

[Dovecot] Pigeonhole: extprograms - pipe
by Anes Mukhametov 20 May '13

20 May '13

Hello! I've tried to use extprograms pipe feature but stuck with "Broken pipe" errors in mail log: May 17 15:18:57 backend1 dovecot: lmtp(20338, user(a)domain.tld) Debug: 3VMVFWFKllFyTwAArRg8UA: sieve: action pipe: running program: learn May 17 15:18:57 backend1 dovecot: script: Error: write(response) failed: Broken pipe May 17 15:18:57 backend1 dovecot: lmtp(20338, user(a)domain.tld) 3VMVFWFKllFyTwAArRg8UA: sieve: execution of script /data/mail/storage/domain/user(a)domain.tld/.dovecot.sieve;name=main script failed, but implicit keep was successful (user logfile /data/mail/storage/domain/buser(a)domain.tld/.dovecot.sieve.log should reveal additional details) /data/mail/storage/domain/buser(a)domain.tld/.dovecot.sieve.log: error: msgid=<c7cd36f19be8164addf091a646b8b284(a)domain.tld>: pipe action: failed to pipe message to program `learn': refer to server log for more information. [2013-05-17 15:18:57] ham user(a)domain.tld 50796. Sieve script contents: require ["fileinto","copy","mailbox","vnd.dovecot.pipe"]; if anyof (header :is "Subject" "ham") { pipe :try "learn" ["ham"]; fileinto "INBOX/ham"; stop; } Sieve plugin config uncommented conents: sieve_plugins = sieve_extprograms *sieve_pipe_socket_dir = sieve-pipe* # Define the executed script as parameter to the sieve service executable = script /etc/dovecot/scripts/spam.sh # Use some unprivileged user for executing the program user = nobody # The unix socket located in the sieve_pipe_socket_dir (as defined in the # plugin {} section above) unix_listener sieve-pipe/learn { # LDA/LMTP must have access user = nobody mode = 0777 } } spam.sh is message processing script which interacts with spamassassin. I've tested pipe with spam.sh that redirects stdin to /dev/null and returns 0 but errors were logged anyway. Note that spam.sh runs, getting the message from sieve and processing it to spamassassin without a problem, but "broken pipe" is being logged.

3 4

Re: [Dovecot] Configure dovecot to provide SASL
by Peter Skensved 20 May '13

20 May '13

> > > Am 19.05.2013 17:51, schrieb Peter Skensved: > > service auth { > > unix_listener /var/spool/postfix/private/auth { > > mode = 0666 > > } > > chmod 666 is always a very bad idea > > > service auth { > unix_listener /var/spool/postfix/private/auth { > mode = 0660 > user = postfix > group = postfix > } > } > Thanks for the reply - - all the other sockets in /var/spool/postfix/private have mode 666 ( and the directory itself mode 700 ) but that is probably a question for the postfix list.... peter

1 0

[Dovecot] v2.2.2 + dsync version incompatibility
by Timo Sirainen 20 May '13

20 May '13

Looks like dsync v2.2.2 isn't fully compatible with earlier dsync versions, unless you add: http://hg.dovecot.org/dovecot-2.2/rev/e0156c479a12

1 0

[Dovecot] Linking mdbox directories
by Alex Crow 20 May '13

20 May '13

Hi Timo/list, We have a scenario in which some email accounts on dovecot (stored in mdbox, separate paths for indexes, email, ALT storage and also using SIS for attachments, LDAP directory) need their names changed. I know we could just change the mail LDAP attribute (and leave mailMessageStore alone) so they keep the same directories on disk, but this would throw a spanner in the works for our backups. Would it be possible to create a hard link of the user's directories under the new name, and change the LDAP mailMessageStore attribute to point to these without stopping and starting dovecot? And after a while unlink the original locations? Or would this mess up dovecot's internal state? Thanks Alex -- This message is intended only for the addressee and may contain confidential information. Unless you are that person, you may not disclose its contents or use it in any way and are requested to delete the message along with any attachments and notify us immediately. "Transact" is operated by Integrated Financial Arrangements plc. 29 Clement's Lane, London EC4N 7AE. Tel: (020) 7608 4900 Fax: (020) 7608 5300. (Registered office: as above; Registered in England and Wales under number: 3727592). Authorised and regulated by the Financial Conduct Authority (entered on the Financial Services Register; no. 190856).

2 2

[Dovecot] doveadm altmove to gzipped-mdbox
by Claus 20 May '13

20 May '13

Hi, im wondering if it's possible to store old messages in a compressed mdbox on alternate storage. The main storage is uncompressed mdbox. I tried something like: doveadm -Dv -o "plugin/zlib_save=gz" altmove -u testuser sentbefore 8d Could someone tell me if it's possible and give me a hint how this can be done? I tried this with dovecot-2.2 Claus

2 2

[Dovecot] Empty file in maildirs
by Roel Wagenaar 20 May '13

20 May '13

I am cleaning up some old users, and found that in every maildir folder there is an empty file called maildirfolder, created at the time the original dovecot was installed. Is this empty file necessary for dovecot, or is it left there in an upgrade proces and can it be removed? Dovecot 2.1.7, on Debian wheezy. -- Roel Wagenaar, Linux-User #469851 with the Linux Counter; http://linuxcounter.net/ Antw.: Omdat het de volgorde verstoord waarin mensen tekst lezen. Vraag: Waarom is top-posting een slechte gewoonte? Antw.: Top-posting. Vraag: Wat is het meest ergerlijke in e-mail? If we aren't supposed to eat amimals, why are they made with meat?

2 1

[Dovecot] v2.2.2 released
by Timo Sirainen 20 May '13

20 May '13

http://dovecot.org/releases/2.2/dovecot-2.2.2.tar.gz http://dovecot.org/releases/2.2/dovecot-2.2.2.tar.gz.sig It's been a while since v2.2.1. I think all of the bad bugs in v2.2 series should be fixed by now, so here's a new release. I think there are still some small URLAUTH bugs left though, so you might want to wait before enabling it in production (imap_urlauth_host is empty by default, which disables it). + zlib: Keep the last mail cached uncompressed in a temp file. This fixes performance when doing small partial fetches from a large mail. + acl: If plugin { acl_defaults_from_inbox = yes } is set, get the default ACLs for private and shared namespaces from the user's INBOX. (This probably will become default in v2.3.) + pop3: Added pop3_deleted_flag setting to switch POP3 deletions to only hide the messages from POP3, but still be visible via IMAP. - ACL plugin: Mailbox creation wasn't actually checking any ACLs and always succeeded (due to some v2.2 API changes). The created mailbox couldn't have been accessed though, so this couldn't have caused any data leak. - IMAP: Various URLAUTH fixes. - IMAP: Fixed a hang with invalid APPEND parameters. - IMAP LIST-EXTENDED: INBOX was never listed with \Subscribed flag. - mailbox_list_index=yes still caused crashes. - maildir: Fixed a crash after dovecot-keywords file was re-read. - maildir: If files had reappeared unexpectedly to a Maildir, they were ignored until index files were deleted. - Maildir: Fixed handling over 26 keywords in a mailbox. - Maildir++: Fixed mail_shared_explicit_inbox=no - namespace { prefix="" list=no } was listing mailboxes. - imap/pop3-login proxying: Fixed a crash if TCP connection succeeded, but the remote login timed out. - Case-insensitive search/sort didn't work correctly for all unicode characters, as specified by i;unicode-casemap comparator. If full text search indexes were used, they need to be rebuilt for old mails to be handled correctly. (This bug has existed always in Dovecot.)

2 3

[Dovecot] Sieve was installed but doesn't work or log
by Jim McNamara 18 May '13

18 May '13

Hello everyone. I have dovecot version 1.2.8 installed from source. This morning I installed the sieve plugin to sort emails, and though the install reported no errors, the plugin doesn't seem to function, and no mention of it is made in the logs when I turn on verbose logging. dovecot --version 1.2.8 dovecot -n # 1.2.8: /usr/local/etc/dovecot.conf # OS: Linux 3.2.0-4-amd64 x86_64 Debian 7.0 base_dir: /usr/local/var/run/dovecot/ log_path: /dev/stderr info_log_path: /dev/stderr log_timestamp: protocols: imap imaps pop3s listen(default): 127.0.0.1:143 listen(imap): 127.0.0.1:143 listen(pop3): * ssl_listen(default): 192.168.1.1:993 ssl_listen(imap): 192.168.1.1:993 ssl_listen(pop3): 192.168.1.1:995 ssl_cert_file: /var/qmail/control/servercert.pem ssl_key_file: /var/qmail/control/servercert.pem ssl_cipher_list: ALL:!LOW verbose_ssl: yes login_dir: /usr/local/var/run/dovecot/login login_executable(default): /usr/local/libexec/dovecot/imap-login login_executable(imap): /usr/local/libexec/dovecot/imap-login login_executable(pop3): /usr/local/libexec/dovecot/pop3-login verbose_proctitle: yes first_valid_uid: 89 last_valid_uid: 89 mail_location: maildir:~/Maildir mail_debug: yes mail_executable(default): /usr/local/libexec/dovecot/imap mail_executable(imap): /usr/local/libexec/dovecot/imap mail_executable(pop3): /usr/local/libexec/dovecot/pop3 mail_plugins(default): quota imap_quota mail_plugins(imap): quota imap_quota mail_plugins(pop3): quota mail_plugin_dir(default): /usr/local/lib/dovecot/imap mail_plugin_dir(imap): /usr/local/lib/dovecot/imap mail_plugin_dir(pop3): /usr/local/lib/dovecot/pop3 pop3_uidl_format(default): %08Xu%08Xv pop3_uidl_format(imap): %08Xu%08Xv pop3_uidl_format(pop3): %v-%u namespace: type: private separator: . prefix: INBOX. inbox: yes list: yes subscriptions: yes lda: postmaster_address: postmaster(a)mail.domain.com hostname: mail.domain.com mail_plugins: sieve mail_plugin_dir: /usr/local/lib/dovecot/lda deliver_log_format: msgid=%m: %$ sieve: /home/vpopmail/domains/%d/%n/sieve sieve_global_path: /usr/local/etc/default.sieve log_path: /var/log/qmail/sieve/dovecot.log info_log_path: /var/log/qmail/sieve/dovecot.log auth default: user: vpopmail passdb: driver: vpopmail userdb: driver: vpopmail plugin: quota: maildir Here is the config.log from sieve root@myplace:/usr/local# head dovecot-1.2-sieve-0.1.19/config.log This file contains any messages produced by compilers while running configure, to aid debugging if configure makes a mistake. It was created by Dovecot Sieve configure 0.1.19, which was generated by GNU Autoconf 2.67. Invocation command line was $ ./configure --with-dovecot=../dovecot-1.2.8/ That compiled cleanly, then make and make install also proceeded without error. With verbose logging enabled, the only times "sieve" appeared in the logs was when I tried to load it as a plugin for imap - grep sieve /var/log/qmail/qmail-dovecot/current |tai64nlocal 2013-05-14 09:20:05.091635500 FPlugin sieve not found from directory /usr/local/lib/dovecot/imap 2013-05-14 09:20:06.120848500 FPlugin sieve not found from directory /usr/local/lib/dovecot/imap 2013-05-14 09:20:07.142465500 FPlugin sieve not found from directory /usr/local/lib/dovecot/imap 2013-05-14 09:20:08.164247500 FPlugin sieve not found from directory /usr/local/lib/dovecot/imap Once I removed it from being loaded as an imap plugin and used it only as an lda plugin, it hasn't appeared in the dovecot logs. It also isn't logging where I asked it to in the config file (log_path: /var/log/qmail/sieve/dovecot.log, or info_log_path: /var/log/qmail/sieve/dovecot.log), but that files was touched and all directories below /var/log/qmail/sieve have the correct permissions for dovecot to write there: ls -al /var/log/qmail/sieve/ total 16 drwxr-xr-x 2 dovecot dovecot 4096 May 14 11:04 . drwxr-xr-x 7 qmaill root 12288 May 14 11:04 .. -rw-r--r-- 1 dovecot dovecot 0 May 14 11:04 dovecot.log Can anyone suggest an error they see or what I can do to get my errors with the sieve config logged somewhere? Thanks for your help and insight.

2 4