- dovecot - dovecot.org

[Dovecot] Crossrealm Kerberos problems
by Jonathan Hanks 15 May '13

15 May '13

I am running dovecot 2.1.7 on Debian Squeeze 64 bit, config information at the end of the email. I am working on a Kerberos/GSSAPI based setup that requires cross-realm authentication. I have regular GSSAPI working, I can log in using pam_krb5 with password based logins or with the GSSAPI support when using a kerberos ticket in the default realm. However when I attempt to authenticate using cross realm authentication the login fails (logs below). After perusing the source code I beleive that the problem is as such: All taking place in mech-gssapi.c 1. mech_gssapi_userok(...) calls mech_gssapi_krb5_userok 2. mech_gssapi_krb5_userok(...) calls krb5_kuserok(...) to verify that the given Kerberos prinicpal can log in as the requested user. 3. The authentication process is running as the Dovecot user so: 3a. krb5_kuserok(...) looks for ~dovecot/.k5login to authorize cross realm logins 3b. There is no ~dovecot/.k5login, thus no cross realm access is allowed 3c. It should be looking at the users .k5login ~poptest/.k5login 3d. This never happens and the login attempt fails I have the server set up to use system users specifically so that I can do cross-realm authentication. Do I have some basic configuration error? How do I change the authentication process to run as the user requesting to login? Should that be allowed? Another thought is to backport some of the patches proposed for 2.2 that remove krb5_kuserok from the loop. Thank you for any insight. This server is not in production use so I can experiment. May 9 10:54:49 lakeview.ligo-wa.caltech.edu dovecot: auth: Debug: gssapi(jonathan.hanks(a)SOME.REALM,198.129.xxx.xxx,<qYAkv0zc9wDGgdAT>): Negotiated security layer May 9 10:54:49 lakeview.ligo-wa.caltech.edu dovecot: auth: Debug: gssapi(jonathan.hanks(a)SOME.REALM,198.129.xxx.xxx,<qYAkv0zc9wDGgdAT>): Negotiated security layer May 9 10:54:49 lakeview.ligo-wa.caltech.edu dovecot: auth: Debug: client out: CONT#0111#011BQQF/wAMAAAAAAAACpxNKQH///+YdY3lGMDBq6TWTfc= May 9 10:54:49 lakeview.ligo-wa.caltech.edu dovecot: auth: Debug: client out: CONT#0111#011BQQF/wAMAAAAAAAACpxNKQH///+YdY3lGMDBq6TWTfc= May 9 10:54:49 lakeview.ligo-wa.caltech.edu dovecot: auth: Debug: client in: CONT<hidden> May 9 10:54:49 lakeview.ligo-wa.caltech.edu dovecot: auth: Debug: client in: CONT<hidden> May 9 10:54:49 lakeview.ligo-wa.caltech.edu dovecot: auth: gssapi(jonathan.hanks(a)SOME.REALM,198.129.xxx.xxx,<qYAkv0zc9wDGgdAT>): User not authorized to log in as poptest May 9 10:54:49 lakeview.ligo-wa.caltech.edu dovecot: auth: gssapi(jonathan.hanks(a)SOME.REALM,198.129.xxx.xxx,<qYAkv0zc9wDGgdAT>): User not authorized to log in as poptest My config is as follows: # 2.1.7: /etc/dovecot/dovecot.conf # OS: Linux 2.6.32-5-amd64 x86_64 Debian 6.0.7 auth_debug = yes auth_gssapi_hostname = $ALL auth_krb5_keytab = /etc/mail.keytab auth_mechanisms = plain login gssapi auth_username_format = %u auth_verbose = yes listen = * mail_location = mbox:~/mail:INBOX=/var/spool/mail/inbox/%u mail_privileged_group = mail passdb { args = dovecot driver = pam } protocols = imap pop3 service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0666 user = postfix } unix_listener auth-userdb { mode = 0666 } } service imap-login { inet_listener imap { port = 0 } inet_listener imaps { port = 993 ssl = yes } } service pop3-login { inet_listener pop3 { port = 0 } inet_listener pop3s { port = 995 ssl = yes } } ssl_cert = </etc/ssl/certs/mail-server.pem ssl_cipher_list = !aNULL:!eNULL:!EXPORT:!DSS:!DES:RC4-SHA:RC4-MD5:ALL ssl_key = </etc/ssl/private/mail-server.pem userdb { driver = passwd } protocol imap { imap_client_workarounds = tb-extra-mailbox-sep tb-lsub-flags } protocol pop3 { pop3_client_workarounds = outlook-no-nuls oe-ns-eoh pop3_uidl_format = %08Xu%08Xv } -- Jonathan Hanks General Computing Sys Admin LIGO Hanford Observatory

2 2

[Dovecot] Fatal: Can't finish POP3 UIDL command
by stevenfah 15 May '13

15 May '13

I have been setting up a new mail server and copied our client's old mail to it. The old server has Courier (under Plesk), we're using Dovecot on the new server. Most accounts seem to work fine (under IMAP or POP3), but for a few we're getting the following in the /var/log/mail.err. Error: Message ordering changed unexpectedly (msg #1: storage seq 140 -> 1) Fatal: Can't finish POP3 UIDL command And the affected accounts can't get at their email. Things work ok if people switch to IMAP but for some of our clients that is a difficulty, so we really need POP3 working. I used the Perl script given here to convert the mailboxes. The only fix we've found is the rename/delete the Dovecot-uidlist file for the affected mailboxes and we've done that, as it was only a few. The issue now is that more mailboxes are coming with the same error, even though they were fine originally. -- View this message in context: http://dovecot.2317879.n4.nabble.com/Fatal-Can-t-finish-POP3-UIDL-command-t… Sent from the Dovecot mailing list archive at Nabble.com.

2 3

[Dovecot] quota-related crash for doveadm dsync operation
by Emmanuel Dreyfus 15 May '13

15 May '13

Hi I understand the crash below is caused by filesystem quota. I just report it because perhaps it could have a more graceful failure. Apr 29 09:39:17 danceny dovecot: dsync-local(jdoe): Error: Mailbox Sent: Saving failed: Not enough disk space Apr 29 09:39:17 danceny syslogd[165]: last message repeated 4 times Apr 29 09:39:17 danceny dovecot: doveadm: Error: dsync-remote(jdoe): Error: Cached message size smaller than expected (35111 < 40830) Apr 29 09:39:17 danceny dovecot: doveadm: Error: dsync-remote(jdoe): Error: Corrupted index cache file /mail/indexes/jdoe/.imap/Sent/dovecot.index.cache: Broken physical size for mail UID 976 Apr 29 09:39:17 danceny dovecot: doveadm: Error: dsync-remote(jdoe): Error: dsync(local): read(/home/pct/jdoe/mail/Sent) failed: Invalid argument Apr 29 09:39:17 danceny dovecot: dsync-local(jdoe): Error: dsync(root(a)volanges.net.espci.fr): read() failed: Broken pipe Apr 29 09:39:17 danceny dovecot: dsync-local(jdoe): Panic: file mail-storage.c: line 1830 (mailbox_transaction_commit_get_changes): assertion failed: (ret < 0 || seq_range_count(&changes_r->saved_uids) == save_count || array_count(&changes_r->saved_uids) == 0) Apr 29 09:39:17 danceny dovecot: dsync-local(jdoe): Fatal: master: service(doveadm): child 23443 killed with signal 6 (core not dumped - set service doveadm { drop_priv_before_exec=yes }) -- Emmanuel Dreyfus manu(a)netbsd.org

2 1

[Dovecot] Lucene and Zlib with 2.2.1
by Kyle Wheeler 15 May '13

15 May '13

Hello, I have an "archive" folder in my inbox, where I manually stick old mails into a compressed mbox format. Since upgrading to Dovecot 2.2.1, I've started seeing messages like the following in my log files: imap(...): Error: lucene: Failed to sync mailbox INBOX: Mailbox isn't selectable indexer-worker(...): Error: lucene: Failed to sync mailbox INBOX: Mailbox isn't selectable indexer-worker(...): Error: lucene: Failed to sync mailbox INBOX: Mailbox isn't selectable indexer-worker(...): Error: lucene: Failed to sync mailbox INBOX: Mailbox isn't selectable imap(...): Error: indexer failed to index mailbox INBOX/Archive/2007/Sent.gz These errors *appear* to be mostly benign; I still get results from searching the mailbox. But for whatever reason, the indexer appears to not be working for those folders. As you can probably tell, I'm using the fts_lucene plugin, which used to work just fine (with Dovecot 2.1.x). Is this expected behavior? Are these errors truly ignorable? Why are these compressed mailboxes not selectable? ~Kyle -- Where justice is denied, where poverty is enforced, where ignorance prevails, and where any one class is made to feel that society is an organized conspiracy to oppress, rob and degrade them, neither persons nor property will be safe. -- Frederick Douglas

3 5

[Dovecot] Xlist in userdb, Foldernames with whitespace?
by Hajo Locke 15 May '13

15 May '13

Hello, i use dovecot 2.1.7 and exported all my XLIST FolderSettings to userdb Whole Story is here: http://dovecot.org/list/dovecot/2013-March/089209.html This is all successful, but there is one problem left. I use lines like this to realize individual XLIST Foldernames in usedb: namespace/inbox/mailbox=Sent namespace/inbox/mailbox/Sent/name=Sent namespace/inbox/mailbox/Sent/auto=subscribe namespace/inbox/mailbox/Sent/special_use=\sent My problem is to allow Foldernames with whitespace in it f.e. Sent Messages I tried to put these names in quotes in this line or mask the blank with backslash but nothing was working. Dovecot ist not accepting these settings: dovecot: imap: Debug: Added userdb setting: namespace/inbox/mailbox="Sent Messages" dovecot: imap: Debug: Unknown userdb setting: plugin/namespace/inbox/mailbox/"Sent Messages"/auto=subscribe dovecot: imap: Debug: Unknown userdb setting: plugin/namespace/inbox/mailbox/"Sent Messages"/name="Sent Messages" dovecot: imap: Debug: Unknown userdb setting: plugin/namespace/inbox/mailbox/"Sent Messages"/special_use=\sent How to code folders with whitespace etc. in my userdb settings? I tried a lot but nothing was correct. Thanks, Hajo

2 3

[Dovecot] protocols and privileges
by andreas graeper 15 May '13

15 May '13

hi, 1) protocols = pop3 but when starting the service, output tells about imap. when mua fetches mails ~/mail/.imap/INDEX is created. 2) i have some users uid=500 .. 505. src in /var/mail/%u, owner is <user>.mail and home-directories /home/<user> - owner is <user>.users when dovecot tries to create directory /home/<user>/mail then it tells for user xyz (uid = 502) euid=502(xyz) egid=100(users) missing +w permission /home/xyz , euid is not dir owner. but /home/xyz is owned by xyz.users and mod = 0700 ( drwx------ ) same environment for uid = 501 works great ! thanks in advance andreas ? permission lookup from /home/xyz/mail failed do i have to create that mail directory manually ?

2 1

[Dovecot] dovecot 2.2.1: lmtp running in base_dir
by Andy R 15 May '13

15 May '13

Evening all, I'm running into an issue with lmtp trying to store user mail in 'base_dir' ( same as this ( http://www.dovecot.org/list/dovecot/2011-January/056736.html )) however I'm just using PAM for auth. I've tried with chroot, without chroot and 'chroot'ing lmtp directly in ' service lmtp { } ' which just lead to lots more errors. I've not included anything of the current config so far, as I don't know what is needed here yet. I'm sure I'm missing something obvious, but I can't spot it for the life of me. Can anyone offer any new ideas? Many thanks Andy R.

2 1

[Dovecot] Dovecot 2.2.1 subscribtion status in LIST
by Nikolay S. 15 May '13

15 May '13

Hi there, I am using Evolution to connect to dovecot imap server. Today the server was upgraded to 2.2.1 from 2.1.9, and there is problem with evolution being unable to subscribe to INBOX. This is from dovecot 2.1.9: a002 list "" "*" return (subscribed) * LIST (\Subscribed) "." "Sent Items" * LIST (\Subscribed) "." "Junk E-mail" * LIST (\Subscribed) "." "Trash" * LIST (\Subscribed) "." "Archive" * LIST (\Subscribed) "." "Drafts" * LIST (\Subscribed) "." "INBOX" <--- And this is from 2.2.1: a002 list "" "*" return (subscribed) * LIST (\Subscribed) "." "Sent Items" * LIST (\Subscribed) "." "Junk E-mail" * LIST (\Subscribed) "." Trash * LIST (\Subscribed) "." Archive * LIST (\Subscribed) "." Drafts * LIST () "." INBOX <--- a002 OK List completed. a002 lsub "" "*" * LSUB () "." Drafts * LSUB () "." "Sent Items" * LSUB () "." Archive * LSUB () "." Trash * LSUB () "." INBOX <--- * LSUB () "." "Junk E-mail" a002 OK Lsub completed. In 2.2.1 LIST does not show INBOX as subscribed, which looks to confuse evolution. INBOX is actually subscribed: cat <path-to-maildir>/subscriptions Drafts Sent Items Archive Trash INBOX Junk E-mail

2 1

[Dovecot] IMAP SSL proxy (questions)
by Trever L. Adams 15 May '13

15 May '13

Hello everyone, I have seen: http://wiki.dovecot.org/HowTo/ImapProxy. It doesn't seem to fit what I need. Unfortunately, I cannot use TLS. I have to use SSL. Also, I would rather not duplicate the certificates for the IMAP servers. Hence nginx doesn't seem to be a good choice either. I am hoping that since SSL has "Client Hello" which specifies the site requested the the following could be done: Client - > Proxy [SYN] Proxy -> Client [SYN, ACK] Client -> Proxy [ACK] Client -> Proxy [SSL With "Client Hello", having server_name in Extension: server_name and sub-fields] Proxy sees intended host Proxy <-> Intended Server [SYN/SYN+ACK/ACK sequence] Proxy -> Intended Server [Replay SSL/Client Hello] Client <-> Proxy <-> Intended Server (Proxy is non decrypting Man-in-the-Middle, just acting as a pseudo-invisible relay) I know that something somewhat like this works because this is how Apache can do virtual hosts with SSL. Of course, it acts as the end point intended server, not a proxy. I believe it is also somewhat how Squid does SSL proxying, although I could be entirely wrong. Is this possible? Can this be implemented in dovecot? If not, does anyone know of such a project. Proxy needs to not have any exploitable holes and really only needs to understand enough SSL to get the server_name, pass through the connection, replaying Client Hello, and then knowing when to shut the connection. Just as a breif example, the use I have for this now is that I have several imap servers which all have IPv6 addresses, but have to share an IPv4 address. for SMTP side of things, this works well for all incoming email. (As an aside, does anyone know of a similar setup for SSL traffic on port 465 SSL for SMTP?) Thank you for any help, Trever

5 5

[Dovecot] Keyword limit?
by Michael M Slusarz 15 May '13

15 May '13

Running into a weird issue in a mailbox that has 26+ keywords. In one session, I do this: S: 2 SELECT "INBOX" (QRESYNC (1255685337 78608 [...uids...])) S: [...] S: * OK [HIGHESTMODSEQ 78608] Highest S: * OK [UIDVALIDITY 1255685337] UIDs valid S: 2 OK [READ-WRITE] Select completed. C: 3 UID STORE 48386 (UNCHANGEDSINCE 78608) +FLAGS AAAAAAAA S: * 8 FETCH (UID 48386 MODSEQ (78609) FLAGS (\Seen AAAAAAAA)) S: 3 OK Store completed. C: 4 LOGOUT S: * OK [CLOSED] Previous mailbox closed. S: * BYE LOGOUT received S: 4 OK Completed The next time I access that mailbox, I see this: C: 2 SELECT "INBOX" (QRESYNC (1255685337 78609 [...uids...])) S: [...] S: * OK [UIDVALIDITY 1255685337] UIDs valid S: * OK [HIGHESTMODSEQ 78609] Highest S: * 8 FETCH (MODSEQ (78610) UID 48386 FLAGS (\Seen)) S: 2 OK [READ-WRITE] Select completed. MODSEQ 78610 is entirely server-initiated. It *appears* that the mailbox doesn't handle more than 26 keywords. My dovecot-keywords looks like: 0 $Forwarded [Entries 1-24] 25 Test "Test" is a keyword I created immediately before "AAAAAAAA". If I remove Test and then add "AAAAAAAA", the keyword sticks. Is this a built-in limit? Can't find anything in the config/wiki docs (Dovecot 2.1.16). Or are my dovecot index/cache files hosed in some way? michael

3 4