- dovecot - dovecot.org

[Dovecot] LMTP Setup/Design Help Request
by Matthias Hofer 09 Apr '13

09 Apr '13

Hi altogether, I am switching from dbmail 2.2 to dovecot 2.1.7, and I was able to do a successful transition of IMAP. But I had a very hard time with receiving mail, and in the end -- after loads of reading and debugging -- I broke down and failed. This is why I am asking you for your kind help. I only have virtual users and have set mail_uid = dovemail mail_gid = dovemail For authentication, I simply use (for now) a flat file: passdb { driver = passwd-file args = scheme=PLAIN username_format=%u /etc/dovecot/mypasswd.file } # cat /etc/dovecot/mypasswd.file user1:{PLAIN}userpw1 user2:{PLAIN}userpw2 user3:{PLAIN}userpw3 And everything works fine with IMAP. I am completely domain-agnostic here. But I was not able to use this fine setup to receive mails with my postfix. I tried about 13 different configurations, some with considerable changes dovecot-config, the passwd-file or postfix, but I could not find a single variant working. In this situation, I would be very happy if somebody could give me a hint, which would be the prudent way to configure dovecot, LDA/LMTP and postfix based on the setup above. Thank you very much in advance, and have a great time, Matthias Hofer

3 2

[Dovecot] repeating dsync - questions
by Bob Gustafson 08 Apr '13

08 Apr '13

I'm moving/converting email from one system to another The source system is: Dual core x86_64 6GB memory 180 GB raid1 disks ext4 Fedora 9 Dovecot 1.0.15 Maildir format The destination system is: Dual core x86_64 2GB memory 1TB raid1 disks ext4 Fedora 18 Dovecot 2.1.15 sdbox format I am moving mail in a series of steps: 0) cd ( to mail user home directory ) mkdir Maildir 1) # rsync mail from source system (hoho4) to current (hoho0) time rsync -arv --times hoho4:/home/bobgus/Maildir/ /home/bobgus/Maildir/ This step takes about 37 minutes the first time 2) # dsync mirror/convert to sdbox format on current system time dsync mirror maildir:~/Maildir This step takes about 858 minutes (!!) Looking at -D messages indicates that dsync is deciding between duplicates much of the time. Looking at the results in a mail browser (Evolution), it seems fine, although the latest mails are not there. 3) # pick up more current mail - use same script as in 1) time rsync -arv --times hoho4:/home/bobgus/Maildir/ /home/bobgus/Maildir/ This step takes about 5 minutes although this varies depending on the amount of new mail. 4) # repeat the 2) dsync step time dsync mirror maildir:~/Maildir This is where things look peculiar. When I look at the directory of sdbox/mailboxes, I see duplicated directories [bobgus@hoho0 sdbox]$ cd mailboxes [bobgus@hoho0 mailboxes]$ ls Apple Mail To Do Apple Mail To Do_2a47983780615e5179600000ba55d82c Deleted Messages Deleted Messages_2847983780615e5179600000ba55d82c Drafts Drafts_2447983780615e5179600000ba55d82c Important Important_2947983780615e5179600000ba55d82c INBOX INBOX_1547983780615e5179600000ba55d82c Sent Sent_2547983780615e5179600000ba55d82c Trash Trash_2747983780615e5179600000ba55d82c The 2nd dsync step has not completed yet. I'm wondering whether the extra directory will be magically moved into the older directory. (This is unlikely because the file names are duplicated in the new directory) ------- Is this expected behavior? Are there command changes I can make to speed up the process? Eliminate the duplicate directories?

3 14

[Dovecot] dovecot 2 variables
by Pavel Dimow 08 Apr '13

08 Apr '13

Hi, I am trying to use separate configurations for ldap authentication thus providing users with the ability to only use username without domain part. Now according to documentation this should be possible http://wiki2.dovecot.org/AuthDatabase/PasswdFile but I keep getting error in my dovecot.log like this auth: Error: Can't open configuration file /etc/dovecot/%l/dovecot-ldap.conf: No such file or directory Why does dovecot does not expand %l to local ip address?

6 11

[Dovecot] dsync replication: quota counted twice
by Oli Schacher 08 Apr '13

08 Apr '13

Hi I enabled quota + warnings in my replication test setup and now whenever a mail gets delivered the quota is counted twice (probably due to both servers using the same mysql quota backend) and quota warnings are fired too early. After a doveadm quota recalc -u <username> the quota is correct again. How do I make dovecot only count the quota on the server where the mail was added originally? dovecot -n is the same as in my previous message to the list today http://www.dovecot.org/list/dovecot/2013-April/089558.html (thanks Timo for the hint in this thread btw, changing the permissions made the errors go away) Thanks Oli -- message transmitted on 100% recycled electrons

2 4

[Dovecot] Dovecot Configuration
by Andreas K. 08 Apr '13

08 Apr '13

Can somebody, please, point me in the right direction in finding a COMPLETE and EXACT definition of the Dovecot configuration hierarchy. In other words what configuration options exist both at the top level but also at each subconfiguration elements (ex. sections etc). While my C is a bit rusty, I can still make sense of source code and with a bit of effort I will figure it out. I have been going through the src/config/all-settings.c but still have large gaps. A hint in the right direction on how the config works might help clarify and speed things up. Thanks Andreas Kasenides

1 0

[Dovecot] Problem with fts lucene, on solaris 10
by Pigi 08 Apr '13

08 Apr '13

Hi all, I'm planning to migrate my courier-imap imap server to dovecot, but I'm experiencing a strange issue with fts-lucene plugin. Basically, every time I start a search, the log starts to write: Apr 05 19:30:53 indexer: Error: Indexer worker disconnected, discarding 1 requests for XXXXXX Apr 05 19:30:53 indexer-worker(XXXXX): Fatal: master: service(indexer-worker): child 809 killed with signal 11 (core not dumped) Apr 05 19:30:53 imap(XXXXXX): Error: indexer failed to index mailbox INBOX Apr 05 19:30:56 indexer-worker(XXXXX): Error: lucene index /home/XXXXX/Maildir/lucene-indexes: IndexWriter() failed (#1): Lock obtain timed out When trussing the indexer-worker pid I can see it ends with: ...SNIP... 527: brk(0x005A7840) = 0 527: brk(0x005AD840) = 0 527: pread64(16, " I G E N E R I C I < /".., 8170, 24514) = 8170 527: brk(0x005AD840) = 0 527: brk(0x005B3840) = 0 527: Incurred fault #5, FLTACCESS %pc = 0xFEBD6DDC 527: siginfo: SIGBUS BUS_ADRALN addr=0x005B50BA 527: Received signal #10, SIGBUS [default] 527: siginfo: SIGBUS BUS_ADRALN addr=0x005B50BA I cannot get a core, but either root ( user that is starting the dovecot ) than the user XXXXX have unlimited coresize XXXXX /home/XXXXXXX > ulimit -a time(seconds) unlimited file(blocks) unlimited data(kbytes) unlimited stack(kbytes) 8192 coredump(blocks) unlimited nofiles(descriptors) 256 vmemory(kbytes) unlimited root # ulimit -a core file size (blocks, -c) unlimited data seg size (kbytes, -d) unlimited file size (blocks, -f) unlimited open files (-n) 1024 pipe size (512 bytes, -p) 10 stack size (kbytes, -s) 8192 cpu time (seconds, -t) unlimited max user processes (-u) 29995 virtual memory (kbytes, -v) unlimited The mailbox for user XXXXXX ( Maildir stile, for speed-up migration ) has ~ 4000 messages. The search ends, but I think it don't use the lucene plugin ( it crashes ). I'm sure I'm missing something, but I can't really find what. All stuff have been self compiled, using standard flags as per "configure" scripts. Thanks for any hint. Pigi here the environment: uname -a SunOS puma 5.10 Generic_137137-09 sun4u sparc SUNW,Sun-Fire-V240 ( yes, I know, it's quite old ;) ) ======= dovecot --version 2.1.15 ======= doveconf -n # 2.1.15: /usr/local/dovecot/etc/dovecot/dovecot.conf # OS: SunOS 5.10 sun4u debug_log_path = /usr/local/dovecot/var/log/dovecot-debug.log disable_plaintext_auth = no first_valid_uid = 100 info_log_path = /usr/local/dovecot/var/log/dovecot-info.log log_path = /usr/local/dovecot/var/log/dovecot.log mail_location = maildir:~/Maildir mail_plugins = " fts fts_lucene" namespace { inbox = yes location = prefix = INBOX. separator = . } passdb { driver = pam } plugin { fts = lucene fts_lucene = whitespace_chars=@. } service imap-login { inet_listener imap { port = 144 } } service indexer-worker { drop_priv_before_exec = yes } service pop3-login { inet_listener pop3 { port = 112 } } ssl = no userdb { driver = passwd } ============= gcc -v Reading specs from /usr/sfw/lib/gcc/sparc-sun-solaris2.10/3.4.3/specs Configured with: /sfw10/builds/build/sfw10-patch/usr/src/cmd/gcc/gcc-3.4.3/configure --prefix=/usr/sfw --with-as=/usr/ccs/bin/as --without-gnu-as --with-ld=/usr/ccs/bin/ld --without-gnu-ld --enable-languages=c,c++ --enable-shared Thread model: posix gcc version 3.4.3 (csl-sol210-3_4-branch+sol_rpath) ============= clucene clucene-core-2.3.3.4 libstemmer_c libtextcat-2.2 openssl-1.0.1e

2 6

[Dovecot] checkpassword protocol
by dovecot.pkoch＠dfgh.net 08 Apr '13

08 Apr '13

Hi, I'm writing a checkpassword script in order to support our OTP token as a fallback for client certificate authentication. Here are two questions: 1) It seems to me that the username and the password will be delivered to my script both on file descriptor 3 and via the environment variables AUTH_USER and AUTH_PASSWORD. May I ignore file descriptor 3 and use the environment variables or may it happen that these variables will have differnet content from what is sent via fd 3? 2) There seems to be some undocumented interaction between dovecot and my script via file descriptor 4. Seems that whatever I write to fd 4 will show up in syslog (unless it contains newlines). Can I use this "feature" to send error messages from my script to dovecot? What data does dovecot expect on fd 4? Peter

3 5

[Dovecot] ssl_require_crl does not work as expected
by dovecot.pkoch＠dfgh.net 08 Apr '13

08 Apr '13

Hi I'm trying to use dovecot with client certificates. We produce our certificates with our on CA and we do NOT use certificate revocation lists. So I put "ssl_require_crl = no" into 10-ssl.conf. I did not find a solution neither in the wiki nor somewhere else, so I finally started to read the source. My impression is that openssl will always try to use CRLs. If "ssl_require_crl = no" dovecot will use CRLs but tries to ignore openssl error codes X509_V_ERR_UNABLE_TO_GET_CRL and X509_V_ERR_CRL_HAS_EXPIRED. This is done in ssl_verify_client_cert() in ssl-proxy-openssl.c line 871, namely i_info("proxy=%d, require_crl=%d, error=%d", proxy->client_proxy, proxy->set->ssl_require_crl, ctx->error ); if (proxy->client_proxy && !proxy->set->ssl_require_crl && (ctx->error == X509_V_ERR_UNABLE_TO_GET_CRL || ctx->error == X509_V_ERR_CRL_HAS_EXPIRED)) { /* no CRL given with the CA list. don't worry about it. */ preverify_ok = 1; } With my setup proxy->client_proxy is 0. I added the i_info() to check this and with this modification my syslog shows: Apr 7 13:01:16 d600 dovecot: master: Dovecot v2.1.15 starting up (core dumps disabled) Apr 7 13:01:21 d600 dovecot: auth: Debug: Loading modules from directory: /usr/dovecot/lib/dovecot/auth Apr 7 13:01:21 d600 dovecot: auth: Debug: auth client connected (pid=26175) Apr 7 13:01:22 d600 dovecot: imap-login: proxy=0, require_crl=0, error=3 Apr 7 13:01:22 d600 dovecot: imap-login: Invalid certificate: unable to get certificate CRL: /CN=...user cert.../C=DE Apr 7 13:01:22 d600 dovecot: imap-login: proxy=0, require_crl=0, error=3 Apr 7 13:01:22 d600 dovecot: imap-login: Invalid certificate: unable to get certificate CRL: /CN=...intermedieate cert.../C=DE Apr 7 13:01:22 d600 dovecot: imap-login: proxy=0, require_crl=0, error=3 Apr 7 13:01:22 d600 dovecot: imap-login: Invalid certificate: unable to get certificate CRL: /CN=Root-CA.../C=DE I dont know what the proxy-stuff is about so instead of ignoring CRL-related errors I tried to disable CRL-checking. I therefore commented out two lines in ssl_proxy_ctx_verify_client() in ssl-proxy-openssl.c line 1004, namely: // X509_STORE_set_flags(store, X509_V_FLAG_CRL_CHECK | // X509_V_FLAG_CRL_CHECK_ALL); This tells OpenSSL not to check CRLs. Of course in production code this should be done only if "ssl_require_crl = no". Similar code is contained in iostream-openssl-context.c, namely in routine ssl_iostream_ctx_verify_remote_cert() Is this a bug? Peter

2 1

[Dovecot] client limit and STARTTLS
by David Benfell 08 Apr '13

08 Apr '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi all, I'm migrating from one system to another. Both are Arch Linux, but copying the configurations and just modifying them for IP addresses and hostnames didn't work. Here's doveconf -n # 2.1.15: /etc/dovecot/dovecot.conf doveconf: Warning: service auth { client_limit=256 } is lower than required under max. load (3072) doveconf: Warning: service anvil { client_limit=256 } is lower than required under max. load (2051) # OS: Linux 3.8.4-1-ARCH x86_64 base_dir = /var/run/dovecot/ default_client_limit = 256 default_process_limit = 1024 login_trusted_networks = 10.8.0.0/16 127.0.0.0/8 mail_location = maildir:~/Maildir mail_max_userip_connections = 30 passdb { args = failure_show_msg=yes driver = pam } service auth { unix_listener /var/spool/postfix/private/auth { mode = 0666 } } ssl_cert = </big/www/ssl/www.cybernude.org_publickey.pem ssl_key = </big/www/ssl/www.cybernude.org_privatekey.pem userdb { driver = passwd } Obvious first question: I can't figure out how to make dovecot happy with the client and process limits. I'm not terribly worried about going overboard here, though I have a very small number of users; the migration is to a much more capable system. But I would like to stop looking at the warning. It doesn't seem to matter what I put where--it keeps complaining. Second question: STARTTLS isn't working. What am I missing? Sorry if this is something that should be obvious; I'm fighting a similar battle with postfix and I'm being pushed around the bend while I really need to be working on other things. Thanks! -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.19 (GNU/Linux) Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQIcBAEBAgAGBQJRXy6nAAoJELJhbl/uPb4SsTAQALIkmDwCwPlCNPtJr482lVNj vsNHX4TvTy0Xu4adtxFqJQM30EoEpu4A983CTm81jUFYKqDIBRJ3SAVOGf58lCQ1 uJhoyL0yhCaO9Zh7WZKdmhB+Jnek2+Rz2cpfOP4VseLL7Lg3OIwI4K/YiDAIcwnW do/tvuJEL6SDDcDA3gOjDJ7gkykg34tJ02nnG65Yau0y563FT7npXKFnwGSn1X0+ GTFUwpZx5xp90eUZBLoTBPcnXohKlWhYxa2POHgm7eraK8k+aD9/2zlThQL6/qIx HQKcSkZjB1CTgKGysp+msaR/gS5HiHILadB3opP8p7baGNG9jhifKE6LJavREH8p PsxxCpTnf8d+xbbJVeDx6cyz7NQ8rNLals1qtPLAY4F04Uh400FjJov/dJruBISZ QvASZPOtyZHuswUnSTtX22WOg2QIvyO5GyzqPGZ/0+MtgbtJxwizsyCTEFuTkq+r RvsW1cltVsDKCFCCcjrkRzWu+xbDrkX42tNUnhi4YSJ5wcKQMRiqQBTtyCYT88sy Ws9WtNaElOERxQeydmizvxIuFIoLapdPtfyRDSGoDOo0Cnq/QSIzvQNdOVbqqSBt hcIVDNHTw8O5UfOhhbo+YT8QIBwD8J/uPxLfV72ep7nQBJh8XOymHJXGtQR8+H4x 6aey6+bafQ/YHtuS63bz =4qNn -----END PGP SIGNATURE-----

4 4

[Dovecot] v2.2.rc6 released
by Timo Sirainen 08 Apr '13

08 Apr '13

http://dovecot.org/releases/2.2/rc/dovecot-2.2.rc6.tar.gz http://dovecot.org/releases/2.2/rc/dovecot-2.2.rc6.tar.gz.sig Some more fixes to bugs I noticed today while trying out some new things in production. Note especially the replicator-doveadm socket change, see http://wiki2.dovecot.org/Replication for how to configure it. This change allowed local replicator to notify the remote replicator about user being synced. * replicator: Don't create replicator-doveadm socket by default. This way doveadm replicator commands don't accidentally start an unconfigured replicator server. + replicator: Have remote dsync notify the remote replicator that a user was just synced. This way the replicators are kept roughly in sync. + Added ssl_client_ca_file to specify the CA certs as a file. This is needed (instead of ssl_client_ca_dir) in RedHat-based systems. + Added "doveadm fs" commands, mainly to debug lib-fs backends. - Mailbox list indexes weren't using proper file permissions based on the root directory.

2 2