- dovecot - dovecot.org

[Dovecot] dsync replication: quota counted twice
by Oli Schacher 08 Apr '13

08 Apr '13

Hi I enabled quota + warnings in my replication test setup and now whenever a mail gets delivered the quota is counted twice (probably due to both servers using the same mysql quota backend) and quota warnings are fired too early. After a doveadm quota recalc -u <username> the quota is correct again. How do I make dovecot only count the quota on the server where the mail was added originally? dovecot -n is the same as in my previous message to the list today http://www.dovecot.org/list/dovecot/2013-April/089558.html (thanks Timo for the hint in this thread btw, changing the permissions made the errors go away) Thanks Oli -- message transmitted on 100% recycled electrons

2 4

[Dovecot] Dovecot Configuration
by Andreas K. 08 Apr '13

08 Apr '13

Can somebody, please, point me in the right direction in finding a COMPLETE and EXACT definition of the Dovecot configuration hierarchy. In other words what configuration options exist both at the top level but also at each subconfiguration elements (ex. sections etc). While my C is a bit rusty, I can still make sense of source code and with a bit of effort I will figure it out. I have been going through the src/config/all-settings.c but still have large gaps. A hint in the right direction on how the config works might help clarify and speed things up. Thanks Andreas Kasenides

1 0

[Dovecot] Problem with fts lucene, on solaris 10
by Pigi 08 Apr '13

08 Apr '13

Hi all, I'm planning to migrate my courier-imap imap server to dovecot, but I'm experiencing a strange issue with fts-lucene plugin. Basically, every time I start a search, the log starts to write: Apr 05 19:30:53 indexer: Error: Indexer worker disconnected, discarding 1 requests for XXXXXX Apr 05 19:30:53 indexer-worker(XXXXX): Fatal: master: service(indexer-worker): child 809 killed with signal 11 (core not dumped) Apr 05 19:30:53 imap(XXXXXX): Error: indexer failed to index mailbox INBOX Apr 05 19:30:56 indexer-worker(XXXXX): Error: lucene index /home/XXXXX/Maildir/lucene-indexes: IndexWriter() failed (#1): Lock obtain timed out When trussing the indexer-worker pid I can see it ends with: ...SNIP... 527: brk(0x005A7840) = 0 527: brk(0x005AD840) = 0 527: pread64(16, " I G E N E R I C I < /".., 8170, 24514) = 8170 527: brk(0x005AD840) = 0 527: brk(0x005B3840) = 0 527: Incurred fault #5, FLTACCESS %pc = 0xFEBD6DDC 527: siginfo: SIGBUS BUS_ADRALN addr=0x005B50BA 527: Received signal #10, SIGBUS [default] 527: siginfo: SIGBUS BUS_ADRALN addr=0x005B50BA I cannot get a core, but either root ( user that is starting the dovecot ) than the user XXXXX have unlimited coresize XXXXX /home/XXXXXXX > ulimit -a time(seconds) unlimited file(blocks) unlimited data(kbytes) unlimited stack(kbytes) 8192 coredump(blocks) unlimited nofiles(descriptors) 256 vmemory(kbytes) unlimited root # ulimit -a core file size (blocks, -c) unlimited data seg size (kbytes, -d) unlimited file size (blocks, -f) unlimited open files (-n) 1024 pipe size (512 bytes, -p) 10 stack size (kbytes, -s) 8192 cpu time (seconds, -t) unlimited max user processes (-u) 29995 virtual memory (kbytes, -v) unlimited The mailbox for user XXXXXX ( Maildir stile, for speed-up migration ) has ~ 4000 messages. The search ends, but I think it don't use the lucene plugin ( it crashes ). I'm sure I'm missing something, but I can't really find what. All stuff have been self compiled, using standard flags as per "configure" scripts. Thanks for any hint. Pigi here the environment: uname -a SunOS puma 5.10 Generic_137137-09 sun4u sparc SUNW,Sun-Fire-V240 ( yes, I know, it's quite old ;) ) ======= dovecot --version 2.1.15 ======= doveconf -n # 2.1.15: /usr/local/dovecot/etc/dovecot/dovecot.conf # OS: SunOS 5.10 sun4u debug_log_path = /usr/local/dovecot/var/log/dovecot-debug.log disable_plaintext_auth = no first_valid_uid = 100 info_log_path = /usr/local/dovecot/var/log/dovecot-info.log log_path = /usr/local/dovecot/var/log/dovecot.log mail_location = maildir:~/Maildir mail_plugins = " fts fts_lucene" namespace { inbox = yes location = prefix = INBOX. separator = . } passdb { driver = pam } plugin { fts = lucene fts_lucene = whitespace_chars=@. } service imap-login { inet_listener imap { port = 144 } } service indexer-worker { drop_priv_before_exec = yes } service pop3-login { inet_listener pop3 { port = 112 } } ssl = no userdb { driver = passwd } ============= gcc -v Reading specs from /usr/sfw/lib/gcc/sparc-sun-solaris2.10/3.4.3/specs Configured with: /sfw10/builds/build/sfw10-patch/usr/src/cmd/gcc/gcc-3.4.3/configure --prefix=/usr/sfw --with-as=/usr/ccs/bin/as --without-gnu-as --with-ld=/usr/ccs/bin/ld --without-gnu-ld --enable-languages=c,c++ --enable-shared Thread model: posix gcc version 3.4.3 (csl-sol210-3_4-branch+sol_rpath) ============= clucene clucene-core-2.3.3.4 libstemmer_c libtextcat-2.2 openssl-1.0.1e

2 6

[Dovecot] checkpassword protocol
by dovecot.pkoch＠dfgh.net 08 Apr '13

08 Apr '13

Hi, I'm writing a checkpassword script in order to support our OTP token as a fallback for client certificate authentication. Here are two questions: 1) It seems to me that the username and the password will be delivered to my script both on file descriptor 3 and via the environment variables AUTH_USER and AUTH_PASSWORD. May I ignore file descriptor 3 and use the environment variables or may it happen that these variables will have differnet content from what is sent via fd 3? 2) There seems to be some undocumented interaction between dovecot and my script via file descriptor 4. Seems that whatever I write to fd 4 will show up in syslog (unless it contains newlines). Can I use this "feature" to send error messages from my script to dovecot? What data does dovecot expect on fd 4? Peter

3 5

[Dovecot] ssl_require_crl does not work as expected
by dovecot.pkoch＠dfgh.net 08 Apr '13

08 Apr '13

Hi I'm trying to use dovecot with client certificates. We produce our certificates with our on CA and we do NOT use certificate revocation lists. So I put "ssl_require_crl = no" into 10-ssl.conf. I did not find a solution neither in the wiki nor somewhere else, so I finally started to read the source. My impression is that openssl will always try to use CRLs. If "ssl_require_crl = no" dovecot will use CRLs but tries to ignore openssl error codes X509_V_ERR_UNABLE_TO_GET_CRL and X509_V_ERR_CRL_HAS_EXPIRED. This is done in ssl_verify_client_cert() in ssl-proxy-openssl.c line 871, namely i_info("proxy=%d, require_crl=%d, error=%d", proxy->client_proxy, proxy->set->ssl_require_crl, ctx->error ); if (proxy->client_proxy && !proxy->set->ssl_require_crl && (ctx->error == X509_V_ERR_UNABLE_TO_GET_CRL || ctx->error == X509_V_ERR_CRL_HAS_EXPIRED)) { /* no CRL given with the CA list. don't worry about it. */ preverify_ok = 1; } With my setup proxy->client_proxy is 0. I added the i_info() to check this and with this modification my syslog shows: Apr 7 13:01:16 d600 dovecot: master: Dovecot v2.1.15 starting up (core dumps disabled) Apr 7 13:01:21 d600 dovecot: auth: Debug: Loading modules from directory: /usr/dovecot/lib/dovecot/auth Apr 7 13:01:21 d600 dovecot: auth: Debug: auth client connected (pid=26175) Apr 7 13:01:22 d600 dovecot: imap-login: proxy=0, require_crl=0, error=3 Apr 7 13:01:22 d600 dovecot: imap-login: Invalid certificate: unable to get certificate CRL: /CN=...user cert.../C=DE Apr 7 13:01:22 d600 dovecot: imap-login: proxy=0, require_crl=0, error=3 Apr 7 13:01:22 d600 dovecot: imap-login: Invalid certificate: unable to get certificate CRL: /CN=...intermedieate cert.../C=DE Apr 7 13:01:22 d600 dovecot: imap-login: proxy=0, require_crl=0, error=3 Apr 7 13:01:22 d600 dovecot: imap-login: Invalid certificate: unable to get certificate CRL: /CN=Root-CA.../C=DE I dont know what the proxy-stuff is about so instead of ignoring CRL-related errors I tried to disable CRL-checking. I therefore commented out two lines in ssl_proxy_ctx_verify_client() in ssl-proxy-openssl.c line 1004, namely: // X509_STORE_set_flags(store, X509_V_FLAG_CRL_CHECK | // X509_V_FLAG_CRL_CHECK_ALL); This tells OpenSSL not to check CRLs. Of course in production code this should be done only if "ssl_require_crl = no". Similar code is contained in iostream-openssl-context.c, namely in routine ssl_iostream_ctx_verify_remote_cert() Is this a bug? Peter

2 1

[Dovecot] client limit and STARTTLS
by David Benfell 08 Apr '13

08 Apr '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi all, I'm migrating from one system to another. Both are Arch Linux, but copying the configurations and just modifying them for IP addresses and hostnames didn't work. Here's doveconf -n # 2.1.15: /etc/dovecot/dovecot.conf doveconf: Warning: service auth { client_limit=256 } is lower than required under max. load (3072) doveconf: Warning: service anvil { client_limit=256 } is lower than required under max. load (2051) # OS: Linux 3.8.4-1-ARCH x86_64 base_dir = /var/run/dovecot/ default_client_limit = 256 default_process_limit = 1024 login_trusted_networks = 10.8.0.0/16 127.0.0.0/8 mail_location = maildir:~/Maildir mail_max_userip_connections = 30 passdb { args = failure_show_msg=yes driver = pam } service auth { unix_listener /var/spool/postfix/private/auth { mode = 0666 } } ssl_cert = </big/www/ssl/www.cybernude.org_publickey.pem ssl_key = </big/www/ssl/www.cybernude.org_privatekey.pem userdb { driver = passwd } Obvious first question: I can't figure out how to make dovecot happy with the client and process limits. I'm not terribly worried about going overboard here, though I have a very small number of users; the migration is to a much more capable system. But I would like to stop looking at the warning. It doesn't seem to matter what I put where--it keeps complaining. Second question: STARTTLS isn't working. What am I missing? Sorry if this is something that should be obvious; I'm fighting a similar battle with postfix and I'm being pushed around the bend while I really need to be working on other things. Thanks! -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.19 (GNU/Linux) Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQIcBAEBAgAGBQJRXy6nAAoJELJhbl/uPb4SsTAQALIkmDwCwPlCNPtJr482lVNj vsNHX4TvTy0Xu4adtxFqJQM30EoEpu4A983CTm81jUFYKqDIBRJ3SAVOGf58lCQ1 uJhoyL0yhCaO9Zh7WZKdmhB+Jnek2+Rz2cpfOP4VseLL7Lg3OIwI4K/YiDAIcwnW do/tvuJEL6SDDcDA3gOjDJ7gkykg34tJ02nnG65Yau0y563FT7npXKFnwGSn1X0+ GTFUwpZx5xp90eUZBLoTBPcnXohKlWhYxa2POHgm7eraK8k+aD9/2zlThQL6/qIx HQKcSkZjB1CTgKGysp+msaR/gS5HiHILadB3opP8p7baGNG9jhifKE6LJavREH8p PsxxCpTnf8d+xbbJVeDx6cyz7NQ8rNLals1qtPLAY4F04Uh400FjJov/dJruBISZ QvASZPOtyZHuswUnSTtX22WOg2QIvyO5GyzqPGZ/0+MtgbtJxwizsyCTEFuTkq+r RvsW1cltVsDKCFCCcjrkRzWu+xbDrkX42tNUnhi4YSJ5wcKQMRiqQBTtyCYT88sy Ws9WtNaElOERxQeydmizvxIuFIoLapdPtfyRDSGoDOo0Cnq/QSIzvQNdOVbqqSBt hcIVDNHTw8O5UfOhhbo+YT8QIBwD8J/uPxLfV72ep7nQBJh8XOymHJXGtQR8+H4x 6aey6+bafQ/YHtuS63bz =4qNn -----END PGP SIGNATURE-----

4 4

[Dovecot] v2.2.rc6 released
by Timo Sirainen 08 Apr '13

08 Apr '13

http://dovecot.org/releases/2.2/rc/dovecot-2.2.rc6.tar.gz http://dovecot.org/releases/2.2/rc/dovecot-2.2.rc6.tar.gz.sig Some more fixes to bugs I noticed today while trying out some new things in production. Note especially the replicator-doveadm socket change, see http://wiki2.dovecot.org/Replication for how to configure it. This change allowed local replicator to notify the remote replicator about user being synced. * replicator: Don't create replicator-doveadm socket by default. This way doveadm replicator commands don't accidentally start an unconfigured replicator server. + replicator: Have remote dsync notify the remote replicator that a user was just synced. This way the replicators are kept roughly in sync. + Added ssl_client_ca_file to specify the CA certs as a file. This is needed (instead of ssl_client_ca_dir) in RedHat-based systems. + Added "doveadm fs" commands, mainly to debug lib-fs backends. - Mailbox list indexes weren't using proper file permissions based on the root directory.

2 2

[Dovecot] mdbox and folders containing both messages and sub-folders
by Rich Wales 08 Apr '13

08 Apr '13

I've got Dovecot 2.2r5 (Ubuntu package version 2:2.2.0~rc5-0~auto+1 from the "testing-auto/dovecot-2.2" repository on xi.rename-it.nl) running on a brand-new Ubuntu 12.04.2 server. I'm trying to configure Dovecot (using the "mdbox" mailbox format) to allow folders to contain both messages and sub-folders. However, it's not working consistently. I need to have folders with both messages and sub-folders because I'm trying to migrate mail from an existing (but soon-to-be-retired) Cyrus server, and the existing body of mail has folders of this sort. I'm currently using the following configuration line: mail_location = mdbox:~/mdbox:DIRNAME=.indexes:INDEX=~/mdbox/indexes and am using the Larch program to do an IMAP-to-IMAP copy of one of my family member's mail from the old Cyrus server to the new Dovecot server. When I examine the "mailboxes" directory tree, I see some directories that (correctly) contain both the renamed ".indexes" directory and also directories for IMAP subfolders. However, the Larch output is showing many errors of the form "mailbox cannot contain messages", and some of the messages could not be migrated because of this problem. Am I doing something wrong? Or is the "folders containing both messages and sub-folders" feature simply broken for the "mdbox" format -- meaning presumably that I'll be forced either to use the Maildir format, or else abandon Dovecot entirely and install Cyrus on my new mail server instead? Rich Wales richw(a)richw.org

7 14

[Dovecot] autocreate mailbox but no sub folders
by Arnaud Abélard 07 Apr '13

07 Apr '13

Hello, We have been using lda_mailbox_autocreate to avoid to intialize empty mailboxes upon account creations. This does the job allright except that dovecot-lda is also allowed to autocreate sub folders which is a problem when using addresses extensions (adress+folder(a)domain.tld) It's easy for a malicious user to flood a mailbox with tons of subfolders. Is there a way to tell dovecot-lda it can only create the initial mailbox and maybe some special folders but nothing else? Thanks, Arnaud -- Arnaud Abélard jabber: arnaud.abelard(a)univ-nantes.fr / twitter: ArnY Administrateur Système DSI Université de Nantes -

2 1

[Dovecot] replicator/dsync over tcp
by Michael Grimm 07 Apr '13

07 Apr '13

Hi -- I am testing replicator/dsync over tcp, and I did run into some issues. First of all I did need to extend http://wiki2.dovecot.org/Replication to get dsync over tcp running without ssl: | # dsync over tcp default port | # | doveadm_port = 12345 | service doveadm { | # running dsync over tcp and using ssl | # added-->| user = vmail | inet_listener { added-->| address = 1.2.3.4 | port = 12345 | # ssl = yes | } | } | plugin { | # this host replicates to remote host | # | mail_replica = tcp:SERVER-A.TLD That didn't work ... | dovecot: doveadm(test): Error: doveadm_password not set, can't authenticate to remote server ... thus, I needed to add: added-->| local 1.2.3.4 { added-->| # password for client authentication by doveadm server added-->| # added-->| doveadm_password = secret added-->| # allow client to only use specified list of commands (default is all): added-->| # added-->| #doveadm_allowed_commands = added-->| } 1. Question: may one include "secret" from a file? Well, that runs like a charm! Now, I did try to add ssl by activating "ssl = yes" in 'service doveadm' (see above) and adding ... | # used by replicator/dsync over tcp | # | ssl_client_ca_dir = /<path-to>/ssl/certs ... and ... | mail_replica = tcps:SERVER-A.TLD But, this didn't work (logfile at remote server): | dovecot: doveadm(test): Invalid certificate: self signed certificate: /OU=dovecot server/CN=OTHER-NAME.TLD/emailAddress=postmaster(a)OTHER-NAME.TLD | dovecot: doveadm(test): Error: SERVER-A.TLD: Received invalid SSL certificate | dovecot: doveadm(test): Error: sync: Disconnected from remote The OTHER-NAME.TLD is served by my additional settings used by my MUAs: | ssl_cert = </<path-to>/ssl/certs/OTHER-NAME.TLD.pem | ssl_key = </<path-to>/ssl/private/OTHER-NAME.TLD.pem I did supply SERVER-A.TLD certs and private certificates at both servers as well, but dovecot seems to use those of OTHER-NAME.TLD for replicator/dsync instead :-( 2. Question: May I config the certificate that should be used for replicator/dsync and that might be different from those used by my MUAs (other then pointing to '/<path-to>/ssl/certs')? I am quite sure that I screwed my config somehow, but I cannot find the cause. Thus, someone? Thanks, and with kind regards, Michael

2 4