- dovecot - dovecot.org

[Dovecot] This binary should probably be called with process group set to (vmail) instead of (userid)
by jeep＠rahul.net 07 May '12

07 May '12

Im sorry to ask another basic question, but Ive tried to find this answer for several hours now and it eludes me. Im getting the following when dovecot tries to deliver an email: May 6 19:29:21 mydomain dovecot: lda: Debug: auth input: jeff home=/opt/imapdata/j/jeff/INBOX uid=1001 gid=999 May 6 19:29:21 mydomain dovecot: lda(jeff): Fatal: setgid(999(vmail) from userdb lookup) failed with euid=999(vmail), gid=500(jeff), egid=500(jeff): Operation not permitted (This binary should probably be called with process group set to 999(vmail) instead of 500(jeff)) I cannot seem to find where its trying to call dovecot-lda with uid(jeff) at? AFAIK Ive set everything up to use/deliver as 'vmail'. 'jeff' is the only person on this box with a unix account which is uid 500, but how do I make it use vmail instead? Thanks for the help! Jeff postfix master.cf: virtual_transport = vmail mailbox_command=/opt/dovecot/libexec/dovecot/dovecot-lda -f "$SENDER" -a "$RECIPIENT" dovecot -n: # 2.1.5: /opt/dovecot/etc/dovecot/dovecot.conf # OS: Linux 2.6.35.14-106.fc14.x86_64 x86_64 Fedora release 14 (Laughlin) ext4 auth_debug = yes auth_debug_passwords = yes auth_mechanisms = plain login auth_socket_path = /opt/dovecot215/var/run/dovecot/auth-userdb auth_verbose = yes auth_verbose_passwords = plain default_client_limit = 225 default_internal_user = vmail disable_plaintext_auth = no first_valid_gid = 999 first_valid_uid = 999 listen = * lock_method = flock mail_debug = yes mail_gid = vmail mail_home = /opt/imapdata/vmailhome mail_location = mbox:/opt/imapdata/%1n/%n:INDEX=/opt/imapdata/%1n/%n mail_privileged_group = vmail mail_uid = vmail mbox_lock_timeout = 1 mins mbox_write_locks = fcntl namespace { inbox = yes location = prefix = separator = / type = private } passdb { args = /opt/dovecot/etc/dovecot/conf.d/dovecot-sql.conf.ext driver = sql } plugin { mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename mail_log_fields = uid box msgid size } protocols = imap service auth { inet_listener { port = 12345 } unix_listener auth-userdb { group = vmail mode = 0666 user = vmail } user = $default_internal_user } service imap-login { inet_listener imap { port = 143 } service_count = 1 } ssl_cert = </etc/pki/dovecot/certs/dovecot.pem ssl_key = </etc/pki/dovecot/private/dovecot.pem userdb { args = /opt/dovecot/etc/dovecot/conf.d/dovecot-sql.conf.ext driver = sql } userdb { args = /opt/dovecot/etc/dovecot/conf.d/dovecot-sql.conf.ext driver = sql } userdb { args = /opt/dovecot/etc/dovecot/conf.d/dovecot-sql.conf.ext driver = sql } protocol imap { imap_idle_notify_interval = 1 mins imap_max_line_length = 64 k mail_max_userip_connections = 5 } /mf/home/jeep/shell/.signature

2 2

Re: [Dovecot] Shared namespace
by Daniel L. Miller 07 May '12

07 May '12

On 5/6/2012 8:34 PM, Daniel L. Miller wrote: > I'm not sure what's triggered it - I THINK it has something to do with > a force-resync, but not sure. > > I'm no longer viewing my full list of shared mailboxes. I used to > have a number of users shown - they had all had their ACL's set > individually and were shown in the list. "doveadm acl debug" shows > they SHOULD be shown - at least I think so, as the output for the > mailboxes that DO appear is identical for those that don't. > > Where should I look for breakage? After upgrading to 2.1.6 - mailboxes are back. Not sure I want to TRY to break it again... -- Daniel

1 0

Re: [Dovecot] IMAP STARTTLS Problem
by Patrick Ben Koetter 07 May '12

07 May '12

* markus(a)opsys.de <markus(a)opsys.de>: > Yep, I set the rights for the cert in Thunderbird. With this CERT > SSL is working in Thunderbird but not with STARTTLS. > > 4440[af7d580]: bcde800:mail.opsys.de:NA:CreateNewLineFromSocket: 1 > BAD TLS not available due to temporary reason Your server responds it has a temporary problem. Set the server verbose to get more useful log output. p@rick P.S. And please keep this thread onlist. > That's the message I get from Thunderbird. > > And that's the hole log: > > 4440[af7d580]: ImapThreadMainLoop entering [this=bcde800] > 0[c0f140]: bcde800:mail.opsys.de:NA:SetupWithUrl: clearing > IMAP_CONNECTION_IS_OPEN > 4440[af7d580]: bcde800:mail.opsys.de:NA:ProcessCurrentURL: entering > 4440[af7d580]: bcde800:mail.opsys.de:NA:ProcessCurrentURL:imap://markus%40opsys%2Ede@mail.opsys.de:143/select%3E.INBOX: > = currentUrl > 4440[af7d580]: ReadNextLine [stream=bc59ca8 nb=118 needmore=0] > 4440[af7d580]: bcde800:mail.opsys.de:NA:CreateNewLineFromSocket: * > OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE > STARTTLS AUTH=PLAIN AUTH=LOGIN] Dovecot ready. > > 4440[af7d580]: bcde800:mail.opsys.de:NA:SendData: 1 STARTTLS > > 4440[af7d580]: ReadNextLine [stream=bc59ca8 nb=49 needmore=0] > 4440[af7d580]: bcde800:mail.opsys.de:NA:CreateNewLineFromSocket: 1 > BAD TLS not available due to temporary reason > > 4440[af7d580]: try to log in > 4440[af7d580]: IMAP auth: server caps 0x4405427, pref 0x1006, failed > 0x0, avail caps 0x1006 > 4440[af7d580]: (GSSAPI = 0x1000000, CRAM = 0x20000, NTLM = 0x100000, > MSN = 0x200000, PLAIN = 0x1000, LOGIN = 0x2, old-style IMAP login = > 0x4)auth external IMAP login = 0x20000000 > 4440[af7d580]: trying auth method 0x1000 > 4440[af7d580]: got new password > 4440[af7d580]: IMAP: trying auth method 0x1000 > 4440[af7d580]: PLAIN auth > 4440[af7d580]: bcde800:mail.opsys.de:NA:SendData: 2 authenticate plain > > 4440[af7d580]: ReadNextLine [stream=bc59ca8 nb=4294967295 needmore=0] > 4440[af7d580]: bcde800:mail.opsys.de:NA:CreateNewLineFromSocket: > clearing IMAP_CONNECTION_IS_OPEN - rv = 80470002 > 4440[af7d580]: bcde800:mail.opsys.de:NA:TellThreadToDie: close > socket connection > 4440[af7d580]: bcde800:mail.opsys.de:NA:CreateNewLineFromSocket: (null) > 4440[af7d580]: authlogin failed > 4440[af7d580]: marking auth method 0x1000 failed > 4440[af7d580]: IMAP auth: server caps 0x4405427, pref 0x1006, failed > 0x1000, avail caps 0x6 > 4440[af7d580]: (GSSAPI = 0x1000000, CRAM = 0x20000, NTLM = 0x100000, > MSN = 0x200000, PLAIN = 0x1000, LOGIN = 0x2, old-style IMAP login = > 0x4)auth external IMAP login = 0x20000000 > 4440[af7d580]: trying auth method 0x2 > 4440[af7d580]: login failed entirely -- state of mind () http://www.state-of-mind.de Franziskanerstraße 15 Telefon +49 89 3090 4664 81669 München Telefax +49 89 3090 4666 Amtsgericht München Partnerschaftsregister PR 563

2 5

[Dovecot] v2.1.6 released
by Timo Sirainen 07 May '12

07 May '12

http://dovecot.org/releases/2.1/dovecot-2.1.6.tar.gz http://dovecot.org/releases/2.1/dovecot-2.1.6.tar.gz.sig * Session ID is now included by default in auth and login process log lines. It can be added to mail processes also by adding %{session} to mail_log_prefix. + Added ssl_require_crl setting, which specifies if CRL check must be successful when verifying client certificates. + Added mail_shared_explicit_inbox setting to specify if a shared INBOX should be accessible as "shared/$user" or "shared/$user/INBOX". - v2.1.5: Using "~/" as mail_location or elsewhere failed to actually expand it to home directory. - dbox: Fixed potential assert-crash when reading dbox files. - trash plugin: Fixed behavior when quota is already over limit. - mail_log plugin: Logging "copy" event didn't work. - Proxying to backend server with SSL: Verifying server certificate name always failed, because it was compared to an IP address.

1 0

[Dovecot] Shared namespace
by Daniel L. Miller 07 May '12

07 May '12

I'm not sure what's triggered it - I THINK it has something to do with a force-resync, but not sure. I'm no longer viewing my full list of shared mailboxes. I used to have a number of users shown - they had all had their ACL's set individually and were shown in the list. "doveadm acl debug" shows they SHOULD be shown - at least I think so, as the output for the mailboxes that DO appear is identical for those that don't. Where should I look for breakage? -- Daniel

1 0

Re: [Dovecot] mdbox packing
by Daniel L. Miller 07 May '12

07 May '12

On 5/6/2012 8:09 PM, Daniel L. Miller wrote: > On 4/30/2012 5:23 PM, Timo Sirainen wrote: >> On Mon, 2012-04-30 at 12:43 -0700, Daniel L. Miller wrote: >>> Is there a way to manually force an mdbox storage to be rebuilt into >>> new >>> files? Particularly files of the maximum size? >> You could do it with dsync. >> >> > dsync seems to do a marvelous job - new question.? > > Given a mailbox with a larger number of older mails - assuming any new > mails will have later dates - will the new mail storage files be > identical? I'm probably not saying the right - let me try this: > > 1. "dsync backup mdbox" (with appropriate args) is run for a given user. > 2. "dsync mirror mdbox" is done just to catch up. > 3. Old mailstore moved off. > 4. New mailstore moved to active location. > > I'm sure there's a safer way to do the above - but I've got a > low-traffic site and I can just shut down mail service altogether for > a few minutes if I want during this. > > Now - repeat the above four steps. Will mail files m.1 through > m.(n-1) be identical to the last run? Is this a valid packing > strategy prior to performing an rsync type backup - assuming no > changes are being made to the archived mails between pack runs? Given the above, and SIS - if the backup is performed in the same spool, i.e. original is /var/mail/domain/user, backup is /var/mail/domain/user-new - will this result in any problems with SIS? If after the pack and rename operation, the old mail tree is simply deleted - will that leave SIS files unreferenced if the user later deletes the messages from their active store? -- Daniel

1 0

[Dovecot] mdbox packing
by Daniel L. Miller 07 May '12

07 May '12

Is there a way to manually force an mdbox storage to be rebuilt into new files? Particularly files of the maximum size? -- Daniel

3 3

[Dovecot] Authentication process holding open filehandles
by George Barnett 07 May '12

07 May '12

Hi, We're using dovecot to provide pop3 for a number of mailboxes. The setup is pretty simple: Each user / domain has a mailstore in /data/mailstore/<domain>/<user>/Maildir (backed by NFS). Passwords are in simple passwd-file format in the top level domain directory eg: # cat /data/mailstore/foo.com/.passwd user:{plain}password The passdb setup looks like this. passdb { args = username_format=%n /data/mailstore/%d/.passwd driver = passwd-file } The problem we're having is that when we want to remove a domain from the system and we go to rm -rf /data/mailstore/<domain>/ we are unable to because the auth process is still holding onto the file handles for the password file. Can somebody suggest an alternative pattern that I could use for storing password files? Ideally, we'd avoid one large file to prevent locking issues and would also keep the passwd-file setup since it's simple. It would be possible to have the password files in a separate dir, but over time I'm guessing that would lead to nfs turds? Easy to clean up I suppose, but maybe there's a simpler solution I'm missing? George

2 1

[Dovecot] smtp -auth with using clear text password
by Agnello George 06 May '12

06 May '12

Hi I am setting up a mailserver .. where clients need to authenticate to the mail server . The mta i am using is postfix . It is possible to use a file like this : ---------------------------------- cat /etc/postfix/dovecote_passwd agnello:123456 --------------------------------- where user is agnello and password is 123456 If you can please send me some reference links thanks a ton -- Regards Agnello D'souza

5 9

Re: [Dovecot] IMAP STARTTLS Problem
by Patrick Ben Koetter 06 May '12

06 May '12

* markus(a)opsys.de <markus(a)opsys.de>: > Am 05.05.2012 22:44, schrieb Patrick Ben Koetter: > >* Markus Fritz <markus.fritz(a)opsys.de>: > >>Am 05.05.2012 21:06, schrieb Markus Fritz: > >Assuming your server cert is located in > >/etc/ssl/certs/ca-certificates.crt try > >this on your server: > > > >openssl s_client -starttls imap -CAfile > >/etc/ssl/certs/ca-certificates.crt -connect localhost:143 > > > >Use "2 logout" to get out of the session. > > > >If it works, try the same from your client host. > > > >Does it work both times? > > yes: > > Verify return code: 0 (ok) > --- > . OK Capability completed. > > it works. But I cannot login with Thunderbird. I imported the cert > in Thunderbird, too. IIRC it is not enough to import the cert. You also need to set a policy i.e. allow the cert to be used for e-mail. p@rick -- state of mind () http://www.state-of-mind.de Franziskanerstraße 15 Telefon +49 89 3090 4664 81669 München Telefax +49 89 3090 4666 Amtsgericht München Partnerschaftsregister PR 563

1 0