- dovecot - dovecot.org

[Dovecot] squat fts not working on 2.1rc1
by Metro Domain Admin 28 Nov '11

28 Nov '11

Hello, I tried to upgrade from 2.0.15 to 2.1.rc1 over the weekend but ran into some problems with squat. My two largest mailboxes were corrupted, producing this error: Nov 27 17:38:12 kerio1 dovecot[42860]: imap(bigmailbox): Error: Corrupted squat uidlist file /var/mail/metro-email.com/bigmailbox/mdbox/mailboxes/INBOX/dbox-Mails/dovecot.index.search.uids: wrong indexid There is a good chance that I had shot my own foot, by forgetting to update postfix's dovecot-lda reference to the new instance. I had also enabled an inet based LMTP listener, although it is not being used yet. Even using non-corrupted indexes, it seemed that FTS was not being used. A basic search such as this one took many minutes to complete: doveadm search -u jsample mailbox INBOX body eps I found messages like this in mail.log after performing the search: Nov 27 18:21:39 kerio1 dovecot[42860]: indexer-worker(jsample): Indexed 0 messages in Drafts Nov 27 18:21:39 kerio1 dovecot[42860]: indexer-worker(jsample): Indexed 0 messages in INBOX When I rolled back to 2.0.15, the same search returned almost immediately. The larger mailboxes went quickly again, but only after they had a chance to rebuild. A few other notes about our configuration: We are on PPC, with the stats service disabled (because of kqueue issue discussed earlier). I made some minor changes in my config since the previous installed version (diff below). mail_location override is in place for all users via password file, e.g.: userdb_mail=mdbox:/var/mail/metro-email.com/jsample/mdbox Thanks, Tony kerio1:~ metroadmin$ /opt/dovecot-2.1.rc1/bin/doveconf -n -c /opt/dovecot-2.1.rc1/etc/dovecot/dovecot.conf # 2.1.rc1: /opt/dovecot-2.1.rc1/etc/dovecot/dovecot.conf # OS: Darwin 9.8.0 Power Macintosh auth_cache_negative_ttl = 0 auth_cache_size = 1 M auth_mechanisms = plain login lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes lmtp_proxy = yes mail_location = maildir:%h mail_plugins = fts fts_squat mail_log notify mail_privileged_group = mail maildir_very_dirty_syncs = yes managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave editheader mdbox_rotate_size = 10 M namespace { inbox = yes location = prefix = separator = / } passdb { args = scheme=CRYPT username_format=%u /opt/dovecot-2.1.rc1/etc/dovecot/users driver = passwd-file } plugin { fts = squat mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename mail_log_fields = uid box msgid size from subject sieve = ~/.dovecot.sieve sieve_dir = ~/sieve } postmaster_address = postmaster(a)metro-email.com protocols = imap lmtp service auth { unix_listener /var/spool/postfix/private/auth { group = _postfix mode = 0660 user = _postfix } unix_listener auth-userdb { group = mail mode = 0660 user = metroadmin } } service imap { executable = imap postlogin } service lmtp { inet_listener lmtp { address = 192.168.20.10 127.0.0.1 port = 24 } } service postlogin { executable = script-login rawlog -t } service stats { fifo_listener stats-mail { mode = 00 } } ssl_cert = </opt/local/apache2/conf/ssl_startcom/server.crt ssl_key = </opt/local/apache2/conf/ssl_startcom/server.key userdb { args = username_format=%u /opt/dovecot-2.1.rc1/etc/dovecot/users driver = passwd-file } verbose_proctitle = yes protocol imap { mail_max_userip_connections = 16 } Here is a diff between the current/working and attempted configs: kerio1:~ metroadmin$ diff k1.curr k1.new2 1c1 < # 2.0.15: /opt/dovecot-2.0.15/etc/dovecot/dovecot.conf --- > # 2.1.rc1: /opt/dovecot-2.1.rc1/etc/dovecot/dovecot.conf 9a10 > lmtp_proxy = yes 15c16 < managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave --- > managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave editheader 24c25 < args = scheme=CRYPT username_format=%u /opt/dovecot-2.0.15/etc/dovecot/users --- > args = scheme=CRYPT username_format=%u /opt/dovecot-2.1.rc1/etc/dovecot/users 50a52,57 > service lmtp { > inet_listener lmtp { > address = 192.168.20.10 127.0.0.1 > port = 24 > } > } 53a61,65 > service stats { > fifo_listener stats-mail { > mode = 00 > } > } 57c69 < args = username_format=%u /opt/dovecot-2.0.15/etc/dovecot/users --- > args = username_format=%u /opt/dovecot-2.1.rc1/etc/dovecot/users kerio1:~ metroadmin$

1 0

[Dovecot] Which FTS to use!
by Henrique Santos Fernandes 27 Nov '11

27 Nov '11

Hello, i am currently using squat dovecot, but some users that have lots os emails ( 1GB ) are complaining about speed. Iam using dovecot 2.0.13 on debian 6 my squat conf is plugin { fts = squat fts_squat = partial=4 full=5 } I am thinking in maybe start to use Solr, so any one can help me with an decision? I am probably gonna update dovecot to 2.1 next year. and them maybe change the FTS plugin. This year i will get 10k disk only to store the dovecot index, rigth now they are saved on the same storage that the mails are and also change the "full" parameter to something like 10 or 15 I know i will use more disk space for it, but it will make a lot of differences right? it will match the message without the need of opening it for any search smaller than 10 character i guess. But this will be enough? or Solr or Lucene still better? Anyway, i am not current updating the indexes automatic, but i am planing on it, just not sure what is better, the command doveadm index or doveadm search... with one is better to do the task? Thanks! []'sf.rique

2 2

[Dovecot] Dovecot 1.2 ACL problem.
by Rajeev Sharma 26 Nov '11

26 Nov '11

Sir, I have migrate from courier-imap to dovecot without any problem but on courier in have shared folder which access on the basis on rights. I have manage these folders in dovecot but i have one problem all the shared folder is accessible by all user whether they have rights or not i have place dovecot-acl in shared folder and assign user my dovecot-acl is user=rajeev(a)teamsg.in tr. But all other user which is not listing on dovecot-acl also able to access these folder. Here is the output of dovecot -n. # 1.2.17: /usr/local/etc/dovecot.conf # OS: Linux 2.6.18-194.3.1.el5 i686 CentOS release 5.5 (Final) base_dir: /var/run/dovecot/ log_path: /var/log/dovecot.log ssl_listen: 192.168.0.251:993 ssl_cert_file: /var/qmail/control/servercert.pem ssl_key_file: /var/qmail/control/servercert.pem login_dir: /var/run/dovecot//login login_executable: /usr/local/libexec/dovecot/imap-login first_valid_uid: 508 last_valid_uid: 508 mail_location: maildir:~/Maildir namespace: type: private separator: . prefix: INBOX. inbox: yes list: yes subscriptions: yes namespace: type: shared separator: . prefix: INBOX.Shared. location: maildir:/home/vpopmail/domains/sgcricket.com/Maildir/Out:INDEX=~/Maildir/Sh… list: children auth default: user: vpopmail passdb: driver: vpopmail userdb: driver: vpopmail plugin: acl: vfile Please help whats wrong i am doing. Rajeev Sharma.

1 0

[Dovecot] Seen flag getting lost
by Edgar Fuß 26 Nov '11

26 Nov '11

We have two dovecot 1.2 instances sharing Maildirs on NFS. Indexes are local to the individual servers. Occasionally (no idea how to trigger this), the Seen flag gets lost on some messages. I've verified that actually the ``S'' is missing from the filename. I suspect something like server A caching the flags, server B setting Seen, and then server A flushing its cache for another change so overwriting what B changed. Any ideas short of switching to 2.0?

6 8

[Dovecot] v2.1.rc1 released
by Timo Sirainen 25 Nov '11

25 Nov '11

http://dovecot.org/releases/2.1/rc/dovecot-2.1.rc1.tar.gz http://dovecot.org/releases/2.1/rc/dovecot-2.1.rc1.tar.gz.sig I'll probably release v2.1.0 pretty soon, unless people report some new bugs. I know v2.1 is already being used to serve mails to tens (or hundreds?) of thousands of users, so it should be pretty stable. Most of the changes since v2.1.beta1 have been for rather small issues. Many of the fixed bugs exist also in v2.0, but since they are so minor I didn't bother backporting the fixes. As new features since v2.1.beta1 there are the things I did also for v2.0.16, and: * ssl_client_cert/key: Proxying can now send SSL certificate to backend server * ssl_crypto_device for enabling hardware encryption * SCRAM-SHA-1 authentication mechanism support by Florian Zeitz * passdb/userdb checkpassword: Export all auth %variables to AUTH_* environment. * maildir_broken_filename_sizes setting for people upgrading from other maildir servers that wrote tons of broken S=<size> values And as a reminder, here are the biggest new things since v2.0: * Plugins now use UTF-8 mailbox names rather than mUTF-7: acl, autocreate, expire, trash, virtual * auth_username_format default changed to %Lu. If you really want case sensitive usernames, set it back to empty. * Solr full text search backend changed to use mailbox GUIDs instead of mailbox names, requiring reindexing everything. solr_old backend can be used with old indexes to avoid reindexing, but it doesn't support some newer features. + imapc (= IMAP client) storage allows using a remote IMAP server to be used as storage. This allows using Dovecot as a smart (caching) proxy or using dsync to do migration from remote IMAP server. + Mailbox indexing via queuing indexer service (required for Lucene) + Lucene full text search (FTS) backend rewritten with support for different languages + FTS finally supports "OR" search operation + FTS supports indexing attachments via external programs + IMAP FUZZY extension, supported by Lucene and Solr FTS backends + Mailbox list indexes + Statistics tracking via stats service. Exported via doveadm stats. + Autocreate plugin creates/subscribes mailboxes physically only when the mailbox is opened for the first time. Mailbox listing shows the autocreated mailboxes even if they don't physically exist. + Password and user databases now support default_fields and override_fields settings to specify template defaults/overrides. - listescape plugin works perfectly now

6 8

[Dovecot] How to create home directories for virtual users?
by Olli Räisänen 25 Nov '11

25 Nov '11

Hello, I,m using Dovecot 1.2.9, now finishing a migration from Courier IMAP. Documentation (http://wiki.dovecot.org/VirtualUsers/Home) says that home directory should not be the same as mail directory. When I create new user accounts with PostfixAdmin the mail directory is not a problem but is there some smart way to create the home directory as well (locating it for instance in '/srv/vmail/%d/%n/home')? Regards, Olli

5 8

[Dovecot] Problem with lmtp proxy
by Miguel Tormo 24 Nov '11

24 Nov '11

Hello everyone, I have set up postfix to deliver mails to dovecot (2.0.16) using LMTP. On the other hand, I've successfully configured the IMAP proxy setting in dovecot in order to be able to distribute mailboxes among different servers. I wanted to do the same proxy at LMTP level, but it's not working. If I put lmtp_proxy = no, then everything works ok (assuming the mailbox is local), but when I set lmtp_proxy = yes then the user is not found when deliverying the message via LMTP, so the mail remains in the postfix queue. Users are validated through active directory. However, this AD hasn't the SFU installed, thus its LDAP schema doesn't provide me with the required uid, gid, etc. To solve this, I have winbind configured in the system, so I'm doing this: - To validate users *and* be able to set the proxy extra fields, I use ldap as "passdb" (I believe it's not possible to use proxies with PAM). I'm using some LDAP field to store the host that has the user's mailbox. - In order to get the user account data that is not available in the AD, I use passwd as "userdb". I know that when using LMTP with proxy, a passdb needs to be configured. I assume this is needed for the service to lookup for the appropriate host to send the message. So, initially I set ldap as the passdb for LMTP, but just because it didn't work I put both ldap and passwd, and even a userdb (passwd), but the problems remain the same. Anyway the ldap should be the right one as it is there where I have the host information for each user. I think I'm missing something but I can't find what it is. To summarize: with lmtp_proxy = no it does work, with lmtp_proxy = yes it doesn't. Thank you for your help! This is my current config: ************* dovecot -n ************** # 2.0.16: /etc/dovecot/dovecot.conf # OS: Linux 2.6.37-gentoo-edicom-1104 x86_64 Gentoo Base System release 1.12.14 auth_debug = yes auth_debug_passwords = yes auth_mechanisms = plain login auth_username_format = %n auth_verbose = yes base_dir = /var/run/dovecot/ listen = * lmtp_proxy = yes login_trusted_networks = 127.0.0.1 mail_debug = yes mail_location = maildir:~/maildir managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave passdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } plugin { sieve = ~/.dovecot.sieve sieve_dir = ~/sieve } postmaster_address = postmaster(a)domain.com protocols = imap pop3 sieve lmtp quota_full_tempfail = yes service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0666 user = postfix } unix_listener auth-userdb { group = root mode = 0600 user = root } } service imap { vsz_limit = 512 M } service lmtp { inet_listener lmtp { address = 192.168.0.90 port = 24 } unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0666 user = postfix } } ssl_cert = </etc/ssl/dovecot/server.pem ssl_key = </etc/ssl/dovecot/server.key submission_host = 192.168.0.22 userdb { driver = passwd } verbose_proctitle = yes protocol lmtp { passdb { args = driver = passwd } passdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } userdb { args = driver = passwd } } protocol lda { mail_plugins = sieve } protocol imap { imap_client_workarounds = delay-newmail } protocol pop3 { pop3_client_workarounds = outlook-no-nuls oe-ns-eoh pop3_uidl_format = %08Xu%08Xv } **************************************************** ************** cat dovecot-ldap.conf.ext ************** hosts = dcserver:389 dn = cn=binduser,cn=Users,dc=edicom,dc=es dnpass = bindpassword tls = no debug_level = -1 auth_bind = yes ldap_version = 3 base = CN=Users,DC=domain,DC=com deref = never scope = subtree user_filter = (&(memberOf=CN=correo,OU=Alfresco,DC=edicom,DC=es)(sAMAccountName=%u)) pass_attrs = userPassword=password,=proxy_maybe=Y,physicalDeliveryOfficeName=host pass_filter = (&(memberOf=CN=correo,OU=Alfresco,DC=edicom,DC=es)(sAMAccountName=%u)) **************************************************** The results I get in the log: **************************************************** dovecot [2011-11-24 15:53:39] [warning] master: Warning: Killed with signal 15 (by pid=10437 uid=0 code=kill) dovecot [2011-11-24 15:53:40] [info] master: Dovecot v2.0.16 starting up (core dumps disabled) dovecot [2011-11-24 15:53:50] [debug] lmtp(10506): Debug: none: root=, index=, control=, inbox=, alt= dovecot [2011-11-24 15:53:50] [info] lmtp(10506): Connect from local dovecot [2011-11-24 15:53:50] [debug] auth: Debug: Loading modules from directory: /usr/lib64/dovecot/auth dovecot [2011-11-24 15:53:50] [err] auth: Error: ldap_bind dovecot [2011-11-24 15:53:50] [err] auth: Error: ldap_simple_bind dovecot [2011-11-24 15:53:50] [err] auth: Error: ldap_sasl_bind dovecot [2011-11-24 15:53:50] [err] auth: Error: ldap_send_initial_request dovecot [2011-11-24 15:53:50] [err] auth: Error: ldap_new_connection 1 1 0 dovecot [2011-11-24 15:53:50] [err] auth: Error: ldap_int_open_connection dovecot [2011-11-24 15:53:50] [err] auth: Error: ldap_connect_to_host: TCP dcserver:389 dovecot [2011-11-24 15:53:50] [err] auth: Error: ldap_new_socket: 17 dovecot [2011-11-24 15:53:50] [err] auth: Error: ldap_prepare_socket: 17 dovecot [2011-11-24 15:53:50] [err] auth: Error: ldap_connect_to_host: Trying 192.168.0.67:389 dovecot [2011-11-24 15:53:50] [err] auth: Error: ldap_pvt_connect: fd: 17 tm: -1 async: 0 dovecot [2011-11-24 15:53:50] [err] auth: Error: ldap_open_defconn: successful dovecot [2011-11-24 15:53:50] [err] auth: Error: ldap_send_server_request dovecot [2011-11-24 15:53:50] [debug] auth: Debug: master in: PASS 1 myuser(a)domain.com service=lmtp dovecot [2011-11-24 15:53:50] [debug] auth: Debug: password(myuser): passdb doesn't support credential lookups dovecot [2011-11-24 15:53:50] [debug] auth: Debug: password(myuser): passdb doesn't support credential lookups dovecot [2011-11-24 15:53:50] [debug] auth: Debug: password(myuser): passdb doesn't support credential lookups dovecot [2011-11-24 15:53:50] [debug] auth: Debug: master out: FAIL 1 dovecot [2011-11-24 15:53:50] [err] lmtp(10506): Error: user myuser(a)domain.com: Auth PASS lookup failed dovecot [2011-11-24 15:53:50] [debug] lmtp(10506): Debug: auth input: dovecot [2011-11-24 15:53:50] [err] auth: Error: ldap_result ld 0x16518d0 msgid -1 dovecot [2011-11-24 15:53:50] [err] auth: Error: wait4msg ld 0x16518d0 msgid -1 (timeout 0 usec) dovecot [2011-11-24 15:53:50] [err] auth: Error: wait4msg continue ld 0x16518d0 msgid -1 all 0 dovecot [2011-11-24 15:53:50] [err] auth: Error: ** ld 0x16518d0 Connections: dovecot [2011-11-24 15:53:50] [err] auth: Error: * host: domain.com port: 389 (default) dovecot [2011-11-24 15:53:50] [err] auth: Error: refcnt: 2 status: Connected dovecot [2011-11-24 15:53:50] [err] auth: Error: last used: Thu Nov 24 15:53:50 2011 dovecot [2011-11-24 15:53:50] [err] auth: Error: dovecot [2011-11-24 15:53:50] [err] auth: Error: dovecot [2011-11-24 15:53:50] [err] auth: Error: ** ld 0x16518d0 Outstanding Requests: dovecot [2011-11-24 15:53:50] [err] auth: Error: * msgid 1, origid 1, status InProgress dovecot [2011-11-24 15:53:50] [err] auth: Error: outstanding referrals 0, parent count 0 dovecot [2011-11-24 15:53:50] [err] auth: Error: ld 0x16518d0 request count 1 (abandoned 0) dovecot [2011-11-24 15:53:50] [err] auth: Error: ** ld 0x16518d0 Response Queue: dovecot [2011-11-24 15:53:50] [err] auth: Error: Empty dovecot [2011-11-24 15:53:50] [err] auth: Error: ld 0x16518d0 response count 0 dovecot [2011-11-24 15:53:50] [err] auth: Error: ldap_chkResponseList ld 0x16518d0 msgid -1 all 0 dovecot [2011-11-24 15:53:50] [err] auth: Error: ldap_chkResponseList returns ld 0x16518d0 NULL dovecot [2011-11-24 15:53:50] [err] auth: Error: ldap_int_select dovecot [2011-11-24 15:53:50] [err] auth: Error: read1msg: ld 0x16518d0 msgid -1 all 0 dovecot [2011-11-24 15:53:50] [err] auth: Error: read1msg: ld 0x16518d0 msgid 1 message type bind dovecot [2011-11-24 15:53:50] [err] auth: Error: read1msg: ld 0x16518d0 0 new referrals dovecot [2011-11-24 15:53:50] [err] auth: Error: read1msg: mark request completed, ld 0x16518d0 msgid 1 dovecot [2011-11-24 15:53:50] [err] auth: Error: request done: ld 0x16518d0 msgid 1 dovecot [2011-11-24 15:53:50] [err] auth: Error: res_errno: 0, res_error: <>, res_matched: <> dovecot [2011-11-24 15:53:50] [err] auth: Error: ldap_free_request (origid 1, msgid 1) dovecot [2011-11-24 15:53:50] [err] auth: Error: ldap_parse_result dovecot [2011-11-24 15:53:50] [err] auth: Error: ldap_msgfree dovecot [2011-11-24 15:53:50] [err] auth: Error: ldap_result ld 0x16518d0 msgid -1 dovecot [2011-11-24 15:53:50] [err] auth: Error: wait4msg ld 0x16518d0 msgid -1 (timeout 0 usec) dovecot [2011-11-24 15:53:50] [err] auth: Error: wait4msg continue ld 0x16518d0 msgid -1 all 0 dovecot [2011-11-24 15:53:50] [err] auth: Error: ** ld 0x16518d0 Connections: dovecot [2011-11-24 15:53:50] [err] auth: Error: * host: domain.com port: 389 (default) dovecot [2011-11-24 15:53:50] [err] auth: Error: refcnt: 1 status: Connected dovecot [2011-11-24 15:53:50] [err] auth: Error: last used: Thu Nov 24 15:53:50 2011 dovecot [2011-11-24 15:53:50] [err] auth: Error: dovecot [2011-11-24 15:53:50] [err] auth: Error: dovecot [2011-11-24 15:53:50] [err] auth: Error: ** ld 0x16518d0 Outstanding Requests: dovecot [2011-11-24 15:53:50] [err] auth: Error: Empty dovecot [2011-11-24 15:53:50] [err] auth: Error: ld 0x16518d0 request count 0 (abandoned 0) dovecot [2011-11-24 15:53:50] [err] auth: Error: ** ld 0x16518d0 Response Queue: dovecot [2011-11-24 15:53:50] [err] auth: Error: Empty dovecot [2011-11-24 15:53:50] [err] auth: Error: ld 0x16518d0 response count 0 dovecot [2011-11-24 15:53:50] [err] auth: Error: ldap_chkResponseList ld 0x16518d0 msgid -1 all 0 dovecot [2011-11-24 15:53:50] [err] auth: Error: ldap_chkResponseList returns ld 0x16518d0 NULL dovecot [2011-11-24 15:53:50] [err] auth: Error: ldap_int_select dovecot [2011-11-24 15:53:50] [info] lmtp(10506): Disconnect from local: Client quit (in reset) ****************************************************

3 4

[Dovecot] Questions about Proxy/Director (was: Re: Indexes to MLC-SSD)
by Patrick Westenberg 24 Nov '11

24 Nov '11

Jan-Frode Myklebust schrieb: > MTA -(lmtp)--> dovecot-director ---(lmtp)---> backend-server1 > \---(lmtp)---> backend-server2 > > > IMAP-user -(imap)--> dovecot-director --(imap) --> backend-server1 > \--(imap) --> backend-server2 In this scenario it should be possible to use a non cluster filesystem to store my mails, isn't it? Patrick

2 1

[Dovecot] modules directory
by Johannes Berg 24 Nov '11

24 Nov '11

Hi! I'm a little confused with how plugin loading works in dovecot 2, I can't seem to make it load from $(moduledir)/imap/. Is that intended to work? Just a configuration issue? Reason I ask is that I ported my antispam plugin (I know there's a fork, but I still like mine better) to dovecot 2 and the default "make install" no longer loads properly with just "mail_plugins = antispam". So is $(moduledir)/imap/ no longer used? I also notice acl/imap_acl now, but I still see subdirectories for at least auth. Should I install into just $(moduledir)/ now? johannes

2 4

Re: [Dovecot] Solaris hardware crypto engines
by Martin Preen 24 Nov '11

24 Nov '11

Hello, after serveral tests (and reading a lot of howto's) I'm now fairly convinced that the Solaris HW-crypto engine is not automatically used. Even when dovecot ist compiled with the OpenSSL version provided by Solaris. Currently I have only a T1-CPU available for testing (Sun Fire T2000) and after patching src/login-common/ssl-proxy-openssl.c (Dovecot 1.2.17) with ENGINE *e; ENGINE_load_builtin_engines(); ENGINE_init((e=ENGINE_by_id("pkcs11"))); ENGINE_set_default_RSA(e); ENGINE_set_default_DSA(e); ENGINE_set_default_ciphers(e); in ssl_proxy_init() and inserting ENGINE_cleanup(); in ssl_proxy_deinit() the crypto device gets used. I'm sure that this is not the whole story since this only seems to affect the IMAP login. One has to use the specific SSL-engine and the ENGINE/EVP calls (as stated in the various articles). Is there any chance that Dovecot gets updated/patched for this ? E.g. Like the SSLCryptoDevice setting in Apache's mod_ssl. Regards. Martin Chris Hoogendyk wrote: > > On 4/18/11 6:30 AM, Martin Preen wrote: >> Hello, >> I tried to find out how about to use the hardware crypto engines under >> Solaris (Sun Fire T2000). It seems, that its not just a compilation >> issue: >> >>> For operations that are to be offloaded, it is necessary to restrict >>> use to subset >> > of OpenSSL functions (the EVP_ functions) and explicitly indicate >> the use of the PKCS11 >> > engine; something like the following works for bulk ciphers (the >> process for RSA is similar): >>> >>> ENGINE *e; >>> ENGINE_load_builtin_engines(); >>> e = ENGINE_by_id("pkcs11"); >>> ENGINE_set_default_ciphers(e); >>> EVP_CIPHER_CTX_init (&ctx); >>> EVP_EncryptInit (&ctx, EVP_des_cbc (), key, iv); >>> EVP_EncryptUpdate (.....); >> >> Since I'm not familiar with SSL programming, I wonder if it's possible to >> modify the dovecot 1.2.x source code. Maybe someone has already tried >> this >> or can give me hint. > > You don't want to do that. > > The objective is for the ssl engine to be low level and basically > invisible to layers of application above that use it. So, build openssl > properly and it just works for everything else. > > I'm not at work today, so I don't have reference to my notes. Ah, just > found an email I sent to my colleagues -- copied it below. --------------------------------------------------------------- Martin Preen, Universität Freiburg, Institut für Informatik Georges-Koehler-Allee 52, Raum EG-006, 79110 Freiburg, Germany phone: ++49 761 203-8250 preen(a)informatik.uni-freiburg.de fax: ++49 761 203-8242 swt.informatik.uni-freiburg.de/~preen

3 6