- dovecot - dovecot.org

Re: [Dovecot] Solaris hardware crypto engines
by Chris Hoogendyk 19 Apr '11

19 Apr '11

The attachment made the message too long for the forum. So I canceled the original. If you want the Sun article, you can google 05071387.pdf. The original went through to Martin. On 4/18/11 5:02 PM, Chris Hoogendyk wrote: > On 4/18/11 6:30 AM, Martin Preen wrote: >> Hello, >> I tried to find out how about to use the hardware crypto engines under >> Solaris (Sun Fire T2000). It seems, that its not just a compilation issue: >> >>> For operations that are to be offloaded, it is necessary to restrict use to subset >> > of OpenSSL functions (the EVP_ functions) and explicitly indicate the use of the PKCS11 >> > engine; something like the following works for bulk ciphers (the process for RSA is similar): >>> >>> ENGINE *e; >>> ENGINE_load_builtin_engines(); >>> e = ENGINE_by_id("pkcs11"); >>> ENGINE_set_default_ciphers(e); >>> EVP_CIPHER_CTX_init (&ctx); >>> EVP_EncryptInit (&ctx, EVP_des_cbc (), key, iv); >>> EVP_EncryptUpdate (.....); >> >> Since I'm not familiar with SSL programming, I wonder if it's possible to >> modify the dovecot 1.2.x source code. Maybe someone has already tried this >> or can give me hint. > > You don't want to do that. > > The objective is for the ssl engine to be low level and basically invisible to layers of > application above that use it. So, build openssl properly and it just works for everything else. > > I'm not at work today, so I don't have reference to my notes. Ah, just found an email I sent to my > colleagues -- copied it below. -- --------------- Chris Hoogendyk - O__ ---- Systems Administrator c/ /'_ --- Biology& Geology Departments (*) \(*) -- 140 Morrill Science Center ~~~~~~~~~~ - University of Massachusetts, Amherst <hoogendyk(a)bio.umass.edu> --------------- Erdös 4 -------- Original Message -------- Subject: building apps with ssl Date: Thu, 18 Mar 2010 11:30:42 -0400 From: Chris Hoogendyk<hoogendyk(a)bio.umass.edu> cool. I've got things working now so that I can build applications with the openssl built by Sun to tap into the cryptographic accelerators on the T2. It turns out that the /opt/coolstack stuff related to openssl is actually symlinks to /usr/sfw. So, in the Makefile, if I set the openssl directory to /usr/sfw, rather than the default /usr/local/openssl, it finds the includes, the libraries, and the binaries that are needed. Then I specifically point the certs directory (in the Makefile) to /usr/local/openssl/certs for local control. Then, for the example of uw-imap, everything builds just fine. This should simply apply to anything we need to build with openssl on any of the T5220s. One side note is that this was a custom Makefile. Applications that use ./configure would presumably find the openssl through the paths provided in /usr/local/src/env. In the process of figuring that out, I also found that one of the most recent Solaris 10 kernel patches that we have on imladris specifically addresses awareness of the crypto accelerators and included patches to the openssl related items in /usr/sfw. So, I'm pretty confident that everything is alright. It's interesting too that in the paper presented at ACM by Sun last year they said that a couple of classes of attacks on crypto processes were negated by running it directly on the CPU. One of them had to do with timing. I should forward that paper to you as well. OK, just attached it. -- --------------- Chris Hoogendyk - O__ ---- Systems Administrator c/ /'_ --- Biology& Geology Departments (*) \(*) -- 140 Morrill Science Center ~~~~~~~~~~ - University of Massachusetts, Amherst <hoogendyk(a)bio.umass.edu> --------------- Erdös 4

1 0

[Dovecot] Solaris hardware crypto engines
by Martin Preen 18 Apr '11

18 Apr '11

Hello, I tried to find out how about to use the hardware crypto engines under Solaris (Sun Fire T2000). It seems, that its not just a compilation issue: > For operations that are to be offloaded, it is necessary to restrict use to subset > of OpenSSL functions (the EVP_ functions) and explicitly indicate the use of the PKCS11 > engine; something like the following works for bulk ciphers (the process for RSA is similar): > > ENGINE *e; > ENGINE_load_builtin_engines(); > e = ENGINE_by_id("pkcs11"); > ENGINE_set_default_ciphers(e); > EVP_CIPHER_CTX_init (&ctx); > EVP_EncryptInit (&ctx, EVP_des_cbc (), key, iv); > EVP_EncryptUpdate (.....); Since I'm not familiar with SSL programming, I wonder if it's possible to modify the dovecot 1.2.x source code. Maybe someone has already tried this or can give me hint. Regards. Martin

2 1

Re: [Dovecot] 2.0.12 ipwd.c does not compile under solaris
by Joseph Tam 18 Apr '11

18 Apr '11

> From: Roger Fujii <rmf(a)lookhere.com> > > the new src/lib/ipwd.c introduced in 2.0.12 no longer compiles on > solaris. Under solaris, > the *_r routines doesn't pass in result as the last parameter and return > errno - it just returns result. > obviously a job for configure..... This was solved several Emails back about forcing the use of POSIX threading models (a workaround path is provided): http://www.dovecot.org/list/dovecot/2011-April/058602.html Joseph Tam <jtam.home(a)gmail.com>

1 0

[Dovecot] Dovecot v2.0.12 OpenBSD - getpwuid() error
by LEVAI Daniel 17 Apr '11

17 Apr '11

Hi! I've upgraded from 2.0.11 to 2.0.12. I've experienced errors during delivery with dovecot-lda. The error log attached contains the errors. Since then I had to downgrade to 2.0.11, to make it work again. When starting 2.0.12, it couldn't chown() the files under /var/dovecot (eg.: dict) to the user specified in the configuration file. Configuration: # doveconf -n # 2.0.11: /etc/dovecot/dovecot.conf # OS: OpenBSD 4.8 i386 auth_master_user_separator = * auth_mechanisms = plain login digest-md5 ntlm auth_verbose = yes base_dir = /var/dovecot/ default_internal_user = _dovecot default_login_user = _dovenull dict/quota = pgsql:/etc/dovecot/dovecot_dict-sql.conf first_valid_gid = 8000 first_valid_uid = 8000 info_log_path = /var/log/mail/dovecot.info listen = ip 127.0.0.1 log_path = /var/log/mail/dovecot.log mail_location = maildir:~/Maildir/ mail_plugins = quota managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date passdb { args = /etc/dovecot/dovecot-sql.conf driver = sql } passdb { args = /etc/dovecot/master_passdb-sql.conf driver = sql master = yes pass = yes } plugin/quota = dict:User quota::proxy::quota plugin/quota_rule = *:storage=100M plugin/quota_rule2 = Trash:storage=+50M plugin/sieve = ~/dovecot.sieve plugin/sieve_dir = ~/sieve plugin/sieve_global_dir = /var/mail_virtual/sieve/ plugin/sieve_max_script_size = 1M plugin/sieve_quota_max_scripts = 5 plugin/sieve_quota_max_storage = 5M protocols = pop3 imap sieve service auth { unix_listener /var/spool/postfix/private/auth { group = _postfix mode = 0660 } unix_listener /var/www/priv/dovecot-auth { group = www mode = 0660 } unix_listener auth-master { group = vmail mode = 0660 } } service dict { unix_listener dict { group = vmail mode = 0660 } } service imap-postlogin { executable = script-login /etc/dovecot/postlogin.sh user = root } service imap { executable = imap imap-postlogin } service managesieve-login { vsz_limit = 64 M } service pop3-postlogin { executable = script-login /etc/dovecot/postlogin.sh user = root } service pop3 { executable = pop3 pop3-postlogin } ssl = required ssl_cert = </etc/ssl/dovecot_cert.pem ssl_key = </etc/ssl/private/dovecot_key.pem userdb { driver = prefetch } userdb { args = /etc/dovecot/dovecot-sql.conf driver = sql } protocol imap { mail_plugins = quota imap_quota } protocol pop3 { mail_plugins = quota pop3_client_workarounds = outlook-no-nuls oe-ns-eoh pop3_uidl_format = %08Xu%08Xv } protocol lda { deliver_log_format = msgid=%m, from=%f, subject=%s: %$ mail_plugins = quota sieve postmaster_address = postmaster@domain sendmail_path = /usr/local/sbin/sendmail } Daniel -- LÉVAI Dániel PGP key ID = 0x83B63A8F Key fingerprint = DBEC C66B A47A DFA2 792D 650C C69B BE4C 83B6 3A8F

1 1

[Dovecot] pop3-login segfaults (new backtrace)
by interfaSys sàrl 17 Apr '11

17 Apr '11

Hello, A while back I reported that pop3-login was segfaulting, but my traces were not very helpful. Here is a new one. Let me know if it helps. #0 0x000000080090cf91 in _pthread_mutex_init_calloc_cb () from /lib/libc.so.7 No symbol table info available. #1 0x000000080090dc9d in _pthread_mutex_init_calloc_cb () from /lib/libc.so.7 No symbol table info available. #2 0x000000080090e9c5 in _pthread_mutex_init_calloc_cb () from /lib/libc.so.7 No symbol table info available. #3 0x00000008009116ec in _malloc_prefork () from /lib/libc.so.7 No symbol table info available. #4 0x00000008009143c4 in malloc () from /lib/libc.so.7 No symbol table info available. #5 0x000000080047774c in data_stack_init () from /dovecot-2.0-hg/src/lib-dovecot/.libs/libdovecot.so.0 No symbol table info available. #6 0x00007fffffffe260 in ?? () No symbol table info available. #7 0x000000004da57f53 in ?? () No symbol table info available. #8 0x0000000000000048 in ?? () No symbol table info available. #9 0x000000080049d5ae in lib_init () from /dovecot-2.0-hg/src/lib-dovecot/.libs/libdovecot.so.0 No symbol table info available. #10 0x000000004da031c7 in ?? () No symbol table info available. #11 0x0000000000054e94 in ?? () No symbol table info available. #12 0x0000000000403392 in ?? () No symbol table info available. #13 0x000000080049d609 in master_service_init () from /dovecot-2.0-hg/src/lib-dovecot/.libs/libdovecot.so.0 No symbol table info available. #14 0x0000000000403392 in ?? () No symbol table info available. #15 0x0000000000000048 in ?? () No symbol table info available. #16 0x00007fffffffe260 in ?? () No symbol table info available. #17 0x0000000000000001 in ?? () No symbol table info available. #18 0x0000000000403650 in pop3_login_setting_parser_info () No symbol table info available. #19 0x0000000000403392 in ?? () No symbol table info available. #20 0x00007fffffffe308 in ?? () No symbol table info available. #21 0x0000000000000000 in ?? () No symbol table info available. #22 0x0000000000000000 in ?? () No symbol table info available. #23 0x000000080044bf41 in main () from /dovecot-2.0-hg/src/login-common/.libs/libdovecot-login.so.0 No symbol table info available. #24 0x00007fffffffe308 in ?? () No symbol table info available. #25 0x00000001005333d0 in ?? () No symbol table info available. #26 0x0000000000000001 in ?? () No symbol table info available. #27 0x00007fffffffe308 in ?? () No symbol table info available. #28 0x0000000800ace8b0 in __stack_chk_guard () from /lib/libc.so.7 No symbol table info available. #29 0x0000000000000001 in ?? () No symbol table info available. #30 0x00007fffffffe2e0 in ?? () No symbol table info available. #31 0x00007fffffffe318 in ?? () No symbol table info available. #32 0x00007fffffffe308 in ?? () No symbol table info available. #33 0x0000000000000000 in ?? () No symbol table info available. #34 0x0000000000000000 in ?? () No symbol table info available. #35 0x0000000000401dae in _start () No symbol table info available. I'm using GCC 4.5 with gold. Using the standard linker creates a binary that doesn't crash. It's the only part of dovecot that has a problem. imap-login works fine. Cheers, Olivier

3 5

[Dovecot] 2.0.12 ipwd.c does not compile under solaris
by Roger Fujii 17 Apr '11

17 Apr '11

the new src/lib/ipwd.c introduced in 2.0.12 no longer compiles on solaris. Under solaris, the *_r routines doesn't pass in result as the last parameter and return errno - it just returns result. obviously a job for configure..... -- Roger Fujii<rmf(a)lookhere.com>

2 1

[Dovecot] Post-login script with LDAP virtual users
by Hideo GOTO 16 Apr '11

16 Apr '11

Dear sirs, I'm working on Post-login script for migrating 40K Courier-imap users to Dovecot. After reading related topics about post-login script in your documentation, mailing list, I cannot remove the problem described here-below. Is there any special config to add when users are virtual (authentication and user info is fed by LDAP server). I would be grad if anyone could give me advise. Phenomena: ========== Although the authentication and script execution is successfully done, Pop3 session is aborted just after that, leaving the following error message to syslog: /var/log/maillog: Feb 7 17:45:58 pop3migr dovecot: pop3(vuser1): Post-login script denied access to user vuser1 cf. "vuser1" is UID of a virtual account on the LDAP tree. Maildir is located at /var/spool/postfixdata/%u/Maildir, and is owned by linux local user "mailuser". Dovecot works perfect ,if post-login script configuration is commented out. Environment: Dovecot: dovecot-2.0.9 (built from source tar ball) OS: Linux / 2.6.30.10-105.2.23.fc11.x86_64 (Virtual machine on a xen server) Maidir: tested both with local file system and NFS (ext3, xfs) client: Using telnet on pop3 TCP port. All the pop3 users are virtual and does not have local login account ('authentication and user information is given by LDAP server). SMTP service is managed by Postfix: ( A single local login account is writing all mails to Maildir for all the virtual users. ) Thanks in advance.

4 5

Re: [Dovecot] coredump in dovecot 2.0.11
by k b 16 Apr '11

16 Apr '11

This is it: -------- [root@server00 spool]# service dovecot start Starting Dovecot Imap: [ OK ] [root@isteren spool]# gdb /usr/libexec/dovecot/imap core GNU gdb (GDB) Fedora (7.2-46.fc14) Copyright (C) 2010 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html> This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type "show copying" and "show warranty" for details. This GDB was configured as "i686-redhat-linux-gnu". For bug reporting instructions, please see: <http://www.gnu.org/software/gdb/bugs/>... Reading symbols from /usr/libexec/dovecot/imap...Reading symbols from /usr/lib/debug/usr/libexec/dovecot/imap.debug...done. done. /var/spool/core: No such file or directory. (gdb) bt full No stack. (gdb) q Should i create the /var/spool/core (file or directory) first? --- On Sat, 4/9/11, Timo Sirainen <> wrote: > Subject: Re: [Dovecot] coredump in dovecot 2.0.11 > Date: Saturday, April 9, 2011, 12:29 PM > I'm guessing it either couldn't open > the binary file or the core file.. Even without debug > symbols it should print something. What's the full gdb > command you're giving and its output? > > On 9.4.2011, at 13.26, k b wrote: > > > apparently i cannot get it right, > > (gdb) bt full says: > > No stack. > > > > > > i did install the debuginfo files > > debuginfo-install dovecot-2.0.11-1.fc14.i686 > > > > but gdb still says No stack. > > > > > > > > > > > > > > --- On Sat, 4/9/11, Timo Sirainen <tss(a)iki.fi> wrote: > > > >> Subject: Re: [Dovecot] coredump in dovecot 2.0.11 > >> Cc: dovecot(a)dovecot.org > >> Date: Saturday, April 9, 2011, 9:01 AM > >> On 9.4.2011, at 9.37, k b wrote: > >> > >>> I can post the coredump but i will have to > clean it > >> first as i can see it contains a few emails. > >>> would it help to post the coredump or shuould > i skip > >> that? > >> > >> The core file itself isn't useful, because it's > highly > >> system specific. Posting a gdb backtrace from it > would be > >> very useful though. So basically: > >> > >> gdb /usr/libexec/dovecot/imap core > >> bt full > >> > >> > > > >

3 7

[Dovecot] Compiling Error with Dovecot 1.0.7 and Sieve 1.0.4
by Jay Welch 15 Apr '11

15 Apr '11

Hi, I am having compiling issues with Sieve and I am not sure what the error is stating. [root@iosmail dovecot-sieve-1.0.4]# make make all-recursive make[1]: Entering directory `/home/jayw/Desktop/dovecot-sieve-1.0.4' Making all in src make[2]: Entering directory `/home/jayw/Desktop/dovecot-sieve-1.0.4/src' Making all in libsieve make[3]: Entering directory `/home/jayw/Desktop/dovecot-sieve-1.0.4/src/libsieve' /bin/sh ../../libtool --tag=CC --mode=compile gcc -DHAVE_CONFIG_H -I. -I../.. -I/usr/src/dovecot/dovecot-1.0.7 -I/usr/src/dovecot/dovecot-1.0.7/src/lib -I../../src @CFLAGS@ -MT addr.lo -MD -MP -MF .deps/addr.Tpo -c -o addr.lo addr.c libtool: compile: gcc -DHAVE_CONFIG_H -I. -I../.. -I/usr/src/dovecot/dovecot-1.0.7 -I/usr/src/dovecot/dovecot-1.0.7/src/lib -I../../src @CFLAGS@ -MT addr.lo -MD -MP -MF .deps/addr.Tpo -c addr.c -fPIC -DPIC -o .libs/addr.o gcc: @CFLAGS@: No such file or directory make[3]: *** [addr.lo] Error 1 make[3]: Leaving directory `/home/jayw/Desktop/dovecot-sieve-1.0.4/src/libsieve' make[2]: *** [all-recursive] Error 1 make[2]: Leaving directory `/home/jayw/Desktop/dovecot-sieve-1.0.4/src' make[1]: *** [all-recursive] Error 1 make[1]: Leaving directory `/home/jayw/Desktop/dovecot-sieve-1.0.4' make: *** [all] Error 2 Also, I did not originally have the source files and I had to download them for *dovecot-config*. Not sure if that makes a difference or not. Much Appreciated -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.

2 3

[Dovecot] Problem login in managesieve with email address
by Juan C. Blanco 15 Apr '11

15 Apr '11

Hello all, I have a installation of dovecot 1.2.16, sieve-0.1.18, managesieve-0.11.12 in dovecot-ldap.conf auth_bind=yes user_attrs = irisMailbox=home,fiMailQuotaSize=quota_rule=*:storage user_filter = (|(uid=%u)(mail=%u)) pass_attrs = userPassword=password,irisMailbox=userdb_home,fiMailQuotaSize=userdb_quota_rule=*:storage pass_filter = (|(uid=%u)(mail=%u)) I'm doing some test to authenticate using the full email address for authentication and this works fine for IMAP and POP3 but dows not work with MANAGESIEVE I have a test machine with dovecot 2.0.12 and pigeonhole-0.2.3 and the results are the same. ¿Do you known if there is any reason for this differente behaviour? Activating debug in dovecot this are the difference between IMAP and MANAGESIEVE authenticacion Apr 15 17:43:15 auth: Debug: auth client connected (pid=13832) Apr 15 17:43:15 auth: Debug: client in: AUTH 1 PLAIN service=sieve secured lip=138.100.8.17 rip=138.100.8.42 lport=2000 rport=52828 resp=<hidden> Apr 15 17:43:15 auth: Debug: auth(d0122(a)alumnos.fi.upm.es,138.100.8.42,master): Master user lookup for login: d0122 Apr 15 17:43:15 auth: Debug: cache(d0122(a)alumnos.fi.upm.es,138.100.8.42,master): hit: Apr 15 17:43:15 auth: Info: cache(d0122(a)alumnos.fi.upm.es,138.100.8.42,master): User unknown Apr 15 17:43:17 auth: Debug: client out: FAIL 1 user=d0122(a)alumnos.fi.upm.es Apr 15 17:43:17 managesieve-login: Info: Disconnected (auth failed, 1 attempts): user=<d0122(a)alumnos.fi.upm.es>, method=PLAIN, rip=138.100.8.42, lip=138.100.8.17, TLS Apr 15 17:43:18 auth: Debug: auth client connected (pid=13833) Apr 15 17:43:18 auth: Debug: client in: AUTH 1 PLAIN service=imap secured lip=138.100.8.17 rip=138.100.8.42 lport=993 rport=34094 resp=<hidden> Apr 15 17:43:18 auth: Debug: cache(d0122(a)alumnos.fi.upm.es,138.100.8.42): hit: <hidden> userdb_home=/mail/alumnos/d0/d0122 userdb_quota_rule=*:storage=10240 Apr 15 17:43:18 auth: Debug: client out: OK 1 user=d0122(a)alumnos.fi.upm.es Apr 15 17:43:18 auth: Debug: master in: REQUEST 413401089 13833 1 42fd9bf31349809a03f19a6a3b9730cc Apr 15 17:43:18 auth: Debug: userdb-cache(d0122(a)alumnos.fi.upm.es,138.100.8.42): miss Apr 15 17:43:18 auth: Debug: passwd-file(d0122(a)alumnos.fi.upm.es,138.100.8.42): lookup: user=d0122(a)alumnos.fi.upm.es file=/nas/mail/etc/passwd.master Apr 15 17:43:18 auth: Info: passwd-file(d0122(a)alumnos.fi.upm.es,138.100.8.42): unknown user Apr 15 17:43:18 auth: Debug: prefetch(d0122(a)alumnos.fi.upm.es,138.100.8.42): success Apr 15 17:43:18 auth: Debug: master out: USER 413401089 d0122(a)alumnos.fi.upm.es home=/mail/alumnos/d0/d0122 quota_rule=*:storage=10240 Apr 15 17:43:18 imap-login: Info: Login: user=<d0122(a)alumnos.fi.upm.es>, method=PLAIN, rip=138.100.8.42, lip=138.100.8.17, mpid=13834, TLS Thanks and best regards Juan C. Blanco -- +----------------------------------------------------------------+ | Juan C. Blanco | | | | Centro de Calculo | | | Facultad de Informatica U.P.M. | E-mail: jcblanco(a)fi.upm.es | | Campus de Montegancedo | | | Boadilla del Monte | Tel.: (+34) 91 336 7466 | | 28660 MADRID (Spain) | Fax : (+34) 91 336 6913 | +----------------------------------------------------------------+

1 0