- dovecot - dovecot.org

[Dovecot] SSL Compatibility? SNI vs SAN (Subject Alternative Names) and multiple domains
by Thomas Harold 17 Mar '11

17 Mar '11

Getting ready to redo our mail server setup and I'm trying to wrap my head around the ins and outs and pratfalls involved in SSL, multiple domains, and Dovecot. I've taken a look at: http://wiki2.dovecot.org/SSL/DovecotConfiguration My basic understanding at this point is that: - With SSL for IMAP/POP3, it is limited to one certificate per IP address, because the SSL process starts as soon as the client opens the socket to the IP address. In order to support multiple domains / server names, you have to rely on SAN (Subject Alternative Names) in the server's SSL certificate. - If I use STARTTLS for IMAP/POP3 and Dovecot 2.x, then the SNI process will allow the client to specify that they want to talk to mail server XYZ and Dovecot will hand the correct certificate to the client. However, a lot of devices don't support SNI yet so this is fraught with peril and incompatibilities. So it seems like if I have fewer IP addresses then mail server names, I should stick with a single SSL cert and use SANs. (Wildcard certs are not an option due to the top level domain being different.) How big of an issue is a cert with half a dozen or a dozen SANs attached? Do most mail clients handle that sort of certificate properly in order to access their mailboxes? Reference links: http://www.digicert.com/subject-alternative-name-compatibility.htm

7 8

[Dovecot] problems with public (sub)folders
by frederik.schmid＠gmx.net 17 Mar '11

17 Mar '11

Hi, i am trying to share a maildir++ mailbox to other users but i can only subscribe to the root directory. The subfolders of the public mailbox do not appear in the exported list. Does anyone has an idea how i can share the subfolders too without creating symlinks for every single folder? Best, Frederik >>>>> ls -lA /var/mail/public .user01 -> /var/mail/user01/Maildir >>>>> ls -A /var/mail/user01/Maildir/ (shortened) .Drafts,.Templates,.Sent,.Trash,.Spam new,cur,tmp dovecot.* .subfolder .subfolder.test1 .subfolder.test1.xyz .subfolder.test2 .subfolder.test3 >>>>> doveconf -n # 2.0.11 (2cb0fb910441): /etc/dovecot/dovecot.conf # OS: Linux 2.6.32-5-amd64 x86_64 Debian 6.0 auth_master_user_separator = * auth_username_format = %Ln auth_verbose = yes base_dir = /var/run/dovecot/ disable_plaintext_auth = no first_valid_gid = 100 first_valid_uid = 1000 hostname = xxx last_valid_gid = 50000 last_valid_uid = 50000 listen = * log_path = /var/log/dovecot.log mail_debug = yes mail_location = maildir:~/Maildir managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date namespace { inbox = yes location = prefix = separator = . type = private } namespace { hidden = yes inbox = no list = no location = prefix = INBOX. separator = . type = private } namespace { hidden = no inbox = no list = children location = maildir:/var/mail/public prefix = public. separator = . subscriptions = no type = public } passdb { args = /etc/dovecot/master-users driver = passwd-file master = yes pass = yes } passdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } plugin/autocreate = Trash plugin/autocreate2 = Spam plugin/autocreate3 = Sent plugin/autocreate4 = Drafts plugin/autocreate5 = Templates plugin/autocreate6 = Spam plugin/autosubscribe = Trash plugin/autosubscribe2 = Spam plugin/autosubscribe3 = Sent plugin/autosubscribe4 = Drafts plugin/autosubscribe5 = Templates plugin/autosubscribe6 = Spam plugin/sieve = ~/.main.sieve plugin/sieve_before = /etc/dovecot/sieve/move-spam.sieve plugin/sieve_dir = ~/sieve postmaster_address = postmaster@xxx protocols = imap lmtp sieve service anvil { client_limit = 2048 } service imap-login { client_limit = 1024 inet_listener imap { port = 143 } inet_listener imaps { port = 993 ssl = yes } process_limit = 1024 process_min_avail = 16 } service lmtp { inet_listener lmtp { address = * port = 24 } } service managesieve-login { inet_listener sieve { port = 4190 } } ssl = required ssl_cert = </etc/dovecot/cert/xxx ssl_key = </etc/dovecot/cert/xxx userdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } verbose_proctitle = yes protocol lmtp { mail_plugins = " sieve" } protocol lda { mail_plugins = " sieve" } protocol imap { mail_max_userip_connections = 100 mail_plugins = " autocreate" } -- GMX DSL Doppel-Flat ab 19,99 Euro/mtl.! Jetzt mit gratis Handy-Flat! http://portal.gmx.net/de/go/dsl

2 1

[Dovecot] Dove cot+Kerberos
by Rostislav Matyusha 17 Mar '11

17 Mar '11

Hi All. I have a problem with authorization users AD via kerberos in Dovecot&Postfix. Windows SRV 2008 Standart - AD mail server: Gentoo + cyrus-sasl + postfix + dovecot with support ldap&kerberos. I am created a 4 keytabs on Windows box. C:\Users\Admin>ktpass -princ host/srv-mail.cn.energy(a)CN.ENERGY -mapuser ldapmail(a)CN.ENERGY -pass "superpasswd" -crypto RC4-HMAC-NT -ptype KRB5_NT_PRINCIPAL -out c:\mail.keytab etc... for all imap/srv-mail.cn.energy pop/srv-mail.cn.energy smtp/srv-mail.cn.energy host/srv-mail.cn.energy On Linux server: ktutils ktutils: rkt /root/Keytab/imap.keytab ktutils: rkt /root/Keytab/smtp.keytab ktutils: rkt /root/Keytab/pop.keytab ktutils: rkt /root/Keytab/host.keytab ktutils: wrt /etc/krb5.keytab ktutils: q kinit -V -k -t /etc/krb5.keytab host/srv-mail.cn.energy(a)CN.ENERGY Authenticated to Kerberos v5 KRB5_KTNAME=/etc/krb5.keytab ; export KRB5_KTNAME TESTING: imtest srv-mail ERROR: Mar 10 08:27:23 srv-mail dovecot: auth(default): auth(?,10.0.0.5): Invalid username: host/srv-mail.cn.energy(a)CN.ENERGY Mar 10 08:27:23 srv-mail dovecot: auth(default): gssapi(?,10.0.0.5): authn_name: Username contains disallowed character: 0x2f Why username "host/srv-mail.cn.energy(a)CN.ENERGY" ??? imtest -m GSSAPI -u ross -a ross -r cn.energy srv-mail ERROR: Mar 10 08:31:55 srv-mail dovecot: auth(default): auth(?,10.0.0.5): Invalid username: host/srv-mail.cn.energy(a)CN.ENERGY Mar 10 08:31:55 srv-mail dovecot: auth(default): gssapi(?,10.0.0.5): authn_name: Username contains disallowed character: 0x2f BUT if i create kinit ross(a)CN.ENERGY imtest srv-mail ERROR: srv-mail dovecot: auth(default): gssapi(ross(a)CN.ENERGY,10.0.0.5): Invalid response length So i am confusion, please help me. many thanks -- Best Regards Ross Remote Server Administration. e-mail: ross.sysadm(a)gmail.com skype: ross.sysadm icq: 317410068 Best Offers for a full range of server management services and effective on time solutions.

2 1

[Dovecot] dict crashes with multiple map definitions
by Birger Brunswiek 17 Mar '11

17 Mar '11

Hi, I get a crash in dict if I use multiple map sections. Each one of them works fine by their own. I managed to convince dovecot to create dump files to debug this, but I can't figure out how to do the same for dict. How can I do this? Anyway, perhaps someone already know's what's wrong by looking at what I do in the sql dict configuration. Mar 9 02:27:52 xxx dovecot: dict: pgsql: Connected to dovecot Mar 9 02:27:52 xxx dovecot: dict: Panic: file driver-pgsql.c: line 529 (do_query): assertion failed: (db->sync_result == NULL) Mar 9 02:27:52 xxx dovecot: dict: Raw backtrace: dict() [0x418a9a] -> dict() [0x418b03] -> dict() [0x418206] -> dict() [0x414124] -> dict() [0x414b07] -> dict() [0x40e0dc] -> dict() [0x40e20a] -> dict() [0x40b77f] -> dict() [0x40b8b9] -> dict() [0x40ba57] -> dict(io_loop_handler_run+0xbd) [0x41d87d] -> dict(io_loop_run+0x18) [0x41ccf8] -> dict(main+0x114) [0x40bda4] -> /lib/libc.so.6(__libc_start_main+0xfd) [0x7f9a10cdbc4d] -> dict() [0x40ad69] Mar 9 02:27:52 xxx dovecot: IMAP(xxx): read(/var/run/dovecot/dict-server) failed: Remote disconnected Mar 9 02:27:52 xxx dovecot: IMAP(xxx): acl: dict iteration failed, can't update dict Mar 9 02:27:52 xxx dovecot: dovecot: child 11180 (dict) killed with signal 6 (core not dumped) # dovecot --version 1.2.15 # dovecot -n # 1.2.15: /etc/dovecot/dovecot.conf # OS: Linux 2.6.32-5-amd64 x86_64 Debian 6.0 ext3 log_timestamp: %Y-%m-%d %H:%M:%S protocols: imap imaps managesieve listen: [::] ssl_cert_file: /etc/ssl/certs/foo.bar.pem ssl_key_file: /etc/ssl/private/foo.bar.key.pem login_dir: /var/run/dovecot/login login_executable(default): /usr/lib/dovecot/imap-login login_executable(imap): /usr/lib/dovecot/imap-login login_executable(managesieve): /usr/lib/dovecot/managesieve-login mail_privileged_group: mail mail_location: maildir:/var/mail/%u/mailbox mbox_write_locks: fcntl dotlock mail_executable(default): /usr/lib/dovecot/imap mail_executable(imap): /usr/lib/dovecot/imap mail_executable(managesieve): /usr/lib/dovecot/managesieve mail_plugins(default): acl imap_acl mail_plugins(imap): acl imap_acl mail_plugins(managesieve): mail_plugin_dir(default): /usr/lib/dovecot/modules/imap mail_plugin_dir(imap): /usr/lib/dovecot/modules/imap mail_plugin_dir(managesieve): /usr/lib/dovecot/modules/managesieve namespace: type: private separator: / inbox: yes list: yes subscriptions: yes namespace: type: shared separator: / prefix: shared/%%n/ location: maildir:/var/mail/%%u/mailbox:INDEX=/var/mail/%u/mailbox/shared/%%u list: children lda: postmaster_address: postmaster(a)foo.bar mail_plugins: sieve acl auth default: mechanisms: plain gssapi passdb: driver: pam args: blocking=yes dovecot userdb: driver: static args: uid=vmail gid=vmail home=/var/mail/%u allow_all_users=yes socket: type: listen client: path: /var/spool/postfix/private/auth mode: 432 user: postfix group: postfix master: path: /var/run/dovecot/auth-master mode: 384 user: vmail plugin: acl: vfile acl_shared_dict: proxy::acl sieve: ~/.dovecot.sieve sieve_dir: ~/sieve dict: acl: pgsql:/etc/dovecot/dovecot-dict-sql.conf # cat /etc/dovecot/dovecot-dict-sql.conf connect = host=foo.bar dbname=dovecot user=dovecot password=xxx map { pattern = shared/shared-boxes/user/$owner/$user table = user_shares value_field = dummy fields { owner = $owner usr = $user } } map { pattern = shared/shared-boxes/anyone/$owner table = global_shares value_field = dummy fields { owner = $owner } } map { pattern = shared/shared-boxes/group/$group/$owner table = group_shares value_field = dummy fields { grp = $group owner = $owner } }

2 1

[Dovecot] dovecot 1.2 quota with local users
by iti＠promax.media.pl 17 Mar '11

17 Mar '11

Hello, I got problem with setting quota from mysql for local users. In database are only information with quota. Password are store in passwd/shadow. My database have only simple info like in wiki description. Table created with: CREATE TABLE quota ( username varchar(100) not null, bytes bigint not null default 0, messages integer not null default 0, primary key (username) ); In dovecot.conf like in description is: dict { quotadict = mysql:/etc/dovecot-dict-sql.conf } plugin { # v1.2 + SQL: quota = dict:user::proxy::quotadict # v1.2 + file: quota = dict:user::file:%h/Maildir/dovecot-quota quota_rule = *:storage=10M:messages=1000 } File dovecot-dict-sql.conf has: # v1.2+ only: connect = host=localhost dbname=mails user=sqluser password=sqlpass map { pattern = priv/quota/storage table = quota username_field = username value_field = bytes } map { pattern = priv/quota/messages table = quota username_field = username value_field = messages } With corrected values about databasename, user and password. Where should to add information about sql query when autorization is not via myqsl (only shadow/password). There are in description info about additional file with user_query: dovecot-mysql.conf. Can anybody know how it should it look like and where to add it in config?

2 3

[Dovecot] inetd config - dovecot doesn't exits
by kjonca＠o2.pl 17 Mar '11

17 Mar '11

Is there any option for dovecot to exit when is unneded? I mostly use dovecot via shell process (ie. something like /usr/sbin/dovecot --exec-mail imap) But sometimes I want to use it remotely via tcp and I run dovecot via inetd. --8<---------------cut here---------------start------------->8--- localhost:imap stream tcp nowait root /usr/sbin/tcpd /usr/lib/dovecot/imap-login --8<---------------cut here---------------end--------------->8--- in inetd.conf works good, but dovecot stays, even if all clients ended their connections. How can I make dovecot to exit after last client disconnects? KJ -- Http://modnebzdury.wordpress.com/2009/10/01/niewiarygodny-list-prof-majewsk… Wiesz, tryb tekstowy w Linuksie ma się tak do DOSu jak F-117A do paralotni. (c) Dawid Kuroczko

2 1

[Dovecot] Attachment file size error in SIS
by Daniel L. Miller 17 Mar '11

17 Mar '11

I've got an attachment that triggers a "smaller than expected" error. It was a pdf I received some time ago. I copied the file from the dovecot storage, renamed it to something close to the original name (I don't remember what that was), then created a new mail with this as an attachment and saved it to the server. This created a new file, identical file size to the other - but continues to have the "smaller than expected" error. -- Daniel

2 1

[Dovecot] search for attachment hash
by Daniel L. Miller 17 Mar '11

17 Mar '11

How can I determine what message(s) are linked to a given attachment hash? -- Daniel

2 1

[Dovecot] doveadm expunge info message in std.error
by Kui Zhang 17 Mar '11

17 Mar '11

Hello This command doveadm expunge -u "user@domain" mailbox ".namespace/*" savedbefore 7d writes these messages to std.error doveadm(user@domain): Info: expunge: box=.namespace/INBOX, uid=5932, msgid=<E1Puxwf-0001fD-Si@hostname>, size=1824 doveadm(user@domain): Info: expunge: box=.namespace/INBOX, uid=5933, msgid=<E1Puy0N-0001fI-No@hostname>, size=1822 doveadm(user@domain): Info: expunge: box=.namespace/INBOX, uid=5934, msgid=<E1Puy0Q-0001fM-I0@hostname>, size=1824 doveadm(user@domain): Info: expunge: box=.namespace/INBOX, uid=5935, msgid=<E1Pv6CY-0001ge-H9@hostname>, size=1843 doveadm(user@domain): Info: expunge: box=.namespace/INBOX, uid=5936, msgid=<E1Pv6Hm-0001gi-7R@hostname>, size=1822 doveadm(user@domain): Info: expunge: box=.namespace/INBOX, uid=5937, msgid=<E1PvMRn-0001lm-A6@hostname>, size=1854 doveadm(user@domain): Info: expunge: box=.namespace/INBOX, uid=5938, msgid=<E1PvZLN-0001p4-EF@hostname>, size=1832 doveadm(user@domain): Info: expunge: box=.namespace/INBOX, uid=5939, msgid=<E1PvZN6-0001p8-IA@hostname>, size=1840 doveadm(user@domain): Info: expunge: box=.namespace/INBOX, uid=5940, msgid=<E1PwMvo-0001xs-8w@hostname>, size=1835 Can we write these messages(informational) to std.out It would help reduce cron mails. Thanks KuiZ

3 3

[Dovecot] segmentation fault with doveadm search
by Nick Rosier 17 Mar '11

17 Mar '11

Configuration: Dovecot 2.0.11 on FreeBSD 8.2 When I run a search to generate the FTS search indexes I get following error: # doveadm search -A body dead_beef [1] 34789 segmentation fault doveadm search -A body dead_beef How can I (help) troubleshoot this? Rgds, N.

2 3