- dovecot - dovecot.org

[Dovecot] Help needed with plugin - Read Only access to IMAP mailbox
by Chris Moules 25 Aug '10

25 Aug '10

System info: # 1.2.13: /etc/dovecot/dovecot.conf # OS: Linux 2.6.32-5-686-bigmem i686 Debian squeeze/sid .. mail_plugins: readonly .. I have a requirement to have read-only to a mailbox. I have been researching through the wiki, the mailing list archives and good old Google. There was a number of similar questions with no real definitive answer. Option 1: ACL This can work, but not if the mailbox(s) can change without you knowing how. I.E. a online read-only archive of someone else's mailbox. There is no wild-card or recursive ACL options. Rsync style backups don't allow for easy creation of custom ACL files per mailbox. Option 2: Read-only filesystem (Linux) This seems easy, but it's not. 1) how do you update your archive? I tried with a bind mount, this does not let you set the 'ro' option *directly*. You must then use "-o remount,ro" to get your read-only bind mount. This is a little messy (needs custom init scripts for mounting on boot), but do-able. 2) Dovecot needs write access to CONTROL and INDEX files. This lead me to using the "CONTROL" and "INDEX" options on the mail_locaiton. Setting these to the original 'rw' mount and the rest to my 'ro' bind mount. Again, messy but do-able. 3) Clients try to move messages from 'new' to 'cur' for Maildir. Every time I opened a maildir I got an error per mail (dovecot log) about read-only filesysem as the client was trying to set the Seen flag and dovecot was trying to move the 'new' mail to the 'cur' folder. My test client, mutt, has a 'read_only' option when connecting. This eliminates this issue, but I cannot get everyone to use this archive with a correctly configured mutt. This sent me looking for 'read only' options in other clients. I could hardly find any. I noted that mutt send an EXAMINE and not a SELECT to open the mailbox when in read_only mode and this set me thinking about doing this in another way. Option 3: Dovecot Plugin I started looking into the dovecot plugins. Being more a systems administrator than developer I have cobbled together a working plugin. It nearly does what I want, but not quite, and I don't know why. NOTE: I no longer use the setup that I had to test Options 1 and 2. I thought that this plugin can either be used server-wide or with the 'mail_plugins' userdb option. The plugin forces the MAILBOX_OPEN_READONLY flag in a mailbox_open() call. The plugin returns an error for all mailbox_create() calls. Testing in mutt: - I am unable to delete a mail - I am unable to create a new folder So far so good. However: - I am able to move/copy a mail to an *existing* mailbox (note, the move operation makes the copy but fails to set the 'delete' flag) I do not understand why this works. I have been grep-ing through the source of dovecot and the plugins to find some answer, but without luck. Attached is the full source to my plugin and the Makefile (adapted from Johannes Berg's antispam plugin Makefile) When finished, I will be happy to release this to the dovecot community under the GPL/LGPL or whatever. Regards Chris

3 10

[Dovecot] v2.0.1 released
by Timo Sirainen 24 Aug '10

24 Aug '10

http://dovecot.org/releases/2.0/dovecot-2.0.1.tar.gz http://dovecot.org/releases/2.0/dovecot-2.0.1.tar.gz.sig Some small fixes mainly, but since people aren't reporting much bugs for v2.0.0 anymore maybe v2.0.1 release will change that. :) Some of the more important changes since v2.0.0 are: * When dsync is started as root, remote dsync command is now also executed as root instead of with dropped privileges. - IMAP: QRESYNC parameters for SELECT weren't handled correctly. - UTF-8 string validity checking wasn't done correctly (e.g. mailbox names in Sieve fileinto) - dsync: Fixed a random assert-crash with remote dsyncing

1 0

[Dovecot] Live Mirror dovecot / OS X 10.6.4
by Eric Boltz (MMI/UPC) 24 Aug '10

24 Aug '10

I want to set up mirrored postfix/dovecot servers using two mac mini servers (OSX 10.6.4) located in different locations (Canada and the US to be specific) for redundancy. The idea is to have one as the primary MX ("mail.corp.com") and the other as the secondary ("webmail.corp.com"). If the primary goes down clients would revert to webmail until the primary is back up. The plan is to use rsync for this. My challenge, however, is what all I need to rsync to have a "live" backup. Rsync for backup isn't an issue, but I will need to rsync users (system and virtual). Anyone have experience with this? So far it seems that apple puts things in lots of non-standard locations. I suppose I could to a blanket rsync on /var, but that seems a bit much. Thanks in advance.

2 1

[Dovecot] Fully kerberized mail system
by Dr Matthew Williams 24 Aug '10

24 Aug '10

Hello, Is it possible to use Dovecot in a fully kerberized mail system? We have configured authentication via kerberos, now we would like the imap deamon to access a kerberized nfs file system. Has any one any experiences? Regards, Matthew. -- Dr Matthew Williams MEng PhD MBCS Systems Administrator - IT Services - Bangor University Prifysgol Bangor Tel: (44) (0)1248 382414 Adeilad Deiniol Mob: (44) (0)7979 778269 Ffordd Deiniol URL: www.bangor.ac.uk Bangor, Gwynedd LL57 2UX EMail: matthew.williams(a)bangor.ac.uk

2 1

[Dovecot] Messages causing an error from Solr.
by Erik Hetzner 23 Aug '10

23 Aug '10

Hi, I am trying to use the fts_solr plugin, and having some success. Unfortunately some spam messages I had lying around generate an error from Solr, e.g.: HTTP/1.1 400 ParseError at [row,col]:[5,29] Message: An invalid XML character (Unicode: 0xd84e) was found in the element content of the document. While I assume that these messages do indeed contain bad unicode, my searches seem to hang when they get an error back from Solr, causing other problems, so it would be nice if these messages did not cause an error from Solr. I isolated some of these messages and have attached them. I hope that the problematic characters come through properly. I have more messages that cause this problem (sometimes with difference unicode codepoints than the one in the message above), but I don’t want to clog the list up. Thank you for your help. best, Erik Hetzner Config: # 1.2.13: /etc/dovecot/dovecot.conf # OS: Linux 2.6.32-23-generic i686 Ubuntu 10.04.1 LTS log_timestamp: %Y-%m-%d %H:%M:%S protocols: imaps login_dir: /usr/local/stow/dovecot-1.2.13/var/run/dovecot/login login_executable: /usr/local/stow/dovecot-1.2.13/libexec/dovecot/imap-login mail_privileged_group: mail mail_plugins: virtual fts fts_solr namespace: type: private separator: / location: maildir:~/Maildir inbox: yes list: yes subscriptions: yes namespace: type: private separator: / prefix: virtual/ location: virtual:~/Maildir_virtual:LAYOUT=maildir++ list: yes subscriptions: yes auth default: passdb: driver: pam userdb: driver: passwd plugin: fts: solr fts_solr: url=http://localhost:8080/solr/ break-imap-search debug

2 6

[Dovecot] PATCH: SQL connect crash
by Leandro Santi 23 Aug '10

23 Aug '10

Hi! Dovecot 2.0.0 auth process seems to crash while attempting to connect to a nonexistent SQL database. A shallow look at the code reveals that NULL module->conn in passdb-sql.c is being erroneously dereferenced while trying to clean up after a failed connection attempt: (gdb) bt #0 0x0806240e in sql_query_callback (result=0x8076c40, sql_request=0x808ff90) at passdb-sql.c:70 #1 0x08069b66 in sqlpool_request_abort (_request=<value optimized out>) at driver-sqlpool.c:114 #2 0x0806ab2a in driver_sqlpool_deinit (_db=0x808b970) at driver-sqlpool.c:448 #3 0x0806970a in sql_deinit (_db=0x808b5bc) at sql-api.c:87 #4 0x0805a3ac in db_sql_unref (_conn=0x807fc60) at db-sql.c:119 #5 0x08062be2 in userdb_deinit (userdb=0x807fc48) at userdb.c:177 #6 0x0804ff4b in auths_deinit () at auth.c:213 #7 0x0805b7bc in main (argc=1474660693, argv=0xec835356) at main.c:160 gdb) print ((struct sql_passdb_module *) _module)->conn $20 = (struct sql_connection *) 0x0 It seems that module->conn for passdb is being zeroed at auth_deinit(), passdb_deinit() completes succesfully but then userdb_deinit() does the illegal access. The following hack seems to eliminate the symptom, however I'd strongly recommend to take a deeper look at the issue. I suspect that a higher level fix would be more appropriate. --- dovecot-2.0.rc6.orig/src/auth/passdb-sql.c 2010-07-21 14:13:29.000000000 +0000 +++ dovecot-2.0.rc6.patched/src/auth/passdb-sql.c 2010-08-18 21:07:05.000000000 +0000 @@ -67,7 +67,7 @@ ret = sql_result_next_row(result); if (ret < 0) { - if (!module->conn->default_password_query) { + if (!module->conn || !module->conn->default_password_query) { auth_request_log_error(auth_request, "sql", "Password query failed: %s", sql_result_get_error(result)); Leandro

2 2

[Dovecot] Authentication woes - Couldn't drop privileges: Mail access not allowed for root
by Ralph Seichter 23 Aug '10

23 Aug '10

I'm currently trying to set up a Dovecot 2.0.0 server for backup purposes. There's an existing server which I successfully migrated to Dovecot 2.0.0, and it uses LDAP for authentication. For the backup server, which will not be exposed to users, I tried both PAM and PASSWD authentication, but all I are syslog entries like these: dovecot: imap-login: Login: user=<foo>, method=PLAIN, rip=[...], lip=[...], mpid=20059, TLS dovecot: imap(foo): Error: user foo: Couldn't drop privileges: Mail access not allowed for root dovecot: imap(foo): Error: Internal error occurred. Refer to server log for more information. Here is my current configuration: # doveconf -n # 2.0.0: /usr/local/dovecot-2.0/etc/dovecot/dovecot.conf # OS: Linux 2.6.35-gentoo-r1-v3 x86_64 Gentoo Base System release 2.0.1 auth_mechanisms = plain login base_dir = /var/run/dovecot/ listen = * mail_location = maildir:~/.maildir passdb { args = scheme=crypt /usr/local/dovecot-2.0/etc/dovecot/passwd driver = passwd-file } protocols = imap ssl_cert = </usr/local/dovecot-2.0/etc/dovecot/server.crt ssl_key = </usr/local/dovecot-2.0/etc/dovecot/server.key The password file contents: # cat /usr/local/dovecot-2.0/etc/dovecot/passwd foo:{CRYPT}xxx:1000:1000:Foo Backup:/home/foo:/bin/bash I searched the Dovecot Wiki and also tried MARC and Google, but I can't seem to find a solution for this problem. Could you please point me in the right direction? I have probably missed something. Thanks! -Ralph

2 5

[Dovecot] Dovecot 2.0 and BSDI 4.X
by The Doctor 23 Aug '10

23 Aug '10

All right, I am trying to migrating to 2.0 but running into problems. from my typescript: Script started on Wed Aug 18 23:24:58 2010 doctor.nl2k.ab.ca//usr/home/doctor$ tail -f /var/log/maillog | egrep dovecot Aug 18 23:25:31 doctor dovecot: master: Dovecot v2.0.0 starting up (core dumps disabled) Aug 18 23:25:31 doctor dovecot: log: Error: net_accept() failed: Invalid argument Aug 18 23:25:31 doctor dovecot: master: Warning: service(anvil): process_limit reached, client connections are being dropped quit ^C doctor.nl2k.ab.ca//usr/home/doctor$ /usr/doc veo cot/sbin/dovecot -n # 2.0.0: /usr/dovecot/etc/dovecot/dovecot.conf # OS: BSD/OS 4.3 i386 auth_cache_negative_ttl = 3600 s base_dir = /var/run/dovecot/ disable_plaintext_auth = no first_valid_uid = 100 listen = * login_log_format_elements = user=<%u> method=%m rip=%r lip=%l %c mail_debug = yes mail_location = mbox:~/mail:INBOX=/var/mail/%u mail_log_prefix = %Us(%u): mdbox_rotate_size = 2048 passdb { args = /etc/master.passwd driver = passwd-file } protocols = pop3 imap service auth { executable = /usr/dovecot/libexec/dovecot/auth user = root vsz_limit = 256 } service imap-login { chroot = login client_limit = 256 executable = /usr/dovecot/libexec/dovecot/imap-login inet_listener imaps { address = 204.209.81.1 } process_limit = 128 process_min_avail = 3 service_count = 1 user = dovecot vsz_limit = 64 } service imap { executable = /usr/dovecot/libexec/dovecot/imap process_limit = 512 vsz_limit = 256 } service pop3-login { chroot = login client_limit = 256 executable = /usr/dovecot/libexec/dovecot/pop3-login inet_listener pop3s { address = 204.209.81.1 } process_limit = 128 process_min_avail = 3 service_count = 1 user = dovecot vsz_limit = 64 } service pop3 { executable = /usr/dovecot/libexec/dovecot/pop3 process_limit = 512 vsz_limit = 256 } ssl_cert = </etc/ssl/certs/dovecot.pem ssl_cipher_list = ALL:!LOW:!SSLv2 ssl_key = </etc/ssl/private/dovecot.pem userdb { driver = passwd } userdb { args = /etc/passwd driver = passwd-file } protocol imap { imap_client_workarounds = delay-newmail tb-extra-mailbox-sep imap_idle_notify_interval = 120 s imap_logout_format = bytes=%i/%o imap_max_line_length = 65536 mail_max_userip_connections = 10 mail_plugin_dir = /usr/dovecot/lib/dovecot/imap } protocol pop3 { mail_max_userip_connections = 3 mail_plugin_dir = /usr/dovecot/lib/dovecot/pop3 pop3_enable_last = no pop3_lock_session = no pop3_logout_format = top=%t/%p, retr=%r/%b, del=%d/%m, size=%s pop3_no_flag_updates = no pop3_reuse_xuidl = no pop3_save_uidl = no pop3_uidl_format = %08Xu%08Xv } You have new mail in /var/mail/doctor doctor.nl2k.ab.ca//usr/home/doctor$ exit exit Script done on Wed Aug 18 23:26:07 2010 telneting into the ports work, but the clients seem to stuck in an infinite loop. -- Member - Liberal International This is doctor(a)nl2k.ab.ca Ici doctor(a)nl2k.ab.ca God, Queen and country! Never Satan President Republic! Beware AntiChrist rising! http://twitter.com/rootnl2k http://www.facebook.com/dyadallee Australia!! Vote to throw the REpublicans to the sharks!

5 10

[Dovecot] Over-quota bounces seeming to lack sender
by Dave Brenner 23 Aug '10

23 Aug '10

We're seeing an issue with 1.2.12 where over-quota rejection messages are appearing in the logs with <> as the sender. The sender of the original message sees the appropriate sender (postmaster@) on the rejection, but as the message makes its way through the postfix/amavis chain, I can see that the sender address is missing. Aug 20 10:55:56 inet1 amavis[21822]: [ID 702911 mail.info] (21822-05) Checking: rGDWxOHFPBdY <> -> <xxxx(a)toledotel.com> Aug 20 03:12:39 inet1 amavis[9724]: [ID 702911 mail.info] (09724-37) skip local delivery(3): <> -> <bad-header-quarantine> Aug 19 10:15:47 2010 (1570) xxxxxxxx-users: bounce message w/no discernable addresses: <dovecot-1282238146-79394-0@inet1> (that last one is from Mailman logs) Has anyone else run into this? -- Dave Brenner - david(a)toledotel.com The Toledo Telephone Company, Inc.

2 1

[Dovecot] imap, imaps, ports; config for secure-only service
by Ronald Leach 23 Aug '10

23 Aug '10

Hello, having difficulty setting up a 'secure-only' service on a non-standard port. Objective is to open a secure Dovecot service on an internet-visible port, while also using an insecure service for hosts on an internal network (so that one particular client which is not SSL/TLS-capable can continue to use the service). Checking wiki1 and wiki2, I think that port 143 can be used for a service in both encrypted and unencrypted operations. (Wiki2 describes how port 143 can be used with or without STARTTLS.) I've managed to run both TB/Vista, and KMail/Debian on 143 from local machines, and they seem to work fine. (Though they do only work if the clients are set to use 'unencrypted logins' such as KMail's 'clear text' setting, and TB's 'don't use secure authentication'.) Dovecot's SSL certificate on the server expires in 2028. But I cannot get my 'secure-only service' working at all. I've chosen port 10943 for that service, and have been testing from both KMail on the server, and TB/Vista on another local machine. Here's the config: protocol imap { # inet users, and also users presented from offsite via an SSH tunnel, # will use IMAP (any capability) on 143. listen = *:143 # 143 will not be reachable from outside the internal network (except # via an SSH tunnel) # # External users will be allowed only to use port 10943 (as forwarded # from the gateway), and will have to use SSL ssl_listen = *:10943 } Other settings include: #other settings protocols = imap imaps disable_plaintext_auth = no ssl_disable = no ssl_cert_file = /etc/ssl/certs/dovecot.pem ssl_key_file = /etc/ssl/private/dovecot.pem ssl_verify_client_cert = no ssl_cipher_list = ALL:!LOW ssl_require_client_cert = no ssl_username_from_cert = no mail_location = maildir:~/Maildir #log and debug settings mail_debug = yes auth_debug = yes Log from a successful session on port 143: Logs (using port 143, KMail on the server) 14:43:22 auth(default): client in: AUTH^I1^IPLAIN^Iservice=IMAP^Isecured^Ilip=127.0.0.1^Irip=127.0.0.1^Iresp=<hidden> 14:43:22 auth(default): client out: OK^I1^Iuser=ron 14:43:22 auth(default): master in: REQUEST^I1^I4057^I1 14:43:22 auth(default): master out: USER^I1^Iron^Isystem_user=ron^Iuid=1001^Igid=1001^Ihome=/home/ron 14:43:22 IMAP(ron): Effective uid=1001, gid=1001 14:43:22 IMAP(ron): maildir: data=/home/ron/Maildir 14:43:22 IMAP(ron): maildir: root=/home/ron/Maildir, index=/home/ron/Maildir, control=, inbox= 14:43:22 imap-login: Login: user=<ron>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, TLS Unsuccessful session Logs (using 10943, KMail on the server) - absolutely no sign of any authentication, and the client reports a timeout. 17:03:30 imap-login: Disconnected: Inactivity: rip=127.0.0.1, lip=127.0.0.1, TLS handshake 17:04:06 imap-login: Disconnected: rip=127.0.0.1, lip=127.0.0.1, TLS handshake 17:05:08 imap-login: Disconnected: Inactivity: rip=127.0.0.1, lip=127.0.0.1, TLS handshake 143 works fine, so Dovecot is (of course) perfectly good at managing the auth and service, so I must have something wrong in the config. I cannot see it. Could anyone share a config they've used for *secure-only* IMAP service on an internet-visible port? I'd like to compare the settings. regards, Ron

4 3