- dovecot - dovecot.org

[Dovecot] Correct folder permissions for maildir....
by Donovan J. Edye 06 Jul '10

06 Jul '10

G'Day, I am trying to find a definitive answer to what the directory permissions should be for my configuration under Centos 5.5. I see a number of the following error messages in the maillog as a consequence of permissions errors. After reading the FAQ, Wiki etc. and browsing the web I am unable to determine just exactly what the user security settings should be for the offending folders. If anyone could point me in the right direction I would appreciate it. Should you require additional diagnostic information let me know and I will source it. The error messages: Jun 17 19:50:14 moe dovecot: POP3(carolyn.spyseebiz): mkdir_parents(/home/spyseebiz/homes/carolyn/mail/.imap/INBOX) failed: Permission denied Jun 17 19:53:09 moe dovecot: POP3(marnie.capitel): mkdir_parents(/home/capitel/homes/marnie/mail/.imap/INBOX) failed: Permission denied dovecot -n # 1.0.7: /etc/dovecot.conf protocols: imap pop3 imaps pop3s listen: 116.212.71.194 ssl_listen: 116.212.71.194 login_dir: /var/run/dovecot/login login_executable(default): /usr/libexec/dovecot/imap-login login_executable(imap): /usr/libexec/dovecot/imap-login login_executable(pop3): /usr/libexec/dovecot/pop3-login mail_location: mbox:~/mail/:INBOX=/var/mail/%u mail_executable(default): /usr/libexec/dovecot/imap mail_executable(imap): /usr/libexec/dovecot/imap mail_executable(pop3): /usr/libexec/dovecot/pop3 mail_plugin_dir(default): /usr/lib/dovecot/imap mail_plugin_dir(imap): /usr/lib/dovecot/imap mail_plugin_dir(pop3): /usr/lib/dovecot/pop3 pop3_uidl_format(default): %08Xu%08Xv pop3_uidl_format(imap): %08Xu%08Xv pop3_uidl_format(pop3): %v.%u namespace: type: private separator: / prefix: #mbox/ location: mbox:~/mail:INBOX=/var/mail/%u inbox: yes hidden: yes namespace: type: private separator: / location: maildir:~/Maildir auth default: passdb: driver: pam userdb: driver: passwd ps aux | grep dovecot root 3457 0.0 0.0 1880 508 ? Ss Jun13 0:20 /usr/sbin/dovecot root 5650 0.0 0.1 7952 1460 ? S 03:28 0:04 dovecot-auth dovecot 15591 0.0 0.1 4992 1760 ? S 19:26 0:00 imap-login dovecot 15598 0.0 0.1 4992 1752 ? S 19:26 0:00 imap-login dovecot 15627 0.0 0.1 4992 1508 ? S 19:26 0:00 imap-login dovecot 16596 0.0 0.1 4988 1748 ? S 19:45 0:00 pop3-login dovecot 16615 0.0 0.1 4988 1744 ? S 19:46 0:00 pop3-login dovecot 16720 0.2 0.1 4988 1500 ? S 19:47 0:00 pop3-login root 16726 0.0 0.0 4000 700 pts/0 S+ 19:48 0:00 grep dovecot -- --Donovan J. Edye Calico Communications - "All your marketing, communication & web needs." Home To: daisyndandelion.com.au, natiki.com.au, themarketingcoach.com.au w: calicom.com.au t: +61-2-6292-1573 f: +61-2-6292-1592 p: PO Box 165, Erindale Centre, ACT 2903, Australia

4 6

[Dovecot] Dovecot 2.0 beta4 and Expire Plugin
by Burckhard Schmidt 06 Jul '10

06 Jul '10

Hello, there seems to be an error writing into the expire database defined by dict. dict { expire = sqlite:/usr/dovecot/etc/dovecotbeta-dict-expire.conf } ... plugin { ... expire = AutoCleanSpam 1d expire_dict = proxy::expire } with dovecotbeta-dict-expire.conf: connect = /test/addons/expire/expiresbeta.db map { pattern = shared/expire/$user/$mailbox table = expires value_field = expire_stamp fields { username = $user mailbox = $mailbox } } sqlite shows schema: CREATE TABLE expires ( username varchar(100) not null, mailbox varchar(255) not null, expire_stamp integer not null, primary key (username, mailbox) ); CREATE TRIGGER mergeexpires BEFORE INSERT ON expires FOR EACH ROW BEGIN UPDATE expires SET expire_stamp=NEW.expire_stamp WHERE username = NEW.username AND mailbox = NEW.mailbox; SELECT raise(ignore) WHERE (SELECT 1 FROM expires WHERE username = NEW.username AND mailbox = NEW.mailbox) IS NOT NULL; END; Delivering of an email into folder AutoCleanSpam via sieve script works fine. error-log: Apr 08 12:57:05 lda(account1): Debug: sieve: executing compiled script /addons/sieve/account1.sieve Apr 08 12:57:05 lda(account1): Debug: expire: Mails expire in 86400 secs in mailbox: AutoCleanSpam Apr 08 12:57:05 dict: Error: sqlite: exec(INSERT INTO expires (expire_stamp,username,mailbox) VALUES ('1270810625','account1','AutoCleanSpam')) failed: unable to open database file (14) Apr 08 12:57:05 master: Error: service(dict): child 10936 killed with signal 11 (core not dumped - set drop_priv_before_exec=yes) Apr 08 12:57:05 master: Error: service(dict): command startup failed, throttling deliver-log: Apr 08 12:57:05 lda(account1): Error: read(/var/run/dovecot//dict) failed: Remote disconnected Apr 08 12:57:05 lda(account1): Info: sieve: msgid=<4BBDB681.10003(a)hu-berlin.de>: stored mail into mailbox 'AutoCleanSpam' If I use a non existing database filename in dovecotbeta-dict-expire.conf like connect = /test/addons/expire/expiresbeta.dbbbbb I see in the log dict: Error: sqlite: open(/test/addons/expire/expiresbeta.dbbbbb) failed: unable to open database file So I'm sure, having the rigth config file. Moreover how to start expire-tool now? dovecot --exec-mail ... is no more valid. Additional: /usr/dovecotbeta/sbin/dovecot --build-options Build options: ioloop=poll ipv6 openssl Mail storages: cydir dbox maildir mbox mdbox raw shared SQL drivers: sqlite Passdb: checkpassword ldap pam passwd passwd-file shadow sql Userdb: checkpassword ldap passwd prefetch passwd-file sql static /usr/dovecotbeta/sbin/dovecot -n # 2.0.beta4: /usr/dovecotbeta/etc/dovecot/dovecot.conf # OS: SunOS 5.9 sun4u auth_debug = yes auth_username_chars = abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ012345 67890 auth_verbose = yes base_dir = /var/run/dovecot/ debug_log_path = /var/log/dovecot-error default_client_limit = 6144 dict { expire = sqlite:/usr/dovecot/etc/dovecotbeta-dict-expire.conf } first_valid_gid = 20 first_valid_uid = 20 info_log_path = /var/log/dovecot-error listen = 172.19.5.17 log_path = /var/log/dovecot-error mail_access_groups = sysdov mail_debug = yes mail_gid = sysdov mail_location = dbox:%h:INDEX=/addons/index/%u:CONTROL=~/Control:LAYOUT=fs mail_privileged_group = sysdov mail_uid = sysdov mbox_write_locks = fcntl passdb { args = dovecot driver = pam } plugin { autocreate = AutoCleanSpam autocreate1 = Junk autocreate2 = Trash autocreate3 = Sent autocreate4 = Drafts autosubscribe = AutoCleanSpam autosubscribe1 = Junk autosubscribe2 = Trash autosubscribe3 = Sent autosubscribe4 = Drafts expire = AutoCleanSpam 1d expire_dict = proxy::expire sieve = /addons/sieve/%u.sieve } service pop3 { process_limit = 0 } ssl_cert = </opt/csw/etc/ssl/certs/mail.pem ssl_key = </opt/csw/ssl/priv/mail.key syslog_facility = local2 userdb { args = /usr/dovecot/etc/sybldap.conf driver = ldap } verbose_proctitle = yes protocol imap { log_path = /var/log/imap.log mail_plugin_dir = /usr/dovecotbeta/lib/dovecot mail_plugins = autocreate expire } protocol lda { auth_socket_path = /var/run/dovecot/auth-master info_log_path = /var/log/deliver.log log_path = /var/log/deliver.log mail_plugin_dir = /usr/dovecotbeta/lib/dovecot mail_plugins = sieve autocreate expire postmaster_address = postmaster(a)hu-berlin.de sendmail_path = /opt/csw/sbin/sendmail } -- Burckhard Schmidt

2 6

[Dovecot] ACL, forced INBOX subscription
by Matthias Rieber 06 Jul '10

06 Jul '10

Hi, I've two accounts 'matthias' and 'mailverwalter'. Mailverwalter want's to share the Spam folder: This is the situation in the beginning: (matthias) a LIST (SUBSCRIBED) "common." "*" a OK List completed. a LIST (SUBSCRIBED) "common.mailverwalter" "*" a OK List completed. (mailverwalter) a GETACL Spam * ACL "Spam" "mailverwalter" lrwstipekxacd a OK Getacl completed. a GETACL INBOX * ACL "INBOX" "mailverwalter" lrwstipekxacd a OK Getacl completed. So far so good. Mailverwalter sets the list permission: (mailverwalter) a SETACL "Spam" "matthias" l a OK Setacl complete. a GETACL "Spam" * ACL "Spam" "matthias" l "mailverwalter" lrwstipekxacd a OK Getacl completed. a GETACL "INBOX" * ACL "INBOX" "mailverwalter" lrwstipekxacd a OK Getacl completed. That's ok as well and I want to make sure that the INBOX doesn't have any other permission. After that, some listing: (matthias) a LIST (SUBSCRIBED) "common." "*" a OK List completed. a LIST (SUBSCRIBED) "common.mailverwalter." "*" a OK List completed. That's also ok, nothing subscribed. (matthias) a LIST "common.mailverwalter." "*" * LIST (\Noselect \HasChildren) "." "common.mailverwalter" * LIST (\HasNoChildren) "." "common.mailverwalter.Spam" a OK List completed. This normal folder listing seems to be ok, too, and then listing of the subcribed folders again: (matthias) a LIST (SUBSCRIBED) "common.mailverwalter." "*" * LIST (\Subscribed \NonExistent) "." "common.mailverwalter.INBOX" a OK List completed. And then, the INBOX is subscribed and \NonExistent because I don't have permissions on it. The folder stays subscribed as long as I'm connected to the server. When I disconnect and do the LIST (SUBSCRIBED) again, the folder is not subscribed as long I do not 'normal' list it. Happens with dovecot 1.2.11, haven't tried 2.0 yet. I assume that's not the intended behaviour. This INBOX folder confuses the Nokia n900 email client a lot, but it doesn't matter if it can be accessed or not. Regards, Matthias

2 4

[Dovecot] SLES9: compile pigeonhole failed
by Andreas Schulze 06 Jul '10

06 Jul '10

Hello, I try to compile pigeonhole ( hg clone from yesterday ) on SLES9 I get the following error: ---- snip cd dovecot-2.0-pigeonhole ./autogen.sh configure.in:17: option `tar-ustar' not recognized autoreconf: automake failed with exit status: 1 --- snap automake-1.8.3 autoconf-2.59 I found something similar here: http://osdir.com/ml/science.robotics.orocos.devel/2006-03/msg00029.html "It seems this option (tar-ustar) is automake 1.9 only" Is the a workaround or something I can patch ? Thanks, Andreas -- Andreas Schulze Internetdienste | P532 DATEV eG 90329 Nürnberg | Telefon +49 911 319-0 | Telefax +49 911 319-3196 E-Mail info @datev.de | Internet www.datev.de Sitz: 90429 Nürnberg, Paumgartnerstr. 6-14 | Registergericht Nürnberg, GenReg Nr.70 Vorstand Prof. Dieter Kempf (Vorsitzender) Dipl.-Kfm. Wolfgang Stegmann (stellvertretender Vorsitzender) Dipl.-Kfm. Michael Leistenschneider Jörg Rabe v. Pappenheim Dipl.-Vw. Eckhard Schwarzer Vorsitzender des Aufsichtsrates: Reinhard Verholen

1 0

[Dovecot] Jul 06 13:00:50 dovecot: Warning: I/O leak: 806ef10 (36)
by Dennis Clarke 06 Jul '10

06 Jul '10

I'm currently fighting my way through the dovecot configuration pages and endless options to see if I can just get my mail from the server. Thus far no joy but dovecot seems to be working if I could figure out the configuration. My process thus far has been : 1) read docs 2) try a config change 3) fail 4) goto (1) I just saw an error while trying to read my /var/mail/dclarke good 'ol mbox in the message.log : Jul 06 12:58:50 IMAP(dclarke): Error: mbox root directory can't be a file: /var/mail/dclarke/ (http://wiki.dovecot.org/MailLocation/Mbox) So I figure I better go read that page again and see what I did wrong this time. I guess this is wrong : mail_location: mbox:/var/mail/%u Even though that is where the mail actually is : # ls -lap /var/mail total 34 drwxrwxrwt 3 root mail 6 Jul 6 02:19 ./ drwxr-xr-x 47 root sys 47 May 30 02:52 ../ drwxrwxr-x 2 root mail 2 May 29 23:47 :saved/ -rw-rw---- 1 dclarke mail 0 Jul 5 16:01 dclarke -rw-rw---- 1 lucone mail 657 Jul 2 17:55 lucone -rw-rw---- 1 root mail 8705 Jul 2 05:40 root # I shutdown the dovecot service on Solaris via svcadm and saw this in the error log : Jul 06 13:00:50 dovecot: Warning: I/O leak: 806ef10 (36) Jul 06 13:00:50 dovecot: Warning: I/O leak: 806ef10 (30) Jul 06 13:00:50 dovecot: Warning: I/O leak: 806ef10 (26) Jul 06 13:00:50 dovecot: Warning: I/O leak: 806ef10 (24) I'm not too sure what that means but it doesn't look good. Here is some info : # /opt/csw/sbin/dovecot -n # 1.2.12: /etc/opt/csw/dovecot/dovecot.conf Warning: fd limit 256 is lower than what Dovecot can use under full load (more than 640). Either grow the limit or change login_max_processes_count and max_mail_processes settings # OS: SunOS 5.10 i86pc zfs base_dir: /var/opt/csw/dovecot/ log_path: /var/opt/csw/dovecot/error.log info_log_path: /var/opt/csw/dovecot/message.log protocols: imap pop3 imaps pop3s ssl: required ssl_cert_file: /etc/opt/csw/dovecot/certs/dovecot.pem ssl_key_file: /etc/opt/csw/dovecot/private/dovecot.pem ssl_cipher_list: ALL:!LOW:!SSLv2 verbose_ssl: yes login_dir: /var/opt/csw/dovecot//login login_executable(default): /opt/csw/libexec/dovecot/imap-login login_executable(imap): /opt/csw/libexec/dovecot/imap-login login_executable(pop3): /opt/csw/libexec/dovecot/pop3-login login_greeting: Dovecot from Blastwave.org is ready. login_max_processes_count: 64 verbose_proctitle: yes mail_location: mbox:/var/mail/%u mail_debug: yes mail_executable(default): /opt/csw/libexec/dovecot/imap mail_executable(imap): /opt/csw/libexec/dovecot/imap mail_executable(pop3): /opt/csw/libexec/dovecot/pop3 mail_plugin_dir(default): /opt/csw/lib/dovecot/imap mail_plugin_dir(imap): /opt/csw/lib/dovecot/imap mail_plugin_dir(pop3): /opt/csw/lib/dovecot/pop3 auth default: passdb: driver: pam userdb: driver: passwd Any thoughts before I enter the infinite loop noted at the top of this message ? :-) -- Dennis

2 2

[Dovecot] Multiple authentication backends
by Wouter van der Schagt 06 Jul '10

06 Jul '10

Good morning, I have a question. Currently we are using Dovecot to handle our pop3, pop3s, imap and imaps connections. Our virtual domain management backend is vpopmail. Which works beautifully. Our current setup requires users to login with their email address and password (user@domain). We are now looking at migrating another server to our environment where users are logging in with their username only. This is because unlike virtual users these mailboxes have corresponding system users on the server. Ideally we would like to migration for the end user as easy as possible without requiring them to make changes to their settings. Is it possible to configure Dovecot to handle multiple authentication back-ends or do any of you have found a solution to a similar problem before? Sincerely, - Wouter van der Schagt

2 1

[Dovecot] doveadm stop
by Andreas Schulze 06 Jul '10

06 Jul '10

hello I start dovecot via daemontools and use "dovecot -F". "doveadm stop" does correctly stop dovecot. Of course dovecot will restart not a second later. Is it possible, that "doveadm stop" detect that dovecot is started with -F an print an informational log ? I think, it's helpfull, because in this special setup "doveadm stop" can and will not do what the the user expects from the name. -- Andreas Schulze Internetdienste | P532 DATEV eG 90329 Nürnberg | Telefon +49 911 319-0 | Telefax +49 911 319-3196 E-Mail info @datev.de | Internet www.datev.de Sitz: 90429 Nürnberg, Paumgartnerstr. 6-14 | Registergericht Nürnberg, GenReg Nr.70 Vorstand Prof. Dieter Kempf (Vorsitzender) Dipl.-Kfm. Wolfgang Stegmann (stellvertretender Vorsitzender) Dipl.-Kfm. Michael Leistenschneider Jörg Rabe v. Pappenheim Dipl.-Vw. Eckhard Schwarzer Vorsitzender des Aufsichtsrates: Reinhard Verholen

2 1

Re: [Dovecot] Jul 06 00:06:15 dict: Error: dict client: Broken handshake
by Dennis Clarke 06 Jul '10

06 Jul '10

> > On 6.7.2010, at 1.15, Dennis Clarke wrote: > >> base_dir: /var/opt/csw/dovecot/ >> login_dir: /var/opt/csw/dovecot > > These must not be the same. Just use the default for login_dir, it > defaults under base_dir. (I thought I already added a check against this > .. oh well, v2.0 won't let you specify login_dir at all anymore.) > fixed ! awesome software ... now I'll test this in a production machine and see how things go :-) -- Dennis

1 0

[Dovecot] Jul 06 00:06:15 dict: Error: dict client: Broken handshake
by Dennis Clarke 06 Jul '10

06 Jul '10

After building and install dovecot I then made my own self signed SSL certs and placed them carefully into the correct places : Thus : # grep -v "^#" dovecot-openssl.cnf | grep -v "^$" [ req ] default_bits = 1024 encrypt_key = yes distinguished_name = req_dn x509_extensions = cert_type prompt = no [ req_dn ] C=CA ST=Ontario L=Toronto O=Blastwave OU=IMAP server CN=titan.blastwave.org emailAddress=postmaster(a)blastwave.org [ cert_type ] nsCertType = server # /opt/csw/bin/openssl req -new -x509 -nodes -config ./dovecot-openssl.cnf -out /etc/opt/csw/dovecot/certs/dovecot.pem -keyout /etc/opt/csw/dovecot/private/dovecot.pem -days 365 Generating a 1024 bit RSA private key ...........................++++++ ....................++++++ writing new private key to '/etc/opt/csw/dovecot/private/dovecot.pem' ----- # ls -l /etc/opt/csw/dovecot/certs/dovecot.pem /etc/opt/csw/dovecot/private/dovecot.pem -rw-r--r-- 1 root other 1050 Jul 5 23:58 /etc/opt/csw/dovecot/certs/dovecot.pem -rw-r--r-- 1 root other 887 Jul 5 23:58 /etc/opt/csw/dovecot/private/dovecot.pem # I then checked things out with a dovecot -n : # /opt/csw/sbin/dovecot -n # 1.2.12: /etc/opt/csw/dovecot/dovecot.conf Warning: fd limit 256 is lower than what Dovecot can use under full load (more than 576). Either grow the limit or change login_max_processes_count and max_mail_processes settings # OS: SunOS 5.8 i86pc base_dir: /var/opt/csw/dovecot/ log_path: /var/opt/csw/dovecot/error.log info_log_path: /var/opt/csw/dovecot/message.log ssl_cert_file: /etc/opt/csw/dovecot/certs/dovecot.pem ssl_key_file: /etc/opt/csw/dovecot/private/dovecot.pem login_dir: /var/opt/csw/dovecot login_executable: /opt/csw/libexec/dovecot/imap-login login_greeting: Dovecot from Blastwave.org is ready. login_max_processes_count: 64 mail_location: mbox:%h/mail:INBOX=/var/mail/%u auth default: passdb: driver: pam userdb: driver: passwd Other than the warning it looks ready to run. I fire up the init script : # /etc/opt/csw/init.d/cswdovecot start dovecot service starting. ps -ef confirms that things are happening : # ps -ef UID PID PPID C STIME TTY TIME CMD root 0 0 0 Jun 15 ? 0:16 sched root 1 0 0 Jun 15 ? 0:24 /etc/init - root 2 0 0 Jun 15 ? 0:00 pageout root 3 0 0 Jun 15 ? 10:37 fsflush root 331 1 0 Jun 15 ? 0:00 /usr/lib/saf/sac -t 300 root 334 331 0 Jun 15 ? 0:00 /usr/lib/saf/ttymon root 153 1 0 Jun 15 ? 0:00 /usr/sbin/rpcbind root 392 196 0 Jun 16 ? 0:00 in.telnetd root 75 1 0 Jun 15 ? 0:00 /usr/lib/sysevent/syseventd root 149 1 0 Jun 15 ? 0:43 /usr/lib/ldap/ldap_cachemgr root 199 1 0 Jun 15 ? 0:00 /usr/lib/autofs/automountd root 156 1 0 Jun 15 ? 0:00 /usr/sbin/keyserv root 196 1 0 Jun 15 ? 0:00 /usr/sbin/inetd -s daemon 198 1 0 Jun 15 ? 0:00 /usr/lib/nfs/statd root 234 1 0 Jun 15 ? 0:08 /usr/lib/inet/xntpd root 226 1 0 Jun 15 ? 0:00 /usr/sbin/cron root 202 199 0 Jun 15 ? 0:42 /usr/lib/autofs/automountd root 194 1 0 Jun 15 ? 0:00 /usr/lib/nfs/lockd root 239 1 0 Jun 15 ? 0:00 /usr/lib/lpsched root 266 265 0 Jun 15 ? 0:00 /usr/sbin/cs00 root 251 1 0 Jun 15 ? 0:00 /usr/lib/power/powerd root 265 1 0 Jun 15 ? 0:00 /usr/sbin/cssd root 225 1 0 Jun 15 ? 0:00 /usr/sbin/syslogd root 267 1 0 Jun 15 ? 0:00 /usr/bin/fgd root 264 1 0 Jun 15 ? 0:00 /usr/lib/utmpd root 290 288 0 Jun 15 ? 0:00 htt_server -port 9010 -syslog -message_locale C root 275 1 0 Jun 15 ? 0:00 /usr/lib/locale/ja/wnn/dpkeyserv root 281 1 0 Jun 15 ? 0:00 /usr/lib/locale/ja/wnn/jserver root 282 281 0 Jun 15 ? 0:00 /usr/lib/locale/ja/wnn/jserver_m root 288 1 0 Jun 15 ? 0:00 /usr/lib/im/htt -port 9010 -syslog -message_locale C root 297 1 0 Jun 15 ? 0:00 /usr/lib/locale/ja/atokserver/atokmngdaemon root 320 317 0 Jun 15 ? 6:33 mibiisa -r -p 3200 root 5500 1 0 Jun 16 console 0:00 -sh root 317 1 0 Jun 15 ? 0:00 /usr/lib/snmp/snmpdx -y -c /etc/snmp/conf root 325 1 0 Jun 15 ? 0:00 /usr/lib/dmi/snmpXdmid -s titan root 324 1 0 Jun 15 ? 0:00 /usr/lib/dmi/dmispd root 11633 11624 0 00:02:40 ? 0:00 dovecot-auth -w root 11624 1 1 00:02:39 ? 0:00 /opt/csw/sbin/dovecot -c /etc/opt/csw/dovecot/dovecot.conf sysadmin 394 392 0 Jun 16 pts/1 0:09 -sh root 10182 5500 0 Jun 19 console 0:00 /opt/csw/bin/bash dclarke 10759 10717 0 18:02:33 pts/2 0:01 /opt/csw/bin/bash root 16188 16185 0 Jun 23 pts/3 0:01 -sh root 10713 10703 0 18:01:21 ? 0:02 /opt/csw/sbin/sshd -f /etc/opt/csw/ssh/sshd_config -R root 11626 11624 0 00:02:39 ? 0:00 dovecot-auth dovecot 11629 11624 2 00:02:40 ? 0:01 imap-login root 11635 16188 1 00:02:44 pts/3 0:00 ps -ef root 10703 1 0 17:56:08 ? 0:00 /opt/csw/sbin/sshd -f /etc/opt/csw/ssh/sshd_config root 11634 11624 0 00:02:40 ? 0:00 dovecot-auth -w dclarke 10717 10715 0 18:01:38 pts/2 0:00 -sh dovecot 11628 11624 2 00:02:40 ? 0:01 imap-login root 11631 11624 5 00:02:40 ? 0:02 dict dclarke 10715 10713 0 18:01:37 ? 0:14 /opt/csw/sbin/sshd -f /etc/opt/csw/ssh/sshd_config -R root 11627 11624 0 00:02:40 ? 0:00 dovecot-auth -w root 11625 11624 11 00:02:39 ? 0:05 ssl-build-param /var/opt/csw/dovecot/lib/dovecot/ssl-parameters.dat dovecot 11630 11624 2 00:02:40 ? 0:01 imap-login root 10175 1 0 Jun 19 ? 0:00 /opt/trustedhost/sbin/sshd -f /opt/trustedhost/etc/ssh/sshd_config root 11632 11624 0 00:02:40 ? 0:00 dovecot-auth -w I look in the area for logging and see : # ls -lap /var/opt/csw/dovecot/ total 7292 drwxr-x--- 3 root dovecot 512 Jul 6 00:02 ./ drwxr-xr-x 6 root bin 512 Jul 5 23:40 ../ srw------- 1 root other 0 Jul 6 00:02 auth-worker.11626 srw-rw---- 1 root dovecot 0 Jul 6 00:02 default srwxrwxrwx 1 root other 0 Jul 6 00:02 dict-server lrwxrwxrwx 1 root other 33 Jul 6 00:02 dovecot.conf -> /etc/opt/csw/dovecot/dovecot.conf -rw------- 1 root other 3720949 Jul 6 00:04 error.log drwxr-x--- 3 root other 512 Jul 6 00:02 lib/ -rw------- 1 root other 6 Jul 6 00:02 master.pid -rw------- 1 root other 171 Jul 6 00:02 message.log Why is there a symlink to the dovecot.conf I have no idea but far more intersting is the very large error.log. # tail -f /var/opt/csw/dovecot/error.log Jul 06 00:04:35 dict: Error: dict client: Broken handshake Jul 06 00:04:35 dict: Error: dict client: Broken handshake Jul 06 00:04:35 dict: Error: dict client: Broken handshake Jul 06 00:04:35 dict: Error: dict client: Broken handshake Jul 06 00:04:35 dict: Error: dict client: Broken handshake Jul 06 00:04:35 dict: Error: dict client: Broken handshake Jul 06 00:04:35 dict: Error: dict client: Broken handshake Jul 06 00:04:35 dict: Error: dict client: Broken handshake Jul 06 00:04:35 dict: Error: dict client: Broken handshake Jul 06 00:04:35 dict: Error: dict client: Broken handshake Jul 06 00:04:35 dict: Error: dict client: Broken handshake . . . many many lines. About 100,000 lines of that. The message.log looks innocent : # cat /var/opt/csw/dovecot/message.log Jul 06 00:02:39 dovecot: Info: Dovecot v1.2.12 starting up Jul 06 00:02:39 dovecot: Info: Generating Diffie-Hellman parameters for the first time. This may take a while.. What's up with that "Broken handshake" ?? -- Dennis

2 1

[Dovecot] NFS(4) IMAP Quota
by Martin Schanzenbach 05 Jul '10

05 Jul '10

Hi *, We use nfs4 in combination with dovecot. Also (hard)quotas are used on the exports. Using the dovecot quota fs plugin things did not work at all. There were a few issues we encountered: 1. Nfs4 is not recognized. The problem is that the mount type is only checked for "nfs" and not nfs4. This was an easy fix. 2. The (fs)path for nfs4 that is relayed to rquotad has to be without the leading "/". This was an easy fix, too. (borrowed from linuxquota: http://linuxquota.cvs.sourceforge.net/viewvc/linuxquota/quota-tools/rquota_… ) 3. Maybe because we do not use softquotas the quota active boolean (rq_active) in the rquota struct is always false. So we hackishly removed this check. This problem also occured here: http://dovecot.org/pipermail/dovecot/2009-May/039593.html Apparently quota-tools do not check for this either (not needed?). 4. As metioned above we only use hardquotas but the plugin only reports softquotas. In my patch below I changed the behaviour: Check softquota == 0. If true then use hardquota, else softquota. Maybe you can use some of those fixes. I think at least #3 is reproducible (see ml post). The hard vs softquota behaviour is certainly a matter of discussion. The nfs4 "fixes" are actually more like feature requests that I think should be added to the plugin in one way or another. I created a diff of my changes to quota-fs.c. The changes were tested only for nfs3/4 though. Cheers Martin For completeness: BEGIN dovecot -n # 1.2.12: /etc/dovecot/dovecot.conf # OS: Linux 2.6.31-xen-r10-xen_domU x86_64 Gentoo Base System release 1.12.13 protocols: imaps pop3s listen: [::] ssl_listen(default): *:1993 ssl_listen(imap): *:1993 ssl_listen(pop3): *:1995 <cert files omitted> version_ignore: yes login_dir: /var/run/dovecot/login login_executable(default): /usr/libexec/dovecot/imap-login login_executable(imap): /usr/libexec/dovecot/imap-login login_executable(pop3): /usr/libexec/dovecot/pop3-login login_max_processes_count: 256 mail_privileged_group: mail mail_debug: yes mmap_disable: yes mail_nfs_index: yes mail_executable(default): /usr/local/bin/dovecot_helper mail_executable(imap): /usr/local/bin/dovecot_helper mail_executable(pop3): /usr/local/bin/dovecot_helper_pop mail_plugins(default): quota imap_quota mail_plugins(imap): quota imap_quota mail_plugins(pop3): mail_plugin_dir(default): /usr/lib64/dovecot/imap mail_plugin_dir(imap): /usr/lib64/dovecot/imap mail_plugin_dir(pop3): /usr/lib64/dovecot/pop3 pop3_uidl_format(default): %08Xu%08Xv pop3_uidl_format(imap): %08Xu%08Xv pop3_uidl_format(pop3): %v,%u lda: postmaster_address: <omitted> auth default: passdb: driver: pam args: * userdb: driver: passwd plugin: quota: fs:user:noenforcing -- END The diff (-Naur): --- quota-fs.c 2010-06-19 00:12:44.000000000 +0200 +++ quota-fs.c 2010-06-29 15:44:45.033517162 +0200 @@ -164,7 +164,7 @@ mount->fd = -1; #endif - if (strcmp(mount->type, "nfs") == 0) { + if (strcmp(mount->type, "nfs") == 0 || strcmp(mount->type, "nfs4") == 0) { if (strchr(mount->device_path, ':') == NULL) { i_error("quota-fs: %s is not a valid NFS device path", mount->device_path); @@ -210,7 +210,7 @@ #ifdef FS_QUOTA_SOLARIS #ifdef HAVE_RQUOTA - if (strcmp(mount->type, "nfs") == 0) { + if (strcmp(mount->type, "nfs") == 0 || strcmp(mount->type, "nfs4") == 0) { /* using rquota for this mount */ } else #endif @@ -319,6 +319,11 @@ host = t_strdup_until(mount->device_path, path); path++; + /* For NFSv4, we send the filesystem path without initial /. Server prepends proper + * NFS pseudoroot automatically and uses this for detection of NFSv4 mounts. */ + if (strcmp(root->mount->type, "nfs4") == 0) + while (*path == '/') + path++; if (root->root.quota->set->debug) { i_info("quota-fs: host=%s, path=%s, uid=%s, %s", @@ -366,17 +371,24 @@ /* convert the results from blocks to bytes */ const rquota *rq = &result.getquota_rslt_u.gqr_rquota; - if (rq->rq_active) { - if (bytes) { - *value_r = (uint64_t)rq->rq_curblocks * - (uint64_t)rq->rq_bsize; + if (bytes) { + *value_r = (uint64_t)rq->rq_curblocks * + (uint64_t)rq->rq_bsize; + if (rq->rq_bsoftlimit) { *limit_r = (uint64_t)rq->rq_bsoftlimit * (uint64_t)rq->rq_bsize; } else { - *value_r = rq->rq_curfiles; - *limit_r = rq->rq_fsoftlimit; + *limit_r = (uint64_t)rq->rq_bhardlimit * + (uint64_t)rq->rq_bsize; } + } else { + *value_r = rq->rq_curfiles; + if (rq->rq_fsoftlimit) + *limit_r = rq->rq_fsoftlimit; + else + *limit_r = rq->rq_fhardlimit; } + if (root->root.quota->set->debug) { i_info("quota-fs: uid=%s, value=%llu, " "limit=%llu, active=%d", dec2str(root->uid), @@ -419,7 +431,12 @@ host = t_strdup_until(mount->device_path, path); path++; - + /* For NFSv4, we send the filesystem path without initial /. Server prepends proper + * NFS pseudoroot automatically and uses this for detection of NFSv4 mounts. */ + if (strcmp(root->mount->type, "nfs4") == 0) + while (*path == '/') + path++; + if (root->root.quota->set->debug) { i_info("quota-fs: host=%s, path=%s, gid=%s, %s", host, path, dec2str(root->gid), @@ -761,7 +778,7 @@ bytes = strcasecmp(name, QUOTA_NAME_STORAGE_BYTES) == 0; #ifdef HAVE_RQUOTA - if (strcmp(root->mount->type, "nfs") == 0) { + if (strcmp(root->mount->type, "nfs") == 0 || strcmp(root->mount->type, "nfs4") == 0) { T_BEGIN { ret = !root->user_disabled ? do_rquota_user(root, bytes, value_r, &limit) :

2 2