- dovecot - dovecot.org

[Dovecot] Right way to Dovecot Load Balance
by Proskurin Kirill 30 Apr '10

30 Apr '10

Hello. I building LB&HA Email cluster based on Exim+Dovecot+LDAP. Now I thinking what the most right way to LB Dovecot(2 nodes with shared storage). HA-Proxy? Dovecot Proxy? Nginx? Else? -- Best regards, Proskurin Kirill

2 1

[Dovecot] Question about auth multiple configuration
by Fabrice MATHIEU 30 Apr '10

30 Apr '10

Hello, My mail system is build with postfix, dovecot and roundcube. In first time users can view and "manage" their mail only on the webmail. So this one (webmail) use IMAP (no tls/ssl at all) authentication to give access to users maildir. This connection is made on the 'loopback' interface and use PLAIN method. This works fine (configuration below without ssl parameters). Now I want to see and send my mail with a MUA (thunderbird). As my system is on an Internet provider I want to add more security "solutions". I use smtps with postfix and SASL/auth by dovecot socket mechanism to send mail. I use imaps with dovecot for managing my maildir. I have added ssl parameters to the configuration file (see below) and I required certificate from the client (to avoid man in the middle attack and to get access only for client with user certificate). To get this "ssl_require_client_cert" is set to yes. Ok, now imaps works perfectly. But since a certificate is required webmail authentication (localhost) and SASL (postfix auth trough dovecot socket mechanism) don't work. Webmail => dovecot: imap-login: Disconnected (cert required, client didn't start TLS): method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, secured Postfix => postfix/smtpd[71640]: warning: TOTO[X.A.B.C]: SASL PLAIN authentication failed: Client didn't present valid SSL certificate That's normal. But 127.0.0.1 client(network) is considered by dovecot as secure, so won't the auth possible without certificate ? Can't we make two auth policy to make secure (client crt require) for public IP/client and less "secure" (without crt client) for local process (postfix) and local newtwork(127.0.0.1) for roundcube ? I see section "auth default { ... }" and is used by ... default ! But can we make an other one to make this two particular authentication on the same "instance" ? Thank you. And then my configuration : operating system => FreeBSD 7.1 dovecot --version => 1.2.8 dovecot -n => # 1.2.8: /usr/local/etc/dovecot.conf # OS: FreeBSD 7.1-RELEASE i386 ufs protocols: imap listen: 127.0.0.1 ssl_listen: X.Y.Z.T ssl: yes ssl_ca_file: /usr/local/etc/dovecot/CAclient.pem ssl_cert_file: /usr/local/etc/dovecot/imaps.pem ssl_key_file: /usr/local/etc/dovecot/imaps.key ssl_verify_client_cert: yes login_dir: /var/run/dovecot/login login_executable: /usr/local/libexec/dovecot/imap-login verbose_proctitle: yes first_valid_uid: 1000 first_valid_gid: 1000 mail_privileged_group: mail mail_location: maildir:/jails/mails/%d/%n imap_client_workarounds: delay-newmail netscape-eoh tb-extra-mailbox-sep lda: postmaster_address: postmaster@SOMETHING hostname: SOMETHING_ELSE sendmail_path: /usr/sbin/sendmail auth default: mechanisms: plain login username_format: %Lu passdb: driver: passwd-file args: username_format=%n /jails/mails/dov_pass/%d/usr_pas userdb: driver: passwd-file args: username_format=%n /jails/mails/dov_pass/%d/usr_pas ssl_require_client_cert = yes ssl_username_from_cert = no socket: type: listen client: path: /var/spool/postfix/private/auth mode: 432 user: postfix group: wheel master: path: /var/run/dovecot/auth-master mode: 384 Best regards, _________________________________________________________________ Consultez gratuitement vos emails Orange, Gmail, Free, ... directement dans HOTMAIL ! http://www.windowslive.fr/hotmail/agregation/

3 8

[Dovecot] Question about dovecot imap proxy
by Monika Janek 29 Apr '10

29 Apr '10

Hi everyone! I have dovecot (1.2.11) on one our external mail servers acting as a proxy. The client (ifor now, my iphone) connects fine via ssl to the external mailserver but I can't seem to get a secure connection now to the internal destination imap server (between external mail server and internal imap server, it's going through port 143). Running tcpdump, I can clearly see my password being transmitted on our internal network. I read the addition to the documentation about dovecot proxy but I'm not sure where to add these variables: In v1.2.rc4+ the connections to destination server can be TLS/SSL encrypted by returning: * ssl=yes: Use SSL and require a valid verified remote certificate. *WARNING: Unless used carefully, this is an insecure setting!* Currently host must be an IP address, so this setting accepts any certificate signed by a trusted CA. The host name isn't checked in any way against the certificate's CN. The only way to use this securely is to only use and allow your own private CA's certs, anything else is exploitable by a man-in-the-middle attack. * ssl=any-cert: Use SSL, but don't require a valid remote certificate. * starttls: Use STARTTLS command instead of doing SSL handshake immediately after connected. Can anyone point me in the right direction? Thanks so much! :) -- Monika Janek Systems Administrator, Side Effects Software Toronto, Ontario Canada 416-504-9876 x207 www.sidefx.com

2 8

[Dovecot] Assertion failed in mail-search-build.c
by Mark Moseley 29 Apr '10

29 Apr '10

With Friday's and today's mercurial repo, I'm getting this: Apr 26 12:55:31 master: Info: Dovecot v2.0.beta4 starting up (core dumps disabled) Apr 26 12:58:34 imap-login: Info: Login: user=<mail@box>, method=PLAIN, rip=10.1.1.206, lip=192.168.152.1 Apr 26 12:58:34 imap(mail@box): Panic: file mail-search-build.c: line 59 (mail_search_build_key_int): assertion failed: (sarg->value.subargs != NULL) Apr 26 12:58:34 imap(mail@box): Error: Raw backtrace: /usr/lib/dovecot/libdovecot.so.0 [0xb76a3ad1] -> /usr/lib/dovecot/libdovecot.so.0 [0xb76a3b4f] -> /usr/lib/dovecot/libdovecot.so.0(i_error+0) [0xb76a3e08] -> /usr/lib/dovecot/libdovecot-storage.so.0 [0xb76f859e] -> /usr/lib/dovecot/libdovecot-storage.so.0 [0xb76f860f] -> /usr/lib/dovecot/libdovecot-storage.so.0(mail_search_build+0x82) [0xb76f86f2] -> dovecot/imap [mail@box 10.1.1.206 SEARCH](imap_search_args_build+0x48) [0x805d8a8] -> dovecot/imap [mail@box 10.1.1.206 SEARCH](cmd_search+0xbb) [0x805342b] -> dovecot/imap [mail@box 10.1.1.206 SEARCH] [0x80564dc] -> dovecot/imap [mail@box 10.1.1.206 SEARCH] [0x8056579] -> dovecot/imap [mail@box 10.1.1.206 SEARCH](client_handle_input+0x2d) [0x80566ed] -> dovecot/imap [mail@box 10.1.1.206 SEARCH](client_input+0x5f) [0x805710f] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run+0xf5) [0xb76b0115] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_run+0x30) [0xb76af160] -> /usr/lib/dovecot/libdovecot.so.0(master_service_run+0x2a) [0xb769ca5a] -> dovecot/imap [mail@box 10.1.1.206 SEARCH](main+0x2b5) [0x805fb95] -> /lib/libc.so.6(__libc_start_main+0xe5) [0xb752e455] -> dovecot/imap [mail@box 10.1.1.206 SEARCH] [0x804e951] Apr 26 12:58:34 master: Error: service(imap): child 13220 killed with signal 6 (core dumps disabled) Login is working fine, just blowing up on that assert by doing a search. The search is pretty basic, in python: server.search( None, "(ALL)" ) Testing with a previous version (from a couple of days earlier -- I don't have the intervening), I don't hit that assertion. The last changeset on mail-search-build.c in the working copy is 11146:3649ad8c9f9a. Let me know if there's anything you'd like me to try.

2 1

[Dovecot] pop3-login: auth failure -- due to number as first character in login name
by dovecot mail list account 29 Apr '10

29 Apr '10

Seem to have found a error in version 1.2.6 regarding usernames having a number as the first character. Customers with a number as the first character in thier user name can not login via pop3 clients. However they can login through our webmail interface. If we remove the number from the username then the customer can login. # 1.2.6: /etc/dovecot.conf # OS: Linux 2.6.31.12-desktop-3mnb x86_64 Mandriva Linux 2010.0 protocols: pop3 ssl_listen: * ssl_cert_file: /etc/pki/tls/certs/dovecot.pem ssl_key_file: /etc/pki/tls/private/dovecot.pem disable_plaintext_auth: no login_dir: /var/run/dovecot/login login_executable: /usr/lib64/dovecot/pop3-login mail_privileged_group: mail mail_location: mbox:~/mail:INBOX=/home/mail/%u mail_executable: /usr/lib64/dovecot/pop3 mail_plugin_dir: /usr/lib64/dovecot/modules/pop3 pop3_uidl_format: %08Xv%08Xu lda: postmaster_address: postmaster(a)example.com auth default: mechanisms: plain login verbose: yes passdb: driver: pam userdb: driver: passwd socket: type: listen client: path: /var/spool/postfix/private/auth mode: 432 user: postfix group: postfix plugin: quota_warning: storage=95%% /usr/local/bin/quota-warning.sh 95 quota_warning2: storage=80%% /usr/local/bin/quota-warning.sh 80

2 1

[Dovecot] Problems with Mailbox is in inconsistent state, please relogin.
by Daniel Machado Grilo 29 Apr '10

29 Apr '10

Dear Dovecot users, I'm a sysadmin in a company that recently migrated the IMAP from courier-imap to dovecot :-) *urray* Everything with the perl migrating scripts (version 1.0) went with OKs and it was a lot of fun (and pray) to move 400Gb of mails and migrate.. and everything is working even better :-) The problem is for some outside users that use webmails, like: - Squirrel - Roundcube - Horde They claim that the connection is constantly dropping.. You might say now: "Webmail's fault!!!" as I said in the beginning :) But the IMAP logs shows SEVERAL times (almost every 10mins ?!): Apr 28 21:10:48 olive dovecot: IMAP(rcoelho): Maildir /cluster/mail/mailboxes/rcoelho sync: UID inserted in the middle of mailbox (192736 > 192720, file = msg.LDW0C) Apr 28 21:10:48 olive dovecot: IMAP(rcoelho): Disconnected: Mailbox is in inconsistent state, please relogin. Apr 28 19:14:11 olive dovecot: IMAP(pcorreia): Maildir /cluster/mail/mailboxes/pcorreia sync: UID < next_uid (7874 < 7875, file = msg.5BNVC) Apr 28 19:14:12 olive dovecot: IMAP(pcorreia): Disconnected: Mailbox is in inconsistent state, please relogin. and so on. I read somewhere on the web that configuring the mbox_lazy_write=no should work .. it did not :-) I have CentOS 5.4 in our mailserver, so the version of dovecot is not the latest (it is 1.0.7).. But of course, this is production environment and I don't want to update if its not needed :-) So my questions are: - Is this a known bug for this version and I have to upgrade ? - Is this a problem in my configs for dovecot ? - Can this be other problem than dovecot ? -- so probably i should be able to add more debug anoying messages to our logs ? - Probably something went wrong in the migration for these maildirs? So now what can we do to fix this ? Our mail is working and, at the moment, I found 3 users with this error.. They have about 10Gb of mail each, I don't think this is a problem for dovecot.. only for our storages.. :-) Tks for your patience, Best Regards!

4 3

[Dovecot] Maildircrypt
by brainstorm 29 Apr '10

29 Apr '10

Hi guys, I was just wondering if this idea makes sense overall or if there are major impediments (indexing performance ?): http://blogs.nopcode.org/brainstorm/2010/04/28/maildircrypt/ Thanks ! Roman

2 1

[Dovecot] Dovecot headers at start of text returned to KMail
by Barry Scott 29 Apr '10

29 Apr '10

The attachment show Kmail (kdepim-4.4.2-1.fc12.x86_64) accessing an email from dovecot over imap. From the wireshark-imap-trace.txt you can see at line 77 that the headers do not end cleanly "X-)". And at line 84 there is text from the headers that is not part of the body "-Spambayes-Trained: ham". The email being access by dovecot is in: 1272011889.M384349P30156.f12barry.office.onelan.co.uk,S=6494,W=6606:2,S Because of this bug kmail fails to show the message cleanly on screen. # 1.2.11: /etc/dovecot.conf # OS: Linux 2.6.32.11-99.fc12.x86_64 x86_64 Fedora release 12 (Constantine) login_dir: /var/run/dovecot/login login_executable(default): /usr/libexec/dovecot/imap-login login_executable(imap): /usr/libexec/dovecot/imap-login login_executable(pop3): /usr/libexec/dovecot/pop3-login mail_executable(default): /usr/libexec/dovecot/imap mail_executable(imap): /usr/libexec/dovecot/imap mail_executable(pop3): /usr/libexec/dovecot/pop3 mail_plugin_dir(default): /usr/lib64/dovecot/imap mail_plugin_dir(imap): /usr/lib64/dovecot/imap mail_plugin_dir(pop3): /usr/lib64/dovecot/pop3 auth default: passdb: driver: pam userdb: driver: passwd Barry

2 4

[Dovecot] How can I add change_password
by Yavuz Maşlak 29 Apr '10

29 Apr '10

Hello I use dovecot, postfix, mysql and squirrelmail as a mail server. it works well. Meanwhile I am novice at postfix. As you know, there is a change_password plugin on squirrelmail. I wish to add change_password plugin on squirrelmail. I couldn't find how to integrate postfix and change_password. How can I add it ?

2 1

[Dovecot] How can I integrate change_password plugin, dovecot and postfix
by Yavuz Maşlak 29 Apr '10

29 Apr '10

Hello I use dovecot, postfix, mysql and squirrelmail as a mail server. it works well. Meanwhile I am novice at postfix. As you know, there is a change_password plugin on squirrelmail. I wish to add change_password plugin on squirrelmail. I couldn't find how to integrate postfix and change_password. How can I add it ?

3 3