- dovecot - dovecot.org

[Dovecot] Dovecot SSL limitations
by Thomas Hummel 01 Dec '09

01 Dec '09

Hello Timo, I'd like to check if my understanding of dovecot-1.2.x's SSL certificate handling is correct : SSL does not provide the server any mechanism to choose which certificate it must send relatively to the name the client is using. Thus, if you want to use different certificates, you have to listen to different addresses. This is an SSL limitation, not a dovecot nor IMAP limitation. This is the reason why it's possible to use different certificates for IMAP and POP3. But it seems to work only with those two : As a matter of fact, even if you listen to different addresses, how would you tell dovecot to send this certificate for this address and that certificate for that address, since there is no IP dependent section (as in apache IP-based virtual host for instance) ? It seems the only way would be to have more than one instance of dovecot (several dovecot with different config files). The problem is that some clients may be configured with mail.my.domain, some others with imap.my.domain, ...etc... Hence the need to have different certificates with those different names as cn. -- Thomas Hummel | Institut Pasteur <hummel(a)pasteur.fr> | Pôle informatique - systèmes et réseau

4 5

Re: [Dovecot] Dovecot 1.2.x masteruser proxy problem
by Tom Mihalicek 30 Nov '09

30 Nov '09

The problem was in auth_bind=yes in dovecot-ldap.conf i didnt read thoroughly the http://wiki.dovecot.org/Authentication/MasterUsers?action=show&redirect=Mas… You should also add the pass=yes setting to the master passdb if possible. It means that Dovecot verifies that the login user really exists before allowing the master user to log in. Without the setting if a non-existing login username is given, depending on the configuration, it could either return an internal login error (the userdb lookup failed) or create a whole new user (with eg. static userdb). pass=yes doesn't work with PAM or LDAP with auth_bind=yes, because both of them require knowing the user's password. Tom Mihalicek wrote: > > Greetings to all > > I need a masteruser/proxy account for some applications to be implemented > and i am having some problems. Normal users are proxyied through > ldap queries to the remote machine and this is working like it sopose to, > but i can't make the master user to work. Below are both the dovecot.conf > and dovecot-ldap.conf and verbose logs on the proxy machine. > > If i log directly on the remote machine that should be proxied everything > is working normal ... > > ### dovecot.conf > > protocols = pop3 imap managesieve > > mail_uid = 10021 > mail_gid = 10021 > mail_privileged_group = vmail > mail_access_groups = vmail > > log_path = > info_log_path = > log_timestamp = "%b %d %H:%M:%S " > login_log_format_elements = user=<%u> method=%m rip=%r lip=%l %c > login_log_format = %$: %s > mail_log_prefix = "%Us(%u): " > > disable_plaintext_auth = no > login_process_per_connection=yes > auth_default_realm = example.com > login_processes_count = 8 > login_max_processes_count = 128 > login_max_connections = 256 > verbose_proctitle = yes > max_mail_processes = 512 > > mail_debug = yes > auth_verbose = yes > auth_debug = yes > auth_debug_passwords = yes > > auth_master_user_separator = * > login_chroot = yes > > ssl = no > protocol imap { > imap_client_workarounds = delay-newmail outlook-idle netscape-eoh > tb-extra-mailbox-sep > listen = xx.xx.xx.xx:143 > imap_max_line_length = 65536 > imap_logout_format = bytes=%i/%o > mail_max_userip_connections = 10 > } > > protocol pop3 { > pop3_uidl_format = %08Xu%08Xv > pop3_client_workarounds = outlook-no-nuls oe-ns-eoh > pop3_enable_last = yes > pop3_uidl_format = %08Xu%08Xv > listen = xx.xx.xx.xx:110 > mail_max_userip_connections = 10 > } > > protocol managesieve { > listen = xx.xx.xx.xx:2000 > login_executable = > /usr/local/dovecot/libexec/dovecot/managesieve-login > mail_executable = /usr/local/dovecot/libexec/dovecot/managesieve > managesieve_max_line_length = 65536 > managesieve_implementation_string = dovecot > managesieve_logout_format = bytes ( in=%i : out=%o ) > } > > auth default { > mechanisms = plain login > user = vmail > > passdb passwd-file { > args = /etc/dovecot/passwd.masterusers > master = yes > pass = yes > } > > passdb ldap { > args = /etc/dovecot/dovecot-ldap.conf > } > > userdb ldap { > args = /etc/dovecot/dovecot-ldap.conf > } > > socket listen { > master { > path = /var/run/dovecot/auth-master > mode = 0600 > user = vmail > group = vmail > } > client { > path = /var/spool/postfix/dovecot-auth > mode = 0660 > user = postfix > group = postfix > } > } > } > > ### dovecot-ldap.conf > > hosts = ldap.example.com > ldap_version = 3 > auth_bind = yes > dn = cn=vmail,dc=example,dc=com > dnpass = secret_pass > base = ou=Users,domainName=%d,o=domains,dc=example,dc=com > scope = subtree > deref = never > user_filter = > (&(mail=%u)(objectClass=mailUser)(accountStatus=active)(enabledService=mail)(enabledService=%Ls)) > user_attrs = > storageBaseDirectory=home,mailHost=host,=proxy=yes,=nologin=yes,=nodelay=yes > pass_filter = > (&(mail=%u)(objectClass=mailUser)(accountStatus=active)(enabledService=mail)(enabledService=%Ls)) > pass_attrs = > userPassword=password,mailHost=host,=proxy=yes,=nologin=yes,=nodelay=yes > default_pass_scheme = CRYPT > > ### /var/log/mail/dovecot.info > > Nov 30 14:26:59 dougie dovecot: auth(default): new auth connection: > pid=5873 > Nov 30 14:27:28 dougie dovecot: auth(default): client in: AUTH 1 PLAIN > service=pop3 lip=xx.xx.xx.xx rip=192.168.22.222 > lport=110 rport=36639 > resp=AHRtaWhhbGljZWtAeG5ldC5sYW4qbWlncmF0aW9uQHhuZXQuaHIAbTFncjR0MTBu > Nov 30 14:27:28 dougie dovecot: auth(default): > passwd-file(migration(a)example.com,192.168.22.222,master): lookup: > user=master_user(a)example.com > file=/etc/dovecot/passwd.masterusers > Nov 30 14:27:28 dougie dovecot: auth(default): > passdb(master_user(a)example.com,192.168.22.222,master): Master user logging > in as some_user(a)example.com > Nov 30 14:27:28 dougie dovecot: auth(default): > ldap(some_user(a)example.com,192.168.22.222): bind search: > base=ou=Users,domainName=example.com,o=domains,dc=example,dc=com > filter=(&(mail=some_user@example.com)(objectClass=mailUser)(accountStatus=active)(enabledService=mail)(enabledService=pop3)) > Nov 30 14:27:28 dougie dovecot: auth(default): > ldap(some_user(a)example.com,192.168.22.222): result: > mailHost(host)=xx.xx.xx.xx > Nov 30 14:27:28 dougie dovecot: auth(default): > ldap(some_user(a)example.com,192.168.22.222): invalid credentials (given > password: master_password) > Nov 30 14:27:28 dougie dovecot: auth(default): client out: FAIL 1 > user=some_user(a)example.com authz nodelay host=xx.xx.xx.xx > proxynologin pass=master_password master=master_user(a)example.com > Nov 30 14:27:28 dougie dovecot: pop3-login: Ignoring unknown passdb extra > field: authz > > > -- View this message in context: http://old.nabble.com/Dovecot-1.2.x-masteruser-proxy-problem-tp26574804p265… Sent from the Dovecot mailing list archive at Nabble.com.

1 0

[Dovecot] Dovecot 1.2.x masteruser proxy problem
by Tom Mihalicek 30 Nov '09

30 Nov '09

Greetings to all I need a masteruser/proxy account for some applications to be implemented and i am having some problems. Normal users are proxyied through ldap queries to the remote machine and this is working like it sopose to, but i can't make the master user to work. Below are both the dovecot.conf and dovecot-ldap.conf and verbose logs on the proxy machine. If i log directly on the remote machine that should be proxied everything is working normal ... ### dovecot.conf protocols = pop3 imap managesieve mail_uid = 10021 mail_gid = 10021 mail_privileged_group = vmail mail_access_groups = vmail log_path = info_log_path = log_timestamp = "%b %d %H:%M:%S " login_log_format_elements = user=<%u> method=%m rip=%r lip=%l %c login_log_format = %$: %s mail_log_prefix = "%Us(%u): " disable_plaintext_auth = no login_process_per_connection=yes auth_default_realm = example.com login_processes_count = 8 login_max_processes_count = 128 login_max_connections = 256 verbose_proctitle = yes max_mail_processes = 512 mail_debug = yes auth_verbose = yes auth_debug = yes auth_debug_passwords = yes auth_master_user_separator = * login_chroot = yes ssl = no protocol imap { imap_client_workarounds = delay-newmail outlook-idle netscape-eoh tb-extra-mailbox-sep listen = xx.xx.xx.xx:143 imap_max_line_length = 65536 imap_logout_format = bytes=%i/%o mail_max_userip_connections = 10 } protocol pop3 { pop3_uidl_format = %08Xu%08Xv pop3_client_workarounds = outlook-no-nuls oe-ns-eoh pop3_enable_last = yes pop3_uidl_format = %08Xu%08Xv listen = xx.xx.xx.xx:110 mail_max_userip_connections = 10 } protocol managesieve { listen = xx.xx.xx.xx:2000 login_executable = /usr/local/dovecot/libexec/dovecot/managesieve-login mail_executable = /usr/local/dovecot/libexec/dovecot/managesieve managesieve_max_line_length = 65536 managesieve_implementation_string = dovecot managesieve_logout_format = bytes ( in=%i : out=%o ) } auth default { mechanisms = plain login user = vmail passdb passwd-file { args = /etc/dovecot/passwd.masterusers master = yes pass = yes } passdb ldap { args = /etc/dovecot/dovecot-ldap.conf } userdb ldap { args = /etc/dovecot/dovecot-ldap.conf } socket listen { master { path = /var/run/dovecot/auth-master mode = 0600 user = vmail group = vmail } client { path = /var/spool/postfix/dovecot-auth mode = 0660 user = postfix group = postfix } } } ### dovecot-ldap.conf hosts = ldap.example.com ldap_version = 3 auth_bind = yes dn = cn=vmail,dc=example,dc=com dnpass = secret_pass base = ou=Users,domainName=%d,o=domains,dc=example,dc=com scope = subtree deref = never user_filter = (&(mail=%u)(objectClass=mailUser)(accountStatus=active)(enabledService=mail)(enabledService=%Ls)) user_attrs = storageBaseDirectory=home,mailHost=host,=proxy=yes,=nologin=yes,=nodelay=yes pass_filter = (&(mail=%u)(objectClass=mailUser)(accountStatus=active)(enabledService=mail)(enabledService=%Ls)) pass_attrs = userPassword=password,mailHost=host,=proxy=yes,=nologin=yes,=nodelay=yes default_pass_scheme = CRYPT ### /var/log/mail/dovecot.info Nov 30 14:26:59 dougie dovecot: auth(default): new auth connection: pid=5873 Nov 30 14:27:28 dougie dovecot: auth(default): client in: AUTH 1 PLAIN service=pop3 lip=xx.xx.xx.xx rip=192.168.22.222 lport=110 rport=36639 resp=AHRtaWhhbGljZWtAeG5ldC5sYW4qbWlncmF0aW9uQHhuZXQuaHIAbTFncjR0MTBu Nov 30 14:27:28 dougie dovecot: auth(default): passwd-file(migration(a)example.com,192.168.22.222,master): lookup: user=master_user(a)example.com file=/etc/dovecot/passwd.masterusers Nov 30 14:27:28 dougie dovecot: auth(default): passdb(master_user(a)example.com,192.168.22.222,master): Master user logging in as some_user(a)example.com Nov 30 14:27:28 dougie dovecot: auth(default): ldap(some_user(a)example.com,192.168.22.222): bind search: base=ou=Users,domainName=example.com,o=domains,dc=example,dc=com filter=(&(mail=some_user@example.com)(objectClass=mailUser)(accountStatus=active)(enabledService=mail)(enabledService=pop3)) Nov 30 14:27:28 dougie dovecot: auth(default): ldap(some_user(a)example.com,192.168.22.222): result: mailHost(host)=xx.xx.xx.xx Nov 30 14:27:28 dougie dovecot: auth(default): ldap(some_user(a)example.com,192.168.22.222): invalid credentials (given password: master_password) Nov 30 14:27:28 dougie dovecot: auth(default): client out: FAIL 1 user=some_user(a)example.com authz nodelay host=xx.xx.xx.xx proxynologin pass=master_password master=master_user(a)example.com Nov 30 14:27:28 dougie dovecot: pop3-login: Ignoring unknown passdb extra field: authz -- View this message in context: http://old.nabble.com/Dovecot-1.2.x-masteruser-proxy-problem-tp26574804p265… Sent from the Dovecot mailing list archive at Nabble.com.

1 0

[Dovecot] /var/run/dovecot mode 750 too tight
by Frank Cusack 30 Nov '09

30 Nov '09

dovecot-1.2.8 creates /var/run/dovecot mode 750. I run postfix+dovecot in a virtual user setup. Postfix calls deliver as user vmail group vmail. Nov 29 12:53:04 imap.invalid dovecot: [ID 583609 mail.error] deliver(frank): userdb lookup: connect(/var/run/dovecot/auth-master) failed: Permission denied (euid=500(vmail) egid=500(vmail) missing +x perm: /var/run/dovecot) I will say this: dovecot's error reporting in general is head and shoulders above the norm. Makes tracking down problems sooo much easier. Something else I noticed, should the dict-server socket really be mode 777? At least a-x I would think. -frank

3 6

[Dovecot] Everytime I start my mail client it downloads all message again!
by BeKi 28 Nov '09

28 Nov '09

Hello, I use Xdove 1.2 on my ts-409 together with IMAP/dovecot. I like to see the same folder structure on my different workstation (private/work ...). I move the mails into the folder structure I created. That works fine. But since I use Xdove with IMAP I have the problem that my mailclient loads all mails I already stored in different folders again into the INBOX (some mails also multiple with subfolders). These mails are duplicates (or multiples) because I delete them all. The mails in my folders are still there. Up to now I tried different mail clients. Thunderbird 2.x/3.x, Pegasus 4.5, Outlook Express. All behave the same way, so I think it must have something to do with the server. Maybe one of you heard about this and can give me hints where to look for. Which configuration files shall I post to help debug? Thanks, Bernd

2 1

[Dovecot] init-script update for v2.0
by Pascal Volk 27 Nov '09

27 Nov '09

Hi Timo, please find attached a patch for the init script in the doc directory. * Added LSB-compliant info block (for insserv and friends) * Updated base_dir detection (for v2.0 config output) Regards, Pascal -- The trapper recommends today: decade.0932307(a)localdomain.org

3 7

[Dovecot] Proxy, using checkpassword
by Aaron Roberts 27 Nov '09

27 Nov '09

Hi all, I think I may be doing something wrong but, is it possible to proxy POP and IMAP users when using a checkpassword script as the passdb? I'm trying to write a perl script to handle authentication to a mix of SQL and POP3 sources whilst logging user passwords at the same time for a migration. At the moment, I'm trying to set environment variables to tell dovecot what to do: $ENV{'AUTHORIZED'} = 2; $ENV{'proxy'} = 'Y'; $ENV{'host'} = $pop_success; Dovecot is logging the following: Nov 27 10:35:01 pop3 dovecot: auth(default): client in: AUTH#0118#011PLAIN#011service=pop3#011lip=192.168.100.143#011rip=192.168.100.60#011lport=110#011rport=3051#011resp=AGFpcmJlYXIAcG9uZGFhcjM= Nov 27 10:35:01 pop3 dovecot: auth(default): checkpassword(airbear,192.168.100.60): execute: /var/run/dovecot/login/authomatic.pl /usr/libexec/dovecot/checkpassword-reply Nov 27 10:35:02 pop3 dovecot: auth(default): checkpassword(airbear,192.168.100.60): Received input: userdb_uid=0#011userdb_gid=0#011 Nov 27 10:35:02 pop3 dovecot: auth(default): checkpassword(airbear,192.168.100.60): Received no input Nov 27 10:35:02 pop3 dovecot: auth(default): checkpassword(airbear,192.168.100.60): exit_status=0 Nov 27 10:35:02 pop3 dovecot: auth(default): client out: OK#0118#011user=airbear Nov 27 10:35:02 pop3 dovecot: dovecot: User airbear is missing UID (see mail_uid setting) Nov 27 10:35:02 pop3 dovecot: auth(default): master in: REQUEST#0115#01116075#0118 Nov 27 10:35:02 pop3 dovecot: auth(default): master out: USER#0115#011airbear Nov 27 10:35:02 pop3 dovecot: pop3-login: Internal login failure (auth failed, 1 attempts): user=<airbear>, method=PLAIN, rip=192.168.100.60, lip=192.168.100.143 Thanks in advance, Aaron

1 1

[Dovecot] is there a script to find a message from a given username easily?
by Gary Kline 27 Nov '09

27 Nov '09

Hello people, I used primarily mutt and sendmail for many years. (And elm before mutt.) All my mail was saved into ~/Mail. Messages from, say, smith(a)foo.ber were stored in ~/Mail/smith; all mail from smith was catenated into one file, and if I wanted to find something that smith had written, I would just cd to ~/Mail and grep or egrep on a likely word or phrase. Is there a script that can reach into my server into My maildirectory and cp or symlink (say) ~/Maildir/smith's files: 2 -rw------- 1 kline kline 780 Apr 18 2008 1208585354.91013_3.aristotle:2,S 2 -rw------- 1 kline kline 731 May 15 2008 1210901757.55602_4.aristotle:2,S 2 -rw------- 1 kline kline 566 May 18 2008 1211140486.77700_3.aristotle:2,S 2 -rw------- 1 kline kline 578 May 20 2008 1211326880.95596_4.aristotle:2,S 2 -rw------- 1 kline kline 578 May 21 2008 1211393732.2283_3.aristotle:2,S 2 -rw------- 1 kline kline 673 Apr 13 2009 1239636788.1457_3.aristotle:2,S 6 -rw------- 1 kline kline 4242 Apr 14 2009 1239748901.16354_4.aristotle:2,S into somthing named ~/Mail/smith, with all files catted together? tia, gary kline -- Gary Kline kline(a)thought.org http://www.thought.org Public Service Unix http://jottings.thought.org http://transfinite.thought.org The 7.31a release of Jottings: http://jottings.thought.org/index.php

2 1

[Dovecot] Acl Groups
by Dimitrios Karapiperis 26 Nov '09

26 Nov '09

Hi all! I have a corpus of virtual users ( user1(a)domain.tld , user2(a)domain.tld, user3(a)domain.tld,..., usern(a)domain.tld ... ) authenticated against Active Directory. Is it possible to group some users (virtual) and give appropriate ACLs on a shared imap public folder using an ACL vfile? thanks in advance Dimitrios

4 5

[Dovecot] Dovecot hosts in France?
by Anatoly IVANOV 26 Nov '09

26 Nov '09

Hi, * Would someone recommend web hosts in France using Dovecot, please? I'd prefer to outsource the server management to someone else (although I could install and run my own Dovecot server). I need the server to be located physically in a French datacenter for legal reasons. Sorry if I'm a bit off-topic. Not a technical question. Thanks in advance. ANATOLY IVANOV / PHOTOGRAPHY / DESIGN / PROSE http://www.anatolyivanov.com/ AI on Twitter http://twitter.com/anatolyivanov

1 0