- dovecot - dovecot.org

[Dovecot] SetUID check problem
by Thomas Berezansky 27 Oct '09

27 Oct '09

Running dovecot 1.2.4 on FreeBSD using Postfix. Everything works fine normally, but deliver is executable by world. This is not normally a problem, as I don't run deliver SetUID root. But for whatever reason, when deliver is called by something that IS SetUID root I get the following error: /usr/local/libexec/dovecot/deliver must not be both world-executable and setuid-root. This allows root exploits. See http://wiki.dovecot.org/LDA#multipleuids Deliver's permissions look like this: -r-xr-xr-x While the program calling deliver has permissions like this: -r-s--x--- If it isn't possible for deliver to differentiate between being called by setuid root programs and being setuid root itself I don't think it should be doing that particular security check. Alternatively, there should be an option to turn that particular check off, but what little I saw of the source code and found searching the documentation told me that there doesn't seem to be such an option already. I also couldn't find any mention that this is fixed by 1.2.5 or 1.2.6. Thomas Berezansky Merrimack Valley Library Consortium

2 1

[Dovecot] Test environment question
by Stewart Dean 27 Oct '09

27 Oct '09

I want to test out my first V1.2 Dovecot (upgraded from V1.1) instance. What I have in mind to do is to run it on another machine that has the Inbox dir and homedirs NFS import mounted from the production mailserver. I then have 5 people test it in this test environment.... A) Then I can deal with the index filesystem in one of two ways: 1) Make it local OR 2) NFS import it from the production DC server Comments as to which is best? I have used #1 before...which caused some temporary unhappiness with the switchover and switchback....during which time the index is badly wrong and DC auto-rebuilds it... B) Is there anything else I should do/not do? C) Any ugliness that will surface in this testing lashup but isn't important? -- ==== Stewart Dean, Unix System Admin, Henderson Computer Resources Center of Bard College, Annandale-on-Hudson, New York 12504 sdean(a)bard.edu voice: 845-758-7475, fax: 845-758-7035

1 0

[Dovecot] Multiple identities
by Koenraad Lelong 27 Oct '09

27 Oct '09

Hi, I recently moved from courier-imap to dovecot, to be able to work with managesieve. I use version 1.2.5, on suse 10.3. I used the script to migrate the courier maildir to dovecot format. It seems to work fine except for one problem : I use a number of aliasses and with Thunderbird I can select which alias (e-mail-address) to use as my identity when sending a mail. I sniffed with wireshark, and with my standard identity, I see the message appended to "Sent", like I expect. If I use an alias, I see a folder being created : "INBOX.Sent", and then the message is appended there. Why the difference ? I'm trying to debug this but dovecot does not help much. I tried rawlog but there is no output (that I see) from it, no log-files in my maildir. Any hints how to proceed ? Output op dovecot -n : # 1.2.5: /etc/dovecot/dovecot.conf # OS: Linux 2.6.22.19-0.4-default x86_64 openSUSE 10.3 (X86-64) base_dir: /var/run/dovecot/ log_path: /var/log/dovecot log_timestamp: %Y-%m-%d %H:%M:%S listen: *:143 ssl_listen: *:993 ssl_ca_file: /etc/postfix/certificate/cacert.org.pem ssl_cert_file: /etc/postfix/certificate/mailbox.pem ssl_key_file: /etc/postfix/certificate/mailboxkey.pem disable_plaintext_auth: no verbose_ssl: yes login_dir: /var/run/dovecot//login login_executable: /usr/lib/dovecot/imap-login first_valid_uid: 499 last_valid_uid: 499 mail_location: maildir:/var/vmail/%d/%u mail_debug: yes mail_executable: /usr/lib/dovecot/rawlog /usr/lib/dovecot/imap lda: postmaster_address: postmaster(a)mydomain.com sendmail_path: /usr/lib/sendmail auth_socket_path: /var/run/dovecot/auth-master mail_plugins: cmusieve auth default: mechanisms: plain login user: nobody verbose: yes debug: yes passdb: driver: sql args: /etc/dovecot/dovecot-sql.conf userdb: driver: sql args: /etc/dovecot/dovecot-sql.conf socket: type: listen client: path: /var/spool/postfix/private/auth mode: 432 user: postfix group: postfix master: path: /var/run/dovecot/auth-master mode: 432 user: vmail group: vmail Kind regards, Koenraad Lelong.

3 6

[Dovecot] Maildir autocreation
by Proskurin Kirill 26 Oct '09

26 Oct '09

Hello. Today i found what maildir autocreation stop work. May be after upgrade to 1.2. Here logs: Oct 21 11:01:25 deliver(shershov-oa(a)fxclub.org): Info: Loading modules from directory: /usr/local/lib/dovecot/lda Oct 21 11:01:25 deliver(shershov-oa(a)fxclub.org): Info: Module loaded: /usr/local/lib/dovecot/lda/lib10_quota_plugin.so Oct 21 11:01:25 deliver(shershov-oa(a)fxclub.org): Info: Module loaded: /usr/local/lib/dovecot/lda/lib90_sieve_plugin.so Oct 21 11:01:25 deliver(shershov-oa(a)fxclub.org): Info: auth input: quota_rule=*:storage=2046M Oct 21 11:01:25 deliver(shershov-oa(a)fxclub.org): Info: auth input: uid=1002 Oct 21 11:01:25 deliver(shershov-oa(a)fxclub.org): Info: auth input: gid=1002 Oct 21 11:01:25 deliver(shershov-oa(a)fxclub.org): Info: auth input: home=/var/spool/dovecot/domains/fxclub.org/shershov-oa Oct 21 11:01:25 deliver(shershov-oa(a)fxclub.org): Info: Home dir not found: /var/spool/dovecot/domains/fxclub.org/shershov-oa Oct 21 11:01:25 deliver(shershov-oa(a)fxclub.org): Info: Quota root: name= backend=maildir args= Oct 21 11:01:25 deliver(shershov-oa(a)fxclub.org): Info: Quota rule: root= mailbox=* bytes=2145386496 messages=0 Oct 21 11:01:25 deliver(shershov-oa(a)fxclub.org): Info: Quota rule: root= mailbox=Trash bytes=1317011456 messages=0 Oct 21 11:01:25 deliver(shershov-oa(a)fxclub.org): Info: Quota rule: root= mailbox=SPAM ignored Oct 21 11:01:25 deliver(shershov-oa(a)fxclub.org): Info: Quota warning: bytes=2038117171 (95%) messages=0 command=/usr/local/bin/quota-warning.sh 95 Oct 21 11:01:25 deliver(shershov-oa(a)fxclub.org): Info: Quota warning: bytes=1716309196 (80%) messages=0 command=/usr/local/bin/quota-warning.sh 80 Oct 21 11:01:25 deliver(shershov-oa(a)fxclub.org): Info: maildir autodetect: stat(/var/spool/dovecot/domains/fxclub.org/shershov-oa//cur) failed: No such file or directory Oct 21 11:01:25 deliver(shershov-oa(a)fxclub.org): Info: mbox autodetect: data=/var/spool/dovecot/domains/fxclub.org/shershov-oa/ Oct 21 11:01:25 deliver(shershov-oa(a)fxclub.org): Info: mbox autodetect: INBOX file: stat(/var/spool/dovecot/domains/fxclub.org/shershov-oa/) failed: No such file or directory Oct 21 11:01:25 deliver(shershov-oa(a)fxclub.org): Info: mbox autodetect: has .imap/: stat(/var/spool/dovecot/domains/fxclub.org/shershov-oa//.imap) failed: No such file or directory Oct 21 11:01:25 deliver(shershov-oa(a)fxclub.org): Info: mbox autodetect: has inbox: stat(/var/spool/dovecot/domains/fxclub.org/shershov-oa//inbox) failed: No such file or directory Oct 21 11:01:25 deliver(shershov-oa(a)fxclub.org): Info: mbox autodetect: has mbox: stat(/var/spool/dovecot/domains/fxclub.org/shershov-oa//mbox) failed: No such file or directory Oct 21 11:01:25 deliver(shershov-oa(a)fxclub.org): Error: mail_location: Ambiguous mail location setting, don't know what to do with it: /var/spool/dovecot/domains/fxclub.org/shershov-oa/ (try prefixing it with mbox: or maildir:) Oct 21 11:01:25 deliver(shershov-oa(a)fxclub.org): Fatal: Namespace initialization failed dovecot -n # 1.2.4: /usr/local/etc/dovecot.conf # OS: FreeBSD 7.1-RELEASE-p7 i386 ufs base_dir: /var/run/dovecot/ log_path: /var/log/dovecot/dovecot.log info_log_path: /var/log/dovecot/dovecot-debug.log protocols: imap imaps pop3 pop3s managesieve listen(default): * listen(imap): * listen(pop3): * listen(managesieve): *:2000 ssl_ca_file: /usr/local/etc/certs/GlobalSignCA.crt ssl_cert_file: /usr/local/etc/certs/fxclub_org.crt ssl_key_file: /usr/local/etc/certs/fxclub_org.key ssl_cipher_list: ALL:!LOW:!SSLv2 login_dir: /var/run/dovecot/login login_executable(default): /usr/local/libexec/dovecot/imap-login login_executable(imap): /usr/local/libexec/dovecot/imap-login login_executable(pop3): /usr/local/libexec/dovecot/pop3-login login_executable(managesieve): /usr/local/libexec/dovecot/managesieve-login login_process_size: 128 login_processes_count: 20 login_max_processes_count: 512 mail_max_userip_connections(default): 256 mail_max_userip_connections(imap): 256 mail_max_userip_connections(pop3): 20 mail_max_userip_connections(managesieve): 10 verbose_proctitle: yes first_valid_gid: 0 mail_privileged_group: mail mail_uid: dmail mail_gid: dmail mail_location: maildir:/var/spool/dovecot/domains/%d/%n mail_debug: yes mail_executable(default): /usr/local/libexec/dovecot/imap mail_executable(imap): /usr/local/libexec/dovecot/imap mail_executable(pop3): /usr/local/libexec/dovecot/pop3 mail_executable(managesieve): /usr/local/libexec/dovecot/managesieve mail_process_size: 512 mail_plugins(default): quota imap_quota autocreate mail_log mail_plugins(imap): quota imap_quota autocreate mail_log mail_plugins(pop3): quota mail_plugins(managesieve): mail_plugin_dir(default): /usr/local/lib/dovecot/imap mail_plugin_dir(imap): /usr/local/lib/dovecot/imap mail_plugin_dir(pop3): /usr/local/lib/dovecot/pop3 mail_plugin_dir(managesieve): /usr/local/lib/dovecot/managesieve imap_client_workarounds(default): delay-newmail tb-extra-mailbox-sep imap_client_workarounds(imap): delay-newmail tb-extra-mailbox-sep imap_client_workarounds(pop3): imap_client_workarounds(managesieve): pop3_client_workarounds(default): pop3_client_workarounds(imap): pop3_client_workarounds(pop3): outlook-no-nuls oe-ns-eoh pop3_client_workarounds(managesieve): lda: postmaster_address: postmaster(a)fxclub.org hostname: mail.fxclub.org mail_plugins: sieve quota mail_plugin_dir: /usr/local/lib/dovecot/lda quota_full_tempfail: yes deliver_log_format: msgid=%m: %$ %f %s log_path: /var/log/dovecot/deliver.log info_log_path: /var/log/dovecot/deliver.log sendmail_path: /usr/sbin/sendmail rejection_reason: Your message to <%t> was automatically rejected:%n%r auth_socket_path: /var/run/dovecot/auth-master auth default: mechanisms: plain login user: dovecot-auth username_format: %Lu worker_max_count: 100 passdb: driver: ldap args: /usr/local/etc/dovecot-ldap.conf userdb: driver: ldap args: /usr/local/etc/dovecot-ldap.conf socket: type: listen client: path: /var/run/dovecot/auth-client mode: 432 user: exim master: path: /var/run/dovecot/auth-master mode: 384 user: dmail plugin: quota: maildir quota_rule: *:storage=1024M quota_rule2: Trash:storage=1256M quota_rule3: SPAM:ignore quota_warning: storage=95%% /usr/local/bin/quota-warning.sh 95 quota_warning2: storage=80%% /usr/local/bin/quota-warning.sh 80 autocreate: Trash autocreate2: Sent autocreate3: Spam autosubscribe: Trash autosubscribe2: Sent autosubscribe3: Spam sieve_dir: ~/sieve sieve: ~/.dovecot.sieve sieve_global_path: /var/spool/dovecot/global.sieve mail_location: /var/spool/dovecot/domains/%d/%n/ mail_log_events: delete undelete expunge copy mailbox_delete mailbox_rename mail_log_fields: uid box msgid size mail_log_max_lines_per_sec: 0 -- Best regards, Proskurin Kirill

5 7

[Dovecot] Multiple postfix + single dovecot - optimal configuration
by Tomek 26 Oct '09

26 Oct '09

Hello, I want to setup dovecot with two postfix servers on three machines: - dovecot - with huge amount of disk space - where all user emails will be kept, - postfix1 - with greylisting, amavisd-new (spamassassin, clamav, etc), with mysql backend, - postfix2 - same as postfix1. MX priority will be set to the same value for both postfix machines. For now I don't know how to "glue" these severs: - if I should install dovecot on both postfix and use third servers as a NFS share? - or maybe it is possible to communicate with dovecot on third server via LMTP? - or should I run third postfix daemon (without antyspam etc - simple configuration) on the same machine as dovecot only for delivering local mails? I will be grateful for any advice, howto or good practices example. -- Regards, Thomas.

3 2

[Dovecot] protocol configure confusion
by Stewart Dean 26 Oct '09

26 Oct '09

The docs say: > > *protocol*s = imap *imaps* > *Protocol*s we want to be serving: imap *imaps* pop3 pop3s If you > only want to use dovecot-auth, you can set this to "none". > and..... > > If you want to specify ports for each service, you will need to > configure these settings inside the *protocol* imap/pop3 { ... } > section, so you can specify different ports for IMAP/POP3. For example: > > # *protocol* imap { > # listen = *:10143 > # ssl_listen = *:10943 > # .. > # } > So if I want to run both imap and imaps AND configure the port, do I do: # *protocol* imap { # listen = *:143 # ssl_listen = *:10943 # } OR # *protocol* imap { # listen = *:143 # } # *protocol* imaps { # listen = *:993 # }

2 1

[Dovecot] Ubuntu stable versions
by Stefan Onken 26 Oct '09

26 Oct '09

Hello, I am using ubuntu-server for some of my servers. Unfortunately the latest version available is 1.1.11. Is there any alternative than building it from source to get the latest dovecot version ? Thanks Stonki

4 9

[Dovecot] Rotating the dovecot log file
by Jerry 24 Oct '09

24 Oct '09

Using FreeBSD-7.2, I am attempting to configure the system newsyslog utility to rotate the dovecot.log file. I would prefer to use the system utility rather than the one described on the dovecot wiki for rotating the file. Unfortunately, it is not working. This is the error message that is spawned: newsyslog: illegal signal number in config file: /var/log/dovecot.log root:wheel 0666 1 * $M1D0 CJ /var/run/dovecot/master.pid USR1 Does anyone have an idea how to get this to work? Thanks! -- Jerry gesbbb(a)yahoo.com |::::======= |::::======= |=========== |=========== | Wilner's Observation: All conversations with a potato should be conducted in private.

2 2

[Dovecot] New error messages
by Robin Atwood 23 Oct '09

23 Oct '09

I was glancing at my logwatch report when I noticed: dovecot: IMAP(robinmail): fchown(/home/robinmail/mail/.imap/INBOX/dovecot.index.log.newlock, -1, 10(wheel)) failed: Operation not permitted (egid=100(users), group based on /var/mail/robinmail): 1 Time(s) dovecot: IMAP(robinmail): fchown(/home/robinmail/mail/.imap/INBOX/dovecot.index.tmp, -1, 10(wheel)) failed: Operation not permitted (egid=100(users), group based on /var/mail/robinmail): 3 Time(s) So what's going on here? :) I am fairly sure I never had them before. Running dovecot 1.2.6. TIA -Robin -- ---------------------------------------------------------------------- Robin Atwood. "Ship me somewheres east of Suez, where the best is like the worst, Where there ain't no Ten Commandments an' a man can raise a thirst" from "Mandalay" by Rudyard Kipling ----------------------------------------------------------------------

2 2

[Dovecot] v2.0.alpha2 released
by Timo Sirainen 23 Oct '09

23 Oct '09

http://dovecot.org/releases/2.0/alpha/dovecot-2.0.alpha2.tar.gz http://dovecot.org/releases/2.0/alpha/dovecot-2.0.alpha2.tar.gz.sig Changes since alpha1: - All debug messages are now logged to debug log (debug_log_path setting, defaults to info_log_path). Patch by Pascal Volk. - Added support for SORT=DISPLAY IMAP extension. - Added doveadm who command for listing currently logged in users. - ssl_ciphers_list: Disable anonymous and export ciphers by default. - mail_chroot can now contain %variables (e.g. /home/%u) - fixed a bad maildir crashing bug - ssl-params is now run with +15 priority when generating the ssl parameters - Redesigned how login processes log in and create imap/pop3 processes. This fixes several settings and some other problems, plus it's now also possible for a single imap/pop3 process to handle multiple connections. If you want to try this, modify master.conf: service imap { # comment out: #service_count = 1 # This should be at least the number of CPUs, maybe more (2-3x?) process_min_avail = 4 # Limit the number of clients a single process can handle. # Disk IO is blocking, so some commands can take a while. client_limit = 5 } It currently doesn't even try to group same user's connections to same process, they'll just go randomly to whichever process manages to accept it first. Some day perhaps there should be a new service in the middle that keeps track of existing connections and forwards new ones to right mail processes. v2.0.beta1 TODO list: - master.conf has to be somehow put into defaults, so doveconf -n doesn't show its contents. an example master.conf would be minimal and show only those settings that admin might want to change (and those would show up in doveconf -n) - verbose_proctitle=yes is now quite useless because of the imap/pop3 process creation change. Probably enable linux-proctitle-hack and start changing the proctitle much more often. For example it could contain the command that's currently being run by user. And login processes could contain how many client connections they currently have. And other processes too something similar.. - change plugin hook design to allow multiple users in same process to run different plugins See alpha1 release announcement for more about these TODO: - v1.x config backwards compatibility - dsync is buggy - config process is slow - tcp-wrappers support

4 4