- dovecot - dovecot.org

[Dovecot] TLS / SSL mixed w/ plaintext auth and virtual hosting
by Nathan M 27 Aug '09

27 Aug '09

Traditionally this server has only accepted plaintext authentications; however, we want to change that and enable TLS/SSL. The challenge is the server has hundreds of IP addresses it binds to to listen on ports 110/143. Enabling TLS/SSL is not an option because as this is a virtual hosting environment, if a connection comes in on any other hostname other than the specific one tied to the crt all mail clients will throw a mis-matched certificate error if TLS is initiated by the client, and a surprisingly large number of customers have "use TLS if available" selected in their clients. According to most of the suggestions on the list, I've setup 2 dovecot instances. The first listening on *:110 and *:143, and the second listening on 10.0.0.2:993 and 10.0.0.2:995. This works great for SSL support; however, I would also like to offer TLS to connections coming in on a single IP address. Because the server has hundreds of IPs, with new IPs adding all the time, seemingly the only way would be to configure every one of these IPs (as they occur) into the primary dovecot.conf file, and then only setup the single IP that's handling SSL/TLS in the dovecot-ssl.conf (the conf file the SSL/TLS instance loads). This can be time consuming and has no way to automate. It would be terrific if one of the following exists, or potentially could exist: 1. Ideal scenario. A config option which tells TLS to only respond on certain IPs. In our case if a connection attempts to initiate TLS on any IP address except 10.0.0.2, it would respond with no TLS support. This would be ideal as we could continue running just a single dovecot instance. 2. Secondary scenario. A way to exclude an IP from being bound to. Something like the following to bind to all except 10.0.0.2 listen = *:110, -10.0.0.2 As is, based on my understanding of the config neither of these are options. Any support for adding either of these options, or alternate ideas anyone might have? - N

4 7

[Dovecot] Fatal: Dovecot is already running
by Jim 27 Aug '09

27 Aug '09

We had a power outage here last night, and when the server rebooted, dovecot was unable to launch properly: 8/27/09 2:08:25 AM com.apple.SystemStarter[31] Starting dovecot 8/27/09 2:08:25 AM com.apple.SystemStarter[31] Fatal: Dovecot is already running with PID 143 (read from /usr/local/var/run/dovecot/ master.pid) 8/27/09 2:08:25 AM SystemStarter[31] dovecot (115) did not complete successfully When I checked the server and saw this, I simply started it via the command line, and it came right up, but of course that was hours later. Since this script is only called at startup, would it be safe to just delete master.pid before trying to start dovecot? The server here is OS X 10.5.7, dovecot is being called via a StartupItem. I had originally used a LaunchDaemon for starting this, but ran into issues because MySQL wasn't always ready when dovecot tried to launch, and dovecot would never come up as a result. Below is the script I'm using, which includes a check for MySQL: #!/bin/sh # A script to automatically start up policyd on system bootup . /etc/rc.common ConsoleMessage "dovecot - setting up" # wait for mysql start up IS_ALIVE=`/usr/local/mysql/bin/mysqladmin -umysql ping | grep -c 'alive'` while [ "$IS_ALIVE" != "1" ]; do sleep 5 ConsoleMessage "dovecot - waiting for MySQL" IS_ALIVE=`/usr/local/mysql/bin/mysqladmin -umysql ping | grep -c 'alive'` done StartService () { ConsoleMessage "Starting dovecot" /usr/local/sbin/dovecot } StopService () { return 0 } RestartService () { return 0 } RunService "$1"

2 1

[Dovecot] missing .dovecot.lda-dupes file in LDAP/virtual user environment
by Claudio Tassini 27 Aug '09

27 Aug '09

Hi, I'm running a postfix/dovecot/ldap setup and it works quite fine. I am now trying to setup a global sieve script to forward all incoming mails to a local user for vacation management (gnarwl). I can't user the vacation extension of the sieve script itself because it is not configurable enough (each user has his vacation message and status stored in LDAP). The problem is that when deliver runs the sieve script, it tries to create the .dovecot.lda-dupes inside the user homedir, even if I didn't use the vacation feature in the script. This is the error I get: Aug 27 15:19:23 myhostname deliver(user1(a)mydomain.it): file_dotlock_create( mydomain.it/1/user1(a)mydomain.it/Maildir/.dovecot.lda-dupes) failed: No such file or directory Important sections from config: master.cf deliver: dovecot unix - n n - - pipe flags=DRhu user=mail:mail argv=/usr/lib/dovecot/deliver -f ${sender} -d ${recipient} dovecot -n extract: mail_location: maildir:/maildirs/%h auth default: passdb: driver: ldap args: /etc/dovecot/dovecot-ldap.conf userdb: driver: passwd userdb: driver: ldap args: /etc/dovecot/dovecot-ldap.conf plugin: quota: maildir:User Quota acl: vfile:/etc/dovecot/acls sieve_global_path: /etc/dovecot/default.sieve and extract from dovecot-ldap.conf : user_attrs = mailMessageStore=home,maildirquota=quota_rule=*:backend=%$ user_filter = (&(|(mail=%u(a)mydomain.it )(mail=%u)(mailalternateaddress=%u)(mailequivalentaddress=%u))(objectclass=mailrecipient)(imap-status=true)) pass_attrs = mail=user,userPassword=password,mailMessageStore=userdb_home,mailquota=userdb_quota_rule=*:backend=%$ pass_filter = (&(|(mail=%u(a)mydomain.it )(mail=%u)(mailalternateaddress=%u)(mailequivalentaddress=%u))(objectclass=mailrecipient)(imap-status=true)) The global sieve script: require ["copy"]; if not address :is "to" "gnarwl@localhost" { redirect :copy "gnarwl@localhost"; } The format of the "home" userdb extra field as returned from the ldap is " mydomain.it/1/user1(a)mydomain.it/Maildir/" . This value is normally appended to the mail_location global parameter ( /maildirs ) to build a path of the form "/maildirs/mydomain.it/1/user1(a)mydomain.it/Maildir" . This works flawlessly when delivering mail, but seems that the sieve plugin ignores the "mail_location" and tries to write the dupes file in the home as it is returned from the ldap. Questions are: 1) Is it normal that lda tries to create the dupes file even if I am not using the vacation extension at all? 2) How can I tell LDA/sieve/whatever to prepend the mail_location to the home directory of the user for proper creation of the file? Many thanks in advance. -- Claudio Tassini

2 2

[Dovecot] Two server certificates for two common names
by Δημήτριος Καραπιπέ ρης 27 Aug '09

27 Aug '09

Hi there! I have two DNS records mail1.domain.tld mail2.domain.tld I have issued SSL server Certificates for both my domain names. Is it possible to tell dovecot to use both , depending on client access; clients using the mail1.domain.tld be served by the mail1.domain.tld .key and .cert and those using mail2.domain.tld be served by the mail2.domain.tld .key and .cert Thanks in advance Dimitrios

7 10

[Dovecot] Authentication failed, failure to login after changed password
by linuxvinit 27 Aug '09

27 Aug '09

I have installed dovecot 1.0 mail server on debian linux. I am using unix authentication to login the mail accounts. We developed one web mail application whcih use imap protocol and send mail fro sending the mail. We are creating unix user through our application and able to login to the mail account succesfully and do all opeartion on that. But once user change password through our application or directly on unix commaqnd prompt then we are unable to login to mail application it gives authentication failed error. Even user can use ssh, sftp after changing password. Everything works except mail account. Here is the error excerpt from log files (mail.log and auth.log ) respectively. Aug 26 10:58:37 digibeanz dovecot: imap-login: Aborted login (1 authentication attempts): user=<child2>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, TLS Aug 26 12:22:00 digibeanz dovecot-auth: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=child2 rhost=127.0.0.1 user=child2 Please help me. This is very urgent -- View this message in context: http://www.nabble.com/Authentication-failed%2C-failure-to-login-after-chang… Sent from the Dovecot mailing list archive at Nabble.com.

1 0

[Dovecot] Weird mirgration problem
by Stewart Dean 27 Aug '09

27 Aug '09

Most likely non-Dovecot, but I'd appreciate any comments on WTF might be going on here. Preparatory to migration from mbox to maildir format on our AIX mail server, I am migrating from the JFS filesystem (being deprecated by IBM) to JFS2 to better handling the jump in the number of files. Two nights ago, I took the first step and migrated the IT homedir filesystem: copied it to a scratch disk, melted down the FS and recreated it as a JFS2 FS. In order to keep changes from happening to it during this process, I killed off DC (dovecot -n ouput is appended to bottom of this note) and dropped the export of the FS. The bringup was a little ragged due to time constraints and the fact that I had trouble re-establishing the export. FWIW, the homedirs and Inobx FSes are mounted by a majordomo mailing list server. Everything went fine except for an anomaly with old pre-existing mailing list emails in my INBOX and that of a few others. Note that the inbox FS wasn't touched by this process, just the homedir FS for the IT department. What happened there was that the mbox headers went from looking like this: From owner-hcrcstaff Mon Aug 24 14:53:29 2009 >From majordom Mon Aug 24 14:53:29 2009 the rest of the normal header here To looking like this: From owner-hcrcstaff Mon Aug 24 14:53:29 2009 Status: RO X-UID: 871476 Content-Length: 1915 >From majordom Mon Aug 24 14:53:29 2009 normal header lines here It appears that the Status, X-UID and Content-Length lines were inserted just under the top line of the header in every old mailing list mailing email header...and not in any other mailing As a result of this, = these emails appear in the email client's TOC listing with blank Sender and Subject fields, even though the data for that is properly in the header further down = This happens both in TBird and Horde webmail. = All these emails (some 300, going back to 2008) are listed in one block, in proper order for their actual date, as having the datestamp of 5AM, when I was bringing everything back up. Unfortunately, because of time pressures, I can say exactly what I was doing then. = I never took down my TBird session while doing this process...and I imagine that others, who haven't said anything and presumably didn't have this problem, left their TBird or IMAP email client up... Does this anomaly bring to mind anything to you? FWIW, I plan on doing the students' homedir FS early tomorrow morning. This time I'll be more scrupulous about tracking things AND I will take down the mailing list and login servers to remove the possibility that they had something to do with this... dovecot -n output # 1.1.15: /usr/local/etc/dovecot.conf # OS: AIX 3 0001378F4C00 listen: *:143 ssl_listen: *:993 disable_plaintext_auth: no verbose_ssl: yes login_dir: /var/run/dovecot/login login_executable: /usr/local/libexec/dovecot/imap-login login_processes_count: 12 login_max_processes_count: 774 max_mail_processes: 1024 verbose_proctitle: yes first_valid_uid: 200 mail_location: mbox:~/mail:INBOX=/var/spool/mail/%u:INDEX=/var/dcindx/%u mbox_write_locks: fcntl mbox_dirty_syncs: no auth default: passdb: driver: pam userdb: driver: passwd -- ==== Once upon a time, the Internet was a friendly, neighbors-helping-neighbors small town, and no one locked their doors. Now it's like an apartment in Bed-Stuy: you need three heavy duty pick-proof locks, one of those braces that goes from the lock to the floor, and bars on the windows.... ==== Stewart Dean, Unix System Admin, Bard College, New York 12504 sdean(a)bard.edu voice: 845-758-7475, fax: 845-758-7035

2 1

[Dovecot] fchown() failed
by Arthur Dent 26 Aug '09

26 Aug '09

Hello all, I'm not sure if this question is better posed to a Fedora group because I have only had this problem since I upgraded from F9 to F11, but I figured that the specialised knowledge here might help me more... I have been getting these entries in syslog since upgrading. Today for instance I got: **Unmatched Entries** dovecot: Dovecot v1.2.0 starting up (core dumps disabled): 1 Time(s) dovecot: IMAP(mark): fchown() failed with file /home/mark/Mail/.imap/INBOX/dovecot.index.log.newlock: Operation not permitted: 1 Time(s) dovecot: IMAP(mark): fchown() failed with file /home/mark/Mail/.imap/INBOX/dovecot.index.tmp: Operation not permitted: 1 Time(s) and yesterday I had: **Unmatched Entries** dovecot: IMAP(helena): fchown() failed with file /home/wife/mail/.imap/INBOX/dovecot.index.tmp: Operation not permitted: 1 Time(s) dovecot: IMAP(toby): fchown() failed with file /home/son/mail/.imap/INBOX/dovecot.index.cache.lock: Operation not permitted: 1 Time(s) dovecot: IMAP(toby): fchown() failed with file /home/son/mail/.imap/INBOX/dovecot.index.log.newlock: Operation not permitted: 1 Time(s) dovecot: IMAP(toby): fchown() failed with file /home/son/mail/.imap/INBOX/dovecot.index.tmp: Operation not permitted: 3 Time(s) The permissions are as follows: ls -la /home/mark/Mail/.imap/INBOX/ total 328 drwx------. 2 mark mark 4096 2009-08-18 15:32 . drwx------. 84 mark mark 4096 2009-03-05 21:53 .. -rw-------. 1 mark mark 7472 2009-08-18 15:32 dovecot.index -rw-------. 1 mark mark 286720 2009-08-19 11:46 dovecot.index.cache -rw-------. 1 mark mark 5380 2009-08-19 12:43 dovecot.index.log Those of wife and son are similar. As I access my mailbox several times a day (and certainly did yesterday) from several different mail clients I am surprised that the error count is only 1 for most the above entries. Is this being caused by some sort of cron job (logrotate perhaps)? Any ideas? All help / suggestions gratefully received... Thanks Mark

2 2

[Dovecot] Load spikes on NFS server, multiple index updaters.
by Jorgen Lundman 26 Aug '09

26 Aug '09

We are occasionally experiencing trouble where the NFS server's load will shoot over 60+. (Normal of sub 1.0). I have been hunting this for a while, and I believe it comes down to "deliver". System setup: NFS servers: x4540 Solaris 10 x64 ZFS over NFS. NFS clients: Solaris 10 x64 postfix-2.4.1 with dovecot-1.1.11 deliver. What appears to happen, when I check for nfsstat per process, is that I see 4 processes (in this case on vmx04) taking up majority of NFS ops: root@vmx04:/var/tmp# ./nfsclientstats.pl process read write readdir getattr setattr lookup access create remove rename mkdir rmdir 24303 0 0 1 19 0 190 171 0 0 0 0 0 24551 0 0 1 18 0 180 162 0 0 0 0 0 26099 0 0 1 18 0 180 162 0 0 0 0 0 295 0 0 1 18 0 180 162 0 0 0 0 0 6793 3 0 0 0 0 5 5 0 0 0 0 0 7234 0 1 0 2 0 9 9 0 1 0 0 0 Checking what these processes are doing, I find the following happening: 26099: getdents64(8, 0xCE7A4000, 8192) = 8136 26099: stat64("/export/censored/mail/cur/1223013930.V4700010I69f93eM483098.vmx02.unix:2,S", 0x08047930) = 0 26099: stat64("/export/censored/mail/cur/1222066290.V4700007I67562bM241839.vmx04.unix:2,S", 0x08047930) = 0 26099: stat64("/export/censored/mail/cur/1225325373.V4700008I94a1f9M286935.vmx04.unix:2,S", 0x08047930) = 0 26099: stat64("/export/censored/mail/cur/1236170307.V4700002I67ca03M310418.vmx06.unix:2,", 0x08047930) = 0 26099: stat64("/export/censored/mail/cur/1223581462.V4700011I69ffd6M720814.vmx02.unix:2,S", 0x08047930) = 0 Very well, so it is rebuilding the dovecot.index, or recalculating the user's quota usage. Is the directory large? root@vmx04# ls -l /export/censored/mail/cur/|wc -l 199626 You bet! But what is annoying is that if I also check process 24303, 24551 and 295, they are scanning the SAME user's directory. 295: stat64("/export/censored/mail/cur/1230544947.V4700004I11d1d7fM492433.vmx04.unix:2,S", 0x08047930) = 0 295: stat64("/export/censored/mail/cur/1223003964.V4700007I68932dM763546.vmx04.unix:2,S", 0x08047930) = 0 So, in vmx04 we have 4 processes working in one user's giant directory, and on the other vmx clients, many more. Could the semantics to 're-computing dovecot.index' be done such that the first "deliver" process locks it to do the work, and sub-sequent deliver processes will return temporary failures, until the work has finished. Has it been already addresses in dovecot-1.1.18? Advice please. Lund -- Jorgen Lundman | <lundman(a)lundman.net> Unix Administrator | +81 (0)3 -5456-2687 ext 1017 (work) Shibuya-ku, Tokyo | +81 (0)90-5578-8500 (cell) Japan | +81 (0)3 -3375-1767 (home)

2 4

Re: [Dovecot] LDAP: Connection lost to LDAP server,
by Andrés A. Gómez Palacio 25 Aug '09

25 Aug '09

Hi i have: [root@mail log]# rpm -q dovecot dovecot-1.2.4-0_99.el5 and have the same problem with ldap (AD), in this release is not include the patch? (http://hg.dovecot.org/dovecot-1.2/rev/355d5a40f7a7) is normal the reconnection to ldap server? or exist any reazon for lose the connection? Aug 25 11:27:03 mail dovecot: auth-worker(default): LDAP: Connection lost to LDAP server, reconnecting Aug 25 11:37:34 mail dovecot: auth-worker(default): LDAP: Connection lost to LDAP server, reconnecting Aug 25 11:46:04 mail dovecot: auth-worker(default): LDAP: Connection lost to LDAP server, reconnecting Aug 25 11:52:34 mail dovecot: auth-worker(default): LDAP: Connection lost to LDAP server, reconnecting Aug 25 11:56:06 mail dovecot: auth-worker(default): LDAP: Connection lost to LDAP server, reconnecting Aug 25 12:01:07 mail dovecot: auth-worker(default): LDAP: Connection lost to LDAP server, reconnecting Aug 25 12:11:06 mail dovecot: auth-worker(default): LDAP: Connection lost to LDAP server, reconnecting Aug 25 12:16:07 mail dovecot: auth-worker(default): LDAP: Connection lost to LDAP server, reconnecting Aug 25 12:28:07 mail dovecot: auth-worker(default): LDAP: Connection lost to LDAP server, reconnecting ....... Message: 1 Date: Tue, 25 Aug 2009 18:13:28 +0400 From: McShel <McShel(a)yandex.ua> Subject: Re: [Dovecot] LDAP: Connection lost to LDAP server, reconnecting To: "Dovecot Mailing List"<dovecot(a)dovecot.org> Message-ID: <37911251209608(a)webmail126.yandex.ru> Content-Type: text/plain 25.08.09, 17:32, "Timo Sirainen" <tss(a)iki.fi>: > On Tue, 2009-08-25 at 16:09 +0400, McShel wrote: > > Hi! Sorry by my english. Set Postfix + dovecot + AD + ldap, everything works well, but appears in the logs, every 15 minutes: > > > > auth(default): Error: LDAP: Connection lost to LDAP server, reconnecting > > > > Standart limit ldap connect to AD 15 minutes. > > Can somehow fix this problem without increasing the time of connection to the AD? > This is actually a bug. Fixed: > http://hg.dovecot.org/dovecot-1.2/rev/355d5a40f7a7 > (The patch applies to v1.1 too) Thank you! You include this fix in the next release? ------------------------------ Message: 2 Date: Tue, 25 Aug 2009 10:24:58 -0400 From: Charles Marcus <CMarcus(a)Media-Brokers.com> Subject: Re: [Dovecot] LDAP: Connection lost to LDAP server, reconnecting To: McShel <McShel(a)yandex.ua> Cc: Dovecot Mailing List <dovecot(a)dovecot.org> Message-ID: <4A93F43A.8050009(a)Media-Brokers.com> Content-Type: text/plain; charset=ISO-8859-1 On 8/25/2009, McShel (McShel(a)yandex.ua) wrote: > Thank you! You include this fix in the next release? He always does... :) -- Best regards, Charles ------------------------------------------------------------------------------------------------------- DISCLAIMER NOTE: Este mensaje y/o sus anexos son para uso exclusivo de su destinatario intencional y puede contener información legalmente protegida por ser privilegiada o confidencial. Si usted no es el destinatario del mensaje, debe informarnos de inmediato, eliminar el mensaje y sus anexos de su computador. Le comunicamos que cualquier retención, revisión no autorizada, distribución, divulgación, reenvío, copia, impresión, reproducción o uso indebido de este mensaje y/o sus anexos, está estrictamente prohibida y sancionada legalmente. Este mensaje igualmente, puede contener información de carácter personal que no necesariamente refleja la opinión de AVANSOFT S.A. Este mensaje y sus anexos han sido sometidos a control con programas antivirus, por lo cual consideramos se encuentra libre de virus o cualquier anomalía que pueda afectar a terceros; sin embargo, el destinatario debe verificar con sus propios medios de protección, que lo recibido no está afectado por virus u otros defectos, en cuyo caso, el remitente no asume responsabilidad alguna por el recibo, transmisión y uso de este material.

2 1

[Dovecot] scalability and arhive ideas
by fernando＠dfcom.com.br 25 Aug '09

25 Aug '09

Hi, I´m reading the past topics related to archive and scalability of dovecot, they are all very interesting. Here, I´m using two dovecot proxies in front of five storages pairs, and we split the domain´s accounts among those servers. So, we can share the i/o load and if one server goes down only few accounts of the domain stops (not all of them). But, we began to have space problems - and the solution would be insert more and more storage servers. So I was searching for some archive solutions (hard links - at S.O level, or some dovecot extension). A friend told me that he knows an ISP that share even the mailbox of the users among many servers - this is very weird and (at same time) very interesting approach. Instead of put all messages into one maildir and this maildir into one server, this "maildir" (?) is spplited among many servers - so, if one servers fails the account is still acessible and they move old/big messages to a new "cheap" storage - archiving transparently. Well, maybe it´s an stupid idea, but couldn´t dovecot imap/pop proxy do the same ? I mean, imagine the following scenario: 1- Proxy does an user account sql - today the return is (among other data), the final server IP, but it could be the storage servers for this account 2- Proxy does parallel connections (instead of today´s one connection with the final server). Retrieve the messages and caches locally where the message is. If the cache is lost, no problem, it just connects again and re-cache them. 3- When a message is deleted/flagged, etc - it has the cache (allowing it to know where send the command to), when a message inserted (as sent folder) - the system can have the 'default storage' where the messages are delivered and saved to - the other storages are just for archiving (or even a round-robin delivery !? - hard to control). Problems: 1- Have the cache at proxy level. 2- Quota calculation (how the delivery process can check this ?) 3- Maybe mixing proxy connection and this new approach is not easy way. 4- the more servers, the more time waiting their answers (imagine one of them answering slowly). Advantages: 1- No local mounts at storage level - (as nfs and other network mounted partitions). 2- Servers independency - if space is at a critical value, insert a pair of servers, move messages there, insert the servers in the sql answer (server1, server2, server3, ... , serverN). 3- Scalability - the more servers, the more i/o load you can share. Well, sorry for the long post...but I hope to collaborate with some ideas (even if they are stupid :( ) Regards, Fernando Bertasso Figaro

3 8