- dovecot - dovecot.org

[Dovecot] Dovecot+PAM advice please?
by S. A. Woltering 14 Sep '09

14 Sep '09

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi all, sorry to bother you with this. I'm trying to set up an experimental system (which may become production if it ever gets off the ground) and it's not working. The short version: I'm trying to get Dovecot 1.2.4 to authenticate against a customised PAM module. In short, we're using a specialised OTP radius backend. One of my colleagues has coded up a PAM module for this backend. The IMAP service is on HP-UX11.23, IA64. The module is compiles into /usr/lib/security/hpux32 and is called "pam_cached_radius.so.0.0". The entry in /etc/pam.conf is: cached-radius auth required pam_cached_radius.so.0.0 The PAM module compiles OK, and my colleague's test suite (run, both as root and as our local "dovecot" user) works fine. When I use the following options in dovecot.conf: auth default { user = root mechanisms = plain passdb pam { args = cached-radius } userdb passwd { } } it fails leaving only the log entry below in syslog. Sep 14 09:15:15 elrond syslog: load_modules: can not open module /usr/lib/security/hpux32/pam_cached_radius.so.0.0 Sep 14 09:15:22 elrond syslog: load_modules: can not open module /usr/lib/security/hpux32/pam_cached_radius.so.0.0 (Always 2 entries). I appreciate that this probably isn't a dovecot issue per se, but it is suspicious that our test suite works and divecot can't access the module. I'd be most grateful if anyone could offer some possible avenues of investigation. Thanks, SAW - -- Steven-Ashley Woltering, MBCS, Systems Analyst, ECMWF, Shinfield Park, Reading, RG2 9AX, UK Tel.: +44 1189 499473 (internal x2473) Email: Steven.Woltering(a)ecmwf.int -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.4-svn0 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iD8DBQFKrhHch854NVK99FMRAnUiAJ9nOhLkGPFLGhEnhIwbk5V5RvGfPACghZUc 8HWimxrolkqhBkkjPD4AtQw= =WmSS -----END PGP SIGNATURE-----

2 5

[Dovecot] fchown failed
by Frank Bonnet 14 Sep '09

14 Sep '09

Hello I occasionally get the following error in dovecot log I've replaced the username by xxxxxxx /user is the user's home directories place, does this means it must be owned by the "mail" group ? Sep 14 09:20:48 IMAP(xxxxxxx): Error: fchown(/user/xxxxxxx/.imap/INBOX/dovecot.index.tmp, -1, 8(mail)) failed: Operation not permitted (egid=3420(math), group based on /var/mail/xxxxxxx) Thanks

3 2

[Dovecot] Problems getting Dovecot to work.
by Mark Gillespie 14 Sep '09

14 Sep '09

Hi, having a nightmare trying to get dovecot working on my SheevaPlug (flash based ARM embedded device). I need to use virtual users, and I need to store all the mail on an external USB HDD (not in home directories which live in the limited flash space). However I can't even log in via telnet. I've followed the Wiki troubleshooting tips, and still no further forward. logging via telnet, I get: "user sheeva BAD Error in IMAP command received by server." the logs show: ubuntu dovecot: User sheeva is missing UID (see mail_uid setting) What do I need to do? I know basic Linux stuff, but I wouldn't call myself an expert, so please no tech talks!!! -- Using Opera's revolutionary e-mail client: http://www.opera.com/mail/

3 2

[Dovecot] file->buffer_offset + file->buffer->used == file->sync_offset
by Edgar Fuß 14 Sep '09

14 Sep '09

I got the following panic on 1.2.3: Panic: file mail-transaction-log-append.c: line 88 (log_buffer_move_to_memory): assertion failed: (file->buffer_offset + file->buffer->used == file->sync_offset) It's probably related to the file system holding the indexes being full.

2 2

[Dovecot] GSSAPI Authentication in v1.2.1
by Phillip Macey 14 Sep '09

14 Sep '09

In the release notes for v1.2.2, Timo said: > Found and fixes several v1.2-specific bugs. Hopefully it's now stable > for most people's usage. > > * GSSAPI: More changes to authentication. Hopefully good now. > What were the GSSAPI changes? I am having problems with _some_ of my users using GSSAPI auth. I am using version 1.2.1. The client (thunderbird) reports that the server does not support 'secure authentication'. When I switch on auth_debug in dovecot, I see errors such as these in the logs: Aug 3 16:45:57 fury dovecot: auth(default): client in: AUTH 1 GSSAPI service=imap lip=10.1.0.20 rip=10.8.5.72 lport=143 rport=4027 Aug 3 16:45:57 fury dovecot: auth(default): gssapi(?,10.8.5.72): Using all keytab entries Aug 3 16:45:57 fury dovecot: auth(default): client out: CONT 1 Aug 3 16:45:57 fury dovecot: imap-login: Disconnected: Input buffer full (auth failed, 1 attempts): method=GSSAPI, rip=10.8.5.72, lip=10.1.0.20 Other users work perfectly (eg. all of the user accounts I tested against). Would this have been a bug that was fixed in 1.2.2 or is it something else? If it is most likely something else, I will post `dovecot -n`. -- Thanks, Phill Macey

4 11

Re: [Dovecot] Global ACL configuration problems: mailboxes not visible , set ACLs not honoured
by Andreas Ntaflos 14 Sep '09

14 Sep '09

On Tuesday 01 September 2009 12:11:39 Thomas Leuxner wrote: > On Tue, Sep 01, 2009 at 11:34:16AM +0200, Andreas Ntaflos wrote: > > Is there anything more to it? I ask, because I can't seem to get it > > to work correctly using this approach with global ACLs. Problems > > include: > > > > - Can't get the mailboxes "Spam" and "Ham" under the "Public" > > namespace to show up in the mail client (Thunderbird, KMail, > > Horde/IMP) at all. These have the ACL "authenticated lrwstipk" set > > so the should be visible to authenticated clients, shouldn't they? > > All I see is the namespace with no mailboxes beneath it. > > Hi Andreas, > > did you try with enabling the logging option 'mail_debug = yes'? It > should then verbosely log ACLs read while accessing the folders. How > about the files 'dovecot-acl' and 'dovecot-acl-list'? Are they > present in your public root? The latter should have been > automatically created once the subdirs have working ACLs. Hi Thomas, thanks for your helpful reply. I hadn't thought of setting mail_debug, don't know why :) Now I can see more clearly. It seems that ACL files such as "/etc/dovecot/acls/Backup.received" or "/etc/dovecot/acls/Backup.sent" are read, but when accessing the actual mailbox Dovecot looks for a file "/etc/dovecot/acls/received" or "/etc/dovecot/acls/sent". I.e. the mailbox names *without* the namespace prefix. This can't be the desired behaviour, can it? When I create such an ACL file (""/etc/dovecot/acls/sent") the defined restrictions seem to be applied. At least KMail doesn't even offer to "Delete message" anymore. Thunderbird does and messages can apparently be deleted, but they show up again upon reloading the folder. This is probably a Thunderbird issue. Horde/IMP is similar in this regard. The Public namespace however doesn't seem to be given any consideration at all by Dovecot. I can see the namespace root ("Public") in the folder subscription list, but nothing beneath it. Even when I apply the "fix" described in the previous paragraphs I still can't see any of the public folders. The log file doesn't show anything about this either. There are no "dovecot-acl" files at all, anywhere. I want to avoid having to use them, which is why I am trying to get global ACLs to work. The "dovecot-acl-list" files are created in every root directory, i.e. /var/mail/public/dovecot-acl-list, /var/vmail/example.org/username/Maildir/dovecot-acl-list and /var/vmail/example.org/username/Maildir-backup/dovecot-acl-list. All three are empty. So, the second issue (private namespace ACLs) could be a bug in Dovecot, unless I misunderstood how to name ACL files for mailboxes in other private namespaces. The first issue (invisibility of public folders) is still a mystery to me. Ideas? Thanks again for your reply! Andreas -- Andreas Ntaflos Vienna, Austria GPG Fingerprint: 6234 2E8E 5C81 C6CB E5EC 7E65 397C E2A8 090C A9B4

3 2

[Dovecot] Question regarding reverse quota_warning
by jeroen＠intuxicated.org 14 Sep '09

14 Sep '09

Hi Everyone, I have a question regarding reverse quota_warnings. I'm building a new setup, and I would like to block sending messages if a person is over his/her quota limit. Although this can be accomplished using a quota_warning script, I can't find how to accomplish the reverse. Has anyone tried to do something like this? By looking at the source code: ---- quote ---- if ((bytes_before < (uint64_t)warnings[i].rule.bytes_limit && bytes_current >= (uint64_t)warnings[i].rule.bytes_limit) || (count_before < (uint64_t)warnings[i].rule.count_limit && count_current >= (uint64_t)warnings[i].rule.count_limit)) { quota_warning_execute(root, warnings[i].command); break; } ----- /quote ----- I think it could be as simple as adding a second if statement and prefixing a string, but that's not a very clean solution. Best regards, Jeroen Koekkoek

2 1

[Dovecot] [DOVECOT] quota_warning threshold from ldap
by Emmanuel Gonzalez 14 Sep '09

14 Sep '09

Hello all, I'm trying to get dovecot read three different quota_warnings values directly from ldap. I configured correctly the quota_rule value, know I'm trying to override this values: quota_warning = storage=95%% /usr/local/bin/quota-warning.sh 95 quota_warning2 = storage=80%% /usr/local/bin/quota-warning.sh 80 quota_warning3 = storage=70%% /usr/local/bin/quota-warning.sh 70 reading the values 95, 80 and 70 from ldap. I tried to do this in my dovecot-ldap.conf user_attrs = mailMessageStore=mail=maildir:/maildirs/%$,maildirquota=quota_rule=*:backend, *maildirwarn1*=quota_warning = storage=*maildirwarn1%% */usr/local/bin/quota-warning.sh *maildirwarn1%%* I'm sure that I'm doing something wrong. Any ideas? This is my configuration: # dovecot --version 1.2.4 # dovecot -n # 1.2.4: /etc/dovecot.conf # OS: Linux 2.6.18-128.7.1.el5PAE i686 CentOS release 5.3 (Final) log_path: /var/log/dovecot-deliver.log info_log_path: /var/log/dovecot-deliver.log log_timestamp: %Y-%m-%d %H:%M:%S listen(default): localhost:143 listen(imap): localhost:143 listen(pop3): *, [::] ssl: no login_dir: /var/run/dovecot/login login_executable(default): /usr/libexec/dovecot/imap-login login_executable(imap): /usr/libexec/dovecot/imap-login login_executable(pop3): /usr/libexec/dovecot/pop3-login first_valid_uid: 8 first_valid_gid: 12 mail_privileged_group: mail mail_uid: 8 mail_gid: 12 mail_location: maildir:~/Maildir mail_debug: yes mail_executable(default): /usr/libexec/dovecot/imap mail_executable(imap): /usr/libexec/dovecot/imap mail_executable(pop3): /usr/libexec/dovecot/pop3 mail_plugins(default): quota imap_quota acl imap_acl mail_plugins(imap): quota imap_quota acl imap_acl mail_plugins(pop3): mail_plugin_dir(default): /usr/lib/dovecot/imap mail_plugin_dir(imap): /usr/lib/dovecot/imap mail_plugin_dir(pop3): /usr/lib/dovecot/pop3 namespace: type: private separator: / inbox: yes list: yes subscriptions: yes namespace: type: shared separator: / prefix: shared/%%u/ location: maildir:/maildirs/%%d/%%u/Maildir list: children lda: postmaster_address: postmaster(a)mydomain.it mail_plugins: quota log_debug: /var/log/dovecot-deliver.log auth_socket_path: /var/run/dovecot/auth-master auth default: default_realm: mydomain.it verbose: yes debug: yes passdb: driver: ldap args: /etc/dovecot-ldap.conf userdb: driver: passwd userdb: driver: ldap args: /etc/dovecot-ldap.conf socket: type: listen client: path: /var/spool/postfix/private/auth mode: 432 user: postfix group: postfix master: path: /var/run/dovecot/auth-master mode: 384 user: mail group: mail plugin: quota: maildir acl: vfile acl_shared_dict: file:/maildirs/shared-mailboxes # grep -v '^ *$#.*$\?$' /etc/dovecot-ldap.conf hosts = localhost sasl_bind = no auth_bind = yes ldap_version = 3 base = dc=mydomain,dc=it scope = subtree user_attrs = mailMessageStore=mail=maildir:/maildirs/%$,maildirquota=quota_rule=*:backend user_filter = (&(objectClass=inetOrgPerson)(mail=%u)) pass_attrs = mail=user,userPassword=password,mailMessageStore=userdb_home pass_filter = (&(objectClass=inetOrgPerson)(mail=%u)) Some important values from my ldap # /usr/lib/mozldap/ldapsearch -h localhost -D "cn=Directory Manager" -w XXXXXXXX -b "dc=mydomain,dc=it" "mail=user(a)mydomain.it" version: 1 dn: uid=user,ou=People,dc=mydomain.it,dc=mydomain,dc=it givenName: user mailProgramDeliveryInfo: /maildirs/ vacationMessage: Modificare questo messaggio mailMessageStore: mydomain.it/user(a)mydomain.it/Maildir/ uid: user mail: user(a)mydomain.it cn: user sn: user *maildirQuota: 51200S* *maildirwarn1: 70 maildirwarn2: 80 maildirwarn3: 90* mailHost: localhost mailmaxmessagesize: 10485760

2 1

[Dovecot] Security holes in CMU Sieve plugin
by Timo Sirainen 14 Sep '09

14 Sep '09

A recently found security hole in Cyrus Sieve exists also in Dovecot, because Dovecot's Sieve plugin is based on libsieve from Cyrus project. I also found and fixed a few additional buffer overflows that I can't really understand why I hadn't noticed/fixed before. This security hole affects all installations that give their users any kind of ability to modify their Sieve scripts. Even if you give only limited access it might be enough for an attacker. For example forwarding a user's mails to about 100 addresses should do the trick. Since these are buffer overflows for variables in stack, they're very likely exploitable and allow attackers to execute arbitrary code as the user. Note that this security hole doesn't exist in Stephan Bosch's excellent new Sieve plugin for Dovecot v1.2. I encourage everyone to switch to using it as soon as possible. Who knows what other holes still lurk in libsieve. The bugs are fixed in v1.1.7 release for Dovecot v1.1+: http://dovecot.org/releases/sieve/dovecot-sieve-1.1.7.tar.gz http://dovecot.org/releases/sieve/dovecot-sieve-1.1.7.tar.gz.sig and in v1.0.4 release for Dovecot v1.0: http://dovecot.org/releases/sieve/dovecot-sieve-1.0.4.tar.gz http://dovecot.org/releases/sieve/dovecot-sieve-1.0.4.tar.gz.sig You can also get them as a patch: http://hg.dovecot.org/dovecot-sieve-1.1/rev/049f22520628 http://hg.dovecot.org/dovecot-sieve-1.1/rev/4577c4e1130d

1 0

[Dovecot] Sieve and locale (Japanese)
by Jorgen Lundman 14 Sep '09

14 Sep '09

I have setup Dovecot-1.2 'delivery' to use Dovecot's Sieve as well (both versions are latest from dovecot.org) I am curious if sieve can handle Japanese, or locale, in general in the language. In particular, the subject which is encoded even more complicated. if header :contains "subject" ["test", "テスト"] { So if I want to file based on above, test, and tesuto (utf-8). Most Japanese mail is send in iso-2022-jp, will it use iconv to change to utf-8 before the test? Then handle the Subject encoding? (It's also possible to be in EUC-JP, but that is unusual). Or is it something on TODO? -- Jorgen Lundman | <lundman(a)lundman.net> Unix Administrator | +81 (0)3 -5456-2687 ext 1017 (work) Shibuya-ku, Tokyo | +81 (0)90-5578-8500 (cell) Japan | +81 (0)3 -3375-1767 (home)

3 7