- dovecot - dovecot.org

[Dovecot] GSSAPI Authentication Broke with Dovecot 1.1.16 -> 1.2.4 Upgrade
by John Marshall 29 Aug '09

29 Aug '09

This morning I upgraded a dovecot installation from 1.1.16 to 1.2.4 on a FreeBSD 7.2 server, and then spent 3 hours trying to figure out why GSSAPI authentication had broken. It turned out to be a recent change in Dovecot's mech-gssapi.c to do with checking for NULs in usernames: everything worked fine when I disabled that test. <http://hg.dovecot.org/dovecot-1.2/rev/5d53b1d66d1b> This is what I was seeing in the log file with auth_debug enabled: ------------------------ auth(default): client in: AUTH 1 GSSAPI service=imap secured lip=192.0.2.36 rip=192.0.2.168 lport=143 rport=51168 auth(default): gssapi(?,192.0.2.168): Obtaining credentials for imap(a)mail1.example.com auth(default): client out: CONT 1 auth(default): client in: CONT<hidden> auth(default): gssapi(john(a)EXAMPLE.COM,192.0.2.168): security context state completed. auth(default): client out: CONT 1 YGwGCSqGSIb3EgECAgIAb10wW6ADAgEFoQMCAQ+iTzBNoAMCARCiRgREIuGJR3fqiMdvWjEg6utI7bt3fZuI8Ulk4LoFu59aMgnX+Kivdohxin2A71UCEC7oG0sVYe7vrTjg2N9s27D1BLRuJbQ= auth(default): client in: CONT<hidden> auth(default): gssapi(john(a)EXAMPLE.COM,192.0.2.168): Negotiated security layer auth(default): client out: CONT 1 YD8GCSqGSIb3EgECAgIBBAD/////MINNkeu5LVS8fiZNSnb8j8iKBuHArr/sHec++VYV+9SSc+RkAf///wQEBAQ= auth(default): client in: CONT<hidden> auth(default): gssapi(john(a)EXAMPLE.COM,192.0.2.168): authz_name has NULs auth(default): client out: FAIL 1 user=john(a)EXAMPLE.COM imap-login: Disconnected (auth failed, 1 attempts): user=<john(a)EXAMPLE.COM>, method=GSSAPI, rip=192.0.2.168, lip=192.0.2.36, TLS: Disconnected ------------------------ I commented out the 'return -1;' at the end of the if(data_has_nuls) block (to preserve the log message but fall through), rebuilt, and everything works again. ------------------------ auth(default): gssapi(john(a)EXAMPLE.COM,192.0.2.168): authz_name has NULs auth(default): client out: OK 1 user=john(a)EXAMPLE.COM ------------------------ I tried building dovecot 1.2.4 with Heimdal 0.6.3, 1.0.1 and 1.2.1 and all gave the same result. Is it possible that the data_has_nuls test doesn't work as intended or that it only works with MIT Kerberos? Thank you. -- John Marshall

2 4

[Dovecot] [Fwd: Re: Question about ACL/flags]
by Timo Sirainen 28 Aug '09

28 Aug '09

Your To: field was interesting.. Shouldn't mailman have changed it? Oh well.

1 0

[Dovecot] ACL in public folders
by Keith Edmunds 28 Aug '09

28 Aug '09

# dovecot --version 1.2.1 I'm trying to configure ACLs for public folders. I have: -------------------------------------------------------------------------------- namespace public { separator = / prefix = shared2/ location = maildir:/home/pubfolders2:INDEX=~/Maildir/public2 subscriptions = no list = children } protocol imap { mail_plugins = acl } plugin { acl = vfile } -------------------------------------------------------------------------------- I have /home/pubfolders2/dovecot-acl containing: user=xyz lrwstiekxa I've also hardlinked the file to /home/pubfolders2/.info (one of the public folders: that dir contains cur,tmp,new). Since enabling ACLs in dovecot.conf, none of the users see the 'shared2' namespace. I've clearly misunderstood something. I'm expecting user xyz to be able to see the public folder. Grateful for any pointers. Thanks, Keith

2 7

[Dovecot] Authentication failed, failure to login after changed password
by Vinit Jain 28 Aug '09

28 Aug '09

Hi, I have installed dovecot 1.0 mail server on debian linux. I am using unix authentication to login the mail accounts. We developed one web mail application whcih use imap protocol and send mail fro sending the mail. We are creating unix user through our application and able to login to the mail account succesfully and do all opeartion on that. But once user change password through our application or directly on unix commaqnd prompt then we are unable to login to mail application it gives authentication failed error. Even user can use ssh, sftp after changing password. Everything works except mail account. Here is the error excerpt from log files (mail.log and auth.log ) respectively. Aug 26 10:58:37 digibeanz dovecot: imap-login: Aborted login (1 authentication attempts): user=<child2>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, TLS Aug 26 12:22:00 digibeanz dovecot-auth: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=child2 rhost=127.0.0.1 user=child2 Please help me. This is very urgent Regards, linuxvinit _________________________________________________________________ Log on to MSN India for a lowdown on what’s hot in the world today http://in.msn.com

3 2

[Dovecot] Question about ACL/flags
by Eric Jon Rostetter 28 Aug '09

28 Aug '09

Okay, I'm cruising the wiki, and it is at best confusing to me. Maybe someone on the list can help me out quickly? Here is what I have: dovecot 1.1.18, mbox format, currently no acl/namespace/etc. All works great. What I want to be able to do: Have an email account (or folder or mailbox) which can be accessed by several people (say 3) with per-user seen flags. That is, say 3 people all access the mail but each user has their own seen flag for the messages. This would hopefully be done with mbox still, if possible, but I'm willing to try a mixed mbox/maildir setup if required to accomplish the goal. Questions: 1) Can I do this with 1.1.18, or do I need to upgrade? 2) Do I need to set :CONTROL in mail_location, and if so, what should I set it to, and what does this control exactly (more precisely, does this info need to be HA or not, etc) Is this where the seen flag info will be stored (or is that in INDEXES)? 3) Can I do this with mbox only, or do I need maildir, or does it depend on dovecot version? 4) Any additional help you can give me... I basically understand the ideas behind it all, but from the wiki I'm confused exactly what I need to do, and what version I might need. (If the wiki example is for dovecot 1.2+, does that mean it won't work in 1.1, or just that it has to be done differently, etc). Any help (clearing up my obvious confusion) would be appreciated... Step by step directions would be even better! :) -- Eric Rostetter The Department of Physics The University of Texas at Austin This message is provided "AS IS" without warranty of any kind, either expressed or implied. Use this message at your own risk.

1 0

[Dovecot] runaway imap processes
by rpyne＠kinfolk.org 27 Aug '09

27 Aug '09

I am running dovecot (1.2.3) with postfix (2.6.3), postfixadmin (2.1.0), maia mailguard (1.0.2) and squirrelmail (1.4.19) on Linux (kernel 2.6.27.8). I have an ongoing problem with imap processes that hang and eat all available cpu. I try killing them and they won't die. The only way to get rid of them is to reboot the server. Any help with this will be greatly appreciated. I really need to get this solved as it has been an ongoing problem for more than a year.

2 1

[Dovecot] TLS / SSL mixed w/ plaintext auth and virtual hosting
by Nathan M 27 Aug '09

27 Aug '09

Traditionally this server has only accepted plaintext authentications; however, we want to change that and enable TLS/SSL. The challenge is the server has hundreds of IP addresses it binds to to listen on ports 110/143. Enabling TLS/SSL is not an option because as this is a virtual hosting environment, if a connection comes in on any other hostname other than the specific one tied to the crt all mail clients will throw a mis-matched certificate error if TLS is initiated by the client, and a surprisingly large number of customers have "use TLS if available" selected in their clients. According to most of the suggestions on the list, I've setup 2 dovecot instances. The first listening on *:110 and *:143, and the second listening on 10.0.0.2:993 and 10.0.0.2:995. This works great for SSL support; however, I would also like to offer TLS to connections coming in on a single IP address. Because the server has hundreds of IPs, with new IPs adding all the time, seemingly the only way would be to configure every one of these IPs (as they occur) into the primary dovecot.conf file, and then only setup the single IP that's handling SSL/TLS in the dovecot-ssl.conf (the conf file the SSL/TLS instance loads). This can be time consuming and has no way to automate. It would be terrific if one of the following exists, or potentially could exist: 1. Ideal scenario. A config option which tells TLS to only respond on certain IPs. In our case if a connection attempts to initiate TLS on any IP address except 10.0.0.2, it would respond with no TLS support. This would be ideal as we could continue running just a single dovecot instance. 2. Secondary scenario. A way to exclude an IP from being bound to. Something like the following to bind to all except 10.0.0.2 listen = *:110, -10.0.0.2 As is, based on my understanding of the config neither of these are options. Any support for adding either of these options, or alternate ideas anyone might have? - N

4 7

[Dovecot] Fatal: Dovecot is already running
by Jim 27 Aug '09

27 Aug '09

We had a power outage here last night, and when the server rebooted, dovecot was unable to launch properly: 8/27/09 2:08:25 AM com.apple.SystemStarter[31] Starting dovecot 8/27/09 2:08:25 AM com.apple.SystemStarter[31] Fatal: Dovecot is already running with PID 143 (read from /usr/local/var/run/dovecot/ master.pid) 8/27/09 2:08:25 AM SystemStarter[31] dovecot (115) did not complete successfully When I checked the server and saw this, I simply started it via the command line, and it came right up, but of course that was hours later. Since this script is only called at startup, would it be safe to just delete master.pid before trying to start dovecot? The server here is OS X 10.5.7, dovecot is being called via a StartupItem. I had originally used a LaunchDaemon for starting this, but ran into issues because MySQL wasn't always ready when dovecot tried to launch, and dovecot would never come up as a result. Below is the script I'm using, which includes a check for MySQL: #!/bin/sh # A script to automatically start up policyd on system bootup . /etc/rc.common ConsoleMessage "dovecot - setting up" # wait for mysql start up IS_ALIVE=`/usr/local/mysql/bin/mysqladmin -umysql ping | grep -c 'alive'` while [ "$IS_ALIVE" != "1" ]; do sleep 5 ConsoleMessage "dovecot - waiting for MySQL" IS_ALIVE=`/usr/local/mysql/bin/mysqladmin -umysql ping | grep -c 'alive'` done StartService () { ConsoleMessage "Starting dovecot" /usr/local/sbin/dovecot } StopService () { return 0 } RestartService () { return 0 } RunService "$1"

2 1

[Dovecot] missing .dovecot.lda-dupes file in LDAP/virtual user environment
by Claudio Tassini 27 Aug '09

27 Aug '09

Hi, I'm running a postfix/dovecot/ldap setup and it works quite fine. I am now trying to setup a global sieve script to forward all incoming mails to a local user for vacation management (gnarwl). I can't user the vacation extension of the sieve script itself because it is not configurable enough (each user has his vacation message and status stored in LDAP). The problem is that when deliver runs the sieve script, it tries to create the .dovecot.lda-dupes inside the user homedir, even if I didn't use the vacation feature in the script. This is the error I get: Aug 27 15:19:23 myhostname deliver(user1(a)mydomain.it): file_dotlock_create( mydomain.it/1/user1(a)mydomain.it/Maildir/.dovecot.lda-dupes) failed: No such file or directory Important sections from config: master.cf deliver: dovecot unix - n n - - pipe flags=DRhu user=mail:mail argv=/usr/lib/dovecot/deliver -f ${sender} -d ${recipient} dovecot -n extract: mail_location: maildir:/maildirs/%h auth default: passdb: driver: ldap args: /etc/dovecot/dovecot-ldap.conf userdb: driver: passwd userdb: driver: ldap args: /etc/dovecot/dovecot-ldap.conf plugin: quota: maildir:User Quota acl: vfile:/etc/dovecot/acls sieve_global_path: /etc/dovecot/default.sieve and extract from dovecot-ldap.conf : user_attrs = mailMessageStore=home,maildirquota=quota_rule=*:backend=%$ user_filter = (&(|(mail=%u(a)mydomain.it )(mail=%u)(mailalternateaddress=%u)(mailequivalentaddress=%u))(objectclass=mailrecipient)(imap-status=true)) pass_attrs = mail=user,userPassword=password,mailMessageStore=userdb_home,mailquota=userdb_quota_rule=*:backend=%$ pass_filter = (&(|(mail=%u(a)mydomain.it )(mail=%u)(mailalternateaddress=%u)(mailequivalentaddress=%u))(objectclass=mailrecipient)(imap-status=true)) The global sieve script: require ["copy"]; if not address :is "to" "gnarwl@localhost" { redirect :copy "gnarwl@localhost"; } The format of the "home" userdb extra field as returned from the ldap is " mydomain.it/1/user1(a)mydomain.it/Maildir/" . This value is normally appended to the mail_location global parameter ( /maildirs ) to build a path of the form "/maildirs/mydomain.it/1/user1(a)mydomain.it/Maildir" . This works flawlessly when delivering mail, but seems that the sieve plugin ignores the "mail_location" and tries to write the dupes file in the home as it is returned from the ldap. Questions are: 1) Is it normal that lda tries to create the dupes file even if I am not using the vacation extension at all? 2) How can I tell LDA/sieve/whatever to prepend the mail_location to the home directory of the user for proper creation of the file? Many thanks in advance. -- Claudio Tassini

2 2

[Dovecot] Two server certificates for two common names
by Δημήτριος Καραπιπέ ρης 27 Aug '09

27 Aug '09

Hi there! I have two DNS records mail1.domain.tld mail2.domain.tld I have issued SSL server Certificates for both my domain names. Is it possible to tell dovecot to use both , depending on client access; clients using the mail1.domain.tld be served by the mail1.domain.tld .key and .cert and those using mail2.domain.tld be served by the mail2.domain.tld .key and .cert Thanks in advance Dimitrios

7 10