- dovecot - dovecot.org

[Dovecot] Mail replication
by Renaud Allard 18 Apr '09

18 Apr '09

Hello, I am running an asynchronously replicated mail setup. 2 servers are each running an smtp server which uses dovecot as the LDA. I am using unison to replicate mail files between servers. Before, I was using Maildir format and after reading so much good papers about the very good performance of dbox format, I decided to switch to dbox. However, I now have a very annoying problem, as mails are created with names like u.1234 and numbers are following each others. So, if there is for example a mail stored as u.1001 on both servers, and now 2 mails arrive at about the same time, 1 on each server. Then, they will both be created as u.1002, that means unison will encounter a conflict as both files are different. So my question would be, is there a way to tell the servers to increment by 2 instead of 1 and have each an offset (like you can do with mysql with auto incrementing tables for example)? That way, with former example, one mail would be stored as u.1002 and the other as u.1003. Thanks

2 3

[Dovecot] Logging to see exactly all IMAP commands?
by Johan Persson 18 Apr '09

18 Apr '09

I was wondering if there is some additional logging that can be enabled to make it possible to have Dovecot print all actual IMAP commands it receives in a conversation? /Johan

2 2

[Dovecot] Feature Request: Control over IMP IDLE 'OK Still Here' message timings
by Robert Goldsmith 18 Apr '09

18 Apr '09

Hi all, I would like to make a feature request regarding IMAP Idle support. Currently when a client triggers Idle support, Dovecot then sends 'OK Still Here' messages every 2 minutes. This is apparently to prevent NAT systems killing the tcp connection and disconnecting the client. However, while this may be fine for desktop clients, this rapidly drains the battery life of mobile clients such as phones. Unfortunately, the timing control on this behaviour is a c define at the top of cmd-idle.c and is only adjustable at compile-time. I have experimented with this define and find a timeout of 20 minutes between 'OK' messages is perfectly adequate for my system setup and results in a significant battery saving for my Nokia 6120c (increasing from ~ 6 hours to ~ 55 hours from full charge to low battery warning). Therefore, can you please make the timeout changeable from the config file, even if it defaults to the current 2min timing, so admins supporting mobile users can balance battery life with a need to prevent killed tcp connections. Thanks Robert Goldsmith --- GnuPG public key: http://www.Far-Blue.co.uk

3 2

[Dovecot] Shared folders and subscriptions
by Markus Werner 18 Apr '09

18 Apr '09

Hi, I've got a problem with user shared folders and subscriptions. When I try to subscribe a folder, dovecot returns "OK Subscribe completed", but the newly subscribed folder is not listed with LSUB: a1 login test(a)example.com ******* a1 OK [CAP..... a2 list "" "*" * LIST (\HasChildren) "/" "INBOX" * LIST (\Noselect \HasChildren) "/" "#User" * LIST (\Noselect \HasChildren) "/" "#User/markus(a)example.com" * LIST (\HasNoChildren) "/" "#User/markus(a)example.com/ForTest" a3 subscribe "#User/markus(a)example.com/ForTest" a3 OK Subscribe completed. a4 lsub "" "*" * LSUB (\Noselect) "/" "#User/markus(a)example.com" Dovecot is 1.2-rc3, namespace configuration as follows: namespace private { separator = / prefix = INBOX/ inbox = yes subscriptions = yes } namespace public { separator = / prefix = "#Shared/" location = maildir:/var/spool/dovecot/sharedfolders:INDEX=~/Maildir/index/public:CONTROL=~/Maildir/control/public subscriptions = yes } namespace shared { separator = / prefix = "#User/%%u/" location = maildir:%%h/Maildir:INDEX=~/Maildir/index/shared/%%u:CONTROL=~/Maildir/control/shared subscriptions = yes list = yes } I tried without CONTROL= directory in the shared namespace, but that made no difference. Contents of the subscriptions (with CONTROL=) file after subscribing: ForTestUser Regards, Markus

2 6

[Dovecot] Sieve "redirect"
by James Butler 18 Apr '09

18 Apr '09

Is there an alternative to the "redirect" Sieve capability? For example: if header :contains "Subject" "Listserv" { redirect "list-user1(a)example.com"; redirect "list-user2(a)example.com"; redirect "list-user3(a)example.com"; stop; } How can I do the above without using "redirect"? Unfortunately, "redirect" seems to be unsupported by Dovecot. Thank you. James

3 3

[Dovecot] Address Extensions with System Users
by Jeff Grossman 18 Apr '09

18 Apr '09

I am using Dovecot 1.2RC2 with Postfix 2.5.5. Everything is running fine. I would like to start using address extensions and have e-mail automatically filtered into folders based on the folder name after the "+" in the e-mail address. I only use system users, no virtual users. I have Deliver configured in main.cf as: mailbox_command = /usr/local/libexec/dovecot/deliver Everything I can find about setting this up applies to virtual users which I do not have. How do I get Deliver to recognize the address extension. I am sure it is easy, and I apologize for not finding the answer out myself. Here is a copy of my dovecot -n output: # 1.2.rc2: /usr/local/etc/dovecot.conf # OS: Linux 2.6.29-1-amd64 x86_64 Debian squeeze/sid base_dir: /var/run/dovecot/ protocols: imap imaps pop3 pop3s ssl_cert_file: /etc/ssl/certs/stikman-godaddy.crt ssl_key_file: /etc/ssl/private/stikman-godaddy.key ssl_cipher_list: ALL:!LOW:!SSLv2 disable_plaintext_auth: no login_dir: /var/run/dovecot//login login_executable(default): /usr/local/libexec/dovecot/imap-login login_executable(imap): /usr/local/libexec/dovecot/imap-login login_executable(pop3): /usr/local/libexec/dovecot/pop3-login mail_location: maildir:~/Maildir mail_executable(default): /usr/local/libexec/dovecot/imap mail_executable(imap): /usr/local/libexec/dovecot/imap mail_executable(pop3): /usr/local/libexec/dovecot/pop3 mail_plugin_dir(default): /usr/local/lib/dovecot/imap mail_plugin_dir(imap): /usr/local/lib/dovecot/imap mail_plugin_dir(pop3): /usr/local/lib/dovecot/pop3 auth default: mechanisms: plain login passdb: driver: pam userdb: driver: passwd plugin: sieve: sieve

4 10

[Dovecot] Setup Question
by Jeff Grossman 17 Apr '09

17 Apr '09

I really want to try and get this plus addressing working correctly with Dovecot and Postfix. After doing some reading I think I am going to change my Postfix setup from mailbox_command to mailbox_transport. I have a few questions to make sure I am thinking correctly. All of my users are system users. Their mail is delivered directly to their "/home/<user>/Maildir" directory. Everything works great and I have no problems. Here is what I am thinking of doing. 1. Create a new vmail user and group. 2. Have all mail delivered for each user to the "/home/vmail/<user>/" directory. All mail will be owned by vmail, but that is okay since Dovecot is the only thing touching the mail files anyway. 3. Change the mail_location setting in dovecot.conf to "mail_location = /home/vmail/%u 4. Uncomment the auth_socket_path = /var/run/dovecot/auth-master setting in dovecot.conf 5. Switch Postfix's main.cf to use "mailbox_transport = dovecot" and put the following line in master.cf: 1. dovecot unix - n n - - pipe flags=DR user=vmail:vmail argv=/usr/local/libexec/dovecot/deliver -f ${sender} -d ${recipient} -n -m ${extension} 6. Copy the current users mail to the new vmail location. What is the best way to copy it preserving date and time stamps on the mail? Did I cover all of the steps are am I missing something? Here is a copy of my current dovecot -n output. Thanks for any help you can offer me. # 1.2.rc3: /usr/local/etc/dovecot.conf # OS: Linux 2.6.29-1-amd64 x86_64 Debian squeeze/sid base_dir: /var/run/dovecot/ protocols: imap imaps pop3 pop3s ssl_cert_file: /etc/ssl/certs/ssl.crt ssl_key_file: /etc/ssl/private/ssl.key ssl_cipher_list: ALL:!LOW:!SSLv2 disable_plaintext_auth: no login_dir: /var/run/dovecot//login login_executable(default): /usr/local/libexec/dovecot/imap-login login_executable(imap): /usr/local/libexec/dovecot/imap-login login_executable(pop3): /usr/local/libexec/dovecot/pop3-login mail_location: maildir:~/Maildir mail_executable(default): /usr/local/libexec/dovecot/imap mail_executable(imap): /usr/local/libexec/dovecot/imap mail_executable(pop3): /usr/local/libexec/dovecot/pop3 mail_plugin_dir(default): /usr/local/lib/dovecot/imap mail_plugin_dir(imap): /usr/local/lib/dovecot/imap mail_plugin_dir(pop3): /usr/local/lib/dovecot/pop3 auth default: mechanisms: plain login passdb: driver: pam userdb: driver: passwd plugin: sieve: sieve

3 10

[Dovecot] Active Directory LDAP authentication fails after a time
by noahisaac 17 Apr '09

17 Apr '09

Hi - I've got Dovecot version 1.0.7 running on a CentOS 5.2 machine. It's serving pop, imap and imaps and authenticating against an Active Directory machine. This all works fine at first, but after about two weeks or so, dovecot's authentication against AD starts to fail. All of dovecot's authentication attempts time out. I also have postfix on the same machine authenticating against the same AD, and it does not seem to experience this issue. If I restart dovecot, the authentication starts working again. I've gone over /var/log/maillog, but I don't see anything particularly useful. The only thing I really see is: dovecot: IMAP(noah): Disconnected for inactivity Here's some of the relevant portions of my configs: dovecot.conf auth default { mechanisms = plain passdb ldap { args = /etc/dovecot-ldap.conf } passdb passwd-file { args = /etc/dovecot/passdb master = yes } userdb static { args = uid=vmail gid=vmail home=/home/vmail/%u } user = root } dovecot-ldap.conf hosts = admachine.domain.com base = dc=domain,dc=com ldap_version = 3 auth_bind = yes auth_bind_userdn = DOMAIN\%u Does anybody have any ideas about why this is happening, or maybe just an idea about how to better troubleshoot it? If you need any more info, I'll be happy to provide it. Can I tell dovecot to be a little more verbose with it's log entries (I've already got auth_debug set to yes, but I'm not getting very much info)? Thanks! Noah -- View this message in context: http://www.nabble.com/Active-Directory-LDAP-authentication-fails-after-a-ti… Sent from the Dovecot mailing list archive at Nabble.com.

4 3

[Dovecot] SELinux and "i_stream_read() failed: Permission denied"
by James Butler 17 Apr '09

17 Apr '09

Not a problem ... sharing a solution (this time)! Please correct my understanding of the process, if required. "i_stream_read() failed: Permission denied" is an error message generated when a large-ish file (>128kb in my case) is attached to a message that has been passed to Dovecot's deliver program when SELinux is being enforced. In my case, these messages are first run through Spamassassin, then passed to deliver, however the SELinux policy that is being violated relates to deliver, and not to Spamassassin, even though I do NOT generate the errors WITHOUT running Spamassassin. I'm not going to guess as to why that is. The policies below resolve the issue, and now large-ish (even LARGE) attachments come through without a whimper with Postfix+Spamassassin+Dovecot. The problem is that deliver is not running with the correct SELinux policy to be able to write to the global /tmp directory (in my case, after receiving the big attachment from SA), even if that directory's permissions allow it. (Bless you, SELinux!) Small-ish file attachments do not trigger this deliver functionality. Here's a complete error message, and its subsequent errors in the course of delivering a large-ish message+attachment: =================================================== deliver(user): unlink(/tmp/dovecot.deliver.. \ 1239836047.9469.46242b1037005551) failed: Permission denied deliver(user): copy: i_stream_read() failed: Permission denied deliver(user): read(mail, uid=1) failed: Permission denied deliver(user): read(mail, uid=1) failed: Permission denied deliver(user): msgid=: save failed to INBOX: Internal error occurred. \ Refer to server log for more information. [2009-04-15 17:54:07] =================================================== This is the final error series received before the policies were finally updated, and shows an error during deliver's attempt to "unlink()" (remove) the temporary file. Previous errors occurred during attempts to "stat()" and "creat()" (sic) the temporary files. Basically, the "dovecot_deliver_t" context needs to be able to create, read, write and remove files in the /tmp directory ("tmp_t" context). Below, I am pasting my "local_postfix.te" SELinux policy file. It includes instructions for using it, and for figuring out how to do other SELinux policy adjustments on your own. This is my COMPLETE Postfix+Dovecot SELinux policy group. I also have policies for Spamassassin, if anyone wants them. If you are running Sendmail or another MTA instead of Postfix, you can build on what you find below and establish your own policies. I hope this proves useful. Again, please feel free to correct any misunderstandings I may be promoting with this message. Use at your own risk, please! No guarantees ... it just worked, for me. James ## NOTE: I have broken lines in the following using the standard "\" notation to fix the email format better. However the local_postfix.te file should NOT have ANY lines broken. Remove my "\" notation and keep the lines together and you should be okay. ## ####### HOW TO USE THIS #################################################### # SELinux, Postfix, Dovecot # # SELinux needs help resolving Postfix+Dovecot context issues. # # This file + the following instructions should get you # # on your way to resolving the policies between those contexts. # # # # 1) Create this file with the data shown below: # # local_postfix.te # # 2) Compile this file: # # checkmodule -M -m -o local_postfix.mod local_postfix.te # # 3) Create SELinux policy package: # # semodule_package -o local_postfix.pp -m local_postfix.mod # # 4) Move policy package to normal SELinux modules directory: # # mv local_postfix.pp /etc/selinux/targeted/modules/active/modules/ # # 5) Update kernel with new policy package: # # semodule -i \ # # /etc/selinux/targeted/modules/active/modules/local_postfix.pp # # # # Test: Send mail from remote to this system. # # Check /var/log/maillog for mail errors and # # /var/log/messages & /var/log/audit/audit.log for more specific # # SELinux errors # # Also, SELinux will provide the command (sealert...) for more details # # Use the error info you see in messages (or sealert...) to create # # new entries in local_postfix.te, then re-compile, package # # and update the kernel. # # # # Alternately, you can use this to generate a .te file automatically # # from the SELinux errors displayed in /var/log/audit/audit.log (or # # from /var/log/messages IF you do NOT have audit installed): # # # # audit2allow -m local -l -i /var/log/audit/audit.log > local_postfix.te # # # # (This is also helpful if you can't guess the correct domain/policy to # # use from reading the error messages.) Take the new stuff from what # # audit2allow creates and add it to this file, then re-compile, package # # and update the kernel. # ############################################################################ module local_postfix 1.0; require { type admin_home_t; type bin_t; type default_t; type dovecot_t; type dovecot_deliver_t; type dovecot_deliver_exec_t; type dovecot_var_log_t; type etc_runtime_t; type fs_t; type home_root_t; type httpd_config_t; type httpd_t; type initrc_t; type postfix_etc_t; type postfix_local_t; type postfix_master_t; type postfix_postdrop_t; type postfix_postqueue_exec_t; type postfix_public_t; type postfix_pipe_t; type sendmail_t; type sendmail_exec_t; type src_t; type tmp_t; type usr_t; type user_home_dir_t; type user_home_t; type var_log_t; class capability { sys_nice chown }; class file { append create execute execute_no_trans \ getattr ioctl link lock read rename setattr write unlink }; class dir { add_name getattr create read remove_name \ rename write search setattr rmdir }; class fifo_file { getattr write }; class filesystem getattr; class sock_file write; class unix_stream_socket { connectto getattr read write }; } #============= dovecot_t =============== allow dovecot_t home_root_t:file { create getattr link lock \ read rename setattr unlink write }; allow dovecot_t home_root_t:dir { add_name create remove_name write }; #============= dovecot_deliver_t ============== allow dovecot_deliver_t tmp_t:dir getattr; allow dovecot_deliver_t fs_t:filesystem getattr; allow dovecot_deliver_t dovecot_var_log_t:file append; allow dovecot_deliver_t initrc_t:unix_stream_socket connectto; allow dovecot_deliver_t tmp_t:dir { add_name remove_name search write }; allow dovecot_deliver_t tmp_t:file { create read unlink write }; allow dovecot_deliver_t var_log_t:dir search; allow dovecot_deliver_t var_log_t:file append; #============ httpd_t ================= allow httpd_t postfix_etc_t:dir search; #============= postfix_local_t ============== allow postfix_local_t home_root_t:file { create getattr link unlink write }; allow postfix_local_t admin_home_t:dir { create read write }; allow postfix_local_t home_root_t:dir { add_name create remove_name write }; allow postfix_local_t clamd_var_lib_t:dir { add_name create remove_name \ rename setattr write read }; allow postfix_local_t clamd_var_lib_t:file { create link lock read rename \ getattr setattr unlink write }; allow postfix_local_t home_root_t:dir { rename setattr }; allow postfix_local_t self:capability { sys_nice chown }; allow postfix_local_t sendmail_exec_t:file { read execute ioctl \ execute_no_trans }; allow postfix_local_t spamc_exec_t:file { execute execute_no_trans \ getattr read }; allow postfix_local_t usr_t:file { append execute execute_no_trans \ read getattr write }; allow postfix_local_t default_t:file { create getattr read write }; allow postfix_local_t default_t:dir { add_name remove_name search write }; allow postfix_local_t user_home_dir_t:file { read write getattr rename }; #============= postfix_master_t =============== allow postfix_master_t src_t:dir search; #============= postfix_pipe_t ============== allow postfix_pipe_t bin_t:file { execute execute_no_trans read }; allow postfix_pipe_t postfix_public_t:sock_file write; #============= postfix_postdrop_t =============== allow postfix_postdrop_t initrc_t:fifo_file { write getattr }; allow postfix_postdrop_t postfix_local_t:unix_stream_socket { getattr \ read write }; allow postfix_postdrop_t user_home_t:file append; #============= sendmail_t ============== allow sendmail_t postfix_local_t:fifo_file { getattr write }; allow sendmail_t postfix_postqueue_exec_t:file { execute \ execute_no_trans read };

2 6

[Dovecot] UW-IMAP migration to namespaces
by Jernej Porenta 17 Apr '09

17 Apr '09

Hello, I am trying to migrate existing UW-IMAP installation to dovecot 1.1.14 and I am having troubles with namespaces. As you know UW-IMAP allows full system access to home directory of a user and you can set up dovecot to do that as well, but I would like to use namespaces. If I set my namespaces like this: namespace private { separator = / prefix = inbox = yes location = mbox:~/:INBOX=~/.mailbox hidden = yes list = yes } namespace private { separator = / prefix = mail/ location = mbox:~/mail prefix = mail/ hidden = yes } Everything is working fine, but I am seeing also all other files in home directory of a user, but this is annoying if you have users with public_html folder with millions of files in it. Dovecot indexing makes index.log file for every file seen in namespace, so you have several million index files for files that are not mailboxes. So I was wondering is there a way to skip certain directories in namespaces or a way to setup namespaces in a way, that you would have: - INBOX in home directory - some folders in home directory (via .subscriptions) - some folders in %h/mail/ directory - and not seeing all other files/directories in home dir Thanks in advance, regards, Jernej

2 1