- dovecot - dovecot.org

[Dovecot] GSSAPI cross-realm fixed
by Bryan Jacobs 08 Jul '09

08 Jul '09

Attached is a patch which in my environment (Linux/Heimdal 1.2.1) fixes cross-realm GSSAPI authentication. Changes it makes: 1. When using krb5_kuserok, do not call gss_compare_name to check that authn_name and authz_name are the same. Instead, make TWO calls to krb5_kuserok, one for each ID. If both IDs are acceptable, allow the login. 2. Disable checking that the name is a GSS_KRB5_PRINCIPAL_NAME, as this doesn't appear to be always the case for the authz_name. If I create a .k5login listing both username@REALM1 and username@REALM2, and make that file follow the appropriate security restrictions (world read, user only write permissions), this lets me use GSSAPI logins with principals from either REALM1 or REALM2. This leaves untouched the behavior in the case where krb5_kuserok is not available. Bryan Jacobs

2 3

[Dovecot] v1.2.0 released
by Timo Sirainen 08 Jul '09

08 Jul '09

http://dovecot.org/releases/1.2/dovecot-1.2.0.tar.gz http://dovecot.org/releases/1.2/dovecot-1.2.0.tar.gz.sig As promised. No changes since v1.2.rc8 (except packaged in OS X, since CentOS 5 autotools didn't add support for configure --docdir). Below are the largest changes since v1.1: * When creating files or directories to mailboxes, Dovecot now uses the mailbox directory's permissions and GID for them. Previous versions simply used 0600 mode always. For backwards compatibility dovecot-shared file's permissions still override these with Maildir. * SQL dictionary (quota) configuration file is different than in v1.1. See doc/dovecot-dict-sql-example.conf for the new format. * deliver -m: Mailbox name is now assumed to be in UTF-8 format, not modified-UTF7. Stephan Bosch's new Sieve implementation also assumes UTF-8 format in fileinto parameters. + Full support for shared mailboxes and IMAP ACL extension. The code is mainly from Sascha Wilde and Bernhard Herzog. + IMAP: Added support for extensions: CONDSTORE, QRESYNC, ESEARCH, ESORT, SEARCHRES, WITHIN, ID and CONTEXT=SEARCH. + SEARCH supports INTHREAD search key, but the rest of the INTHREAD draft isn't implemented yet so it's not advertised in capability. + THREAD REFS algorithm where threads are sorted by their latest message instead of the thread root message. There is also no base subject merging. + IMAP: Implemented imap-response-codes draft. + Thread indexes for optimizing IMAP THREAD command and INTHREAD search key. + Added userdb checkpassword (by Sascha Wilde) + Virtual mailboxes: http://wiki.dovecot.org/Plugins/Virtual + Autocreate plugin: http://wiki.dovecot.org/Plugins/Autocreate + Listescape plugin: http://wiki.dovecot.org/Plugins/Listescape

10 29

[Dovecot] Lost email where did it go...?
by Romer Ventura 08 Jul '09

08 Jul '09

Hello, I have this user that lost an email, even when the server is set up to do lazy expunge. The mail server logs show that the message was received, the user also read it and he did reply to it. here is the mail.log Jun 29 07:52:48 mx20 postfix/smtpd[19289]: 0ACD81C443B: client=usxsl050.slb.atosorigin-asp.com[199.6.139.15] Jun 29 07:52:48 mx20 postfix/cleanup[20259]: 0ACD81C443B: message- id=<791A7985471643BA9997A472B6E429AD(a)eur.slb.com> Jun 29 07:52:50 mx20 postfix/qmgr[24622]: 0ACD81C443B: from=<remoteusers(a)stonehouse.oilfield.slb.com>, size=405287, nrcpt=1 (queue active) Jun 29 07:52:50 mx20 postfix/smtpd[19289]: disconnect from usxsl050.slb.atosorigin-asp.com[199.6.139.15] Jun 29 07:52:50 mx20 postfix/smtpd[20261]: connect from localhost [127.0.0.1] Jun 29 07:52:50 mx20 postfix/smtpd[20261]: EB9C11C4443: client=localhost[127.0.0.1] Jun 29 07:52:50 mx20 postfix/cleanup[20259]: EB9C11C4443: message- id=<791A7985471643BA9997A472B6E429AD(a)eur.slb.com> Jun 29 07:52:50 mx20 postfix/qmgr[24622]: EB9C11C4443: from=< remoteuser(a)stonehouse.oilfield.slb.com>, size=406106, nrcpt=1 (queue active) Jun 29 07:52:50 mx20 postfix/smtp[20260]: 0ACD81C443B: to=<localuser(a)mydomain.com>, relay=127.0.0.1[127.0.0.1]:10025, delay=3.2, delays=2.5/0.01/0/0.7, dsn=2.0.0, status=sent (250 OK, sent 4A48B922_20407_5563_1 EB9C11C4443) Jun 29 07:52:50 mx20 postfix/qmgr[24622]: 0ACD81C443B: removed Jun 29 07:52:50 mx20 postfix/smtpd[20261]: disconnect from localhost [127.0.0.1] Jun 29 07:52:51 mx20 deliver(localuser(a)mydomain.com): msgid=<791A7985471643BA9997A472B6E429AD(a)eur.slb.com>: saved mail to INBOX But i cant find it anywhere... Is there any way of finding where it went...? I've done: grep -r 'sender@senderemail' <user>/Maildir/ And it only shows the email my user sent, not the original... any ideas of what happen as well...? Thanks.

3 4

[Dovecot] rquota RPC with netapp filer
by Ralf Becker 08 Jul '09

08 Jul '09

Hello list, with dovecot 1.2 on AIX rquota RPC calls fail with quota-fs: remote ext rquota call failed: RPC: 1832-012 Program/version mismatch when using a netapp filer. This is what netapp says: Bug ID 97288 Title Support requested for rquota version 2 Bug Severity 5 - Suggestion Bug Status Closed Product Data ONTAP Bug Type NFS Description Linux has implemented its own extensions to the rquota protocol as a version 2 of that protocol. ONTAP only supports v1 as that is the only version defined by Sun, the owner of that RPC program number. Workaround - Fixed-In This bug is not scheduled to be fixed, you may opt to Version open a technical support case if you would like to contact Network Appliance regarding the status of this bug. A complete list of releases where this bug is fixed is available here. So this should be no AIX specific problem. Using the attached rquota.x fixes the problem. In addition you have to disable group quota checking by adding "user" to your "quota" definition. Otherwise you'll see: quota-fs: rquota not compiled with group support Regards, Ralf -- ______________________________________________________________________ Dipl.-Inform. (FH) Ralf Becker Rechenzentrum (r/ft) der FH Trier (Network|Mail|Web|Firewall) University of applied sciences Administrator Schneidershof, D-54293 Trier Mail: beckerr(a)fh-trier.de Fon: +49 651 8103 499 Web: http://www.fh-trier.de/~beckerr Fax: +49 651 8103 214 PubKey: http://www.fh-trier.de/~beckerr Crypto: GnuPG, S/MIME ______________________________________________________________________ Wenn Gott gewollt haette, dass E-Mail in HTML geschrieben wuerden, endeten Gebete traditionell mit </amen>. (Tom Listen) /* * COMPONENT_NAME: onchdrs * * FUNCTIONS: none * * ORIGINS: 24,27 * * * (C) COPYRIGHT International Business Machines Corp. 1988,1993 * All Rights Reserved * Licensed Materials - Property of IBM * US Government Users Restricted Rights - Use, duplication or * disclosure restricted by GSA ADP Schedule Contract with IBM Corp. */ /* * Copyright (c) 1988 by Sun Microsystems, Inc. * (#) from SUN 1.4 */ /* * Remote quota protocol * Requires unix authentication */ const RQ_PATHLEN = 1024; struct getquota_args { string gqa_pathp<RQ_PATHLEN>; /* path to filesystem of interest */ int gqa_uid; /* inquire about quota for uid */ }; /* * remote quota structure */ struct rquota { int rq_bsize; /* block size for block counts */ bool rq_active; /* indicates whether quota is active */ unsigned int rq_bhardlimit; /* absolute limit on disk blks alloc */ unsigned int rq_bsoftlimit; /* preferred limit on disk blks */ unsigned int rq_curblocks; /* current block count */ unsigned int rq_fhardlimit; /* absolute limit on allocated files */ unsigned int rq_fsoftlimit; /* preferred file limit */ unsigned int rq_curfiles; /* current # allocated files */ unsigned int rq_btimeleft; /* time left for excessive disk use */ unsigned int rq_ftimeleft; /* time left for excessive files */ }; enum gqr_status { Q_OK = 1, /* quota returned */ Q_NOQUOTA = 2, /* noquota for uid */ Q_EPERM = 3 /* no permission to access quota */ }; union getquota_rslt switch (gqr_status status) { case Q_OK: rquota gqr_rquota; /* valid if status == Q_OK */ case Q_NOQUOTA: void; case Q_EPERM: void; }; program RQUOTAPROG { version RQUOTAVERS { /* * Get all quotas */ getquota_rslt RQUOTAPROC_GETQUOTA(getquota_args) = 1; /* * Get active quotas only */ getquota_rslt RQUOTAPROC_GETACTIVEQUOTA(getquota_args) = 2; } = 1; } = 100011;

2 2

[Dovecot] [PATCH] Fix VPATH build of RQUOTA support
by Matthias Andree 08 Jul '09

08 Jul '09

# HG changeset patch # User Matthias Andree <matthias.andree(a)gmx.de> # Date 1246993296 -7200 # Branch HEAD # Node ID c884491cb1a61ef50e227fcf4bb77d2e449c1e3a # Parent dff7312629a72f6ee90ab470ad0d50dfa68e6f71 Fix VPATH build of RQUOTA support. Some rpcgen derive #include "..." paths from the infile argument. This will be off for VPATH builds, as the generated rquota_xdr.c code will look in $(srcdir), but we'll generate the rquota.h file in $(builddir). Play safe and copy rquota.x to $(builddir) first. This fixes the build on openSUSE 11.1. diff -r dff7312629a7 -r c884491cb1a6 src/plugins/quota/Makefile.am --- a/src/plugins/quota/Makefile.am Tue Jul 07 15:00:52 2009 -0400 +++ b/src/plugins/quota/Makefile.am Tue Jul 07 21:01:36 2009 +0200 @@ -37,9 +37,10 @@ #RQUOTA_X = /usr/include/rpcsvc/rquota.x RQUOTA_X = $(srcdir)/rquota.x rquota_xdr.c: Makefile $(RQUOTA_X) + if "$(srcdir)" != "$(builddir)" ; then cp $(RQUOTA_X) $(builddir) ; fi (echo '#include "lib.h"'; \ echo '#include <rpc/rpc.h>'; \ - $(RPCGEN) -c $(RQUOTA_X) | \ + $(RPCGEN) -c $(builddir)/rquota.x | \ sed -e 's/IXDR_PUT/(void)IXDR_PUT/g' \ -e 's,/usr/include/rpcsvc/rquota.h,rquota.h,' \ -e 's/int32_t \*buf/int32_t *buf ATTR_UNUSED/' \

2 2

[Dovecot] expire-tool complains in 1.2
by LEVAI Daniel 08 Jul '09

08 Jul '09

Hi! I've upgrade from 1.1 to 1.2, and one thing I noticed, that when running expire-tool, I get this error: # /usr/local/sbin/dovecot --exec-mail ext /usr/local/libexec/dovecot/expire- tool Info: Loading modules from directory: /usr/local/lib/dovecot/imap Info: Module loaded: /usr/local/lib/dovecot/imap/lib10_quota_plugin.so Info: Module loaded: /usr/local/lib/dovecot/imap/lib20_expire_plugin.so Info: Quota root: name= backend=maildir args= Info: Quota rule: root= mailbox=* bytes=104857600 messages=0 Info: Quota rule: root= mailbox=Trash bytes=52428800 messages=0 Info: expire: No expire or expire_altmove settings - plugin disabled Here is how I have defined an "expire" setting in dovecot.conf: plugin { [...] expire = SA.* 1 expire_dict = proxy::expire [...] } # dovecot -n # 1.2.0: /etc/dovecot/dovecot.conf # OS: OpenBSD 4.5 i386 log_path: /var/log/mail/dovecot.log info_log_path: /var/log/mail/dovecot.info protocols: pop3 pop3s imap listen: 212.92.15.17 127.0.0.1 ssl: required ssl_cert_file: /etc/ssl/dovecot_cert.pem ssl_key_file: /etc/ssl/private/dovecot_key.pem login_dir: /var/run/dovecot/login login_executable(default): /usr/local/libexec/dovecot/imap-login login_executable(imap): /usr/local/libexec/dovecot/imap-login login_executable(pop3): /usr/local/libexec/dovecot/pop3-login login_user: _dovecot login_max_processes_count: 10 max_mail_processes: 490 first_valid_uid: 8000 first_valid_gid: 8000 mail_location: maildir:~/Maildir/ mail_debug: yes mail_executable(default): /usr/local/libexec/dovecot/imap mail_executable(imap): /usr/local/libexec/dovecot/imap mail_executable(pop3): /usr/local/libexec/dovecot/pop3 mail_plugins: quota expire mail_plugin_dir(default): /usr/local/lib/dovecot/imap mail_plugin_dir(imap): /usr/local/lib/dovecot/imap mail_plugin_dir(pop3): /usr/local/lib/dovecot/pop3 imap_client_workarounds(default): outlook-idle delay-newmail imap_client_workarounds(imap): outlook-idle delay-newmail imap_client_workarounds(pop3): pop3_client_workarounds(default): pop3_client_workarounds(imap): pop3_client_workarounds(pop3): outlook-no-nuls oe-ns-eoh auth default: mechanisms: plain digest-md5 ntlm user: _dv_auth master_user_separator: * verbose: yes passdb: driver: passwd-file args: /etc/dovecot/dovecot.passdb_master pass: yes master: yes passdb: driver: passwd-file args: /etc/dovecot/dovecot.passdb userdb: driver: passwd-file args: /etc/dovecot/dovecot.userdb socket: type: listen client: path: /var/spool/postfix/private/auth mode: 432 user: _postfix group: _postfix master: path: /var/run/dovecot/auth-master mode: 288 user: vmail group: vmail plugin: quota: maildir quota_rule: *:storage=100M quota_rule2: Trash:storage=50M expire: SA.* 1 expire_dict: proxy::expire dict: expire: pgsql:/etc/dovecot/dovecot-dict-expire-sql.conf # cat dovecot-dict-expire-sql.conf connect = host=localhost dbname=dovecot user=<username> password=<password> map { pattern = shared/expire/$user/$mailbox table = expires value_field = expire_stamp fields { username = $user mailbox = $mailbox } } What am I doing wrong? Daniel -- LÉVAI Dániel PGP key ID = 0x4AC0A4B1 Key fingerprint = D037 03B9 C12D D338 4412 2D83 1373 917A 4AC0 A4B1

2 1

[Dovecot] postfix dovecot sieve lda
by Benny Pedersen 08 Jul '09

08 Jul '09

Hi Dovecot users i like to know how i can make dovecot not bounce when i have a sieve rule that says reject :/ my postfix is configured as in wiki with the pipe to deliver lda in dovecot, how do i solve this ? problem comes from the part that sieve vacation need to bounce to get returned mail added to vacation response, but a sieve rule with reject, accept and bounce in my setup :( postfix 2.5.5 dovecot 1.1.7 http://wiki.dovecot.org/LDA/Postfix -- xpoint

4 3

[Dovecot] AUTH PLAIN error with Thunderbird and Dovecot 1.2
by Bernhard Schmidt 08 Jul '09

08 Jul '09

Hi, a few days ago I started to get some complaints about authentication delays from Thunderbird POP3 users. After some debugging it turned out that the problem was introduced somewhere between 1.2rc3 and 1.2rc7 (1.2.0 is still affected). A session with Thunderbird 2.0.0.22 against 1.2rc3 looks like this: <<< +OK Dovecot ready. >>> CAPA <<< +OK <<< CAPA <<< TOP <<< UIDL <<< RESP-CODES <<< PIPELINING <<< STLS <<< USER <<< SASL PLAIN LOGIN <<< . >>> AUTH PLAIN <<< + >>> <base64> <<< +OK Logged in. and with 1.2.0 (same client, same config, just replaced the server binaries) <<< +OK Dovecot ready. >>> CAPA <<< +OK <<< CAPA <<< TOP <<< UIDL <<< RESP-CODES <<< PIPELINING <<< STLS <<< USER <<< SASL PLAIN LOGIN <<< . >>> AUTH PLAIN [ 2 seconds delay ] <<< -ERR Authentication failed. >>> AUTH LOGIN [ 5 seconds delay ] <<< + <base64> >>> <base64> <<< + <base64> >>> <base64> <<< +OK Logged in. In the log I see mail dovecot: auth(default): plain(?,77.2.39.xx): invalid input Does anyone have an idea? # dovecot -n # 1.2.0: /etc/dovecot/dovecot.conf # OS: Linux 2.6.28.2 x86_64 Debian squeeze/sid ext4 protocols: imap imaps pop3 pop3s managesieve listen: *, [::] ssl_cert_file: /etc/ssl/private/pop3.mucip.net.crt ssl_key_file: /etc/ssl/private/pop3.mucip.net.key disable_plaintext_auth: no login_dir: /var/run/dovecot/login login_executable(default): /usr/lib/dovecot/dovecot/imap-login login_executable(imap): /usr/lib/dovecot/dovecot/imap-login login_executable(pop3): /usr/lib/dovecot/dovecot/pop3-login login_executable(managesieve): /usr/lib/dovecot/dovecot/managesieve-login login_process_per_connection: no verbose_proctitle: yes mail_uid: 5000 mail_gid: 5000 mail_location: maildir:/var/mail/vmail/%1u/%u:INDEX=/var/cache/dovecot/%1u/%u maildir_stat_dirs: yes mail_executable(default): /usr/lib/dovecot/dovecot/imap mail_executable(imap): /usr/lib/dovecot/dovecot/imap mail_executable(pop3): /usr/lib/dovecot/dovecot/pop3 mail_executable(managesieve): /usr/lib/dovecot/dovecot/managesieve mail_plugins(default): quota imap_quota fts fts_squat mail_plugins(imap): quota imap_quota fts fts_squat mail_plugins(pop3): mail_plugins(managesieve): mail_plugin_dir(default): /usr/lib/dovecot/imap mail_plugin_dir(imap): /usr/lib/dovecot/imap mail_plugin_dir(pop3): /usr/lib/dovecot/pop3 mail_plugin_dir(managesieve): /usr/lib/dovecot/managesieve imap_idle_notify_interval(default): 900 imap_idle_notify_interval(imap): 900 imap_idle_notify_interval(pop3): 120 imap_idle_notify_interval(managesieve): 120 auth default: mechanisms: plain login verbose: yes passdb: driver: ldap args: /etc/dovecot/dovecot-ldap.conf userdb: driver: ldap args: /etc/dovecot/dovecot-ldap.conf socket: type: listen client: path: /var/spool/postfix-mailout/private/auth mode: 432 user: postfix group: postfix master: path: /var/run/dovecot/auth-master mode: 384 user: vmail plugin: quota: maildir quota_rule: *:storage=500M Thanks, Bernhard

2 2

[Dovecot] troubles with broken clients (iPhone) - again
by Federico Bianchi 08 Jul '09

08 Jul '09

The PC (Outlook) is accessing the mailbox via POP3, the iPhone is using IMAP; please consider we are talking about a user's home setup, so it's pretty difficult to have a more detailed report on his part (Outlook version, iPhone OS version, xDSL router type and configuration, etc.). The mail server 'dovecot -n' output is attached. The symptoms: when the Mail application is "closed" on the iPhone, Outlook still says the mailbox is in use; a Dovecot imap process is still active for that user even after a few minutes (manually killing it releases the lock, thereby leaving the inbox available for Outlook). >From the client side, there is a seemingly relevant article at http://blogs.sun.com/chienr/entry/iphone_supports_imap_idle it describes, among others, the "Settings / Mail / Auto-Check" and "Settings / General / Auto-Lock" parameters; from my point of view, however, being able to solve the problem directly on the server would be far better, and might also accomodate other broken clients we haven't seen yet: that's why I asked you whether there is a way to tell Dovecot only one POP3 or IMAP process from the same user, the latest one, can be active at the same time, closing and disconnecting all the others. Regards, and thanks a lot again for your help Federico Bianchi Dipartimento di Storia delle Arti Universita` di Pisa piazza S.Matteo in Soarta, 2 - I56127 Pisa (Italy) fax.+39-050-580128; e-mail: <f.bianchi(a)arte.unipi.it> =================================================== !DISCLAIMER!: my e-mail reflects _my_own_ opinions! ===================================================

3 3

[Dovecot] Ambiguous mail location setting
by Shawn 08 Jul '09

08 Jul '09

"Using Dovecot v1.0.alpha4 on OpenBSD 3.8 (same problem find using Dovecot v1.0.alpha3 on OpenBSD 3.7) Log output: _________________________________ dovecot: Nov 04 11:15:28 Info: auth(default): client in: AUTH 1 PLAIN service=IMAP secured lip=127.0.0.1 rip=127.0.0.1 resp=AHl2cmlAbjN1dHJpbm4uaXQAeXVyaW6zgXRyaW1v dovecot: Nov 04 11:15:28 Info: auth(default): sql(myuser at mydomain.com <http://dovecot.org/cgi-bin/mailman/listinfo/dovecot>,127.0.0.1): query: SELECT password FROM user_accounts WHERE username='myuser at mydomain.com <http://dovecot.org/cgi-bin/mailman/listinfo/dovecot>' dovecot: Nov 04 11:15:28 Info: auth(default): client out: OK 1 user=myuser at mydomain.com <http://dovecot.org/cgi-bin/mailman/listinfo/dovecot> dovecot: Nov 04 11:15:28 Info: auth(default): master in: REQUEST 5 32206 1 dovecot: Nov 04 11:15:28 Info: auth(default): sql(myuser at mydomain.com <http://dovecot.org/cgi-bin/mailman/listinfo/dovecot>,127.0.0.1): SELECT '/var/mail/'||mailbox AS mail, uid, gid FROM user_accounts WHERE username='myuser at mydomain.com <http://dovecot.org/cgi-bin/mailman/listinfo/dovecot>' dovecot: Nov 04 11:15:28 Info: auth(default): master out: USER 5 myuser at mydomain.com <http://dovecot.org/cgi-bin/mailman/listinfo/dovecot> mail=/var/mail/mydomain.com/myuser uid=10001 gid=10001 dovecot: Nov 04 11:15:28 Error: imap(myuser at mydomain.com <http://dovecot.org/cgi-bin/mailman/listinfo/dovecot>): Ambiguous mail location setting, don't know what to do with it: /var/mail/mydomain.com/myuser (try prefixing it with mbox: or maildir:) dovecot: Nov 04 11:15:28 Error: imap(myuser at mydomain.com <http://dovecot.org/cgi-bin/mailman/listinfo/dovecot>): Failed to create storage with data: /var/mail/mydomain.com/myuser _________________________________ I verified that "default_mail_env" on my dovecot configuration file are "maildir:" correctly prefixed: "default_mail_env = maildir:/var/mail/%d/%n" and ... permissions of /var/mail/mydomain and /var/mail/mydomain/myuser are 2755 and owner is root:mail. I'm sure that isn't an authentication problem. I've tried some days to understand and to find over internet and here in the dovecot mailing list but I've not find a solution yet. I think it's a dovecot internal bug. Someone know what I'm talking about?" Set permissions on the mail folder to 2775 because dovecot runs as its own user and group and you need the mail file in that folder to accept writes from mail and from dovecot groups. Also in the config file dovecot.conf you need to specify if the files are maildir or mbox. They are probably mbox but try both for the error messages.

4 3