- dovecot - dovecot.org

[Dovecot] virtual domains with SQL auth + ntlm (winbind) auth for one of them...
by Tomasz Lutelmowski 16 Apr '09

16 Apr '09

Hello ! Is it possible to configure dovecot so it can use SQL authentication for set of domains, and ntlm authentication for one domain? In other words, I would like to authenticate all users (with user(a)domain.com as login) in SQL server, and if not found, then strip @windomain.com from login and fallback to pam->winbind authentication. So far i have in my dovecot.conf: auth_default_realm = windomain.com mechanisms = plain passdb sql { args = /etc/dovecot/dovecot-sql.conf } passdb pam { } passdb passwd { } userdb sql { args = /etc/dovecot/dovecot-sql.conf } userdb passwd { } userdb prefetch { } in pam.d/dovecot : auth required pam_nologin.so auth include system-auth-winbind account include system-auth-winbind session include system-auth-winbind With this configuration I can authenticate all users for virtual domains with logins user(a)domain.com - ok, then it fallbacks to pam - ok, but then it returns error (winbind uses only "user" or "DOMAIN\user" as login). After I set auth_username_format = %n I get opposite situation - I can authenticate users with pam, but I can't with SQL (it requires user@domain as login field). Unfortunately auth_default_realm = windomain.com is a must have (and most of the windows clients uses user(a)windomain.com as login anyway). Please help, I'm banging my head against keyboard since 3 days but still no idea how to do it. Best regards, Tomek

2 1

[Dovecot] dovecot SASL + Postfix no IMAP or POP3
by Roderick A. Anderson 16 Apr '09

16 Apr '09

A customer is suffering with an older version of a Windows "Mail Server" software that does not permit connections to _other_ ports (25 only). Several of the domains they host have users who's ISPs block port 25 so they can not send mail. They'd like to set up an outbound (relay?) SMTP server for those customers using per user(a)domain.tld authentication. Since I personally use Postfix with dovecot SASL I'd prefer doing the same for them. The only issue I see is how to "disable" IMAP and POP3 and use only the SASL authentication feature. I read that Timo is thinking to _someday_ :-) separate the SASL authentication from the rest of Dovecot, but in the mean time can I just leave out the IMAP and POP3 stuff from dovecot.conf, or is there a disable option? Of course I'll clamp the IMAP and POP3 ports down with iptables but it would be nice knowing Dovecot would just say go away or ignore those connections. Is anyone doing this or have any suggestions, thoughts, or ideas about it? \\||/ Rod --

2 1

[Dovecot] failed dovecot 1.2rc2 build Solaris 8, gcc 2.95.3
by Jernej Porenta 16 Apr '09

16 Apr '09

Hello, I trying to build dovecot 1.2rc2 on ancient Solaris 8 with gcc 2.95.3 and it fails with: gcc -DHAVE_CONFIG_H -I. -I../.. -I../../src/lib -I../../src/lib-settings -DSYSCONFDIR=\""/opt/dovecot/etc"\" -DPKG_RUNDIR=\""/opt/dovecot/var/run/dovecot"\" -DPKG_STATEDIR=\""/opt/dovecot/var/lib/dovecot"\" -DPKG_LIBEXECDIR=\""/opt/dovecot/libexec/dovecot"\" -DMODULEDIR=\""/opt/dovecot/lib/dovecot"\" -DSSLDIR=\""/usr/local/ssl/certs\"" -I/usr/local/ssl/include -I/opt/kerberos-heimdal/include -g -O2 -Wall -W -Wmissing-prototypes -Wmissing-declarations -Wpointer-arith -Wchar-subscripts -Wformat=2 -Wbad-function-cast -c login-process.c In file included from ../../src/lib/lib.h:28, from common.h:6, from login-process.c:3: ../../src/lib/data-stack.h:73: warning: `pure' attribute directive ignored In file included from ../../src/lib/lib.h:39, from common.h:6, from login-process.c:3: ../../src/lib/strfuncs.h:44: warning: `pure' attribute directive ignored ../../src/lib/strfuncs.h:54: warning: `pure' attribute directive ignored ../../src/lib/strfuncs.h:55: warning: `pure' attribute directive ignored ../../src/lib/strfuncs.h:56: warning: `pure' attribute directive ignored ../../src/lib/strfuncs.h:57: warning: `pure' attribute directive ignored ../../src/lib/strfuncs.h:58: warning: `pure' attribute directive ignored ../../src/lib/strfuncs.h:59: warning: `pure' attribute directive ignored ../../src/lib/strfuncs.h:77: warning: `pure' attribute directive ignored In file included from master-settings.h:4, from common.h:7, from login-process.c:3: ../../src/lib/network.h:114: warning: `pure' attribute directive ignored ../../src/lib/network.h:115: warning: `pure' attribute directive ignored ../../src/lib/network.h:123: warning: `pure' attribute directive ignored In file included from ../../src/lib/array.h:33, from login-process.c:4: ../../src/lib/buffer.h:36: warning: `pure' attribute directive ignored ../../src/lib/buffer.h:88: warning: `pure' attribute directive ignored ../../src/lib/buffer.h:106: warning: `pure' attribute directive ignored In file included from login-process.c:4: ../../src/lib/array.h:96: warning: `pure' attribute directive ignored ../../src/lib/array.h:161: warning: `pure' attribute directive ignored ../../src/lib/array.h:222: warning: `pure' attribute directive ignored ../../src/lib/array.h:229: warning: `pure' attribute directive ignored In file included from login-process.c:6: ../../src/lib/hash.h:24: warning: `pure' attribute directive ignored ../../src/lib/hash.h:35: warning: `pure' attribute directive ignored ../../src/lib/hash.h:54: warning: `pure' attribute directive ignored ../../src/lib/hash.h:55: warning: `pure' attribute directive ignored In file included from login-process.c:8: ../../src/lib/ostream.h:72: warning: `pure' attribute directive ignored login-process.c:52: field `data' has incomplete type *** Error code 1 make: Fatal error: Command failed for target `login-process.o' Current working directory /opt/src/dovecot-1.2.rc2/src/master *** Error code 1 configure looks like this: CPPFLAGS='-I/usr/local/ssl/include -I/opt/kerberos-heimdal/include' LDFLAGS='-L/usr/local/ssl/lib -R/usr/local/ssl/lib -L/opt/kerberos-heimdal/lib -R/opt/kerberos-heimdal/lib' ./configure --prefix=/opt/dovecot --enable-ssl --with-ssldir=/usr/local/ssl/certs --with-ssl=openssl --without-passwd-file --with-passwd --with-shadow --without-bsdauth --without-static-userdb --without-prefetch-userdb --without-checkpassword --with-gssapi=yes --without-pgsql --without-sql --without-ldap --without-vpopmail --without-sia The build goes fine with gcc 3.2.2. Dovecot 1.1 builds fine with 2.95.3. Are there any requirements for GCC version? regards, Jernej

2 1

[Dovecot] INBOX lost in virtual namespace
by Xueron Nee 16 Apr '09

16 Apr '09

Hi, I have set a virtual namespace to create Virtual POP3 INBOX follow: http://wiki.dovecot.org/Plugins/Virtual dovecot.conf: mail_location = maildir:~/Maildir # default namespace namespace private { separator = / prefix = list = yes hidden = no subscriptions = yes } # virtual mailbox, for pop3 namespace private { separator = / prefix = virtual/ location = virtual:~/Maildir/virtual:LAYOUT=maildir++ list = no hidden = yes } # Copy of the default namespace. We'll use this in dovecot-virtual file. namespace private { separator = / prefix = secret/ list = no hidden = yes subscriptions = no } # cat ~/Maildir/virtual/.INBOX/dovecot-virtual secret/* all but, the INBOX lost in secret/ namespace :( When list in IMAP: a1 list "" "*" * LIST (\HasNoChildren) "/" "Sent" * LIST (\HasNoChildren) "/" "Spam" * LIST (\HasNoChildren) "/" "Junk" * LIST (\HasNoChildren) "/" "Draft" * LIST (\HasNoChildren) "/" "Trash" * LIST (\HasNoChildren) "/" "INBOX" a1 OK List completed. a1 list "secret/" "*" * LIST (\HasNoChildren) "/" "secret/Sent" * LIST (\HasNoChildren) "/" "secret/Spam" * LIST (\HasNoChildren) "/" "secret/Junk" * LIST (\HasNoChildren) "/" "secret/Draft" * LIST (\HasNoChildren) "/" "secret/Trash" a1 OK List completed. INBOX lost, So, the virtual namespace for POP3 cannot see the messages in IMAP's INBOX. Am I doing anything wrong? Thanks.. -- Xueron Nee http://www.xueron.com

2 1

[Dovecot] Can virtual mailboxes created automatically?
by Xueron Nee 16 Apr '09

16 Apr '09

Hi, I set a virtual namespace, and for new users, there is no root dir for it. namespace private { separator = / prefix = virtual/ location = virtual:~/Maildir/virtual list = no hidden = yes } log: Apr 10 12:14:41 mail dovecot: IMAP(test1@xueron.com):Namespace 'virtual/': virtual: Root mail directory doesn't exist:/home/data/test1@xueron.com/Maildir/virtual Apr 10 12:14:41 mail dovecot: Fatal: IMAP(test1(a)xueron.com): Namespace initialization failed Apr 10 12:15:27 mail dovecot: Killed with signal 15 (by pid=26918 uid=0 code=kill) How to do then? Thanks :) -- Xueron Nee http://www.xueron.com

2 3

[Dovecot] help with ldap config
by Ricardo Kleemann 16 Apr '09

16 Apr '09

Hi, I've been using courier with ldap and I'm trying to configure dovecot to do the same. I'm not exactly sure how to setup the ldap binds and filters... Here's my dovecot info: # 1.0.10: /etc/dovecot/dovecot.conf log_path: /var/log/dovecot.log log_timestamp: %Y-%m-%d %H:%M:%S login_dir: /var/run/dovecot/login login_executable: /usr/lib/dovecot/imap-login mail_privileged_group: mail mail_debug: yes auth default: verbose: yes debug: yes passdb: driver: pam passdb: driver: ldap args: /etc/dovecot/dovecot-ldap.conf userdb: driver: ldap args: /etc/dovecot/dovecot-ldap-userdb.conf plugin: quota: maildir $ sudo grep -v '^ *$#.*$\?$' /etc/dovecot/dovecot-ldap.conf uris = ldap://ldap dn = cn=admin, dc=americasnet, dc=com dnpass = xxxxx auth_bind = yes auth_bind_userdn = uid=%u,ou=%d,dc=americasnet,dc=com ldap_version = 3 base = uid=%u,ou=%d,dc=americasnet,dc=com user_filter = (&(objectClass=posixAccount)(uid=%u,ou=%d)) So I try to login with an LDAP user, say ricardo(a)domain.com. This is how it exists in the database. It's accessed as: uid=ricardo(a)domain.com,ou=domain.com,dc=americasnet,dc=com This is what I get in the error log: dovecot: 2009-04-11 11:36:07 Info: auth(default): client in: AUTH 1 PLAIN service=IMAP secured lip=127.0.0.1 rip=127.0.0.1 resp=<hidden> dovecot: 2009-04-11 11:36:07 Info: auth(default): pam(ricardo(a)domain.com,127.0.0.1): lookup service=dovecot dovecot: 2009-04-11 11:36:11 Info: auth(default): pam(ricardo(a)domain.com,127.0.0.1): pam_authenticate() failed: User not known to the underlying authentication module dovecot: 2009-04-11 11:36:11 Info: auth(default): ldap(ricardo(a)domain.com,127.0.0.1): bind: dn=uid=ricardo(a)domain.com,ou=domain.com,dc=americasnet,dc=com dovecot: 2009-04-11 11:36:11 Info: auth(default): client out: OK 1 user=ricardo(a)domain.com dovecot: 2009-04-11 11:36:11 Info: auth(default): master in: REQUEST 1 5398 1 dovecot: 2009-04-11 11:36:11 Info: auth(default): ldap(ricardo(a)domain.com,127.0.0.1): user search: base=uid=ricardo(a)domain.com,ou=domain.com,dc=americasnet,dc=com scope=subtree filter=(&(objectClass=posixAccount)(uid=ricardo(a)domain.com,ou=domain.com)) fields=uid,homeDirectory,uidNumber,gidNumber dovecot: 2009-04-11 11:36:11 Error: auth(default): ldap(ricardo(a)domain.com,127.0.0.1): Authenticated user not found dovecot: 2009-04-11 11:36:11 Error: auth(default): userdb(ricardo(a)domain.com,127.0.0.1): user not found from userdb dovecot: 2009-04-11 11:36:11 Info: auth(default): master out: NOTFOUND 1 dovecot: 2009-04-11 11:36:11 Info: imap-login: Internal login failure: user=<ricardo(a)domain.com>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, secured

3 6

Re: [Dovecot] auth-master: Permission denied [sigh]
by James Butler 15 Apr '09

15 Apr '09

Here is everything I could think of that might pertain to this, as currently configured on my dedicated server. It's all fresh! :) ## SYSTEM ## Fedora 10 Postfix 2.55 Dovecot 1.2.rc2 Spamassassin 3.2.5 SELinux (no SELinux restrictions. Testing done with SELinux=permissive.) SASLAuthd (not required for local delivery) ## dovecot -n ## # 1.2.rc2: /usr/local/etc/dovecot.conf # OS: Linux 2.6.27.15-170.2.24.fc10.i686 i686 Fedora rel 10 (Cambridge) protocols: imaps listen: *:993 ssl_cert_file: /etc/pki/dovecot/certs/dovecot.pem ssl_key_file: /etc/pki/dovecot/private/dovecot.pem login_dir: /usr/local/var/run/dovecot/login login_executable: /usr/local/libexec/dovecot/imap-login first_valid_gid: 0 mail_location: maildir:~/Maildir auth default: passdb: driver: pam userdb: driver: passwd ## /usr/local/etc/dovecot.conf ## socket listen { master { path = /var/run/dovecot/auth-master mode = 0666 # user = group = dovecot } client { path = /var/run/dovecot/auth-client mode = 0666 # user = group = dovecot } } ## POSTFIX CONFIG ## /etc/postfix/main.cf: mailbox_transport = spamassassin /etc/postfix/master.cf: spamassassin unix - n n - - pipe user=spam:dovecot argv=/usr/bin/spamc -f -e /usr/libexec/dovecot/deliver -f ${sender} -d ${user} -m ${extension} ## PERMISSIONS / OWNERSHIP ## /usr/local/libexec/dovecot: -rwxr-xr-x 1 root root 197513 2009-04-03 13:52 checkpassword-reply -rwxr-xr-x 1 root dovecot 4044835 2009-04-14 13:52 deliver -rwxr-xr-x 1 root root 1044608 2009-04-03 13:52 dovecot-auth /var/run: drwxrwxrwx 3 root dovecot 4096 2009-04-14 12:07 dovecot /var/run/dovecot: drwxr-x--- 2 root dovecot 4096 2009-04-09 06:56 login /usr/bin/spamassassin: -rwxr-xr-x 1 root root 27023 2008-09-04 14:51 spamassassin /home/user: drwx------ 4 user dovecot 4096 2009-04-14 12:00 user ## 'ps aux' OUTPUT (trimmed) ## root Ss 11:14 0:02 /usr/local/sbin/dovecot root S 12:07 0:00 dovecot-auth root S 12:07 0:00 dovecot-auth -w root Ss 11:14 0:31 /usr/bin/spamd -d -c -m5 -H --username spam -r \ /var/run/spamd.pid spam S 11:14 0:27 spamd child spam S 11:14 0:08 spamd child ## 'ps aux | grep deliver' numerous times until I caught one: ## postfix S 12:47 0:00 pipe -n spamassassin -t unix user=spam:dovecot \ argv=/usr/bin/spamc -f -e /usr/libexec/dovecot/deliver -f ${sender} \ -d ${user} -m ${extension} spam Ss 12:47 0:00 /usr/bin/spamc -f -e /usr/libexec/dovecot/deliver \ -f sender(a)example.com -d user -m ## /var/log/maillog OUTPUT ## Apr 14 14:53:15 ltfs450 postfix/smtpd[23173]: connect from \ IP-ADD-RES-SS.dedicatedprovider.com[IP.ADD.RES.SS] Apr 14 14:53:15 ltfs450 postfix/smtpd[23173]: C7FB9FA00FA: \ client=IP-ADD-RES-SS.dedicatedprovider.com[IP.ADD.RES.SS] Apr 14 14:53:15 ltfs450 postfix/cleanup[23177]: C7FB9FA00FA: \ message-id=<49E4EA41.6020908(a)example-send.com> Apr 14 14:53:15 ltfs450 postfix/qmgr[23171]: C7FB9FA00FA: \ from=<sender(a)example-send.com>, size=2215, nrcpt=1 (queue active) Apr 14 14:53:15 ltfs450 postfix/smtpd[23173]: disconnect from \ IP-ADD-RES-SS.dedicatedprovider.com[IP.ADD.RES.SS] Apr 14 14:53:16 ltfs450 spamd[4121]: spamd: connection from \ localhost.localdomain [127.0.0.1] at port 50035 Apr 14 14:53:16 ltfs450 spamd[4121]: spamd: processing message \ <49E4EA41.6020908(a)example-send.com> for spam:653 Apr 14 14:53:20 ltfs450 spamd[4121]: spamd: clean message (2.2/5.0) \ for spam:653 in 4.7 seconds, 2167 bytes. Apr 14 14:53:21 ltfs450 spamd[4121]: spamd: result: . 2 - \ AWL,RDNS_DYNAMIC,TVD_SPACE_RATIO scantime=4.7,size=2167,user=spam,\ uid=653,required_score=5.0,rhost=localhost.localdomain,raddr=127.0.0.1,\ rport=50035,mid=<49E4EA41.6020908(a)example-send.com>,autolearn=no Apr 14 14:53:21 ltfs450 deliver(user): Can't connect to auth server \ at /var/run/dovecot/auth-master: Permission denied Apr 14 14:53:21 ltfs450 postfix/pipe[23179]: C7FB9FA00FA: \ to=<user(a)example-receive.com>, relay=spamassassin, delay=5.2, \ delays=0.01/0.01/0/5.2, dsn=4.3.0, status=deferred (temporary failure) Apr 14 14:53:21 ltfs450 spamd[4119]: prefork: child states: II

2 2

Re: [Dovecot] auth-master: Permission denied [sigh]
by James Butler 15 Apr '09

15 Apr '09

Oh, that was fun. Making the change below resulted in mail getting deferred with "Fatal: destination user parameter (-d user) not given" ... which apparently is caused by running deliver as 'root'! (http://archive.netbsd.se/?ml=dovecot-general&a=2008-02&t=6558196) So I am back to: -rwxr-xr-x 1 root dovecot 4044835 2009-04-03 13:52 deliver which doesn't produce the error and delivers the mail. Still no joy with Postfix+Spamassassin+Dovecot. This is unbelievably hard to get going. I started with the default installations of everything on a brand new system. I only made minimal changes as indicated by the docs. Then I made small changes as indicated by this and other mailing lists. I always reverted back to the original defaults between each effort. Now I'm just stumped. I'm not a newbie ... I've been administrating public servers for over 10 years, and using and working on the Internet since 1968! This is just the first time I've tried to use Postfix+Spamassassin+Dovecot. Previous installations have all used Sendmail+Spamassassin+Dovecot with zero issues. I want the benefits of using the Maildir storage system, but the past two weeks of trying to get this going are making me question whether that benefit is worth it. Can anyone please post their successful Postfix+Spamassassin+Dovecot setup for me to learn from? I would really appreciate it. James > I have changed /usr/local/libexec/dovecot/deliver permissions as follows: > > -rwsr-s--- 1 root dovecot 4044835 2009-04-03 13:52 deliver > > Because of message returned to 'sender(a)example-send.com': > > "local configuration error. Command output: > /usr/local/libexec/dovecot/deliver must not be both world-executable and > setuid-root. This allows root exploits. See [LDA#multipleuids wiki page]." > > Same auth-master "Permission denied" error. > > Thanks again. > > James

3 5

Re: [Dovecot] auth-master: Permission denied [sigh]
by James Butler 14 Apr '09

14 Apr '09

I have changed /usr/local/libexec/dovecot/deliver permissions as follows: -rwsr-s--- 1 root dovecot 4044835 2009-04-03 13:52 deliver Because of message returned to 'sender(a)example-send.com': "local configuration error. Command output: /usr/local/libexec/dovecot/deliver must not be both world-executable and setuid-root. This allows root exploits. See [LDA#multipleuids wiki page]." Same auth-master "Permission denied" error. Thanks again. James

2 1

[Dovecot] auth-master: Permission denied [sigh]
by James Butler 14 Apr '09

14 Apr '09

I've been messing with this for too long, now, and I'm blind to whatever's wrong. Or I'm simply being dense. Either way, I need help with a common issue. I'm trying to get Postfix+Spamassassin+Dovecot going on Fedora 10. (I'll get back to the global Sieve thingy soon, but I need to get this going, first.) When using the simple: mailbox_command = /usr/local/libexec/dovecot/deliver everything is cool, except there's no Spamassassin involvement, obviously. The problem shows itself when the Spamassassin user hands off to the recipient user and Deliver + the recipient user tries to access /var/run/dovecot/auth-master. Thank you for any insight you can provide. /var/run/dovecot: 755 root:dovecot /var/run/dovecot/login: 750 root:dovecot /var/run/dovecot/auth-master: 750 root:dovecot (I think. auth-master is a temporary file? Comes and goes.) >From /etc/postfix/main.cf mailbox_transport = spamassassin >From /etc/postfix/master.cf: spamassassin unix - n n - - pipe user=spam argv=/usr/bin/spamc -f -e /usr/libexec/dovecot/deliver -f ${sender} -d ${user} -m ${extension} Here's my 'socket listen' section from /usr/local/etc/dovecot.conf: socket listen { master { path = /var/run/dovecot/auth-master mode = 0666 #user = group = dovecot } client { path = /var/run/dovecot/auth-client mode = 0666 #user = group = dovecot } } >From /var/log/maillog: Postfix receives the message: postfix/smtpd[29447]: connect from \ IP-ADD-RE-SS.ptr.example-send.com[IP.ADD.RE.SS] postfix/smtpd[29447]: 60990FA01BA: \ client=IP-ADD-RE-SS.ptr.example-send.com[IP.ADD.RE.SS] postfix/cleanup[29451]: 60990FA01BA: \ message-id=<49E20BF2.4090408(a)example-send.com> postfix/qmgr[29441]: 60990FA01BA: from=<sender(a)example-send.com>, \ size=812, nrcpt=1 (queue active) postfix/smtpd[29447]: disconnect from \ IP-ADD-RE-SS.ptr.example-send.com[IP.ADD.RE.SS] Spamassassin processes the message as user 'spam': spamd[4121]: spamd: processing message\ <49E20BF2.4090408(a)example-send.com> for spam:653 spamd[4121]: spamd: clean message (3.0/5.0) for spam:653 in 5.2 seconds,\ 793 bytes. spamd[4121]: spamd: result: . 2 - RDNS_DYNAMIC,TVD_SPACE_RATIO \ scantime=5.2,size=793,user=spam,uid=653,required_score=5.0, \ rhost=localhost.localdomain,raddr=127.0.0.1,rport=42493, \ mid=<49E20BF2.4090408(a)example-send.com>,autolearn=no Spamassassin pipes result to Deliver which runs as recipient user. Deliver as recipient user doesn't have permission to auth: deliver(recipient): Can't connect to auth server at \ /var/run/dovecot/auth-master: Permission denied postfix/pipe[29452]: 60990FA01BA: to=<recipient(a)example-receive.com>, \ relay=spamassassin, delay=6, delays=0.33/0.01/0/5.7, dsn=4.3.0, \ status=deferred (temporary failure) 1) I must use the 'user=' arg for spamc 2) Can't use 'user=${user}' or $user: fatal: get_service_attr: unknown username: ${user} 3) Must use '-d ${user}' Deliver arg, otherwise message gets delivered to user 'spam' AArrgh! TIA.

4 9