- dovecot - dovecot.org

[Dovecot] IMAP ACLs and global ACLs in v1.2
by Timo Sirainen 23 Feb '09

23 Feb '09

I just committed code for IMAP ACL support based on the code from Kolab people. I did quite large changes though. I also changed how global ACLs are handled. Previously local ACLs could override global ACLs, but now that users are able to modify the ACLs I think it should be the other way around. From what I've heard global ACLs are typically added for things like 1) disallowing user from doing something in specific mailboxes such as expunge messages, 2) giving a specific master user access to some mailboxes ONLY, such as voicemail. For 1) case a user really shouldn't be able to grant himself privileges back but still should be able to share the mailbox to others (so the global ACL should have 'a' privilege). For 2) case a user shouldn't be able to remove privileges from the voicemail. So now the user can freely update the local ACLs in whatever way he wants. But in the end if there are any global ACLs, all the local ACLs for those identifiers are ignored. Also local negative identifiers are ignored, so that e.g. global "user=foo lr" can't be disabled by a local "-user=foo lr" ACL. I guess I should update the Wiki ACL page about how exactly the ACLs are applied now that they're well in my memory. :) One thing I'm not really sure about is the "owner" handling. IMAP ACL specifications have no such concept. I think many/most other servers simply add a default ACL for the user name directly. It's a useful concept though, especially with the global ACLs. So currently Dovecot replies: x getacl inbox * ACL "inbox" "owner" lrwstiekxacd x OK Getacl completed. But should it just internally convert "owner" to "username" when replying? But then again if there's a separate rule directly for the "username" it breaks. Do any of the existing ACL-capable IMAP clients want to see the username in the ACL reply or can they handle "owner" just fine? Also what about global ACLs? The current code just lists them twice with local ACLs, which is definitely wrong: x getacl foo * ACL "foo" "xx" w "xx" lr "owner" lrwstiekxacd x OK Getacl completed. Perhaps the global ACLs could have a prefix character? Maybe '#'? Which reminds me, the current dovecot-acl file is mapped to IMAP ACLs like this: dovecot-acl : IMAP ACL - anyone : anyone - authenticated : authenticated - owner : owner - user=name : name - group=name : $name - group-override=name : !$name So all global ACLs would get the # prefix, like #anyone, #name, #!$name. Any thoughts? BTW. Listing shared mailboxes still doesn't work. I guess we'll see tomorrow if I still have energy to get that done.

6 14

[Dovecot] dovecot auth
by ben 23 Feb '09

23 Feb '09

Hi, I'm using dovecot with a passdb-file . When I login using : test(a)testdomain.com I notice dovecot strips off the domainname and looks up everything in front of the @ in his passdb-file... So I went on to configure the following in my dovecot.conf : auth_username_format = %u@%d restarted dovecot, but he still strips of the @ and the domainname ... LOG (sorry for f* up format) : dovecot: Feb 21 12:15:08 Info: auth(default): new auth connection: pid=24483 dovecot: Feb 21 12:15:12 Info: auth(default): client in: AUTH 1 PLAIN service=pop3 lip=195.207.136.102 rip=195.207.136.108 lport=110 rport=36132 resp=AGJlbkBpdHV4LmJlAHRlc3QxMjMu dovecot: Feb 21 12:15:12 Info: auth(default): passwd-file(test@testdomain.com@testdomain.com,195.207.136.108): lookup: user=test file=/opt/dovecot/etc/dovecot.passwd dovecot: Feb 21 12:15:12 Info: auth(default): passwd-file(test@testdomain.com@testdomain.com,195.207.136.108): unknown user dovecot: Feb 21 12:15:14 Info: auth(default): client out: FAIL 1 user=test(a)testdomain.com Can someone enlighten me on how to config it so he looks up "test(a)testdomain.com" fully ? thx

3 5

[Dovecot] Cant Receive Email from dovecot pop
by Linux Advocate 22 Feb '09

22 Feb '09

Guys, i am new to dovecot. I am not able to retrieve email from an account that i just setup. A. This is the output from /var/log.maillog. ........................................................... Feb 21 18:01:31 fwgw dovecot: auth(default): client in: AUTH 1 PLAIN service=POP3 lip=::ffff:60.54.174.146 rip=::ffff:60.50.250.8 resp=<hidden> Feb 21 18:01:31 fwgw dovecot: auth-worker(default): mysql: Connected to localhost (postfix) Feb 21 18:01:31 fwgw dovecot: auth-worker(default): sql(fizan,::ffff:60.50.250.8): query: SELECT password FROM mailbox WHERE username = 'fizan' Feb 21 18:01:31 fwgw dovecot: auth-worker(default): sql(fizan,::ffff:60.50.250.8): unknown user Feb 21 18:01:32 fwgw dovecot: auth(default): new auth connection: pid=3567 Feb 21 18:01:32 fwgw dovecot: auth(default): client out: FAIL 1 user=fizan Feb 21 18:01:32 fwgw dovecot: pop3-login: Aborted login: user=<fizan>, method=PLAIN, rip=::ffff:60.50.250.8, lip=::ffff:60.54.174.146 B. This is my /etc/dovecont.conf ............................................ ## Dovecot configuration file protocols = imap pop3 auth default { userdb sql { args = /etc/dovecot-mysql.conf } passdb sql { args = /etc/dovecot-mysql.conf } } first_valid_uid = 89 default_mail_env = maildir:/home/vmail/%d/%n # Debugging options auth_verbose = yes auth_debug = yes C. Error Message from the Email Client - Kmail ................................................................ I get a messge saying; "Could not Login to mail.mesara.biz. The password may be wrong. The server said authentication failed" D. Other info ............. I am running on a Centos 5.2 box , with postfix 2.3, dovecot 1.0.7, mysql 5.0.45 Pls help. Much appreciated. Regards. gomez

2 6

[Dovecot] TLS / Dovecot / POP3
by John Espiro 22 Feb '09

22 Feb '09

I am using Thunderbird 2.x as my client, Dovecot on the server (POP3 not IMAP). Currently I have in my conf file: protocols = pop3s pop3 ssl_disable = no ssl_cert_file = /usr/share/ssl/certs/dovecot.pem ssl_key_file = /usr/share/ssl/private/dovecot.pem ssl_parameters_file = /var/run/dovecot/ssl-parameters.dat disable_plaintext_auth = yes login = pop3 In Thunderbird, I have the email server setup to: - Port 110 - TLS Here's my question: If I change protocols = pop3s pop3 to protocols = pop3s I can no longer connect to my mail server via Thunderbird unless I setup Thunderbird to use SSL. Am I doing something wrong? Thanks, John

2 1

[Dovecot] LDAP documentation cleanups
by Timo Sirainen 22 Feb '09

22 Feb '09

I remember some people also complained how the LDAP documentation was messy. Here's my attempt at cleaning it up: http://wiki.dovecot.org/AuthDatabase/LDAP Anything still unclear? (Other than SSL/TLS setup. Someone who knows how it really works should write something there.)

1 0

[Dovecot] Problem with v1.1.10
by Cyrus Rahman 22 Feb '09

22 Feb '09

I've been using 1.1.8 successfully but tried out 1.1.10 this morning. I have a combination of system and virtual users. The system users were unaffected by the change, but the virtual users all lost access to their mail because their home directories, as interpreted by dovecot, moved from user@domain to user@user@domain. The location of the home directory is given to dovecot for virtual users using the static db as uid=vmail gid=vmail home=/var/vmail/%u mail=maildir:~/Inboxdir Were there any changes in this area that might have caused the problem? Cyrus dovecot -n output: # 1.1.10: /usr/local/etc/dovecot.conf # OS: FreeBSD 7.1-RELEASE-p2 amd64 protocols: imaps managesieve ssl_cert_file: /etc/ssl/dovecot/certs/dovecot.pem ssl_key_file: /etc/ssl/dovecot/private/dovecot.pem login_dir: /var/run/dovecot/login login_executable(default): /usr/local/libexec/dovecot/imap-login login_executable(imap): /usr/local/libexec/dovecot/imap-login login_executable(managesieve): /usr/local/libexec/dovecot/managesieve-login login_greeting_capability(default): yes login_greeting_capability(imap): yes login_greeting_capability(managesieve): no verbose_proctitle: yes first_valid_uid: 1000 first_valid_gid: 1000 mail_privileged_group: mail mail_location: mbox:~/.dovecot:INBOX=/var/mail/%u mail_executable(default): /usr/local/libexec/dovecot/imap mail_executable(imap): /usr/local/libexec/dovecot/imap mail_executable(managesieve): /usr/local/libexec/dovecot/managesieve mail_plugins(default): expire quota imap_quota trash fts fts_squat antispam autocreate mail_plugins(imap): expire quota imap_quota trash fts fts_squat antispam autocreate mail_plugins(managesieve): mail_plugin_dir(default): /usr/local/lib/dovecot/imap mail_plugin_dir(imap): /usr/local/lib/dovecot/imap mail_plugin_dir(managesieve): /usr/local/lib/dovecot/managesieve imap_client_workarounds(default): delay-newmail netscape-eoh tb-extra-mailbox-sep imap_client_workarounds(imap): delay-newmail netscape-eoh tb-extra-mailbox-sep imap_client_workarounds(managesieve): dict_db_config: /usr/local/etc/dovecot-db.conf sieve_storage(default): sieve_storage(imap): sieve_storage(managesieve): ~/.sieve sieve(default): sieve(imap): sieve(managesieve): ~/.dovecot.sieve namespace: type: private separator: / prefix: #mbox/ inbox: yes hidden: yes subscriptions: yes namespace: type: private separator: / location: maildir:~/Maildir list: yes subscriptions: yes auth default: mechanisms: plain login username_format: %Lu passdb: driver: pam args: session=yes dovecot passdb: driver: sql args: /usr/local/etc/dovecot-sql.conf userdb: driver: passwd args: blocking=yes userdb: driver: static args: uid=vmail gid=vmail home=/var/vmail/%u mail=maildir:~/Inboxdir socket: type: listen client: path: /var/run/dovecot/auth-client mode: 432 master: path: /var/run/dovecot/auth-master mode: 384 user: vmail group: vmail

4 6

[Dovecot] dovecot 1.2 virtual folders question
by Robert Schetterer 22 Feb '09

22 Feb '09

Hi Timo is this possible a possible setup ? for downloading imap folders ( including inbox ) with pop3 controlled by a a dovecot-virtual file in usr/local/virtual/%d/%u/ with content something like that * -Trash -Trash/* -Sent -Sent/* -Drafts -Drafts/* all namespace private { separator = / prefix = "" location=maildir:/usr/local/virtual/%d/%u/:CONTROL=/usr/local/virtual/%d/%u/:INDEX=/usr/local/virtual/%d/%u/ inbox = yes subscriptions = yes list = yes } namespace private { prefix = virtual/ separator = / location = virtual:/usr/local/virtual/%d/%u:LAYOUT=maildir++ inbox = no } it doesnt work yet, but i am nearly sure that i havent understand http://wiki.dovecot.org/Plugins/Virtual perhaps you might bring me on the way background : i want to include a global sieve rule which sorts marked spam mails in a subfolder of inbox called Junk, so that users never can overide it and set perhaps an autoreply by an Sieve rule by incomming mail to inbox to make it possible that pop3 users may fetch sorted Spam mails outta the Junk folder too, i wanna use virtual setup folders Trash , Sent , Drafts are standart folders are standart and should be ignored with that -- Best Regards MfG Robert Schetterer Germany/Munich/Bavaria

2 11

[Dovecot] DIGEST-MD5 user/realm mismatch with Postfix
by Darren Pilgrim 22 Feb '09

22 Feb '09

This is a follow-on to the "SQL field format for digest-md5?" thread. After some additional debugging, I've found the problem is a mismatch in what Dovecot expects and Postfix uses for the user and realm. For a username "user(a)example.com" and password "sekret", Dovecot expects: username = "user" realm = "example.com" but Postfix sends the checksum of: username = "user(a)example.com" realm = "" How do I fix this?

2 1

Re: [Dovecot] Concurrent POP3 Sessions Issues
by Timo Sirainen 22 Feb '09

22 Feb '09

Did you already solve this? If not, just mail the strace output to me privately and I'll take a look at it. On Fri, 2009-01-30 at 09:39 -0300, Mauricio López Riffo wrote: > Timo, > > What messages should be see? I execute the commands and shows a lot > of messages, i dont know what it means, i m not a programmer :) > > > Thanks > > ---- > > Mauricio López Riffo > Red Hat Certified Engineer > 804006455319519 > Netline Telecomunicaciones Chile > Los Conquistadores 2430, Providencia, Santiago. > Codigo Postal: 7530041 > Fono: +562 6560600 > Móvil: +569 90992366 > > > -----Mensaje original----- > > De: Timo Sirainen [mailto:tss@iki.fi] > > Enviado el: jueves, 29 de enero de 2009 20:46 > > Para: mauricio.lopez(a)netline.net; Dovecot Mailing List > > Asunto: Re: [Dovecot] Concurrent POP3 Sessions Issues > > > > On Jan 29, 2009, at 1:17 PM, Mauricio López Riffo wrote: > > > > > I have problems with dovecot + ldap + nfs, we could't have more than > > > 20 concurrent sessions of pop3, when user 21 comes, the auth process > > > takes more than 1 sec and is incresing (while most users arrives, more > > > delay in > > > autenticacion exists) and my customers complaint about the service. > > > We need > > > support about 200 concurrents pop3 users, here is my details > > > > Someone else was recently complaining about the same thing. Or was it you? > Anyway, > > dovecot-auth doesn't know how many users are logged in so if the problem > really is 21 > > *concurrent users* instead of n logins/ second, I find it highly unlikely > that the problem is > > with authentication. > > > > My guess is that this has something to do with NFS. Perhaps start Dovecot > with strace -tt -f > > dovecot and then when it's slowing down see what syscall it says is > blocking. >

1 0

[Dovecot] One Dovecot serving 2 domains - possible?
by k bah 22 Feb '09

22 Feb '09

I'm talking about Dovecot 1.0.x, since 1.1.x showed some problems on some of my servers. -- Is it possible to have Dovecot on one machine serving two different domains? How can I set the mailboxes root to one domain to /dir1/ and to the other domain to /dir2/ ? I want all mailboxes from one domain to reside on a different mailbox root. I use Dovecot LDA. Is is possible to set a LDAP config to one domain and another LDAP config to the other (the auth part, I wan't users to reside on different bases on my LDAP tree, so search bases need to be different) thanks in advance = Scrublade Wipers New, Heavy Duty, wiper design to remove bugs and road slime. http://a8-asy.a8ww.net/a8-ads/adftrclick?redirectid=2b9f0c9f1afcc5e7181028e… -- Powered by Outblaze

2 1