- dovecot - dovecot.org

[Dovecot] Enforcing TLS
by Ed Schouten 09 Jan '09

09 Jan '09

Hello all, I've happily been using Dovecot for a couple of years now, but only a couple of days ago I configured it to speak both TLS and SSL for both POP3 and IMAP. Ideally I want users to use TLS, but I've enabled SSL, because some mailers (at least Apple Mail on OS X Tiger) don't support TLS. Right now I'm in sort of a transitional phase, where I'm asking users to enable TLS in their email clients, if not enabled already. After a couple of weeks/months I want to disable any (non-local) connections that don't use TLS or SSL. I already asked on IRC whether this was possible, because I was unable to find this on the Wiki. It turns out there is a configuration switch called `disable_plaintext_auth', but looking at the description this only prevents people from using plain-text username/password authentication. It does not actually enforce TLS or SSL. My question: is there support to enforce TLS when people connect to non-SSL ports? If someone comes up with a solution, I'll add it to the SSL article on the Wiki. I'm using Dovecot 1.1.7, installed on a FreeBSD 6.4-STABLE system. Thanks! -- Ed Schouten <ed(a)80386.nl> WWW: http://80386.nl/

5 8

[Dovecot] Restoring individual messages from a backup into a Maildir setup?
by Thomas Harold 09 Jan '09

09 Jan '09

We have a user who deleted IMAP folders from his account, so I simply tried to restore the folder ".FolderName" from our backup. I checked that file/folder ownership was the same as the original, but the Dovecot IMAP server is throwing errors at the client. I've tried copying the individual message files from the "cur" folders in the backup directory, but Dovecot immediate goes into panic mode and throws errors at the IMAP client when I do that. Even if the file is owned by the currect UID. I've tried putting those files into "tmp" and "new" as well, with no luck. I looked at the following thread, but it didn't help. http://www.dovecot.org/list/dovecot/2007-August/024971.html The thread from Sep 2008 wasn't much help either: http://www.mail-archive.com/dovecot@dovecot.org/msg12846.html ... Eh, I figured this out before I even posted. Restoration is indeed that simple. The problem is that the files were not labeled with the proper SELinux security context after being restored. When the file was restored, it was assigned a context of "root:object_r:file_t", which is not a context that the Dovecot service has permissions to interact with. I had to re-label the files after restoring them with # chcon -R user_u:object_r:mail_spool_t foldername So the lesson here is to check /var/log/messages and look for sealert indicators when restoring files. ... Hopefully that helps some other people out when dealing with Red Hat / CentOS with SELinux set to enforcing mode.

3 7

[Dovecot] dovecot-auth Temporary But Frequent CPU Spike
by Joe Clark 09 Jan '09

09 Jan '09

Hi.. I am setting up a new server (2GHz CPU, Ubuntu 8.10) and am using dovecot for an IMAP server. I have installed dovecot 1.1.4 and Squirrelmail 1.4.15. sudo dovecot -n shows this: # 1.1.4: /etc/dovecot/dovecot.conf log_timestamp: %Y-%m-%d %H:%M:%S protocols: imap login_dir: /var/run/dovecot/login login_executable: /usr/lib/dovecot/imap-login login_process_per_connection: no mail_privileged_group: mail auth default: passdb: driver: pam userdb: driver: passwd The problem I'm noticing is that if I do top -d 1 while clicking links in Squirrelmail (e.g., logging in, the Inbox link, opening a message), I see that a "dovecot-auth" process maximizes the CPU for about a second. While this is not a huge amount, it seems like with multiple users it could quickly bog down a server . Are there any recommendations or thoughts on what might cause the one-second CPU spike? -- or is that just normal operation? Thanks for your thoughts. - Joe Clark

2 1

[Dovecot] v1.1.8 released
by Timo Sirainen 09 Jan '09

09 Jan '09

http://dovecot.org/releases/1.1/dovecot-1.1.8.tar.gz http://dovecot.org/releases/1.1/dovecot-1.1.8.tar.gz.sig Most importantly mbox bugfixes. v1.1 should finally be as stable with mboxes as it was with v1.0. Hopefully we'll also soon have the first v1.2 beta release and the final v1.2.0 somewhat soon after that. - mbox: Several bugfixes. Fixes "next message unexpectedly lost" errors and perhaps some other problems as well. - deliver: It wasn't possible to override boolean settings in lda section by setting them to "no". - Maildir++ quota didn't correctly check if maildirs had changed during recalculation. - kqueue notify: Fixed assert-crash in some situations - dbox: Several fixes to handling Maildir migrations - Logging/error message improvements

6 13

[Dovecot] cannot delete emails in inbox
by JANE CUA 09 Jan '09

09 Jan '09

I am working on upgrading our current squirrelmail and replace uw-imap with dovecot. I have what looks like a successful installation. My current setup is: Centos 5.2 sendmail 8.13.8 dovecot 1.1.17 (imap) squirrelmail 1.4.17 I can send and receive email fine. However when I try to delete an email in my Inbox, it doesn't get deleted. It only sends a copy to the Trash folder. But the email is still in the Inbox. I can purge and delete the contents in my Trash and Sent folder, no problem. I am not sure if this is a Squirrelmail issue or a Dovecot issue. Please advice. Thank you -- Jane

4 8

[Dovecot] Dovecot-auth timeouts
by Javier Fox 08 Jan '09

08 Jan '09

Hello, I've unfortunately been unable to find anything relating to the problem I'm having specifically, in searching the list or google, and so I now plead to you to assistance. I'm running Dovecot as an LDA and SASL auth for Postfix on a Debian 4 box. Dovecot is version 1.0.rc15 (the official debian pkg version). The problem I'm running into is this. After some time of running (lately it's been as little as 5 minutes), I start to see the following errors in dovecot.log: deliver(user(a)domain.com): "Dec 23 14:38:47 "Error: User request from dovecot-auth timed out deliver(anotheruser(a)domain.com): "Dec 23 14:38:48 "Error: User request from dovecot-auth timed out Postfix responds to these by simply deferring the messages. Dovecot itself, however, begins to return 'Authentication failed' messages after significant lag time (sometimes greater than 30s): Connected to localhost. Escape character is '^]'. +OK Dovecot-POP user username +OK pass mypassword -ERR Authentication failed. Now, for authentication, Dovecot is using LDAP on the local server. The only additional information I can find pertaining to these errors is the following from slapd.log: slapd[22593]: connection_input: conn=6 deferring operation: pending operations These messages correspond 1-to-1 to the above 'deliver' errors, where 'conn' is always the same number. Restarting dovecot and ldap resolves the issue for a few minutes, but sure enough the errors start flowing again. I'm really at the end of my rope on this, as nothing I do seems to help. I have a good 500+ customers being effected by this as well, and they're all none too pleased by it. If this is something that will absolutely be resolved by upgrading from source, that is doable, but we'd prefer to stick with the official package version if possible. Dovecot configs follow Thanks, J. Fox ----- configs follow ----- dovecot.conf ------------ auth_verbose = yes auth_debug = yes auth_debug_passwords = yes mail_debug = no base_dir = /var/run/dovecot/ protocols = imap imaps pop3 pop3s protocol lda { postmaster_address = postmaster(a)spiritone.com auth_socket_path = /var/run/dovecot/auth-master log_path = /var/log/dovecot.log info_log_path = /var/log/mail.info } listen = * shutdown_clients = yes mmap_disable = yes lock_method = dotlock maildir_copy_with_hardlinks = no log_path = /var/log/dovecot.log info_log_path = /var/log/mail.log log_timestamp = "%b %d %H:%M:%S " syslog_facility = mail auth_default_realm = involved.com disable_plaintext_auth = no ssl_cert_file = /etc/ssl/certs/dovecot.pem ssl_key_file = /etc/ssl/private/dovecot.pem login_chroot = yes valid_chroot_dirs = /home/vmail/ login_user = postfix login_process_per_connection = yes login_processes_count = 2 login_max_processes_count = 64 login_max_connections = 128 login_greeting = Involved login_log_format_elements = user=<%u> method=%m rip=%r lip=%l %c login_log_format = %$: %s default_mail_env = maildir:/home/vmail/domains/%d/%u first_valid_uid = 103 pop3_uidl_format = %08Xu%08Xv auth_cache_size = 10485760 auth_cache_ttl = 3600 auth_worker_max_count = 10 #auth_worker_max_request_count = 50 auth default { mechanisms = PLAIN LOGIN passdb ldap { args = /etc/dovecot/dovecot-ldap.conf } userdb ldap { args = /etc/dovecot/dovecot-ldap.conf } socket listen { master { path = /var/run/dovecot/auth-master mode = 0666 user = vmail group = vmail } client { path = /var/spool/postfix/private/auth mode = 0660 user = postfix group = postfix } } user = vmail } dovecot-ldap.conf ----------------- hosts = localhost auth_bind = yes auth_bind_userdn = cn=%n,ou=%d,ou=mail,dc=domain,dc=com ldap_version = 3 base = ou=mail,dc=domain,dc=com dn = cn=Manager,dc=domain,dc=com dnpass = secret deref = never scope = subtree pass_attrs = mail=user,userPassword=password user_filter = (&(objectClass=VirtualMailAccount)(accountActive=TRUE)(mail=%u)) pass_filter = (&(objectClass=VirtualMailAccount)(accountActive=TRUE)(mail=%u)) user_global_uid = 1001 user_global_gid = 1001 ---end---

2 1

[Dovecot] Panic in v1.1.8
by Mark Sapiro 08 Jan '09

08 Jan '09

I just tried installing dovecot 1.1.8 as an upgrade to 1.1.7 and encountered Panics like the following with pop3 accesses Jan 8 10:55:31 sbh16 dovecot: Killed with signal 15 Jan 8 10:55:49 sbh16 dovecot: Dovecot v1.1.8 starting up Jan 8 10:57:01 sbh16 dovecot: pop3-login: Login: user=<user2>, method=PLAIN, rip=72.52.113.36, lip=72.52.113.36, secured Jan 8 10:57:01 sbh16 dovecot: Panic: POP3(user2): file mbox-transaction.c: line 54 (mbox_transaction_commit): assertion failed: (mbox->ibox.box.transaction_count > 0 || mbox->mbox_lock_type == F_UNLCK) Jan 8 10:57:01 sbh16 dovecot: POP3(user2): Raw backtrace: pop3 [0x80c4400] -> pop3 [0x80c445a] -> pop3 [0x80c3d5c] -> pop3 [0x806e209] -> pop3(index_transaction_commit+0x4e) [0x809251e] -> pop3(mailbox_transaction_commit+0x26) [0x80942a6] -> pop3(client_command_execute+0x3c5) [0x805b1f5] -> pop3 [0x805a152] -> pop3(io_loop_handler_run+0x100) [0x80cc100] -> pop3(io_loop_run+0x28) [0x80cb208] -> pop3(main+0x5d2) [0x805bda2] -> /lib/libc.so.6(__libc_start_main+0xdc) [0x4614cdec] -> pop3 [0x80594d1] Jan 8 10:57:01 sbh16 dovecot: child 32263 (pop3) killed with signal 6 I have a few users who access their mailbox via pop3 every few minutes and they all hit this. I reverted to 1.1.7 and all was OK Here's dovecot -n from 1.1.7. The dovecot.conf for 1.1.8 was the same. # 1.1.7: /usr/local/etc/dovecot.conf # OS: Linux 2.6.18-8.1.14.el5 i686 CentOS release 5 (Final) ext3 protocols: pop3 pop3s ssl_cert_file: /etc/postfix/grizz-cert.pem ssl_key_file: /etc/postfix/grizz-key.pem login_dir: /usr/local/var/run/dovecot/login login_executable: /usr/local/libexec/dovecot/pop3-login mail_access_groups: mail mail_location: /var/spool/mail/%u mbox_write_locks: fcntl dotlock mail_executable: /usr/local/libexec/dovecot/pop3 mail_plugin_dir: /usr/local/lib/dovecot/pop3 pop3_lock_session: yes auth default: mechanisms: plain apop login worker_max_count: 5 passdb: driver: passwd-file args: /usr/local/etc/dovecot.passwd passdb: driver: pam userdb: driver: passwd socket: type: listen client: path: /var/spool/postfix/private/auth mode: 432 user: postfix group: postfix -- Mark Sapiro <mark(a)msapiro.net> The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan

2 2

[Dovecot] delivers mail to bad directory(prefix) using sieve filters
by Radim Roska 08 Jan '09

08 Jan '09

Hi, I've installed dovecot debian stable(from backports) version (1.0.15). Its great..i just have problem with sieve filters. I use only web tool for creating filters that works for me (avelsieve plugin for squirrelmail). it creates rules, where specified folder has prefix INBOX. Thats fine.. Since dovecot has configured prefix INBOX too. BUT mails are delivered to INBOX.INBOX.test_folder and thats ugly and not usable. I've figured out new version 1.2 should work, but i dont like idea to install not stable version to production server. Is there any patch or something for stable version? Thanks a lot! Radim

4 9

[Dovecot] Bug Report in Connection with Expire Plugin
by Jörg Leis 08 Jan '09

08 Jan '09

If the expire plugin is enabled and a new message (not in trash) is deleted via IMAP in Mozilla Thunderbird (only tested in this client), it will indefinately copy the message into the folder. Dovecot, meanwhile, occupies itself with this: root@server:~# cat /var/log/dovecot.log [...] dovecot: 2008-12-26 09:21% Error: child 6132 (imap) killed with signal 11 dovecot: 2008-12-26 09:21% Error: child 6133 (imap) killed with signal 11 dovecot: 2008-12-26 09:21% Error: child 6134 (imap) killed with signal 11 dovecot: 2008-12-26 09:21% Error: child 6135 (imap) killed with signal 11 dovecot: 2008-12-26 09:21% Error: child 6136 (imap) killed with signal 11 dovecot: 2008-12-26 09:21% Error: child 6138 (imap) killed with signal 11 dovecot: 2008-12-26 09:21% Error: child 6139 (imap) killed with signal 11 dovecot: 2008-12-26 09:21% Error: child 6140 (imap) killed with signal 11 dovecot: 2008-12-26 09:21% Error: child 6142 (imap) killed with signal 11 [...] root@server:~# cat /var/log/dovecot.info [...] dovecot: 2008-12-26 09:21% Info: imap-login: Login: user=<admin(a)bildig.ch>, method=CRAM-MD5, rip=84.75.159.19, lip=92.42.190.87, TLS dovecot: 2008-12-26 09:21% Info: IMAP(admin(a)bildig.ch): Loading modules from directory: /usr/lib/dovecot/modules/imap dovecot: 2008-12-26 09:21% Info: IMAP(admin(a)bildig.ch): Module loaded: /usr/lib/dovecot/modules/imap/lib10_quota_plugin.so dovecot: 2008-12-26 09:21% Info: IMAP(admin(a)bildig.ch): Module loaded: /usr/lib/dovecot/modules/imap/lib11_imap_quota_plugin.so dovecot: 2008-12-26 09:21% Info: IMAP(admin(a)bildig.ch): Module loaded: /usr/lib/dovecot/modules/imap/lib20_expire_plugin.so dovecot: 2008-12-26 09:21% Info: IMAP(admin(a)bildig.ch): Effective uid=5000, gid=5000, home=/home/vmail/Maildirs/bildig.ch/admin dovecot: 2008-12-26 09:21% Info: IMAP(admin(a)bildig.ch): Quota root: name=User Quota backend=maildir args= dovecot: 2008-12-26 09:21% Info: IMAP(admin(a)bildig.ch): Quota rule: root=User Quota mailbox=* bytes=524288000 (0%) messages=0 (0%) dovecot: 2008-12-26 09:21% Info: IMAP(admin(a)bildig.ch): Quota rule: root=User Quota mailbox=Trash bytes=52428800 (0%) messages=0 (0%) dovecot: 2008-12-26 09:21% Info: IMAP(admin(a)bildig.ch): Quota warning: bytes=498073600 (95%) messages=0 (0%) command=/usr/local/bin/mail-quota-warning.sh 95 dovecot: 2008-12-26 09:21% Info: IMAP(admin(a)bildig.ch): Quota warning: bytes=419430400 (80%) messages=0 (0%) command=/usr/local/bin/mail-quota-warning.sh 80 dovecot: 2008-12-26 09:21% Info: IMAP(admin(a)bildig.ch): maildir: data=/home/vmail/Maildirs/bildig.ch/admin dovecot: 2008-12-26 09:21% Info: IMAP(admin(a)bildig.ch): maildir++: root=/home/vmail/Maildirs/bildig.ch/admin, index=, control=, inbox=/home/vmail/Maildirs/bildig.ch/admin dovecot: 2008-12-26 09:21% Info: imap-login: Login: user=<admin(a)bildig.ch>, method=CRAM-MD5, rip=84.75.159.19, lip=92.42.190.87, TLS dovecot: 2008-12-26 09:21% Info: IMAP(admin(a)bildig.ch): Loading modules from directory: /usr/lib/dovecot/modules/imap dovecot: 2008-12-26 09:21% Info: IMAP(admin(a)bildig.ch): Module loaded: /usr/lib/dovecot/modules/imap/lib10_quota_plugin.so dovecot: 2008-12-26 09:21% Info: IMAP(admin(a)bildig.ch): Module loaded: /usr/lib/dovecot/modules/imap/lib11_imap_quota_plugin.so dovecot: 2008-12-26 09:21% Info: IMAP(admin(a)bildig.ch): Module loaded: /usr/lib/dovecot/modules/imap/lib20_expire_plugin.so dovecot: 2008-12-26 09:21% Info: IMAP(admin(a)bildig.ch): Effective uid=5000, gid=5000, home=/home/vmail/Maildirs/bildig.ch/admin dovecot: 2008-12-26 09:21% Info: IMAP(admin(a)bildig.ch): Quota root: name=User Quota backend=maildir args= dovecot: 2008-12-26 09:21% Info: IMAP(admin(a)bildig.ch): Quota rule: root=User Quota mailbox=* bytes=524288000 (0%) messages=0 (0%) dovecot: 2008-12-26 09:21% Info: IMAP(admin(a)bildig.ch): Quota rule: root=User Quota mailbox=Trash bytes=52428800 (0%) messages=0 (0%) dovecot: 2008-12-26 09:21% Info: IMAP(admin(a)bildig.ch): Quota warning: bytes=498073600 (95%) messages=0 (0%) command=/usr/local/bin/mail-quota-warning.sh 95 dovecot: 2008-12-26 09:21% Info: IMAP(admin(a)bildig.ch): Quota warning: bytes=419430400 (80%) messages=0 (0%) command=/usr/local/bin/mail-quota-warning.sh 80 dovecot: 2008-12-26 09:21% Info: IMAP(admin(a)bildig.ch): maildir: data=/home/vmail/Maildirs/bildig.ch/admin dovecot: 2008-12-26 09:21% Info: IMAP(admin(a)bildig.ch): maildir++: root=/home/vmail/Maildirs/bildig.ch/admin, index=, control=, inbox=/home/vmail/Maildirs/bildig.ch/admin [...] When the expire plugin is disabled no error occurs. I use Dovecot 1.1.4 on Ubuntu 8.10 Intrepid with following settings: root@server:~# dovecot -n # 1.1.4: /etc/dovecot/dovecot.conf base_dir: /var/run/dovecot/ log_path: /var/log/dovecot.log info_log_path: /var/log/dovecot.info log_timestamp: %Y-%m-%d %H:%M% protocols: imaps pop3s ssl_cert_file: /etc/ssl/certs/www_bildig_ch__chained.crt ssl_key_file: /etc/ssl/private/www_bildig_ch.key login_dir: /var/run/dovecot/login login_executable(default): /usr/lib/dovecot/imap-login login_executable(imap): /usr/lib/dovecot/imap-login login_executable(pop3): /usr/lib/dovecot/pop3-login login_greeting: Dovecot ready login_process_per_connection: no login_processes_count: 1 login_max_processes_count: 8 login_max_connections: 64 valid_chroot_dirs: /var/spool/vmail mail_debug: yes mail_location: maildir:/home/vmail/Maildirs/%d/%n mail_executable(default): /usr/lib/dovecot/imap mail_executable(imap): /usr/lib/dovecot/imap mail_executable(pop3): /usr/lib/dovecot/pop3 mail_process_size: 64 mail_plugins(default): expire imap_quota quota mail_plugins(imap): expire imap_quota quota mail_plugins(pop3): expire quota mail_plugin_dir(default): /usr/lib/dovecot/modules/imap mail_plugin_dir(imap): /usr/lib/dovecot/modules/imap mail_plugin_dir(pop3): /usr/lib/dovecot/modules/pop3 pop3_uidl_format(default): %08Xu%08Xv pop3_uidl_format(imap): %08Xu%08Xv pop3_uidl_format(pop3): %08%08Xv auth default: mechanisms: cram-md5 passdb: driver: sql args: /etc/dovecot/dovecot-sql.conf userdb: driver: static args: uid=vmail gid=vmail home=/home/vmail/Maildirs/%d/%n allow_all_users=yes socket: type: listen client: path: /var/spool/postfix/private/auth mode: 432 user: postfix group: postfix master: path: /var/run/dovecot/auth-master mode: 384 user: vmail plugin: expire: Trash 30 Trash/* 30 Spam 30 expire_dict: proxy::expire quota: maildir:User Quota quota_rule: *:storage=500M quota_rule2: Trash:storage=50M quota_warning: storage=95%% /usr/local/bin/mail-quota-warning.sh 95 quota_warning2: storage=80%% /usr/local/bin/mail-quota-warning.sh 80 dict: expire: mysql:/etc/dovecot/dovecot-dict-expire.conf root@server:~# cat /etc/dovecot/dovecot-sql.conf driver = mysql connect = host=127.0.0.1 dbname=mailserver user=mailserver password=testpwd1 default_pass_scheme = CRAM-MD5 password_query = SELECT email AS user, password, quota_rule FROM view_users WHERE email='%u' root@server:~# cat /etc/dovecot/dovecot-dict-expire.conf connect = host=localhost dbname=mailserver user=mailserver_exp password=testpwd2 table = expire select_field = expire_stamp where_field = mailbox I tried using a "user_field = user" additionally as is written here: http://wiki.dovecot.org/Plugins/Expire. (Incidentally, there must be some mismatch in the documentation because the tables for v1.1 do not contain a field username). Of course I adapted the MySQL database accordingly. Unfortunately I was unable to produce a backtrace. Thanks, Joerg Leis

2 1

[Dovecot] Apple patches 1-5
by Mike Abbott 08 Jan '09

08 Jan '09

Here are the first few simple patches from Apple, based on dovecot-1.1.7. The comments with "APPLE" in them helped us merge in your new releases; feel free to remove them. Please let me know if you want subsequent patches in a different format, or if you have any questions. Patch #1. Some versions of Mac OS X have buggy CMSG_* macros. Patch #2. Don't set "<username>=1" in the environment. Patch #3. Some versions of Mac OS X return near-duplicate kevents. Patch #4. Null renames are actually pretty slow on HFS (Apple's file system), so avoid them. Patch #5. Required by Apple's lawyers.

3 12