- dovecot - dovecot.org

[Dovecot] deliver to root
by Philipp Kolmann 05 Mar '09

05 Mar '09

Hi, we use dovecot 1.1.11 on a RH Server with sendmail. Local delivery is done with deliver: Mlocal, P=/usr/local/libexec/dovecot/deliver, F=lsDFMAw5:/|@qSPfhn9, S=EnvFromL/HdrFromL, R=EnvToL/HdrToL, T=DNS/RFC822/X-Unix, A=deliver -d $u This setup works without issues for us, but mail to root has a problem with deliver: deliver(root): Mar 04 16:31:31 Error: userdb(root) returned 0 as uid deliver(root): Mar 04 16:31:31 Error: userdb(root) returned 0 as gid deliver(root): Mar 04 16:31:31 Error: User root is missing UID (set mail_uid) Is it generally not possible to use deliver to deliver mail to root? Thanks Philipp

4 3

[Dovecot] Outlook cant delete folders
by Romer Ventura 05 Mar '09

05 Mar '09

Hello, It has been brought to my attention that outlook users cant delete folders from their mailbox. They can move them around and erase emails, but when it comes to folders, they cant.. Any ideas..? # dovecot --version 1.1.7 # dovecot -n # 1.1.7: /etc/dovecot/dovecot.conf # OS: Linux 2.6.16.60-0.21-xenpae i686 SUSE Linux Enterprise Server 10 (i586) login_dir: /var/run/dovecot/login login_executable: /usr/lib/dovecot/imap-login mail_uid: vmail mail_gid: vmail mail_location: maildir:~/Maildir/ mail_plugins: lazy_expunge imap_client_workarounds: delay-newmail outlook-idle netscape-eoh namespace: type: private separator: / inbox: yes list: yes subscriptions: yes namespace: type: private separator: / prefix: .EXPUNGED/ location: maildir:/home/vmail/%Ud/%Ln/Maildir/expunged list: yes subscriptions: yes namespace: type: private separator: / prefix: .DELETED/ location: maildir:/home/vmail/%Ud/%Ln/Maildir/deleted list: yes subscriptions: yes namespace: type: private separator: / prefix: .DELETED/.EXPUNGED/ location: maildir:/home/vmail/%Ud/%Ln/Maildir/deleted/expunged list: yes subscriptions: yes auth default: mechanisms: plain login passdb: driver: ldap args: /etc/dovecot/dovecot-ldap.conf userdb: driver: ldap args: /etc/dovecot/dovecot-ldap.conf socket: type: listen client: path: /var/spool/postfix/private/auth mode: 432 user: postfix group: postfix master: path: /var/run/dovecot/auth-master mode: 384 user: vmail group: vmail plugin: lazy_expunge: .EXPUNGED/ .DELETED/ .DELETED/.EXPUNGED/

4 7

Re: [Dovecot] failed assertion in 1.1.8: istream.c: line 81
by Timo Sirainen 05 Mar '09

05 Mar '09

On Wed, 2009-03-04 at 10:12 -0500, Alan Ferrency wrote: > Hi. > > I applied the patch, and the assertion did move to istream-raw-mbox.c. > > I've attached a script of the gdb session with the prints you requested. Thanks. See if applying this patch helps: http://hg.dovecot.org/dovecot-1.1/raw-rev/632777217f7b Keep my previous debug patch also in case this doesn't fix it.

1 0

[Dovecot] set \Seen flag on mail
by J.P. Trosclair 04 Mar '09

04 Mar '09

I'm looking for a way to set the \Seen flag on certain mail no matter what. Currently I'm using a global sieve script to do this. From what I've read, there is no way to enforce the global script if the user creates their own sieve script. More details: I have a postfix transport that along with sender_bcc_maps and recipient_bcc_maps uses deliver to create a read only archive of user's mail. The mail intended to be archived is stored in a per user imap folder called "Archives" that uses the ACL plugin to make the messages there read only. In addition to that, I want the mail marked as \Seen upon delivery so that user's who subscribe to the Arhives folder don't see new mail indications and what not when mail is delivered there. Is there a better way to set the \Seen flag other than the global sieve script since it can be overridden by the user? -- J.P. Trosclair

4 3

[Dovecot] tls and auth plain login
by Bradley Giesbrecht 04 Mar '09

04 Mar '09

Hello List, I want to allow plain text passwords only on ssl/tls. Is it possible to have: auth default { mechanisms = cram-md5 ntlm ...... } and then over-ride this when connection is ssl/tls to allow plain and login? I have tried adding "mechanisms = plain login cram-md5 ntlm" to "protocol imaps{}" as an example but I get an error that the protocol does not exist. I read somewhere today that dovecot enables plain automatically over secure connections (ssl/tls) but I'm not seeing it. Also, "auth default" suggests that "auth something_else" is possible. I'm probably just doing a poor job of research but I'm not finding the answers I'm seeking. Using postfix and lda. # openssl s_client -connect localhost:993 # a01 capability * CAPABILITY IMAP4rev1 SASL-IR SORT THREAD=REFERENCES MULTIAPPEND UNSELECT LITERAL+ IDLE CHILDREN NAMESPACE LOGIN-REFERRALS UIDPLUS LIST- EXTENDED I18NLEVEL=1 AUTH=CRAM-MD5 AUTH=NTLM a01 OK Capability completed. Note about below, fd limit is increased management script. # dovecot -n # 1.1.3: /opt/local/etc/dovecot/dovecot.conf Warning: fd limit 256 is lower than what Dovecot can use under full load (more than 768). Either grow the limit or change login_max_processes_count and max_mail_processes settings log_path: /opt/local/var/ispbox/log/mail/dovecot.log protocols: imap imaps pop3 pop3s ssl_cert_file: /opt/local/etc/ssl/certs/dovecot.pem ssl_key_file: /opt/local/etc/ssl/private/dovecot.pem login_dir: /opt/local/var/run/dovecot/login login_executable(default): /opt/local/libexec/dovecot/imap-login login_executable(imap): /opt/local/libexec/dovecot/imap-login login_executable(pop3): /opt/local/libexec/dovecot/pop3-login mail_location: dbox:/opt/local/var/ispbox/mail/%d/%n/dbox mail_executable(default): /opt/local/libexec/dovecot/imap mail_executable(imap): /opt/local/libexec/dovecot/imap mail_executable(pop3): /opt/local/libexec/dovecot/pop3 mail_plugin_dir(default): /opt/local/lib/dovecot/imap mail_plugin_dir(imap): /opt/local/lib/dovecot/imap mail_plugin_dir(pop3): /opt/local/lib/dovecot/pop3 auth default: mechanisms: cram-md5 ntlm passdb: driver: sql args: /opt/local/etc/dovecot/dovecot_mysql.conf userdb: driver: prefetch userdb: driver: sql args: /opt/local/etc/dovecot/dovecot_mysql.conf socket: type: listen client: path: /opt/local/var/spool/postfix/private/auth mode: 432 user: _postfix group: _postfix master: path: /opt/local/var/run/dovecot/auth-master mode: 384 user: _vmail Thanks for any tips, //Bradley

3 7

[Dovecot] no auth attempts: log
by Mathieu Kretchner 04 Mar '09

04 Mar '09

Hello, is there any option that could disable such log : Mar 2 16:47:31 imap dovecot: imap-login: Disconnected (no auth attempts): rip=127.0.0.1, lip=127.0.0.1, secured, port=143 Mar 2 16:48:31 imap last message repeated 2 times Mar 2 16:49:32 imap last message repeated 2 times Mar 2 16:51:02 imap last message repeated 3 times Mar 2 16:52:02 imap last message repeated 2 times Thanks.

3 3

[Dovecot] Shared mailbox documentation updated
by Timo Sirainen 04 Mar '09

04 Mar '09

http://wiki.dovecot.org/SharedMailboxes Anything missing? Anything still need clarifying?

4 3

[Dovecot] dovecot 1.1.11 errors
by Stéphane Cottin 03 Mar '09

03 Mar '09

Hi, I sometimes got the following log entries with dovecot 1.1.11 : mail.err: Feb 27 10:06:54 dovecot: IMAP(hidden(a)email.com): write(dnotify pipe) failed: Bad file descriptor mail.err: Feb 27 10:06:54 dovecot: IMAP(hidden(a)email.com): close(dnotify pipe[0]) failed: Bad file descriptor mail.err: Feb 27 10:06:54 dovecot: IMAP(hidden(a)email.com): close(dnotify pipe[1]) failed: Bad file descriptor [...] mail.err: Feb 27 10:17:55 dovecot: child 18656 (imap) returned error 82 (Internal logging error) any thougths ? Stéphane Cottin

3 2

[Dovecot] problems with dotlock
by Mark Hedges 03 Mar '09

03 Mar '09

I have to make dotlock work because this openwebmail thing only supports one of dotlock or flock, but procmail delivery does dotlock and fcntl. procmail correctly creates a dotlock file in /var/spool/mail/username.lock when delivering, I can watch this with `while :; do ls -la | grep lock; done`. It works fine when lock_method=fcntl, but no dotlock file shows up in /var/spool/mail. mbox_write_locks are working correctly with mbox_write_locks = dotlock fcntl, the dotlock file shows up in the user's mail directory. However, dotlocking /var/spool/mail doesn't work: $ ls -la /var/spool/mail total 44 drwxrwxr-x 2 root mail 4096 Feb 25 17:39 . $ grep mail_privileged_group /etc/mail/dovecot.conf mail_privileged_group = mail Feb 25 17:45:45 anubis dovecot: POP3(despam_test_anubis): Effective uid=511, gid=100 Feb 25 17:45:45 anubis dovecot: POP3(despam_test_anubis): mbox: data=/home/anubis/despam_test_anubis/mail:INBOX=/var/spool/mail/despam_test_anubis Feb 25 17:45:45 anubis dovecot: POP3(despam_test_anubis): mbox: root=/home/anubis/despam_test_anubis/mail, index=/home/anubis/despam_test_anubis/mail, inbox=/var/spool/mail/despam_test_anubis Feb 25 17:45:45 anubis dovecot: POP3(despam_test_anubis): file_lock_dotlock() failed with mbox file /var/spool/mail/despam_test_anubis: Permission denied Feb 25 17:45:45 anubis dovecot: POP3(despam_test_anubis): Couldn't open INBOX: Internal error occurred. Refer to server log for more information. [2009-02-25 17:45:45] Feb 25 17:45:45 anubis dovecot: POP3(despam_test_anubis): Couldn't open INBOX top=0/0, retr=0/0, del=0/0, size=0 Feb 25 17:45:45 anubis dovecot: pop3-login: Login: user=<despam_test_anubis>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, secured gid=100 = group 'users'. I tried making all of the binaries root:mail with g+s, same as /usr/bin/lockfile, but this was no help. It also does not help to chmod +t /var/spool/mail. $ dovecot --version 1.0.7 kernel 2.6.18-92.1.22.el5 centos mmap_disable = yes (req'd for ~/mail dotlocks, makes no difference either way for /var/spool/mail) Any ideas? Thanks, Mark

6 34

[Dovecot] GSSAPI cross-realm still broken
by Bryan Jacobs 03 Mar '09

03 Mar '09

I've been trying to track down some problems with Dovecot in a Kerberos 5 cross-realm environment, and there seem to be a few issues. LOGIN/PLAIN work fine using pam_krb5, but GSSAPI is a bit harder to handle. On line 436 of src/auth/mech-gssapi.c, the authn_name and the authz_name are compared using gss_compare_name. This dates back to the message at: http://dovecot.org/pipermail/dovecot/2005-October/009615.html While everything within that message is true, as things stand, Dovecot is unusable in a cross-realm environment. When cross-realm tickets are used, the authn_name is "username@REALM" and the authz_name is "username" (or vice versa, I don't remember). The attached patch causes dovecot to display these two values in human-readable format to illustrate the issue. Because these two GSS names differ, Dovecot refuses to allow access in spite of the fact that krb5_kuserok would return TRUE. I am not the only one to have noticed this problem: http://dovecot.org/pipermail/dovecot/2007-July/023868.html http://dovecot.org/pipermail/dovecot/2007-October/026027.html Might I suggest that some more robust security checking be done instead of abusing gss_compare_name like this? I don't know how to do this using GSSAPI, but on the Kerberos side Heimdal provides the function krb5_kuserok. Dovecot could also just have a configurable file listing acceptable krb5 principals (preferably in .k5login syntax) and check that both auth_name and authz_name are in the list. Bryan Jacobs

1 0