- dovecot - dovecot.org

[Dovecot] tls and auth plain login
by Bradley Giesbrecht 04 Mar '09

04 Mar '09

Hello List, I want to allow plain text passwords only on ssl/tls. Is it possible to have: auth default { mechanisms = cram-md5 ntlm ...... } and then over-ride this when connection is ssl/tls to allow plain and login? I have tried adding "mechanisms = plain login cram-md5 ntlm" to "protocol imaps{}" as an example but I get an error that the protocol does not exist. I read somewhere today that dovecot enables plain automatically over secure connections (ssl/tls) but I'm not seeing it. Also, "auth default" suggests that "auth something_else" is possible. I'm probably just doing a poor job of research but I'm not finding the answers I'm seeking. Using postfix and lda. # openssl s_client -connect localhost:993 # a01 capability * CAPABILITY IMAP4rev1 SASL-IR SORT THREAD=REFERENCES MULTIAPPEND UNSELECT LITERAL+ IDLE CHILDREN NAMESPACE LOGIN-REFERRALS UIDPLUS LIST- EXTENDED I18NLEVEL=1 AUTH=CRAM-MD5 AUTH=NTLM a01 OK Capability completed. Note about below, fd limit is increased management script. # dovecot -n # 1.1.3: /opt/local/etc/dovecot/dovecot.conf Warning: fd limit 256 is lower than what Dovecot can use under full load (more than 768). Either grow the limit or change login_max_processes_count and max_mail_processes settings log_path: /opt/local/var/ispbox/log/mail/dovecot.log protocols: imap imaps pop3 pop3s ssl_cert_file: /opt/local/etc/ssl/certs/dovecot.pem ssl_key_file: /opt/local/etc/ssl/private/dovecot.pem login_dir: /opt/local/var/run/dovecot/login login_executable(default): /opt/local/libexec/dovecot/imap-login login_executable(imap): /opt/local/libexec/dovecot/imap-login login_executable(pop3): /opt/local/libexec/dovecot/pop3-login mail_location: dbox:/opt/local/var/ispbox/mail/%d/%n/dbox mail_executable(default): /opt/local/libexec/dovecot/imap mail_executable(imap): /opt/local/libexec/dovecot/imap mail_executable(pop3): /opt/local/libexec/dovecot/pop3 mail_plugin_dir(default): /opt/local/lib/dovecot/imap mail_plugin_dir(imap): /opt/local/lib/dovecot/imap mail_plugin_dir(pop3): /opt/local/lib/dovecot/pop3 auth default: mechanisms: cram-md5 ntlm passdb: driver: sql args: /opt/local/etc/dovecot/dovecot_mysql.conf userdb: driver: prefetch userdb: driver: sql args: /opt/local/etc/dovecot/dovecot_mysql.conf socket: type: listen client: path: /opt/local/var/spool/postfix/private/auth mode: 432 user: _postfix group: _postfix master: path: /opt/local/var/run/dovecot/auth-master mode: 384 user: _vmail Thanks for any tips, //Bradley

3 7

[Dovecot] no auth attempts: log
by Mathieu Kretchner 04 Mar '09

04 Mar '09

Hello, is there any option that could disable such log : Mar 2 16:47:31 imap dovecot: imap-login: Disconnected (no auth attempts): rip=127.0.0.1, lip=127.0.0.1, secured, port=143 Mar 2 16:48:31 imap last message repeated 2 times Mar 2 16:49:32 imap last message repeated 2 times Mar 2 16:51:02 imap last message repeated 3 times Mar 2 16:52:02 imap last message repeated 2 times Thanks.

3 3

[Dovecot] Shared mailbox documentation updated
by Timo Sirainen 04 Mar '09

04 Mar '09

http://wiki.dovecot.org/SharedMailboxes Anything missing? Anything still need clarifying?

4 3

[Dovecot] dovecot 1.1.11 errors
by Stéphane Cottin 04 Mar '09

04 Mar '09

Hi, I sometimes got the following log entries with dovecot 1.1.11 : mail.err: Feb 27 10:06:54 dovecot: IMAP(hidden(a)email.com): write(dnotify pipe) failed: Bad file descriptor mail.err: Feb 27 10:06:54 dovecot: IMAP(hidden(a)email.com): close(dnotify pipe[0]) failed: Bad file descriptor mail.err: Feb 27 10:06:54 dovecot: IMAP(hidden(a)email.com): close(dnotify pipe[1]) failed: Bad file descriptor [...] mail.err: Feb 27 10:17:55 dovecot: child 18656 (imap) returned error 82 (Internal logging error) any thougths ? Stéphane Cottin

3 2

[Dovecot] problems with dotlock
by Mark Hedges 04 Mar '09

04 Mar '09

I have to make dotlock work because this openwebmail thing only supports one of dotlock or flock, but procmail delivery does dotlock and fcntl. procmail correctly creates a dotlock file in /var/spool/mail/username.lock when delivering, I can watch this with `while :; do ls -la | grep lock; done`. It works fine when lock_method=fcntl, but no dotlock file shows up in /var/spool/mail. mbox_write_locks are working correctly with mbox_write_locks = dotlock fcntl, the dotlock file shows up in the user's mail directory. However, dotlocking /var/spool/mail doesn't work: $ ls -la /var/spool/mail total 44 drwxrwxr-x 2 root mail 4096 Feb 25 17:39 . $ grep mail_privileged_group /etc/mail/dovecot.conf mail_privileged_group = mail Feb 25 17:45:45 anubis dovecot: POP3(despam_test_anubis): Effective uid=511, gid=100 Feb 25 17:45:45 anubis dovecot: POP3(despam_test_anubis): mbox: data=/home/anubis/despam_test_anubis/mail:INBOX=/var/spool/mail/despam_test_anubis Feb 25 17:45:45 anubis dovecot: POP3(despam_test_anubis): mbox: root=/home/anubis/despam_test_anubis/mail, index=/home/anubis/despam_test_anubis/mail, inbox=/var/spool/mail/despam_test_anubis Feb 25 17:45:45 anubis dovecot: POP3(despam_test_anubis): file_lock_dotlock() failed with mbox file /var/spool/mail/despam_test_anubis: Permission denied Feb 25 17:45:45 anubis dovecot: POP3(despam_test_anubis): Couldn't open INBOX: Internal error occurred. Refer to server log for more information. [2009-02-25 17:45:45] Feb 25 17:45:45 anubis dovecot: POP3(despam_test_anubis): Couldn't open INBOX top=0/0, retr=0/0, del=0/0, size=0 Feb 25 17:45:45 anubis dovecot: pop3-login: Login: user=<despam_test_anubis>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, secured gid=100 = group 'users'. I tried making all of the binaries root:mail with g+s, same as /usr/bin/lockfile, but this was no help. It also does not help to chmod +t /var/spool/mail. $ dovecot --version 1.0.7 kernel 2.6.18-92.1.22.el5 centos mmap_disable = yes (req'd for ~/mail dotlocks, makes no difference either way for /var/spool/mail) Any ideas? Thanks, Mark

6 34

[Dovecot] GSSAPI cross-realm still broken
by Bryan Jacobs 03 Mar '09

03 Mar '09

I've been trying to track down some problems with Dovecot in a Kerberos 5 cross-realm environment, and there seem to be a few issues. LOGIN/PLAIN work fine using pam_krb5, but GSSAPI is a bit harder to handle. On line 436 of src/auth/mech-gssapi.c, the authn_name and the authz_name are compared using gss_compare_name. This dates back to the message at: http://dovecot.org/pipermail/dovecot/2005-October/009615.html While everything within that message is true, as things stand, Dovecot is unusable in a cross-realm environment. When cross-realm tickets are used, the authn_name is "username@REALM" and the authz_name is "username" (or vice versa, I don't remember). The attached patch causes dovecot to display these two values in human-readable format to illustrate the issue. Because these two GSS names differ, Dovecot refuses to allow access in spite of the fact that krb5_kuserok would return TRUE. I am not the only one to have noticed this problem: http://dovecot.org/pipermail/dovecot/2007-July/023868.html http://dovecot.org/pipermail/dovecot/2007-October/026027.html Might I suggest that some more robust security checking be done instead of abusing gss_compare_name like this? I don't know how to do this using GSSAPI, but on the Kerberos side Heimdal provides the function krb5_kuserok. Dovecot could also just have a configurable file listing acceptable krb5 principals (preferably in .k5login syntax) and check that both auth_name and authz_name are in the list. Bryan Jacobs

1 0

[Dovecot] Anyone know or have a perl, c/c++ script?
by Brandon Lamb 03 Mar '09

03 Mar '09

Hello all, Im hoping maybe someone on this list has already looked for or built something similiar. Basically from what I can tell, phps imap libraries or whatever dont support setting custom keywords. So I am wondering if someone has a library or script that can take a username, domain, password, folder, uid and flag to set so that my webmail app can call this to set imap keywords. So far my google searching isnt turning up anything, but searching for the word keyword doesnt really help.

1 1

[Dovecot] Seperate auth per protocol (pop3/imap)
by Guy 03 Mar '09

03 Mar '09

Hi, During discussions with the boss we've speculated about having users having only specific services available. One of the ideas was to have users being able to specify if they wanted POP3 or IMAP and whether we could limit their access to one or the other server side. We use MySQL for the userdb and passdb lookups at the moment. Is it possible to specify separate auth files with different MySQL lookups per protocol? Thanks Guy -- Don't just do something...sit there!

2 1

[Dovecot] under load
by Mohsen Pahlevanzadeh 03 Mar '09

03 Mar '09

Dear all, If you have a IMAP or pop3 server under load with vpopmail, can you mail me dovecot.conf ? Yours, Mohsen

1 1

[Dovecot] dovecot imap and thunderbird tags
by Lorenzo Bettini 02 Mar '09

02 Mar '09

We've been using an imap(s) dovecot server for a while on an ubuntu 8.04.2 and we noted that tags set by thunderbird ("important", "to do", etc.) are almost always lost, i.e., when connecting to the same imap account from another machine, the tags are not there anymore... this always happens for the Inbox, and seldomly for other imap folders... anyone else experiencing this? Note that the same problem does not arise with other imap server accounts... thanks in advance Lorenzo -- Lorenzo Bettini, PhD in Computer Science, DI, Univ. Torino ICQ# lbetto, 16080134 (GNU/Linux User # 158233) HOME: http://www.lorenzobettini.it MUSIC: http://www.purplesucker.com http://www.myspace.com/supertrouperabba BLOGS: http://tronprog.blogspot.com http://longlivemusic.blogspot.com http://www.gnu.org/software/src-highlite http://www.gnu.org/software/gengetopt http://www.gnu.org/software/gengen http://doublecpp.sourceforge.net

3 7