- dovecot - dovecot.org

[Dovecot] Permission denied creating inbox file in /var/mail
by Steve Ochani 01 Aug '08

01 Aug '08

Hello all, I'm using dovecot version 1.07 on CentoOS 5 (clone of RHEL 5). When there is no existing mbox file for a user in /var/mail I get the following error: --------------- Jul 31 16:32:32 newnewton dovecot: imap-login: Login: user=<testm2>, method=PLAIN, rip=::ffff:127.0.0.1, lip=::ffff:127.0.0.1, secured Jul 31 16:32:32 newnewton dovecot: IMAP(testm2): open(/var/mail/testm2, O_CREAT) failed: Permission denied Jul 31 16:32:32 newnewton dovecot: IMAP(testm2): access() failed with mbox file /var/mail/testm2: No such file or directory Jul 31 16:32:32 newnewton dovecot: IMAP(testm2): stat() failed with mbox file /var/mail/testm2: No such file or directory Jul 31 16:32:32 newnewton dovecot: IMAP(testm2): Connection closed ---------------- My persimmons on /var/mail (which is a symlink to /var/spool/mail) : drwxrwxr-x 2 root mail 4096 Jul 31 16:32 mail I have tried adding the mail group as mail_privileged_group, the output of dovecot -n : -------------------- # 1.0.7: /etc/dovecot.conf login_dir: /var/run/dovecot/login login_executable(default): /usr/libexec/dovecot/imap-login login_executable(imap): /usr/libexec/dovecot/imap-login login_executable(pop3): /usr/libexec/dovecot/pop3-login mail_privileged_group: mail mail_location: mbox:~/IMAPmail:INBOX=/var/mail/%u mail_executable(default): /usr/libexec/dovecot/imap mail_executable(imap): /usr/libexec/dovecot/imap mail_executable(pop3): /usr/libexec/dovecot/pop3 mail_plugin_dir(default): /usr/lib/dovecot/imap mail_plugin_dir(imap): /usr/lib/dovecot/imap mail_plugin_dir(pop3): /usr/lib/dovecot/pop3 auth default: passdb: driver: pam userdb: driver: passwd -------------------- Here is the permission on /etc/dovecot.conf -rw-r--r-- 1 root root 42833 Jul 31 15:30 /etc/dovecot.conf I've searched google and the mailing list archive and tried the couple of things commonly suggested. As for a test I changed perms on /var/spool/mail to 777 and then dovecot made the inbox file. The file ended up being owned by the user and the group owner was the group that the user belongs to, not mail. When I create new users using useradd there is a 0 byte file created in /var/mail for the user but I use scripts to create student accounts every semester (about 10,000) so I'm trying to avoid having to add more things that the script will have to create. Any help is greatly appreciated. Thanks -Steve O.

3 4

[Dovecot] dovecot.sieve file location?
by kbajwa 01 Aug '08

01 Aug '08

CentOS 5.2 Postfix-2.3.3 Dovecot-1.1.1 Dovecot.Sieve-1.1.5 I have setup with: home_mailbox = Maildir/ (/etc/postfix/main.cf) & mail-location = maildir:~/Maildir (/etc/dovecot.conf) I have created a 'test' user to test Sieve 'Vacation' setup. My questions are: 1. Which folder '.dovecot.sieve' script is copied into? Is it 'home/test' -or- 'home/test/Maildir' or someplace else? 2. '.dovecot.sieve' script parameter ":days 1" means that the reply is sent once a day. Is it possible to send the reply 'immediately'? Kirti

2 1

[Dovecot] Dovecot load balancing
by Thomas Hummel 01 Aug '08

01 Aug '08

Hello, I'd like to figure out how to set up a site running dovecot on multiple computers for load balancing reasons. I'm currently running dovecot-1.0.14 on a 8GB RAM, 2 quad-core 2.66Ghz Xeon single server which runs FreeBSD 6.2-STABLE SMP. . the mailbox format was mbox and I successfully migrated to Maildir only . mailboxes are on an NFS NetApp server, attribute caching is off . indexes are locally stored . the number of users is around 2500, some of them having huge mailboxes (~ 1 or 2 GB) . a large amount of users is using IMAP but there are also many POP3 users . the passdb/userdb is openLDAP . for now, I neither use namespaces, nor quotas nor deliver, nor any plugin, but I plan to use namespaces and ACL to implement shared mailboxes. The same machine is running postfix-2.4.6 with amavisd-new-2.5.4 (no spamassassin) and clamav-0.93.1. I'm using procmail-3.22 as the LDA. I installed dovecot-1.1.2 on non-standard ports for test and plan to switch to it as I read on this list it performs better, load wise. This setup (1.0.14) works great except that, compared to the time mailboxes were in mbox format, the load average (as shown by 'top') goes higher from a significant amout on a regular basis and sometimes goes over the top. On "normal" circumstances, the number of processes is around 1400 and the load oscillates between 1 to 10 and 30 to 60. Most of the time, I'd say the load average is around 20. Every friday a message (no attachement, decent size) is sent to all users : in such circumstances (but only sometimes, not every time : let's say half the time such a message is sent), the load goes so high that I have to stop dovecot to let procmail deliver the message or even reboot the machine. Sometimes, the load climbs up to something like 150, then goes back to the 'normal' case described above. I know multi-master replication is on the roadmap. I know some dovecot sites use in the meantime several dovecot servers. I'd like to know how those sites do the load balancing, the main problem beeing to be able to direct each user to the same dovecot server each time as stated in the Wiki (http://wiki.dovecot.org/NFS) I don't think that DNS round robin would do the trick because some UA (for instance Thunderbird) often open up to 5 connexions for the same user, unless maybe such UA makes a single 'gethostbyname()', thus connecting 5 times to the same physical server ? What are the options to achieve such a setup ? Any successful experiences ? Thank you -- Thomas Hummel | Institut Pasteur <hummel(a)pasteur.fr> | Pôle informatique - systèmes et réseau

8 13

[Dovecot] One LDAP attribute for many variables
by Juan Asensio Sánchez 31 Jul '08

31 Jul '08

Hi Using Dovecot 1.1.2 with LDAP. If i have this: user_attrs = uid=home=/var/vmail/%$,mailuserquota=quota_rule=*:storage=%$,=mail=maildir:/var/vmail/%n/Maildir OK. But if i have this: user_attrs = uid=home=/var/vmail/%$,mailuserquota=quota_rule=*:storage=%$,uid=mail=maildir:/var/vmail/%$/Maildir I get this error: deliver(usuario1): Jul 25 12:59:08 Error: Per-user script path is unknown. See http://wiki.dovecot.org/LDA/Sieve#location The only difference is that I use the uid LDAP attribute twice. Why does this happen?

2 1

[Dovecot] Seen flag in maildir filename not being respected
by Eduardo M KALINOWSKI 31 Jul '08

31 Jul '08

Hi, I'm using dovecot 1.1.2 (but I've noticed this since 1.1.1 which I was using until yesterday). It seems dovecot is ignoring the "S" flag in Maildir filenames, and is relying only in its Index Files to determine if a message has been read or not. I say that because if I delete the dovecot.index.* files for a mail folder, all the mails in there appear as unread. Also, I've tried accessing the maildir directly (using heirloom-mailx, but mutt should have done, too) and reading a new message. The file name was changed to add a "S" to the end, but this message was still marked as "unread" when the mail folder was accessed via IMAP. The flags R, F and T are correctly read from the filename if no index is present. I haven't tested the other flags. I'm using dovecot's deliver, and it creates filenames such as "1217450416.M77457P5201.mail.kalinowski.com.br,S=1377,W=1411:2,S", that is, perfectly fine. dovecot -n: # 1.1.2: /etc/dovecot/dovecot.conf log_path: /var/log/dovecot/main.log info_log_path: /var/log/dovecot/info.log log_timestamp: %Y-%m-%d %H:%M:%S ssl_cert_file: /etc/ssl/certs/server.pem ssl_key_file: /etc/ssl/private/server.pem login_dir: /var/run/dovecot/login login_executable: /usr/lib/dovecot/imap-login login_processes_count: 1 first_valid_uid: 100 mail_privileged_group: mail mail_location: maildir:/home/vmail/%d/%n/INBOX:INDEX=/home/vmail/%d/%n/dovecotidx mail_plugins: quota imap_quota zlib auth default: mechanisms: plain login cram-md5 passdb: driver: passwd-file args: username_format=%n /home/vmail/%d/db/passwd passdb: driver: pam userdb: driver: static args: uid=104 gid=8 home=/home/vmail/%d/%n userdb: driver: passwd socket: type: listen client: path: /var/run/dovecot/auth-client mode: 438 master: path: /var/run/dovecot/auth-master mode: 384 user: vmail group: mail plugin: quota: maildir quota_rule: ?:storage=0 quota_rule2: Trash:ignore quota_rule3: Spam:ignore quota_rule4: Spam.Errado:ignore sieve: /home/vmail/%d/db/sieves/%n.sieve

2 3

[Dovecot] wrong permission
by Cor Bosman 31 Jul '08

31 Jul '08

Im still finding a number of control directories that have the wrong permission: Jun 26 00:02:34 userimap13.xs4all.nl dovecot: IMAP(xxx): file_dotlock_create(/var/spool/mail/dovecot-control/g/gl/xxx/INBOX/.Apple Mail To Do/dovecot-uidlist) failed: Permission denied userimap1# ls -al "/var/spool/mail/dovecot-control/g/gl/xxx/INBOX/.Apple Mail To Do" total 8 drw------- 2 xxx user 4096 May 12 23:43 . drwx------ 7 xxx user 4096 May 12 23:43 .. This folder was created May 12, well after us starting to use 1.1RC versions. I currently fixed a few hundred of these (out of millions of folders), and whats interesting is that a very large percentage of those (1/3th) is the folder "Apple Mail To Do", created by Mail.App I think. Obviously that same folder is no where near 1/3th of our total folder number, so thats a bit strange. I really doubt this is some local setting issue, because then id see much more of those. Right now it's a tiny fraction of our total folder amount, which leads me to believe it's some weird edge case in the dovecot code. Anyone have any ideas? Cor

2 9

[Dovecot] dovecot-imap displays empty domainalias mailboxen
by Kacper Wysocki 31 Jul '08

31 Jul '08

Hi folks, I'm using dovecot 1.0.13 as the IMAPS frontend for a vpopmail/qmail virtual domain setup. Dovecot is set up as follows: passdb vpopmail{ } userdb vpopmail{ } I've added a domain alias for the main domain with vaddaliasdomain and email to post@aliasdomain is delivered to post@maindomain and can be checked with pop. However, when I try to check IMAP through the account post@aliasdomain I am confronted with an empty mailbox. If I log in using post@maindomain I get the expected contents. Why can't my users log in using user@aliasdomain to check their emails? Regards, Kacper Wysocki -- http://kacper.doesntexist.org http://windows.dontexist.net There is symmetry in chaos, and chaos in excessive order. Though you may see heaven or hell, remember that it is your mind which creates them. Avoid grasping the one or fleeing the other.

1 0

Re: [Dovecot] Some help required - dovecot: IMAP(matthew): unlink(/home/matthew/Maildir/cur/new) failed: Operation not permitted
by Matthias Andree 31 Jul '08

31 Jul '08

Hi I hope you're not offended by posting a quote to the list... you sent the mail just to me. On Thu, 31 Jul 2008, matbic(a)gmail.com wrote: > Here here is an excerpt: > > ls -l home/matthew/Maildir/cur > ... > drwx------ 2 matthew matthew 512 Jul 30 17:48 cur:2,ST > drwx------ 2 matthew matthew 512 Jul 31 06:55 new > drwx------ 2 matthew matthew 512 Jul 30 18:21 tmp:2,ST > > Is this to be expected or is this my problem? These (in .../Maildir/cur) are your problem - someone created a Maildir underneath Maildir/cur, and dovecot or some other software considered the three directories messages, and goofed up. Check your delivery recipes so that none deliver to .../Maildir/, if you find any, adjust them deliver to .../Maildir/ instead. I'd suggest to: cd /home/matthew/Maildir/cur # move potential messages out to the proper new/... directory # if mv complains about nonexistent .../*, all the better! mv 'cur:2,ST/'* 'new/'* 'tmp:2,ST/'* ../new/ # get rid of the bogus directories rmdir '???:2,ST/' new cd - and see if that fixes the problem. If rmdir fails because there are hidden files, see what they are and where to move them, if the {cur,tmp}:2,ST or new are empty, fine, someone accidentally ran maildirmake with bogus arguments. HTH Matthias

2 1

[Dovecot] .files in dovecot-1.1.1
by John Baker 31 Jul '08

31 Jul '08

Hi there We had been using the stock Ubuntu Dapper Dovecot which is an early 1.0 beta but just upgraded to 1.1.1 to fix some read flag issues with Horde. Previously dovecot seemed to ignore files beginning with "." in the ~/mail (mbox format) directory but now shows them. There doesn't seem to be any switch in the dovcot.conf file to change this. Any such settings are about maildir. Is there anyway to make dovecot-1.1.1 ignore hidden files? Thanks -- John Baker Network Systems Administrator Marlboro College Phone: 451-7551 off campus; 551 on campus

2 1

[Dovecot] login processes from attacks staying for hours
by Kai Schaetzl 31 Jul '08

31 Jul '08

I'm in the process of rolling out new setups with dovecot on CentOS 5.2 and I notice that dovecot doesn't handle the brute-force attacks too nice. I reduced the limit a bit to some reasonable looking value: login_max_processes_count = 32 to stop them earlier and the number of processes stops at that figure when an attack happens. However, it stays at this count for hours although the attack is already over since long. For instance, my monitoring alerts me at the moment when the process count for pop3-login goes over 20 processes. This happened on three machines at 2 am with a brute-force attack from the same source that didn't last longer than a minute or so. However, the process count dropped only at 7am under 20 on two machines and on the third machine it was still over 20 when I was in the office at 9 am and finally killed them. As these machines are all not in production yet, there weren't any other logins and the single brute-force ended within one minute according to the logs (obviously when pop3-logins hit the limit). Shouldn't these processes go down to login_processes_count (3) within a few minutes? An strace shows that they are mostly doing gettimeofday lookups (=sleeping). This is the default dovecot (1.07) coming with CentOS 5.2. I've been running only one other instance of dovecot in production (0.99.11) on CentOS 4.6 so far and I don't know which behavior that displayed in the past as I just recognize that I accidentally ommitted it from monitoring. :-( I had this mailing list searched for "brute-force" to see how others handle this and what dovecot provides to stop these attacks. I have found not many threads about this. There is one with a bit more information: "Delay on failed pw attempts" from January 1. Unfortunately, this functionality is only in a later version of dovecot and it's not clear if it was implemented or not or if it would be helpful. Was it implemented? This thread also mentions fail2ban which may be one way to go, although I don't like this log parsing approach too much. Does anyone use iptables for rate-limiting per IP on the pop/imap ports to prevent brute-force attacks? Kai -- Kai Schätzl, Berlin, Germany Get your web at Conactive Internet Services: http://www.conactive.com

7 9