- dovecot - dovecot.org

[Dovecot] dovecot-auth consumes 100% CPU time on Solaris 10
by KOT MATPOCKuH 02 Jan '08

02 Jan '08

Is problem with CPU load solved? I have same problem - dovecot-auth eats one of my cores. I'm using dovecot 1.0.7 on Solaris 10 Sparc. I tried to use auth-bind and standard scheme with separate user for bind and have same result. Problem occupts only with LDAP authentication, on some other systems I use PostgreQSL and MySQL authentication and doesn't have this problem. Using PAM authentication is not possible, because dovecot run in chroot'ed environment and I planing to move it to separate system or zone without ldap client. -- MATPOCKuH

7 20

[Dovecot] Delay on failed pw attempts
by Dean Brooks 02 Jan '08

02 Jan '08

Hi, Is there a way, or can a way be added, to add an "auth_failed_delay=10s" style option that would put in an artificial delay after a failed password attempt? As it stands now, Dovecot seems highly vulnerable to widescale brute-force password dictionary scans. Even if it's not configurable, can a delay be hardcoded to something like, say, 10 or 15 seconds? -- Dean Brooks dean(a)iglou.com

10 18

[Dovecot] deliver triggering SELinux AVC denials
by Gerry Reno 02 Jan '08

02 Jan '08

I setup postfix/dovecot on a new machine and now all works well with the small exception of dovecot triggering selinux avc denials on some temp... files here is a sample alert: Summary SELinux is preventing /usr/libexec/dovecot/deliver (dovecot_deliver_t) "link" to temp.localhost.678.40caaf5592891c46 (user_home_dir_t). Detailed Description SELinux denied access requested by /usr/libexec/dovecot/deliver. It is not expected that this access is required by /usr/libexec/dovecot/deliver and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access Sometimes labeling problems can cause SELinux denials. You could try to restore the default system file context for temp.localhost.678.40caaf5592891c46, restorecon -v temp.localhost.678.40caaf5592891c46 If this does not work, there is currently no automatic way to allow this access. Instead, you can generate a local policy module to allow this access - see http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385 Or you can disable SELinux protection altogether. Disabling SELinux protection is not recommended. Please file a http://bugzilla.redhat.com/bugzilla/enter_bug.cgi against this package. Additional Information Source Context user_u:system_r:dovecot_deliver_t Target Context user_u:object_r:user_home_dir_t Target Objects temp.localhost.678.40caaf5592891c46 [ file ] Affected RPM Packages dovecot-1.0.7-16.fc7 [application] Policy RPM selinux-policy-2.6.4-63.fc7 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Permissive Plugin Name plugins.catchall_file Host Name localhost Platform Linux localhost 2.6.23.8-34.fc7 #1 SMP Thu Nov 22 23:05:33 EST 2007 i686 athlon Alert Count 1 First Seen Tue 01 Jan 2008 09:29:35 PM EST Last Seen Tue 01 Jan 2008 09:29:35 PM EST Local ID 507dd6a2-da46-4541-8c10-a0771bc85042 Line Numbers Raw Audit Messages avc: denied { link } for comm="deliver" dev=dm-0 egid=5000 euid=5000 exe="/usr/libexec/dovecot/deliver" exit=0 fsgid=5000 fsuid=5000 gid=5000 items=0 name="temp.localhost.678.40caaf5592891c46" pid=678 scontext=user_u:system_r:dovecot_deliver_t:s0 sgid=5000 subj=user_u:system_r:dovecot_deliver_t:s0 suid=5000 tclass=file tcontext=user_u:object_r:user_home_dir_t:s0 tty=(none) uid=5000 and 5000 is user vmail. When I look for these files that it is complaining about they are never in the filesystem. I get about 8 alerts with every email that is delivered. Right now I have SELinux set to permissive so that the mail gets delivered but I would like to find the cause of this problem so that I can set it back to enforcing. ???? Gerry

2 1

[Dovecot] 1.1b13 build in FreeBSD fails using 'make'; 'gmake' apparently required
by snowcrash 01 Jan '08

01 Jan '08

hi, i'm doing a 1st build of dovecot in a freebsd 62R jail. following instructions at http://wiki.dovecot.org/CompilingSource ./configure make sudo make install after an OK 'configure', @ 'make', i get make make all-recursive Making all in src Making all in lib make: don't know how to make unicodemap.c. Stop *** Error code 1 Stop in /s/usr-local/build/dovecot/dovecot/src. *** Error code 1 Stop in /s/usr-local/build/dovecot/dovecot. *** Error code 1 Stop in /s/usr-local/build/dovecot/dovecot. looking at source, i couldn't figure this out ... on a whim, i tried 'gmake', instead of 'make'. it completes without error. subsequent make check make install are both ok, resulting in ls -al dovecot -rwxr-xr-x 1 root wheel 459786 Dec 30 21:53 dovecot* ./dovecot --version 1.1.beta13 on FreeBSD, apparently, make != gmake ls -al `which make` `which gmake` -r-xr-xr-x 1 root wheel 350904 Dec 29 17:25 /usr/bin/make* -r-xr-xr-x 1 root wheel 199808 Dec 27 06:14 /usr/local/bin/gmake* make --version make: illegal option -- - usage: make [-BPSXeiknqrstv] [-C directory] [-D variable] [-d flags] [-E variable] [-f makefile] [-I directory] [-j max_jobs] [-m directory] [-V variable] [variable=value] [target ...] gmake --version GNU Make 3.81 Copyright (C) 2006 Free Software Foundation, Inc. This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. This program built for amd64-portbld-freebsd6.2 so, using 'gmake' seems to solve the issue. neither at the link above, nor at, http://wiki.dovecot.org/DovecotServerInstallations/FreeBSD/6.0RELEASE/20Use… is the use of 'gmake'mentioned. i'd ask/suggest that either said mention be added to the wiki (if it's not already there, and i missed it), or, that the build be made to be FreeBSD-make friendly. hth. cheers!

8 17

[Dovecot] my.cnf reading support in MySQL backend
by Luca Longinotti 01 Jan '08

01 Jan '08

I hope this ml is the right place to send this... Anyway, I'd very much like for the MySQL backend to call mysql_options, so that it'll read the settings defined in MySQL's my.cnf under the [client] section. This allows to set a whole slew of MySQL specific settings for the MySQL connection, for example to enable the compressed protocol, set charsets, enable SSL client verification, and much more. A patch is attached that implements this. See http://dev.mysql.com/doc/refman/5.0/en/mysql-options.html for more info. -- Best regards, Luca Longinotti aka CHTEKK LongiTEKK Networks Admin: chtekk(a)longitekk.com Gentoo Dev: chtekk(a)gentoo.org SysCP Dev: chtekk(a)syscp.org TILUG Supporter: chtekk(a)tilug.ch

2 5

[Dovecot] deliver: keep existing From_ line
by Alexander 'Leo' Bergolth 01 Jan '08

01 Jan '08

Hi! I'm using procmail to filter my email. (I have to use it because of various features that are not supported by sieve.) However, I'd like to deliver mail to my mboxes using dovecots deliver program in order to update index files and speed up mbox access. Using "| $DELIVER -m <mboxname>" in my procmail receipes, everything works fine, except that the envelope sender address is mangled. deliver sets it to MAILER-DAEMON, even though it is already provided in the first line of the mail. I cannot use the "-f <address>" options of deliver, since procmail doesn't provide the envelope-sender address in a variable. (I'd have to extract it from the first line of the mail using a separate receipe, which isn't very efficient.) Is there a way to keep the already existing "From " line? Thanks in advance, --leo -- e-mail ::: Alexander.Bergolth (at) wu-wien.ac.at fax ::: +43-1-31336-906050 location ::: Computer Center | Vienna University of Economics | Austria

2 1

[Dovecot] Segmentation fault in dovecot-sieve-1.1.2 + dovecot-1.1.beta13
by Ron Avriel 01 Jan '08

01 Jan '08

Hi, dovecot-sieve-1.1.2 + dovecot-1.1.beta13 segfaults with the following sieve filter: --- require ["imapflags"]; if header :contains "subject" ["test"] { addflag "$testflag"; } --- when a message with a subject containing "test" is delivered via dovecot lda. The fault backtrace is: (gdb) run Starting program: /usr/local/libexec/dovecot/deliver -d load1(a)virt1.cti2.com < bad.txt Program received signal SIGSEGV, Segmentation fault. get_flags (sieve_flags=0xbfe7e438, flags_r=0xbfe7dee4, keywords_r=0x2) at /root/dovecot-1.1.beta13/src/lib/array.h:145 145 *count_r = array->buffer->used / array->element_size; (gdb) bt #0 get_flags (sieve_flags=0xbfe7e438, flags_r=0xbfe7dee4, keywords_r=0x2) at /root/dovecot-1.1.beta13/src/lib/array.h:145 #1 0x00f68744 in sieve_keep (ac=0x2, ic=0x0, sc=0xbfe7f4e0, mc=0xbfe7f480, errmsg=0xbfe7e3f0) at sieve-cmu.c:561 #2 0x00f779a5 in do_sieve_error (ret=0, interp=0x92dbf18, script_context=0xbfe7f4e0, message_context=0xbfe7f480, imapflags=0xbfe7e438, actions=0x92e42d8, notify_list=0x0, lastaction=8, implicit_keep=1, actions_string=0xbfe7e440 "Action(s) taken:\n", errmsg=0x0) at script.c:627 #3 0x00f780d8 in sieve_execute_bytecode (exe=0x92dcc58, interp=0x92dbf18, script_context=0xbfe7f4e0, message_context=0xbfe7f480) at script.c:824 #4 0x00f69809 in cmu_sieve_run (namespaces=0x92d5c70, storage_r=0xbfe7f6ac, mail=0x92de358, script_path=0x92d3c82 "/usr/local/etc/sieve_global.txt", destaddr=0xbff3fbb9 "load1(a)virt1.cti2.com", username=0x92d4b05 "load1(a)virt1.cti2.com", mailbox=0x80d0367 "INBOX") at sieve-cmu.c:971 #5 0x00f67752 in cmusieve_deliver_mail (namespaces=0x92d5c70, storage_r=0xbfe7f6ac, mail=0x92de358, destaddr=0xbff3fbb9 "load1(a)virt1.cti2.com", mailbox=0x80d0367 "INBOX") at cmusieve-plugin.c:76 #6 0x0805aa4f in main (argc=3, argv=0xbfe7f794) at deliver.c:940 (gdb) I managed to fix the problem with this patch to sieve-cmu.c: --- sieve-cmu.c.orig 2007-12-31 10:21:54.000000000 +0200 +++ sieve-cmu.c 2007-12-31 10:24:18.000000000 +0200 @@ -495,6 +495,7 @@ ARRAY_DEFINE(keywords, const char *); const char *name; int i; + unsigned int count; *flags_r = 0; @@ -524,7 +525,7 @@ array_append(&keywords, &name, 1); *keywords_r = array_count(&keywords) == 1 ? NULL : - array_get(&keywords, 0); + array_get(&keywords, &count); } static int sieve_fileinto(void *ac, BTW, dovecot-sieve-1.0.2 + dovecot-1.0.9 work OK for the above. Happy New Year and thanks for a great product, Ron ____________________________________________________________________________________ Never miss a thing. Make Yahoo your home page. http://www.yahoo.com/r/hs

2 1

[Dovecot] Building path to maildir
by Michel Bulgado 01 Jan '08

01 Jan '08

Hello everyone Happy new year . This is the first time I address to the list I have the following situation and I need help from all you people I have dovecot 0.9-11 and i want to migrate to a superior version like dovecot 1.0 looking forward to implement quotas in my system , and use the function deliver with postfix. My Scenario is as follow Dovecot + LDAP (ADS) + postfix My actual version is : 0.99.11 This is my actual configuration: Protocols = imap pop3 imap_listen = * pop3_listen = * login_dir = /var/run/dovecot-login login = imap login = pop3 default_mail_env = maildir:/var/spool/virtualmail/%d/%n mbox_locks = fcntl auth = dovecot-auth auth_mechanisms = plain auth_default_realm = CASA.CULT.CU auth_userdb = ldap /etc/dovecot-ldap.conf auth_passdb = pam dovecot auth_user = root auth_verbose = yes auth_debug = yes dovecot-ldap.conf hosts = ldap.casa.cult.cu base = ou=CASA,dc=casa,dc=cult,dc=cu dn = cn=unix-conector,cn=Users,dc=casa,dc=cult,dc=cu dnpass = ***** ldap_version = 3 deref = never scope = subtree user_global_uid = 500 user_global_gid = 500 user_attrs = mail,/var/spool/virtualmail/%d/%n,,,, user_filter = (&(objectClass=user)(!(objectClass=computer))(sAMAccountName=%n)) I see many changes in this new version. One of them is : -Renamed default_mail_env to mail_location - many changes in ldap queries With the new version my problem is when to dovecot tries to detect or builds the way where it´s stored the mailbox of my users. In /var/spool/virtualmail/%d/%u , it does not detect the domain when asking to my active directory (w2k) and consequently takes a value of my default realm = casa.cult.cu in this case the default domain where authenticate my users. My configuration in the new version of dovecot: protocols = imap pop3 protocol imap { listen = * } protocol pop3 { listen = * } login_dir = /var/run/dovecot/login login_chroot = yes login_greeting = Dovecot ready. mail_location = maildir:/var/spool/virtualmail/%d/%u mail_debug = yes mbox_read_locks = fcntl mbox_write_locks = fcntl protocol imap { mail_plugins = quota imap_quota } protocol pop3 { mail_plugins = quota } protocol lda { postmaster_address = postmaster(a)example.com mail_plugins = quota auth_socket_path = /var/run/dovecot/auth-master } auth_executable = /usr/libexec/dovecot/dovecot-auth auth_verbose = yes auth_debug = yes auth default { mechanisms = plain passdb pam { args = dovecot } userdb ldap { args = /etc/dovecot-ldap.conf } userdb prefetch { } user = root socket listen { master { path = /var/run/dovecot/auth-master mode = 0600 user = virtualmail group = virtualmail } } } dict { } plugin { quota = maildir:storage=10240 } user_attrs = mail,/var/spool/virtualmail/%d/%n,,,, The attribute mail in the old version returns to me user(a)casa.com or user(a)casa.cult.cu this way dovecot can build the way with no problems at all. But in this late version something is happening, it only takes the value %n= user , but not %d = domain . It´s not working. do you have any idea how I can solve this I beg your pardon for my poor English. ---------------------------------------------------------------- This message was sent using IMP, the Internet Messaging Program.

2 1

[Dovecot] Maildir
by Peter Fraser 01 Jan '08

01 Jan '08

I have been trying to set up dovecot with postfix to use at work. I'm trying to configure dovecot to authenticate against active directory and postfix the same. I installed dovecot 1.0.10 on FreeBSD 7.0 beta 2 When I telnet in the get authentication ok but an error suggesting that there is no Mailbox belonging to that user. I am using Maildirs. How can I now create a Maildir with the proper permissions for that virtual user? Thanks for any assistance.

1 0

[Dovecot] Enhanced Kerberos support
by Richard A Nelson 31 Dec '07

31 Dec '07

The recent addition of auth_gssapi_hostname is a welcome addition, but a little more is needed for multi-homed (or multi-domained) sites. SSH recently added this enhancement to address this common need: GSSAPIStrictAcceptorCheck Determines whether to be strict about the identity of the GSSAPI acceptor a client authenticates against. If “yes” then the client must authenticate against the host service on the current hostname. If “no” then the client may authenticate against any service key stored in the machine’s default store. This facility is provided to assist with operation on multi homed machines. The default is “yes”. Note that this option applies only to protocol version 2 GSSAPI connections, and setting it to “no” may only work with recent Kerberos GSSAPI libraries. I've heard that other daemons support multi-names by instead of using gethostname(), obtain the hostname of the interface that the request came in on. Can either approach be looked at for dovecot ? Thanks, -- Richard A Nelson (Rick) cowboy(a)((linux.)?vnet|us).ibm.com Phone: 1-408-463-5584 Fax: 1-408-463-3873 COBOL Development IBM Silicon Valley Laboratory http://www.ibm.com/software/awdtools/cobol/

5 5