- dovecot - dovecot.org

[Dovecot] [Patch] Samba's proposed "ntlm_auth + winbind" support for dovecot-auth
by Dmitry Butskoy 11 Jul '07

11 Jul '07

The Samba team recommends to use their "ntlm_auth" command line helper for "NTLM" and "GSS-SPNEGO" authentication. This helper interacts with the Samba's winbind daemon, and this way can authenticate users against NT or Active Directory windows domain. Currently Dovecot can do "NTLM" authentication too, but just "locally" (against a local or sql database etc.). I've made a patch (attached), which adds "ntlm_auth" (or "winbind") support for Dovecot. The idea is to add two new authentication mechanisms: "mech_winbind_ntlm" and "mech_winbind_spnego". Both are coded in one additional file, "mech-winbind.c". An option "auth_ntlm_use_winbind" specifies whether to use the current implementation of ntlm, or do it by the "ntlm_auth" helper. "GSS-SPNEGO" always performed by the helper. Normally, "ntlm_auth" is invoked once, for all further requests. Such a way, "ntlm_auth helper from the Samba package, interacting with the Samba's winbind daemon", is used now by Squid, Apache and AFAIK some other applications. It is "strongly recommended" by the Samba team, and was already proposed even in this maillist 3 year ago (see f.e. http://www.dovecot.org/list/dovecot/2004-September/004775.html ). I hope there are no any serious performance issues for such a "complex way" -- f.e. with our web proxy, using this way, ~200 users do not feel any actual delays etc. I've successfully tested this patch with NTLM against AD domain. This patch can considerably improve the situation of "Email client on Windows desktop under Windows domain, but imap/pop at UNIX server". Currently, windows users have to specify their "login/password" for email accounts manually. There is an "SPA" (Secure Password Authentication) alternative for them, where just the desktop's login is used transparently, but it cannot be used now, because Dovecot cannot perform NTLM against, say, Active Directory domain. Since "dovecot-auth" daemon can be utilized by MTA as well (Postfix and other), the support of "ntlm_auth" in Dovecot can satisfy both SMTP and IMAP servers at UNIX side, and solve the issue completely. Questions and requests: - I try to code things most close to used style, i.e. using Dovecot's memory-management and io-pipe routines etc., but could someone look at it and check whether I've missed something or not? - Perhaps some names (of routines, modules) could be chosen better? - Maybe some other options should be implemented, i.e. "auth_winbind_helper_ntlm" and "auth_winbind_helper_spnego" to specify the helper's cmdline exactly ? - Currently I strip domain part of the username returned, i.e. from "DOMAIN\user" just to "user". Maybe better add some option "auth_winbind_strip_domain" for this? Certainly, it will be fine if someone else check it more, especially for "GSS-SPNEGO" which I cannot test for a while. Regards, Dmitry Butskoy http://www.fedoraproject.org/wiki/DmitryButskoy

2 6

[Dovecot] NFS and Filesystem quota
by Joseba Torre 11 Jul '07

11 Jul '07

Hi, I've recently moved my mailboxes to a NFS share (on an emc Celerra), and, as expected, the quota extensions no longer works. However, I've read that adding http://dovecot.org/patches/quota-rquotad.c to $DOVECOT/src/plugins/quota, adding a line to $DOVECOT/src/plugins/quota/Makefile.am and rebuilding, it should work again. Unfortunately, it doesn't compile in my RHEL 4.0: /usr/bin/gcc4 -DHAVE_CONFIG_H -I. -I. -I../../.. -I../../../src/lib -I../../../src/lib-dict -I../../../src/lib-index -I../../../src/lib-mail -I../../../src/lib-storage -I../../../src/lib-storage/index -I../../../src/lib-storage/index/maildir -std=gnu99 -g -O2 -Wall -W -Wmissing-prototypes -Wmissing-declarations -Wpointer-arith -Wchar-subscripts -Wformat=2 -Wbad-function-cast -I/usr/kerberos/include -MT quota-rquotad.lo -MD -MP -MF .deps/quota-rquotad.Tpo -c quota-rquotad.c -fPIC -DPIC -o .libs/quota-rquotad.o quota-rquotad.c: In function 'debugmsg': quota-rquotad.c:50: warning: implicit declaration of function 'i_vinfo' quota-rquotad.c: In function 'rquotad_quota_add_storage': quota-rquotad.c:90: error: storage size of 'statbuf' isn't known quota-rquotad.c:97: warning: implicit declaration of function 'statfs' quota-rquotad.c:99: error: 'MNT_LOCAL' undeclared (first use in this function) quota-rquotad.c:99: error: (Each undeclared identifier is reported only once quota-rquotad.c:99: error: for each function it appears in.) quota-rquotad.c:104: error: 'MNAMELEN' undeclared (first use in this function) quota-rquotad.c:90: warning: unused variable 'statbuf' quota-rquotad.c: At top level: quota-rquotad.c:225: warning: initialization from incompatible pointer type quota-rquotad.c: In function 'rquota_get': quota-rquotad.c:256: warning: dereferencing type-punned pointer will break strict-aliasing rules quota-rquotad.c:267: warning: passing argument 3 of 'clnt->cl_ops->cl_call' from incompatible pointer type quota-rquotad.c:267: warning: passing argument 4 of 'clnt->cl_ops->cl_call' from incompatible pointer type quota-rquotad.c:267: warning: passing argument 5 of 'clnt->cl_ops->cl_call' from incompatible pointer type quota-rquotad.c:267: warning: passing argument 6 of 'clnt->cl_ops->cl_call' from incompatible pointer type quota-rquotad.c: In function 'rquotad_quota_root_update': quota-rquotad.c:275: error: storage size of 'statfsbuf' isn't known quota-rquotad.c:291: error: 'MNT_LOCAL' undeclared (first use in this function) quota-rquotad.c:275: warning: unused variable 'statfsbuf' make[4]: *** [quota-rquotad.lo] Error 1 make[4]: Leaving directory `/home/lgstosej/dovecot/dovecot-1.0.1/src/plugins/quota' make[3]: *** [all-recursive] Error 1 make[3]: Leaving directory `/home/lgstosej/dovecot/dovecot-1.0.1/src/plugins' make[2]: *** [all-recursive] Error 1 make[2]: Leaving directory `/home/lgstosej/dovecot/dovecot-1.0.1/src' make[1]: *** [all-recursive] Error 1 make[1]: Leaving directory `/home/lgstosej/dovecot/dovecot-1.0.1' make: *** [all] Error 2 Any help? Is there any plan to have official support for this? Aaaaaaaaaagur. -- Joseba Torre. CIDIR Bizkaia.

2 1

[Dovecot] Migrating subscription lists
by Stewart Dean 10 Jul '07

10 Jul '07

I thought this would be relatively straightforward....I would create .subscriptions by doing an ls -1 of ~/mail. I'm running into some problems. 1) the ~/mail directories haves directories in them for 5% of the accounts! AFAIK, our mail sevice has always been UWIMAP with mbox format INBOXes, and it was my understanding that the mbox format is flat and NOT hierarchical and thus I'd have thought that ~/mail would be all folders and wouldn't have a directory with folders in it. Plus our users are not, as a rule, power/geek user that would understand even making subdirs in ~mail, so I don't know how this would have come to pass. Should this be? Or am I misunderstanding things? 2) Some people are consciously or unconsciously using the UWIMAP .mailboxlist subscription file as it is meant to be used, namely to *restrict* the folders shown. If/when I generated the Dovecot .subsbcriptions file by just doing an ls -1 of their mail directory, they will be surprised to see stuff not previously displayed....that they may very well not know they'd had. Murphy must be a terribly overworked deity...you'd think he'd take a rest now and then from maximizing entropy -- ==== Stewart Dean, Unix System Admin, Henderson Computer Resources Center of Bard College, Annandale-on-Hudson, New York 12504 sdean(a)bard.edu voice: 845-758-7475, fax: 845-758-7035

2 1

[Dovecot] mbox vs maildir
by Don Russell 10 Jul '07

10 Jul '07

I'm using Dovecot 1.0.1-12 on Linux/Fedora 7 along with sendmail and procmail all running on the same box mail is stored in mbox format It's a small system with a half dozen or so e-mail "accounts". Each with 40-60MB of messages in various folders. I keep seeing messages about how mbox is antiquated and anybody with more than 100 messages etc should not use mbox, but use maildir instead. I'm not entirely convinced.... there seem to be pros and cons for each. Is there a discussion somewhere that really highlights why one format is so much better than the other? The last time I tried to convert from mbox to maildir, things got pretty botched up, no data loss, but it wasn't pretty. :-) Can Dovecot handle mbox for some users and maildir for others? I'd like to try a conversion for one user... I'll probably create a new user, then have procmail copy (via ! action code) all mail for one user to that new user. Thank you

16 40

[Dovecot] secure pop for outside pop inside
by arjan 10 Jul '07

10 Jul '07

Hi all, I've a server with dovecot running in secure pop mode. For connections from the outside world, I don't want to enable pop. However, this machine is also the host for a vserver. In this vserver I have a webserver running the WebGUI Content Management System. One can add content via email. For this the cms has to be able to check a pop emailbox. The cms doesn't support secure pop. It's not nescessary either, because dovecot and cms are on the same machine. How can I configure Dovecot in such a way that I can enable pop just for one ip-adress and have secure pop for connections on another adress? Any help would be very much appreciated. Kind regards, Arjan

2 3

[Dovecot] Repeated references to non existent users table
by Frank Church 10 Jul '07

10 Jul '07

Dovecot keeps returning messages in the general log about a users table, where my users table is called mailbox, based on my postfixadmin configuration. dovecot: Jul 10 11:37:27 Info: auth-worker(default): sql(user(a)domain.com): SELECT home, uid, gid FROM users WHERE userid = 'user(a)domain.com' dovecot: Jul 10 11:37:27 Info: auth(default): prefetch(user(a)domain.com): passdb didn't return userdb entries I get errors stating that table postfix.users does not exist which is right because my table is named mailbox my dovecot-sql.conf files don't contain any references to a table named users. dovecot.conf ========= protocol lda { postmaster_address = postmaster(a)abc.meripol.net mail_plugins = quota log_path = /var/log/dovecot-deliver.log info_log_path = /var/log/dovecot-deliver.log } main.cf ========== # ---------------------- SASL PART START ---------------------- smtpd_sasl_type = dovecot smtpd_sasl_path = private/auth smtpd_sasl_auth_enable = yes smtpd_sasl_local_domain = smtpd_sasl_exceptions_networks = smtpd_sasl_security_options = noanonymous broken_sasl_auth_clients = yes # ---------------------- SASL PART END ---------------------- master.cf ======= dovecot unix - n n - - pipe flags=DRhu user=vmail:mail argv=/usr/local/libexec/dovecot/deliver -d ${recipient}

1 0

[Dovecot] dovecot lda with fetchmail
by JC Júnior 10 Jul '07

10 Jul '07

hi all, I'm new in dovecot, and i need to setup a machine that download emails from an external pop3 server, and delivers to my internal network via imap, for this , i want ( if possible ) to use fetchmail with the option mda to dovecot's deliver, because all user must be virtual users stored in a sqlite database, and my question is: 1- it is possible?? 2- theres a better way to do this?? 3- someone knows some howto about this configuration??? thanks for all JC Júnior

3 6

[Dovecot] Upgrade from 1.00 to 1.0.1
by Jon 09 Jul '07

09 Jul '07

Hi, I'm getting a bunch of errors since I upgraded to 1.0.0. I understand now that some of them are bug related to release 1.0.0. I'm about to upgrade to 1.0.1. Does anyone know if there are changes in the config file btwn these to versions? Also, what is the best way to do the upgrade? Can I just run ./configure : make : make install : killlall -HUP dovetcot? Best Regards - Jon

7 9

[Dovecot] Tbird-DC state problem
by Stewart Dean 09 Jul '07

09 Jul '07

A experienced sysadmin who's doing some guinea-pig use of DC just ran into the following situation: 1) He brings up SeaMonkey 2) About 30 minutes later, he's in the middle of some involved messaging, mistakenly hits the redX in the top right of the SeaMonkey window, knocking himself out of SeaMonkey. 3) He immediately reinvokes SeaMonkey, all appeared to be OK Viewed some e-mail and some web page references, tries to send a message and then the Send hung for a time with a message "Sending Authenticate Info"..after some minutes, a new E-mail window appeared stating the "Server reported a timeout". As far as the message, it was apparently sent successfully, and saved in the Sent folder successfully. 4) He calls me in. I look through the syslog logging. There is nothing in the syslog critical stuff...and everything in the maillog looks normal. 5) He starts another message, tries to save it to Drafts and that hangs 6) I look more closely at the maillog and see a lot of logins (one a minute in some cases, but all appear to have been cleanly executed) plus one bunch of disconnected messages with one disconnected in idle in the period when the write to the Drafts would have been hung. Could it be that DC was in the middle of clean up in the initial disconnect/reconnect and SeaMonkey came back in the middle of it and one or the other's state tables got messed up (or both of them)? Shutting out of SeaMonkey, waiting a minute and reconnecting seems to have gotten things working again. Any comments? Anything I should be looking for? OTOH, this is the first real problem I've seen in some person-months of testing..... -- ==== Stewart Dean, Unix System Admin, Henderson Computer Resources Center of Bard College, Annandale-on-Hudson, New York 12504 sdean(a)bard.edu voice: 845-758-7475, fax: 845-758-7035

1 0

[Dovecot] PHP implementation of dovecotpw passwords
by Frank Church 09 Jul '07

09 Jul '07

I am looking for PHP functions that implement passwords that much the dovecotpw implementation. I downloaded one from PEAR, Crypt_HMAC, but the passwords it generates look nothing like the dovecotpw passwords, which could be my fault because I know nothing about the field. Is there a guide or some library that implements them to match dovecotpw?

4 4