- dovecot - dovecot.org

[Dovecot] auth_default_realm for different listeners
by John Morrissey 15 Sep '07

15 Sep '07

We provide POP3 service for several realms, each of which has a substantial number of users logging in with no realm (bare username). We would like to use Dovecot, but I haven't been able to findout how to vary auth_default_realm for each listener. My most recent attempt was to set up one auth {} block for each realm with a different auth_default_realm and socket master path. I then set up one protocol pop3 {} block for each realm, listening on different IP addresses and with a auth_socket_path corresponding to the auth block for that listener. I'm not sure if I'm on the right track here, but I'm seeing two problems: 1. When dovecot starts, I get: Sep 5 18:32:21 pop01 dovecot: auth(otherdomain): Socket already exists: /var/run/dovecot/auth-otherdomain for each additional auth {} block. 2. dovecot won't start with auth_socket_path specified in a protocl pop3 {} block: Error in configuration file /etc/dovecot/dovecot.conf line 654: Unknown setting: socket_path Is there a way to vary auth_default_realm for each listener, so I can have multiple realms log in with bare usernames? thanks, john -- John Morrissey _o /\ ---- __o jwm(a)horde.net _-< \_ / \ ---- < \, www.horde.net/ __(_)/_(_)________/ \_______(_) /_(_)__

2 3

[Dovecot] namespace prefix issue with avelsieve
by it-dovecot＠ml.epigenomics.com 15 Sep '07

15 Sep '07

Hi! I am currently testing a setup with dovecot's lda, the cmusieve plugin, pysieved and the avelsieve plugin for squirrelmail. The issue I am stumbling upon is that avelsieve is generating folder names including the namespace prefix when creating "fileinto" rules. E.g.: A rule: If the header "Precedence" contains "bulk", then file it into the folder INBOX.bulk. Also keep a copy in INBOX, marked as deleted. translates into sieve: require ["fileinto","reject","vacation","imapflags","relational","comparator-i;ascii-numeric","regex","notify"]; if header :contains "Precedence" "bulk" { fileinto "INBOX.bulk"; addflag "\\Deleted"; keep; } But what happens when a matching email is delivered is that a new mailbox ".INBOX.bulk" in the user's Maildir is created. I.e. the email is not delivered to ~/.Maildir/.bulk as intended, but into ~/.Maildir/.INBOX.bulk, creating the new folder on the fly. The same happens when trying to fileinto folders from other namespaces. It seems that either avelsieve is generating "too much" and should remove the prefix (at least for INBOX) or dovecot's deliver is not able to use the namespaces definition in dovecot.conf correctly when interpreting sieve's fileinto directive. Did I miss something? This is the dovecot.conf in use: # /etc/dovecot/dovecot.conf log_timestamp: %Y-%m-%d %H:%M:%S listen: *:143 ssl_listen: *:993 ssl_cert_file: /etc/courier/imapd.pem ssl_key_file: /etc/courier/imapd.pem disable_plaintext_auth: no login_dir: /var/run/dovecot/login login_executable: /usr/lib/dovecot/imap-login login_processes_count: 12 login_max_processes_count: 512 verbose_proctitle: yes mail_location: maildir:~/.Maildir:INDEX=/var/cache/dovecot/INBOX.%u:CONTROL=/var/cache/dovecot/INBOX.%u mail_full_filesystem_access: yes maildir_stat_dirs: yes maildir_copy_with_hardlinks: yes namespace: type: private separator: . prefix: INBOX. inbox: yes namespace: type: public separator: . prefix: shared. location: maildir:~/.Maildir/shared:INDEX=/var/cache/dovecot/shared.%u:CONTROL=/var/cache/dovecot/shared.%u namespace: type: private separator: . prefix: archive. location: maildir:/mnt/nfs/imap_archive.hm/%u:INDEX=/var/cache/dovecot/archive.%u:CONTROL=/var/cache/dovecot/archive.%u auth default: verbose: yes passdb: driver: passwd userdb: driver: passwd socket: type: listen client: path: /var/run/dovecot/auth-client mode: 432 master: path: /var/run/dovecot/auth-master mode: 384 Greetings -- Robert Sander Senior Manager Information Systems Epigenomics AG Kleine Praesidentenstr. 1 10178 Berlin, Germany phone:+49-30-24345-0 fax:+49-30-24345-555 http://www.epigenomics.com robert.sander(a)epigenomics.com

2 1

[Dovecot] Broken Pipe
by Joseph D. Wagner 15 Sep '07

15 Sep '07

Since upgrading to dovecot 1.0.5, I started to see the following error in maillog: dovecot: IMAP(username): Connection closed: Broken pipe Any insight that anyone can offer would be greatly appreciated. I've attached a complete list of all dovecot log entries in maillog in the hope that it will help you identify the issue. Thanks in advance. Joseph D. Wagner

3 2

[Dovecot] problem migrating uw imap to dovecot on suse 9.3
by Dan Trutza 14 Sep '07

14 Sep '07

hi all, after i successed in install / configure dovecot, and transform mbox to maildir i got error in outlook expres. outlook expres is authenticated . dovecot accep user/passwd. when i try to receive folder list is giving me error: "downloading folder from server.ro" "one or more problems occurred downloading your list of folders from your account. The folder list may be inaccurate." any ideea? thanks.

2 3

Re: [Dovecot] Dovecot / OS X 10.4 Mail.app and "Too Many Opened files" error message ?
by Xavier Beaudouin 14 Sep '07

14 Sep '07

(replying to myself) > After a long time, the OS X client say error : "Too Many opened > files". Seems that OS X has stupidly low number of files that can be opened... $ ulimit -a [...] open files (-n) 256 On my MacBook Pro.... This is bloody low.... So I've figured to change this limit globaly, but it seems that OS X don't have any limits.conf or default values.... This kinda strange.. So I decided to do some local fixe for Mail.app only : in /Applications/Mail.app/Contents/MacOS/ $ sudo mv Mail Mail.orig and ... Create a Mail file with this following content : #!/bin/sh # thanks to http://www.amug.org/~glguerin/howto/More-open-files.html # To understand this, read 'man sh' below "substring processing". # This can also be accomplished with the 'dirname' command, # but it may not be installed. here="${0%/*}" # This should be the name of your native Java-app's executable. cmd='Mail.orig' # Set all desired soft-limits here. See 'ulimit' in 'man sh'. ulimit -S -n 1000 # Execute the Java-app in the current process. See 'exec' in 'man sh'. exec "$here/$cmd" "$@" $ sudo chmod +x Mail and this all... FYI Mail.app is really strange thing.... $ lsof | grep Mail.orig | wc -l 150 Mostly all libraries and TCP connection to mail server... Maybe this can be added to Wiki even if it is not too mutch dovecot related, but can be usefull for people like me that does have lots of mail.... /Xavier

2 1

[Dovecot] imap / 1,.0.5: Connection closed: Broken pipe
by Frank Elsner 14 Sep '07

14 Sep '07

Hello *, since the upgrade to version 1.0.5 (from 1.0.3) I observe lines of the form imap(XXXXXXXX): Connection closed: Broken pipe in the logfile, which I've never seen before. What's behind? Should I care about? Regards ______________________________________________________________ Frank Elsner / c/o Technische Universitaet Berlin | ____________/ tubIT [BD], Sekr. E-N 50 | | Einsteinufer 17 | | Phone: +49 30 314 23897 D-10587 Berlin | | eMail: Frank.Elsner(a)TU-Berlin.DE Germany __________________| |_________________________________________________________| in dubio pro exim

1 0

[Dovecot] gssapi, kerberos and webmail
by Denis Cardon 14 Sep '07

14 Sep '07

Hi every one, first thanks for the great job, I switched successfully from courier imap a few months ago and both the migration and maintenance went smoothly from then on. The reason I switched was gssapi support (and the easier debug) and now I have thunderbird on Linux connecting in an SSO fashion through kerberos/GSSAPI (works great). Users should be able to access their mail throught a webmail too (eg. eGroupware). I have already checked for kerberos authentication on Apache, however there seems to be no way to have ticket forwarding throught PHP. AFIAK there is thus no way to use kerberos for php-imap --> dovecot authentication. The only information available seems to be the username. So here is my question : how do people on this mailing list handle kerberos authentication with webmail? Do you use other kind of authentication on privileged port (ie with access only from apache) and just do a login/nopassword authentication (like an uid base authentication through ldapi:/// on an ldap directory for example) ? Here is what we have with thunderbird : Thunderbird -------kerberos-------> dovecot on standard port Here is what I would guess for webmail auth : Firefox ------kerberos----> Apache ----gssapi-auth-just-using-login----> dovecot on privileges port Cheers, Denis -- Denis Cardon Tranquil IT Systems 44 bvd des pas enchantés 44230 Saint Sébastien sur Loire tel : +33 (0) 2.40.97.62.67 http://www.tranquil-it-systems.fr

2 1

[Dovecot] Dovecot / OS X 10.4 Mail.app and "Too Many Opened files" error message ?
by Xavier Beaudouin 14 Sep '07

14 Sep '07

Hello, I am trying to move from Courier-imap to dovecot.... Even if the processes to move logical (eg name spaces etc...) went very and without any problem, I've some etrange behavior when Imap client is Mac OS X Mail.app. I've got a big mailbox that have about 3 / 4G of mail in several folder (lots !!!)... After a long time, the OS X client say error : "Too Many opened files". I have check on the servers (a FreeBSD farm of 3 servers using freebsd ports of dovecot)... And nothing special... A question : why do I have never this kind of message on courier imap and why do I get this on dovecot... ? Configuration file on demand... if needed... THanks, /Xavier

1 0

[Dovecot] pipe() error but not linked to kqueue
by Patrick Milvich 14 Sep '07

14 Sep '07

I have dovecot 1.0.5 installed on an OpenBSD 4.1 box and an OS X Server 10.4.10 box. Sure you've all heard it before, because of the pipe error, no more login processes can be launched, and I have to restart the server. dovecot: Sep 13 05:50:00 Error: pipe() failed: Too many open files I first thought this was the issue with kqueue, but I've since recompiled making sure to use poll. This also happened with 1.0.3 and 1.0.2. It also happens very specifically after a dictionary attack that lasts usually about an hour, unless I can catch it earlier. (Around 18,000 login attempts) ex: dovecot: Sep 13 05:49:58 Info: pop3-login: Aborted login: user=<aaron>, method=PLAIN, rip=62.161.41.32, lip=<local ip> dovecot: Sep 13 05:49:58 Info: pop3-login: Aborted login: user=<adm>, method=PLAIN, rip=62.161.41.32, lip=<local ip> dovecot: Sep 13 05:49:58 Info: pop3-login: Aborted login: user=<account>, method=PLAIN, rip=62.161.41.32, lip=<local ip> But after the attack has subsided for a period of time, I still have the number of file descriptors maxed out for the dovecot process. I've increased the number available to have a higher roof, but that doesn't fix the problem. Wondering if anyone else has seen this issue, and also in a generic problem. How are others dealing the the problem of being attacked in this method? Is there a max number of login tries for a given ip address within a period of time that I'm missing? :) Thanks, Patrick

2 1

[Dovecot] dirsize quota assertion problem
by Alan Ferrency 14 Sep '07

14 Sep '07

Our current virtual mailbox configuration is not compatible with one of the assertions in the dovecot quota plugin's assertions in quota-dirsize.c. I believe the assertion is incorrect, but I would also be happy if I could get the same result with a better configuration setting. Here is a sample passdb entry which causes the quota assertion to fail: test(a)example.com:<snip>:3007:1000::/usr/boxes/username/example.com::userdb_mail=mbox:~/test^/.imap:INBOX=~/test userdb_uid=3007 userdb_gid=1000 userdb_home=/usr/boxes/username/example.com userdb_quota=dirsize:storage=100 The imap folder is "~/test^/.imap" and the INBOX is "~/test". As you can see, these are in different locations, but the INBOX string happens to be a substring of the imap folder directory. An example of the failed assertion error: Aug 31 16:44:13 www2 dovecot: IMAP(test(a)example.com): file quota-dirsize.c: line 180 (quota_count_path_add): assertion failed: (!is_file) This particular error log line was generated by dovecot 1.0.3, but the code in quota-dirsize.c is the same in dovecot 1.1 alpha3's version of quota-dirsize.c: 131 if (strncmp(count_path[i].path, path, strlen(path)) == 0) { 132 /* the new path contains the existing path */ 133 i_assert(!is_file); 134 count_path += i; 135 break; 136 } First, quota_count_path_add() is called for directory "~/test^/.imap" and it succeeds. When it is subsequently called for file "~/test": - the strncmp matches because "~/test" is a substring of "~/test^/.imap" - the assertion fails because "~/test" is a file and not a directory It seems to me that instead of asserting !is_file, it would be better to simply skip the conditional in that case, since a path variable that is a file should never be tested to see whether it contains an existing path. if (!is_file && strncmp(count_path[i].path, path, strlen(path)) == 0) { /* the new path contains the existing path */ count_path += i; break; } But this also has a bug: if path is a directory which substring matches count_path[i].path, but the same path with a directory separator appended to it does not substring match count_path[i].path, then it is a different path and does not contain the existing path. For example, if count_path[i] is the directory /usr/home/test/mailbox_folders, and path is the directory /usr/home/test/mailbox, then /usr/home/test/mailbox does not contain/usr/home/test/mailbox_folders, and this condition should fail. If some other code were to enforce that /usr/home/test/mailbox be terminated with a directory separator, then this is not a problem and my patch should work. I hope this makes sense. Thanks, Alan Ferrency pair Networks, Inc. alan(a)pair.com

2 7