- dovecot - dovecot.org

Re: [Dovecot] LDAP authentication via PAM
by Stephen Warren 28 Aug '06

28 Aug '06

Oscar A. Valdez wrote: > El lun, 10-04-2006 a las 11:17 -0600, Stephen Warren escribió: >> Oscar A. Valdez wrote: >>> Before trying Luis' suggestion, I had the following in /var/log/messages: >>> >>> dovecot(pam_unix)[4691]: check pass; user unknown >>> dovecot(pam_unix)[4691]: authentication failure; logname= uid=0 euid=0 >>> tty= ruser= rhost= >> >> I believe this is because your PAM configuration checks both local files >> (pam_unix: /etc/passwd) and pam_ldap: LDAP. The pam_unix module can't >> find the user in the local database, and complains, then LDAP finds the >> user information, and allows the login/whatever. >> >> The solution is probably to create a /etc/pam.d/system-auth-ldap-only >> file that doesn't reference pam_unix, and use that pam configuration for >> network services such as Dovecot. >> >> Or, possible, check pam_ldap first with a "sufficient" setting; perhaps >> this will stop pam_unix being tried at all? >> >> I keep meaning to try this, since I'm seeing those messages from a >> number of network services, but have never gotten around to it! > > They tend to fill up the message log quickly, so if you get around to > it, I'm interested in your fix. Well, I finally got around to fiddling with this, and I now have created a /etc/pam.d/system-auth that doesn't trigger the annoying authentication failure messages in syslog. The file is shown below. I've tested this by connecting in using SSH (setup for PAM) both as a user in the local /etc/passwd and as a user in LDAP. Also, I tested /etc/passwd users with the LDAP server stopped, and that worked too. Finally, I tested connecting to Dovecot as an LDAP user. Note: The only section that references LDAP is the auth section. That's because account and session rely on pam_unix to pick up the information using nss_ldap (i.e. /etc/nsswitch.conf says "files ldap" for passwd, group, etc.) This seems to work for me... Also, note that my LDAP server stores Samba passwords too, so that's why the password section uses pam_smbpass (which in turn is setup to access LDAP via /etc/samba/smb.conf) rather than pam_ldap. This is so both the Unix and SMB passwords are updated in LDAP. Anyway, here's my file. Anyone want to pick holes in it? Indented lines are just mail formatting... #%PAM-1.0 # This file is auto-generated. # User changes will be destroyed the next time authconfig is run. auth required /lib/security/$ISA/pam_env.so auth sufficient /lib/security/$ISA/pam_ldap.so debug auth sufficient /lib/security/$ISA/pam_unix.so use_first_pass likeauth auth required /lib/security/$ISA/pam_deny.so account required /lib/security/$ISA/pam_unix.so account sufficient /lib/security/$ISA/pam_succeed_if.so uid < 100 quiet account required /lib/security/$ISA/pam_permit.so password requisite /lib/security/$ISA/pam_cracklib.so retry=3 password sufficient /lib/security/$ISA/pam_smbpass.so use_authtok password sufficient /lib/security/$ISA/pam_unix.so nullok use_authtok md5 shadow password required /lib/security/$ISA/pam_deny.so session required /lib/security/$ISA/pam_limits.so session required /lib/security/$ISA/pam_unix.so session required /lib/security/$ISA/pam_mkhomedir.so skel=/etc/skel/ umask=0077

1 0

[Dovecot] failed to start
by Don Citarella 28 Aug '06

28 Aug '06

Hello, i saw you posted on dovecot.org and was hoping you could assist with a problem i have with dovecot. I installed the attached file to webmin and clicked it said it installed correctly: Dovecot IMAP/POP3 Server in /usr/libexec/webmin/dovecot (372 kB) under category Servers I clicked the link and then clicked "Start Dovecot Server" from the webmin panel and got this error: Failed to start Dovecot : I assume this means a file is missing. My config file looks like this: dovecot=/usr/sbin/dovecot dovecot_config=/etc/dovecot.conf init_script=dovecot pid_file=/var/run/dovecot/master.pid There doesn't appear to be a dovecot directory in: etc/rc.d/init.d/ Perhaps that's the issue? I'm running Redhat Linux 4. Can you assist in any way? Any help is most appreciated. Thanks, Don

3 2

[Dovecot] vmysql: sql error[3]
by Charles M. Gerungan 27 Aug '06

27 Aug '06

I keep getting these messages in the log: @4000000044f1db7732acaddc dovecot: Error: auth(default): vmysql: sql error[3]: MySQL server has gone away I see that at least one user has the same problem: http://www.mail-archive.com/vchkpw@inter7.com/msg23311.html Unfortunately, no solution is given. I also found the MySQL Problems page on the wiki, but the issues are supposed to be resolved for my version of MySQL. The only way to get dovecot to authenticate again is to restart the daemon. Is there a solution to this problem? If yes, please share it! dovecot 1.0 RC7 FreeBSD 5.4-RELEASE-p17 #6 vpopmail 5.4.13 mysql version: Ver 14.12 Distrib 5.0.24, for portbld-freebsd5.4 (i386) using 4.3 Dovecot and vpopmail are compiled from source. MySQL is compiled from source via the FreeBSD ports system. -- Regards, Charles.

1 0

[Dovecot] imap service not working
by LeVA 26 Aug '06

26 Aug '06

Hi! I'm using dovecot-1.0.rc7 with pop3 and imap. The pop3 is ok, really, no problem at all. With imap, I have the following problem: From the client side it looks like it logs in - logs out - logs in - logs out... can not see any emails or directories. From the server side, I can see these in the logs: dovecot: Aug 26 22:29:00 Info: auth(default): client in: AUTH 1 PLAIN service=IMAP secured lip=x.x.x.x rip=x.x.x.x dovecot: Aug 26 22:29:00 Info: auth(default): client out: CONT 1 dovecot: Aug 26 22:29:00 Info: auth(default): client in: CONT 1 AHRlc3p0AGxvZmFzeg== dovecot: Aug 26 22:29:00 Info: auth(default): client out: OK 1 user=teszt MAIL=maildir:/ dovecot: Aug 26 22:29:00 Info: auth(default): master in: REQUEST 30 15660 1 dovecot: Aug 26 22:29:00 Info: auth(default): master out: USER 30 teszt uid=8010 gid=8010 home=/var/mail/virtual/teszt/Maildir/./ dovecot: Aug 26 22:29:00 Info: IMAP(teszt): Effective uid=8010, gid=8010 dovecot: Aug 26 22:29:00 Info: IMAP(teszt): maildir: data=/ dovecot: Aug 26 22:29:00 Info: IMAP(teszt): maildir: root=, index=, control=, inbox= dovecot: Aug 26 22:29:00 Info: imap-login: Login: user=<teszt>, method=plain, rip=x.x.x.x, lip=x.x.x.x, TLS These messages are repeating, but with an incrementing number: "USER 30 teszt". This number after the 'USER' word increments with every login. The user's mail directory has 770 perms, and owned by 8010:8010 (the teszt user's UID and GID). The cur/new/tmp folders gets created, but nothing more. The MTA on the server puts the messages inside the new/ folder, and I can get the mails with pop3 from the 'teszt' account. Only imap is acting funny. This "infinite loop" happens with Thunderbird, but I tried it with KMail too. The latter says right after the login procedure: "The connection to the server IMAP Account was unexpectedly closed or timed out. It will be re-established automatically if possible." Is there some script which makes the maildir folder "ready" for use (like the mkmaildir with courier imap), or is there some special file which I must put in it to make it work? Thanks for the help! Daniel -- LeVA

1 0

[Dovecot] separate passdb for imap and pop3
by LeVA 26 Aug '06

26 Aug '06

Hi! Is this possible? I couldn't find any writings about the 'auth' (like 'auth default') keyword in the wiki. What does that mean? Can I setup seperate user and password dbs for sepearate circumstances? I've tried to experiment with it and added two auths: auth pop3 { mechanisms = plain digest-md5 passdb passwd-file { args = /etc/dovecot_pop3.passwd } userdb passwd-file { args = /etc/dovecot_pop3.passwd } user = _dv_auth } auth imap { mechanisms = plain digest-md5 passdb passwd-file { args = /etc/dovecot_imap.passwd } userdb passwd-file { args = /etc/dovecot_imap.passwd } user = _dv_auth } But how can I configure dovecot to use the 'auth imap' for imap authentications, and use 'auth pop3' for pop3 authentications. With the above setup dovecot always try to use the last one (auth imap). Any help would be appreciated! Thanks! Daniel -- LeVA

2 1

[Dovecot] Dovecot SSL issue on Solaris 10 x64 (64-bit)
by Patric 26 Aug '06

26 Aug '06

I'm having an issue with Thunderbird (and Opera) and Dovecot SSL on a Solaris 10. My OS is Solaris 10 6/06 x86 (running in 64-bit mode) using ZFS (disk mirror) as the filesystem for my users. Dovecot version is 1.0rc7 (logs below are from 1.0rc6). First the connection asks if the SSL-certificate should be accepted, accepting it seems to work but then nothing happens. Thunderbird is quite silent, not always displays an error message, it just seems that there are no emails to download. It works fine in Mac OS X Mail.app with POP3s and IMAPs (both SSL). But not for Thunderbird (1.5.0.5) and Opera (latest). Setting "verbose_ssl=yes" and "auth_debug=yes" in the configuration gives this error from a Thunderbird login: Aug 16 14:16:28 credo dovecot: [ID 107833 mail.warning] pop3-login: SSL_accept() failed: error:140D308A:SSL routines:TLS1_SETUP_KEY_BLOCK:cipher or hash unavailable [85.225.200.123] Aug 16 14:16:28 credo dovecot: [ID 107833 mail.info] pop3-login: Disconnected: rip=85.225.200.123, lip=195.198.174.212, TLS Aug 16 14:16:29 credo dovecot: [ID 107833 mail.warning] pop3-login: SSL_accept() failed: error:140D308A:SSL routines:TLS1_SETUP_KEY_BLOCK:cipher or hash unavailable [85.225.200.123] Aug 16 14:16:29 credo dovecot: [ID 107833 mail.info] pop3-login: Disconnected: rip=85.225.200.123, lip=195.198.174.212, TLS It seems to be that the OpenSSL installed with Solaris 10 is abit "broken" or missing the cryptographic procotols needed. (at least from what I've read on the Internet) Strange that it works fine with Mail.app on Mac OS X. So, I installed the latest OpenSSL, compiled, tested and installed. (no problems occured) Back to compiling Dovecot, used this oneliner to point it to the new OpenSSL (and my compile settings): env PKG_CONFIG_PATH=/usr/local/ssl/lib/pkgconfig ./configure --sysconfdir=/usr/local/etc --with-ssldir=/usr/local/etc/ssl Worked! bash-3.00$ egrep "^SSL_" config.log SSL_CFLAGS='-I/usr/local/ssl/include ' SSL_LIBS='-L/usr/local/ssl/lib -lssl -lcrypto -lsocket -lnsl -ldl ' But gives this error message when I compile: gcc -std=gnu99 -g -O2 -Wall -W -Wmissing-prototypes -Wmissing-declarations -Wpointer-arith -Wchar-subscripts -Wformat=2 -Wbad-function-cast -I/usr/local/ssl/include -o ssl-build-param ssl-init-main.o ssl-init-openssl.o ssl-init-gnutls.o ../lib/liblib.a -L/usr/local/ssl/lib -lssl -lcrypto -ldl -lsocket -lnsl -lrt -lsendfile ld: warning: file /usr/local/ssl/lib/libcrypto.a(dh_asn1.o): wrong ELF class: ELFCLASS64 Undefined first referenced symbol in file DH_generate_parameters ssl-init-openssl.o ERR_get_error ssl-init-openssl.o ERR_error_string_n ssl-init-openssl.o i2d_DHparams ssl-init-openssl.o ld: fatal: Symbol referencing errors. No output written to ssl-build-param collect2: ld returned 1 exit status *** Error code 1 make: Fatal error: Command failed for target `ssl-build-param' Current working directory /home/nollan/work2/dovecot-1.0.rc7/src/master *** Error code 1 The following command caused the error: (error message removed to save space, can include if requested) It seems that the Thunderbird/Opera SSL problem will be solved with a new OpenSSL. But I seem to have problems getting Dovecot to compile with the new OpenSSL (64-bit issue?). Anyone got any hints on what I should do? With Regards, Patric

3 2

[Dovecot] imap daemon consuming all the cpu
by Rui Lopes 26 Aug '06

26 Aug '06

Hello, I've tried to do a full text search on the inbox, it run fine, but the imap daemon started to eat all the CPU until I closed the email client. I'm running dovecot 1.0.rc7 [using kqueue] on FreeBSD 6.1. ktrace shows this pattern over and over (its seems to be looping): 49021 imap CALL kevent(0x4,0,0,0x80df000,0x5,0xbfbfe988) 49021 imap RET kevent 1 49021 imap CALL gettimeofday(0x80d0b00,0x80d0b08) 49021 imap RET gettimeofday 0 49021 imap CALL gettimeofday(0x80d0b00,0x80d0b08) 49021 imap RET gettimeofday 0 49021 imap CALL kevent(0x5,0,0,0xbfbfe930,0x1,0xbfbfe928) 49021 imap RET kevent 1 49021 imap CALL gettimeofday(0xbfbfe990,0) 49021 imap RET gettimeofday 0 Maybe this is useless to track the cause... :( Unfortunately(?) I can't reproduce this again, because searches run OK. Best regards, Rui Lopes

1 1

[Dovecot] High CPU load
by Nagy László 25 Aug '06

25 Aug '06

Hello, I'm using dovecot-1.0.b9 on a FreeBSD 6.1 system. Usually we have 6 clients connected to dovecot through IMAPs. These clients are Thunderbird 1.5 programs. After some hours, one or two processed go up to 100% WCPU. As an example, this is what I see when I run 'top': last pid: 5111; load averages: 1.34, 1.82, 1.75 up 13+00:04:09 15:26:59 150 processes: 2 running, 147 sleeping, 1 zombie CPU states: 21.2% user, 0.0% nice, 47.7% system, 0.0% interrupt, 31.1% idle Mem: 149M Active, 368M Inact, 196M Wired, 29M Cache, 111M Buf, 255M Free Swap: 5120M Total, 548M Used, 4572M Free, 10% Inuse PID USERNAME THR PRI NICE SIZE RES STATE C TIME WCPU COMMAND 52627 thomas 1 109 0 2940K 1500K CPU1 0 21:49 99.02% imap When there are two rebellious clients, they occupy 50-50% CPU time. If I restart thunderbird, then all goes well for a couple of minutes. I need to solve this problem. I already had a system crash that was probably caused by the cpu heat. Pleas help me. Laszlo

5 4

[Dovecot] Restricting IP and/or user access (POP3/IMAP)
by Phil Clare 25 Aug '06

25 Aug '06

Hi, The documentation says to authenticate only from a specific IP or network… if you set this to 127.0.0.1 to indicate the local loop then this effectively blocks every IP address but this one. Since the extra field is in passdb then this would imply it can be done on a per user basis. Have you tried this? Phil ________________________________________ From: dovecot-bounces(a)dovecot.org [mailto:dovecot-bounces@dovecot.org] On Behalf Of Jos Chrispijn Sent: 24 August 2006 15:08 To: dovecot(a)dovecot.org Subject: [Dovecot] Restricting IP and/or user access (POP3/IMAP) Hi, Just new on this mailinglist; I sure hope my questions wouldn't be too dumb for words :-) Q: Restricting IP and/or user access (POP3/IMAP) What I would like to do is blocking some of my user from fetching their mail with neither POP3 nor IMAP. The only way of letting them read/write their e-mail is to be done with my/their Webmail client. On the site of Dovecot I read: 'It's possible to allow user to authenticate only from a specific IP or network. This is especially useful for master users. This can be done by returning allow_nets extra field in passdb.' Actually I am looking for a way of _blocking_ user(names) or certain IP adress(es) instead of _allowing_ certain IP adresses to get their POP3/IMAP mail. Pls could someone hint me out on this? Thanks in advance. Jos -- No virus found in this outgoing message. Checked by AVG Free Edition. Version: 7.1.405 / Virus Database: 268.11.5/426 - Release Date: 23/08/2006

3 3

[Dovecot] multiple mailboxes in imap
by einKI.ml 25 Aug '06

25 Aug '06

Hi I try to setup a mail server which fetches mails from some pop accounts and presents them through imap (with dovecot) to my local network. I get the mails with getmail at this works as it should. To use dovecot as a pop3 and imap server works too. Now I am trying to setup multiple mailboxes which then should be presented to the user as different folders. I think I have to use namespaces for this (is this correct?) So I tried to configure two namespaces with the following statement. namespace private { separator = / inbox = yes prefix = } namespace private { separator = / prefix = ns location = maildir:/data/server/mail/in/%u/ns } when i try to access the imap server with thunderbird I can receive mails for Inbox but when I want to subscripe an additional folder ns can be seen but is grayed out in thunderbird. To summarize this can anybody give me a hint or example how to configure multiple mailboxes which are located in different directories on the server. thx

1 0