- dovecot - dovecot.org

[Dovecot] Dovecot Authentication through LDAP Server
by ashok cvs 09 Jun '06

09 Jun '06

I have a Samba PDC with LDAP (samba version 3.0.21c with Openldap 2.3.19). where i have all the users. I have configured sendmail on another system with dovecot as IMAP and POP3 server. I wanted to enable user authentication from LDAP server which is on samba PDC. So configured /etc/dovecot.conf ################################################################ protocols = pop3 imap imap_listen = [::] pop3_listen = [::] login_dir = /var/run/dovecot-login login = imap login_user = testuser login = pop3 verbose_proctitle = yes maildir_copy_with_hardlinks = yes mbox_locks = fcntl auth = default auth_mechanisms = plain digest-md5 auth_userdb = ldap /etc/dovecot-ldap.conf auth_passdb = ldap /etc/dovecot-ldap.conf auth_user = dovecot auth_username_chars = abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ01234567890.-_@ ################################################################ configured /etc/dovecot-ldap.conf ####################################################################### # NOTE: We don't support "authentication binds", so you'll have to give # dovecot-auth read access to userPassword field in LDAP server. With OpenLDAP # this is done by modifying /etc/ldap/slapd.conf. There should already be # something like this: # # access to attribute=userPassword # by dn="<dovecot's dn>" read # add this # by anonymous auth # by self write # by * none # Space separated list of LDAP hosts to use. host:port is allowed too. hosts = 192.168.129.18 # Distinguished Name - the username used to login to the LDAP server dn = uid=root,ou=People,dc=msdpl,dc=com # Password for LDAP server dnpass = mobil5@b1d # LDAP protocol version to use. Likely 2 or 3. ldap_version = 3 # LDAP base base = dc=msdpl,dc=com # Dereference: never, searching, finding, always deref = never # Search scope: base, onelevel, subtree scope = subtree # User attributes in order: # Virtual user name (user@domain) # Home directory # MAIL environment # System user name (for initgroups()) # System UID # System GID #user_attrs = uid,homeDirectory,,uid,uidNumber,gidNumber user_attrs = uid,homeDirectory,,uid,, # Filter for user lookup. Some variables can be used: # %u - username # %n - user part in user@domain, same as %u if there's no domain # %d - domain part in user@domain, empty if user there's no domain user_filter = (&(objectClass=posixAccount)(uid=%u)) #ser_filter = (&(objectClass=sambaSamAccount)(uid=%u)) # Password checking attributes in order: # Virtual user name (user@domain) # Password, may optionally start with {type}, eg. {crypt} pass_attrs = uid,userPassword # Filter for password lookups #pass_filter = (&(objectClass=posixAccount)(uid=%u)) # Default password scheme. "{scheme}" before password overrides this. # Currently supported schemes include PLAIN, PLAIN-MD5, DIGEST-MD5, CRYPT #default_pass_scheme = CRYPT # You can use same UID and GID for all user accounts if you really want to. # If the UID/GID is still found from LDAP reply, it overrides these values. #user_global_uid = 100 #user_global_gid = 100 ####################################################################### The following is the error when we check using [root]#telnet mymailserverip 110 Trying 192.168.129.248 Connected to testmail.mydomain.com (192.168.129.248) Escape character is '^]`. user dcadmin pass mypass ERR-Authentication Failure The following is the log output of /var/log/maillog ######################################################################### Jun 8 13:09:16 testmail dovecot-auth: ldap(dcadmin): No password in reply Jun 8 13:10:16 testmail pop3-login: Disconnected: Inactivity [::ffff: 127.0.0.1] Jun 8 13:10:26 testmail dovecot-auth: ldap(root): No password in reply Jun 8 13:11:26 testmail pop3-login: Disconnected: Inactivity [::ffff: 127.0.0.1] Jun 8 13:11:38 testmail dovecot-auth: LDAP: ldap_result() failed: Can't contact LDAP server Jun 8 13:13:46 testmail dovecot-auth: ldap(root): No password in reply Jun 8 13:13:46 testmail imap-login: Disconnected [::ffff:127.0.0.1] Jun 8 13:14:03 testmail dovecot-auth: ldap(dcadmin): No password in reply Jun 8 13:14:03 testmail imap-login: Disconnected [::ffff:127.0.0.1] ############################################################################ Regards Niranjan

2 1

[Dovecot] Login issue
by "M. Tolga Özses" 09 Jun '06

09 Jun '06

Hi, cat /var/log/dovecot.log|grep -i jun\ 09 dovecot: Jun 09 09:35:26 Info: auth(default): client in: AUTH 1 PLAIN service=POP3 lip=192.168.1.2 rip=212.98.201.1 resp=<hidden> dovecot: Jun 09 09:35:26 Info: auth(default): client out: CONT 1 dovecot: Jun 09 09:35:26 Info: auth(default): client in: CONT<hidden> dovecot: Jun 09 09:35:26 Info: auth(default): client out: OK 1 user=kabuto dovecot: Jun 09 09:35:26 Info: auth(default): master in: REQUEST 13 12652 1 dovecot: Jun 09 09:35:26 Info: auth(default): master out: USER 13 kabuto system_user=kabuto uid=1000 gid=100 home=/home/kabuto dovecot: Jun 09 09:35:26 Info: pop3-login: Login: user=<kabuto>, method=PLAIN, rip=212.98.201.1, lip=192.168.1.2 dovecot: Jun 09 09:35:26 Info: POP3(kabuto): Disconnected: Logged out top=0/0, retr=0/0, del=0/0, size=0 Does this look right? I'm still not getting any e-mails from outside world. My latest .conf file is at http://www.kunduz.org/dovecot.conf. The last change I made was to out uncomment pop3_uidl_format as I was suggested yesterday. Regards,

2 2

[Dovecot] Error building on OpenBSD 3.9
by B.O.F.H. 08 Jun '06

08 Jun '06

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 This is for all versions from 1.0b3 - 1.0b8 All crash at the same place: Making all in auth gmake[3]: Entering directory `/src/mail/dovecot-1.0.beta8/src/auth' if gcc -DHAVE_CONFIG_H -I. -I. -I../.. -I../../src/lib - -I../../src/lib-sql -I../../src/lib-settings -I../../src/lib-ntlm - -DAUTH_MODULE_DIR=\""/usr/local/lib/dovecot/auth"\" - -DPKG_LIBEXECDIR=\""/usr/local/libexec/dovecot"\" -I@includedir@ @INCLUDE_des@ -I/usr/local/include -I/usr/include/kerberosV - -std=gnu99 -O2 -march=athlon -pipe -Wall -W -Wmissing-prototypes - -Wmissing-declarations -Wpointer-arith -Wchar-subscripts -Wformat=2 - -Wbad-function-cast -MT mycrypt.o -MD -MP -MF ".deps/mycrypt.Tpo" - -c -o mycrypt.o mycrypt.c; \ then mv -f ".deps/mycrypt.Tpo" ".deps/mycrypt.Po"; else rm -f ".deps/mycrypt.Tpo"; exit 1; fi gcc: cannot specify -o with -c or -S and multiple compilations gmake[3]: *** [mycrypt.o] Error 1 gmake[3]: Leaving directory `/src/mail/dovecot-1.0.beta8/src/auth' gmake[2]: *** [all-recursive] Error 1 gmake[2]: Leaving directory `/src/mail/dovecot-1.0.beta8/src' gmake[1]: *** [all-recursive] Error 1 gmake[1]: Leaving directory `/src/mail/dovecot-1.0.beta8' gmake: *** [all] Error 2 Gnu-make versus BSD make doesn't differ. Compile options were: ./configure \ - --sysconfdir=/etc/dovecot \ - --localstatedir=/var \ - --infodir=/usr/share/info \ - --mandir=/usr/share/man \ - --disable-rpath \ - --enable-ipv6 \ - --enable-asserts \ - --without-shadow \ - --without-pam \ - --without-vpopmail \ - --with-pgsql \ - --with-mysql \ - --with-ssl=openssl \ - --with-ssldir=/etc/ssl \ - --with-storages='maildir mbox' \ - --with-sql-drivers \ CFLAGS='-O2 -march=athlon -pipe' \ LDFLAGS='-L/usr/local/lib' \ CPPFLAGS='-I/usr/local/include -I/usr/include/kerberosV' What other data can I provide to help figure out what's going wrong? - -- Ed V. IBM: Into Building Money 7 June 2006 17:52:03 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.3 (MingW32) iQIVAwUBRIdnZKfRmhqF/IZAAQrVUg//U0L4agoc5WGQ8gvj0XiEclzj+izer635 NYppYOc4AicVKq1Hp3HbcwaYcWYBY0nubkcUemSk+t8V/2qcZY2Y3rvaQo6B2aj8 rQF8Wj8BdqIzVMsX4IeVJO7XQlI7xUA/vaEOeL69dx43M/+7VE673YuaBpHYLvez UwXx/4pWujg0HbSuuX1SqFg5VntAE2XppxfukHmbK4FYfNbmWWGYKuAwAMqdr35t r+2cN8GOrk9nRBgisl2ADJW8YbDYvrj1DVcrNeo2cIeK68kqXU8knhCNxs9fXr75 pNRP811rdDLXQur66JHSlGdcJWOSNuoKUDUWLoJ5vpuQP/QlCpF2IfJ5kiK7rraJ 56q4Jbw63IHqYOiEC+yb2pGcgoh7tOOBSGTtlmzorym+0lOBS2SSKz7xd0+zfeU2 yHlRs5af13nCWG5ZV9e+gdyLuvZkd+8H9RTQyv2pbBgn9GHjq62HreDP/Drj6/DA HfHMXOtDF0tkfWbedIDD6SCeH4ptPf6FOqRd0BVdzuMk0Hi4uFeiChmkdXJYo9Vn c3176FN31fHmc7ZJm1P7MjAPdzAI/QP+vGiucMJg9bNTZVVOs5t/4aKMdG183zRT 5UZR4x+7ZA1JKZ4NgfVuaTM3khsgo9lQgw+A8QwrOOwKFGaek9By0AKxbJ06wIcg BFOZZSoKgWc= =U0oQ -----END PGP SIGNATURE-----

3 6

[Dovecot] a bug in the LDAP code
by Udo Rader 08 Jun '06

08 Jun '06

Hi, I was heaving some grave problems with dovecot's ldap client that left me with the following settings for virtual users: -------CUT------- mbox: data=/virtual/oeush.at/home/f.someone/mail/:INBOX=/var/mail/f.someone.oeush.at -------CUT------- data in that case was correct, yet the INBOX location was wrong, this should have been /virtual/oeush.at/var/mail/f.someone.oeush.at instead. My settings for the retrieval of the mail environment in /etc/dovecot/dovecot-ldap.conf were like this: -------CUT------- user_attrs = homeDirectory=home,uidNumber=uid,gidNumber=gid,MailMessageStore=mail -------CUT------- now at first glance this seems correct, but the problem was the upper cased "MailMessageStore" attribute name. changing it to "mailMessageStore" gave me the correct settings: -------CUT------- mbox: data=/virtual/oeush.at/home/f.someone/mail/:INBOX=/virtual/oeush.at/var/mail/f.someone.oeush.at -------CUT------- I don't have any of the LDAP RFCs ready, but I think that per default the case of the attribute _names_ should not matter when querying an ldap server. Udo Rader -- B e s t S o l u t i o n . a t EDV Systemhaus GmbH ------------------------------------------------------------------------ udo rader technischer leiter/CTO mobile ++43 660 5263642 ------------------------------------------------------------------------ eduard-bodem-gasse 8/3 A-6020 innsbruck fax ++43 512 935833 http://www.bestsolution.at phone ++43 512 935834

2 1

[Dovecot] Login issue
by "M. Tolga Özses" 08 Jun '06

08 Jun '06

Hi, I have a login issue. I do everything I can think of, but can't login. My .conf file is at http://kabuto.kunduz.org/dovecot.conf and I make slight changes everytime I try a new thing. I last set disable_plaintext_auth to yes and when I try to login using Thunderbird, I get *Code:* Sending of username did not succeed. Mail server mail.somedomain.org responded: Plaintext authentication disabled. , and dovecot.log reads *Code:* Info: pop3-login: Login failed: Plaintext authentication disabled: method=PLAIN, rip=212.98.201.1, lip=192.168.1.2. When I set disable_plaintext_auth to no and try again, I get *Code:* Sending of password did not succeed. Mail server mail.somedomain.org responded: Authentication failed and dovecot.log reads *Code:* dovecot: Jun 07 16:05:45 Info: auth(default): client in: AUTH 1 PLAIN service=POP3 lip=192.168.1.2 rip=212.98.201.1 resp=<hidden> dovecot: Jun 07 16:05:45 Info: auth(default): client out: CONT 1 dovecot: Jun 07 16:05:45 Info: auth(default): client in: CONT<hidden> dovecot: Jun 07 16:05:45 Info: auth(default): pam(kabuto,212.98.201.1): pam_authenticate() failed: Authentication failure dovecot: Jun 07 16:05:46 Info: auth(default): client out: FAIL 1 user=kabuto dovecot: Jun 07 16:05:47 Info: auth(default): client in: AUTH 2 PLAIN service=POP3 lip=192.168.1.2 rip=212.98.201.1 resp=<hidden> dovecot: Jun 07 16:05:47 Info: auth(default): pam(kabuto,212.98.201.1): pam_authenticate() failed: Authentication failure dovecot: Jun 07 16:05:48 Info: auth(default): client out: FAIL 2 user=kabuto dovecot: Jun 07 16:05:51 Info: pop3-login: Disconnected: user=<kabuto>, method=PLAIN, rip=212.98.201.1, lip=192.168.1.2 Can you help me with this? Sorry that it is long, but it was the only way to describe completely. Best regards,

3 3

RE: [Dovecot] Using MySQL to store email?
by Joshua Goodall 08 Jun '06

08 Jun '06

Marc Perkel scribbled: > Repeat after me - think outside the box. Did you miss the part where I said we've already tried this? Not only have we thought outside the box, but we've smashed it up and built several alternatives to see which one sucked the least. Turns out, SQL backends suck the most. Please try to keep up :) Marc Perkel also scribbled: > To do this with MySQL would be trivial. To do it without a database > isn't possible. Actually you could do that with a tiny Sieve extension. I don't think you really understand what you are even proposing. Your statement would be better phrased "to do it without an index would be slow". If you wanted to create a database server for mail, with a mail-specific query language, then that database might be called "Dovecot", and the query language might be called "IMAP". Innovation is not an excuse for lousy engineering. As usual, it turns out to be bad design practice to say "let's deploy shinytoy for feature X!" rather than say "we need capability X! What's a creative way to achieve that?". Which is why necessity is the mother of invention. /JG

1 0

RE: [Dovecot] Using MySQL to store email?
by Joshua Goodall 07 Jun '06

07 Jun '06

Marc Perkel: > Suppose I want to move all message from a specific host to another folder. > UPDATE table SET folder=new-folder WHERE host=value; > > With databases you can do things you would have to write complex programs > to do with files. Things that you would consider to be impossible are > trivial with databases. > > This outside the box. People who optimise their systems for shiny cute features rather than the common case get all the hacks they deserve. Repeat after me: design for the common case. Also your proposed sql above and implications (arbitrary operations based on mail metadata i.e. headers) seems to involve indexing every mail header on delivery. Good luck with that one large scale mail storage. Did you want a mail database, or an OLAP system? >-) /jg

3 2

RE: [Dovecot] Using MySQL to store email?
by Joshua Goodall 07 Jun '06

07 Jun '06

Marc Perkel trolled: > So Timo, > > Have you considered the idea of storing all the email in a MySQL > database? Seems to me that MySQL could somplify all the backend stuff > that everyone struggles with and with replication one could create very > massive and reliable systems. What would it take to use MySQL that way? Maybe we could recode Dovecot in PHP, too. Sorry, that was nasty. However, having recently experimented with a very large mail storage system using mysql, I strongly advise against this avenue. In particular, the two main backends have serious deficiencies when you get up to the multi-gigabyte ranges: * MyISAM doesn't restart in constant time. * InnoDB's next-key locking kills performance on large blob inserts & deletes. Anyway, what do you mean, everyone struggles with backends? Dovecot's backends are fast, modular and reliable. Regarding replication; all good logical volume managers can do this. Regarding massive; all good filesystems can do this. Regarding reliable; I guarantee that mysql reliability (when properly managed) is still lower than that of a filesystem (when properly managed). In fact, the whole argument is specious. Filesystems already are databases, optimised for storing arbitrary-sized data objects using a hierarchical key, which is practically the definition of mail storage. /jg

2 1

[Dovecot] Dspam Plugin
by Timothy White 07 Jun '06

07 Jun '06

Johannes, do you have any plans (regarding your dspam plugin) to: a) Integrate it into libdspam rather than calling the dspam binary? b) Any ideas for scaling it better, and implementing it scaled better? I notice a slight discussion about scaling, and you have chosen not to pursue it. Is that because it's too hard, or just because you don't need to? Thanks Tim p.s. If I knew how to use the libdspam stuff, I'd make the changes myself... I might have to learn ;-) -- Linux Counter user #273956

2 1

[Dovecot] Dovecot configure script for 1.0b8 not including SQL drivers?
by Will Buik 06 Jun '06

06 Jun '06

On 6/5/06, grant beattie <grant(a)grunta.com> wrote: > On Mon, Jun 05, 2006 at 05:57:36PM -0400, Will Buik wrote: > > > I am having a problem with the configure script for Dovecot 1.0b8. It > > doesn't seem to be compiling in sql engine driver support. I have > > specified --with-sql and --with-pgsql but when the script is done it > > says "Building with SQL drivers ..............:" but lists no drivers > > afterwards. I tried compiling it anyway but it logs the error " > > auth(default): Unknown database driver 'pgsql' " so the it defiantly > > didn't get compiled in. My pgsql includes and libs are in a non > > standard location but I specified that in the CPPFLAGS and LDFLAGS > > before the ./configure invocation. What have I done wrong here, or is > > there a bug in the script? > > > > The whole invocation is: > > CPPFLAGS='-I/usr/local/openssl-0.9.8b/include > > -I/usr/local/pgsql-8.1.4/include' > > LDFLAGS='-L/usr/local/openssl-0.9.8b/lib -L/usr/local/pgsql-8.1.4/lib' > > ./configure --prefix=/usr/local/dovecot-1.0b8 > > --sysconfdir=/etc/dovecot --localstatedir=/var --with-ioloop=eooll > > --with-notify=dnotify --without-pop3d --with-storages=maildir > > --with-sql --with-pgsql --with-gnu-ld > > what does config.log say? and does it report any problems with > finding openssl? > > the problem may be that the shared libraries can't be found at > runtime, in which case you will need to set the rpath in the binaries > that are built. you didn't mention which platform/compiler you're > using, but this is done using the -Wl,-R<directory> argument for gcc > and Sun Studio compiler/Solaris ld, at least (-Wl passes the next > argument to the linker, -R tells the linker to include this path in the > binary's rpath). > > grant. I looked at the config.log file and it doesn't look like it's having any problems with openssl, but when I looked for pgsql I got what looked like some errors. configure:29296: checking for PQconnectdb in -lpq | char PQconnectdb (); | PQconnectdb (); ac_cv_lib_pq_PQconnectdb=no /usr/local/pgsql-8.1.4/lib/libpq.so: undefined reference to `dlerror' /usr/local/pgsql-8.1.4/lib/libpq.so: undefined reference to `dlclose' /usr/local/pgsql-8.1.4/lib/libpq.so: undefined reference to `dlopen' /usr/local/pgsql-8.1.4/lib/libpq.so: undefined reference to `dlsym'

2 1