- dovecot - dovecot.org

[Dovecot] Re: Apple Mail and too many open files?
by Roger Weeks 24 May '06

24 May '06

> Date: Wed, 24 May 2006 19:55:41 +1000 > From: Rob Middleton <robm-dovecot(a)centenary.org.au> > Subject: Re: [Dovecot] Apple Mail and too many open files? > To: Alan Schmitt <alan.schmitt(a)polytechnique.org> > Cc: Dovecot List Mailing <dovecot(a)dovecot.org> > > OS X is configured by default with these numbers way too low. OS X has > some really dumb processes like AFP that will chew through all of your > open files and not cope cleanly with running out of allowable/ > available > filehandles. If you're running filesharing of ANY kind on your mail server, you should stop it. Mail servers should run mail, not run AFP and Samba and other things. > OS X has a DoS vulnerability in the way ssh processes are spawned and > the ssh interaction with their PAM modules (it exhibits with the > symptoms you have described). Have you really got port 22 blocked from > the outside world?? Have you tested that? Consider running ssh on an > alternate port if running OS X server (as Apple's GUI config tools for > the firewall don't always allow you to block port 22). This is a very simple problem to fix, and doesn't require blocking port 22. Set up /etc/hosts.allow: sshd : 192.169.1.0/255.255.255.0 sshd-keygen-wrapper : 192.168.1.0/255.255.255.0 Set up /etc/hosts.deny: ALL: ALL:deny Tcpwrappers will now take care of you, and any DOS attacks you get will simply be dropped. > Do consider running your mail services off a machine that is not a Mac > OS X server. OS X server is merely OS X client/workstation with a > pretty > management utility for some 'nix services. It is not stable under high > load -- and it is not even stable under moderate load without numerous > performance tweaks (it doesn't cope at all well if the disk queue goes > up a touch or loadavg is at all interesting - ie it degrades poorly > under load). While some of this statement may be accurate, there's a lot of FUD here too. Both OS X and OS X server use the same kernel, it is true. However, these operating systems are fast and reliable. We ran our mail server for a couple of years on OS X with exim and courier-imap, and the only reason we did stop and move to Linux is because we needed a bigger solution and intel-based hardware was cheaper than a bunch of XServes. And I will challenge your statement about high load. We have two web servers that average betwen 5 and 10 mbits of constant web load, running on OS X Server and XServes. The average load on these boxes is something like 0.20. Roger Weeks

2 1

Fwd: Re[4]: [Dovecot] dovecot can't start!
by Oleg D. 24 May '06

24 May '06

Hello Chris, Wednesday, May 24, 2006, 8:36:00 PM, you wrote: CH> Quoting "Oleg D." <dzoleg(a)rsute.ru>: >> MB> Hmmm... I was seeing a problem rather like this with 1.0beta8 >> under Solaris >> MB> with Sun's compiler: only it was with the IMAP protocol rather than POP. >> >> MB> The problem there was an assumption Tio had made that everyone >> was using a >> MB> C99-compatible compiler. Apparently this handles some aspects of >> variable >> MB> initialisation differently from earlier C compilers. >> >> MB> In my case adding a command-line option to the C compiler to flip it into >> MB> C99 mode seemed to solve the problem. The option for our compiler was >> MB> "-xc99" -- however if your compiler has such an option it may have a >> MB> different name. If you check the manual page for your C compiler you may >> MB> find an equivalent option to try. >> >> MB> However another solution was provided by Timo in the form of a >> simple patch >> MB> that made changes to a couple of source files. I hope Timo doesn't mind: >> MB> I'm re-sending his patch as an attachment to this message as it is tiny. >> MB> You could try applying it and rebuilding Dovecot. >> >> MB> Cheers, >> MB> Mike Brudenell >> >> But I use FreeBSD 4.11-RELEASE-p15 with native compiler. >> Really nobody has this problem on freebsd? >> >> And the main - Why I can't start dovecot without SSL :) >> Why I see in log "pop3-login: BUG: SSL initialization parameters not >> given while they should have been" >> even if I have "ssl_disable = yes" in dovecot.conf >> 1.0b3 works fine. >> This problem is main for me >> because I don't want to use SSL. CH> I run FreeBSD here, and my hunch is that SSL (or some form) was CH> compiled it. Which would help explain the errors you describe. CH> What "knobs" did you use when you built it? Did you simply take CH> the default without examining the Makefile? My hunch is that if CH> you take a closer look at how it was built and installed; you'll CH> find some form of SSL/ encryption was built into it, and you'll CH> either have to: cd /usr/ports/mail/dovecot; make deinstall; CH> tweak the Makefile to your needs; make reinstall. Or figure out CH> how to utilize the security method that was built in by default. CH> Perhaps SASL2, or GSSAPI, as I see they're options in the Makefile. CH> Best wishes. I hope this helps. CH> --Chris H. I tried to add --without-ssl in port's Makefile and compile dovecot without ssl. But I have all the same seen "pop3-login: BUG: SSL initialization parameters not given while they should have been" When I have set "ssl_disable = no" I saw another error: "Error: SSL support not compiled in but ssl_disable=no" WITHOUT_KQUEUE=true WITHOUT_SASL2=true WITHOUT_GSSAPI=true WITHOUT_VPOPMAIL=true WITHOUT_LDAP=true WITHOUT_PGSQL=true WITH_MYSQL=true WITHOUT_SQLITE=true only mysql is enable -- Best regards, Oleg mailto:dzoleg@rsute.ru

1 0

Re[2]: Fwd: Re[2]: [Dovecot] dovecot can't start!
by Oleg D. 24 May '06

24 May '06

Hello Chris, Tuesday, May 23, 2006, 2:13:24 PM, you wrote: CW> Oleg D. wrote: >> >> >> BTW >> If I have enable SSL and set "protocols = pop3s" only >> I see "Fatal: Protocol pop3s given more than once" >> >> CW> That's odd. It looks like it's deducing you want POP3 from somewhere CW> else. Can you send us your dovecot.conf file, or output of "dovecot -n"? CW> Chris I set "protocols = pop3s" for testing vpn# dovecot -n protocols: pop3s disable_plaintext_auth: no verbose_ssl: yes login_dir: /var/run/dovecot/login login_executable: /usr/local/libexec/dovecot/pop3-login login_process_size: 64 verbose_proctitle: yes first_valid_gid: 0 mail_extra_groups: mail default_mail_env: mbox:/var/mail/%u mail_executable: /usr/local/libexec/dovecot/pop3 mail_plugin_dir: /usr/local/lib/dovecot/pop3 pop3_uidl_format: %08Xu%08Xv pop3_client_workarounds: outlook-no-nuls oe-ns-eoh auth default: mechanisms: plain login digest-md5 cram-md5 apop default_realm: xxxxx.xx verbose: yes debug: yes debug_passwords: yes passdb: driver: pam passdb: driver: sql args: /usr/local/etc/dovecot-sql.conf userdb: driver: passwd userdb: driver: sql args: /usr/local/etc/dovecot-sql.conf But I see "Fatal: Protocol pop3s given more than once" -- Best regards, Oleg mailto:dzoleg@rsute.ru

2 2

[Dovecot] Busy, again
by Timo Sirainen 24 May '06

24 May '06

Just a note to people if you're wondering why I'm not replying to most of my mails: I'm trying to get into university to start stydying cellular biology (so I'm applying to biochemistry and biotechnology). Their entrance exams are next wednesday, so I'm trying to use most of my time left to study for them (and also do some work..). I don't know much about the subject, so I really need to study for them. :) Then again, if I don't pass, my fallback plan is to go in via computer science and try again next year. Hopefully they allow taking the same bio-classes even if it's not my major.

7 10

[Dovecot] Two INBOX locations
by arilinux 24 May '06

24 May '06

Hello I'm running dovecot v1.0.beta3 on a fedora 4 machine. I have two kinds of clients: - first use IMAP and receive their mails (maildir) in /home/%u/mail - second use POP and receive their mails (mbox) in /var/mail/%u Problem is when I want to provide an access for second with squirrelmail which use IMAP, as the INBOX is in /var/mail/%u and IMAP settings tell that INBOX is in /home/%u/mail, they can't view their emails. Is there a way to tell to dovecot to search IMAP mails both in /home/%u/mail and in /var/mail/%u Thanks > Emmanuel RIZZI > ERILOG > 103 rue Beaupoil > 39210 DOMBLANS > Tel: 03 84 44 66 66 > Fax: 03 84 44 62 00 > > >

2 1

Fwd: Re[2]: [Dovecot] dovecot can't start!
by Oleg D. 24 May '06

24 May '06

Hello Chris, Tuesday, May 23, 2006, 1:13:17 PM, you wrote: CW> Oleg D. wrote: >> Hello HenkJan, >> >> >> Tuesday, May 23, 2006, 11:30:37 AM, you wrote: >> >> >> >>>do you have "disable_plaintext_auth = no" in dovecot.conf? >> >> Yes. >> >> >>>"auth_verbose = yes" and "auth_debug = yes" in dovecot.conf for more logging >> >> Yes. >> >> >>>what happens if you telnet to your dovecotserver? >> >> I have already tried it many times. >> >> And I don't see any prompt. >> >> >> In log: >> >> "dovecot: Dovecot v1.0.beta8 starting up >> >> dovecot: Generating Diffie-Hellman parameters for the first time. This may take >> a while.. >> >> dovecot: auth-worker(default): mysql: Connected to /tmp/mysql.sock (mail)" >> >> >> after telnet: >> >> "dovecot: pop3-login: Waiting for SSL parameter file ssl-parameters.dat" >> >> and nothing else >> >> >> I found ssl-parameters.dat.tmp in /var/run/dovecot/login >> >> >> After starting/stopping dovecot several times ssl-parameters.dat is appear in >> /var/run/dovecot/login >> >> But nothing again >> >> >> OK. I try all of this to start dovecot anyway. >> >> But I don't want to use SSL! >> >> >> THE MAIN QUESTION: >> >> Why I see "pop3-login: BUG: SSL initialization parameters not given while they >> should have been" >> >> even if I have "ssl_disable = yes" in dovecot.conf >> >> >> 1.0b3 works fine. >> >> >> -- >> >> Best regards, >> >> Oleg mailto:dzoleg@rsute.ru >> CW> What do you have as your "protocols" line? Make sure there's no "imaps" CW> or "pop3s". Also, make sure you don't have any "ssl_listen" options set. CW> Also, do you ever get the "SSL parameters regeneration completed" line CW> in your log file (it can take several minutes on a slow machine)? If CW> it's decided (however wrongly) to do the SSL paramters generation, you CW> won't be able to login until it's finished. CW> Chris "protocols = pop3" only >"ssl_listen" options set dont't set. BTW If I have enable SSL and set "protocols = pop3s" only I see "Fatal: Protocol pop3s given more than once" -- Best regards, Oleg mailto:dzoleg@rsute.ru

2 1

[Dovecot] Thunderbird 1.5 and messages with no Date: header
by grant beattie 24 May '06

24 May '06

hi, some of my Thunderbird users have a minor but annoying problem with messages that have no Date: header. these clients use BODY[HEADER.FIELDS (Date)] as the date for messages. when a message has no Date: header, they display the date as 01/01/1970 10:00:00 because Dovecot returns empty string. would it be possible for Dovecot to return INTERNALDATE instead, for messages that contain no Date: header? I know this is not *technically* correct, but it's a reasonable best-guess, and better than returning nothing. perhaps as a client-workaround? I vaguely recalled a previous message about this, but I couldn't find it today. grant.

6 10

[Dovecot] Shared folder (namespace) access hanging
by Jeff Turner 24 May '06

24 May '06

Hi, I'm using Dovecot 1.0-b8. We use a shared 'support' account for incoming support mail. For security reasons we want to instead have everyone with their own account, accessing a shared 'support' folder. So I've configured dovecot with a public 'Support' namespace: default_mail_env = maildir:/imap/mailboxes/%u namespace private { separator = / prefix = inbox = yes } namespace public { separator = / location = maildir:/imap/mailboxes/support:CONTROL=/imap/mailboxes/%u/shared-settings/support/control prefix = Support/ hidden = no } So now: - User 'support' logs in (this is the user whose folder is being shared). Dovecot creates a dovecot-uidlist file: root@redback:/imap/mailboxes/support/.INBOX.test# cat dovecot-uidlist 1 1147757548 9 1 1147755677.P8078Q3M183587.redback.sydney.atlassian.com:2,RSace 2 1147755677.P8078Q2M183587.redback.sydney.atlassian.com:2,abcdf 3 1147755677.P8078Q1M183587.redback.sydney.atlassian.com:2,Sabcd 4 1147756077.P8078Q8.redback.sydney.atlassian.com:2,Sabcd 5 1147756440.P8461Q3M643698.redback.sydney.atlassian.com:2,Sa 6 1147756440.P8461Q2M643698.redback.sydney.atlassian.com:2,Sa 7 1147756440.P8461Q1M643698.redback.sydney.atlassian.com:2,Sa 8 1147756440.P8461Q0M643698.redback.sydney.atlassian.com:2,Sa root@redback:/imap/mailboxes/support/.INBOX.test# ls -la total 60 drwxrwx--- 5 jturner mail 4096 May 16 15:32 . drwxrwxrwx 59 support mail 4096 May 16 15:31 .. drwxrwx--- 2 jturner mail 4096 May 16 15:18 cur -rw-rw-rw- 1 support mail 448 May 16 15:32 dovecot.index -rw-rw-rw- 1 support mail 21504 May 16 15:32 dovecot.index.cache -rw-rw-rw- 1 support mail 512 May 16 15:32 dovecot.index.log -rw------- 1 support mail 72 May 16 15:28 dovecot-keywords -rw-rw-rw- 1 jturner mail 0 May 16 14:52 dovecot-shared -rw-rw-rw- 1 support mail 516 May 16 15:32 dovecot-uidlist drwxrwx--- 2 jturner mail 4096 May 16 15:01 new drwxrwx--- 2 jturner mail 4096 May 16 15:14 tmp root@redback:/imap/mailboxes/support/.INBOX.test# - If I now log in as 'jturner' and subscribe to this folder, there appears to be nothing in the 'test' folder. On disk, the folder subscription is registered but the test folder's CONTROL directory is empty: # ls /imap/mailboxes/jturner/shared-settings/support/control/ subscriptions # cat /imap/mailboxes/jturner/shared-settings/support/control/subscriptions INBOX.test # ls /imap/mailboxes/jturner/shared-settings/support/control/.INBOX.test/ # Restarting dovecot and Thunderbird makes no difference. However, if I delete dovecot.index and dovecot.index.log from /imap/mailboxes/support/.INBOX.test/, then suddenly it works. User 'jturner' can view the folder contents, and a uidlist file for them appears: # cat /imap/mailboxes/jturner/shared-settings/support/control/.INBOX.test/dovecot-uidlist 1 1147758095 9 1 1147755677.P8078Q3M183587.redback.sydney.atlassian.com:2,RSace 2 1147755677.P8078Q2M183587.redback.sydney.atlassian.com:2,abcdf 3 1147755677.P8078Q1M183587.redback.sydney.atlassian.com:2,Sabcd 4 1147756077.P8078Q8.redback.sydney.atlassian.com:2,Sabcd 5 1147756440.P8461Q3M643698.redback.sydney.atlassian.com:2,Sa 6 1147756440.P8461Q2M643698.redback.sydney.atlassian.com:2,Sa 7 1147756440.P8461Q1M643698.redback.sydney.atlassian.com:2,Sa 8 1147756440.P8461Q0M643698.redback.sydney.atlassian.com:2,Sa Although the contents is the same (1-8), the UIDVALIDITY at the top is different to that for the 'support' user: # head -1 /imap/mailboxes/jturner/shared-settings/support/control/.INBOX.test/dovecot-uidlist 1 1147758095 9 # head -1 /imap/mailboxes/support/.INBOX.test/dovecot-uidlist 1 1147757548 9 and now if I log back in as 'support' and access the folder, dovecot complains: dovecot: May 16 15:47:05 Error: IMAP(support): Corrupted index cache file /imap/mailboxes/support/.INBOX.test/dovecot.index.cache: indexid changed Switching back and forth results in various errors: dovecot: May 16 15:48:04 Error: IMAP(support): Corrupted transaction log file /imap/mailboxes/support/.INBOX.test/dovecot.index.log: end_offset (656) > current sync_offset (512) dovecot: May 16 15:48:04 Error: IMAP(support): Corrupted transaction log file /imap/mailboxes/support/.INBOX.test/dovecot.index.log: invalid indexid (1147758095 != 1147757548) dovecot: May 16 15:48:04 Error: IMAP(support): Corrupted transaction log file /imap/mailboxes/support/.INBOX.test/dovecot.index.log: invalid new transaction log sequence (2 >= 2) dovecot: May 16 15:48:04 Error: IMAP(support): Lost transaction log file /imap/mailboxes/support/.INBOX.test/dovecot.index.log seq 1 ------------------------------ In the wild, I've seen frequent occurrences of this error, where dovecot seems to switch between the UIDVALIDITY of 'support' and a user's dovecot-uidlists: dovecot: May 16 13:56:28 Error: IMAP(jturner): Maildir /imap/mailboxes/support/.INBOX sync: UIDVALIDITY changed (1147751603 -> 1147686345) and here's it toggling back from 'support' to jturner's dovecot-uidlist uidvalidity: dovecot: May 16 14:16:04 Error: IMAP(support): Maildir /imap/mailboxes/support/.INBOX sync: UIDVALIDITY changed (1147752716 -> 1147751603) I've also seen plenty of processes being killed, seemingly at random, about 3 or 4 a minute: # cat /usr/local/logs/dovecot | grep killed.wit ... dovecot: May 16 12:00:16 Error: child 32706 (imap) killed with signal 6 dovecot: May 16 12:00:16 Error: child 32649 (imap) killed with signal 14 dovecot: May 16 12:00:45 Error: child 32412 (imap) killed with signal 6 dovecot: May 16 12:01:02 Error: child 32702 (imap) killed with signal 6 dovecot: May 16 12:01:02 Error: child 368 (imap) killed with signal 6 dovecot: May 16 12:01:02 Error: child 357 (imap) killed with signal 6 dovecot: May 16 12:01:16 Error: child 383 (imap) killed with signal 6 dovecot: May 16 12:02:26 Error: child 32297 (imap) killed with signal 6 ... So I'm confused. Am I doing something stupid? Why is there a common .cache file (it doesn't get created in the CONTROL dir), but not a common dovecot-uidlists? Is anyone actually *using* shared folders? :) Thanks, Jeff

2 2

[Dovecot] IMAP Folder Creation
by Zach Hobbs 23 May '06

23 May '06

I am using Maildir with dovecot 0.99.14-1 and postfix. My IMAP server was working where I could create a folder in Kmail or Thunderbird and specify wether the folder was to hold messages or folders. Then something changed, and I lost all my folders that contained sub-folders. And now I cannot create folders that contain subfolders (Kmail doesn't event give the option anymore). I can create folders and put messages in them, but I cannot create subfolders in the newly created folders. The Maildir is owned by the user logging in. Do I need to do anything with permissions, or are there settings to allow/disallow this? I've been reading through everything I could find with dovecot and folders in the message, and I can't come up with anything. Here's an example file structure (logging in as "zta-tech_zach"): Maildir# ls -lA -R .: total 32 drwx------ 2 zta-tech_zach web1 4096 2006-05-22 21:41 cur -rw------- 1 zta-tech_zach web1 5 2006-05-22 21:16 .customflags -rw------- 1 zta-tech_zach web1 52 2006-05-22 21:40 dovecot-uidlist drwx------ 2 zta-tech_zach web1 4096 2006-05-22 21:16 .INBOX drwx------ 2 zta-tech_zach web1 4096 2006-05-22 21:40 new -rw------- 1 zta-tech_zach web1 6 2006-05-22 21:41 .subscriptions drwx------ 2 zta-tech_zach web1 4096 2006-05-22 21:40 tmp drwx------ 5 zta-tech_zach web1 4096 2006-05-22 21:25 .Trash ./cur: total 20 -rw------- 1 zta-tech_zach web1 16591 2006-05-22 21:40 1148352021.3157_1.www.zta-tech.com:2,S ./.INBOX: total 24 -rw------- 1 zta-tech_zach web1 1608 2006-05-22 21:41 .imap.index -rw------- 1 zta-tech_zach web1 10264 2006-05-22 21:16 .imap.index.data -rw------- 1 zta-tech_zach web1 2576 2006-05-22 21:16 .imap.index.log -rw------- 1 zta-tech_zach web1 1560 2006-05-22 21:16 .imap.index.tree ./new: total 0 ./tmp: total 0 ./.Trash: total 40 drwx------ 2 zta-tech_zach web1 4096 2006-05-22 21:24 cur -rw------- 1 zta-tech_zach web1 5 2006-05-22 21:25 .customflags -rw------- 1 zta-tech_zach web1 1608 2006-05-22 21:24 .imap.index -rw------- 1 zta-tech_zach web1 10264 2006-05-22 21:25 .imap.index.data -rw------- 1 zta-tech_zach web1 2576 2006-05-22 21:25 .imap.index.log -rw------- 1 zta-tech_zach web1 1560 2006-05-22 21:25 .imap.index.tree drwx------ 2 zta-tech_zach web1 4096 2006-05-22 21:24 new drwx------ 2 zta-tech_zach web1 4096 2006-05-22 21:24 tmp ./.Trash/cur: total 0 ./.Trash/new: total 0 ./.Trash/tmp: total 0 Thanks, Zach

1 1

Fwd: Re[2]: [Dovecot] dovecot can't start!
by Oleg D. 23 May '06

23 May '06

CW> Also, do you ever get the "SSL parameters regeneration completed" line CW> in your log file (it can take several minutes on a slow machine)? If CW> it's decided (however wrongly) to do the SSL paramters generation, you CW> won't be able to login until it's finished. CW> Chris After enable SSL and start dovecot after 2 munutes I see in log: May 23 13:28:43 vpn dovecot: Dovecot v1.0.beta8 starting up May 23 13:28:43 vpn dovecot: Generating Diffie-Hellman parameters for the first time. This may take a while.. May 23 13:28:45 vpn dovecot: auth-worker(default): mysql: Connected to /tmp/mysql.sock (mail) May 23 13:30:48 vpn dovecot: ssl-build-param: SSL parameters regeneration completed after telnet I don't see any prompt and then I see in log: May 23 13:31:55 vpn dovecot: pop3-login: Disconnected: Inactivity: rip=xx.xx.xx.xx, lip=xx.xx.xx.xx, TLS May 23 13:32:08 vpn dovecot: pop3-login: SSL_accept() syscall failed: EOF [xx.xx.xx.xx] -- Best regards, Oleg mailto:dzoleg@rsute.ru

1 0