- dovecot - dovecot.org

[Dovecot] Authentication by certificats (a bug or my misconfiguration)
by Michal Soltys 11 Jul '06

11 Jul '06

Today I've been trying to get dovecot (1.0 rc2) to use certificates for client side authentication. If my memory serves right, beta8 had no problems with it (although it was some time ago and on different machine). Similar setup works perfectly well for postfix (for authentication that is, on the same machine). Originally I thought I overdid some certificate settings (keyUsage, nsCertType, etc.), so for the sake of testing I've simplified the setup to bare minimum - 1 simple selfsigned root certificate, another 1 for dovecot, and the last one for the user. Unfortunately, the results were the same. Configuration: OpenBSD 3.9 (stable branch), i386, no nfs or afs (only local ffs) standard OpenSSL 0.9.7g (+ patches) dovecot 1.0 rc2, compiled from sources, with sysconfdir set to /etc and with disabled pam Tested with the most recent opera and mozilla thunderbird, using pop3s. (note: both clients work with postfix, authetnicating only by certificates). They do send requested certificates. Important dovecot configuration: ssl_cert_file = /etc/ssl/ca_ppgk/certs/pop3_crt.pem (common name - pop3.ppgk.com.pl, valid dns name) ssl_key_file = /etc/ssl/ca_ppgk/private/pop3_key.pem ssl_ca_file = /etc/ssl/ca_ppgk/ca_crt.pem ssl_verify_client_cert = yes verbose_ssl = yes auth_verbose = yes ssl_require_client_cert = yes ssl_username_from_cert = (tested both with yes and no, with common name of user certificate set both as username@domain or as bare username) The rest is just pretty standard, using passwd for both user auth and userdb, with plain and login mechanisms allowed. I tested "few" sets of certificates (for ca, server and user) with configurations ranging from quite specific ones (with basicConstraints, nsCertType, keyUsage, extendedKeyUsage fields set) to very simple ones (basicConstraints + typical stuff like subjectKeyIdentifier). All of them gave the same results with dovecot (postfix didn't complain with any of them either). This is what I get in logs, when trying to pull mail using opera or mozilla: Jul 7 14:33:47 ppgk-wa dovecot: Dovecot v1.0.rc2 starting up Jul 7 14:33:57 ppgk-wa dovecot: pop3-login: Invalid certificate: /C=PL/ST=Mazowieckie/L=Warszawa/O=PPGK/OU=Z10/CN=adminms@ppgk.com.pl/emailAddress=adminms@ppgk.com.pl Jul 7 14:33:57 ppgk-wa dovecot: pop3-login: Invalid certificate: /C=PL/ST=Mazowieckie/L=Warszawa/O=PPGK/OU=Z10/CN=RootCA/emailAddress=admin(a)ppgk.com.pl Jul 7 14:33:57 ppgk-wa dovecot: pop3-login: Valid certificate: /C=PL/ST=Mazowieckie/L=Warszawa/O=PPGK/OU=Z10/CN=RootCA/emailAddress=admin(a)ppgk.com.pl Jul 7 14:33:57 ppgk-wa dovecot: pop3-login: Valid certificate: /C=PL/ST=Mazowieckie/L=Warszawa/O=PPGK/OU=Z10/CN=adminms@ppgk.com.pl/emailAddress=adminms@ppgk.com.pl Jul 7 14:34:05 ppgk-wa dovecot: auth(default): client in: AUTH 1 PLAIN service=POP3 secured lip=192.168.100.77 rip=192.168.100.75 resp=<hidden> Jul 7 14:34:05 ppgk-wa dovecot: auth(default): PLAIN(?,192.168.100.75): Client didn't present valid SSL certificate Jul 7 14:34:05 ppgk-wa dovecot: auth(default): client out: FAIL 1 reason=Client didn't present valid SSL certificate Jul 7 14:34:05 ppgk-wa dovecot: auth(default): client in: AUTH 2 LOGIN service=POP3 secured lip=192.168.100.77 rip=192.168.100.75 resp=<hidden> Jul 7 14:34:05 ppgk-wa dovecot: auth(default): LOGIN(?,192.168.100.75): Client didn't present valid SSL certificate Jul 7 14:34:05 ppgk-wa dovecot: auth(default): client out: FAIL 2 reason=Client didn't present valid SSL certificate Jul 7 14:34:05 ppgk-wa dovecot: auth(default): client in: AUTH 3 PLAIN service=POP3 secured lip=192.168.100.77 rip=192.168.100.75 resp=<hidden> Jul 7 14:34:05 ppgk-wa dovecot: auth(default): PLAIN(?,192.168.100.75): Client didn't present valid SSL certificate Jul 7 14:34:05 ppgk-wa dovecot: auth(default): client out: FAIL 3 reason=Client didn't present valid SSL certificate Jul 7 14:34:07 ppgk-wa dovecot: pop3-login: Disconnected: method=PLAIN, rip=192.168.100.75, lip=192.168.100.77, TLS Those two "Invalid certificate" lines, followed immediately by two "Valid certificate" lines seem suspicious. Is there some configuration detail I might have missed or messed, or is it (probably) a bug ?

3 4

[Dovecot] Group-based filesystem quota
by Scott Alter 11 Jul '06

11 Jul '06

Hello. After using Dovecot for over a year, I have just started experimenting with the filesystem quotas, and I have a suggestion for improvement. On my mail server, I use group-based quotas, and would like to have Dovecot be able to report these quotas. It should be simple to implement, requiring only changes to the quota-fs.c file of the quota plugin. Simply changing USRQUOTA to GRPQUOTA should do the trick. In terms of the configuration file, "quota = fs" could be expanded to something like: quota = fs:storage=group # use filesystem quota with group storage limit Adding in support for message (inode) limits is just as easy, replacing dqb_curblocks with dqb_curinodes and dqb_bsoftlimit with dqb_isoftlimit. It could be easy to configure too, like: quota = fs:storage=group:messages=user # use filesystem quota with group storage limit and user messages limit Although I think I know what would need to be changed, I'm not a C programmer and my code would not be clean nor efficient. Since the messages and storage parameters of the quota setting are defined elsewhere (quota-maildir.c), I don't think it would be too difficult to duplicate this in the quota-fs.c file. Also, I am having the same problem as others with used space off by a factor of 4096, total limit off by a factor of 4. Stian's patch (http://dovecot.org/list/dovecot/2006-June/014159.html) does the trick, but I'm wondering if everyone is having this problem, or just those running Linux. Thanks, Scott

5 9

[Dovecot] Corrupted index & index data file
by james edwards 10 Jul '06

10 Jul '06

We just moved to a new box for POP/IMAP services. I rsynced /home and /var/spool/mail to the new box from the old with the archive switch. It went smoothly but I am seeing more corrupted index & index data file errors in the log than I normally do. I thought I read that Dovecot would rebuild these files after the user accessed them the second time, if corrupt. Is this correct ? Is there a better way to deal with this issue other than deleting them so they are recreated the next time the user checks their mail ? james <jedwards(a)nmcourts.com>

2 4

[Dovecot] PAM Error on POP3s auth? And apop?
by Bruce Lane 10 Jul '06

10 Jul '06

Fellow Dovecot'ers, I've -almost- got Dovecot completely functional, and I will add that it works just fine for non-authenticated POP3. The problem begins when I try to use authentication for same against the system's /etc/passwd section. This is the error message that comes up in /var/log/maillog Jul 9 21:14:10 featherweb dovecot: auth(default): pam(kyrrin(a)bluefeathertech.com,192.168.42.40): pam_start() failed: system error Jul 9 21:14:17 featherweb dovecot: pop3-login: Aborted login: user=<kyrrin(a)bluefeathertech.com>, method=PLAIN, rip=192.168.42.40, lip=192.168.42.130, TLS THE PLATFORM: NetBSD 3.0, Postfix 2.3-RC8 (soon to be replaced by an official release in the coming week), and whatever the current release candidate of Dovecot is. I did some googling for that pam_start error, and discovered (much to my annoyance) that it may be a system bug within NetBSD 3.0. If that's the case, given that I don't have anywhere near the programming skill to even try and correct it, it'll mean I'm pretty much stuck until the NetBSD developers fix it, or until I can figure out an alternate authentication method that won't be an administrative nightmare. Does anyone have any ideas on this? For the benefit of poking and pondering, this is the relevant section of my dovecot.conf file. auth default { # Space separated list of wanted authentication mechanisms: # plain login digest-md5 cram-md5 ntlm rpa apop anonymous gssapi mechanisms = plain login passdb pam { } userdb passwd { } socket listen { client { path = /var/spool/postfix/private/auth mode = 0660 user = postfix group = postfix } } } And this is the contents of the file 'dovecot' in the directory /etc/pam.d # PAM configuration for the "dovecot" subsystem. # # auth auth required pam_nologin.so no_warn auth required pam_unix That entry should, in theory, block all logins if the /etc/nologin file is present, and then hand off to the pam_unix module if it's not. pam_unix, in NetBSD, is the module that authenticates against the /etc/passwd file. As I said, further thoughts would be welcome. If it is a NetBSD system bug causing that pam_auth error, ideas for a simple workaround until the NetBSD crew gets things patched up would also be welcome. Thanks in advance. -=-=-=-=-=-=-=-=-=-=-=- Bruce Lane, Owner & Head Hardware Heavy, Blue Feather Technologies -- http://www.bluefeathertech.com kyrrin (at) bluefeathertech do/t c=o=m "If Salvador Dali had owned a computer, would it have been equipped with surreal ports?"

2 2

[Dovecot] LDAP: bind to LDAP server instead of retreiving a password from it?
by Geert Hendrickx 10 Jul '06

10 Jul '06

Hi, Dovecot currently treats an LDAP user/password database the same way as a text or SQL based database: it just tries to retreive the (hashed) password for a given username. LDAP however has the capability to authenticate the user itself: dovecot could try to bind to LDAP with the given username and password, and if authentication succeeded, the LDAP server returns the other info (uid, homedir, ...), but not the password. I know at least qmail's pop3 server uses LDAP this way. Could this authentication mechanism be implemented in Dovecot as well? Geert

2 2

[Dovecot] Damnitall
by nick 10 Jul '06

10 Jul '06

Today I upgraded to dovecot 1.0 rc1 (before I was using a 1.0 beta, as it had functions no one else had), the beta worked fairly well, no crashes, and the bugs were few and far between. I had a few issues with thunderbird 1.5, so I decided to upgrade. My problem is this, before, I had configured procmail to deliver SPAM to a subdirectory of the users home directory, (not mail/) and everything worked fine, new directories were creatable, and IMP seemed to be happy with everything as it was. With the new version though, dovecot refuses to see the folders in the base of the home directory, and all of this with absolutely no change to my conf file (except for the passdb and userdb options). my dovecot.conf file looks like this: default_mail_env = mbox:/ha/home/%u:INBOX=/ha/mail/%u:INDEX=/ha/home/%u ha is my drbd directory, for high availability. I've tried modifying the private namespaces, but without much luck, and I'm really not looking forward to moving all those folders to under the mail/ directory. Do I have any other options?? thanks, Nick

5 8

[Dovecot] Dovecot and MS Active Directory.
by Sysadmin 10 Jul '06

10 Jul '06

Hello. We are using dovecot right now, but the boss pushes the MS based system (Exchange, Sharepoint, Active Directory etc) to use. However, skipping the other parts I'd like to keep open source based mail server and the question is - can the dovecot authenticate against the MS Active Directory without any problems? -- Sysadmin

2 1

[Dovecot] Oops, forgot about apop...
by Bruce Lane 10 Jul '06

10 Jul '06

How does one go about generating a local password database for apop authentication? Or can it simply run against /etc/passwd, using a PAM entry? (I forgot to append this to my last message... sorry...). Thanks much. -=-=-=-=-=-=-=-=-=-=-=- Bruce Lane, Owner & Head Hardware Heavy, Blue Feather Technologies -- http://www.bluefeathertech.com kyrrin (at) bluefeathertech do/t c=o=m "If Salvador Dali had owned a computer, would it have been equipped with surreal ports?"

2 1

[Dovecot] New User: POP3 issues
by kyrrin＠bluefeathertech.com 10 Jul '06

10 Jul '06

Fellow dovecot'ers, I'm just getting started with Dovecot, and I'm not a programmer, so please be gentle. ;-) THE PLATFORM: NetBSD 3.0/SPARC, Postfix 2.3-RC8, current Dovecot RC (I forgot the number). Maildir-type directories. THE GOAL: To accommodate authenticated (remote) POP3 users with APOP or SSL/TLS, and allow users on the internal network (192.168.x.x) to just use basic POP3 without worrying about authentication. QUESTIONS: (1) Does the dovecot master daemon have to be running in order to call pop3- login from inetd, in response to POP connection attempts? If so, it could be a problem. I'm getting this error when I try to start the thing. featherweb: {339} /usr/local/sbin/dovecot Fatal: listen(110) failed: Address already in use featherweb: {340} (2) For apop authentication, how do I go about generating the shared secret file locally, for each user? Is there a script that came with dovecot or...? (3) Is there a trick, similar to postfix's 'postconf -n,' that will give a condensed output of dovecot's configuration file? (4) I'm currently using sasl auth for Postfix's SMTP auth function. How difficult is it to use Dovecot for the same thing? (5) GAAAAHHHHH! (Just on general principles, based on the hours I've spent trying to get everything working). Thanks in advance. --- Bruce 'Quietly Making Noise' Lane Blue Feather Technologies

3 2

[Dovecot] /var/dovecot /var/spool/mail permissions, setup help (w/ config info)
by Jeff Kowalczyk 08 Jul '06

08 Jul '06

(repost gmane message as list member) I need some help with Dovecot-1.0rc2 on Gentoo Linux. My test harness is one Thunderbird-1.5.0.4 client, storage using legacy mbox directories ported over from an old UW-IMAP/sendmail combo running on RHL 8. Config is intended to be passwd/pam, plaintext login allowed (until I migrate everyone to ssl). After this is working, postfix and dspam are to be added, unless someone can recommend a 'dovecot of smtp' to use. I'll tail the mail.log to illustrate the problem, then excerpt what I think are the relevant directory and config file listings. I'm paying particular attention to file ownership, but am loathe to just chown dovecot things unless I know why. Let me know if you want to see any other config info to help spot the problem. Thanks! # tail -n 30 /var/log/mail.log dovecot: Jul 05 18:35:25 Info: Dovecot v1.0.rc2 starting up dovecot: Jul 05 18:36:10 Info: auth(default): client in: AUTH 1 PLAIN service=IMAP lip=123.456.789.012 rip=098.765.432.109 dovecot: Jul 05 18:36:10 Info: auth(default): client out: CONT 1 dovecot: Jul 05 18:36:10 Info: auth(default): client in: CONT 1 AGplZmYua293YWxjenlrAHdvcmRwYXNzMQ== dovecot: Jul 05 18:36:10 Info: auth(default): client out: OK 1 user=namefirst.namelast dovecot: Jul 05 18:36:10 Info: auth(default): master in: REQUEST 1 25692 1 dovecot: Jul 05 18:36:10 Info: auth(default): master out: USER 1 namefirst.namelast system_user=namefirst.namelast uid=501 gid=12 home=/home/namefirst.namelast dovecot: Jul 05 18:36:10 Error: stat(/var/dovecot/namefirst.namelast) failed: No such file or directory dovecot: Jul 05 18:36:10 Info: IMAP(namefirst.namelast): Effective uid=501, gid=12 dovecot: Jul 05 18:36:10 Info: IMAP(namefirst.namelast): mbox: data=/var/spool/mail/namefirst.namelast:INDEX=/var/dovecot/namefirst.namelast dovecot: Jul 05 18:36:10 Info: IMAP(namefirst.namelast): mbox: INBOX defaulted to /var/spool/mail/namefirst.namelast/inbox dovecot: Jul 05 18:36:10 Info: IMAP(namefirst.namelast): mbox: root=/var/spool/mail/namefirst.namelast, index=/var/dovecot/namefirst.namelast, inbox=/var/spool/mail/namefirst.namelast/inbox dovecot: Jul 05 18:36:10 Info: imap-login: Login: user=<namefirst.namelast>, method=plain, rip=098.765.432.109, lip=123.456.789.012 dovecot: Jul 05 18:36:10 Error: IMAP(namefirst.namelast): open() failed with subscription file /var/spool/mail/namefirst.namelast/.subscriptions: Not a directory dovecot: Jul 05 18:36:12 Error: IMAP(namefirst.namelast): open(/var/spool/mail/namefirst.namelast/inbox, O_CREAT) failed: Not a directory dovecot: Jul 05 18:36:12 Error: IMAP(namefirst.namelast): mkdir_parents(/var/dovecot/namefirst.namelast/.imap/INBOX) failed: Permission denied dovecot: Jul 05 18:36:14 Info: IMAP(namefirst.namelast): Disconnected: Logged out # ls -al /var/spool/mail drwxrwxr-x 2 root mail 1472 Jul 2 19:20 . drwxr-xr-x 6 root root 168 Jul 3 14:19 .. -rw-r--r-- 1 root root 0 Jun 27 18:46 .keep -rw------- 1 namefirst.namelast mail 36243879 Jul 1 17:52 namefirst.namelast (...) # ls -al /var/dovecot/ total 0 drwxr-xr-x 2 root root 72 Jul 5 10:30 . drwxr-xr-x 14 root root 360 Jun 29 09:45 .. -rw-r--r-- 1 root root 0 Jul 5 10:30 .keep # ls -al /var/run/dovecot/ total 5 drwxr-xr-x 3 root root 176 Jul 5 18:35 . drwxr-xr-x 9 root root 504 Jul 3 14:45 .. srw------- 1 root root 0 Jul 5 18:35 auth-worker.25687 srwxrwxrwx 1 root root 0 Jul 5 18:35 dict-server drwxr-x--- 2 root dovecot 136 Jul 5 18:35 login -rw------- 1 root root 6 Jul 5 18:35 master.pid # ls -al /home/namefirst.namelast/ total 17791 drwxr-xr-x 2 namefirst.namelast mail 248 Jul 5 18:29 . drwxr-xr-x 76 root root 2512 Jul 2 20:21 .. -rw------- 1 namefirst.namelast mail 3293785 Sep 23 2005 Sent # grep dovecot /etc/group dovecot:x:97: # grep dovecot /etc/passwd dovecot:x:97:97:added by portage for dovecot:/dev/null:/usr/sbin/nologin # grep mail /etc/passwd mail:x:8:12:mail:/var/spool/mail:/bin/false postmaster:x:14:12:postmaster:/var/spool/mail:/bin/false # grep mail /etc/group mail::12:mail # grep namefirst.namelast /etc/passwd namefirst.namelast:x:501:12:First Last:/home/namefirst.namelast:/bin/bash # cat /etc/pam.d/dovecot auth required pam_unix.so account required pam_unix.so # cat /etc/dovecot.conf base_dir = /var/run/dovecot/ protocols = imap imaps pop3 pop3s listen = * shutdown_clients = yes log_path = /var/log/mail.log info_log_path = /var/log/mail.log log_timestamp = "%b %d %H:%M:%S " syslog_facility = mail disable_plaintext_auth = no ssl_disable = no ssl_cert_file = /etc/ssl/certs/dovecot.pem ssl_key_file = /etc/ssl/private/dovecot.pem login_chroot = yes login_user = dovecot default_mail_env = mbox:/var/spool/mail/%u:INDEX=/var/dovecot/%u mail_extra_groups = mail mail_debug = yes protocol pop3 { pop3_uidl_format = %08Xu%08Xv } auth_verbose = yes auth_debug = yes auth_debug_passwords = yes auth default { mechanisms = plain login passdb pam { args = dovecot } userdb passwd { } user = root } __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

2 3