- dovecot - dovecot.org

Proxy GSSAPI + PLAIN authentication
by Sam 30 Nov '19

30 Nov '19

Hi, I try to configure a proxy accepting GSSAPI and PLAIN authentication. When authenticating with Kerberos, Dovecot uses master user and password to authenticate to backends (backends can be Cyrus or Exchange servers too) When authenticating with PLAIN passwords, Dovecot sends user's login and password to the backend. For GSSAPI, I use extrafields : k5principals=principal@REALM proxy=Y pass=masterpassword login_user=principal user=masteruser host=backend For PLAIN, I use a static driver : passdb { driver = static args = proxy=y host=cyrus password=%w } I can authenticate fine with Kerberos tickets and login/password on the backend. Trouble is that if I authenticate with PLAIN login/password, with a user known from the passdb lookup made for GSSAPI, I can authenticate with any password, it is not checked. The passdb with masteruser and nopassword=y is checked. I can't restrict the passdb with the k5principals extrafield. I tried static and ldap drivers, with the same wrong behaviour. pass_attrs = \ =proxy=Y, \ =nopassword=Y, \ =pass=masterpassword, \ =login_user=%{ldap:uid}, \ =user=masteruser, \ =host=backend, \ =k5principals=%{ldap:uid}@REALM With the ldap driver, I've got auth_bind = no The user is found in the ldap, and Dovecot logs him with the masterpassword. If I don't configure an ldap passdb, but a userdb only, the proxy try passdb that comes after for PLAIN logins. With a passwd-file driver, the k5principals works fine. The user isn't found if it authenticates with PLAIN. My question is : is it possible to restrict a ldap or static passdb for GSSAPI mechanism only ? Thanks for your help, Regards, Sam

2 2

ESEARCH is announced but it doesn't work
by Jesus Cea 29 Nov '19

29 Nov '19

I am using Dovecot 2.3.4. I could upgrade if necessary. I see this capabilities after login in: """ a OK [CAPABILITY IMAP4rev1 SASL-IR LOGIN-REFERRALS ID ENABLE IDLE SORT SORT=DISPLAY THREAD=REFERENCES THREAD=REFS THREAD=ORDEREDSUBJECT MULTIAPPEND URL-PARTIAL CATENATE UNSELECT CHILDREN NAMESPACE UIDPLUS LIST-EXTENDED I18NLEVEL=1 CONDSTORE QRESYNC ESEARCH ESORT SEARCHRES WITHIN CONTEXT=SEARCH LIST-STATUS BINARY MOVE SNIPPET=FUZZY LITERAL+ NOTIFY SPECIAL-USE] Logged in """ ESEARCH (RFC 7377) seems to be available, but the command is not recognized: """ tag1 ESEARCH IN (mailboxes "folder1" subtree "folder2") unseen tag1 BAD Error in IMAP command ESEARCH: Unknown command (0.001 + 0.000 secs). """ What am I doing wrong? Thanks for your time and expertise. -- Jesús Cea Avión _/_/ _/_/_/ _/_/_/ jcea(a)jcea.es - http://www.jcea.es/ _/_/ _/_/ _/_/ _/_/ _/_/ Twitter: @jcea _/_/ _/_/ _/_/_/_/_/ jabber / xmpp:jcea@jabber.org _/_/ _/_/ _/_/ _/_/ _/_/ "Things are not so easy" _/_/ _/_/ _/_/ _/_/ _/_/ _/_/ "My name is Dump, Core Dump" _/_/_/ _/_/_/ _/_/ _/_/ "El amor es poner tu felicidad en la felicidad de otro" - Leibniz

2 2

sendmail -> lmtp 501 5.6.0 Data format error
by Marc Roos 29 Nov '19

29 Nov '19

When changing in a working setup sendmail.mc From this MAILER(smtp)dnl MAILER(procmail)dnl To this FEATURE(`local_lmtp',`[IPC]',`FILE /var/run/dovecot/lmtp')dnl MAILER(local)dnl I am getting these errors '501 5.6.0 Data format error' and ' Unrecognized host name'. What should I change in my lmtp config? Could this be related that messages are being relayed from other servers? lmtp_address_translate = lmtp_hdr_delivery_address = final lmtp_proxy = no lmtp_rcpt_check_quota = no lmtp_save_to_detail_mailbox = no lmtp_user_concurrency_limit = 0

2 3

Using dovecot Replication in a medium to large enterprise.
by Brent Clark 28 Nov '19

28 Nov '19

Good day Guys Just wanted to pick the communities brain and experience(s) for a second. At $CORP where I work. My team has inherited a single server mail solution. We need to look to building a standby / replicated solution. One of the things we were looking at is https://wiki.dovecot.org/Replication We have in excess of +/- 500 mail boxes and using just under 1TB of disk space. That is a lot of small files. Reading about this plugin / module, things that stick out and is concerning is the comments: "The replication in general is a bit resource intensive, so it's not recommended to be used in multi-million user installations." "WARNING: Shared folder replication doesn't work correctly right now –" I would like to ask the community (and anyone else in a similar enterprise) how and if this solution works and scales. In short, I am asking, is anyone else using Dovecot Replication in a medium to large enterprise? Can you please share your experiences, pitfalls and if you have any tips managing mail replication. Kindest regards and thanks in advance. Brent Clark

4 3

IMAP Migration Tools
by Julian Kippels 28 Nov '19

28 Nov '19

Hi, I am looking for tools to migrate Mails from one IMAP-Server to another. Until now I have always used imapsync, but it seems very slow. Even over a 2x10GB/s connection I only get speeds of about 600KiB/s, because the programm always pauses betweeen every single mail. Does anyone here have a suggestion for an alternative? Thanks in advance Julian

6 5

Sendmail + lmtp
by Marc Roos 28 Nov '19

28 Nov '19

Is there any guide like this https://wiki.dovecot.org/HowTo/PostfixDovecotLMTP for configuring sendmail?

1 0

Dovecot auth
by j.emerlik 27 Nov '19

27 Nov '19

Hi, is possible to configure post-login script for Service auth ? I would like to run post script after successful login to postfix (smtp). Regards, Jack

2 1

Dovecot FINs after sending "NO Not showing other users' quota"
by Gene Smith 27 Nov '19

27 Nov '19

When I do imap getquota on a shared folder I see the NO response. That's OK but then often dovecot disconnects (sends FIN) to the client right after this. The client acks the disconnect and creates a new connection and continues on. Should dovecot disconnect after this type of imap "NO" response? -gene

2 1

Performance mdbox vs mbox
by Marc Roos 26 Nov '19

26 Nov '19

If I do the same test[1] with mbox I can store around 31k messages and mdbox 16k messages. I noticed also that cpu and disk utilization with mdbox was not very high, while disk utilization on mbox was much higher. That makes me wonder if I can tune mdbox to have better performance? [1] imaptest - append=100,0 logout=0 host=svr port=143 user=test pass=xxx seed=100 secs=240 clients=1 mbox=64kb.mbox box=inbox/test [2] mail_location = mbox:~/mail:INBOX=/var/spool/mail/%u:CONTROL=~/mail/control:INDEX=/var/d ovecot/%u/index:LAYOUT=maildir++ mail_location = mdbox:~/mdbox:INDEX=/home/popindex/%u/index - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -. F1 Outsourcing Development Sp. z o.o. Poland t: +48 (0)124466845 f: +48 (0)124466843 e: marc(a)f1-outsourcing.eu

2 1

Dovecot Master User: Access user's mailbox without owner's password
by Dav Rdrz 26 Nov '19

26 Nov '19

Hi, I hope you're all right. I describe below the scenario where the problem occurs. I'm trying to activate a master user [1] to be able to access all the boxes of all users by imap. I have configured the dovecot-master-users [2] file with the appropriate permissions. When I try to access, for example with roundcube, through user@mydomain.com*my_master_user@not-exist.com I see in the log, that it seems to ignore the master-user (*) and tries to authenticate the Active Directory but with the master user's password. Then it shows in the log the messages auth: Info: ldap(user(a)mydomain.com,127.0.0.1,<6sFGXE6XLwB/AAAB> ) invalid credentials auth: Debug: client passdb out: FAIL 1 user=user(a)mydomain.com I have other test cases, but I need to validate the master user login that way. I would appreciate any comments you can make and I am waiting to answer any questions. Regards, [1] https://doc.dovecot.org/configuration_manual/authentication/master_users/ [2] https://docs.iredmail.org/dovecot.master.user.html --------------------------------------------------------------------------------------- root@mail-01:/etc/dovecot# cat /etc/issue Ubuntu 14.04.5 LTS \n \l root@mail-01:/etc/dovecot# dpkg -l | grep dovecot | awk {'print $2" "$3'} dovecot-core 1:2.2.9-1ubuntu2.6 dovecot-imapd 1:2.2.9-1ubuntu2.6 dovecot-ldap 1:2.2.9-1ubuntu2.6 dovecot-lmtpd 1:2.2.9-1ubuntu2.6 dovecot-managesieved 1:2.2.9-1ubuntu2.6 dovecot-mysql 1:2.2.9-1ubuntu2.6 dovecot-pop3d 1:2.2.9-1ubuntu2.6 dovecot-sieve 1:2.2.9-1ubuntu2.6 root@mail-01:/etc/dovecot# cat dovecot.conf | grep -v '#' | grep -v -e '^$' | sed "s/REALDOMAIN/mydomain/g" listen = * [::] mail_plugins = quota mailbox_alias acl protocols = pop3 imap sieve lmtp mail_uid = 2000 mail_gid = 2000 first_valid_uid = 2000 last_valid_uid = 2000 log_path = /var/log/dovecot.log auth_verbose = yes auth_debug = yes ssl_protocols = !SSLv2 !SSLv3 ssl = required verbose_ssl = no ssl_ca = </etc/ssl/certs/mydomain.com.ca-bundle ssl_cert = </etc/ssl/certs/mydomain.com.crt ssl_key = </etc/ssl/private/mydomain.com.key ssl_cipher_list = ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:ECDHE-RSA-DES-CBC3-SHA:ECDHE-ECDSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA ssl_dh_parameters_length = 2048 ssl_prefer_server_ciphers = yes disable_plaintext_auth = no mail_location = maildir:%Lh/Maildir/:INDEX=%Lh/Maildir/ auth_default_realm = mydomain.com auth_mechanisms = PLAIN LOGIN service auth { unix_listener /var/spool/postfix/private/dovecot-auth { user = postfix group = postfix mode = 0666 } unix_listener auth-master { user = vmail group = vmail mode = 0666 } unix_listener auth-userdb { user = vmail group = vmail mode = 0660 } } service lmtp { user = vmail process_min_avail = 5 executable = lmtp -L unix_listener /var/spool/postfix/private/dovecot-lmtp { user = postfix group = postfix mode = 0600 } inet_listener lmtp { address = 127.0.0.1 port = 24 } } auth_master_user_separator = * passdb { driver = passwd-file args = /etc/dovecot/dovecot-master-users master = yes } userdb { args = /etc/dovecot/dovecot-ldap.conf driver = ldap } passdb { args = /etc/dovecot/dovecot-ldap.conf driver = ldap } plugin { auth_socket_path = /var/run/dovecot/auth-master quota = dict:user::proxy::quotadict quota_rule = *:storage=3G quota_warning = storage=100%% quota-warning 100 %u quota_warning2 = storage=95%% quota-warning 95 %u quota_warning3 = storage=90%% quota-warning 90 %u quota_warning4 = storage=85%% quota-warning 85 %u quota_grace = 10%% acl = vfile acl_shared_dict = proxy::acl sieve_dir = %Lh/sieve sieve = %Lh/sieve/dovecot.sieve sieve_global_dir = /var/vmail/sieve sieve_before = /var/vmail/sieve/dovecot.sieve mailbox_alias_old = Sent mailbox_alias_new = Sent Messages mailbox_alias_old2 = Sent mailbox_alias_new2 = Sent Items } service quota-warning { executable = script /usr/local/bin/dovecot-quota-warning.sh unix_listener quota-warning { user = vmail group = vmail mode = 0660 } } service dict { unix_listener dict { mode = 0660 user = vmail group = vmail } } dict { quotadict = mysql:/etc/dovecot/dovecot-used-quota.conf acl = mysql:/etc/dovecot/dovecot-share-folder.conf } protocol lda { mail_plugins = $mail_plugins sieve auth_socket_path = /var/run/dovecot/auth-master log_path = /var/log/dovecot-sieve.log lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes postmaster_address = it(a)mydomain.com } protocol lmtp { info_log_path = /var/log/dovecot-lmtp.log mail_plugins = quota sieve postmaster_address = postmaster lmtp_save_to_detail_mailbox = yes recipient_delimiter = + } protocol imap { mail_plugins = $mail_plugins imap_quota imap_acl imap_client_workarounds = tb-extra-mailbox-sep mail_max_userip_connections = 30 } protocol pop3 { mail_plugins = $mail_plugins pop3_client_workarounds = outlook-no-nuls oe-ns-eoh pop3_uidl_format = %08Xu%08Xv mail_max_userip_connections = 30 } service imap-login { service_count = 1 process_limit = 500 } service pop3-login { service_count = 1 } service managesieve-login { inet_listener sieve { address = 127.0.0.1 port = 4190 } } namespace { type = private separator = / prefix = inbox = yes mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Messages" { auto = no special_use = \Sent } mailbox "Sent Items" { auto = no special_use = \Sent } mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Trash { auto = subscribe special_use = \Trash } mailbox "Deleted Messages" { auto = no special_use = \Trash } mailbox Junk { auto = subscribe special_use = \Junk } mailbox Spam { auto = no special_use = \Junk } mailbox "Junk E-mail" { auto = no special_use = \Junk } mailbox Archive { auto = subscribe special_use = \Archive } mailbox Archives { auto = no special_use = \Archive } } namespace { type = shared separator = / prefix = Shared/%%u/ location = maildir:%%Lh/Maildir/:INDEX=%%Lh/Maildir/Shared/%%u subscriptions = yes list = children } root@mail-01:/etc/dovecot# cat dovecot-ldap.conf | sed "s/realdomain/mydomain/g" hosts = active-directory:389 ldap_version = 3 auth_bind = yes dn = domain\vmail dnpass = Str0ngP4ssw0rd base = ou=Organizational Unit,dc=domain,dc=com scope = subtree deref = never user_filter = (&(userPrincipalName=%n@domain.com)(objectClass=person)(!(userAccountControl:1.2.840.113556.1.4.803:=2))) pass_filter = (&(userPrincipalName=%n@domain.com)(objectClass=person)(!(userAccountControl:1.2.840.113556.1.4.803:=2))) #user_filter = (&(mail=%u)(objectClass=person)(!(userAccountControl:1.2.840.113556.1.4.803:=2))) #pass_filter = (&(mail=%u)(objectClass=person)(!(userAccountControl:1.2.840.113556.1.4.803:=2))) pass_attrs = userPassword=password default_pass_scheme = CRYPT user_attrs = \ #=mail=master_user, \ #mail=user, \ =user=%Ln(a)mydomain.com, \ =home=/var/vmail/vmail1/mydomain.com/%Ln/Maildir/, \ =mail=maildir:/var/vmail/vmail1/mydomain.com/%Ln/Maildir/, \ maxStorage=quota_rule=*:bytes=%$ root@mail-01:/etc/dovecot# ls -al dovecot-master-users -r-x------ 1 dovecot dovecot 120 Nov 13 14:45 dovecot-master-users

3 3