- dovecot - dovecot.org

Why does dovecot reject password when authorizing by a certificate?
by yuryb 01 Feb '18

01 Feb '18

We have FreeBSD-server with dovecot installed on it as IMAP-server. My user and password database is a text file with plaintext passwords. Clients connect to imap-server via TLS protocol and plaintext password. All works fine. But I want to configure ability to authorize with a client certificates. I have generated a client certificate and imported it to email-client. Also I have configured dovecot to verify client certificates. But email-client cannot authorize: Password mismatch. Why dovecot reject my password in this case? Please help! My log:dovecot: imap-login: Valid certificate: /C=UA/ST=Kyiv/L=Kyiv/O=Contoso Ltd: user=<>, rip=10.1.1.59, lip=10.1.1.99, TLS handshaking, session=<fp5P5SBkhtMKAQE7> dovecot: imap-login: Valid certificate: /C=UA/ST=Kyiv/O=Contoso Ltd/OU=IT/CN=sysadmin/emailAddress=sysadmin(a)contoso.ua: user=<>, rip=10.1.1.59, lip=10.1.1.99, TLS handshaking, session=<fp5P5SBkhtMKAQE7> dovecot: auth: passwd-file(sysadmin,10.1.1.59,<fp5P5SBkhtMKAQE7>): Password mismatch dovecot: imap-login: Disconnected (auth failed, 1 attempts in 6 secs): user=<sysadmin>, method=EXTERNAL, rip=10.1.1.59, lip=10.1.1.99, TLS, session=<fp5P5SBkhtMKAQE7> My configuration: # 2.2.24 (a82c823): /usr/local/etc/dovecot/dovecot.conf # OS: FreeBSD 10.2-RELEASE-p20 amd64 ufs auth_debug = yes auth_mechanisms = plain login external auth_ssl_require_client_cert = yes auth_ssl_username_from_cert = yes auth_username_format = %Ln auth_verbose = yes disable_plaintext_auth = no lda_mailbox_autocreate = yes mail_debug = yes mail_gid = 999 mail_location = maildir:/mnt/mail/%n mail_uid = 999 namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = /usr/local/etc/dovecot/users driver = passwd-file } protocols = imap pop3 service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } unix_listener auth-userdb { group = vmail mode = 0660 user = vmail } } service imap-login { inet_listener imaps { ssl = yes } } ssl_ca = </etc/ssl/cacert.pem ssl_cert = </etc/ssl/certs/dovecot.pem ssl_dh_parameters_length = 2048 ssl_key = </etc/ssl/private/dovecot.pem ssl_prefer_server_ciphers = yes ssl_protocols = !SSLv2 !SSLv3 !TLSv1 ssl_require_crl = no ssl_verify_client_cert = yes userdb { args = /usr/local/etc/dovecot/users driver = passwd-file } verbose_ssl = yes

2 4

test-net.c failure
by Rupert Gallagher 31 Jan '18

31 Jan '18

test-net.c:79: Assert failed: strcmp(net_ip2addr(&ip), "::5") == 0 test-net.c:83: Assert failed: strcmp(net_ip2addr(&ip), "::5") == 0 net_ip2addr() ........................................................ : FAILED Hello, Is it possible to disable DOVECOT_IPV6? We do not use IPv6 (and hope we shall never do on e-mails).

3 3

2.3.0 on 10.13.3 (macos): all testing errors
by Rupert Gallagher 30 Jan '18

30 Jan '18

Enclosed.

1 0

send specific NDR message for users in certain OU
by lists 30 Jan '18

30 Jan '18

Hi, The question can perhaps be made more generic like this: Can dovecot generate a *specific* NDR (or an autoreply) for accounts that meet a specific criterium, such as: - user account was found under OU=to-delete,CN=company... contrary to the regular location CN=Users,CN=company... We would like to move to-be-deleted users to this container, before actually deleting them. That gives us an easy way to revert, if the deletion turns out to be erroneous. We could do that with via a sieve config for those accounts, but if dovecot could send a "delivery failure"-type specific for those accounts (with instructions who to contact to revert the situation) it would be very easy: only move the user to the specific OU, and have the system do the rest. Can this be done? (dovecot 2.1.17 on wheezy, yes we know we should upgrade, and we also will, but it runs rock solid...) MJ

2 2

2 panics, 1 segmentation fault in dovecot 2.3.0 (fts)
by Infoomatic 30 Jan '18

30 Jan '18

Hi, While testing our migration to dovecot 2.3.0, we encountered 2 panics, 1 segmentation fault while we wanted to rebuild the solr indizes. Problem [1] was encountered while rebuilding the indizes, and now I don't know how many mails/documents are indexed or where it got stuck. [2] and [3] encountered while just playing around, since I did not know of "tokenize" and did not find a lot of information about it. This is a ubuntu 16.04 machine, dovecot 2.3.0 compiled from source ( + the patch for the recent zlib problem). "doveadm index" runs on a ~ 4GB mdbox-zipped-mailbox for about 3-4 minutes before aborting with the message above, beforehand I did a "/opt/dovecot/bin/doveadm fts rescan -A". When I repeat "doveadm index" it aborts after about 4 seconds, after a "/opt/dovecot/bin/doveadm fts rescan -A" it runs again for 3-4 minutes. Apache tika logs, but those are probably not related to the problem, however, the devs might want investigate the last line: WARN Parse exception Expected ';', got "," determining content disposition javax.mail.internet.ParseException: Expected ';', got "," and org.apache.tika.exception.ZeroByteFileException: InputStream must have > 0 bytes I would be happy if you could have a look at this, please, and of course just tell me what further information you need. Thanks, infoomatic [1] /opt/dovecot/bin/doveadm index -u user1 '*' doveadm(user1): Panic: file unichar.c: line 160 (uni_ucs4_to_utf8_c): assertion failed: (uni_is_valid_ucs4(chr)) doveadm(user1): Error: Raw backtrace: /opt/dovecot/lib/dovecot/libdovecot.so.0(+0xc5eea) [0x7ff27755beea] -> /opt/dovecot/lib/dovecot/libdovecot.so.0(+0xc5f59) [0x7ff27755bf59] -> /opt/dovecot/lib/dovecot/libdovecot.so.0(i_fatal+0) [0x7ff2774ce5e1] -> /opt/dovecot/lib/dovecot/libdovecot.so.0(uni_ucs4_to_utf8_c+0xa0) [0x7ff277593300] -> /opt/dovecot/lib/dovecot/libdovecot.so.0(+0xa74f9) [0x7ff27753d4f9] -> /opt/dovecot/lib/dovecot/libdovecot.so.0(mail_html2text_more+0xc5) [0x7ff27753d705] -> /opt/dovecot/lib/dovecot/lib20_fts_plugin.so(+0xcf5c) [0x7ff276460f5c] -> /opt/dovecot/lib/dovecot/lib20_fts_plugin.so(fts_parser_more+0x27) [0x7ff276460c37] -> /opt/dovecot/lib/dovecot/lib20_fts_plugin.so(fts_build_mail+0x511) [0x7ff27645eb51] -> /opt/dovecot/lib/dovecot/lib20_fts_plugin.so(+0x110a6) [0x7ff2764650a6] -> /opt/dovecot/lib/dovecot/libdovecot-storage.so.0(mail_precache+0x2e) [0x7ff27784618e] -> /opt/dovecot/bin/doveadm(+0x2f697) [0x55dd2f912697] -> /opt/dovecot/bin/doveadm(+0x29827) [0x55dd2f90c827] -> /opt/dovecot/bin/doveadm(+0x2a4bb) [0x55dd2f90d4bb] -> /opt/dovecot/bin/doveadm(doveadm_cmd_ver2_to_mail_cmd_wrapper+0x21d) [0x55dd2f90e2cd] -> /opt/dovecot/bin/doveadm(doveadm_cmd_run_ver2+0x575) [0x55dd2f91deb5] -> /opt/dovecot/bin/doveadm(doveadm_cmd_try_run_ver2+0x37) [0x55dd2f91df07] -> /opt/dovecot/bin/doveadm(main+0x1d2) [0x55dd2f8fd032] -> /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xf0) [0x7ff2770ec830] -> /opt/dovecot/bin/doveadm(_start+0x29) [0x55dd2f8fd439] Aborted (core dumped) [2] This was just about my curiosity since I haven't used "tokenize" and did not find too much info about it: /opt/dovecot/bin/doveadm fts tokenize -A '*' Panic: file doveadm-print.c: line 142: unreached Error: Raw backtrace: /opt/dovecot/lib/dovecot/libdovecot.so.0(+0xc5eea) [0x7f38ac5c2eea] -> /opt/dovecot/lib/dovecot/libdovecot.so.0(+0xc5f59) [0x7f38ac5c2f59] -> /opt/dovecot/lib/dovecot/libdovecot.so.0(i_fatal+0) [0x7f38ac5355e1] -> /opt/dovecot/bin/doveadm(+0x3b3d3) [0x55c728e8b3d3] -> /opt/dovecot/bin/doveadm(+0x2a63a) [0x55c728e7a63a] -> /opt/dovecot/bin/doveadm(doveadm_cmd_ver2_to_mail_cmd_wrapper+0x21d) [0x55c728e7b2cd] -> /opt/dovecot/bin/doveadm(doveadm_cmd_run_ver2+0x575) [0x55c728e8aeb5] -> /opt/dovecot/bin/doveadm(doveadm_cmd_try_run_ver2+0x37) [0x55c728e8af07] -> /opt/dovecot/bin/doveadm(main+0x1d2) [0x55c728e6a032] -> /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xf0) [0x7f38ac153830] -> /opt/dovecot/bin/doveadm(_start+0x29) [0x55c728e6a439] Aborted (core dumped) [3] /opt/dovecot/bin/doveadm fts tokenize -u user1 "@" Segmentation fault (core dumped)

2 2

Dovecot 2.2.33.2 doveadm log reopen don't work
by Айхэд 30 Jan '18

30 Jan '18

dovecot -n # 2.2.33.2 (d6601f4ec): /usr/local/etc/dovecot/dovecot.conf # Pigeonhole version 0.4.21 (92477967) # OS: FreeBSD 11.1-RELEASE-p1 amd64 zfs from logrotate.conf: /var/log/dovecot/dovecot.log { rotate 180 missingok nomail noolddir compress create 0600 nobody nobody postrotate # /usr/local/bin/doveadm log reopen /usr/sbin/service dovecot reload endscript } After upgrade to 2.2.33.2 (prev version was 2.2.29.1) there are only messages from sieve in /var/log/dovecot/dovecot.log like this: Jan 29 00:00:12 lda(***): Info: sieve: msgid=<20180128210012.3A9A11138B8E@***>: stored mail into mailbox 'INBOX.' (INBOX) Messages from pop3, pop3-login, imap, imap-login are absent. If i replace /usr/local/bin/doveadm log reopen with /usr/sbin/service dovecot reload all works fine. Before upgrade all worked fine.

1 0

Change destination of dsync
by Sergio Belkin 29 Jan '18

29 Jan '18

Hi, I have the following command for retrieving mails from another IMAP mail server dsync -D -v backup -R -u jon.doe imapc: I't ok and works, but I'd want to copy messages outside of /var directory, is there a way to do that? Thanks in advance! -- -- Sergio Belkin LPIC-2 Certified - http://www.lpi.org

2 1

problem with lda
by Infoomatic 27 Jan '18

27 Jan '18

Hello, I am currently testing the upgrade from our dovecot v2.2.23 to 2.3.0. I have a strange problem with lda. We use bounce mails for internal users if they try to send virus/spammails. The exact same config works with 2.2.23, but not with 2.3.0. The relevant postfix/master.cf part: dovecot unix - n n - - pipe flags=DRhu user=vmail:vmail argv=/opt/dovecot/libexec/dovecot/deliver -d ${recipient} -f ${sender} On the same machine, with 2.2.23 I get a bounce mail when trying to send a virus, with the subject "VIRUS in message apparently from you (Eicar-Test-Signature)", to both the users inbox as well as to the mailbox of virusalert(a)ourdomain.internal With 2.3.0, in the logs I get an error: relay=dovecot, delay=0.01, delays=0/0/0/0, dsn=5.3.0, status=bounced (command line usage error. Command output: lda: Fatal: Invalid -f parameter: Missing domain and the alert message is only sent to virusalert(a)ourdomain.internal, but not to the user who tried to send the mail. The relevant part of our dovecot.conf: protocol lda { mail_plugins = " quota zlib sieve acl mail_log notify" postmaster_address = postmaster(a)ourdomain.internal } Does anyone know how to solve this problem? Or is there a workaround via postfix/amavis/spamassassin? Any hints are highly appreciated, thanks! Regards, infoomatic

3 6

Send full X.509 client certificate to custom authentication policy server
by Jaime Hablutzel Egoavil 26 Jan '18

26 Jan '18

I'm working with Dovecot 2.3 and I'm wondering if I could send the full X.509 client certificate to my custom authentication policy server. I'm actually aware that I can send the client certificate validity status with something like: auth_policy_request_attributes = ... cert=%{cert} But I want the full X.509 certificate to be able to decide over the basis of certificate extensions, e.g. Certificate Policies extension. Is it currently possible?, what about Lua based authentication?, does Lua currently receive the full client certificate?. -- Jaime Hablutzel - RPC 994690880

2 1

exited on signal 6 (core dumped) when searching folder
by Kristjan Eentsalu 26 Jan '18

26 Jan '18

Hey, I'm getting messages exited on signal 6 (core dumped) when doing imap command "a UID SORT (DATE) UTF-8 BODY someword" message log file Jan 26 13:57:20 mail dovecot: imap(kristjan.eentsalu(a)yyy.yy): Panic: file charset-iconv.c: line 87 (charset_to_utf8_try): assertion failed: (srcleft <= CHARSET_MAX_PENDING_BUF_SIZE) Jan 26 13:57:20 mail dovecot: imap(kristjan.eentsalu(a)yyy.yy): Fatal: master: service(imap): child 6410 killed with signal 6 (core dumped) Problem seems to to be with one old mail. OS: FreeBSD 11.1-RELEASE-p4 Dovecot 2.2.33.2 , pigenhole 0.4.21 trace, conf and email available https://pastebin.com/7X6fZPPd Kristjan

2 1