- dovecot - dovecot.org

[bt full included] imap-login: Panic: file client-common.c: line 272 (client_destroy): assertion failed: (client->create_finished)
by Andreas Fischer 20 Feb '18

20 Feb '18

Hi, as discussed with cmouse on freenode two days ago please find attached necessary debug information on a crashing imap-login process, that appeared after upgrading to v2.3 (+ sieve). It is a standard setup in combination with postfix and thunderbird, roundcube and K9(Android) as imap clients. Panic happens 5-6 times a day, but no influence on user experience. Unfortunately i have no idea what might be causing it. Let me know if you need more information. Andreas syslog: Feb 19 21:09:37 hafnium.d9c.eu dovecot[14324]: imap-login: Fatal: master: service(imap-login): child 30653 killed with signal 6 (core dumped) dovecot.log: Feb 19 20:57:07 imap(user(a)d9c.eu)<30655><7C/91pVl0q3CJ7cC>: Info: Connection closed (IDLE running for 0.001 + waiting input for 1109.126 secs, 2 B in + 10 B out, state=wait-input) in=699 out= Feb 19 20:57:24 imap(user(a)d9c.eu)<30656><PuD+1pVl1a3CJ7cC>: Info: Connection closed (IDLE running for 0.001 + waiting input for 1123.798 secs, 2 B in + 10 B out, state=wait-input) in=91 out=1 Feb 19 21:02:15 imap(user(a)d9c.eu)<30999><IS1w55VlKKrDJbhD>: Info: Connection closed (IDLE running for 0.001 + waiting input for 1143.235 secs, 2 B in + 10 B out, state=wait-input) in=686 out= Feb 19 21:02:23 imap(user(a)d9c.eu)<30998><5B5v55VlJqrDJbhD>: Info: Connection closed (IDLE running for 0.001 + waiting input for 1147.566 secs, 2 B in + 10 B out, state=wait-input) in=99 out=1 Feb 19 21:08:36 imap(user(a)d9c.eu)<30657><D7QC15Vl1q3CJ7cC>: Info: Disconnected for inactivity in=91 out=919 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0 Feb 19 21:08:37 imap(user(a)d9c.eu)<30658><n6EG15Vl163CJ7cC>: Info: Disconnected for inactivity in=719 out=5345 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0 dovecot -n # 2.3.0 (c8b89eb): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.0.1 (d33dca20) # OS: Linux 4.15.3-2-ARCH x86_64 auth_debug = yes auth_mechanisms = plain login auth_verbose = yes debug_log_path = /var/log/dovecot-debug.log info_log_path = /var/log/dovecot.log login_log_format_elements = user=<%u> method=%m rip=%r lip=%l mpid=%e %c %k mail_gid = vmail mail_home = /app/vmail/%d/%n mail_location = sdbox:%h/sdbox mail_plugins = " quota" mail_uid = vmail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext editheader mdbox_rotate_interval = 1 days mdbox_rotate_size = 8 M namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } plugin { quota = dict:user::file:%h/mdbox/dovecot-quota sieve = ~/.dovecot.sieve sieve_dir = ~/sieve sieve_extensions = +editheader } protocols = imap pop3 lmtp sieve service auth-worker { user = $default_internal_user } service auth { unix_listener /var/spool/postfix-sasl/private/auth { group = postfix mode = 0660 user = postfix } } service imap-login { chroot = executable = imap-login -D inet_listener imap { port = 143 } inet_listener imaps { port = 0 } service_count = 0 } service lmtp { unix_listener /var/spool/postfix-mail/private/dovecot-lmtp { group = postfix mode = 0660 user = postfix } } service managesieve-login { inet_listener sieve { port = 4190 } process_min_avail = 1 } service pop3-login { inet_listener pop3 { port = 0 } inet_listener pop3s { port = 995 ssl = yes } } ssl = required ssl_cert = </etc/cert.ec.crt ssl_cipher_list = ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256 ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it ssl_min_protocol = TLSv1.2 ssl_prefer_server_ciphers = yes userdb { driver = prefetch } userdb { driver = static } protocol lmtp { mail_plugins = " quota sieve" } protocol imap { imap_client_workarounds = tb-extra-mailbox-sep mail_max_userip_connections = 25 mail_plugins = " quota imap_quota" } (gdb) bt full #0 0x00007fddd9433860 in raise () from /usr/lib/libc.so.6 No symbol table info available. #1 0x00007fddd9434ec9 in abort () from /usr/lib/libc.so.6 No symbol table info available. #2 0x00007fddd987a521 in default_fatal_finish (type=LOG_TYPE_PANIC, status=status@entry=0) at failures.c:228 backtrace = 0x561a9c8612f0 "/usr/lib/dovecot/libdovecot.so.0(+0xc4567) [0x7fddd987a567] -> /usr/lib/dovecot/libdovecot.so.0(+0xc462a) [0x7fddd987a62a] -> /usr/lib/dovecot/libdovecot.so.0(i_fatal+0) [0x7fddd97e9df9] -> /usr/lib/d"... recursed = 0 #3 0x00007fddd987a62a in i_internal_fatal_handler (ctx=0x7ffdbd74cd70, format=<optimized out>, args=<optimized out>) at failures.c:718 status = 0 #4 0x00007fddd97e9df9 in i_panic (format=format@entry=0x7fddd9b35a88 "file %s: line %d (%s): assertion failed: (%s)") at failures.c:306 ctx = {type = LOG_TYPE_PANIC, exit_status = 0, timestamp = 0x0, timestamp_usecs = 0, log_prefix = 0x0} args = {{gp_offset = 40, fp_offset = 48, overflow_arg_area = 0x7ffdbd74ce70, reg_save_area = 0x7ffdbd74cdb0}} #5 0x00007fddd9b2e2e9 in client_destroy (client=<optimized out>, reason=reason@entry=0x7fddd9b35e21 "Disconnected: Shutting down") at client-common.c:272 __func__ = "client_destroy" #6 0x00007fddd9b2e624 in clients_destroy_all_reason (reason=0x7fddd9b35e21 "Disconnected: Shutting down") at client-common.c:430 client = <optimized out> next = 0x0 #7 0x0000561a9aeeb12a in imap_login_deinit () at imap-login-client.c:764 No locals. #8 0x00007fddd9b34587 in main_deinit () at main.c:475 strp = <optimized out> strp = <optimized out> strp_end = <optimized out> #9 login_binary_run (binary=<optimized out>, argc=<optimized out>, argv=<optimized out>) at main.c:550 set_pool = 0x561a9c86b100 login_socket = 0x7fddd9b37ab9 "login" c = <optimized out> #10 0x00007fddd941ff4a in __libc_start_main () from /usr/lib/libc.so.6 No symbol table info available. #11 0x0000561a9aeeaeaa in _start () No symbol table info available. (gdb)

1 0

SASL LOGIN mechanism with nopassword
by Patrick Monnerat 18 Feb '18

18 Feb '18

Hi list, I've noticed dovecot pop3 does not request the password with 'AUTH LOGIN' when nopassword is set. dovecot-2.2.18 auth_mechanisms = plain login ssl = required auth_ssl_require_client_cert = yes auth_ssl_username_from_cert = yes passdb { driver = ldap args = /etc/dovecot/dovecot-ldap.conf.ext default_fields = nopassword=yes userdb_uid=vmail userdb_gid=vmail userdb_home=/var/spool/vmail/%d/%n override_fields = password= } userdb { driver = prefetch } userdb { driver = ldap args = /etc/dovecot/dovecot-ldap.conf.ext default_fields = uid=vmail gid=vmail home=/var/spool/vmail/%d/%n } Although this works perfectly well, skipping the password phase in the SASL LOGIN mechanism deviates from the draft for this mechanism at https://tools.ietf.org/html/draft-murchison-sasl-login-00 I know this document is not normative and has not made its way to a standard. However it does not mention the ability to bypass the password phase. My questions are: - Is the dovecot behavior intentional ? - If not, will you change it (i.e.: to a dummy password request) ? - Are you aware of another server considering the SASL LOGIN password phase as optional ? Please don't tell me to change the config or to use the PLAIN or EXTERNAL mechanism: the real goal of these questions is to know whether this deviance should be supported by a client (more precisely cURL) or not. Thanks in advance for you reply. Patrick

1 0

Dovecot says the message was stored into a Spam mailbox but it's not there
by Kris 18 Feb '18

18 Feb '18

Hi, I have a problem with storing messages into a Spam folder by dovecot. Log says that message was stored into Spam mailbox but when I check there is no message in users's Spam mailbox. cat /var/log/mail.log | grep sieve | grep Spam : *Feb 17 05:09:11 mailserver dovecot: lda(user@domain): sieve: msgid=<b599df639ffa4d20f6e8d2bcff791286(a)somedomain.pl>: stored mail into mailbox 'Spam'* Where are these messages if not in the Spam folder where they should be? /var/vmail/domain/user/Maildir/.Spam/cur/ * dovecot -n* # 2.2.22 (fe789d2): /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.13 (7b14904) # OS: Linux 4.4.0-104-generic x86_64 Ubuntu 16.04.3 LTS ext4 auth_gssapi_hostname = mailserver.belpol.local auth_krb5_keytab = /etc/dovecot/dovecot.keytab auth_mechanisms = gssapi plain first_valid_gid = 117 first_valid_uid = 111 listen = * log_timestamp = "%Y-%m-%d %H:%M:%S " mail_gid = ebox mail_home = /var/vmail/%d/%u mail_location = maildir:/var/vmail/%d/%u/Maildir mail_uid = ebox managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext namespace inbox { inbox = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Messages" { auto = no special_use = \Sent } mailbox Spam { auto = create special_use = \Junk } mailbox Trash { auto = subscribe special_use = \Trash } prefix = separator = / subscriptions = yes } passdb { args = /etc/dovecot/dovecot-ldap.conf driver = ldap } plugin { quota = maildir:User quota quota_rule = *:storage=0 sieve = /var/vmail/%Ld/%Ln/sieve-script sieve_before = /var/vmail/sieve/default.sieve sieve_default = /var/vmail/sieve/default.sieve sieve_dir = /var/vmail/%Ld/%Ln sieve_global_path = /var/vmail/sieve/default.sieve sieve_storage = /var/vmail/%Ld/%Ln } protocols = pop3 imap sieve service auth { executable = /usr/lib/dovecot/auth unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } unix_listener auth-master { group = ebox mode = 0600 user = ebox } } service imap-login { inet_listener imap { address = * port = 143 } inet_listener imaps { address = * port = 993 } } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0666 user = postfix } } service managesieve-login { inet_listener sieve { port = 4190 } } service pop3-login { inet_listener pop3 { port = 110 } inet_listener pop3s { port = 995 } } ssl_cert = </etc/dovecot/private/dovecot.pem ssl_key = </etc/dovecot/private/dovecot.pem userdb { args = /etc/dovecot/dovecot-ldap.conf default_fields = uid=111 gid=117 driver = ldap } protocol imap { mail_max_userip_connections = 20 mail_plugins = quota imap_quota } protocol pop3 { mail_plugins = quota } protocol lda { auth_socket_path = /var/run/dovecot/auth-master mail_plugins = sieve quota postmaster_address = postmaster } *default.sieve:* require ["fileinto"]; # rule:[SPAM] if header :contains "X-Spam-Flag" "YES" { fileinto "Spam"; } if header :contains "subject" ["***UNCHECKED***", "SPAM"] { fileinto "Spam"; }

2 1

FreeBSD Core dump: PAM authentication with Kerberos credentials (GSSAPI_MIT)
by Ben Woods 18 Feb '18

18 Feb '18

Hi everyone, I have a repeatable core dump when running dovecot on FreeBSD in the specific scenario described below. Dovecot is linked against MIT kerberos in /usr/local/lib/, whilst PAM is linked against Heimdal in /usr/lib/. My expectation was that dovecot authentication using GSSAPI would use MIT kerberos in /usr/local/lib, whereas PAM authentication is independent from dovecot and would therefore use Herimdal in /usr/lib/. What actually seems to occur during PAM authentication is the Heimdal code in /usr/lib/ is initially being used, but part way through it switches to using the MIT kerberos code in /usr/local/lib/. I have reported this bug on the FreeBSD bug tracker here: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=225818 Any help troubleshooting this issue would be much appreciated. I suspect it has something to do with the CFLAGS and LDFLAGS being used during the build, so I have attached the build log to the FreeBSD bug report. Thanks in advance, Ben SCENARIO: - Build mail/dovecot with option GSSAPI_MIT (link against MIT kerberos from ports rather than Heimdal in base) - Configure dovecot for PAM authentication, using PAM service "imap": $ cat /usr/local/etc/dovecot/conf.d/10-auth.conf auth_mechanisms = plain passdb { driver = pam args = %s } userdb { driver = passwd } - Configure imap pam to authenticate against kerberos (and enable debugging): $ cat /etc/pam.d/imap auth sufficient pam_krb5.so debug account required pam_krb5.so debug RESULT: This results in a crash of the dovecot authentication worker before any kerberos messages are even exchanged. DIAGNOSIS: Reviewing the log output below, my explanation of the backtrace is below (cronological order / newest item last): - Dovecot had successfully performed pam_start(), the necessary pam_set_item(), and called pam_authenticate(pamh, 0) https://github.com/dovecot/core/blob/2.2.33.2/src/auth/passdb-pam.c#L158 - PAM called pam_sm_authenticate() in /usr/lib/libpam/modules/pam_krb5/pam_krb5.c which successfully got the user, ruser, service, principal, password, checked local user, and then ran krb5_get_init_creds_opt_set_default_flags https://github.com/freebsd/freebsd/blob/master/lib/libpam/modules/pam_krb5/… - Heimdal krb5_get_init_creds_opt_set_default_flags ran the Heimdal version of krb5_appdefault_time: https://github.com/freebsd/freebsd/blob/master/crypto/heimdal/lib/krb5/init… - Heimdal function krb5_appdefault_time ran the MIT kerberos version of krb5_appdefault_string: https://github.com/freebsd/freebsd/blob/master/crypto/heimdal/lib/krb5/appd… This is where the code path cross from using the Heimdal code to the MIT kerberos code, which it should not do. I know this, because the GDB backtrace shows the krb5_appdefault_string function called strdup in file appdefault.c:165, but the Heimdal appdefault.c file only has 140 lines. Reviewing the MIT kerberos code, the strdup function is indeed called at appdefault.c:165. Why did the Heimdal appdefault.c code call the MIT kerberos version of krb5_appdefault_string, when the Heimdal version was only 50 lines higher in the same appdefault.c file? ENVIRONMENT: $ dovecot -n # 2.2.33.2 (d6601f4ec): /usr/local/etc/dovecot/dovecot.conf # OS: FreeBSD 12.0-CURRENT amd64 zfs auth_debug = yes auth_debug_passwords = yes auth_krb5_keytab = /usr/local/etc/dovecot/dovecot.keytab auth_mechanisms = plain login gssapi auth_realms = WOODS.AM auth_verbose = yes mail_location = mdbox:/var/mail/%u namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = failure_show_msg=yes %s driver = pam } service auth-worker { drop_priv_before_exec = yes } ssl_cert = </usr/local/etc/ssl/mail.woods.am/fullchain.pem ssl_key = # hidden, use -P to show it userdb { driver = passwd } GDB BACKTRACE OF COREDUMP: $ gdb /usr/local/libexec/dovecot/auth GNU gdb (GDB) 8.0.1 [GDB v8.0.1 for FreeBSD] Copyright (C) 2017 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html > This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type "show copying" and "show warranty" for details. This GDB was configured as "x86_64-portbld-freebsd12.0". Type "show configuration" for configuration details. For bug reporting instructions, please see: <http://www.gnu.org/software/gdb/bugs/>. Find the GDB manual and other documentation resources online at: <http://www.gnu.org/software/gdb/documentation/>. For help, type "help". Type "apropos word" to search for commands related to "word"... Reading symbols from /usr/local/libexec/dovecot/auth...done. (gdb) core /tmp/auth.core [New LWP 102627] warning: Can't read pathname for load map: Unknown error: -1. warning: Can't read pathname for load map: Unknown error: -1. warning: Can't read pathname for load map: Unknown error: -1. warning: Can't read pathname for load map: Unknown error: -1. Core was generated by `dovecot/auth -w'. Program terminated with signal SIGSEGV, Segmentation fault. #0 strlen (str=0x0) at /usr/src/lib/libc/string/strlen.c:100 warning: Source file is more recent than executable. 100 */ (gdb) bt #0 strlen (str=0x0) at /usr/src/lib/libc/string/strlen.c:100 #1 0x0000000012130022 in strdup (str=0x0) at /usr/src/lib/libc/string/strdup.c:46 #2 0x0000000011b65e9d in krb5_appdefault_string (context=0x10777000, appname=0x106f0018 "imap", realm=0x0, option=0x13b1f403 "ticket_lifetime", default_value=0x0, ret_value=0x7fffffffe088) at appdefault.c:165 #3 0x0000000013af4a80 in krb5_appdefault_time (context=0x0, appname=0xffffffffaaca6003 <error: Cannot access memory at address 0xffffffffaaca6003>, realm=0x50 <error: Cannot access memory at address 0x50>, option=0x0, def_val=0, ret_val=0x7fffffffe0e0) at /usr/src/crypto/heimdal/lib/krb5/appdefault.c:130 #4 0x0000000013ae3e79 in krb5_get_init_creds_opt_set_default_flags (context=0x10777000, appname=0x106f0018 "imap", realm=0x0, opt=0x1070f3c0) at /usr/src/crypto/heimdal/lib/krb5/init_creds.c:171 #5 0x00000000138b738f in ?? () #6 0x0000000000000000 in ?? () LOG OUTPUT: $ cat /var/log/maillog: Feb 11 09:20:40 mail dovecot: auth: Error: auth worker: Aborted PASSV request for woodsb02: Worker process died unexpectedly Feb 11 09:20:40 mail dovecot: auth-worker(34874): Fatal: master: service(auth-worker): child 34874 killed with signal 11 (core dumped) Feb 11 09:20:47 mail dovecot: imap-login: Disconnected (auth failed, 1 attempts in 7 secs): user=<woodsb02>, method=PLAIN, rip=192.168.1.13, lip=192.168.1.13, TLS, session=<GRJsRuxkf17AqAEN> $ cat /var/log/debug.log: Feb 11 09:20:35 mail dovecot: auth: Debug: auth client connected (pid=34853) [34/1991] Feb 11 09:20:40 mail dovecot: auth: Debug: client in: AUTH 1 PLAIN service=imap secured session=GRJsRuxkf17AqAEN lip=192.168.1.13 rip=192.168.1.13 lport= 993 rport=24191 resp=AHdvb2RzYjAyAHRlc3Q= (previous base64 data may contain sensitive data) Feb 11 09:20:40 mail dovecot: auth-worker(34874): Debug: Loading modules from directory: /usr/local/lib/dovecot/auth Feb 11 09:20:40 mail dovecot: auth-worker(34874): Debug: Module loaded: /usr/local/lib/dovecot/auth/lib20_auth_var_expand_crypt.so Feb 11 09:20:40 mail dovecot: auth-worker(34874): Debug: pam(woodsb02,192.168.1.13,<GRJsRuxkf17AqAEN>): lookup service=imap Feb 11 09:20:40 mail auth: in openpam_dispatch(): calling pam_sm_authenticate() in /usr/lib/pam_krb5.so.6 Feb 11 09:20:40 mail auth: in pam_get_user(): entering Feb 11 09:20:40 mail auth: in pam_get_item(): entering: PAM_USER Feb 11 09:20:40 mail auth: in pam_get_item(): returning PAM_SUCCESS Feb 11 09:20:40 mail auth: in pam_get_user(): returning PAM_SUCCESS Feb 11 09:20:40 mail auth: in pam_sm_authenticate(): Got user: woodsb02 Feb 11 09:20:40 mail auth: in pam_get_item(): entering: PAM_RUSER Feb 11 09:20:40 mail auth: in pam_get_item(): returning PAM_SUCCESS Feb 11 09:20:40 mail auth: in pam_sm_authenticate(): Got ruser: woodsb02 Feb 11 09:20:40 mail auth: in pam_get_item(): entering: PAM_SERVICE Feb 11 09:20:40 mail auth: in pam_get_item(): returning PAM_SUCCESS Feb 11 09:20:40 mail auth: in pam_sm_authenticate(): Got service: imap Feb 11 09:20:40 mail auth: in pam_sm_authenticate(): Context initialised Feb 11 09:20:40 mail auth: in pam_sm_authenticate(): Done krb5_cc_register() Feb 11 09:20:40 mail auth: in openpam_get_option(): entering: 'auth_as_self' Feb 11 09:20:40 mail auth: in openpam_get_option(): returning NULL Feb 11 09:20:40 mail auth: in pam_sm_authenticate(): Created principal: woodsb02 Feb 11 09:20:40 mail auth: in pam_sm_authenticate(): Done krb5_parse_name() Feb 11 09:20:40 mail auth: in pam_sm_authenticate(): Got principal: woodsb02(a)WOODS.AM Feb 11 09:20:40 mail auth: in pam_get_authtok(): entering Feb 11 09:20:40 mail auth: in pam_get_item(): entering: PAM_RHOST Feb 11 09:20:40 mail auth: in pam_get_item(): returning PAM_SUCCESS Feb 11 09:20:40 mail auth: in pam_get_item(): entering: PAM_HOST Feb 11 09:20:40 mail auth: in pam_get_item(): returning PAM_SUCCESS Feb 11 09:20:40 mail auth: in pam_get_item(): entering: PAM_OLDAUTHTOK Feb 11 09:20:40 mail auth: in pam_get_item(): returning PAM_SUCCESS Feb 11 09:20:40 mail auth: in openpam_get_option(): entering: 'try_first_pass' Feb 11 09:20:40 mail auth: in openpam_get_option(): returning NULL Feb 11 09:20:40 mail auth: in openpam_get_option(): entering: 'use_first_pass' Feb 11 09:20:40 mail auth: in openpam_get_option(): returning NULL Feb 11 09:20:40 mail auth: in openpam_get_option(): entering: 'authtok_prompt' Feb 11 09:20:40 mail auth: in openpam_get_option(): returning NULL Feb 11 09:20:40 mail auth: in openpam_subst(): entering: 'Password:' Feb 11 09:20:40 mail auth: in openpam_subst(): returning PAM_SUCCESS Feb 11 09:20:40 mail auth: in openpam_get_option(): entering: 'echo_pass' Feb 11 09:20:40 mail auth: in openpam_get_option(): returning NULL Feb 11 09:20:40 mail auth: in pam_vprompt(): entering Feb 11 09:20:40 mail auth: in pam_get_item(): entering: PAM_CONV Feb 11 09:20:40 mail auth: in pam_get_item(): returning PAM_SUCCESS Feb 11 09:20:40 mail auth: in pam_vprompt(): returning PAM_SUCCESS Feb 11 09:20:40 mail auth: in pam_set_item(): entering: PAM_AUTHTOK Feb 11 09:20:40 mail dovecot: auth-worker(34874): Debug: pam(woodsb02,192.168.1.13,<GRJsRuxkf17AqAEN>): #1/1 style=1 msg=Password: Feb 11 09:20:40 mail auth: in pam_set_item(): returning PAM_SUCCESS Feb 11 09:20:40 mail auth: in pam_get_item(): entering: PAM_AUTHTOK Feb 11 09:20:40 mail auth: in pam_get_item(): returning PAM_SUCCESS Feb 11 09:20:40 mail auth: in pam_get_authtok(): returning PAM_SUCCESS Feb 11 09:20:40 mail auth: in pam_sm_authenticate(): Got password Feb 11 09:20:40 mail auth: in openpam_get_option(): entering: 'no_user_check' Feb 11 09:20:40 mail auth: in openpam_get_option(): returning NULL Feb 11 09:20:40 mail auth: in openpam_get_option(): entering: 'no_user_check' Feb 11 09:20:40 mail auth: in openpam_get_option(): returning NULL Feb 11 09:20:40 mail auth: in pam_sm_authenticate(): Done getpwnam() Feb 11 09:20:40 mail dovecot: auth-worker(34875): Debug: Loading modules from directory: /usr/local/lib/dovecot/auth Feb 11 09:20:40 mail dovecot: auth-worker(34875): Debug: Module loaded: /usr/local/lib/dovecot/auth/lib20_auth_var_expand_crypt.so $ ldd /usr/local/libexec/dovecot/auth /usr/local/libexec/dovecot/auth: libstats_auth.so => /usr/local/lib/dovecot/stats/libstats_auth.so (0x80089a000) libdovecot.so.0 => /usr/local/lib/dovecot/libdovecot.so.0 (0x800a9c000) libcrypt.so.5 => /lib/libcrypt.so.5 (0x800e3a000) libpam.so.6 => /usr/lib/libpam.so.6 (0x801058000) libk5crypto.so.3.1 => /usr/local/lib/libk5crypto.so.3.1 (0x801265000) libcom_err.so.3.0 => /usr/local/lib/libcom_err.so.3.0 (0x8014b3000) libldap-2.4.so.2 => /usr/local/lib/libldap-2.4.so.2 (0x8016b6000) liblber-2.4.so.2 => /usr/local/lib/liblber-2.4.so.2 (0x8018fc000) libkrb5.so.3.3 => /usr/local/lib/libkrb5.so.3.3 (0x801b0b000) libgssapi_krb5.so.2.2 => /usr/local/lib/libgssapi_krb5.so.2.2 (0x801e27000) libc.so.7 => /lib/libc.so.7 (0x802090000) libkrb5support.so.0.1 => /usr/local/lib/libkrb5support.so.0.1 (0x802679000) libintl.so.8 => /usr/local/lib/libintl.so.8 (0x802888000) libssl.so.44 => /usr/local/lib/libssl.so.44 (0x802a93000) libcrypto.so.42 => /usr/local/lib/libcrypto.so.42 (0x802ce7000) $ ldd /usr/lib/pam_krb5.so.6 /usr/lib/pam_krb5.so.6: libkrb5.so.11 => /usr/lib/libkrb5.so.11 (0x801614000) libpam.so.6 => /usr/lib/libpam.so.6 (0x801892000) libc.so.7 => /lib/libc.so.7 (0x800826000) libasn1.so.11 => /usr/lib/libasn1.so.11 (0x801a9f000) libcom_err.so.5 => /usr/lib/libcom_err.so.5 (0x801d40000) libcrypt.so.5 => /lib/libcrypt.so.5 (0x801f42000) libcrypto.so.8 => /lib/libcrypto.so.8 (0x802200000) libhx509.so.11 => /usr/lib/libhx509.so.11 (0x80266e000) libroken.so.11 => /usr/lib/libroken.so.11 (0x8028bb000) libwind.so.11 => /usr/lib/libwind.so.11 (0x802ace000) libheimbase.so.11 => /usr/lib/libheimbase.so.11 (0x802cf6000) libprivateheimipcc.so.11 => /usr/lib/libprivateheimipcc.so.11 (0x802efa000) libthr.so.3 => /lib/libthr.so.3 (0x8030fc000) -- From: Benjamin Woods woodsb02(a)gmail.com

2 3

Using director but stick user to a fixed backend
by pw＠wk-serv.de 17 Feb '18

17 Feb '18

Hi everyone, I am using dovecot with a director setup for two backends. I want to add a third backend for use with the apple imap push plugin. Is there a way I can stick some users to this third backend and not using the director feature? Regards Patrick

2 1

Sieve to process list mail based on list-ID
by ＠lbutlr 17 Feb '18

17 Feb '18

Before I spend a lot of time trying to replicate a procmail script that automatically sorts list mail into mailboxes based on the List-ID header (and possibly some other data) I thought I'd check if someone had already done this for sieve. Basically, what I do now in procmail is 1. Get the listname from the List-ID header (or List-post/List-owner if no ID) 2. check against a list of list-ids and if the ID is not on the list, send it to spamc and put the message (if not spam) in the INBOX but mark it as seen, otherwise put it in Junk. 3. have some list specific rules (like rewriting reply-to, stripping subjected tags, etc. 4. Drop message in mailbox based no the ID. (so, dovecot mail goes into .dovecot/new but RandomFakelist gets scanned for spam and if it passes, marked read and put in the inbox). I've seen things like: if exists "List-Id" { if header :contains "List-Id" "dovecot.dovecot.org" { fileinto "dovecot"; } elsif header :contains "List-Id" "others-list.example.com" { fileinto "other-list"; } But I am looking for something more generic, along the lines of $myLists = {"dovecot", "postfix", "other-list") if header :contains "List-ID" "<([^\.])+." { $myID $1; } if $myList :contains $myID { if { $myID is other-list { set $myID to Olist; set header "reply-to" to "moderator@users+other@foo.example.net"; } fileinto $myID; } else { send message to spamc and await results; if spam {fileinto "Junk";} else {fileinto "INBOX";} (obviously that's not the code, but it should give an idea of the sorts of things I want to do and would rather not entirely duplicate. Obviously, I don't know if sieve does variables at all (none of the few example scripts I've looked at have them, but then again most procamil scripts don't have them either). Does sieve support that sort of matching?

4 4

trying to enable sieve
by Mathieu R. 17 Feb '18

17 Feb '18

i'm trying to enable sieve on my dovecot installation, but it seems i'm missing something. Managesieve is ok, i can mange script, but they have no effect at all i've got no error in logs, but no filter is applied here is my dovecot conf : # 2.2.27 (c0f36b0): /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.16 (fed8554) # OS: Linux 4.9.0-4-amd64 x86_64 Debian 9.3 ext4 dict { quota = mysql:/etc/dovecot/dovecot-dict-sql.conf.ext } hostname = onjase.org mail_location = maildir:/srv/vmail/%d/%n:INDEX=/srv/vmail/%d/%n/indexes managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext namespace inbox { inbox = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk { auto = subscribe special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { auto = subscribe special_use = \Trash } prefix = } passdb { driver = pam } passdb { args = /etc/dovecot/dovecot-sql.conf driver = sql } plugin { antispam_allow_append_to_spam = no antispam_backend = pipe antispam_debug_target = syslog antispam_pipe_program = /usr/bin/sa-learn antispam_pipe_program_args = --no-sync antispam_pipe_program_notspam_arg = --ham antispam_pipe_program_spam_arg = --spam antispam_spam = Junk antispam_trash = Trash antispam_verbose_debug = 1 quota = dict:%u::proxy::quota quota_rule = *:storage=10M:messages=1000 quota_warning = storage=99%% quota-warning 99 %u quota_warning2 = storage=97%% quota-warning 97 %u quota_warning3 = storage=95%% quota-warning 95 %u quota_warning4 = storage=90%% quota-warning 90 %u quota_warning5 = storage=85%% quota-warning 85 %u quota_warning6 = storage=80%% quota-warning 80 %u quota_warning7 = storage=75%% quota-warning 75 %u sieve = ~/dovecot.sieve sieve_before = /srv/vmail/global_sieve/ sieve_dir = ~/sieve } postmaster_address = postmaster(a)onjase.org protocols = " imap sieve pop3" quota_full_tempfail = yes service auth { unix_listener /var/spool/postfix/private/auth { mode = 0666 } } service dict { unix_listener dict { mode = 0600 user = vmail } } service imap-login { inet_listener imap { port = 143 } inet_listener imaps { port = 993 ssl = yes } } service lmtp { unix_listener lmtp { mode = 0666 } } service quota-warning { executable = script /usr/local/bin/quota-warning.sh unix_listener quota-warning { user = vmail } user = vmail } ssl_cert = </etc/letsencrypt/live/mail.onjase.org-0001/fullchain.pem ssl_key = # hidden, use -P to show it userdb { driver = passwd } userdb { args = /etc/dovecot/dovecot-sql.conf driver = sql } protocol lda { mail_plugins = " sieve quota" } protocol imap { mail_max_userip_connections = 10 mail_plugins = " quota imap_quota antispam" }

2 1

`mail_crypt` Doesn't Appear to be Working
by jordan.h＠startmail.com 17 Feb '18

17 Feb '18

Dovecot version: 2.2.22 (fe789d2) I generated an EC key from the page https://wiki2.dovecot.org/Plugins/. For reference here's my /etc/dovecot/conf.d/10-mail-crypt.conf file: ---- mail_plugins = $mail_plugins mail_crypt plugin { # mail_crypt_global_private_key = </etc/dovecot/ecprivkey.pem mail_crypt_global_public_key = </etc/dovecot/ecpubkey.pem mail_crypt_save_version = 2 } ---- I saw in a previous message on this mailing list that messages can be encrypted without the private key, so it's stored elsewhere. :-) After restarting dovecot and sending myself a message I found that the message was still unencrypted. Nothing in /var/log/dovecot/*.log files or syslog indicated any problem loading the plugin (I even made some mistakes with the filename beforehand, and errors indicated it was trying to find the plugin). In case in matters dovecot was installed as part of the automated iredmail install (https://iredmail.org) I didn't modify the dovecot.conf file after installation (except for thinking I needed to add `mail_crypt` to `plugins`, then figuring I didn't). Any help is appreciated. Thank you.

2 1

Director & Master Users
by Travis Dolan 16 Feb '18

16 Feb '18

Hello, I have Director setup to proxy requests to backend servers. This works fine when using "standard" username/passwords. I am not try to enable the use of the Dovecot Master user through Director into the backend servers. a.) username is being sent as masteruser*username b.) request hits the proxy and authenticates, and then is passed to the backend servers and fails auth. - logs from proxy/Director point of view. auth: Info: passwd-file(masteruser,172.31.33.224,master,<z2eYD0Rl6P+sHyHg>): Master user logging in as devteam imap-login: Info: proxy(devteam): Login failed to backend.servers:143 (master masteruser): [AUTHENTICATIONFAILED] Authentication failed.: user=<devteam>, method=PLAIN, rip=172.31.33.224, lip=192.168.71.20, session=<z2eYD0R l6P+sHyHg> - logs from backend server point of view. imap-login: Info: Disconnected (auth failed, 1 attempts in 2 secs): user=<masterusername>, method=PLAIN, rip=192.168.71.20, lip=192.168.71.99, session=<O8QN8kNlloXAqEcU> Proxy/Director Configs (hopefully this is enough) auth_master_user_separator = * passdb { driver = passwd-file args = /etc/dovecot/conf.d/master-user-password master = yes pass = yes } passdb { driver = static args = proxy=y nopassword=y } Please let me know if I can provide any further details. Thanks in advance.

3 5

Selective authentication mechanism
by Brian Topping 16 Feb '18

16 Feb '18

Hi all! I have been using GSSAPI authentication method for all my externally reachable endpoints for some time under the theory that they cannot be hit with a dictionary attack. Unfortunately, this means iOS devices cannot log in since they (oddly) cannot use GSSAPI. I say “oddly” because desktop Mac mail can use GSSAPI just fine and https://samuelyates.wordpress.com/2013/10/11/kerberos-single-sign-on-in-ios… goes through how to set it up for web pages. In any event, what I’m looking to do is use a filter (https://wiki.dovecot.org/ConfigFile#Filters) around the auth_mechanisms such that it will allow plain authentication when the client is on a local network or the VPN. Unfortunately, the fine print on filters says "These filters work for most of the settings, but most importantly auth settings currently only support the protocol filter”. I guess it’s kind of academic, but I thought I’d ask why this is a limitation? If there is not a profound security reason to not support this, is this a good enough use case to consider it? Thanks! Brian

2 1