- dovecot - dovecot.org

logins fail for virtual users (permission denied, we're not in group 5000)
by Paul Schreiber 17 Sep '17

17 Sep '17

I have: - Ubuntu 17.04 - Dovecot 2.2.27 (c0f36b0) - Postfix 3.1.4 - regular unix users with mail in /home/bob/Maildir - virtual users with mail in /var/mail/vhosts/domain.com/bob/ The regular users can receive mail as expected. When virtual users try to log in, it fails. The log shows an error like this: 2017-09-14 22:44:55 auth: Error: passwd-file(travler(a)travler.net,54.210.254.169,<EYwzYDFZWoY20v6p>): stat(/var/mail/vhosts/travler.net/shadow) failed: Permission denied (euid=114(dovecot) egid=121(dovecot) missing +x perm: /var/mail/vhosts, we're not in group 5000(vmail), dir owned by 5000:5000 mode=0750) A previous user had a similar problem in 2015: https://dovecot.org/list/dovecot/2015-July/101469.html He was advised to look at https://wiki2.dovecot.org/UserIds … without being given more specific advice. I looked at the page. I tried adding mail_uid and mail_gid. No luck. In my case, I see: # sudo -u dovecot groups dovecot vmail # sudo -u dovecot cat /var/mail/vhosts/travler.net/shadow <file contents> I have a vmail user: # id vmail uid=5000(vmail) gid=5000(vmail) groups=5000(vmail) # ls -la /var/mail/vhosts total 0 drwxr-s--- 1 vmail vmail 246 Jun 30 11:23 . drwxrwsrwt 1 mail mail 26 Dec 5 2016 .. drwxr-s--- 1 vmail vmail 66 Sep 14 23:11 travler.net # ls -l /var/mail/vhosts/travler.net/ total 8 -rwxr-s--- 1 vmail vmail 174 Dec 5 2016 passwd -rwxr-s--- 1 vmail vmail 173 Dec 5 2016 shadow drwxr-s--- 1 vmail vmail 450 Sep 9 13:16 travis.belmont drwxr-s--- 1 vmail vmail 750 Sep 13 14:14 travler I've set mail_gid and mail_uid # doveconf -n|grep id mail_gid = 5000 mail_uid = 5000 Here's my full config: # doveconf -n # 2.2.27 (c0f36b0): /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.16 (fed8554) # OS: Linux 4.10.0-33-generic x86_64 Ubuntu 17.04 btrfs log_path = /var/log/dovecot log_timestamp = "%Y-%m-%d %H:%M:%S " mail_gid = 5000 mail_location = maildir:/home/%u/Maildir mail_privileged_group = mail mail_uid = 5000 namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { driver = pam } passdb { args = username_format=%n /var/mail/vhosts/%d/shadow driver = passwd-file } plugin { sieve = file:~/sieve;active=~/.dovecot.sieve } protocols = " imap" service auth { unix_listener /var/spool/postfix/private/auth { mode = 0666 } } service imap-login { inet_listener imap { port = 0 } } ssl_cert = [snip] ssl_cipher_list = [snip] ssl_dh_parameters_length = 2048 ssl_key = # hidden, use -P to show it ssl_protocols = !SSLv3 !SSLv2 userdb { driver = passwd } userdb { args = username_format=%n /var/mail/vhosts/%d/passwd driver = passwd-file } What do I need to set to get dovecot to run as vmail / fix this error? Paul

2 4

What INTERNALDATE does dovecot with mbox storage set on a COPY'd message?
by Steinar Bang 15 Sep '17

15 Sep '17

When a message is copied to a folder on dovecot with mbox storage, is the mtime of the saved mbox file set to the time of the save? Or is the mtime set to the Date: field of the source message that is saved? If there is a difference in the behaviour, do someone know the dovecot version number where the change happened? The reason I'm asking is a problem reported on the Gnus imap client in August 2016, where messaged moved by Gnus showed up with the wrong order and/or wrong date in other imap clients. (The reason for the different message ordering was that the other clients use the INTERNALDATE and that was changed to the time of message move when Gnus was used. Gnus use the Date of the source message) Thanks! - Steinar (Gnus user)

2 4

[RFC master-2.2 0/1] Support OpenSSL 1.1 API for setting allowed TLS versions
by Apollon Oikonomopoulos 14 Sep '17

14 Sep '17

Hi, I came up with the following patch while trying to figure out a good solution for the situation described in Debian bug #871987[1]. In short, OpenSSL in Debian unstable has disabled TLSv1.0 and TLSv1.1 *by default*. That means that unless an application requests otherwise, only TLSv1.2 is supported. In the world of e-mail this is seemingly an issue, as there are still way too many old clients out there supporting only TLSv1 or TLSv1.1. Now, traditionally OpenSSL 0.9.8/1.0 used SSL_CTX_set_options() to allow *disabling* specific protocols, without offering a way to enable previously disabled protocols. OpenSSL 1.1 introduced a dedicated API[2] to set allowed protocol versions, taking a linear version approach: the application may request a minimum and a maximum allowed version (inclusive), allowing all versions inbetween as well. Dovecot's existing ssl_protocols option is probably not ideal to use with this new "linear" model. Instead, I introduced two new options, ssl_min_proto_version and ssl_max_proto_version, that map directly to OpenSSL 1.1 concepts. I have tested the patch with both OpenSSL 1.0 and OpenSSL 1.1. With OpenSSL 1.1 it works as expected; with OpenSSL 1.0 it doesn't seem to break anything. Other than that, this is a first version; I'm sure there are still things to improve, so comments are welcome :) Regards, Apollon [1] https://bugs.debian.org/871987 [2] https://www.openssl.org/docs/man1.1.0/ssl/SSL_CTX_set_min_proto_version.html Apollon Oikonomopoulos (1): Support setting min/max SSL protocol version doc/example-config/conf.d/10-ssl.conf | 4 ++++ src/config/config-parser.c | 25 +++++++++++++++++++++ src/lib-master/master-service-ssl-settings.c | 4 ++++ src/lib-master/master-service-ssl-settings.h | 2 ++ src/lib-master/master-service-ssl.c | 2 ++ src/lib-ssl-iostream/iostream-openssl-common.c | 12 +++++++++++ src/lib-ssl-iostream/iostream-openssl.h | 1 + src/lib-ssl-iostream/iostream-ssl.h | 2 ++ src/login-common/ssl-proxy-openssl.c | 30 ++++++++++++++++++++++++++ 9 files changed, 82 insertions(+) -- 2.14.1

2 2

disable imap for ldap user
by Markus Rosjat 13 Sep '17

13 Sep '17

hi there, I have a LDAP dir with an attribute set to 0 or 1 and in my old setup (a courier server) I used this attribute to map it to an authoption called disableimap. This prevent users to access the mailbox with imap protocol. So the question is what should I set in dovecot to get the same behaviour? I looked at the docs but the part with the pass_ilter and service doesn't really fit. Some advice would be appreciated regards -- Markus Rosjat fon: +49 351 8107223 mail: rosjat(a)ghweb.de G+H Webservice GbR Gorzolla, Herrmann Königsbrücker Str. 70, 01099 Dresden http://www.ghweb.de fon: +49 351 8107220 fax: +49 351 8107227 Bitte prüfen Sie, ob diese Mail wirklich ausgedruckt werden muss! Before you print it, think about your responsibility and commitment to the ENVIRONMENT

3 4

Problems to configure IMAP Quota
by Jacques Belin 13 Sep '17

13 Sep '17

Hello, We manage a mail server using Dovecot under Debian. Since a long time, we run nightly a script permitting to display the storage usage of each user on the webmail, using internal calls. The usage on each mailbox is stored in a Mysql database. For several reasons, we would now want to use the IMAP quota feature, not only to let users have the quota displayed from their Mail clients. But testing that features, I encounter two problems : 1) It seems that when we use the sql dict, a map contaning the patern "priv/quota/limit/messages" is mandatory. Not specifying it in dovecot-dict-sql.conf.ext issues an error. As we are interested only by the storage size and don't want to process the number of messages, how to get rid of it ? 2) We store the storage value in kilobytes. But the plugin seems to only accept storage in bytes, Is there any way to let know to dovecot that the value stored in the database is in kilobytes ? (of course, I tried to put "size/1024" in the value_field field of the map. It works, but generate a lot of error lines in the dovecot log as it create a syntaxly incorrect MySQL uodate request...) Jacques. -- The last man connected to the Interet was browsing some old WebSites. "You have new mail" appeared on the screen... --------------------------- adapted from a short Fredric Brown's story

3 3

concering dovecot logging
by Rajesh M 13 Sep '17

13 Sep '17

hi had a question concerning dovecot lda logging. deliver_log_format = From:<%f>-<%e> :: Subject:<%s> :: Status:<%$> :: MsgID:<%m> :: Size<%p> :: vSize<%w> am getting %e ie envelope sender as MAILER-DAEMON in the logs Sep 11 08:35:50 lda(noc(a)xxx.com): Info: sieve: From:<bmmsro0612(a)xxx.co.in>-<MAILER-DAEMON> :: Subject:<Fw: ccccccn> :: Status:<forwarded to <nocforward(a)yyyyy.com>> :: MsgID:<<OFBECDF3FA.57B3772C-ON65258198.00111392-65258198.00111394(a)xxx.co.in>> :: Size<12497> :: vSize<12687> what could be the reason ? thanks, rajesh

2 1

Problem w/ Dovecot authentication against AD
by Garry Glendown 13 Sep '17

13 Sep '17

Hi, I had to start using Dovecot on a machine as the new OS does not come with Cyrus IMAP anymore. After multiple problems, I managed to get everything working, including LDAP authentication against the (old) Novell LDAP server. Anyway, the authentication is supposed to be migrated to the new Windows AD. For other tools, I successfully migrated the config to use AD, but somehow Dovecot does not work as it should. I've been going back and forth, trying everything I could think of, but still can't get it to work. Here's the excerpt from the config file: hosts = 10.10.10.210 uris = ldap://10.10.10.210:389 dn = cn=Administrator,cn=Users,dc=srv,dc=SLD,dc=net dnpass = PASSWORD tls = no debug_level = -1 auth_bind = yes ldap_version = 3 base = DC=srv,dc=SLD,dc=net deref = never scope = subtree user_attrs = sAMAccountName=user user_filter = (&(sAMAccountName=%n)(objectclass=person)) pass_attrs = sAMAccountName=user pass_filter = (&(sAMAccountName=%n)(objectclass=person)) iterate_attrs = mail=user iterate_filter = (objectclass=person) default_pass_scheme = PLAIN The problem might be caused by the referal-info sent by the AD, which I can see both in the results dovecot gets (checked with tcpdump), as well as in ldapsearch ... apart from the actual search result, I always get three additional results: # refldap://DomainDnsZones.srv.SLD.net/DC=DomainDnsZones,DC=srv,DC=SLD,DC=net # refldap://ForestDnsZones.srv.SLD.net/DC=ForestDnsZones,DC=srv,DC=SLD,DC=net # refldap://srv.SLD.net/CN=Configuration,DC=srv,DC=SLD,DC=net >From what I can see in the pcap as well as some of the logs, dovecot binds to the AD, sends out the LDAP query correctly, gets the lookup result with the user queried plus the above three referrals, then unbinds from the (named) bind, attempts a simple bind without dn/dnpass (multiple times), and finally sends three additional search requests under the search bases cn=Configuration,DC=srv,DC=SLD,DC=net DC=ForestDnsZones,DC=srv,DC=SLD,DC=net DC=DomainDnsZones,DC=srv,DC=SLD,DC=net These three requests are denied by the AD as they are not permitted without a successful prior bind. Dovecot then fails the auth process. Is there a way to stop Dovecot from using the referals? Openldap seems to have an option to disable referals, but Dovecot does not allow that option in its LDAP config, and having the option set in the global ldap.conf doesn't seem to help any, either. Is there possibly a way to disable the referal information on the AD side? Thanks, Garry -- PGP Fingerprint: A79F A33F 5B13 BEB7 A51D 274F F99C 3AE2 4BCB 7015

3 3

Re: Dovecot and Letsencrypt certs
by Daniel Miller 13 Sep '17

13 Sep '17

And remove that "postfix reload" command - Postfix doesn't require explicit reloading. It'll pickup the changed cert automagically. Daniel On 9/12/2017 9:26 AM, Daniel Miller wrote: > What's wrong with using a certbot "post-hook" script such as: > > #!/bin/bash > echo "Letsencrypt renewal hook running..." > echo "RENEWED_DOMAINS=$RENEWED_DOMAINS" > echo "RENEWED_LINEAGE=$RENEWED_LINEAGE" > > if grep --quiet "your.email.domain" <<< "$RENEWED_DOMAINS"; then > /usr/local/sbin/dovecot reload > /usr/sbin/postfix reload > fi > > Daniel > > On 9/11/2017 1:57 PM, Joseph Tam wrote: >> <master(a)remort.net> writes: >> >>> "writing a script to check the certs" - there is no need to write any >>> scripts. As one mentioned, it's done by a hook to certbot. Please read >>> the manuals for LE or certbot. The issue you have is quite common and >>> of course certbot designed to do it for you. >> >> Won't work, of course, if you employ the least-privilege security >> principle >> and run the certbot as a non-privileged user. You'll need a script with >> administrator privileges to detect cert renewals and restart the >> service. >> >> I can't willy-nilly restart dovecot to pick up renewed certs without >> webmail disruptions. (My webmail uses persistent IMAP sessions.) >> All users get dumped and need to re-authenticate. If a user happens to >> be drafting a message that took 2 hours to compose, I will surely hear >> about it. I should probably install a IMAP proxy to isolate the effects >> of restarts. Most mail readers cope with restarts just fine, though. >> >> Joseph Tam <jtam.home(a)gmail.com>

3 3

Re: Dovecot and Letsencrypt certs
by Joseph Tam 13 Sep '17

13 Sep '17

On Tue, 12 Sep 2017, dovecot-request(a)dovecot.org wrote: > What's wrong with using a certbot "post-hook" script such as: > > #!/bin/bash > echo "Letsencrypt renewal hook running..." > echo "RENEWED_DOMAINS=$RENEWED_DOMAINS" > echo "RENEWED_LINEAGE=$RENEWED_LINEAGE" > > if grep --quiet "your.email.domain" <<< "$RENEWED_DOMAINS"; then > ??? /usr/local/sbin/dovecot reload > ?? /usr/sbin/postfix reload > fi Nothing, if you let your certbot run as root. (I'm assuming that's how these hooks work -- it's called after cert renewal using the same credentials as the certbot.) If you use privilege separation, and run the certbot as a regular user process, this won't work. You might have this scenario if, for example using the context of web serving, you serve many virtual sites with different owners, and you don't want give each owner administrative access. Joseph Tam <jtam.home(a)gmail.com>

2 1

Dynamic host with password plugin
by Jorge Bastos 12 Sep '17

12 Sep '17

Howdy, I’m making my multi-server instalation ready, but I’m facing just one small issue, that is with password plugin. So, in config.inc.php of it I have: config['password_db_dsn'] = 'mysql://webmail:bdkddddddz@192.168.69.222/postfix'; but, as I’m using in roundcube’s config.inc.php “dynamic” host: $config['default_host'] = 'mail.%s'; Can I have in the password plugin config.inc.php the same variable? (I can use same user/password/db on both servers for password change) Thanks in advanced,

1 0