- dovecot - dovecot.org

RE: pop3-login core dump when using TLSSTART on version dovecot-2.2.32 (INTERNAL)
by Arvid.Eikas＠telenor.com 11 Sep '17

11 Sep '17

Hi, Here is the gdb output. Arvid GNU gdb (GDB) Red Hat Enterprise Linux 7.6.1-94.el7 Copyright (C) 2013 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html> This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type "show copying" and "show warranty" for details. This GDB was configured as "x86_64-redhat-linux-gnu". For bug reporting instructions, please see: <http://www.gnu.org/software/gdb/bugs/>... Reading symbols from /local/misc/mail/dovecot-32/libexec/dovecot/pop3-login...done. [New LWP 15894] Core was generated by `dovecot-test/pop3-login'. Program terminated with signal 6, Aborted. #0 0x00007ff0bd9cf1d7 in raise () from /lib64/libc.so.6 Missing separate debuginfos, use: debuginfo-install glibc-2.17-157.el7_3.1.x86_64 (gdb) bt full #0 0x00007ff0bd9cf1d7 in raise () from /lib64/libc.so.6 No symbol table info available. #1 0x00007ff0bd9d08c8 in abort () from /lib64/libc.so.6 No symbol table info available. #2 0x00007ff0bd3c0f2f in engine_unlocked_finish (e=0x1c51c60, unlock_for_handlers=1) at eng_init.c:115 to_return = 1 #3 0x00007ff0bd3c1064 in ENGINE_finish (e=0x1c51c60) at eng_init.c:150 to_return = 1 #4 0x00007ff0be0f9300 in ssl_proxy_deinit () from /local/nextmail/dovecot/lib64/dovecot/libdovecot-login.so.0 No symbol table info available. #5 0x00007ff0be0f4472 in main_deinit () from /local/nextmail/dovecot/lib64/dovecot/libdovecot-login.so.0 No symbol table info available. #6 0x00007ff0be0f479f in login_binary_run () from /local/nextmail/dovecot/lib64/dovecot/libdovecot-login.so.0 No symbol table info available. #7 0x00000000004032da in main (argc=1, argv=0x7ffe3059f3f8) at client.c:356 No locals. -----Original Message----- From: Aki Tuomi [mailto:aki.tuomi@dovecot.fi] Sent: 8. september 2017 14:08 To: Eikås Arvid; dovecot(a)dovecot.org Subject: Re: pop3-login core dump when using TLSSTART on version dovecot-2.2.32 (OPEN) I assume you mean STARTTLS. Can you provide gdb /path/to/bin /path/to/core and provide output of bt full? Aki On 08.09.2017 15:01, Arvid.Eikas(a)telenor.com wrote: > Hi, > > Pop3-login are CORE-dumping when I log on with TLSSTART, I believe the same will happen with imap-logon to, but I have not tested it yet. > The TLS session is coming up and it works fine until I log off, then it's core dump. Open sslvesrion is openssl-1.0.2k. > We ran dovecot-2.2.27 before we upgraded to dovecote-2.2.32, and that > seems to work fine. (not core dumping) > > > Arvid > > > LOG > Sep 05 14:27:34 pop3-login: Debug: SSL: elliptic curve secp384r1 will > be used for ECDH and ECDHE key exchanges Sep 05 14:30:30 pop3-login: > Debug: SSL: elliptic curve secp384r1 will be used for ECDH and ECDHE > key exchanges Sep 05 14:30:30 pop3-login: Debug: SSL: elliptic curve > secp384r1 will be used for ECDH and ECDHE key exchanges Sep 05 > 14:30:42 pop3-login: Debug: SSL: elliptic curve secp384r1 will be used > for ECDH and ECDHE key exchanges Sep 05 14:30:42 pop3-login: Debug: > SSL: elliptic curve secp384r1 will be used for ECDH and ECDHE key > exchanges Sep 05 14:30:50 pop3-login: Info: Login: user=<tstrand>, > method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, mpid=18361, secured, > session=<65m8ZXBYtpN/AAAB> Sep 05 14:30:50 pop3-login: Error: > ENGINE_finish, bad functional reference count Sep 05 14:30:50 > pop3-login: Fatal: master: service(pop3-login): child 18359 killed > with signal 6 (core dumped) > > > > > > > From ./crypto/engine/eng_init.c > > ......... > int engine_unlocked_finish(ENGINE *e, int unlock_for_handlers) { > int to_return = 1; > > /* > * Reduce the functional reference count here so if it's the terminating > * case, we can release the lock safely and call the finish() handler > * without risk of a race. We get a race if we leave the count until > * after and something else is calling "finish" at the same time - > * there's a chance that both threads will together take the count from 2 > * to 0 without either calling finish(). > */ > e->funct_ref--; > engine_ref_debug(e, 1, -1); > if ((e->funct_ref == 0) && e->finish) { > if (unlock_for_handlers) > CRYPTO_w_unlock(CRYPTO_LOCK_ENGINE); > to_return = e->finish(e); > if (unlock_for_handlers) > CRYPTO_w_lock(CRYPTO_LOCK_ENGINE); > if (!to_return) > return 0; > } > #ifdef REF_CHECK > if (e->funct_ref < 0) { > fprintf(stderr, "ENGINE_finish, bad functional reference count\n"); > abort(); > > ......... > > /* The API (locked) version of "finish" */ int ENGINE_finish(ENGINE > *e) { > int to_return = 1; > > if (e == NULL) { > ENGINEerr(ENGINE_F_ENGINE_FINISH, ERR_R_PASSED_NULL_PARAMETER); > return 0; > } > CRYPTO_w_lock(CRYPTO_LOCK_ENGINE); > to_return = engine_unlocked_finish(e, 1); > CRYPTO_w_unlock(CRYPTO_LOCK_ENGINE); > if (!to_return) { > ENGINEerr(ENGINE_F_ENGINE_FINISH, ENGINE_R_FINISH_FAILED); > return 0; > } > return to_return; > }

2 1

Share Website certificate with SSL/STL Dovecot IMAP and Postifix SMTP
by Marco Marco 10 Sep '17

10 Sep '17

Hi guys, I've bought a certificate from the authority for my website to use to access in https mode. Is it possible to share the same pairs to authenticate the emails sent by postfix and Dovecot in order to avoid that client as Hotmail.it or Gmail intercept these as Spam? Thank you

2 1

Embeding a path in address extensions
by ＠lbutlr 09 Sep '17

09 Sep '17

I generate bcc backups with the pattern backups+DATE.user.domain.tld(a)myBackupDomain.tld (for example, backups+20170908.kremels.kreme.com(a)myBackupDomain.tld) This puts mail in …/.20170908.kremels.kreme.com/new What I would like to do is get the expansion to generate the following path …/.20170908/.kremels.kreme.com/new Of course the date changes everyday, but it will always be numeric if that helps. dovecot get the mail from postfix: dovecot unix - n n - - pipe flags=DRhu user=vpopmail:vchkpw argv=/usr/local/libexec/dovecot/dovecot-lda -f ${sender} -d ${user}@${nexthop} -m ${extension} -a ${original_recipient} Would it make more sense (or is it even possible) to split the extension in postfix or to do something with sieve? Or is there a character I can use in the extension that tells dovecot to create a path? Even though I am using a maildir structure for the backups, this "account" never accesses the mail via a MUA, only via the command line when an admin has to restore an email, so it would be much easier to deal with this with daily subfolders. Or, maybe I make the admins use an MUA? If so, I should replace most of these .'s with dashes… -- Apple broke AppleScripting signatures in Mail.app, so no random signatures.

1 1

can't get quota working. I use static userdb driver.
by Вадим Бажов 08 Sep '17

08 Sep '17

Hi, people ! Set up global quota according to docs to 2 Mb. Send more than ten Mb on the box. Mail still getting put in the box, no bounces, no error messages in logs, nothing to prevent mail to be delivered in overflooded mailbox. quota settings are: mail_plugins = quota lmtp_rcpt_check_quota = yes quota_full_tempfail = yes protocol lmtp { postmaster_address = postmaster # required mail_plugins = $mail_plugins sieve } protocol lda { mail_plugins = $mail_plugins sieve } protocol imap { mail_plugins = $mail_plugins imap_quota } plugin { quota = maildir:"User quota" quota_rule = *:storage=10M quota_rule3 = INBOX.Trash:storage=+10%% quota_exceeded_message = "552 5.2.2 Mailbox is full" } doveconf -n is attached. # doveadm quota get Quota name Type Value Limit % "User quota" STORAGE 0 10240 0 "User quota" MESSAGE 0 - # doveadm quota get -u vadim Quota name Type Value Limit % "User quota" STORAGE 0 10240 0 "User quota" MESSAGE 0 - # du -sh /var/mail/vadim/ 23M /var/mail/vadim/ I tried to pass quota_rule as an argument to userdb, quota is being parsed, but still doesn't work. I think problem is that dovecot can't (re)calculate the actual quota on disc (cant calculate how disk space mailbox is used), despite the fact that quota limit itself is configured correctly, since dovecot shows it in log and doveconf -n. What I am dong wrong ?

4 8

EOF from net_disconnect(fd)
by Steffan Cline 08 Sep '17

08 Sep '17

I’m working on an OS project from github. There are two parts: Dovecot plugin - https://github.com/st3fan/dovecot-xaps-plugin Daemon written in Go - https://github.com/st3fan/dovecot-xaps-daemon # dovecot --version 2.2.10 Both parts worked fine on CentOS 6 but I recently rebuilt them both for CentOS 7 and have run into some errors. The plugin sends a notification over a socket to the daemon. The daemon then processes the request and returns a message to the plugin. The plugin reads the response then closes the socket and at that point, I’m running into an issue. The daemon reports the following: read unix /tmp/xapsd.sock->@: read: connection reset by peer In reading the Go language docs, it says that it will throw the first error it hits before the EOF from the socket. This led me to think that perhaps the plugin was not sending an EOF when closing the socket. I tried to write an EOF to the socket before the close but no change. Everything works between the plugin and daemon right up until the socket close. Is there a way to monitor the stream through the socket so I can see if the plugin is indeed sending the EOF? Knowing that lets me know if I need to chase down the issue in the Go daemon code. I’m no pro with C but I tried. The snippet from the plugin follows: alarm(1); { if (net_transmit(fd, str_data(req), str_len(req)) < 0) { i_error("write(%s) failed: %m", socket_path); ret = -1; } else { char res[1024]; ret = net_receive(fd, res, sizeof(res)-1); if (ret < 0) { i_error("read(%s) failed: %m", socket_path); } else { res[ret] = '\0'; if (strncmp(res, "OK ", 3) == 0) { ret = 0; } } } } alarm(0); char stx[1]; stx[0]=(char) 4; //stx[1]='\0'; if ( net_transmit(fd, stx, sizeof(stx) ) < 0 ) { i_error("Error writing EOF"); } //string_t *testEOF= t_str_new(2); //str_append(testEOF, (char*) 4); //if ( net_transmit(fd, str_data(testEOF), str_len(testEOF) ) < 0 ) { // i_error("Error writing EOF"); // } //i_close_fd(&fd); net_disconnect(fd); fd=-1; Thank you, Steffan Cline 602-793-0014

3 6

Automatic DB password hash scheme selection
by Kurt Fitzner 08 Sep '17

08 Sep '17

Hi all, Is there a way to get dovecot to recognize arbitrary password hash schemes when looking up a password in a database? I originally set up with #default_pass_scheme = MD5, and I would like to migrate to SHA512. Seeing as the scheme is actually stored in the password column along with the password in the format $_<scheme#>_$_<salt>_$_<passwordhash>_, it seems to me that dovecot should be able to look at the scheme number and simply do the right thing. If this is possible, then migrating passwords over would be much easier, since people will still be able to log in with their old MD5-hashed password and the changer can be set up to hash with the new method. Is this possible currently? Thanks, Kurt

2 2

Hide public mailboxes from some users
by Arie Peterson 08 Sep '17

08 Sep '17

Hi all, I'm trying to set up public mailboxes for a subset of my users. This is on dovecot 2.2.27. I've created a new public namespace, and the new mailboxes indeed show up for everyone. So far so good. Now I want to restrict access: these mailboxes shouldn't be visible at all except to a fixed list of users. This part I can't seem to get working. I've added acl data along these lines: ``` pubbox anyone pubbox/* anyone pubbox user=me(a)example.com lrwstipekxa pubbox/* user=me(a)example.com lrwstipekxa ``` However, other users can still see "pubbox" and its subfolders, although they can't actually view the contents. This is corroborated by some of the output of `doveadm mailbox list`: ``` # doveadm -D mailbox list -u other(a)example.com … doveadm(other(a)example.com): Debug: Namespace : type=public, prefix=pubbox/, sep=/, inbox=no, hidden=no, list=children, subscriptions=no … doveadm(other(a)example.com): Debug: Mailbox 'pubbox/Drafts' matches global ACL pattern 'pubbox/*' doveadm(other(a)example.com): Debug: Mailbox 'pubbox/Drafts' matches global ACL pattern 'pubbox/*' doveadm(other(a)example.com): Debug: acl vfile: reading file /mnt/data/mail/example.com/public/pubbox/mail/Drafts/dovecot-acl doveadm(other(a)example.com): Debug: acl: No lookup right to mailbox: pubbox/Drafts doveadm(other(a)example.com): Debug: Mailbox 'pubbox/Sent' matches global ACL pattern 'pubbox/*' doveadm(other(a)example.com): Debug: Mailbox 'pubbox/Sent' matches global ACL pattern 'pubbox/*' doveadm(other(a)example.com): Debug: acl vfile: reading file /mnt/data/mail/example.com/public/pubbox/mail/Sent/dovecot-acl doveadm(other(a)example.com): Debug: acl: No lookup right to mailbox: pubbox/Sent doveadm(other(a)example.com): Debug: Mailbox 'pubbox' matches global ACL pattern 'pubbox' doveadm(other(a)example.com): Debug: Mailbox 'pubbox' matches global ACL pattern 'pubbox' doveadm(other(a)example.com): Debug: acl vfile: reading file /mnt/data/mail/example.com/public/pubbox/mail/dovecot-acl pubbox pubbox/Drafts pubbox/Sent INBOX ``` Why do these "pubbox/*" mailboxes show up in the `mailbox list` output, even though the debug messages say that the user has no lookup right for them? `doveadm acl rights` seems to confirm that `other(a)example.com` does not have the lookup right for these mailboxes. So why do they show up in their email clients anyway? Thanks for any advice!

1 2

password reset
by ＠lbutlr 08 Sep '17

08 Sep '17

This is off topic, but I am not sure where to go. I have a local user who cannot login because of a forgotten password, so I went to reset her password with sudo passed <user> Which appears to work, asking for a new password and a confirmation. No error occurs (unless I give it unmatched passwords), but the password is not changed. if I try to change the password in the user's account (after su <user>) t requires the old password. running on FreeBSD 11.0 When I try to change the password with sudo, the timestamp on /etc/passwd gets updated but there is nothing logged to anything in /var/log/

4 6

pop3-login core dump when using TLSSTART on version dovecot-2.2.32 (OPEN)
by Arvid.Eikas＠telenor.com 08 Sep '17

08 Sep '17

Hi, Pop3-login are CORE-dumping when I log on with TLSSTART, I believe the same will happen with imap-logon to, but I have not tested it yet. The TLS session is coming up and it works fine until I log off, then it's core dump. Open sslvesrion is openssl-1.0.2k. We ran dovecot-2.2.27 before we upgraded to dovecote-2.2.32, and that seems to work fine. (not core dumping) Arvid LOG Sep 05 14:27:34 pop3-login: Debug: SSL: elliptic curve secp384r1 will be used for ECDH and ECDHE key exchanges Sep 05 14:30:30 pop3-login: Debug: SSL: elliptic curve secp384r1 will be used for ECDH and ECDHE key exchanges Sep 05 14:30:30 pop3-login: Debug: SSL: elliptic curve secp384r1 will be used for ECDH and ECDHE key exchanges Sep 05 14:30:42 pop3-login: Debug: SSL: elliptic curve secp384r1 will be used for ECDH and ECDHE key exchanges Sep 05 14:30:42 pop3-login: Debug: SSL: elliptic curve secp384r1 will be used for ECDH and ECDHE key exchanges Sep 05 14:30:50 pop3-login: Info: Login: user=<tstrand>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, mpid=18361, secured, session=<65m8ZXBYtpN/AAAB> Sep 05 14:30:50 pop3-login: Error: ENGINE_finish, bad functional reference count Sep 05 14:30:50 pop3-login: Fatal: master: service(pop3-login): child 18359 killed with signal 6 (core dumped) >From ./crypto/engine/eng_init.c ......... int engine_unlocked_finish(ENGINE *e, int unlock_for_handlers) { int to_return = 1; /* * Reduce the functional reference count here so if it's the terminating * case, we can release the lock safely and call the finish() handler * without risk of a race. We get a race if we leave the count until * after and something else is calling "finish" at the same time - * there's a chance that both threads will together take the count from 2 * to 0 without either calling finish(). */ e->funct_ref--; engine_ref_debug(e, 1, -1); if ((e->funct_ref == 0) && e->finish) { if (unlock_for_handlers) CRYPTO_w_unlock(CRYPTO_LOCK_ENGINE); to_return = e->finish(e); if (unlock_for_handlers) CRYPTO_w_lock(CRYPTO_LOCK_ENGINE); if (!to_return) return 0; } #ifdef REF_CHECK if (e->funct_ref < 0) { fprintf(stderr, "ENGINE_finish, bad functional reference count\n"); abort(); ......... /* The API (locked) version of "finish" */ int ENGINE_finish(ENGINE *e) { int to_return = 1; if (e == NULL) { ENGINEerr(ENGINE_F_ENGINE_FINISH, ERR_R_PASSED_NULL_PARAMETER); return 0; } CRYPTO_w_lock(CRYPTO_LOCK_ENGINE); to_return = engine_unlocked_finish(e, 1); CRYPTO_w_unlock(CRYPTO_LOCK_ENGINE); if (!to_return) { ENGINEerr(ENGINE_F_ENGINE_FINISH, ENGINE_R_FINISH_FAILED); return 0; } return to_return; }

2 1

Strange SASL issue
by Antoine Nguyen 07 Sep '17

07 Sep '17

Hi all, I've just upgraded my server from debian 8 to debian 9 and I now encounter a strange issue. I'm using prosody (XMPP server), configured to authenticate against dovecot using SASL and a unix socket. This setup was working fine on debian 8. Now, each time I try to connect using my XMPP client, the authentication fails and I see the following error in logs: auth: Error: BUG: Authentication client said it's PID 0 Have you ever heard about this? For information, dovecot version is 2.2.27. Thank you, Antoine Nguyen

4 6