- dovecot - dovecot.org

Dovecot login is slow
by Mitocariu Emilian 08 Jun '17

08 Jun '17

Hi, I have an Ubuntu 16.04 server with dovecot 2.2.22 configured as an imap server with an LDAP backend for authentication. This is the output of "dovecot -n": # 2.2.22 (fe789d2): /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.13 (7b14904) # OS: Linux 4.4.0-77-generic x86_64 Ubuntu 16.04.2 LTS auth_debug_passwords = yes mail_gid = vmail mail_location = maildir:~/ mail_privileged_group = mail mail_uid = vmail namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } protocols = imap lmtp service auth { unix_listener /var/spool/postfix/private/auth { mode = 0666 } } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } ssl_cert = </path/to/my/cert ssl_key = </path/to/my/key userdb { args = /etc/dovecot/dovecot-ldap.conf.ext default_fields = home=/var/mail/vmail/%n driver = ldap } The problem i'm having is that when i try to login it takes more than 10 seconds, making my webmail very slow. For testing i login to imap like this "openssl s_client -connect localhost:993" and sometimes i get this message "* OK Waiting for authentication master process to respond..". I saw at other people, one of the problem was because they didn't disabled pam authentication when using another backend (like ldap or sql), but i already did that. Does anyone know what could cause such long login times and how to fix it?

2 1

Segmentation fault in imap_bodystructure_is_plain_7bit
by mihaiush 08 Jun '17

08 Jun '17

Hi, I have a lot of errors like this in my log: Fatal: master: service(imap): child 26049 killed with signal 11 (core dumped) Dovecot 2.2.18 build from sources ./configure --prefix=/opt/dovecot2 --with-mysql --with-sqlite --with-solr --with-ssl --disable-rpath --disable-static. Debian Wheezy 3.2.63-2 x86_64. Filesystem is ZFS. All the core files are similar: $ gdb /opt/dovecot2/libexec/dovecot/imap core GNU gdb (GDB) 7.4.1-debian Copyright (C) 2012 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html > This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type "show copying" and "show warranty" for details. This GDB was configured as "x86_64-linux-gnu". For bug reporting instructions, please see: <http://www.gnu.org/software/gdb/bugs/>... Reading symbols from /opt/dovecot2/libexec/dovecot/imap...done. [New LWP 11635] warning: Can't read pathname for load map: Input/output error. [Thread debugging using libthread_db enabled] Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1". Core was generated by `/opt/dovecot2/libexec/dovecot/imap imap-postlogin'. Program terminated with signal 11, Segmentation fault. #0 imap_bodystructure_is_plain_7bit (part=part@entry=0x234cd50) at imap-bodystructure.c:458 458 if (data->content_subtype != NULL && (gdb) bt #0 imap_bodystructure_is_plain_7bit (part=part@entry=0x234cd50) at imap-bodystructure.c:458 #1 0x00007f920a0fbfaf in index_mail_body_parsed_cache_flags (mail=0x234be60) at index-mail.c:587 #2 index_mail_parse_body_finish (mail=mail@entry=0x234be60, field=field@entry=MAIL_CACHE_IMAP_BODYSTRUCTURE, success=success@entry=true) at index-mail.c:1007 #3 0x00007f920a0fc369 in index_mail_parse_body (mail=mail@entry=0x234be60, field=field@entry=MAIL_CACHE_IMAP_BODYSTRUCTURE) at index-mail.c:1081 #4 0x00007f920a0fc498 in index_mail_parse_bodystructure (mail=mail@entry=0x234be60, field=field@entry=MAIL_CACHE_IMAP_BODYSTRUCTURE) at index-mail.c:1222 #5 0x00007f920a0fcf1c in index_mail_get_special (_mail=_mail@entry=0x234be60, field=field@entry=MAIL_FETCH_IMAP_BODYSTRUCTURE, value_r=value_r@entry=0x7ffc1518fde8) at index-mail.c:1379 #6 0x00007f920a0b29cd in dbox_mail_get_special (_mail=_mail@entry=0x234be60, field=field@entry=MAIL_FETCH_IMAP_BODYSTRUCTURE, value_r=value_r@entry=0x7ffc1518fde8) at dbox-mail.c:229 #7 0x00007f920a0a83f0 in mdbox_mail_get_special (_mail=0x234be60, field=MAIL_FETCH_IMAP_BODYSTRUCTURE, value_r=0x7ffc1518fde8) at mdbox-mail.c:213 #8 0x00007f920a08f96d in mail_get_special (mail=<optimized out>, field=field@entry=MAIL_FETCH_IMAP_BODYSTRUCTURE, value_r=value_r@entry=0x7ffc1518fde8) at mail.c:317 #9 0x0000000000419a6a in fetch_bodystructure (ctx=0x232bbd8, mail=<optimized out>, context=<optimized out>) at imap-fetch.c:690 #10 0x0000000000419f9f in imap_fetch_more_int (ctx=ctx@entry=0x232bbd8, cancel=false) at imap-fetch.c:506 #11 0x000000000041af07 in imap_fetch_more (ctx=0x232bbd8, cmd=cmd@entry=0x232ba00) at imap-fetch.c:558 #12 0x000000000040f0c9 in cmd_fetch (cmd=0x232ba00) at cmd-fetch.c:286 #13 0x0000000000418aec in command_exec (cmd=cmd@entry=0x232ba00) at imap-commands.c:167 #14 0x0000000000417ad0 in client_command_input (cmd=cmd@entry=0x232ba00) at imap-client.c:814 #15 0x0000000000417b64 in client_command_input (cmd=0x232ba00) at imap-client.c:874 #16 0x0000000000417e45 in client_handle_next_command (remove_io_r=<synthetic pointer>, client=0x232ade0) at imap-client.c:912 #17 client_handle_input (client=client@entry=0x232ade0) at imap-client.c:924 #18 0x0000000000418212 in client_input (client=0x232ade0) at imap-client.c:966 #19 0x00007f9209df134b in io_loop_call_io (io=0x232b8f0) at ioloop.c:501 #20 0x00007f9209df1e5b in io_loop_handler_run_internal (ioloop=ioloop@entry=0x22ec790) at ioloop-epoll.c:220 #21 0x00007f9209df13d9 in io_loop_handler_run (ioloop=ioloop@entry=0x22ec790) at ioloop.c:548 #22 0x00007f9209df1458 in io_loop_run (ioloop=0x22ec790) at ioloop.c:525 #23 0x00007f9209d92993 in master_service_run (service=0x22ec620, callback=callback@entry=0x421140 <client_connected>) at master-service.c:581 #24 0x000000000040c60b in main (argc=2, argv=0x22ec390) at main.c:431 (gdb) q I wrote a patch which solved the problem but: - my C is absolutely basic, - dovecot is already at version 2.2.30, maybe problem was already fixed. Anyway I attached my patch, please have a look. Thanks.

1 0

Which allowed services can be defined (imap, pop3, etc.)
by Malte Schmidt 08 Jun '17

08 Jun '17

Hello, I am using Dovecot with an LDAP-backend for authentication. According to the documentation at https://wiki.dovecot.org/Authentication/RestrictAccess with LDAP and "pass_filter" it is possible to filter allowed services for the user with: pass_filter = (&(objectClass=posixAccount)(uid=%u)(service=%s)) Thats pretty cool. Now, in the LDAP-settings I created corresponding fields (service) and added the allowed services to tthese fields (imap, pop3, etc.). After that change, certain services were not available to that user anymore. So it seems that more services are there and after explicitly setting the services which are allowed, the other, not mentioned services stop to work. Now two questions: Is there any documented, full-featured list of the services that can be added? Is it possible to "flip" that setting so its not allowing certain services but denying the ones that are added to the "service"-fields? Cheers

2 3

Master users
by Noriyuki TAKEI 08 Jun '17

08 Jun '17

Hi,all What version of dovecot supports master users? Master users means as follows https://wiki2.dovecot.org/Authentication/MasterUsers -- ・‥…━━━━━━━━━━━━━━━━━━━━━━━…‥ サイオステクノロジー株式会社技術部クラウドソリューショングループ武井宜行〒106-0047 東京都港区南麻布二丁目 12 番 3 号サイオスビル TEL：03-6401-5314 (直通) 03-6401-5117 (部代表) URL：http://www.sios.com/ ■SIOSの最新情報はこちらから！「いいね！」をお待ちしています■ (SIOS Technology)：http://www.facebook.com/SIOSTechnology (OSSよろず相談室)：http://www.facebook.com/OSSyorozu ■Twitter公式アカウント■ https://twitter.com/#!/SIOS_Technology ・‥…━━━━━━━━━━━━━━━━━━━━━━━…‥

2 2

virtual isp address, local delivery
by Hugh Bragg 07 Jun '17

07 Jun '17

I'm trying to understand how to deliver mail to an address locally which is popped from my isps email account. I access and keep these emails backed up on dovecot and use postfix smtp to deliver mail. The problem is that while fetchmail uses dovecot lda directly, postfix can't include my isps domain in its $mydestination because I won't be able to send mail to other users in that domain. I want to be able to send mail to other users I'm popping for in that domain, or even send myself mail. Currently postfix just relays the mail to the isp and it returns through fetchmail, but I'd like to have it delivered locally and still be able to email my isp users that I don't pop. As far as I can tell, this can't be done because virtual users have to be in postfix $mydestination. Does someone have a better setup they can share or know how to do this? Hugh

2 3

doveadm sync SSL error when upgrading from 2.2.27 -> 2.2.29
by Pallissard, Matthew 07 Jun '17

07 Jun '17

I'm starting to see the following error from doveadm when upgrading from 2.2.27 to 2.2.29. > doveadm(ip.add.re.ss): Error: doveadm client disconnected before handshake: SSL_accept() failed: error:1417A0C1:SSL routines:tls_post_process_client_hello:no shared cipher I'm using a cert/key with the following curve. ASN1 OID: prime256v1 NIST CURVE: P-256 Downgrading to 2.2.27 resolves the issue. Does anyone know about this off the top of their head? If not I'll try to git-bisect 2.2.27->2.2.28 for any offending commits later on this week. -- Matt Pallissard

1 0

2.2.30.2 fails to compile on centos 7
by Matt Bryant 07 Jun '17

07 Jun '17

Just downloaded the latest release 2.2.30.2, ran ./configure with all defaults and make ... and it fails to build .. error somewhere whilst running Makefile in lib-http libtool: link: gcc -std=gnu99 -g -O2 -Wall -W -Wmissing-prototypes -Wmissing-declarations -Wpointer-arith -Wchar-subscripts -Wformat=2 -Wbad-function-cast -fno-builtin-strftime -Wstrict-aliasing=2 -Wl,--as-needed -o test-http-server-errors test-http-server-errors.o -Wl,--export-dynamic ./.libs/libhttp.a ../lib-dns/.libs/libdns.a ../lib-ssl-iostream/.libs/libssl_iostream.a ../lib-master/.libs/libmaster.a ../lib-settings/.libs/libsettings.a ../lib-test/.libs/libtest.a ../lib/.libs/liblib.a -ldl collect2: error: ld returned 1 exit status make[3]: *** [test-http-server-errors] Error 1 make[3]: Leaving directory `/home/rpmbuild/rpmbuild/BUILD/dovecot-2.2.30.2/src/lib-http' make[2]: *** [all-recursive] Error 1 make[2]: Leaving directory `/home/rpmbuild/rpmbuild/BUILD/dovecot-2.2.30.2/src' make[1]: *** [all-recursive] Error 1 make[1]: Leaving directory `/home/rpmbuild/rpmbuild/BUILD/dovecot-2.2.30.2' make: *** [all] Error 2 any ideas ?? 2.2.30.1 built ok ... rgds Matt

3 6

Moving from CentOS to GF RPMs
by Roger Klorese 07 Jun '17

07 Jun '17

Does anyone have fool-proof documentation for this fool on how to configure repos and what operations to perform to move from the distro RPMs to the GF ones without breaking stuff?

2 2

Re: v2.2.30.1
by Joseph Tam 07 Jun '17

07 Jun '17

Aki Tuomi <aki.tuomi(a)dovecot.fi> wrote: > On 06.06.2017 14:11, Olaf Hopp wrote: >> On 06/05/2017 11:05 AM, Angel L. Mateo wrote: >>> I have updated my dovecot proxy servers from 2.2.28 to 2.2.30. >>> Since the upgrade I'm having the error: >>> >>> Jun 5 10:54:51 musio12 dovecot: auth: Fatal: master: service(auth): >>> child 63632 killed with signal 11 (core not dumped) +1. > We have identified a bug in auth process, and are working with a fix. This is the 1 line context around the same thing I am seeing, if it helps. It seems to happen with brute force scanning Jun 6 06:13:30 server dovecot: imap-login: Warning: Auth connection closed with 1 pending requests (max 7 secs, pid=20675 , EOF) Jun 6 06:13:30 server dovecot: auth: Fatal: master: service(auth): child 20676 killed with signal 11 (core not dumped - set service auth { drop_priv_before_exec=yes }) Jun 6 06:13:30 server dovecot: imap-login: Disconnected (auth failed, 1 attempts in 7 secs): user=<{dead@account}>, method=PLAIN, rip=5.188.11.11, lip={my-ip}, TLS, session=<EpJbYkpRInsFvAsL> Bots aren't known to exit cleanly, so it's probably related to prematurely dropped connections. Apart from that, I'm not seeing this with real users. Joseph Tam <jtam.home(a)gmail.com>

1 1

Bug with 2.2.29-1~auto+25 back to haunt me
by Ralf Hildebrandt 06 Jun '17

06 Jun '17

After upgrading from 2.2.28-1~auto+45 to 2.2.29-1~auto+25 I'm gettings this: May 31 16:44:31 mproxy dovecot: auth: Fatal: passdb imap: Cannot verify certificate without ssl_ca_dir or ssl_ca_file setting May 31 16:44:31 mproxy dovecot: master: Error: service(auth): command startup failed, throttling for 8 secs May 31 16:44:31 mproxy dovecot: imap-login: Disconnected: Auth process broken (disconnected before auth was ready, waited 2 secs): user=<>, rip=141.42.206.36, lip=141.42.206.11, TLS, session=<ze1A9dJQZ8yNKs4k> # doveconf -n # 2.2.devel (215fd61): /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.devel (403042e) # OS: Linux 4.4.0-71-generic x86_64 Ubuntu 16.04.2 LTS auth_mechanisms = plain login default_vsz_limit = 1 G imapc_host = exchange-imap.charite.de imapc_port = 993 imapc_ssl = imaps imapc_ssl_verify = no listen = *,:: mail_gid = imapproxy mail_home = /home/imapproxy/%u mail_location = imapc:~/imapc mail_plugins = mail_log notify mail_uid = imapproxy passdb { args = host=exchange-imap.charite.de port=993 ssl=imaps default_fields = userdb_imapc_user=%u userdb_imapc_password=%w userdb_imapc_host=exchange-imap.charite.de userdb_imapc_ssl=imaps userdb_imapc_port=993 driver = imap } plugin { sieve = file:~/sieve;active=~/.dovecot.sieve } protocols = imap service auth { inet_listener { address = 127.0.0.1 port = 12345 } } ssl = required ssl_ca = </etc/ssl/certs/ca-certificates.crt ssl_cert = </etc/dovecot/dovecot.pem ssl_cipher_list = EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+aRSA+RC4:EECDH:EDH+aRSA:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS:!RC4 ssl_client_ca_file = /etc/ssl/certs/ca-certificates.crt ssl_key = # hidden, use -P to show it ssl_prefer_server_ciphers = yes ssl_protocols = !SSLv2 !SSLv3 userdb { driver = prefetch } verbose_proctitle = yes So I added ssl_ca_file = /etc/ssl/certs/ca-certificates.crt But alas: May 31 16:50:24 mproxy dovecot: config: Warning: Obsolete setting in /etc/dovecot/conf.d/10-ssl.conf:36: ssl_ca_file has been replaced by ssl_ca = <file Gnarf! As you can see I do HAVE ssl_ca in my doveconf -n output! ssl_ca = </etc/ssl/certs/ca-certificates.crt So what gives? -- Ralf Hildebrandt Geschäftsbereich IT | Abteilung Netzwerk Charité - Universitätsmedizin Berlin Campus Benjamin Franklin Hindenburgdamm 30 | D-12203 Berlin Tel. +49 30 450 570 155 | Fax: +49 30 450 570 962 ralf.hildebrandt(a)charite.de | https://www.charite.de

2 6