- dovecot - dovecot.org

Re: Cannot Authenticate user with Kerberos/GSSAPI
by Joseph Tam 15 Jul '17

15 Jul '17

mark(a)ohprs.org > My last message probably contained too much information. This one is more succient. "Succint" may not be the right adjective, because I think this is the third copy I've seen. > Here is the dovecot log when user dsmith attempts to connect to dovecot > from the Tbird client: What I see is ... > Jul 11 19:29:46 imap-login: Info: Disconnected (no auth attempts in 3 secs): user=<>, rip=192.168.0.57, lip=192.168.0.2, TLS, session=<jR0sExNUTADAqAA5> ... a failed authentication with no real mention of Kerberos stuff, followed soon after with SSL/Kerberos yackety-yack, and ... > Jul 11 19:30:18 imap-login: Info: Login: user=<dsmith>, method=GSSAPI, rip=192.168.0.57, lip=192.168.0.2, mpid=3150, TLS, session=<iDUNFRNUUgDAqAA5> ... successful authentication via GSSAPI! From the log files you've shown, you were able to authenticate "dsmith". Your mail reader tells you otherwise? Joseph Tam <jtam.home(a)gmail.com>

1 1

SQLite user database
by Levente Kovacs 14 Jul '17

14 Jul '17

Dear Dovecot users/developers, I installed dovecot, and want to use a sqlite database for users, and passwords. I continuously get user authentication errors. I suspect that the problem is with a password hashing. I used # doveadm pw -s SHA512-CRYPT Enter new password: Retype new password: {SHA512-CRYPT}$6$1cCNWIMCTpuqmexO$cCq7nDEga1xza3967nZ.BFZaGWNoYwjnNfSCvZE/jGzYAY1hLWE1iHR1KYaO.mvVE4WVdDSrvPNtfwAUn/yk3/ to get a password hash. I have this at the database: sqlite> SELECT * from users; lev|logonex.eu|$6$1cCNWIMCTpuqmexO$cCq7nDEga1xza3967nZ.BFZaGWNoYwjnNfSCvZE/jGzYAY1hLWE1iHR1KYaO.mvVE4WVdDSrvPNtfwAUn/yk3/|/home/lev|1001|1001 I've tried adding this to the database, but still no luck. :-( {SHA512-CRYPT}$6$kbUEfz/Mcgpctv/s$uNQGOL/2F01Br.vx0twozVi6v.KJAHZV0OQ7yOFwD9YCloh7UJmeFe7WrgUez9Q5xXdrNOU5q9H8fE3FU2ok9. Could you please help me out what I'm doing wrong? I'm using dovecot version: 2.2.13 The other thing I want to avoid is the home directory and UID and GID. Is there any way for dovecot to use logical, non UNIX users so there's no need to have a user database and an sqlite database? Thank you for your help. Levente

1 0

Can Dovecot replace fetchmail?
by Kenneth Porter 14 Jul '17

14 Jul '17

I'm using fetchmail to grab mail for multiple accounts from an external IMAP server and drop it into local mailboxes via SMTP. It polls the remote server every two minutes. Can Dovecot replace this functionality more elegantly, using IDLE to avoid the polling necessary with fetchmail? I'd like to designate that mail for specific accounts on the external server be moved to specific local mailboxes. --- This email has been checked for viruses by Avast antivirus software. https://www.avast.com/antivirus

3 2

Re: System users lookup via PAM: strip the domain name?
by Larry Rosenman 13 Jul '17

13 Jul '17

Ok,, I was half awake when I typed that 😀 Sent from my Sprint Samsung Galaxy S8+. -------- Original message --------From: Aki Tuomi <aki.tuomi(a)dovecot.fi> Date: 7/13/17 6:19 AM (GMT-06:00) To: Dovecot List <dovecot(a)dovecot.org>, Larry Rosenman <larryrtx(a)gmail.com> Subject: Re: System users lookup via PAM: strip the domain name? No it's intentionally %Ln to convert user1@domain into user1 for PAM. Aki > On July 13, 2017 at 2:03 PM Larry Rosenman <larryrtx(a)gmail.com> wrote: > > > Is the %Ln on the 2nd passdb supposed to be a %Lu? > > > Sent from my Sprint Samsung Galaxy S8+. > -------- Original message --------From: Aki Tuomi <aki.tuomi(a)dovecot.fi> Date: 7/13/17 4:43 AM (GMT-06:00) To: Dovecot List <dovecot(a)dovecot.org>, Larry Rosenman <larryrtx(a)gmail.com> Subject: Re: System users lookup via PAM: strip the domain name? > No. > > It's just a placeholder, like %u or %d. > > Aki > > > On July 13, 2017 at 10:57 AM Larry Rosenman <larryrtx(a)gmail.com> wrote: > > > > > > Will %{original_username} set %d as well? > > > > > > Sent from my Sprint Samsung Galaxy S8+. > > -------- Original message --------From: Aki Tuomi <aki.tuomi(a)dovecot.fi> Date: 7/13/17 12:34 AM (GMT-06:00) To: Dovecot List <dovecot(a)dovecot.org>, Larry Rosenman <larryrtx(a)gmail.com> Subject: Re: System users lookup via PAM: strip the domain name? > > > > > On July 13, 2017 at 4:27 AM Larry Rosenman <larryrtx(a)gmail.com> wrote: > > > > > > > > > I have a need for the following: > > > > > > Real system users in /etc/{passwd,shadow} (actually PAM on FreeBSD) wirhOUT @domain in /etc/passwd > > > > > > Virtual Users in SQL (with full user@domain in the DB) > > > > > > > > > > > > When I have auth_username_format = %Ln I can’t auth the Virtual Users, and if I have auth_username_format = %Lu I can’t auth System users. > > > > > > > > > > > > Is there a compromise somewhere? > > > > > > > > > > You could try using %{original_username} in SQL. > > > > Or you can try removing the auth_username_format and instead > > > > passdb { > > driver = sql > > args = ... > > } > > passdb { > > driver = static > > args = user=%Ln noauthenticate > > # you can remove next line if you want to always normalize your usernames > > skip = authenticated > > } > > passdb { > > driver = pam > > args = ... > > skip = authenticated > > } > > > > Aki

1 1

passwd-file unknown user even if known
by Ricardo Branco 13 Jul '17

13 Jul '17

I am seeing lots of passwd-file unknown user messages even when they are known and they can login. I have several passwd files that are looked up with a deny file first, could the first check on the deny.%Ls file be generating this message then when it checks the next passdb driver it is found? If so is there a way to suppress the error message until all drivers have been checked?

1 0

Re: System users lookup via PAM: strip the domain name?
by Larry Rosenman 13 Jul '17

13 Jul '17

Is the %Ln on the 2nd passdb supposed to be a %Lu? Sent from my Sprint Samsung Galaxy S8+. -------- Original message --------From: Aki Tuomi <aki.tuomi(a)dovecot.fi> Date: 7/13/17 4:43 AM (GMT-06:00) To: Dovecot List <dovecot(a)dovecot.org>, Larry Rosenman <larryrtx(a)gmail.com> Subject: Re: System users lookup via PAM: strip the domain name? No. It's just a placeholder, like %u or %d. Aki > On July 13, 2017 at 10:57 AM Larry Rosenman <larryrtx(a)gmail.com> wrote: > > > Will %{original_username} set %d as well? > > > Sent from my Sprint Samsung Galaxy S8+. > -------- Original message --------From: Aki Tuomi <aki.tuomi(a)dovecot.fi> Date: 7/13/17 12:34 AM (GMT-06:00) To: Dovecot List <dovecot(a)dovecot.org>, Larry Rosenman <larryrtx(a)gmail.com> Subject: Re: System users lookup via PAM: strip the domain name? > > > On July 13, 2017 at 4:27 AM Larry Rosenman <larryrtx(a)gmail.com> wrote: > > > > > > I have a need for the following: > > > > Real system users in /etc/{passwd,shadow} (actually PAM on FreeBSD) wirhOUT @domain in /etc/passwd > > > > Virtual Users in SQL (with full user@domain in the DB) > > > > > > > > When I have auth_username_format = %Ln I can’t auth the Virtual Users, and if I have auth_username_format = %Lu I can’t auth System users. > > > > > > > > Is there a compromise somewhere? > > > > > > You could try using %{original_username} in SQL. > > Or you can try removing the auth_username_format and instead > > passdb { > driver = sql > args = ... > } > passdb { > driver = static > args = user=%Ln noauthenticate > # you can remove next line if you want to always normalize your usernames > skip = authenticated > } > passdb { > driver = pam > args = ... > skip = authenticated > } > > Aki

2 1

Re: System users lookup via PAM: strip the domain name?
by Larry Rosenman 13 Jul '17

13 Jul '17

Will %{original_username} set %d as well? Sent from my Sprint Samsung Galaxy S8+. -------- Original message --------From: Aki Tuomi <aki.tuomi(a)dovecot.fi> Date: 7/13/17 12:34 AM (GMT-06:00) To: Dovecot List <dovecot(a)dovecot.org>, Larry Rosenman <larryrtx(a)gmail.com> Subject: Re: System users lookup via PAM: strip the domain name? > On July 13, 2017 at 4:27 AM Larry Rosenman <larryrtx(a)gmail.com> wrote: > > > I have a need for the following: > > Real system users in /etc/{passwd,shadow} (actually PAM on FreeBSD) wirhOUT @domain in /etc/passwd > > Virtual Users in SQL (with full user@domain in the DB) > > > > When I have auth_username_format = %Ln I can’t auth the Virtual Users, and if I have auth_username_format = %Lu I can’t auth System users. > > > > Is there a compromise somewhere? > > You could try using %{original_username} in SQL. Or you can try removing the auth_username_format and instead passdb { driver = sql args = ... } passdb { driver = static args = user=%Ln noauthenticate # you can remove next line if you want to always normalize your usernames skip = authenticated } passdb { driver = pam args = ... skip = authenticated } Aki

2 1

Global create ACL allows out of boundaries mailbox
by Loïc Gomez 13 Jul '17

13 Jul '17

Hello Dovecot Team, During my tests I setup a global ACL allowing mailbox create for all authenticated users. Then, I made a mistake in Thunderbird, tried to create a mailbox directly on the "/shared/" special folder. Dovecot created a folder in the global root path of our mail store. Since I use maildir:/var/vmail/%d/%n/mail as mail_location, it created the mailbox in /var/vmail (where my domains are). It was just a test and I can imagine allowing create permission to all users whatever the path is not a good idea nor a common use case but still, it's probably worth reporting. Keep up the good work Cheers Loïc Gomez

1 0

Master auth only
by azurit＠pobox.sk 13 Jul '17

13 Jul '17

Hi, i'm trying to configure Dovecot proxy with user authentication on proxy side only, so backends will authenticate using master password (proxy is configured to send it). The problem is that Dovecot, on backends, is telling me that i need to configure at least one auth mechanism: auth: Fatal: No passdbs specified in configuration file. LOGIN mechanism needs one The master auth is correctly configured. I want to accomplished to have user database only on one place (=proxy). Any hints? azur

4 11

System users lookup via PAM: strip the domain name?
by Larry Rosenman 13 Jul '17

13 Jul '17

I have a need for the following: Real system users in /etc/{passwd,shadow} (actually PAM on FreeBSD) wirhOUT @domain in /etc/passwd Virtual Users in SQL (with full user@domain in the DB) When I have auth_username_format = %Ln I can’t auth the Virtual Users, and if I have auth_username_format = %Lu I can’t auth System users. Is there a compromise somewhere? Current doveconf –n with %Ln thebighonker.lerctr.org /usr/local/etc/dovecot/conf.d $ doveconf -n # 2.2.31 (65cde28): /usr/local/etc/dovecot/dovecot.conf # Pigeonhole version 0.4.19 (e5c7051) # OS: FreeBSD 11.1-PRERELEASE amd64 auth_debug = yes auth_debug_passwords = yes auth_mechanisms = plain login auth_realms = lerctr.org thebighonker.lerctr.org tbh.lerctr.org jonesonair.com jonesonair.net auth_username_format = %Ln default_vsz_limit = 1 G deliver_log_format = msgid=%m: %$ (subject=%s from=%f size=%w) doveadm_password = # hidden, use -P to show it lda_mailbox_autocreate = yes listen = 192.147.25.65, :: lmtp_save_to_detail_mailbox = yes login_access_sockets = tcpwrap mail_attribute_dict = file:%h/mail/.imap/dovecot-mail-attributes mail_location = mbox:~/mail:INBOX=~/mail/INBOX mail_log_prefix = "%s(%u/%p): " mail_plugins = " fts fts_solr notify stats virtual" mail_privileged_group = mail mail_server_admin = mailto:ler@lerctr.org mail_server_comment = LERCTR Mail Server mailbox_list_index = yes managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext vacation-seconds editheader mboxmetadata servermetadata imapsieve vnd.dovecot.imapsieve namespace archive { hidden = no list = no location = mbox:~/MAIL-ARCHIVE prefix = ARCHIVE/ separator = / } namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox INBOX { auto = create } mailbox SENT { special_use = \Sent } mailbox SPAM { special_use = \Junk } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } mailbox virtual/Flagged { special_use = \Flagged } mailbox virtual/all { special_use = \All } prefix = } namespace virtual { hidden = no list = yes location = virtual:~/MAIL-VIRTUAL:INDEX=MEMORY prefix = Virtual/ separator = / } passdb { args = /usr/local/etc/dovecot/dovecot-sql.conf.ext driver = sql } passdb { args = failure_show_msg=yes session=yes max_requests=20 driver = pam } plugin { fts = solr fts_autoindex = yes fts_solr = url=http://thebighonker.lerctr.org:8983/solr/dovecot/ fts_tika = http://localhost:9998/tika/ imapsieve_mailbox1_before = file:/usr/local/share/dovecot-pigeonhole/sieve/report-spam.sieve imapsieve_mailbox1_causes = COPY imapsieve_mailbox1_name = SPAM imapsieve_mailbox2_before = file:/usr/local/share/dovecot-pigeonhole/sieve/report-ham.sieve imapsieve_mailbox2_causes = COPY imapsieve_mailbox2_from = SPAM imapsieve_mailbox2_name = * imapsieve_url = sieve://thebighonker.lerctr.org mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename flag_change append mail_log_fields = uid box msgid size from subject vsize flags recipient_delimiter = + sieve = ~/.dovecot.sieve sieve_dir = ~/sieve sieve_execute_bin_dir = /usr/local/share/dovecot-pigeonhole/sieve sieve_extensions = +editheader +vacation-seconds +mboxmetadata +servermetadata sieve_global_extensions = +vnd.dovecot.pipe +vnd.dovecot.execute sieve_pipe_bin_dir = /usr/local/share/dovecot-pigeonhole/sieve sieve_plugins = sieve_imapsieve sieve_extprograms stats_command_min_time = 1 mins stats_domain_min_time = 12 hours stats_ip_min_time = 12 hours stats_memory_limit = 16 M stats_refresh = 5s stats_session_min_time = 15 mins stats_track_cmds = yes stats_user_min_time = 1 hours } protocols = imap pop3 lmtp sieve service auth { unix_listener auth-client { mode = 0666 } unix_listener auth-master { mode = 0666 } } service doveadm { inet_listener http { port = 8080 ssl = yes } } service indexer-worker { drop_priv_before_exec = yes } service managesieve-login { inet_listener sieve { port = 4190 } inet_listener sieve_deprecated { port = 2000 } } service stats { chroot = empty client_limit = 0 drop_priv_before_exec = no executable = stats extra_groups = fifo_listener stats-mail { group = mode = 0666 user = } fifo_listener stats-user { group = mode = 0666 user = } group = idle_kill = 4294967295 secs privileged_group = process_limit = 1 process_min_avail = 0 protocol = service_count = 0 type = unix_listener stats { group = mode = 0666 user = } user = $default_internal_user vsz_limit = 18446744073709551615 B } service tcpwrap { unix_listener login/tcpwrap { group = $default_login_user mode = 0600 user = $default_login_user } } ssl_cert = </home/ler/letsencrypt-home/lerctr.org/fullchain.cer ssl_cipher_list = EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+AESGCM:EECDH:EDH+AESGCM:EDH+aRSA:HIGH:!MEDIUM:!LOW:!aNULL:!eNULL:!LOW:!RC4:!MD5:!EXP:!PSK:!SRP:!DSS ssl_key = # hidden, use -P to show it ssl_protocols = !SSLv2 !SSLv3 userdb { args = /usr/local/etc/dovecot/dovecot-sql.conf.ext driver = sql } userdb { driver = passwd } verbose_proctitle = yes protocol lmtp { mail_plugins = " fts fts_solr notify stats virtual sieve mail_log" } protocol lda { mail_plugins = " fts fts_solr notify stats virtual sieve mail_log" } protocol pop3 { mail_plugins = " fts fts_solr notify stats virtual mail_log" } protocol !doveadm { mail_plugins = " fts fts_solr notify stats virtual mail_log" } protocol imap { imap_client_workarounds = tb-extra-mailbox-sep tb-lsub-flags imap_logout_format = in=%i out=%o fhc=%{fetch_hdr_count} fhb=%{fetch_hdr_bytes} fbc=%{fetch_body_count} fbb=%{fetch_body_bytes} del=%{deleted} exp=%{expunged} trash=%{trashed} imap_metadata = yes mail_max_userip_connections = 50 mail_plugins = " fts fts_solr notify stats virtual mail_log imap_sieve imap_stats stats" } thebighonker.lerctr.org /usr/local/etc/dovecot/conf.d $ -- Larry Rosenman http://www.lerctr.org/~ler Phone: +1 214-642-9640 E-Mail: larryrtx(a)gmail.com US Mail: 17716 Limpia Crk, Round Rock, TX 78664-7281

2 1