- dovecot - dovecot.org

Dovecot and MariaDB/MySQL
by Michael A. Peters 11 Jan '17

11 Jan '17

Howdy - For most of my dovecot servers, they are small and I just use unix accounts. However I am going to be running a new server for more general users, webmail (probably roundcube but I'm hacking roundcube quite a bit, enough that I'm calling it squarepeg instead so users familiar with roundcube will know it is quite different) and it will use MariaDB for account management. I already have it working, following the instructions at https://www.linode.com/docs/email/postfix/email-with-postfix-dovecot-and-my… - those instructions also work in CentOS 7 with the latest Dovecot - but there is something that really bothers me. It makes no provision for salting the password before the crypt function. What I would like to do is when creating a new account, use /dev/urandom to generate a random salt for the account that is stuck in the database along with the account and used when validating the password. That way in the event of a SQL injection attack that dumps the database - yes it is still bad, but 20 accounts that have the same password will have radically different hashes and thus won't be a clue that they are the same, the blackhat that gets the database dump would have to generate a rainbow table for each unique salt. I've looked at at least a dozen different Dovecot / MariaDB howto guides and none of the ones I have looked at supported any kind of individual salting of the user passwords. Can someone point me to a guide that does? I don't mind keeping the salt in the database, I just want to be able to have a different salt for each account. Thank you

2 2

GMail-like user labels in IMAP/dovecot, situation in 2017?
by Gioele Barabucci 11 Jan '17

11 Jan '17

Hello, I am in the process of updating my IMAP dovecot installation and I was wondering what is the current state of the art for GMail-like user-defined labels. Are GMail-like user-defined labels now somehow achievable with dovecot? If now, what is missing? Standardized metadata formats? Support in clients? I searched the web a bit but I could not find any activity in the relevant IETF working groups. That seems strange to me, because the user-defined labels looks like a feature many users would like to have. I suppose I haven't found the relevant discussion group. Is this kind of enhancement to IMAP being discussed somewhere? Regards, -- Gioele Barabucci <gioele(a)svario.it>

2 2

Poolmon: Problem with index-locking
by Tom Sommer 11 Jan '17

11 Jan '17

I have Poolmon (https://github.com/brandond/poolmon) set up. When it does all the checks concurrently, obviously there are locking issues on each mailserver it tests: "Warning: Locking transaction log file xxxx/indexes/dovecot.list.index.log took 60 seconds (syncing)" It's just an empty mailbox. Is there any way to do a login test, without locking the index files? Hence avoiding these warnings/errors? Thanks. -- Tom

2 2

doveadm output format changes
by Benoit Branciard 10 Jan '17

10 Jan '17

It appears that doveadm output format changes every now and then, without particular notice. For example, the following command: doveadm -f pager mailbox status 'messages recent' '*' did output something like this until v2.2.24 : mailbox: Mailbox1 messages: 58 recent: 12 ^L mailbox: Mailbox2 messages: 128 recent: 0 but switched to that in v2.2.26 : Mailbox1 messages: 58 recent: 12 ^L Mailbox2 messages: 128 recent: 0 This seems related to the following changelog entry: 2016-10-25 20:51:36 +0300 Timo Sirainen <timo.sirainen(a)dovecot.fi> (5baa99e) doveadm: "pager" formatter supports now DOVEADM_PRINT_HEADER_FLAG_HIDE_TITLE M src/doveadm/doveadm-print-pager.c Some other format changes did also occur in the past. For example, "doveadm user" had a specific format in v2.0.19 (and ignored the "-f format" option), and obviously defaulted to the "-f tab" format (which has different rendering) somewhere in the v2.2.x or 2.1.x. Such changes render maintenance of wrapping scripts particularly tedious. Could it be possible to avoid such breaking changes in the future ? -- Benoit BRANCIARD Service InfraStructures (SIS) Direction du Système d'Information et des Usages Numériques (DSIUN) Université Paris 1 Panthéon-Sorbonne Centre Pierre Mendès France 90 rue de Tolbiac - 75634 Paris cedex 13 - France Bur. B406 - Tél +33 1 44 07 89 68 - Fax +33 1 44 07 89 66 Accueil: +33 1 44 07 89 65 - Assistance-DSIUN(a)univ-paris1.fr http://dsi.univ-paris1.fr

1 1

Re: dovecot-pigeonhole running external script ends with signal 11
by Stephan Bosch 09 Jan '17

09 Jan '17

Op 1/8/2017 om 10:00 AM schreef Tobi: > Hi Stephan > > according to ps aux the process that segfaults is (pid 18261) > > vmail 18261 0.0 0.0 0 0 pts/0 Z 09:39 0:00 [lmtp] > <defunct> > > the gdb backtrace I attached to my mail was the deepest one I got That looks like it happens in Dovecot still. > @Steffen > the script does not chroot, at least not that I'm aware of. I checked my > dovecot configs and could not find any active chroot config. All > occurences of mail_chroot are commented out and have no path values. What about the version information I asked about? Regards, Stephan. > Am 06.01.2017 um 00:04 schrieb Stephan Bosch: >> Op 1/4/2017 om 9:37 AM schreef Tobi: >>> Hi Aki >>> >>> yes I built dovecot and pigeonhole rpms in the same rpmbuild. pigeonhole >>> rpm is based on 0.4.14 >>> Do you think that the error might come from self building the rpms? >> But what version of Pigeonhole are you actually using? Version 0.4.16 is >> released for Dovecot v2.2.26. >> >> Also: >> >> - Can you find out which process is getting the segfault? GDB shows the >> pid and you should lookup what process that is while GDB is still active. >> - Isn't that GDB backtrace you provided deeper? It shows only two >> levels, but that makes no sense (i.e. main() is not listed). >> >> Regards, >> >> Stephan. >>

4 4

Virtual POP3 namespaces and quota-status
by Aurélien Beaujean 09 Jan '17

09 Jan '17

Hi, I've tried to do configure Virtual POP3 INBOX (dovecot version 2.2.18) as explained here http://wiki.dovecot.org/Plugins/Virtual with a static userdb and nopassword=y so I dont have any database on the dovecot server without the possibility to distinguish POP3 or IMAP in the userdb extra field to change the namespace on the fly. So I've put the namespace virtual informations inside the protocol pop3 { ... }, I did the same for the protocol imap { }: protocol pop3 { mail_plugins = $mail_plugins last_login virtual namespace inbox { prefix = separator = / list = yes } namespace virtual { inbox = yes prefix = virtual/ separator = / location = virtual:/etc/dovecot/virtual:INDEX=MEMORY list = no hidden = yes } namespace real { prefix = RealMails/ separator = / list = no hidden = yes } } protocol imap { mail_plugins = $mail_plugins imap_quota last_login namespace inbox { inbox = yes } } protocol lda { mail_plugins = " quota sieve" namespace inbox { inbox = yes } } passdb { args = nopassword=y uid=vmail gid=vmail home=/var/mail/%2Mn/%2.2Mn/%n driver = static } userdb { args = nopassword=y uid=vmail gid=vmail home=/var/mail/%2Mn/%2.2Mn/%n driver = static } service quota-status { executable = quota-status -p postfix inet_listener { port = 12340 } process_min_avail = 8 } But the service quota-status getting lost with a message: namespace configuration error: inbox=yes namespace missing I didn't find a way to tell quota-status which namespace to use as you can't setup a default one. If I declare a "global" namespace inbox pop3 deamon fails because of duplicated namespace inbox in the configuration files: pop3(xxx): Error: User initialization failed: namespace configuration error: There can be only one namespace with inbox=yes Any idea before I will patch some piece of code to disable the unique restriction of inbox namespace ? Thanks, -- Auré

1 2

dsync for subscription on public/shared folder
by Mike Fröhner 09 Jan '17

09 Jan '17

Hello, I already wrote regarding that, but maybe it sounded too complex. I will write it a bit softer now. The replication through dsnyc works perfectly with one exception. I am having an issue with the replication of the subscriptions file on shared folder. We have a public mailbox defined: namespace public-test { location = maildir:/opt/mail/_public/test prefix = public/test/ separator = / subscriptions = no type = public } There 2 subfolder .Test1 and .Test2 which I would like to subscribe on my user "ldaptestuser" which is part of the group "ldaptestgroup" The dovecot-acl file on /opt/mail/_public/test and /opt/mail/_public/test/.Test{1,2} are the same and are containing: group=ldaptestgroup lrwstipekxa Now if I login through my client (Thunderbird or Roundcubemail) I can see the following debug log: dovecot: imap(ldaptestuser): Debug: acl: acl username = ldaptestuser dovecot: imap(ldaptestuser): Debug: acl: owner = 0 dovecot: imap(ldaptestuser): Debug: acl: group added: domain users dovecot: imap(ldaptestuser): Debug: acl: group added: ldaptestgroup dovecot: imap(ldaptestuser): Debug: acl: group added: all_mailuser I created one new private folder on the mailbox of my test user and also subscribed it. This subscription is successfully replicated. After that I am trying to subscribe the public folder. I can see the folder in my client after I subscribed them. But on the 2nd dovecot server the subscription file is not updated. imap-1 # cat subscription Private1 public/test/Test1 imap-2 # cat subscription Private1 The debug log on both dovecot server tells me: dovecot: doveadm(<ip>,ldaptestuser): Debug: Effective uid=834603987, gid=991, home=/opt/mail/ldaptestuser dovecot: doveadm(<ip>,ldaptestuser): Debug: acl: No acl_shared_dict setting - shared mailbox listing is disabled dovecot: doveadm(<ip>,ldaptestuser): Debug: maildir++: root=/opt/mail/_public/test, index=, indexpvt=, control=, inbox=, alt= dovecot: doveadm(<ip>,ldaptestuser): Debug: acl: initializing backend with data: vfile dovecot: doveadm(<ip>,ldaptestuser): Debug: acl: acl username = ldaptestuser dovecot: doveadm(<ip>,ldaptestuser): Debug: acl: owner = 0 dovecot: doveadm(<ip>,ldaptestuser): Debug: acl vfile: Global ACLs disabled It looks like the doveadm() cannot find the group or is not checking/initalizing the groups. Anybody any idea if I missconfigured something or is this just a bug? I really would appreciate some help. kind regards, Mike;

1 1

Auth-policy: auth_policy_server_url and https support
by gregc＠olypensupport.com 08 Jan '17

08 Jan '17

When using Auth policy server it doesn’t currently doesn’t support https. In version 2.2.27: Policy server HTTP error: 9002 Couldn't initialize SSL context: Can't verify remote server certs without trusted CAs (ssl_client_ca_* settings) and in version 2.3.devel Policy server HTTP error: 9002 Requested https connection, but no SSL settings given dovecot.conf does have “ssl_client_ca_dir = /etc/ssl/certs” set. Looking around the source, http-client-settings are not given the ssl_ca_dir or ssl_ca_file setting from the config. Admittedly SSL tear up/down is little expensive per auth, but I think it maybe it should still work?

2 1

.dovecot.sieve location issue
by Jibeji 08 Jan '17

08 Jan '17

Hello, I am trying to set sieve up on a Centos 7 server. It's a configuration with postfix, Maildir, MySQL and virtual domains which works fine. I have created a simple .dovecot.sieve in the user's directory: # cat /home/mail/domain.com/user/.dovecot.sieve require "fileinto"; redirect "other_address(a)other_domain.com"; Here are the logs: dovecot: lda(user(a)domain.com): Debug: sieve: Pigeonhole version 0.4.2 initializing lda(user(a)domain.com): Debug: sieve: include: sieve_global_dir is not set; it is currently not possible to include `:global' scripts. dovecot: lda(user(a)domain.com): Debug: sieve: script file /home/mail/ domain.com/.dovecot.sieve not found dovecot: lda(user(a)domain.com): Debug: sieve: user's script ~/.dovecot.sieve doesn't exist (trying default script location instead) lda(user(a)domain.com): Debug: sieve: no default script configured for user lda(user(a)domain.com): Debug: sieve: user has no valid location for a personal script lda(user(a)domain.com): Debug: sieve: no scripts to execute: reverting to default delivery. dovecot: lda(user(a)domain.com): msgid=<005b01d269ca$f287ebf0$d797c3d0$@fr>: saved mail to INBOX It tells that user's script ~/.dovecot.sieve doesn't exis However, on the troubleshooting guide, I can see these logs: dovecot: lda(hendrik): Debug: sieve: using sieve path for user's script: /home/hendrik/.dovecot.sieve dovecot: lda(hendrik): Debug: sieve: opening script /home/hendrik/.dovecot.sieve As you can see, it refers to "lda(hendrik)" but not "lda(user(a)domain.com" I am wondering whether Sieve looks for the file elsewhere than /home/mail/ domain.com/user/.dovecot.sieve Do you have any idea?

3 3

Dovecot Selinux Setting
by Günther J. Niederwimmer 08 Jan '17

08 Jan '17

Hello, can any tell me the correct selinux Settings for the Maildir Setting ? in the Moment I have this setting Jan 8 15:04:52 2017 from 192.168.100.100 [root@mx03 ~]# ls -Z /srv/vmail drwx------. vmail vmail unconfined_u:object_r:mail_home_rw_t:s0 example.com drwx------. vmail vmail unconfined_u:object_r:mail_home_rw_t:s0 example.at drwx------. vmail vmail unconfined_u:object_r:mail_home_rw_t:s0 eu-example.at drwx------. vmail vmail unconfined_u:object_r:mail_home_rw_t:s0 example1.com -rw-rw----. vmail vmail unconfined_u:object_r:mail_home_rw_t:s0 shared- mailboxes I mean this not correct, I have problems with sieve to enable the Link and with Sync ? I can't found the correct setting with goo..... Thanks for Help and a answer, -- mit freundlichen Grüssen / best regards Günther J. Niederwimmer

2 1