- dovecot - dovecot.org

nologin + reason -> logging reason
by Arkadiusz Miśkiewicz 22 Nov '16

22 Nov '16

Hi. I'm using nologin with own reason [1]. That works fine. For example pop3 client gets nice message like "-ERR [AUTH] Account is locked. Please contact support." Unfortunately maillog lacks information details about why user was not allowed to log in. pop3-login: Disconnected (auth failed, 1 attempts in 2 secs): user=<testuser>, method=LOGIN, rip=1.1.1.1, lip=2.2.2.2, session=<yIsRftBBmsrB7y2h> Is it possible to log "reason" there, too? (whether it is default/internal dovecot reason or my custom one). reason is the only thing in maillog that allows to distinguish why user was not allowed to log in. 1. http://wiki2.dovecot.org/PasswordDatabase/ExtraFields -- Arkadiusz Miśkiewicz, arekm / ( maven.pl | pld-linux.org )

3 5

Clients creating folders in root when using shared namespace
by Jon Cutting 21 Nov '16

21 Nov '16

We have set up dovecot to use a shared namespace, and it works well. However, when a client attempts to create a folder in the namespace, although dovecot responds with permission denied, it still goes on to create a folder, but in the root of our virtual mailbox folder (more confusingly, even issuing a LIST command for a non-existent subfolder creates the folder in the root). I've checked through the documentation for a misconfiguration but so far to no avail. Our steps to reproduce are as follows: * Create shared namespace (in our case we've used prefix Users/%%u/) * Share folder from one user to another so that the shared folder displays in LIST * Create a folder as a subfolder of the shared folder (i.e. . CREATE Users/testfolder) Expected behaviour: permission is denied and no folder is created Actual behaviour: permission is denied, but folder is created at the root of our vmail store (in the above example a folder /mnt/storage/vmail/testfolder would be created) Thanks, Jon Output from doveconf -n # 2.2.13: /etc/dovecot/dovecot.conf # OS: Linux 3.16.0-4-amd64 x86_64 Debian 8.6 ext4 mail_location = maildir:/mnt/storage/vmail/%d/%n/Maildir mail_plugins = " quota zlib acl" managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave namespace Users { list = children location = maildir:/mnt/storage/vmail/%%d/%%n/Maildir:INDEX=/mnt/storage/vmail/%d/%n/sharedindex/%%d/%%n/ prefix = Users/%%u/ separator = / subscriptions = no type = shared } namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = separator = / type = private } passdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } plugin { acl = vfile acl_shared_dict = file:/mnt/storage/vmail/%d/shared-mailboxes.db quota = maildir:User quota quota_rule = *:storage=50GB sieve = /mnt/storage/vmail/%d/%n/.dovecot.sieve sieve_before = /mnt/storage/vmail/dovecot.sieve sieve_dir = /mnt/storage/vmail/%d/%n/sieve zlib_save = gz zlib_save_level = 6 } protocols = imap lmtp sieve service imap-login { inet_listener imaps { port = 993 ssl = yes } } service lmtp { inet_listener lmtp { address = 0.0.0.0 port = 2003 } user = vmail } service managesieve-login { inet_listener sieve { port = 4190 } service_count = 1 vsz_limit = 64 M } ssl = required ssl_ca = </etc/dovecot/dovecotca.pem ssl_cert = </etc/dovecot/dovecot.pem ssl_key = </etc/dovecot/private/dovecot.pem userdb { args = uid=5000 gid=5000 home=/mnt/storage/vmail/%d/%n allow_all_users=yes driver = static } protocol imap { imap_client_workarounds = tb-extra-mailbox-sep mail_plugins = " quota zlib acl imap_quota" } protocol lmtp { mail_plugins = " quota zlib acl sieve" }

1 0

[PATCH] Manually cleanup OpenSSL from dovecot_openssl_common_global_unref()
by Apollon Oikonomopoulos 21 Nov '16

21 Nov '16

OpenSSL 1.1 features a cleanup function that is automatically run on shutdown using atexit(3). This function frees all OpenSSL-allocated resources. In dovecot, OpenSSL is loaded indirectly using dlopen(3) against the relevant dovecot crypto module and is finally unloaded using dlclose(3). Until OpenSSL 1.0.1c this worked fine, however OpenSSL 1.0.1c makes sure[1] that the library stays loaded after the initial dlclose() so that the atexit(3) handlers can run on shutdown. This, together with the fact that dovecot uses custom allocation functions for OpenSSL and has already partially free()'d some of OpenSSL's resources in module_free(), leads to a segfault at process shutdown[2]. We fix this by explicitly calling OPENSSL_cleanup() during module unload. This is safe to do, as long as we will never want to subsequently re-initialize OpenSSL. [1] https://github.com/openssl/openssl/commit/4af9f7fe79ff82b90c16969b7e5871435… [2] https://buildd.debian.org/status/fetch.php?pkg=dovecot&arch=amd64&ver=1:2.2… Signed-off-by: Apollon Oikonomopoulos <apoikos(a)debian.org> --- src/lib-ssl-iostream/dovecot-openssl-common.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/src/lib-ssl-iostream/dovecot-openssl-common.c b/src/lib-ssl-iostream/dovecot-openssl-common.c index 51ea3ad..2bf6307 100644 --- a/src/lib-ssl-iostream/dovecot-openssl-common.c +++ b/src/lib-ssl-iostream/dovecot-openssl-common.c @@ -101,6 +101,9 @@ bool dovecot_openssl_common_global_unref(void) ERR_remove_thread_state(NULL); #endif ERR_free_strings(); +#if OPENSSL_VERSION_NUMBER >= 0x10100000L + OPENSSL_cleanup(); +#endif return FALSE; } -- 2.10.1

4 4

Index-cache sizes
by Tom Sommer 21 Nov '16

21 Nov '16

I had a customer with an INBOX cache of 400MB+ (5.5GB maildir) which gave me "Error: mmap_anon(474165248) failed: Cannot allocate memory" errors, then I deleted the cache files and ran 'doveadm index -u xxx(a)example.com "*"', now the INBOX cache is 7MB What is up with that? Is the cache now missing something or does it make sense to wipe cache files and reindex cache every-so-often? -- Tom

1 0

Feedback on first, i.e. novice-level, experiences with dovecot
by Michael Felt 21 Nov '16

21 Nov '16

a) google: "dovecot imap configuration" brought an article from 2005 as the first item: while I like debian and a bit of history you may want to ask yourself how to improve your site as the primary hit from google. FYI: years ago I had great results in the top of google searches - and then I made a major error - I moved my site to a new url and google forgot me. b) using your http://wiki.dovecot.org/QuickConfiguration as a guide: I built dovecot using --prefix=/opt (I abhor /usr/local these days - that is so 1984ish). The applications got installed in /opt/bin root@x066:/data/prj/aixtools/dovecot/core# ls -ltr /opt total 36 drwxr-xr-x 3 root root 4096 Nov 20 14:33 lib drwxr-xr-x 3 root root 4096 Nov 20 14:33 include drwxr-xr-x 6 root root 4096 Nov 20 14:33 share drwxr-xr-x 3 root root 4096 Nov 20 14:33 libexec drwxr-xr-x 2 root root 4096 Nov 20 14:33 sbin drwxr-xr-x 2 root root 4096 Nov 20 14:33 bin Are the directories 'make install' touched or made. root@x066:/data/prj/aixtools/dovecot/core# /opt/bin/doveconf -n # 2.3.devel (92c8109): /opt/etc/dovecot/dovecot.conf doveconf: Fatal: open(/opt/etc/dovecot/dovecot.conf) failed: No such file or directory where are example configs? root@x066:/data/prj/aixtools/dovecot/core# find /opt -name example-config root@x066:/data/prj/aixtools/dovecot/core# Not in /opt How about a default config? root@x066:/data/prj/aixtools/dovecot/core# find / -name dovecot /etc/init.d/dovecot /etc/pam.d/dovecot /etc/default/dovecot /etc/dovecot /var/lib/dovecot ^C Seems to be /etc/dovecot root@x066:/data/prj/aixtools/dovecot/core# ls -l /etc/dovecot total 40 drwxr-xr-x 2 root root 4096 Apr 30 2015 conf.d -rw-r--r-- 1 root root 4180 Jun 8 2014 dovecot.conf -rw-r----- 1 root dovecot 410 Jun 8 2014 dovecot-db.conf.ext -rw-r----- 1 root dovecot 782 Jun 8 2014 dovecot-dict-sql.conf.ext -rw-r--r-- 1 root dovecot 1363 Apr 30 2015 dovecot.pem -rw-r----- 1 root dovecot 5348 Jun 8 2014 dovecot-sql.conf.ext drwx------ 2 root root 4096 Apr 30 2015 private -rw-r--r-- 1 root root 121 Jun 8 2014 README and finally - read README to find the examples: root@x066:/data/prj/aixtools/dovecot/core# cat /etc/dovecot/README Configuration files go to this directory. See example configuration files in /usr/share/doc/dovecot-core/example-config/ Conclusion: --prefix=/opt is not applied everywhere. * More first impressions as I come to them - if you want them - as I hope this helps make dovecot better! Michael

2 4

doveadm service: verify client cert
by Matwey V. Kornilov 20 Nov '16

20 Nov '16

Hello, I want to open a socket for connecting doveadm using tcps. I do the following: service doveadm { inet_listener { port = 5001 ssl = yes } } At the same time, I would like to verify client certificates for connections goes to port 5001. I am trying to do the following, but it doesn't work: protocol doveadm { ssl_require_crl = yes ssl_verify_client_cert = yes } How could I achieve required behavior?

1 0

Compound Literal - xlc and gcc differences can be patched
by Michael Felt 19 Nov '16

19 Nov '16

Since I so miserably misspelled packaging - a new thread specific to the issue at hand. I found a "workaround". In short, xlc does not accept arrays of nested array - the bottom line (best message) is: 1506-995 (S) An aggregate containing a flexible array member cannot be used as a member of a structure or as an array element. At the core - all the other messages come because this (I shall call it nesting). For the test-http-auth.c file I have a patch (attached). make ran for while with no issue, then it started running into several files with this same style of specification - doveadm-dict.c being the first one. I ran "make -i" and I notice several files with this - for xlc - "unaccepted" syntax. Please look at the patch - what it basically is - and let me know whether you would consider accepting patches in this form (e.g., verify gcc (I assume) will accept it as well). If your answer is yes, I shall proceed with the additional files (learn how your MACROS work!) and send them to you. Again, initially I would just send one, e.g., doveadm-dict.c - to be sure your regular compiler also builds this alternate specification. Thank you for your consideration! Michael

2 5

Re: Good email client to use with Dovecot?
by Joseph Tam 19 Nov '16

19 Nov '16

Steve Litt asks > * And most important, where can I find the best, most unambiguous > Alpine documentation, that doesn't assume I know anything about > Alpine? The ~/.pinerc config file is well documented. There is a bewildering number of options, and you can tweak it just about anyway you like. Choice of mail readers tend to a religious issue. Users of a particular reader will only change when you pry their cold dead fingers off of it. Alpine is not a bad choice (I've been using it and it's predeccesor for decades), and I go through mail faster than most people I know as I can type faster than they can click buttons, scroll, and drag windows around. However, it sort of sucks when you read formatted mail HTML with lots of graphics). Joseph Tam <jtam.home(a)gmail.com>

1 0

Generalized looping possible in pigeonhole sieve?
by Jeff Kletsky 18 Nov '16

18 Nov '16

I'm struggling to achieve the kind of filtering with sieve that I was able to do with procmail. TL;DR I'd like a way to loop through a set of (address, destination) pairs in sieve so that I can maintain the (address, destination) pairs in one place and not have to explicitly write scores of nearly identical [...] if address :matches ["From", "Sender", "To", "Cc"] "address53" { fileinto "destination53" } if address :matches ["From", "Sender", "To", "Cc"] "address54" { fileinto "destination54" } [...] Longer: I've been using a table-based dispatch approach with procmail for years and it was working reasonably well. The approach uses list of pairs of address and destination boxes and doing a lookup based on the message to be delivered. With procmail, I collected the list of addresses and passed them to external scripts to do the lookup. If I just had a dozen boxes that I deal with, that would be straightforward to implement and maintain in sieve. As the list is an order of magnitude greater than that, maintaining the list of pairs in an external file and programmatically looping through it is a lot easier. I've looked at vnd.dovecot.execute and it certainly can return a destination box name given the input information. Unfortunately, the construct of (for example) address :matches "To" "*"' only returns the first address, not the list of addresses. I can't see a good way to get all the addressees from sieve to pass to the external program. If I have to pass the message (or at least the interesting headers) to the external program and then parse the address list myself, then I'm nearly all the way to just using a full-on external program to parse the whole message. While I'm not adverse to writing the whole thing in Python (or the like) and just using sieve as a thin shell, I'd like to make sure I'm not missing something in sieve. One way to achieve this would be to be able to loop through the pairs and using variable substitution for each iteration. I haven't seen anything in Dovecot Pigeonhole sieve that allows this. If you have any ideas on how to harness sieve for this, I'd appreciate it! Jeff

3 2

BUG: nopassword doesn't work with CRAM-MD5
by Arkadiusz Miśkiewicz 18 Nov '16

18 Nov '16

Hello. dovecot 2.2.26.0 When testing nopassword extra field (http://wiki2.dovecot.org/PasswordDatabase/ExtraFields) with CRAM-MD5 dovecot doesn't allow any password (while it should) and returns " Authentication failed" while in logs: Nov 17 08:22:34 auth-worker(1551): Info: sql(pepe,127.0.0.1,<Y8amDXpBptV/AAAB>): Requested CRAM-MD5 scheme, but we have a NULL password NULL is there because our sql query returns empty password just like wiki says "nopassword: you want to allow all passwords, use an empty password and this field. " If password is returned in sql query then it fails, too: Nov 17 09:00:49 auth-worker(2206): Error: sql(pepe,127.0.0.1,<eO5vlnpBtNd/AAAB>): nopassword set but password is non- empty So looks to be a bug. -- Arkadiusz Miśkiewicz, arekm / ( maven.pl | pld-linux.org )

3 6