- dovecot - dovecot.org

Foreman component
by Aki Tuomi 20 Apr '16

20 Apr '16

Hi! I am planning to add foreman component to dovecot core and I am hoping for some feedback: Foreman - generic per-user worker handling component It is responsible for managing worker pools per protocol, lifecycle management of workers and handing out instances to others, as in, unix socket connections. Each time a request is made to foreman for a worker, the worker is instantiated (if possible) and locked. Then connection is created to the socket of the worker, and the file descriptor is returned to requestor. When the requestor has completed the task, it's responsibility is to close the DATA channel and also ask foreman to unlock the worker. Components can register new workers using lib-foreman's API. Each worker is registered with struct foreman_worker { const char *protocol; const char *path; const char *version; unsigned int max_instances; unsigned int max_requests; /* how many requests one worker can handle */ unsigned int max_idletime_secs; /* how long worker can idle */ unsigned int max_processtime_secs; /* how long worker can process something */ unsigned int max_lifetime_secs; /* how long a worker can live this can be exceeded if the worker has work to do. */ }; /* minimum lifetime of worker: max_idletime_secs */ /* absolute maximum lifetime of worker: max_lifetime_secs + max_processtime_secs */ The unsigned ints are optional. If they are not defined, the workers are kept until foreman exceeds the total number of workers permitted across pools. Pools are per-worker-class pools, and are generated when a worker is registered. Version specifies the protocol version and is going to be "1000" now. Next version will always be 1001, 1002 etc. Any feedback or questions are welcome! Aki

3 2

Reappearing emails (resolved by 2.2.23)
by Ron Cleven 20 Apr '16

20 Apr '16

> ------------------------------ > > Message: 6 > Date: Wed, 16 Mar 2016 16:58:49 +1100 > From: Timo Sirainen<tss(a)iki.fi> > To: Dovecot Mailing List<dovecot(a)dovecot.org> > Subject: Re: Reappearing emails - IMAP trace > Message-ID:<4C26CC22-7C7D-4D91-A767-4E5B3D1F12BA(a)iki.fi> > Content-Type: text/plain; charset=us-ascii > > What mailbox format do you use? Are you able to reproduce this by running doveadm sync commands manually instead of letting replication do it? For example: > > - doveadm sync -s "" -d -u user@domain > state > - Run the UID STORE & UID MOVE > - doveadm sync -s "`cat state`" -d -u user@domain > > There have been some fixes, especially recentlyhttps://github.com/dovecot/core/commit/950a6e61d6c2dac961ce031bdd8b… sounds a bit similar although I don't really see how it would apply here. Would be a good idea to try anyway with v2.2.22.rc1 (which seems to be stable enough that I'll make v2.2.22 release soon). > > Anyway, I attempted a few times to reproduce it with your test but wasn't able to. We had been running 2 replicating servers (Maildir format) using version 2.2.10 under CentOS 7 in production for quite some time. In this forum, I reported a problem that I traced to a timing problem where unread emails being moved to Trash would magically reappear in the INBOX. I have since upgraded our production servers to 2.2.23. The new version resolved the problem. The version upgrade also resolved the occasional, but annoying, dsync maillog entries "Duplicate file entry at line ...". So, I am a very happy camper and appreciate the feedback.

2 1

GSSAPI authentication setup
by Braden McDaniel 20 Apr '16

20 Apr '16

I'm setting up dovecot on a new box; and once again I find myself banging my head against GSSAPI authentication. The particularly irritating thing is that I have this working on another box. I've done my best to ape the configuration of that box; but it's been some years since I set it up and somewhere along the line I have failed. My dovecot.conf has: auth_mechanism = plain gssapi passdb { driver = pam } userdb { driver = ldap args = /etc/dovecot/dovecot-ldap.conf.ext } where /etc/dovecot/dovecot-ldap.conf.ext is: hosts = ldap dn = cn=Manager,dc=endoframe,dc=net dnpass = XXXXXXXX ldap_version = 3 base = ou=people,dc=endoframe,dc=net deref = never scope = subtree user_attrs = homeDirectory=home,uidNumber=uid,gidNumber=gid user_filter = (&(objectClass=posixAccount)(uid=%u)) I've diff'd the contents of /etc/dovecot on the working vs. non-working servers, and I can see nothing of pertinence (just a few lines about loading the sieve plug-in). Now, logging in with the kerberos password via PAM *is* working. /etc/pam.d/dovecot: #%PAM-1.0 auth sufficient pam_krb5.so account sufficient pam_krb5.so But GSSAPI authentication is not: [ root@hinge ~]# telnet localhost 143 Trying ::1... Connected to localhost. Escape character is '^]'. * OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE STARTTLS AUTH=PLAIN AUTH=GSSAPI] Dovecot ready. a authenticate GSSAPI a NO [UNAVAILABLE] Temporary authentication failure. [hinge.endoframe.net:2016-04-16 21:33:32] ^] telnet> close Connection closed. Oh... The kerberos server does have an IMAP service key for hinge; and that service key appears in hinge's /etc/krb5.keytab, as well. Any pointers on where I should be looking at this point would be very much appreciated. -- Braden McDaniel <braden(a)endoframe.com>

3 6

sieve vacation: write to the .lda-dupes database without generating a vacation response.
by Bradley M. Kuhn 20 Apr '16

20 Apr '16

I'm using Dovecot's sieve extensions quite happily, they are very good! Thanks for all who worked on them. I have a question that maybe is appropriate for a sieve-specific discussion list, so if there is one I should post to instead, please let me know: I've poked through the sieve vacation RFC and all the documentation I can find and I cannot figure out how to do this. It's more-or-less not the intent of sieve's vacation, so perhaps it's more of a "you can't get there from here" situation, but maybe folks here have an idea: I am (ab)?using sieve vacation to send an automated response at all times to all senders who put me in the To line, every 90 days, which explains my lack of responsiveness and to explain who else might be better contact. (I have hundreds of emails sent to me to which I will never have time to respond, and probably should have been routed to someone else at my organization anyway.) However, I *don't* want my regular correspondents to receive this autoreply. I'd thus like to seed the database with known individuals I'm corresponding with to pretend they've already received the autoresponder. Since I bcc an archive address on all emails, my original thought was to detect people in the To and Cc line of outgoing emails and record them in the .lda-dupes database, as they received a vacation email. I can't figure out how to do this; there is no option on the sieve vacation directive that I can find to do something like this (i.e., I'm looking for a a "do the usual, but *don't* actually send the the email" option on the sieve vacation directive). I do have various other solutions that help in this regard, for example, I never send a vacation email to messages that match: header :contains "In-Reply-To" "@example.org" (where example.org is my domain). This helps, but obviously doesn't handle the situation where the correspondent doesn't reply to one of my emails, or had a stupid MUA. Furthermore, I'd like to implement as many methods as possible for my regular corespondents to limit their receipt of the autoresponder. Any ideas? Thanks in advance for any help or advice you can give! -- -- bkuhn ======================================================================== Become a Conservancy Supporter today: https://sfconservancy.org/supporter

4 4

[Dovecot] Patch: 2.0 support for URLAUTH, BURL, CATENATE
by Mike Abbott 18 Apr '16

18 Apr '16

Thank you Timo for beginning the port of URLAUTH, BURL, and CATENATE from 1.2 to 2.0. Attached please find two patches that finish the port to 2.0. One patch updates the dovecot-2.0-urlauth branch and is based on the tip of that branch. The other patch adds the full support to dovecot-2.0.beta5. The resulting URLAUTH/BURL/CATENATE code is the same. Please let me know if you have any questions about these patches. Thanks.

4 9

stats: Error: FIFO input error: CONNECT: Duplicate session ID
by Urban Loesch 18 Apr '16

18 Apr '16

Hi, yesterday I updatet to Dovecot EE version 2:2.2.23.1-1. Now sometimes I see this errors in my logs: ... Apr 18 09:02:19 dovecot1 dovecot: stats: Error: FIFO input error: CONNECT: Duplicate session ID NjcCDoSAFFd/KQAAFMUCeg for user user(a)domain1.com service lmtp Apr 18 09:04:05 dovecot1 dovecot: stats: Error: FIFO input error: CONNECT: Duplicate session ID rjV1HtCGFFcoogAAFMUCeg for user user(a)domain2.com service lmtp Apr 18 09:04:30 dovecot1 dovecot: stats: Error: FIFO input error: CONNECT: Duplicate session ID Sqi0IMWAFFeRNQAAFMUCeg for user user(a)domain3.com service lmtp ... The error only appears when a mail is sent to 2 ore more recipients concurrently. It's not ciritcal for me, all mails are getting delivered correctly. Thanks and regards Urban Loesch

2 1

AD LDAP auth shows unknown results
by victorpictor＠mailbox.hu 15 Apr '16

15 Apr '16

Hi List! Been struggling with AD LDAP auth, ldapsearch shows everything fine, but when I try to telnet, the log shows unknown attributes. Dovecot 2.0.19 dovecot -n: # 2.0.19: /etc/dovecot/dovecot.conf # OS: Linux 3.5.0-23-generic x86_64 Ubuntu 12.04.5 LTS ext4 auth_debug = yes auth_mechanisms = plain login auth_username_format = %n auth_verbose = yes disable_plaintext_auth = no listen = * mail_location = maildir:/var/mail/%u%d/Maildir namespace inbox { inbox = yes location = prefix = } passdb { args = /etc/dovecot/dovecot-ldap-passdb.conf driver = ldap } plugin { sieve = ~/.dovecot.sieve sieve_dir = ~/sieve sieve_global_dir = /var/lib/dovecot/sieve/ } protocols = " imap lmtp pop3" service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } user = vmail } ssl = no ssl_cert = </etc/ssl/certs/dovecot.pem ssl_key = </etc/ssl/private/dovecot.pem userdb { args = /etc/dovecot/dovecot-ldap-userdb.conf driver = ldap } protocol lmtp { mail_plugins = " sieve" postmaster_address = postmaster(a)domain.hu } Contents of passdb.conf: hosts = 1.2.3.4 auth_bind = yes auth_bind_userdn = DOMAIN\%u ldap_version = 3 base = dc=domain,dc=in scope = subtree deref = never pass_filter = (&(objectClass=person)(sAMAccountName=%u)(mail=*)) Contents of userdb.conf: hosts = 1.2.3.4 dn = DOMAIN\user dnpass = xxx ldap_version = 3 base = dc=domain,dc=in user_attrs = =uid=108,=gid=115,=home=/var/mail/%Lu,=mail=maildir:/var/mail/%Lu/Maildir/ user_filter = (&(objectClass=person)(sAMAccountName=%u)(mail=*)) # Attributes and filter to get a list of all users iterate_attrs = sAMAccountName=user iterate_filter = (objectClass=person) And the log after a test login: Apr 15 18:10:52 ubuntutest2 dovecot: auth: Debug: ldap(user,127.0.0.1): user search: base=dc=domain,dc=in scope=subtree filter=(&(objectClass=person)(sAMAccountName=user)(mail=*)) fields= Apr 15 18:10:52 ubuntutest2 dovecot: auth: Debug: ldap(user,127.0.0.1): result: objectClass(?unknown?)= cn(?unknown?)= instanceType(?unknown?)= whenCreated(?unknown?)= uSNCreated(?unknown?)= name(?unknown?)= objectGUID(?unknown?)= badPwdCount(?unknown?)= codePage(?unknown?)= countryCode(?unknown?)= badPasswordTime(?unknown?)= lastLogoff(?unknown?)= lastLogon(?unknown?)= primaryGroupID(?unknown?)= objectSid(?unknown?)= accountExpires(?unknown?)= logonCount(?unknown?)= sAMAccountName(?unknown?)= sAMAccountType(?unknown?)= userPrincipalName(?unknown?)= objectCategory(?unknown?)= givenName(?unknown?)= initials(?unknown?)= sn(?unknown?)= displayName(?unknown?)= description(?unknown?)= physicalDeliveryOfficeName(?unknown?)= userAccountControl(?unknown?)= msDS-SupportedEncryptionTypes(?unknown?)= pwdLastSet(?unknown?)= homeDrive(?unknown?)= homeDirectory(?unknown?)= memberOf(?unknown?)= mail(?unknown?)= whenChanged(?unknown?)= uSNChanged(?unknown?)= distinguishedName(?unknown?)= Any idea? Thanks for advance! Victorpictor

1 0

Tighten TLS - usage of specific ssl_ec-curve
by Martin 15 Apr '16

15 Apr '16

Hi folks, at first: thanks very much for the great piece of software! I have a proposal to tighten the TLS security: enable the usage of a specific ec-curve in the 10-ssl.conf, e.g. ssl_ec-curve = secp384r1 Reason: I use a 384 bit EC server key, but dovecot uses "only" a prime256v1 curve. Keygen was: f=dovecot; openssl ecparam -name secp384r1 -genkey -out $f.key openssl req -new -x509 -key $f.key -out ${f}.crt -days 2000 -sha512 Server check gives: prio ciphersuite protocols pfs curves 1 ECDHE-ECDSA-AES128-GCM-SHA256 TLSv1.2 ECDH,P-256,256bits prime256v1 2 ECDHE-ECDSA-AES128-SHA256 TLSv1.2 ECDH,P-256,256bits prime256v1 3 ECDHE-ECDSA-AES128-SHA TLSv1.2 ECDH,P-256,256bits prime256v1 4 ECDHE-ECDSA-AES256-GCM-SHA384 TLSv1.2 ECDH,P-256,256bits prime256v1 5 ECDHE-ECDSA-AES256-SHA384 TLSv1.2 ECDH,P-256,256bits prime256v1 6 ECDHE-ECDSA-AES256-SHA TLSv1.2 ECDH,P-256,256bits prime256v1 Certificate: UNTRUSTED, 384 bit, ecdsa-with-SHA512 signature $ sudo nano /etc/dovecot/conf.d/10-ssl.conf ssl = required ssl_protocols = !SSlv2 !SSLv3 TLSv1.2 ssl_cipher_list = EECDH+AES128+AESGCM:EECDH+AES256+AESGCM:EECDH+AES128+SHA256:EECDH+AES256+SHA384:EECDH+AES128+SHA:EECDH+AES256+SHA ssl_prefer_server_ciphers = yes ssl_key = </etc/dovecot/dovecot.key ssl_cert = </etc/dovecot/dovecot.crt OS is arch linux. Thanks very much, Martin

2 1

How to filter spam with same to: and from: adress
by Claude 14 Apr '16

14 Apr '16

Is it possible to create a filter somewhere to delete email that have same to: and from: adress. All these email are forged using my domain name with always different fictif user name. The only common point is that they have the same user name in the from: and to: adress Claude Gelinas agr. Phyto Ressources Inc.

2 1

A few new Pigeonhole features
by Stephan Bosch 14 Apr '16

14 Apr '16

Hi, A few new Pigeonhole features that enthusiasts can experiment with: - Recently, I implemented support for the "imapsieve" extension in Sieve and its IMAP counterpart (https://tools.ietf.org/html/rfc6785) This is now in the Pigeonhole master branch. This allows running Sieve scripts at IMAP activity, rather than at delivery. There are also facilities for the familiar sieve_before/sieve_after administrator scripts. The documentation is currently only in the sources and not on the wiki: https://raw.githubusercontent.com/dovecot/pigeonhole/master/doc/plugins/ima… - Yesterday, I implemented online trace debugging for Sieve scripts: i.e., directly during delivery rather than only using the sieve-test tool. This is also supported for the IMAPSIEVE feature discussed above. This is documented in the INSTALL file: https://github.com/dovecot/pigeonhole/blob/master/INSTALL#L522 In other news, I started a specification for a new Sieve feature that allows using the IMAP SPECIAL-USE attributes from Sieve scripts: https://tools.ietf.org/html/draft-bosch-sieve-special-use-00 There is no implementation yet. Any comments, suggestions or bug reports are welcome. Regards, Stephan.

2 4