- dovecot - dovecot.org

AD LDAP auth shows unknown results
by victorpictor＠mailbox.hu 15 Apr '16

15 Apr '16

Hi List! Been struggling with AD LDAP auth, ldapsearch shows everything fine, but when I try to telnet, the log shows unknown attributes. Dovecot 2.0.19 dovecot -n: # 2.0.19: /etc/dovecot/dovecot.conf # OS: Linux 3.5.0-23-generic x86_64 Ubuntu 12.04.5 LTS ext4 auth_debug = yes auth_mechanisms = plain login auth_username_format = %n auth_verbose = yes disable_plaintext_auth = no listen = * mail_location = maildir:/var/mail/%u%d/Maildir namespace inbox { inbox = yes location = prefix = } passdb { args = /etc/dovecot/dovecot-ldap-passdb.conf driver = ldap } plugin { sieve = ~/.dovecot.sieve sieve_dir = ~/sieve sieve_global_dir = /var/lib/dovecot/sieve/ } protocols = " imap lmtp pop3" service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } user = vmail } ssl = no ssl_cert = </etc/ssl/certs/dovecot.pem ssl_key = </etc/ssl/private/dovecot.pem userdb { args = /etc/dovecot/dovecot-ldap-userdb.conf driver = ldap } protocol lmtp { mail_plugins = " sieve" postmaster_address = postmaster(a)domain.hu } Contents of passdb.conf: hosts = 1.2.3.4 auth_bind = yes auth_bind_userdn = DOMAIN\%u ldap_version = 3 base = dc=domain,dc=in scope = subtree deref = never pass_filter = (&(objectClass=person)(sAMAccountName=%u)(mail=*)) Contents of userdb.conf: hosts = 1.2.3.4 dn = DOMAIN\user dnpass = xxx ldap_version = 3 base = dc=domain,dc=in user_attrs = =uid=108,=gid=115,=home=/var/mail/%Lu,=mail=maildir:/var/mail/%Lu/Maildir/ user_filter = (&(objectClass=person)(sAMAccountName=%u)(mail=*)) # Attributes and filter to get a list of all users iterate_attrs = sAMAccountName=user iterate_filter = (objectClass=person) And the log after a test login: Apr 15 18:10:52 ubuntutest2 dovecot: auth: Debug: ldap(user,127.0.0.1): user search: base=dc=domain,dc=in scope=subtree filter=(&(objectClass=person)(sAMAccountName=user)(mail=*)) fields= Apr 15 18:10:52 ubuntutest2 dovecot: auth: Debug: ldap(user,127.0.0.1): result: objectClass(?unknown?)= cn(?unknown?)= instanceType(?unknown?)= whenCreated(?unknown?)= uSNCreated(?unknown?)= name(?unknown?)= objectGUID(?unknown?)= badPwdCount(?unknown?)= codePage(?unknown?)= countryCode(?unknown?)= badPasswordTime(?unknown?)= lastLogoff(?unknown?)= lastLogon(?unknown?)= primaryGroupID(?unknown?)= objectSid(?unknown?)= accountExpires(?unknown?)= logonCount(?unknown?)= sAMAccountName(?unknown?)= sAMAccountType(?unknown?)= userPrincipalName(?unknown?)= objectCategory(?unknown?)= givenName(?unknown?)= initials(?unknown?)= sn(?unknown?)= displayName(?unknown?)= description(?unknown?)= physicalDeliveryOfficeName(?unknown?)= userAccountControl(?unknown?)= msDS-SupportedEncryptionTypes(?unknown?)= pwdLastSet(?unknown?)= homeDrive(?unknown?)= homeDirectory(?unknown?)= memberOf(?unknown?)= mail(?unknown?)= whenChanged(?unknown?)= uSNChanged(?unknown?)= distinguishedName(?unknown?)= Any idea? Thanks for advance! Victorpictor

1 0

Tighten TLS - usage of specific ssl_ec-curve
by Martin 15 Apr '16

15 Apr '16

Hi folks, at first: thanks very much for the great piece of software! I have a proposal to tighten the TLS security: enable the usage of a specific ec-curve in the 10-ssl.conf, e.g. ssl_ec-curve = secp384r1 Reason: I use a 384 bit EC server key, but dovecot uses "only" a prime256v1 curve. Keygen was: f=dovecot; openssl ecparam -name secp384r1 -genkey -out $f.key openssl req -new -x509 -key $f.key -out ${f}.crt -days 2000 -sha512 Server check gives: prio ciphersuite protocols pfs curves 1 ECDHE-ECDSA-AES128-GCM-SHA256 TLSv1.2 ECDH,P-256,256bits prime256v1 2 ECDHE-ECDSA-AES128-SHA256 TLSv1.2 ECDH,P-256,256bits prime256v1 3 ECDHE-ECDSA-AES128-SHA TLSv1.2 ECDH,P-256,256bits prime256v1 4 ECDHE-ECDSA-AES256-GCM-SHA384 TLSv1.2 ECDH,P-256,256bits prime256v1 5 ECDHE-ECDSA-AES256-SHA384 TLSv1.2 ECDH,P-256,256bits prime256v1 6 ECDHE-ECDSA-AES256-SHA TLSv1.2 ECDH,P-256,256bits prime256v1 Certificate: UNTRUSTED, 384 bit, ecdsa-with-SHA512 signature $ sudo nano /etc/dovecot/conf.d/10-ssl.conf ssl = required ssl_protocols = !SSlv2 !SSLv3 TLSv1.2 ssl_cipher_list = EECDH+AES128+AESGCM:EECDH+AES256+AESGCM:EECDH+AES128+SHA256:EECDH+AES256+SHA384:EECDH+AES128+SHA:EECDH+AES256+SHA ssl_prefer_server_ciphers = yes ssl_key = </etc/dovecot/dovecot.key ssl_cert = </etc/dovecot/dovecot.crt OS is arch linux. Thanks very much, Martin

2 1

How to filter spam with same to: and from: adress
by Claude 14 Apr '16

14 Apr '16

Is it possible to create a filter somewhere to delete email that have same to: and from: adress. All these email are forged using my domain name with always different fictif user name. The only common point is that they have the same user name in the from: and to: adress Claude Gelinas agr. Phyto Ressources Inc.

2 1

A few new Pigeonhole features
by Stephan Bosch 14 Apr '16

14 Apr '16

Hi, A few new Pigeonhole features that enthusiasts can experiment with: - Recently, I implemented support for the "imapsieve" extension in Sieve and its IMAP counterpart (https://tools.ietf.org/html/rfc6785) This is now in the Pigeonhole master branch. This allows running Sieve scripts at IMAP activity, rather than at delivery. There are also facilities for the familiar sieve_before/sieve_after administrator scripts. The documentation is currently only in the sources and not on the wiki: https://raw.githubusercontent.com/dovecot/pigeonhole/master/doc/plugins/ima… - Yesterday, I implemented online trace debugging for Sieve scripts: i.e., directly during delivery rather than only using the sieve-test tool. This is also supported for the IMAPSIEVE feature discussed above. This is documented in the INSTALL file: https://github.com/dovecot/pigeonhole/blob/master/INSTALL#L522 In other news, I started a specification for a new Sieve feature that allows using the IMAP SPECIAL-USE attributes from Sieve scripts: https://tools.ietf.org/html/draft-bosch-sieve-special-use-00 There is no implementation yet. Any comments, suggestions or bug reports are welcome. Regards, Stephan.

2 4

Dovecot and Windows Live Mail 2012?
by David Mehler 14 Apr '16

14 Apr '16

Hello, I hope someone has this working, because I'm pulling my hair out at this one. I'm using well for this it's a win7 x64 machine running Windows Essentials 2012 and using the Windows Live mail component. I am trying to connect to my Dovecot server running 2.23 I believe. I keep getting the error "the imap command could not be sent to the server because of a non-network error" googling showed many with this, but no fix. In this account I'm trying to access port 143 which uses starttls. In Mail I've got the boxes for require a secure connection and authentication checked. I should note of course and with no surprise that Mail works oh just fine with the Hotmail account I've also got configured, it's only with the downloading of folders and sending of email to the dovecot server that mail has the issue. Please let me know if I can provide any additional information. Help appreciated. Thanks. Dave.

3 3

Best way to only replicate specific users
by Max 14 Apr '16

14 Apr '16

Hi, I was wondering about the best way to achieve this. Currently, the users I don't want replicated do not exist on the target system. The source tries to sync them but runs into an error. Technically, that works for me, but it doesn't seem like the right way to do it and clutters the log. Kind Regards, Max

1 0

antispam plugin, pipe backend, how to make it work?
by Johannes Rohr 13 Apr '16

13 Apr '16

Hi, my setup is a dovecot 2.0.19 IMAP server on Ubuntu Precise with the antispam plugin in version 2.0+20120225-2 and spamassassin at version 3.2.2 I have been trying and failed to get the pipe backend of the antispam plugin to work. Spamassin by itself works, a manual call of sa-learn works fine. Bayes data is stored in a mysql DB. I have the following configuration in /etc/dovecot/conf.d/90-plugin.conf plugin { #setting_name = value sieve=~/.dovecot.sieve sieve_dir=~/sieve antispam_pipe_program_spam_arg = --spam antispam_pipe_program_notspam_arg = --ham antispam_pipe_program = /usr/local/bin/sa-learn-pipe.sh antispam_pipe_program_args = --username=%u # % expansion done by dovecot antispam_trash = trash;Trash;Deleted Items;Deleted Messages antispam_spam = SPAM;Junk antispam_backend = pipe antispam_verbose_debug = 1 antispam_debug_target = syslog antispam_pipe_tmpdir = /tmp } I have tried the following wrapper script: #!/bin/bash # set -x LOGFILE=/tmp/sa-learn-pipe.log echo "$$-start ($*)" >> $LOGFILE #echo $* > /tmp/sendmail-parms.txt cat<&0 >> /tmp/sendmail-msg-$$.txt /usr/bin/sa-learn $* -D /tmp/sendmail-msg-$$.txt >> $LOGFILE 2>&1 && \ rm -f /tmp/sendmail-msg-$$.txt echo "$$-end" >> $LOGFILE exit 0 It somehow isn't working. I can call the wrapper script manually e.g. sudo -u vmail /usr/local/bin/sa-learn-pipe.sh --username=some(a)mail.user --ham \ < someham But it doesn't work from dovecot. It seems the script is called. but no new patterns show up in the bayes DB. Unfortunately, the plugin seems to be documented poorly. How does it call the programme it pipes to? Is it something like $programme --par1 --par2 < message ? Why can't / shouldn't I call sa-learn directly? All the instructions I found on the in internet contained a wrapper script, but none bothered to explain why you would actually need it. I would be very grateful, if someone could enlighten me on that... Cheers, Johannes

6 16

v2.2.23 released
by Timo Sirainen 13 Apr '16

13 Apr '16

http://dovecot.org/releases/2.2/dovecot-2.2.23.tar.gz http://dovecot.org/releases/2.2/dovecot-2.2.23.tar.gz.sig This is a bugfix-only release with various important fixes on top of v2.2.22. - Various fixes to doveadm. Especially running commands via doveadm-server was broken. - director: Fixed user weakness getting stuck in some situations - director: Fixed a situation where directors keep re-sending different states to each others and never becoming synced. - director: Fixed assert-crash related to a slow "user killed" reply - Fixed assert-crash related to istream-concat, which could have been triggered at least by a Sieve script.

6 6

speedup doveadm
by Chris 13 Apr '16

13 Apr '16

All, I've to set ACLs in public namespace for more than 5000 folders. That takes some hours. I'm calling doveadm by a perl script. Is there any way to speedup doveadm? Is it possible to set ACLs for multiple folders or users in a single call? - Chris

1 0

Problem setting owner
by Luca Bertoncello 13 Apr '16

13 Apr '16

Hi list! I have a Dovecot 2.2.9 installed from Ubuntu-Repository. It uses LDAP to authenticate against an Active Directory controller. The authentication works, but it tries always to use the UID of the user for the mailbox... I already added: mail_uid = 1005 mail_gid = 8 in 10-mail.conf and: user_attrs = \ =user=exim, \ =uid=1005, \ =gid=8, \ =quota_rule=*:bytes=%{ldap:quotaBytes}, \ =home=/home/mailboxes/%{ldap:sAMAccountName}/Maildir, \ =mail=maildir:/home/mailboxes/%{ldap:sAMAccountName}/Maildir in the dovecot-ldap.conf.ext, but it seems to ignore them... Could someone help me? Thanks Luca Bertoncello (lucabert(a)lucabert.de)

2 1