- dovecot - dovecot.org

Configure Dovecot for GSSAPI [formerly: Looking for GSSAPI config]
by Mark Foley 06 Jul '16

06 Jul '16

After a over a year and a half struggling to get Dovecot to do either NTLM or GSSAPI authentication with Samba4 AD/DC, I believe I've finally got it! Thanks to all those in this list who helped: Jan Jurkus, Edgar Pettijohn, Gregory Sloop, Tom Talpey especially Aki Tuomi; and infinite thanks to Achim Gottinger on the SambaList for his patience in working this through with me. Although my purpose was for Dovecot to authenticate mail clients, the configuration settings needed were on the Samba side. I hope a variation of these instructions can eventually make it into: http://wiki2.dovecot.org/Authentication/Kerberos What is essentially missing from the wiki is how to set up the proper Service Principal Names and the subsequent creation of a dovecot useable kerberos keytab file. The wiki comment on "k5principals passdb" was not helpful and largely unintelligble to me. Perhaps like many of you, I have switched from Microsoft SBS and Exchange to Samaba4 and Dovecot/IMAP. The transition was completely transparent to my users, except they needed a separate password for email authentication in the absence of NTLM or GSSAPI working with Dovecot. A mild inconvenience, but I have been on a "quest" to fill that gap. This solution finally takes care of that last piece. The following describes how to create the SPNs and krb5 keytab files using Samba4 which has its own built-in (Heimdal) kerberos. The procedures are probably similar for other facilities such as setspn for Windows, but I've not used those so I won't attempt to discuss those mechanism here. You do need kerberos as the Samba built-in kerberos does not have needed commands like `klist`. My distro (Slackware 14.1) does not come with kerberos (nor, I think, does Ubuntu), but is easily found at: https://slackbuilds.org/repository/14.1/network/krb5/ Ubuntu/Debian: apt-get install krb5-config libpam-krb5 krb5-user ssh-krb5 (perhaps more) After provisioning Samba4, copy the krb5.conf template to /etc/krb5.conf. (Note: the actual docs advise symlinking: ln -sf /usr/local/samba/private/krb5.conf /etc/krb5.conf but I prefer making a copy in case I need to modify things). I've set The /etc/krb5.conf file to world readable. It's default contents are (and these do not need to be changed): [libdefaults] default_realm = HPRS.LOCAL dns_lookup_realm = false dns_lookup_kdc = true where HPRS.LOCAL is my realm, of course use your own. Now, we need a samba user in order to create the necessary SPNs (Server Principal Names): $ samba-tool user create dovecot New Password: Retype Password: User 'dovecot' created successfully Next, add the SPN(s), and create the keytab: $ samba-tool spn add imap/mail.hprs.local dovecot $ samba-tool domain exportkeytab --principal imap/mail.hprs.local /etc/dovecot/dovecot.keytab Dovecot does not do my (outgoing) SMTP serving, only (incoming) IMAP, but if it did I'd have to create another SPN for smtp: $ samba-tool spn add smtp/mail.hprs.local dovecot $ samba-tool domain exportkeytab --principal smtp/mail.hprs.local /etc/dovecot/dovecot.keytab Dovecot needs to be able to read the keytab file: $ chgrp dovecot /etc/dovecot/dovecot.keytab $ chmod g+r /etc/dovecot/dovecot.keytab my new keytab: $ klist -Kek /etc/dovecot/dovecot.keytab Keytab name: FILE:/etc/dovecot/dovecot.keytab KVNO Principal ---- -------------------------------------------------------------------------- 1 imap/mail.hprs.local(a)HPRS.LOCAL (des-cbc-crc) (0x232616c2a4fd08f7) 1 imap/mail.hprs.local(a)HPRS.LOCAL (des-cbc-md5) (0x232616c2a4fd08f7) 1 imap/mail.hprs.local(a)HPRS.LOCAL (arcfour-hmac) (0x9dae89a221dc374a39f560833352f60f) (and if I also created the spn for smtp I would also have these:) 1 smtp/mail.hprs.local(a)HPRS.LOCAL (des-cbc-crc) (0x232616c2a4fd08f7) 1 smtp/mail.hprs.local(a)HPRS.LOCAL (des-cbc-md5) (0x232616c2a4fd08f7) 1 smtp/mail.hprs.local(a)HPRS.LOCAL (arcfour-hmac) (0x9dae89a221dc374a39f560833352f60f) DOVECOT SETTINGS: My version: 2.2.15 Of crucial importance is to build dovecot with GSSAPI! That is NOT one of the default settings. In the dovecot build directory: ./configure --with-gssapi=yes Other than that serious build gotcha, settings are pretty simple. Add the following 3 settings to 10-auth.conf: auth_gssapi_hostname = "$ALL" auth_krb5_keytab = /etc/dovecot/dovecot.keytab auth_mechanisms = plain login gssapi The auth_gssapi_hostname is supposedly not required according to some of the above-listed commentors, but my 10-auth.conf template implies differently, so it can't hurt. gssapi does not require a passdb. Use whatever userdb you want. The dovecot wiki doc has some suggestions, not of which I've tried. I use the 'driver = passwd' for my userdb for unrelated reasons. I couldn't get any of this working until I rebooted the Samba AD/DC-Dovecot server, but that just may have been me not stopping/starting Samba and Dovecot in the right sequence (or, everything happened to start working with a concurrent upgrade to Samba 4.2!). In my WIN7 and Ubuntu Thunderbird clients I selected gssapi/kerberos for the IMAP authenticate method and it works! I've even changed the test user's AD password, just to make sure. Someone please put at least the required info on creating the SPNs and krb keytab file for other poor schmucks like me. Now, if I can get NTLM figured out for the remaining Outlook users ... ! --Mark

4 9

Compile error v2.2.25 MacOS X
by James Brown 06 Jul '16

06 Jul '16

Tried to update from 2.2.24 to 2.2.25 using same configure command as previously. make ends with: In file included from guid.c:6: sha1.h:80: error: static or type qualifiers in abstract declarator make[4]: *** [guid.lo] Error 1 make[3]: *** [all] Error 2 make[2]: *** [all-recursive] Error 1 make[1]: *** [all-recursive] Error 1 make: *** [all] Error 2 Mac OS X 10.7.5 Configure statement was: ./configure --with-mysql --with-ssl=openssl Any suggestions? Thanks, James.

3 3

Dovecot2-pigeonhole
by Maximus 06 Jul '16

06 Jul '16

Got an error then I'm trying to upgrade to version 0.4.14: cc1: error: unrecognized command line option "-Wno-duplicate-decl-specifier"

1 0

Postfix/dovecot: user unrecognized, file permissions being misread
by C. Andrews Lavarre 06 Jul '16

06 Jul '16

Hello all. Have spent several days following the excellent tutorial: http://www.binarytides.com/install-postfix-dovecot-debian/ but still fail to have the user recognized and am getting log entries that the mail directories are 0755 when I can clearly see that they are 0774. Very puzzling, any help would be deeply appreciated. Best regards, Andy =========== Details =========== • I can add directories under IMAP, so my IMAP login and permissions must be correct. • I can create an outgoing message under IMAP, but clicking SEND just hangs. Logs do not indicate problem. • I clearly can send it a message with smtp. The message is delivered to postfix, but then dovecot fails to deliver it to a mailbox. ------------------------------------ Log Entries --------------------- --------------- # tail /var/log/mail postfix/qmgr[16390]: 9D6E8C1A77: from=<alavarre(a)gmail.com>, size=2794, nrcpt=1 (queue active) Message has been received postfix/lmtp[16770]: C218DC197D: to=<alavarre(a)privustech.com>, relay=mail.privustech.com[private/lmtp], delay=2560, delays=2260/0.01/300/0, dsn=4.4.2, status=deferred (conversation with mail.privustech.com[private/lmtp] timed out while receiving the initial server greeting) lmtp is not working ------------------------------------ # tail /var/log/dovecot.log auth-worker(16612): Info: pam(alavarre(a)privustech.com,98.179.190.111): unknown user imap-login: Info: Login: user=<alavarre(a)privustech.com>, method=PLAIN, rip=98.179.190.111, lip=70.186.159.22, mpid=16615, TLS, session=<ad;slfj;asfa;> imap(alavarre(a)privustech.com): Error: mkdir(/var/mail/vhosts/privustech.com/alavarre/cur) failed: Permission denied (euid=5000(vmail) egid=5000(vmail) missing +w perm: /var/mail/vhosts/privustech.com/alavarre, dir owned by 0:0 mode=0755) However, the mail directory /var/mail/vhosts/privustech.com/alavarre is -rwxrwxr-- vmail:vmail and I have restarted both postfix and dovecot. ========================= System is openSUSE Leap 42.1 (64). postfix and dovecot with SASL authentication, connecting through a Unix socket: /etc/postfix/main.cf: virtual_transport = lmtp:unix:private/lmtp /etc/dovecot/conf.d/10-master.cf: service lmtp { unix_listener /var/spool/postfix/private/lmtp { mode = 0600 user = postfix group = postfix } The lmtp socket is owned by postfix, while the mail system is owned by vmail, per the tutorial. ------------------------------ I am using virtual users (not system users) defined in /etc/dovecot/dovecot-users: alavarre@privustech.com:{plain}ksaj;flkasjd;ds;f Thanks in advance, Andy

2 6

Dovecot delete and expunge loop
by Il Neofita 06 Jul '16

06 Jul '16

Hi I am using dovecot 2.0.9 with redhat 6.8 One client with Outlook 2013 is deleting and expunging and email over and over changing the uid. I am not able to understand how to solve it.

2 1

kqueue crash on FreeBSD with 2.2.25
by Adam Weinberger 05 Jul '16

05 Jul '16

Hi, 2.2.25 crashes on FreeBSD with a kqueue-related message. I see references to something similar (http://www.dovecot.org/list/dovecot/2012-February.txt) from a couple years ago. I get: Jul 1 10:07:27 imap dovecot: master: Panic: kevent(EV_ADD, READ, 54) failed: Bad file descriptor It's not dumping core, and I get the message even with "protocols =" Downgrading back to 2.2.24 fixes it. What info would be helpful for me to provide here? # Adam -- Adam Weinberger adamw(a)adamw.org http://www.adamw.org

5 11

duplicate Mails with dsync replication
by Dennis Kuhn 05 Jul '16

05 Jul '16

Hi! We have some strange replication issues. Some mails are duplicated when expunged. This bug is quite hard to reproduce, it just happens occasionally. It seems somehow related to sieve. When i deleted the sieve script i could not reproduce this behavior. Here are some logs, mjm-100010(a)mydomain.com is an alias for mjm(a)mydomain.com: # Master Jun 23 00:51:41 dobby4 dovecot: lmtp(mjm-100010(a)mydomain.com): copy from <lmtp DATA>: box=INBOX, uid=7816, msgid=<20160623005132EE517444BB$3A04DF25DD@ABRAHAM>, size=8933 Jun 23 00:51:41 dobby4 dovecot: lmtp(mjm-100010(a)mydomain.com): 4N23HaMVa1fpmQEAJEBNLA: sieve: msgid=<20160623005132EE517444BB$3A04DF25DD@ABRAHAM>: stored mail into mailbox 'INBOX' Jun 23 04:52:57 dobby4 dovecot: pop3(mjm(a)mydomain.com): expunge: box=INBOX, uid=7816, msgid=<20160623005132EE517444BB$3A04DF25DD@ABRAHAM>, size=8933 Jun 23 04:52:57 dobby4 dovecot: dsync-local(mjm(a)mydomain.com): save: box=INBOX, uid=7817, msgid=<20160623005132EE517444BB$3A04DF25DD@ABRAHAM>, size=8933 Jun 23 04:55:21 dobby4 dovecot: pop3(mjm(a)mydomain.com): expunge: box=INBOX, uid=7817, msgid=<20160623005132EE517444BB$3A04DF25DD@ABRAHAM>, size=8933 # Replica Jun 23 00:51:42 dobby5 dovecot: dsync-server(mjm-100010(a)mydomain.com): save: box=INBOX, uid=7816, msgid=<20160623005132EE517444BB$3A04DF25DD@ABRAHAM>, size=8933 Jun 23 04:52:57 dobby5 dovecot: dsync-server(mjm(a)mydomain.com): copy from INBOX: box=INBOX, uid=7817, msgid=<20160623005132EE517444BB$3A04DF25DD@ABRAHAM>, size=8933 Jun 23 04:52:57 dobby5 dovecot: dsync-server(mjm(a)mydomain.com): expunge: box=INBOX, uid=7816, msgid=<20160623005132EE517444BB$3A04DF25DD@ABRAHAM>, size=8933 Jun 23 04:55:22 dobby5 dovecot: dsync-server(mjm(a)mydomain.com): expunge: box=INBOX, uid=7817, msgid=<20160623005132EE517444BB$3A04DF25DD@ABRAHAM>, size=8933 The problem is the "dsync-server(mjm(a)mydomain.com): copy from INBOX: box=INBOX, uid=7817" on dobby5 at 04:52:57. This creates a new uid 7817 and the new mail is replicated back to dobby4. But i have no idea what triggers this copy. Any ideas? The dovecot version is 2.2.24. Thanks Dennis

1 0

many imap connections issue
by Бауыржан Сахариев 05 Jul '16

05 Jul '16

I'm using dovecot 2.1.7 I'm trying to connect to dovecot by imap via Java mail api. My approach described here <http://stackoverflow.com/questions/37991025/why-iterating-over-all-java-mai…>. Bill Shannon, author of the Java Mail api recommended me to check carefully my server side (I have dovecot at server side). Actually, imap login in loop works but very slow. Each store.connect(login,password) takes about 1 minute. I tried to increase mail_max_userip_connections client_limit and process limit but it didn't help. My dovecot sometimes performs query, sometimes not! My logs: Jul 04 18:23:25 auth: Error: pgsql: Query failed, aborting: SELECT email, 'maildir:/home/mailboxes/maildir/'||maildir as mail,'/home/mailboxes/home/'||maildir as home, 500 as uid, 500 as gid FROM users WHERE email = 'test(a)test.domain.com' Jul 04 18:23:25 auth: Error: sql(test(a)test.domain.com,127.0.0.1,<HGiPY842jgB/AAAB>): User query failed: ERROR: permission denied for relation users My user and password queries: password_query = SELECT email as user, password FROM users WHERE email = '%u' user_query = SELECT email as user, 'maildir:/home/mailboxes/maildir/'||maildir as mail, '/home/mailboxes/home/'||maildir as home, 500 as uid, 500 as gid FROM users WHERE email = '%u' My master conf *Please note, that I'm using same uid!* service imap-login { inet_listener imap { #port = 143 } inet_listener imaps { #port = 993 #ssl = yes } # Number of connections to handle before starting a new process. Typically # the only useful values are 0 (unlimited) or 1. 1 is more secure, but 0 # is faster. <doc/wiki/LoginProcess.txt> #service_count = 1 # Number of processes to always keep waiting for more connections. #process_min_avail = 0 # If you set service_count=0, you probably need to grow this. #vsz_limit = $default_vsz_limit } service imap { # Most of the memory goes to mmap()ing files. You may need to increase this # limit if you have huge mailboxes. #vsz_limit = $default_vsz_limit # Max. number of IMAP processes (connections) #process_limit = 1024 } service auth { unix_listener auth-userdb { #mode = 0666 #user = #group = } # Postfix smtp-auth #unix_listener /var/spool/postfix/private/auth { # mode = 0666 #} # Auth process is run as this user. #user = $default_internal_user } service auth-worker { # Auth worker process is run as root by default, so that it can access # /etc/shadow. If this isn't necessary, the user should be changed to # $default_internal_user. #user = root } I'm sure that long login *reason is poor dovecot config* but some things are not clear to me and I can't improve it. 1. Which service are being used when Java connects to dovecot? imap-login,imap or auth? My assumption - imap-login. Imap user for dealing with folders *after* login, auth is for delivery (my assotioations here are postfix,lmtp,lda) =) Is my assumptions about imap-login and other services correct? 2. Which user are being used when I login? One that specified in connection code(one of 50K users in loop) or uid(500) user? I suggested that only one user and increased mail_max_userip_connections is it correct? 3. May some troubles in connection (which I showed above) caused by mode(0660) bad config in master.cf services? 4. Almost each loop iteration connects to dovecot in 60 seconds and rarely connects in a few milliseconds. Is that fact somehow connected with deafult_idle_kill which equlas to 1 mins?

1 0

v2.2.25 released
by Timo Sirainen 04 Jul '16

04 Jul '16

http://dovecot.org/releases/2.2/dovecot-2.2.25.tar.gz http://dovecot.org/releases/2.2/dovecot-2.2.25.tar.gz.sig Some minor fixes and (mainly logging) improvements since rc1. * lmtp: Start tracking lmtp_user_concurrency_limit and reject already at RCPT TO stage. This avoids MTA unnecessarily completing DATA only to get an error. * doveadm: Previously only mail settings were read from protocol doveadm { .. } section. Now all settings are. + quota: Added quota_over_flag_lazy_check setting. It avoids checking quota_over_flag always at startup. Instead it's checked only when quota is being read for some other purpose. + auth: Added a new auth policy service: http://wiki2.dovecot.org/Authentication/Policy + auth: Added PBKDF2 password scheme + auth: Added %{auth_user}, %{auth_username} and %{auth_domain} + auth: Added ":remove" suffix to extra field names to remove them. + auth: Added "delay_until=<timestamp>[+<max random secs>]" passdb extra field. The auth will wait until <timestamp> and optionally some randomness and then return success. + dict proxy: Added idle_msecs=<n> parameter. Support async operations. + Performance improvements for handling large mailboxes. + Added lib-dcrypt API for providing cryptographic functions. + Added "doveadm mailbox update" command + imap commands' output now includes timing spent on the "syncing" stage if it's larger than 0. + cassandra: Added metrics=<path> to connect setting to output internal statistics in JSON format every second to <path>. + doveadm mailbox delete: Added -e parameter to delete only empty mailboxes. Added --unsafe option to quickly delete a mailbox, bypassing lazy_expunge and quota plugins. + doveadm user & auth cache flush are now available via doveadm-server. + doveadm service stop <services> will stop specified services while leaving the rest of Dovecot running. + quota optimization: Avoid reading mail sizes for backends which don't need them (count, fs, dirsize) + Added mailbox { autoexpunge_max_mails=<n> } setting. + Added welcome plugin: http://wiki2.dovecot.org/Plugins/Welcome + fts: Added fts_autoindex_exclude setting. - v2.2.24's MIME parser was assert-crashing on mails having truncated MIME headers. - auth: With multiple userdbs the final success/failure result wasn't always correct. The last userdb's result was always used. - doveadm backup was sometimes deleting entire mailboxes unnecessarily. - doveadm: Command -parameters weren't being sent to doveadm-server. - If dovecot.index read failed e.g. because mmap() reached VSZ limit, an empty index could have been opened instead, corrupting the mailbox state. - imapc: Fixed EXPUNGE handling when imapc_features didn't have modseq. - lazy-expunge: Fixed a crash when copying failed. Various other fixes. - fts-lucene: Fixed crash on index rescan. - auth_stats=yes produced broken output - dict-ldap: Various fixes - dict-sql: NULL values crashed. Now they're treated as "not found".

6 8

Shared mailboxes not showing up in shared namespace
by Marti Markov 04 Jul '16

04 Jul '16

Hi, I think I have configured everything correctly but for some reason I can’t get a list of the shared mailboxes to show up. When I run: doveadm acl debug -u m.markov Shared/d.marteva/INBOX doveadm(root): Debug: Skipping module doveadm_fts_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/lib20_doveadm_fts_plugin.so: undefined symbol: fts_backend_rescan (this is usually intentional, so just ignore this message) doveadm(m.markov): Debug: Added userdb setting: plugin/=yes doveadm(m.markov): Debug: Effective uid=1000, gid=1000, home=/home/vmail/domain.com/m.markov doveadm(m.markov): Debug: Namespace inbox: type=private, prefix=, sep=/, inbox=yes, hidden=no, list=yes, subscriptions=yes location=maildir:~/Maildir doveadm(m.markov): Debug: maildir++: root=/home/vmail/domain.com/m.markov/Maildir, index=, indexpvt=, control=, inbox=/home/vmail/domain.com/m.markov/Maildir, alt= doveadm(m.markov): Debug: acl: initializing backend with data: vfile doveadm(m.markov): Debug: acl: acl username = m.markov(a)domain.com doveadm(m.markov): Debug: acl: owner = 1 doveadm(m.markov): Debug: acl vfile: Global ACLs disabled [ Read 8 lines ] doveadm(m.markov): Debug: Namespace : type=public, prefix=Public/, sep=/, inbox=no, hidden=no, list=yes, subscriptions=yes location=maildir:/home/vmail/Public:INDEXPVT=~/Maildir/Publics doveadm(m.markov): Debug: maildir++: root=/home/vmail/Public, index=, indexpvt=/home/vmail/domain.com/m.markov/Maildir/Public, control=, inbox=, alt=ext ^T To Spell doveadm(m.markov): Debug: acl: initializing backend with data: vfile doveadm(m.markov): Debug: acl: acl username = m.markov(a)domain.com doveadm(m.markov): Debug: acl: owner = 0 doveadm(m.markov): Debug: acl vfile: Global ACLs disabled doveadm(m.markov): Debug: Namespace : type=shared, prefix=Shared/%u/, sep=/, inbox=no, hidden=no, list=yes, subscriptions=yes location=maildir:/home/vmail/domain.com/%u/Maildir:INDEXPVT=~/Maildir/share… doveadm(m.markov): Debug: shared: root=/var/run/dovecot, index=, indexpvt=, control=, inbox=, alt= doveadm(m.markov): Debug: acl: initializing backend with data: vfile doveadm(m.markov): Debug: acl: acl username = m.markov(a)domain.com doveadm(m.markov): Debug: acl: owner = 0 doveadm(m.markov): Debug: acl vfile: Global ACLs disabled doveadm(m.markov): Debug: maildir++: root=/home/vmail/domain.com/d.marteva/Maildir, index=, indexpvt=/home/vmail//d.marteva/Maildir/shared/d.marteva, control=, inbox=/home/vmail/domain.com/d.marteva/Maildir, alt= doveadm(m.markov): Debug: acl: initializing backend with data: vfile doveadm(m.markov): Debug: acl: acl username = d.marteva doveadm(m.markov): Debug: acl: owner = 1 doveadm(m.markov): Debug: acl vfile: Global ACLs disabled doveadm(m.markov): Debug: maildir++: root=/home/vmail/domain.com/d.marteva/Maildir, index=, indexpvt=/home/vmail/domain.com/m.markov/Maildir/shared/d.marteva, control=, inbox=/home/vmail/domain.com/d.marteva/Maildir, alt= doveadm(m.markov): Debug: acl: initializing backend with data: vfile doveadm(m.markov): Debug: acl: acl username = m.markov(a)domain.com doveadm(m.markov): Debug: acl: owner = 0 doveadm(m.markov): Debug: acl vfile: Global ACLs disabled doveadm(m.markov): Info: Mailbox 'INBOX' is in namespace 'Shared/d.marteva/' doveadm(m.markov): Info: Mailbox path: /home/vmail/domain.com/d.marteva/Maildir doveadm(m.markov): Info: Per-user private flags in mailbox: \Seen doveadm(m.markov): Debug: acl vfile: reading file /home/vmail/domain.com/d.marteva/Maildir/dovecot-acl doveadm(m.markov): Info: User m.markov(a)domain.com has rights: lookup read write create doveadm(m.markov): Info: Mailbox found from dovecot-acl-list doveadm(m.markov): Info: User d.marteva found from ACL shared dict doveadm(m.markov): Info: Mailbox Shared/d.marteva/INBOX is visible in LIST Here is how I have defined the namespace: namespace { type = shared separator = / prefix = Shared/%%u/ # a) Per-user seen flags. Maildir indexes are shared. (INDEXPVT requires v2.2+) location = maildir:/home/vmail/domain.com/%%u/Maildir:INDEXPVT=~/Maildir/shared/%%u # b) Per-user seen flags. Maildir indexes are not shared. If users have direct filesystem level access to their mails, this is a safer option: #location = maildir:%%h/Maildir:INDEX=~/Maildir/shared/%%u:INDEXPVT=~/Maildir/shared/%%u subscriptions = yes # list = children list=yes } And here is the ACL config: plugin { #acl = vfile:/etc/dovecot/global-acls:cache_secs=300 acl = vfile } # To let users LIST mailboxes shared by other users, Dovecot needs a # shared mailbox dictionary. For example: plugin { #acl_shared_dict = file:/var/lib/dovecot/shared-mailboxes acl_shared_dict = file:/home/vmail/domain.com/shared-mailboxes2 #acl_lookup_dict = file:/home/vmail/domain.com/shared-mailboxes } Any suggestions?

3 7