- dovecot - dovecot.org

talloc access after free error ntlmssp_server.c:457
by J Landwehr 30 Mar '16

30 Mar '16

Our new/fresh dovecot imap installation on CentOS (latest from yum repository, which is 2.2.10) is locking up with a panic on a consistent basis and denying service to subsequent clients. The behavior is repeatable. Have spent weeks debugging and trying different configurations with no success. Specific /var/log/maillog error messages are: 12:06:54 dovecot: auth: Error: talloc: access after free error - first free may be at ../auth/ntlmssp/ntlmssp_server.c:457 12:06:54 dovecot: auth: Error: Bad talloc magic value - access after free 12:06:54 dovecot: auth: Error: PANIC (pid 2570): Bad talloc magic value - access after free Our configuration is based on the instructions for NTLM authentication with our Windows 2012R2 AD/Domain server: http://wiki2.dovecot.org/HowTo/ActiveDirectoryNtlm <http://wiki2.dovecot.org/HowTo/ActiveDirectoryNtlm> Here are the steps to reproduce: 1. Fresh boot of CentOS server, only configured for postfix/dovecot 2. Connect with Outlook 2016 12.0.4312.1000 32bit on Win7 via IMAP to this dovecot server 3. Any existing and new mail loads in OK to inbox - so authentication is working OK to AD domain server 4. Send an email to someone from Outlook 5. SMTP process completes, message is delivered - 6. dovecot immediately panics on servers, Authentication to dovecot no longer works 7. <systemctl restart dovecot> will hang until a <kill -9> on the “dovecot/auth” PID is performed The issue is with steps 6/7 immediately after 4/5- and is intermittent. Steps 1-3 always work OK, as do 4-5. Further, inbound emails received on this server when no IMAP client is running are always received just fine and dovecot doesn’t hang. Sometimes I have to send a few email messages with steps 4/5 before the issue with 6/7 happens. If I tail -f /var/log/maillog on the server, I can usually determine when 6/7 will fail because there is a line or two with: "dovecot: map: Disconnected: logged out message” being shown, even though the Outlook client is still open. After I see that Outlook closed an IMAP session, even though outlook is still running, I can send a message from Outlook and after it appears in my inbox, dovecot panics/hangs immediately Authentication is otherwise working, e.g. test with: /usr/bin/ntlm_auth —username=alice occasionally takes several seconds to respond, but is usually immediate response is always NT_STATUS_OK: Success (0x0) (I welcome tips to make ntlm_auth always respond more quickly!) I have tried adding lines to smb.conf like: win bind cache time = 300 win bind offline login = true No success I have also looked further into the detailed debugging logs and there is: dovecot: auth: Error: Go user=[alice] domain=[OFFICE] workstation=[pc1] len1=24 len2=290 dovecot: auth: error: login for user [OFFICE]\[alice]@[pc1] failed due to [Wrong Password] dovecot: auth: Error: GENSEC login failed: NT_STATUS_LOGON_FAILURE dovecot: auth: winbind(?,x.x.x.x,<XXX>): user not authetnicated: NT_STATUS_LOGON_FAILURE But I am not sure why there would be that error, since earlier IMAP sessions are working just fine with the same exact domain/username and password. It seems to be something about Outlook quickly opening up new simultaneous IMAP sessions with a CONT command, and NTLM authentication somehow fails with one of them, and panics. It always seems to be when sending an email. Like the process of either receiving a new msg in the inbox and/or also posting the just sent message into the Sent Items folder via IMAP (perhaps when it happens simultaneously, as in a message you cc yourself on) is somehow triggering this. Here is more detailed information that can hopefully help track this down. Thank you! dovecot -n # 2.2.10: /etc/dovecot/dovecot.conf CentOS 7.2.1511 auth_mechanisms = ntlm auth_use_winbind = yes auth_username_format = %n mbox_write_locks = fcntl passdb { drive = pam } protocols = imap service auth { user = root } userdb { driver = passwd } /etc/samba/smb.conf workgroup = OFFICE realm = OFFICE.LOCAL security = ADS local master = no preferred master = no dns proxy = no idmap uid = 10000-20000 idmap gid = 10000-20000 password server = win2012r2 encrypt passwords = no kerberos method = system keytab winbind use_default_domain = yes winbind offline login = true winbind separator = + ERROR MESSAGE 12:00:10 dovecot: imap(alice): Disconnected: logged out in=398 out=4368 12:05:52 postfix/smtpd: connect from pc1 12:05:52 postfix/smtpd: client=pc1 12:05:52 postfix/cleanu: message-id=<XXX> 12:05:52 postfix/qmgr: from=alice, size=5925, nrcpt=1 (queue active) 12:05:53 postfix/smtp: to=bob, relay=mailserver, delay=0.93, dsn=2.0.0, status=send (250 ok: Message accepted) 12:06:53 postfix/qmgr: removed 12:06:54 dovecot: auth: Debug: Loading modules from directory: /usr/lib64/dovecot/auth 12:06:54 dovecot: auth: Debug: Module loaded: /usr/lib64/dovecot/auth/libdriver_sqlite.so 12:06:54 dovecot: auth: Debug: Read auth token secret from /var/run/dovecot/auth-token-secret.dat 12:06:54 dovecot: auth: Debug: auth client connected (pid=2565) 12:06:54 dovecot: auth: Debug: auth client connected (pid=2568) 12:06:54 dovecot: auth: Debug: auth client connected (pid=2569) 12:06:54 dovecot: auth: Debug: client in: AUTH#0111#011NTLM#011service=imap#011session=XXXip=X.X.X.X#011rip=X.X.X.X#011lport=143#011rport=61072 12:06:54 dovecot: auth: Debug: client in: AUTH#0111#011NTLM#011service=imap#011session=XXXip=X.X.X.X#011rip=X.X.X.X#011lport=143#011rport_61061 12:06:54 dovecot: auth: Debug: client in: AUTH#0111#011NTLM#011service=imap#011sessoin=XXXip=x.x.x.x#011lip=X.X.X.X#011lport=143#011rport=61073 12:06:54 dovecot: auth: Debug: client passdb out: CONT#0111 12:06:54 dovecot: auth: Debug: client passdb out: CONT#0111 12:06:54 dovecot: auth: Debug: client passdb out: CONT#0111 12:06:54 dovecot: auth: Debug: client in: CONT<hidden> 12:06:54 dovecot: auth: Debug: client passdb out: CONT#0111#011XXX 12:06:54 dovecot: auth: Debug: client in: CONT<hidden> 12:06:54 dovecot: auth: Debug: client passdb out; CONT#0111#011XXX 12:06:54 dovecot: auth: Debug: client passdb out: CONT#0111#011XXX 12:06:54 dovecot: auth: Debug: client in CONT<hidden> 12:06:54 dovecot: auth: winbind(?X.X.X.X,<XXX>): user not authenticated: NT_STATUS_LOGON_FAILURE 12:06:54 dovecot: auth: Debug: client in: CONT<hidden> 12:06:54 dovecot: auth: Error: talloc: access after free error - first free may be at ../auth/ntlmssp/ntlmssp_server.c:457 12:06:54 dovecot: auth: Error: Bad talloc magic value - access after free 12:06:54 dovecot: auth: Error: PANIC (pid 2570): Bad talloc magic value - access after free 12:06:54 dovecot: auth: Error: BACKTRACE: 15 stack frames: 12:06:54 dovecot: auth: Error: #0 /lib64/libsmbconf.so.0(log_stack_trace+0x1a) 12:06:54 dovecot: auth: Error: #1 /lib64/libsmbconf.so.0(smb_panic_s3+0x20) 12:06:54 dovecot: auth: error: #2 /lib53/libsamba-util.so.0(smb_panic+0x2f) 12:06:54 dovecot: auth: Error: #3 /lib64/libtalloc.so.2(+0x20af) 12:06:54 dovecot: auth: Error: #4 /lib64/libtalloc.so.2(_talloc_free+0x545) 12:06:54 dovecot: auth: Error: #5 /lib64/libsamba-util.so.0(data_blob_free+0x18) 12:06:54 dovecot: auth: Error: #6 /lib64/libgensec.so.0(gensec_ntlmssp_server_auth+0xdf) 12:06:54 dovecot: auth: Error: #7 /lib64/libgensec.so.0(gensec_ntlmssp_update+0x253) 12:06:54 dovecot: auth: Error: #8 /lib64/libgensec.so.0(gensec_update_ev+0x232) 12:06:54 dovecot: auth: Error: #9 /lib64/libgensec.so.0(gensec_update+0x17) 12:06:54 dovecot: auth: Error: #10 /usr/bin/ntlm_auth(+0x92df) 12:06:54 dovecot: auth: Error: #11 /usr/bin/ntlm_auth(+0x587f) 12:06:54 dovecot: auth: Error: #12 /usr/bin/ntlm_auth(main+0xc3b) 12:06:54 dovecot: auth: Error: #13 /lib64/libc.so.6(__libc_start_main+0xf5) 12:06:54 dovecot: auth: Error: #14 /usr/bin/ntlm_auth(+0x535d) 12:06:54 dovecot: auth: Error: Can not dump core: corepath not set up 12:06:55 postfix/smtp[2560]: disconnect from pc1 12:09:54 dovecot: imap-login: Disconnected: Inactivity during authentication (disconnected while authenticating, waited 180 secs): user =<>, method=NTLM, rip=x.x.x.x, lip=x.x.x.x, session=<XXX> The last line ends up repeating as clients continue to try to connect.

2 2

Crash when setting quota = count:User quota
by Tom Sommer 29 Mar '16

29 Mar '16

Mar 19 16:54:37 lmtp(xxxx(a)xxx.xxx): Panic: file file-lock.c: line 269: unreached Mar 19 16:54:37 lmtp(xxxx(a)xxx.xxx): Error: Raw backtrace: /usr/lib/dovecot/libdovecot.so.0 [0x35f647e07a] -> /usr/lib/dovecot/libdovecot.so.0 [0x35f647e0e6] -> /usr/lib/dovecot/libdovecot.so.0 [0x35f647d4ac] -> /usr/lib/dovecot/libdovecot.so.0 [0x35f6481edf] -> /usr/lib/dovecot/libdovecot.so.0(file_wait_lock_error+0x3a) [0x35f648205a] -> /usr/lib/dovecot/libdovecot.so.0(file_try_lock_error+0x13) [0x35f6482123] -> /usr/lib/dovecot/libdovecot.so.0(file_create_locked+0x284) [0x35f647f7a4] -> /usr/lib/dovecot/libdovecot-storage.so.0 [0x35f6068ec4] -> /usr/lib/dovecot/libdovecot-storage.so.0(index_mailbox_vsize_update_wait_lock+0xe) [0x35f6068f2e] -> /usr/lib/dovecot/libdovecot-storage.so.0(index_mailbox_get_virtual_size+0x3d) [0x35f606919d] -> /usr/lib/dovecot/libdovecot-storage.so.0(index_mailbox_get_metadata+0x321) [0x35f606fcd1] -> /usr/lib/dovecot/libdovecot-storage.so.0 [0x35f60485a0] -> /usr/lib/dovecot/libdovecot-storage.so.0 [0x35f60593ce] -> /usr/lib/dovecot/libdovecot-storage.so.0(mailbox_get_metadata+0x6e) [0x35f603404e] -> /usr/lib/dovecot/lib10_quota_plugin.so(quota_count+0xe7) [0x2b45f03b9417] -> /usr/lib/dovecot/lib10_quota_plugin.so [0x2b45f03b94fb] -> /usr/lib/dovecot/lib10_quota_plugin.so(quota_get_resource+0x77) [0x2b45f03b74b7] -> /usr/lib/dovecot/lib10_quota_plugin.so(quota_test_alloc+0x191) [0x2b45f03b78f1] -> /usr/lib/dovecot/lib10_quota_plugin.so [0x2b45f03bd5f5] -> /usr/lib/dovecot/libdovecot-storage.so.0(mailbox_save_begin+0x5e) [0x35f6032eae] -> /usr/lib/dovecot/libdovecot-storage.so.0(mail_storage_copy+0x66) [0x35f602ac26] -> /usr/lib/dovecot/libdovecot-storage.so.0(maildir_copy+0x56) [0x35f60435d6] -> /usr/lib/dovecot/lib10_quota_plugin.so [0x2b45f03bd71d] -> /usr/lib/dovecot/libdovecot-storage.so.0(mailbox_copy+0x7a) [0x35f6032cea] -> /usr/lib/dovecot/libdovecot-lda.so.0(mail_deliver_save+0x1ba) [0x35f680813a] -> /usr/lib/dovecot/libdovecot-lda.so.0(mail_deliver+0xf3) [0x35f68084c3] -> dovecot/lmtp [DATA 172.0.0.0 xxxx(a)xxx.xxx] [0x40645c] -> dovecot/lmtp [DATA 172.0.0.0 xxxx(a)xxx.xxx] [0x406bd6] Only happens when I set "quota = count:User quota" -- Tom Sommer

2 3

Dumb question: dovecot include file
by Jerry 29 Mar '16

29 Mar '16

Dovecot has an include file option. What I am not sure of is why those files use both a *.conf and *.conf.ext extension. I assume both types are included by using the !include <FILE>.conf or !include <FILE>.conf.ext syntax. -- Jerry

2 1

RE: plugin can't be loaded in imap proxy mode
by Zhong, Xun 29 Mar '16

29 Mar '16

Hi, All I tested [last-login] plugin, when I directly logined by pam way, the last-login plugin can load and run, but when I logined by proxy way(Dovecot forward my imap request to another imap server), the last-login plugin did not load and run. Thanks From: Zhong, Xun Sent: Wednesday, March 23, 2016 11:47 AM To: 'dovecot(a)dovecot.org' <dovecot(a)dovecot.org> Subject: plugin can't be loaded in imap proxy mode When dovecot v2.2.21 work in IMAP proxy mode, plugin can not be loaded and work, so my question is: plugins do not work in proxy mode? Anyone can help me ? Thanks a lot.

2 1

crash
by Nerijus Baliunas 29 Mar '16

29 Mar '16

Hello, dovecot-2.2.22-1.fc23.x86_64 from Fedora. I have some old messages, and when I try to open them, dovecot dies: Mar 29 15:29:33 nerijus dovecot: imap(nerijus): Error: Maildir filename has wrong S value, renamed the file from /ho me/nerijus/Maildir/.Linux_old.fetchmail/cur/1038402635.13668_0.nerijus,S=11015:2,FS to /home/nerijus/Maildir/.Linux_ old.fetchmail/cur/1038402635.13668_0.nerijus,S=10955:2,FS Mar 29 15:29:33 nerijus dovecot: imap(nerijus): Error: Corrupted index cache file /home/nerijus/Maildir/.Linux_old.f etchmail/dovecot.index.cache: Broken physical size for mail UID 49 in mailbox Linux_old.fetchmail: read(/home/neriju s/Maildir/.Linux_old.fetchmail/cur/1038402635.13668_0.nerijus,S=11015:2,FS) failed: Cached message size larger than expected (11015 > 10955, box=Linux_old.fetchmail, UID=49, cached Message-Id=<20021127125617.GB26938(a)mcdonald.bombay. retortsoft.com>) Mar 29 15:29:33 nerijus dovecot: imap(nerijus): Panic: file istream.c: line 163 (i_stream_read): assertion failed: (old_size <= _stream->pos - _stream->skip) Attaching backtrace1. Mar 29 16:03:16 nerijus dovecot: imap(nerijus): Error: Maildir filename has wrong S value, renamed the file from /ho me/nerijus/Maildir/.Linux_old.FLTK/cur/1033767038.6490_0.nerijus,S=4712:2,S to /home/nerijus/Maildir/.Linux_old.FLTK /cur/1033767038.6490_0.nerijus,S=4665:2,S Mar 29 16:03:16 nerijus dovecot: imap(nerijus): Error: Corrupted index cache file /home/nerijus/Maildir/.Linux_old.F LTK/dovecot.index.cache: Broken physical size for mail UID 109 in mailbox Linux_old.FLTK: read(/home/nerijus/Maildir /.Linux_old.FLTK/cur/1033767038.6490_0.nerijus,S=4712:2,S) failed: Cached message size larger than expected (4712 > 4665, box=Linux_old.FLTK, UID=109, cached Message-Id=<3D9E04B0.2070105(a)easysw.com>) Mar 29 16:03:16 nerijus dovecot: imap(nerijus): Panic: file istream.c: line 163 (i_stream_read): assertion failed: ( old_size <= _stream->pos - _stream->skip) Attaching backtrace2. Regards, Nerijus

1 0

mailbox prefix
by michael crane 29 Mar '16

29 Mar '16

dovecot version 2.2.13 hello, I try to make a new server just for me after having old one working for ages with Dovecot, Fetchmail, Squirrelmail, Procmail making new one with above plus Postfix using Maildir structure. I am having a bit of trouble understanding exactly what the namespace and prefix are. Is the "private/" prefix an internal thing with Dovecot ? Or is it supposed to be a real directory ? I'm not quite sure how to properly address the INBOX in Procmail, Squirrelmail, Postfix config. for example am I supposed to say inbox is ".private/.INBOX" cheers zemlik

2 1

Some mails seen only via POP3 but not via IMAP
by Nikolaos Milas 29 Mar '16

29 Mar '16

2 1

First dovecot install
by Jason Pruim 29 Mar '16

29 Mar '16

Hey Everyone, I am trying to get postfix and dovecot to talk to each other… postfix is up and running, dovecot allows me to telnet into it both locally and remotely, but when I try to do: “a login “username” “password” I get an authentication failed error… Here is my dovecot -n: [ec2-user@ip-172-31-24-2 dovecot]$ dovecot -n # 2.2.10: /etc/dovecot/dovecot.conf # OS: Linux 4.1.17-22.30.amzn1.x86_64 x86_64 auth_debug_passwords = yes auth_mechanisms = plain login first_valid_uid = 200 lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes mail_debug = yes mail_gid = 12 mail_home = /mnt/vmail/%d/%n mail_location = maildir:~ mail_uid = 200 managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave mbox_write_locks = fcntl passdb { args = /etc/dovecot/dovecot-sql.conf driver = sql } plugin { autocreate = Trash autocreate2 = Sent autocreate3 = Junk autosubscribe = Trash autosubscribe2 = Sent autosubscribe3 = Junk sieve = ~/.dovecot.sieve sieve_dir = ~/sieve sieve_global_dir = /etc/dovecot/sieve/global/ sieve_global_path = /etc/dovecot/sieve/default.sieve sieve_max_script_size = 1M } protocols = imap lmtp sieve pop3 service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = ec2-user } unix_listener auth-userdb { group = mail mode = 0600 user = mailreader } } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } service managesieve-login { inet_listener sieve { port = 4190 } } ssl = required ssl_cert = </etc/pki/tls/certs/server.pem ssl_key = </etc/pki/tls/private/server.pem userdb { driver = prefetch } userdb { args = /etc/dovecot/dovecot-sql.conf driver = sql } protocol lmtp { hostname = mail.primelashdiva.info mail_plugins = " autocreate sieve quota" postmaster_address = postmaster(a)primelashdiva.info } protocol lda { auth_socket_path = /var/run/dovecot/auth-master info_log_path = /var/log/dovecot-lda.log log_path = /var/log/dovecot-lda-errors.log mail_plugins = " sieve" } protocol sieve { info_log_path = /var/log/dovecot-sieve.log log_path = /var/log/dovecot-sieve-errors.log managesieve_implementation_string = dovecot managesieve_max_line_length = 65536 } I’m planning to use user accounts for it to connect to… I’m guessing I’m missing something simple, but I don’t know where to look… Any pointers? Thanks in advance! Jason Pruim pruimj(a)gmail.com

2 1

VS: Re: Migrating to dovecot from gmail apps
by Aki Tuomi 28 Mar '16

28 Mar '16

Primarily german ---Aki TuomiDovecot oy-------- Alkuperäinen viesti --------Lähettäjä: Phil Lello <phil(a)dunlop-lello.uk> Päivämäärä: 28.3.2016 19.34 (GMT+02:00) Saaja: Sven Hartge <sven(a)svenhartge.de> Kopio: dovecot(a)dovecot.org Aihe: Re: Migrating to dovecot from gmail apps Many thanks for the replies, I'm going to take a look at OX. Out of curiousity, does anyone know if Open-Xchange is primarily German or American? I'm trying to favour European projects/products as I've realised too much the tech I use is reliant on the US. Phil On Mon, Mar 28, 2016 at 5:14 PM, Sven Hartge <sven(a)svenhartge.de> wrote: > mick.crane <mick.crane(a)gmail.com> wrote: > > On Mon, March 28, 2016 4:13 pm, mj wrote: > > >>>> *Is there currently a good webmail interface to dovecot, > > > squirrelmail > > Squirrelmail is dead. > > S! > > -- > Sigmentation fault. Core dumped. >

1 0

Migrating to dovecot from gmail apps
by Phil Lello 28 Mar '16

28 Mar '16

Hi, I'm considering migrating away from gmail for my (one-man) company, and I'm trying to decide if dovecot is the right option (I'm committed to self-hosting). I'm a developer, so happy to do my own tooling if needed. *Is there currently a good webmail interface to dovecot, or work-in progress?* If not, would a web interface be out-of-scope for dovecot? I want to use SAML for authentication, so a solution that relies on POP/IMAP doesn't meet my needs - unless I add Kerberos into the mix, which is an additional learning curve, and possibly not widely supported. *Is there currently a good web admin interface to dovecot, or work-in-progress?* If not, would a web interface be out-of-scope? Since I prefer using password-protected SSH keys for shell access, and don't want to tie myself to a laptop (and would hate to use vim on a 3G/4G tablet), I'd like to be able to add/remove aliases and play with SIEVE and ACLs through any available browser. *How's the work on sharing messages between folders progressing?* Finally, and I hope you don't mind me asking, are you aware of a good JAVA based alternative to dovecot? I quite like the idea of using lucene indexing on mailboxes, so reducing the number of dependencies has a certain appeal. Best wishes, Phil Lello

7 7