- dovecot - dovecot.org

possible patch for ACL SQL ERROR: duplicate key value violates unique constraint "user_shares_pkey"
by Steffen Kaiser 24 Jul '15

24 Jul '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I'm using Postgres as dict backend now and then I get this error, when someone changed ACLs, actually for some reason some users, who get permission from other users, get this error quite often: dict: Error: sql dict: commit failed: ERROR: duplicate key value violates unique constraint "user_shares_pkey" (query: INSERT INTO user_shares (dummy,to_user,from_user) VALUES ('1','user1','user2')) It looks like that this error is triggered, when a MUA is connecting to Dovecot after ACLs had been changed and opens several mailboxes at once. So two or parallel Dovecot instances try to insert the record simultaneously. With a similiar technique to the quota problem, I added a trigger. The idea is to use the condition dummy ISNULL to detect, that the function was triggered from the INSERT of the function itself, hence, breaking the recursive triggers. This assumes that dummy is never NULL from Dovecot. The same applies to anyone_shares, just remove the to_user field from the function. Does somebody see something wrong with my hack? ============= CREATE FUNCTION insert_sharing() RETURNS trigger LANGUAGE plpgsql AS $$ BEGIN IF NEW.dummy IS NULL THEN -- ugly kludge: we came here from this function, really do try to insert return NEW; END IF; LOOP UPDATE user_shares SET dummy = NEW.dummy WHERE from_user = NEW.from_user AND to_user = NEW.to_user; IF found THEN -- updated and inserted RETURN NULL; END IF; BEGIN INSERT INTO user_shares (from_user,to_user,dummy) VALUES (NEW.from_user,NEW.to_user,NULL); --- return NULL; EXCEPTION WHEN unique_violation THEN -- someone just inserted the record, update it END; -- Update dummy after INSERT END LOOP; END; $$; CREATE TRIGGER insertsharing BEFORE INSERT ON user_shares FOR EACH ROW EXECUTE PROCEDURE insert_sharing(); - -- Steffen Kaiser -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQEVAwUBVbHxJXz1H7kL/d9rAQIn5gf/dNMQKmmigGrbccGQQrsGU66B6OHvTY7L 1vyh8hgr985KNk2/Ws/usLnAqpl5jhpo8kVPLI8TqcGYLAS/67TOIFrwLKAEBU96 e+QpbqqiSm66mZwWOQZgCI63+Fh7fdBUMREL6UqGleFF1GrzNnjmX4MGecbpu/L9 gQMAGUG++/S+ka9S6B275RXIj9DvWzq/oYqJ1M1grGckUxXfDk5szLyvuIJ981At 20qaCHEIlIOlkQ0ttE4W+RWkkYS2rMJvCzQelF4pcm6vaxhXxvqUryzmy9pv+UUT osqS6igWt7BPXF7ku8+rKYVp/qPZrh9IWXMsajr/2nI+V5gRb6u2ow== =gb1P -----END PGP SIGNATURE-----

1 0

Authenticate system user with alternate password
by AC 22 Jul '15

22 Jul '15

Is there a way to configure Dovecot to authenticate a system user against a different password list? I want to give my own personal account on my machine a password for IMAP and have that be different from the password I use to log into the system for maintenance purposes. I currently do this for outbound email by having the MTA authenticate against a SASL database during the initial SMTP connection (STARTTLS).

2 1

Client Limit reached in Dovecot
by Chandran Manikandan 22 Jul '15

22 Jul '15

Dear Friends, I have faced below issues since two weeks to till now. Could anyone help me to rectify this issue. Below message retrieve from logs and getting disconnection from Outlook and other email clients. Error Message Jul 20 10:33:35 master: Warning: service(imap-login): process_limit (100) reached, client connections are being dropped My local.conf from dovecot folder protocol imap { imap_client_workarounds = "delay-newmail" mail_max_userip_connections = 20 default_process_limit = 300 } 10-master.conf default_process_limit = 300 default_client_limit = 1000 service imap-login { inet_listener imap { # process_limit = 15 # client_limit = 300 #port = 143 } -- *Thanks,* *Manikandan.C* *System Administrator*

2 2

dovecot proxy/director and high availability design
by Chad M Stewart 21 Jul '15

21 Jul '15

I'm trying to determine which dovecot components to use and how to order them in the network path from client to mail store. If I have say 1,000 users, all stored in MySQL (or LDAP) and have 4 mail stores, configured into 2, 2 node pods. MS1 and MS2 are pod1 and are configured with replication (dsync) and host users 0-500. MS3 and MS4 are pod2 and are configured with replication between them and host users 501-1000. Ideally the active connections in pod1 would be split 50/50 between MS1 and MS2. When maintenance is performed obviously all active connections/users would be moved to the other node in the pod and then rebalanced once maintenance is completed. I'm not sure if I need to use both the proxy and director, or just one or the other? If both then what is the proper path, from a network perspective? I like the functionality director provides, being able to add/remove servers on the fly and adjust connections, etc.. But from what I've read director needs to know about all mail servers. The problem is that not all servers host all users. User100 could be serviced by ms1 or ms2, but not by ms3 or ms4. I'm trying to design a system that should provide as close to 99.999% service availability as possible. Thank you, Chad

5 8

SSL accept error
by jjhoffart 21 Jul '15

21 Jul '15

Hello, I am having some trouble isolating an issue with my mail server. In my mail log I keep receiving the following errors: SSL_accept:failed in SSLv3 read client certificate A SSL_accept: error form client(a)mydomain.com: lost connection SSL_accept:SSLv3 flush data I have look through both my dovecot and postfix configs but have not been able to isolate the issue yet, hoping someone might be able to help.

3 2

Re: Client Limit reached in Dovecot
by Daniel Tröder 21 Jul '15

21 Jul '15

Hallo :) On mailinglists please reply below the previous post. It's easier to read this way. Am 21.07.2015 um 11:26 schrieb Chandran Manikandan: > Dear Daniel, > Thanks for your kind response. As per your above command got below > result. but i couldn't see below settings are local.conf,10-master.conf > or toaster.conf. Where it's retrieved. > default_process_limit=100 > default_client_limit=1000 > default_vsz_limit=256 M > service/imap/process_limit=1024 > service/imap/client_limit=1 > service/imap/service_count=1 > service/imap/vsz_limit=18446744073709551615 B > service/imap-login/process_limit=0 > service/imap-login/client_limit=0 > service/imap-login/service_count=1 > service/imap-login/vsz_limit=18446744073709551615 B My guess is, that service/imap-login/process_limit=0 disables the setting and then default_process_limit=100 applies. As to where default_process_limit=100 comes from… try: grep -r default_process_limit /etc/dovecot Greeting Daniel > > > > On Tue, Jul 21, 2015 at 4:56 PM, Daniel Tröder <troeder(a)univention.de > <mailto:troeder@univention.de>> wrote: > > Am 21.07.2015 um 10:35 schrieb Chandran Manikandan: > > Dear Friends, > > I have faced below issues since two weeks to till now. Could anyone help me > > to rectify this issue. > > > > Below message retrieve from logs and getting disconnection from Outlook and > > other email clients. > > > > Error Message > > > > Jul 20 10:33:35 master: Warning: service(imap-login): process_limit (100) > > reached, client connections are being dropped > > > > My local.conf from dovecot folder > > > > protocol imap { > > imap_client_workarounds = "delay-newmail" > > mail_max_userip_connections = 20 > > default_process_limit = 300 > > } > This should be just "process_limit" without "default". But it's > unnecessary, as you set globally default_process_limit. > > > 10-master.conf > > > > default_process_limit = 300 > > default_client_limit = 1000 > > > > service imap-login { > > inet_listener imap { > > # process_limit = 15 > > # client_limit = 300 > > #port = 143 > > } > It is the "imap-login" process_limit that is reached. With the set > default_process_limit=300 this shouldn't happen. So maybe there is some > setting somewhere else, that is not shown. Please supply the output of: > > doveconf -S | egrep '(default|imap/|imap-login).*(limit|service_count)' > > Greetings > Daniel Tröder > > > > > -- > *Thanks,* > *Manikandan.C* > *System Administrator*

1 0

Dovecot in UCS
by Daniel Tröder 21 Jul '15

21 Jul '15

Hello :) I hope you can forgive me a little advertisement: The English translation of my blog post on the Dovecot integration I did for the Univention Corporate Server (UCS) is online: https://www.univention.com/2015/07/dovecot-is-the-default-imappop3-mail-ser… UCS is a Debian based Linux Distribution, everything - incl. management bits - is OSS. There is a "Core Edition" that you can download and use (also commercially) for free, that is - despite its name - feature complete: https://www.univention.com/downloads/ucs-download A lot of interesting Dovecot features can be changed without breaking things, so this blog post may be interesting to everyone. The German version can be found here: https://www.univention.de/2015/07/mailserver-dovecot-als-standard-imappop3-… Greetings Daniel Tröder

1 0

[Dovecot] Dovecot FTS using ElasticSearch
by Darvin Denmian 20 Jul '15

20 Jul '15

Hi, I would like to know if is possible to use ElasticSearch instead of Solr for FTS. Regards, Erick Vitor de Barros.

6 6

[Dovecot Antispam] Can't seem to load plugin
by James Lott 20 Jul '15

20 Jul '15

Hello list, I'm hoping there is a user of the antispam plugin out there who might be able to lend a pointer or two. I am running dovecot 2.2.18 on FreeBSD 10 (doveconf -n attached), where I have installed the binary dovecot2-antispam-plugin package. I have put together what should, in my estimation, be a working configuration for the plugin. I have reviewed the man page and the online documentation, and I think at the *very least* I should be seeing errors for something not working correctly. However, what I have is a great deal more troubling. There is no sign on the plugin even attempting to load. No log entries, no errors, nothing. The plugin is definitely in the right place with the right name, since I let the package manager handle all of that for me root@zerolag:~ # ls -l /usr/local/lib/dovecot/lib90_antispam_plugin.so -rwxr-xr-x 1 root wheel 32488 Jul 2 09:41 /usr/local/lib/dovecot/lib90_antispam_plugin.so I am unable to make any sense of this. Thanks in advance for any pointers :) -- James Lott

4 6

Problems with IMAP/POP and dovecot director on backend (director_proxy_maybe)
by dominik 20 Jul '15

20 Jul '15

Hello dovecot community, first of all: dovecot ist great! ;) ...nevertheless I´ve got some problems to get my director scenario running as needed/expected :( My scenario: I´d like to configure two dovecot backends, without the need for multiple dovecot instances. Both backend servers are active/active and act on top of a glusterfs storage, which implies the need for dovecot director. As described in release notes (v2.2.17) this should be possible by setting the extra field "director_proxy_maybe=yes".: "+ director: Implemented director_proxy_maybe passdb extra field to be able to run director and backend in the same Dovecot instance. (LMTP doesn't support mixed proxy/non-proxy destinations currently.)" My setup: * 1 LMTP client (SLES11p3 with postfix) * 1 IMAP/POP3 client (Debian8 with thunderbird 31.6.0): 10.0.0.26. The client connects through a dovecot mailproxy or direct. * 1 dovecot mailproxy: 10.0.1.151 * 2 mailbox backends running dovecot v2.2.18 on SLES11p3 with mail_location pointing to a glusterfs-mountpoint (GlusterFS: v3.6.3) * mailbox01.example.de: 10.0.2.21 * mailbox02.example.de: 10.0.2.22 * mailbox-gluster.example.de points as an A-RR to 10.0.2.21 and 10.0.2.22. My problem: With LMTP everything works fine (thanks for this!). The director sets the "host" field correctly and all delivery attempts work fine to the estimated backend servers. But when I try to connect via IMAP-/POP3-client (through proxy or direct) it fails with following log messages. It seems, that the director doesn´t set the host field within IMAP/POP sessions before proxying!? auth: Debug: auth client connected (pid=46359) imap-login: ID sent: x-session-id=V3iJmU4biAAK/BAa, x-originating-ip=10.0.0.26, x-originating-port=54408, x-connected-ip=10.0.1.151, x-connected-port=143, x-proxy-ttl=4: user=<>, rip=10.0.1.151, lip=10.0.2.21, session=<RVnAm04bzwAK/FCX> auth: Debug: client in: AUTH 1 PLAIN service=imap session=RVnAm04bzwAK/FCX lip=10.0.2.21 rip=10.0.1.151 lport=143 rport=54735 resp=<hidden> auth: Debug: ldap(tester(a)example.de,10.0.1.151,<RVnAm04bzwAK/FCX>): bind search: base=o=example,c=de filter=(&(|(uid=tester@example.de)(mail=tester@example.de))(!(<cut-cut-cut>)) [...] auth: Debug: client passdb out: OK 1 user=tester(a)example.de director_proxy_maybe=yes lip=10.0.2.21 lport=143 proxy pass=<hidden> imap-login: Debug: Ignoring unknown passdb extra field: director_proxy_maybe imap-login: Debug: Ignoring unknown passdb extra field: lip imap-login: Debug: Ignoring unknown passdb extra field: lport imap-login: Error: proxy: host not given: user=<tester(a)example.de>, method=PLAIN, rip=10.0.2.151, lip=10.0.2.21, session=<RVnAm04bzwAK/FCX> imap-login: Disconnected (internal failure, 1 successful auths): user=<tester(a)example.de>, method=PLAIN, rip=10.0.2.151, lip=10.0.2.21, session=<RVnAm04bzwAK/FCX> Finally the output of "doveadm proxy list" is empty! "doveadm director map" output after a successfull LMTP delivery attempt (before: doveadm director flush all): user hash mail server ip expire time tester(a)example.de 856838019 10.0.2.21 2015-07-20 15:49:18 "doveadm director map" output after a failed IMAP session attempt (before: doveadm director flush all): user hash mail server ip expire time tester(a)example.de 856838019 10.0.2.21 2015-07-20 15:50:02 So, director seems to work in this constellation, but only for LMTP and not for IMAP/POP Proxy :( Has anybody configured this before? Thanks in advance and a lot of greetings from Germany, Dominik ############ My config (mailbox01.example.de. mailbox02.example.de is identical, except the hostname): # doveconf -n # 2.2.18: /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.8 (0c4ae064f307+) # OS: Linux 3.0.101-0.46-default x86_64 SUSE Linux Enterprise Server 11 (x86_64) auth_cache_negative_ttl = 0 auth_cache_ttl = 5 mins auth_debug = yes auth_master_user_separator = "#" auth_mechanisms = plain login auth_verbose = yes auth_verbose_passwords = sha1 director_consistent_hashing = yes director_mail_servers = mailbox-gluster.example.de director_servers = 10.0.2.21:9090 10.0.2.22:9090 disable_plaintext_auth = no imap_metadata = yes listen = mailbox01.example.de lmtp_proxy = yes lmtp_save_to_detail_mailbox = yes lock_method = dotlock login_log_format_elements = user=<%u> method=%m rip=%r lip=%l mpid=%e %c session=<%{session}> %k login_trusted_networks = 10.0.2.0/24 mail_access_groups = dovecot mail_attribute_dict = file:Maildir/dovecot-metadata mail_debug = yes mail_fsync = always mail_location = maildir:~/Maildir/ mail_plugins = quota acl managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mmap_disable = yes namespace { inbox = yes location = mailbox Archiv { special_use = \Archive } mailbox Entwürfe { special_use = \Drafts } mailbox "Gelöschte Objekte" { special_use = \Trash } mailbox "Gesendete Objekte" { special_use = \Sent } mailbox Sent { special_use = \Sent } mailbox Trash { special_use = \Trash } mailbox unerwünscht { special_use = \Junk } prefix = INBOX/ separator = / } namespace { disabled = yes list = children location = maildir:%%h/:INDEXPVT=~/dovecot.index.shared/%%u/ prefix = SHARED/%%u/ separator = / type = shared } passdb { args = /***********/passwd.masterusers driver = passwd-file master = yes } passdb { args = /etc/dovecot/ldap.conf driver = ldap } plugin { acl = vfile acl_shared_dict = file:/var/lib/dovecot/db/shared-mailboxes.db } postmaster_address = postmaster@%d protocols = " imap lmtp pop3" service auth-worker { user = $default_internal_user } service auth { unix_listener /var/spool/postfix/private/saslauth_via_dovecot { group = postfix mode = 0660 user = postfix } unix_listener auth-userdb { mode = 0666 user = dovecot } } service director { fifo_listener login/proxy-notify { mode = 0600 user = $default_login_user } inet_listener { port = 9090 } unix_listener director-userdb { mode = 0666 } unix_listener login/director { mode = 0666 } } service doveadm { inet_listener { port = 24245 } } service imap-login { executable = imap-login director inet_listener imaps { port = 0 } } service ipc { unix_listener ipc { user = dovecot } } service lmtp { inet_listener lmtp { port = 24 } } service managesieve-login { inet_listener sieve { address = mailbox01.example.de } } service pop3-login { executable = pop3-login director } ssl = no ssl_cipher_list = kEECDH+aRSA+AES256:kEDH+aRSA+AES256:ECDHE-RSA-AES256-SHA:DHE-RSA-AES256-SHA ssl_dh_parameters_length = 4096 ssl_options = no_compression ssl_prefer_server_ciphers = yes ssl_protocols = !SSLv2 !SSLv3 !TLSv1.1 userdb { args = /etc/dovecot/ldap.conf driver = ldap } verbose_proctitle = yes protocol lmtp { auth_socket_path = director-userdb mail_plugins = quota notify mail_log } protocol imap { imap_id_log = * mail_plugins = quota fts fts_squat imap_quota mail_log notify acl imap_acl } protocol pop3 { mail_plugins = quota acl pop3_uidl_format = %fan } ################ My /etc/dovecot/ldap.conf: uris = ldap://ldap.example.de pass_filter = (&(|(uid=%u)(mail=%u))(!(<cut-cut-cut>))) pass_attrs = =proxy_maybe=yes, \ =director_proxy_maybe=yes user_filter = (&(|(uid=%u)(mail=%u)(mailAlternateAddress=%u))(!(<cut-cut-cut>))) user_attrs = =master_user=%u, \ =uid=%{ldap:qmailUID:12345}, \ =gid=%{ldap:qmailGID:12345}, \ =home=/mnt/testvol2/%{ldap:mailMessageStore}/%1{ldap:mail}/%{ldap:mail}/, \ =quota_rule=*:bytes=%{ldap:mailQuotaSize:128M} iterate_attrs = mail=user iterate_filter = (objectClass=qmailuser)

1 0