- dovecot - dovecot.org

simple bind + X.509 client certificate?
by Heiko Schlittermann 05 Feb '16

05 Feb '16

Hi, using dovecot 2.2.9. The LDAP server requests a client certificate from dovecot. This client certificate will not be used for authentication, but anyway, the server requests it. No SASL is involved. ldapsearch and Exim work as expected, sending the client cert. The slapd is configured: olcTLSVerifyClient: demand For authentication simple bind should be used. Dovecot doesn't seem to send the requested client certificate. If I sniff the connection, the "Certificate" sent to the server is empty. Using ldapsearch it works (and the certificate isn't empty). Any suggestions? Best regards from Dresden/Germany Viele Grüße aus Dresden Heiko Schlittermann -- SCHLITTERMANN.de ---------------------------- internet & unix support - Heiko Schlittermann, Dipl.-Ing. (TU) - {fon,fax}: +49.351.802998{1,3} - gnupg encrypted messages are welcome --------------- key ID: F69376CE - ! key id 7CBF764A and 972EAC9F are revoked since 2015-01 ------------ -

1 1

doveadm backup -- private flags in shared mailbox
by almut bertha 05 Feb '16

05 Feb '16

dear list, i try to backup our dovecot server via doveadm -Dv backup -A -n inbox -n shared remote:vmail@192.168.122.51 So far, it's working fine except for one thing: the "seen"flags for the shared mailboxes don't get copied to the backup-server. I tried a few things (like calling the doveadm command with different options for the namespaces or defining the mailboxes -m; i also changed the path for INDEXPVT), but none of these worked and i don't know how to tell doveadm to sync these flags. Maybe the config for the namespaces is wrong? Or is it just not possible (yet)? thanks in advance The configs for the source and the backup server are the same: (except for hostname, ip,...) # 2.2.18: /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.8 (0c4ae064f307+) # OS: Linux 4.3.0-1-amd64 x86_64 Debian stretch/sid ext4 auth_verbose = yes default_client_limit = 2500 default_process_limit = 500 disable_plaintext_auth = no doveadm_port = 11111 lmtp_rcpt_check_quota = yes lmtp_save_to_detail_mailbox = yes mail_location = maildir:/srv/vmail/%n/Maildir mail_plugins = " acl quota" managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate imapflags notify namespace { hidden = no inbox = no list = children location = maildir:/srv/vmail/%%n/Maildir:INDEXPVT=/srv/vmail/%n/shared/%%n prefix = shared.%%n. separator = . subscriptions = no type = shared } namespace inbox { hidden = no ignore_on_failure = no inbox = yes list = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk { auto = subscribe special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox Trash { auto = subscribe special_use = \Trash } prefix = INBOX. separator = . subscriptions = yes type = private } passdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } plugin { acl = vfile:/etc/dovecot/global-acls:cache_secs=300 acl_shared_dict = file:/var/lib/dovecot/db/shared-mailboxes.db mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename quota = maildir:User quota:noenforcing quota_grace = 2%% quota_rule = *:storage=3G sieve = /srv/vmail/%Ln/default.sieve sieve_default = /srv/vmail/default.sieve sieve_dir = /srv/vmail/%Ln/sieve sieve_extensions = +notify +imapflags sieve_global_dir = /srv/vmail/global.sieve/ } postmaster_address = postmaster(a)mur.at protocols = " imap lmtp sieve pop3" quota_full_tempfail = yes service auth { unix_listener auth-userdb { group = vmail mode = 0777 user = vmail } } service lmtp { inet_listener lmtp { address = 192.168.122.52 port = 24 } user = vmail } service managesieve-login { inet_listener sieve { port = 4190 } inet_listener sieve_deprecated { port = 2000 } process_min_avail = 1 service_count = 1 vsz_limit = 64 M } service managesieve { process_limit = 256 } userdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } userdb { args = /etc/dovecot/dovecot-ldap-group-userdb.conf.ext driver = ldap } protocol lmtp { mail_plugins = " acl quota sieve" } protocol imap { mail_max_userip_connections = 16 mail_plugins = " acl quota imap_acl imap_quota" } protocol sieve { managesieve_implementation_string = Dovecot Pigeonhole } protocol pop3 { mail_plugins = " acl quota" }

2 2

Authentication proxy
by Miecio 05 Feb '16

05 Feb '16

Hello everyone! I need to set up kind of gateway for submission and imap request, in order to do that i need to find out solution for verifying user password against multiple IMAP backends. Everything for IMAP proxy works perfectly. But i have a problem with authenticating postfix against dovecot SASL. I wonder if there is any option in dovecot to authenticate SASL requests (from postfix) against remote IMAP server or remote SASL instance. Problem is that this server has to be chosen dynamically on the user name basis, so i have to overwrite somehow host parameter in passdb imap definition. I was thinking about using two separate password databasases, first configured as normal sql lookup with proxy flag and host field and second as imap database with host changed to some parameter matching host from previous lookup. Problem is that i don't see any variable matching host filed from passwd sql lookup. With this approach other problem appears, because I want user to be always authenticated against remote IMAP/SASL so i have to somehow return PASSWORD_MISMATCH from my sql lookup. I tried setting up deny parameter to my sql lookup but it causes to reject whole authentication request without even asking remote imap. Thanks a lot --- Regards Miecio

1 0

R: Re: Mail User Agent?
by absolutely_free＠libero.it 04 Feb '16

04 Feb '16

>----Messaggio originale---- >Da: Timo Sirainen <tss(a)iki.fi> >Data: 02/02/2016 23.27 >A: <azurit(a)pobox.sk> >Cc: <dovecot(a)dovecot.org> >Ogg: Re: Mail User Agent? > >On 02 Feb 2016, at 22:00, azurit(a)pobox.sk wrote: >> >> Thank you for info. Well, i understand that clients are not forced to send the info but, in my logs, there's no single ID info. Do i need to enable logging of it or something? > >imap_id_log = * > Thank you very much!

2 1

external storage for mail attachments
by zucca＠systemschmiede.com 03 Feb '16

03 Feb '16

Hi list! was wondering if it was possible to store mail attachments on a separate storage with dovecot, and if so, how. Of course a single instance storage of these attachments would also be a very good thing, allthough not a basic prerequisite. Thanks in advance Sascha -- Bitte beachten Sie unsere neue Firmenadresse ------------------------------------------------- Systemschmiede IT-Lösungen Zucca & Teves GbR An Fürthenrode 52 52511 Geilenkirchen www.systemschmiede.com Tel.: +49 (0)2451 - 9088390 Fax: +49 (0)2451 - 9124070 Mobil: +49 (0)178 - 4073254 Ust.ID: DE248030393

2 1

Apply modifier on long_name variables
by Leon Kyneur 03 Feb '16

03 Feb '16

Hi, Wondering why it's not possible to do the following in ldap args file: base = ou=People,dc=%Ddomain_first,o=ISP however this does work: base = ou=People,dc=%Dd,o=ISP is it intentional that modifiers do not work on long names? Thanks Leon

1 1

Dovecot with Maildir
by John Williams 03 Feb '16

03 Feb '16

Folks, I'm trying to get dovecot to check a for mail in a maildir format on Ubuntu. Mail is being delivered to and from the system. I can send and receive mail using Pine & Mutt. But I cannot seem to get dovecot to work with the maildir. So I can't check for mail using Dovecot. This is what I'm using for reference: https://help.ubuntu.com/community/Dovecot I believe (not sure actually) the answer is in the mail_location variable for Dovecot. This is what I've tried so far: #mail_location = mbox:~/mail:INBOX=/var/mail/%u#mail_location = maildir:/var/mail/%u/Maildir#mail_location = maildir:~/Maildir:INDEX=/var/mail/%umail_location = maildir:/var/mail/%u/Maildir Mail is being delivered and I can send mail out with Postfix. But Dovecot not working. Any idea why? Thanks in advance!

2 4

Re: Mail User Agent?
by Joseph Tam 02 Feb '16

02 Feb '16

azurit(a)pobox.sk and Tom Sommer asks: > How this ID extension can be enabled in Dovecot? From which version is > it supported? Accordind to Dovecot CAPA's response, it is already enabled * OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE STARTTLS LOGINDISABLED] Ready. However, as a previous poster noted, Dovecot doesn't do anything with it other than to log it. The client can elect to ignore it or send an ID string. The ID extension is documented here https://www.ietf.org/rfc/rfc2971.txt I speculated it could be used as a client-side CAPA info so that an IMAP server can modify it's behaviour knowing it's dealing with a certain client, but that is flatly forbidden by RFC (Quoting from RFC) The sole purpose of the ID extension is to enable clients and servers to exchange information on their implementations for the purposes of statistical analysis and problem determination. ... Implementations MUST NOT make operational changes based on the data sent as part of the ID command or response. The ID command is for human consumption only, and is not to be used in improving the performance of clients or servers. Joseph Tam <jtam.home(a)gmail.com>

3 2

IMAP ACLs for groups
by Chris 02 Feb '16

02 Feb '16

Dear All, is there any way to assign POSIX groups to Dovecot IMAP-ACLs? I've tried that today, but I could only open a public folder when my username was listed in the ACL. A group didn't work. How do you manage ACLs for intenseley used public folders with many users? What backend do you use for user management and ACLs? Is there any way to extend permissions? Are there any scripts available that set permissions or grant them when logging in? - Chris

1 0

Disable Client Certificate Authentication for Unencrypted Connections?
by Haravikk 02 Feb '16

02 Feb '16

I’m using dovecot to provide encrypted IMAP e-mail support for remote clients and it’s working great. However, I also need to set up a webmail front-end (Roundcube), which I’m hoping to have use unencrypted IMAP on port 143 (as only port 993 is available externally). The problem I’m running into is that I want to require client certificate authentication on port 993, but dovecot is apparently requiring a certificate on all connections, which is preventing Roundcube from connecting. Since dovecot is also providing authentication to postfix I’ve already created an exemption from the client certificate requirement for SMTP connections by doing the following: protocol !smtp { ssl_ca = </path/to/ca.pem ssl_verify_client_cert = yes auth_ssl_require_client_cert = yes } However, I’m not sure how to do the same thing for unencrypted IMAP connections. Is there a way that I can enable client certificate support for only IMAP port 993, leaving port 143 to handle regular unencrypted IMAP with a username and password? I’ve already added the local network to the trusted networks list, so that Roundcube can use plaintext authentication, can I limit client certificate support in a similar way? Thanks, Haravikk

3 7