- dovecot - dovecot.org

Problems after upgrade from 2.0 to 2.2
by Frank Rust 12 Nov '15

12 Nov '15

Hi all, after upgrade from some 2.0 version to 2.2.19 (debian) i face map login problems: # doveconf -n # 2.2.19 (ca91d540fd87): /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.9 # OS: Linux 2.6.32-5-amd64 x86_64 Debian 8.2 ext4 auth_debug = yes auth_debug_passwords = yes auth_verbose = yes auth_verbose_passwords = plain debug_log_path = /var/log/dovecot-debug.log hostname = test.my.domain.de info_log_path = /var/log/dovecot.log mail_access_groups = smmta mail_debug = yes mail_location = mbox:/extra/mail/mbox.dir/%u/mailboxes:DIRNAME=mBoX-MeSsAgEs:INDEX=/extra/mail/mbox.dir/%u/index:CONTROL=/extra/mail/mbox.dir/%u/control:INBOX=/extra/mail/%u mail_plugins = quota mail_privileged_group = smmta managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate namespace inbox { location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { driver = pam } plugin { mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename flag_change append quota = fs:User quota quota_rule = *:storage=1G quota_rule2 = Trash:storage=+100M quota_warning = storage=95%% quota-warning 95 %u quota_warning2 = storage=80%% quota-warning 80 %u sieve = file:~/sieve;active=~/.dovecot.sieve } postmaster_address = postmaster(a)my.domain.de protocols = " imap sieve pop3" quota_full_tempfail = yes ssl = required ssl_cert = </etc/ssl/StartCom/test.my.domain.pem ssl_cipher_list = EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA256:EECDH+aRSA+RC4:EDH+aRSA EECDH RC4:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS ssl_key = </etc/ssl/StartCom/test.my.domain.key ssl_prefer_server_ciphers = yes ssl_protocols = !SSLv2 !SSLv3 userdb { driver = passwd } verbose_ssl = yes protocol lda { mail_plugins = } When I try to log in with openssl: $ openssl s_client -connect test.familie-rust.de:993 CONNECTED(00000003) depth=1 C = IL, O = StartCom Ltd., OU = Secure Digital Certificate Signing, CN = StartCom Class 1 Primary Intermediate Server CA verify error:num=20:unable to get local issuer certificate --- Certificate chain 0 s:/C=DE/CN=test.my.domain.de/emailAddress=postmaster@my.domain.de i:/C=IL/O=StartCom Ltd./OU=Secure Digital Certificate Signing/CN=StartCom Class 1 Primary Intermediate Server CA 1 s:/C=IL/O=StartCom Ltd./OU=Secure Digital Certificate Signing/CN=StartCom Class 1 Primary Intermediate Server CA i:/C=IL/O=StartCom Ltd./OU=Secure Digital Certificate Signing/CN=StartCom Certification Authority --- Server certificate -----BEGIN CERTIFICATE—— (…) -----END CERTIFICATE----- subject=/C=DE/CN=test.my.domain.de/emailAddress=postmaster(a)my.domain.de issuer=/C=IL/O=StartCom Ltd./OU=Secure Digital Certificate Signing/CN=StartCom Class 1 Primary Intermediate Server CA --- No client certificate CA names sent Peer signing digest: SHA512 Server Temp Key: ECDH, P-384, 384 bits --- SSL handshake has read 4328 bytes and written 506 bytes --- New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES256-GCM-SHA384 Server public key is 4096 bit Secure Renegotiation IS supported Compression: NONE Expansion: NONE No ALPN negotiated SSL-Session: Protocol : TLSv1.2 Cipher : ECDHE-RSA-AES256-GCM-SHA384 Session-ID: B0...5B Session-ID-ctx: Master-Key: 59D...EC0 Key-Arg : None PSK identity: None PSK identity hint: None SRP username: None TLS session ticket lifetime hint: 300 (seconds) TLS session ticket: 0000 - 35 47 73 57 22 45 21 7d-fe ea a4 36 f1 35 76 3a 5GsW"E!}…6.5v: (…) Start Time: 1447309592 Timeout : 300 (sec) Verify return code: 20 (unable to get local issuer certificate) --- * OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE AUTH=PLAIN] Dovecot ready. 01 login frank myPassword * BYE Internal error occurred. Refer to server log for more information. closed And in the log files I find following information: dovecot.log Nov 12 07:47:27 imap-login: Info: Login: user=<frank>, method=PLAIN, rip=134.169.39.105, lip=134.169.39.22, mpid=9475, TLS, session=<...> dovecot-debug.log: Nov 12 07:47:27 imap-login: Debug: SSL: elliptic curve secp384r1 will be used for ECDH and ECDHE key exchanges Nov 12 07:47:27 auth: Debug: auth client connected (pid=11158) Nov 12 07:47:27 imap-login: Debug: SSL: where=0x10, ret=1: before/accept initialization [134.169.39.105] Nov 12 07:47:27 imap-login: Debug: SSL: where=0x2001, ret=1: before/accept initialization [134.169.39.105] Nov 12 07:47:27 imap-login: Debug: SSL: where=0x2001, ret=1: unknown state [134.169.39.105] Nov 12 07:47:27 imap-login: Debug: SSL: where=0x2001, ret=1: unknown state [134.169.39.105] Nov 12 07:47:27 imap-login: Debug: SSL: where=0x2001, ret=1: unknown state [134.169.39.105] Nov 12 07:47:27 imap-login: Debug: SSL: where=0x2001, ret=1: unknown state [134.169.39.105] Nov 12 07:47:27 imap-login: Debug: SSL: where=0x2001, ret=1: unknown state [134.169.39.105] Nov 12 07:47:27 imap-login: Debug: SSL: where=0x2001, ret=1: unknown state [134.169.39.105] Nov 12 07:47:27 imap-login: Debug: SSL: where=0x2002, ret=-1: unknown state [134.169.39.105] Nov 12 07:47:27 imap-login: Debug: SSL: where=0x2002, ret=-1: unknown state [134.169.39.105] Nov 12 07:47:27 imap-login: Debug: SSL: where=0x2001, ret=1: unknown state [134.169.39.105] Nov 12 07:47:27 imap-login: Debug: SSL: where=0x2002, ret=-1: unknown state [134.169.39.105] Nov 12 07:47:27 imap-login: Debug: SSL: where=0x2001, ret=1: unknown state [134.169.39.105] Nov 12 07:47:27 imap-login: Debug: SSL: where=0x2001, ret=1: unknown state [134.169.39.105] Nov 12 07:47:27 imap-login: Debug: SSL: where=0x2001, ret=1: unknown state [134.169.39.105] Nov 12 07:47:27 imap-login: Debug: SSL: where=0x2001, ret=1: unknown state [134.169.39.105] Nov 12 07:47:27 imap-login: Debug: SSL: where=0x20, ret=1: SSL negotiation finished successfully [134.169.39.105] Nov 12 07:47:27 imap-login: Debug: SSL: where=0x2002, ret=1: SSL negotiation finished successfully [134.169.39.105] Nov 12 07:47:27 auth: Debug: client in: AUTH 1 PLAIN service=imap secured session=QkLwUFIkXsCGqSdp lip=134.169.39.22 rip=134.169.39.105 lport=993 rport=49246 resp=xxxx (previous base64 data removed) Nov 12 07:47:27 auth-worker(11140): Debug: pam(frank,134.169.39.105): lookup service=dovecot Nov 12 07:47:27 auth-worker(11140): Debug: pam(frank,134.169.39.105): #1/1 style=1 msg=Password: Nov 12 07:47:27 auth: Debug: client passdb out: OK 1 user=frank Nov 12 07:47:27 auth: Debug: master in: REQUEST 3038248961 11158 1 4e2362c2872f9288b7c8c3ebd8469620 session_pid=11159 request_auth_token Nov 12 07:47:27 auth-worker(11140): Debug: pam(frank,134.169.39.105): lookup Nov 12 07:47:27 auth: Debug: master userdb out: USER 3038248961 frank system_groups_user=frank uid=1000 gid=100 home=/home/frank auth_token=1e04d2c61fb327ec14c1e54ff678d73a325d20bf Nov 12 07:47:27 imap(frank): Debug: Loading modules from directory: /usr/lib/dovecot/modules Nov 12 07:47:27 imap(frank): Debug: Module loaded: /usr/lib/dovecot/modules/lib10_quota_plugin.so Nov 12 07:47:27 imap(frank): Debug: Effective uid=1000, gid=100, home=/home/frank Nov 12 07:47:27 imap(frank): Debug: Quota root: name=User quota backend=fs args= Nov 12 07:47:27 imap(frank): Debug: Quota rule: root=User quota mailbox=* bytes=1073741824 messages=0 Nov 12 07:47:27 imap(frank): Debug: Quota rule: root=User quota mailbox=Trash bytes=+104857600 messages=0 Nov 12 07:47:27 imap(frank): Debug: Quota warning: bytes=1020054732 (95%) messages=0 reverse=no command=quota-warning 95 frank Nov 12 07:47:27 imap(frank): Debug: Quota warning: bytes=858993459 (80%) messages=0 reverse=no command=quota-warning 80 frank Nov 12 07:47:27 imap(frank): Debug: Quota grace: root=User quota bytes=107374182 (10%) Nov 12 07:47:27 imap(frank): Debug: Namespace inbox: type=private, prefix=, sep=, inbox=no, hidden=no, list=yes, subscriptions=yes location=mbox:/extra/mail/mbox.dir/frank/mailboxes:DIRNAME=mBoX-MeSsAgEs:INDEX=/extra/mail/mbox.dir/frank/index:CONTROL=/extra/mail/mbox.dir/frank/control:INBOX=/extra/mail/frank Nov 12 07:47:27 imap(frank): Debug: fs: root=/extra/mail/mbox.dir/frank/mailboxes, index=/extra/mail/mbox.dir/frank/index, indexpvt=, control=/extra/mail/mbox.dir/frank/control, inbox=/extra/mail/frank, alt= Nov 12 07:47:27 imap(frank): Debug: fs quota add mailbox dir = /extra/mail/mbox.dir/frank/mailboxes Nov 12 07:47:27 imap(frank): Debug: fs quota block device = /dev/mapper/ownCloudVG-ownCloudData Nov 12 07:47:27 imap(frank): Debug: fs quota mount point = /extra Nov 12 07:47:27 imap(frank): Debug: fs quota mount type = ext4 Nov 12 07:47:27 imap-login: Debug: SSL alert: close notify [134.169.39.105] What could cause the problem? The problem is not quota related (I enhanced the allowed quota and got the same results) best regards, Frank

2 3

hunting the fatty
by mancyborg＠gmail.com 11 Nov '15

11 Nov '15

Hello dear list, I've recently discovered 'doveadm stats' and I'm trying to use "doveadm stats dump user" and "doveadm stats dump session" to understand the pop/imap users that put more stress on the hard disks. My problem is that some users refuse to delete their emails from the server, so they keep 20GB of maildir files on the server, the webmail (roundcube) takes forever to open the inbox, the imap searches takes forever and meanwhile all the users wait. (already tried roundcube + memcache(d) but didn't help) So my problem is not the storage usage itself: I don't care if the user gets tons of emails with big attachments; my problem is when the user opens / searches an imap folder with more than 10K mails and iostat util goes 100% for minutes. So I've enabled dovecot's stats and enjoying "doveadm stats top", "stats-top.pl" and "doveadm stats dump user/session", but talking about "doveadm stats dump user" and its output fields: user reset_timestamp last_update num_logins num_cmds user_cpu sys_cpu min_faults maj_faults vol_cs invol_cs disk_input disk_output read_count read_bytes write_count write_bytes mail_lookup_path mail_lookup_attr mail_read_count mail_read_bytes mail_cache_hits I'm not sure which of those fields can help me and I can't find any relevant documentation. So here are my questions: 1. is there a documentation for those 21 fields and for 'doveadm stats' in general ? 2. what's the difference between disk_output, read_bytes, read_count and mail_read_bytes ? 3. which field of those is, in your opinion, more representative for expressing the workload that gives me problems ? 4. which settings do I need to store 1 week worth of stats ? I'm currenty using the 'standard' values: stats_refresh = 30 secs stats_track_cmds = yes stats_memory_limit = 16 M stats_command_min_time = 1 mins stats_domain_min_time = 12 hours stats_ip_min_time = 12 hours stats_session_min_time = 15 mins stats_user_min_time = 1 hours Can you please tell me the correct parameters to store 1 week of stats ? Thank you, Mike

3 9

log client certificate
by Eugenio De Vena 11 Nov '15

11 Nov '15

Hello, I would like to log the client certificate ( don't want to authenticate using client certificate but just "log" the client certificate if present ( both Subject and Public key ) ). Is it possibile ? Eugenio

1 0

Active directory
by Станислав Черкасов 11 Nov '15

11 Nov '15

Hello. I have a iRedmail server integrated with AD. I make it following theese instructions http://www.iredmail.org/docs/active.directory.html In my AD i have a user attributes: sAMAccountName = user1 userPrincipalName = csi(a)int.mdom.com proxyAddresses = mail1(a)out.lor.com i need login with user user1 without domain and then have an address mail1(a)out.lor.com i user it in /⁠etc/⁠dovecot/⁠dovecot-⁠ldap.conf -⁠-⁠-⁠-⁠ hosts = dc1.int.mdom.com:389 ldap_version = 3 auth_bind = yes dn = userksa dnpass = sdjfuihJKHSAJKDHQUWjdskfh base = OU=Users,OU=QOL,DC=int,DC=mdom,DC=com scope = subtree deref = never user_filter = (&(objectClass=user)(sAMAccountName=%n) (memberof=CN=Mail_Users,OU=Groups,OU=SFP,DC=int,DC=mdom,DC=com)) pass_filter = (&(objectClass=user)(sAMAccountName=%n) (memberof=CN=Mail_Users,OU=Groups,OU=SFP,DC=int,DC=mdom,DC=com)) default_pass_scheme = CRYPT user_attrs = =home=/var/vmail/vmail1/%Ld/%Ln/Maildir/,=mail=maildir:/var/vmail/vmail1/%Ld/%Ln/Maildir/ -⁠-⁠-⁠-⁠ i have tried to do: #user_filter = (&(proxyAddresses=%u) (objectClass=person)(memberof=CN=Mail_Users,OU=Groups,OU=SFP,DC=int,DC=mdom,DC=com)) #pass_filter = (&(proxyAddresses=%u) (objectClass=person)(memberof=CN=Mail_Users,OU=Groups,OU=SFP,DC=int,DC=mdom,DC=com)) but nothing works.

1 0

Dovecot+AD
by Станислав Черкасов 11 Nov '15

11 Nov '15

Hello. I have a iRedmail server integrated with AD. I make it following theese instructions http://www.iredmail.org/docs/active.directory.html In my AD i have a user attributes: sAMAccountName = user1 userPrincipalName = csi(a)int.mdom.com proxyAddresses = mail1(a)out.lor.com i need login with user user1 without domain and then have an address mail1(a)out.lor.com i user it in /etc/dovecot/dovecot-ldap.conf ---- hosts = dc1.int.mdom.com:389 ldap_version = 3 auth_bind = yes dn = userksa dnpass = sdjfuihJKHSAJKDHQUWjdskfh base = OU=Users,OU=QOL,DC=int,DC=mdom,DC=com scope = subtree deref = never user_filter = (&(objectClass=user)(sAMAccountName=%n) (memberof=CN=Mail_Users,OU=Groups,OU=SFP,DC=int,DC=mdom,DC=com)) pass_filter = (&(objectClass=user)(sAMAccountName=%n) (memberof=CN=Mail_Users,OU=Groups,OU=SFP,DC=int,DC=mdom,DC=com)) default_pass_scheme = CRYPT user_attrs = =home=/var/vmail/vmail1/%Ld/%Ln/Maildir/,=mail=maildir:/var/vmail/vmail1/%Ld/%Ln/Maildir/ ---- i have tried to do: #user_filter = (&(proxyAddresses=%u) (objectClass=person)(memberof=CN=Mail_Users,OU=Groups,OU=SFP,DC=int,DC=mdom,DC=com)) #pass_filter = (&(proxyAddresses=%u) (objectClass=person)(memberof=CN=Mail_Users,OU=Groups,OU=SFP,DC=int,DC=mdom,DC=com)) but nothing works.

1 0

locked ldap users
by klemen＠arnes.si 11 Nov '15

11 Nov '15

Hello. I'm having a problem regarding locked users in ldap. We are using 389DS ldap server. We lock our users with nsAccountLock=true. If user successfully logs into dovecot, his credentials gets cached. When this user is locked its credentials still stay in cache. The problem I'm having is that our ldap server returns error code 53 ("Unwilling to perform - Account inactivated"). Dovecot takes this error code and decides that ldap doesnt work so it takes users credentials from cache (like stated in docs). User can still login untill his credentials are cleared from cache. Error message in logs: ldap(USERNAME,193.X.Y.Z,<aaaaaaaaaaaaaaaa>): ldap_bind() failed: Server is unwilling to perform Oct 20 14:39:31 SERVER dovecot: auth: ldap(USERNAME,193.X.Y.Z,<aaaaaaaaaaaaaaaa>): Falling back to expired data from cache Does dovecot reacts to error code 53 as it should? Maybe our ldap server should return different error code - like 49/533 (Account_disabled)? How would dovecot react to error code 49? Currenty we solve this problem by taking list of locked users and clear cache every minute. thank you and best regards, Klemen Andreuzzi Arnes

1 0

procmail as a content_filter with dovecot
by Vicki Brown 11 Nov '15

11 Nov '15

I am using Mac OS X Server. OS X Server uses postfix with dovecot set as mail_transport. I want to add procmail to the mix. I cannot use the (typical) mailbox_command = procmail -a "$EXTENSION" because mailbox_transport = dovecot overrides any mailbox_command parameter and it is NOT Possible to change, remove, or otherwise vary the mailbox_transport on OS X server. I'm thinking I should be able to set up a content_filter for procmail, but I've found nothing online to tell me if this is possible or how to declare it. Can anyone help? -- Vicki cfcl.com/vlb twitter.com/vlb

4 7

LDAP schema for dovecot proxy?
by Andrey Fesenko 10 Nov '15

10 Nov '15

Hello, I want to deploy dovecot proxy/director with the backend and authorization in LDAP. Dovecot wiki specifies only what is necessary to apply additional arguments that the scheme would have earned a proxy, but no solid LDAP schema. Is there such a scheme, such as the existing scheme http://www.zytrax.com/books/ldap/ape/courier.html http://pro-ldap.ru/sources/schema/qmail.schema http://open.rhx.it/phamm/schema/phamm.schema Unfortunately for the tasks they are not good because they just no dovecot-specific variables

1 0

Fw: new message
by dovecot 10 Nov '15

10 Nov '15

Hey! New message, please read <http://spectrumglobus.com/white.php?p> dovecot

1 0

Fw: new message
by dovecot 10 Nov '15

10 Nov '15

Hey! New message, please read <http://zoomincinema.in/rather.php?2> dovecot

1 0