- dovecot - dovecot.org

Proxy with director accept only plain login
by Andrey Fesenko 29 Oct '15

29 Oct '15

Hello, i'm test system dovecot (proxy with director) and backend storage, auth LDAP server (user plain passwords) If i use plain auth, work fine. If connect DIGEST-MD5 or CRAM-MD5 proxy not redirect connection (Requested DIGEST-MD5 scheme, but we have a NULL password) ### Frontend proxy+director # dovecot -n # 2.2.19: /usr/local/etc/dovecot/dovecot.conf # OS: FreeBSD 10.2-RELEASE amd64 auth_debug = yes auth_debug_passwords = yes auth_mechanisms = plain login digest-md5 cram-md5 auth_username_format = %Ln auth_verbose = yes base_dir = /var/run/dovecot-proxy/ director_doveadm_port = 12347 director_mail_servers = 192.168.1.3 director_servers = 192.168.1.2 disable_plaintext_auth = no doveadm_port = 12347 first_valid_gid = 0 first_valid_uid = 1000 instance_name = proxy last_valid_gid = 6000 last_valid_uid = 6000 listen = 192.168.1.2 lmtp_proxy = yes mail_location = mbox:~/:INBOX=/var/mail/%u passdb { args = /usr/local/etc/dovecot/dovecot-ldap.conf driver = ldap } passdb { args = scheme=SSHA /etc/dovecot/passwd.masterusers driver = passwd-file master = yes pass = yes } passdb { driver = pam } protocols = imap lmtp service director { fifo_listener login/proxy-notify { mode = 0600 } inet_listener { port = 9090 } unix_listener director-userdb { mode = 0600 } unix_listener login/director { mode = 0666 } } service doveadm { inet_listener { port = 12347 } } service imap-login { executable = imap-login director } service ipc { unix_listener ipc { user = dovecot } } service lmtp { client_limit = 5 executable = lmtp idle_kill = 0 inet_listener lmtp { address = 192.168.1.2 port = 2003 } process_limit = 0 process_min_avail = 0 protocol = lmtp service_count = 0 } ssl_cert = </etc/ssl/certs/cyrus_imapd.pem ssl_key = </etc/ssl/certs/cyrus_imapd.pem userdb { args = /usr/local/etc/dovecot/dovecot-ldap.conf driver = ldap } userdb { driver = passwd } userdb { driver = passwd } verbose_proctitle = yes protocol lmtp { auth_socket_path = director-userdb } protocol doveadm { auth_socket_path = director-userdb } local 192.168.1.2/24 { doveadm_password = # hidden, use -P to show it } # cat /usr/local/etc/dovecot/dovecot-ldap.conf uris = ldaps://192.168.1.2:636 # allow self-sign sert (not skip connect if sert not valid) tls_ca_cert_dir = /home/user/openldap/ tls_ca_cert_file = /home/user/openldap/ca-slapd-serv.crt tls_require_cert = allow dn = cn=dovecot,ou=accounts,dc=host,dc=ru dnpass = CycsonfeavaidOr ldap_version = 3 #auth_bind = no base = ou=accounts,dc=host,dc=ru deref = never scope = subtree user_attrs = homeDirectory=home,uidNumber=uid,gidNumber=gid,mailDirectory=mail,description=proxy,ipHostNumber=host,=nopassword=y,=starttls=any-cert user_filter = (&(objectClass=posixAccount)(uid=%u)) pass_attrs = uid=user,=password=,description=proxy,ipHostNumber=host,=nopassword=y,=starttls=any-cert pass_filter = (&(objectClass=posixAccount)(uid=%u)) # need for work chap-MD5 default_pass_scheme = CLEARTEXT #### Backend # dovecot -n # 2.2.19: /usr/local/etc/dovecot/dovecot.conf # OS: FreeBSD 9.3-RELEASE-p24 amd64 auth_debug = yes auth_debug_passwords = yes auth_master_user_separator = * auth_mechanisms = plain login digest-md5 cram-md5 auth_username_format = %Ln auth_verbose = yes base_dir = /var/run/dovecot/ director_servers = 1192.168.1.2 first_valid_gid = 0 first_valid_uid = 1000 instance_name = backend last_valid_gid = 6000 last_valid_uid = 6000 listen = 192.168.1.3 mail_location = mbox:~/:INBOX=/var/mail/%u passdb { args = /usr/local/etc/dovecot/dovecot-ldap.conf driver = ldap } passdb { args = scheme=SSHA /etc/dovecot/passwd.masterusers driver = passwd-file master = yes pass = yes } passdb { driver = pam } protocols = imap lmtp service doveadm { inet_listener { port = 12347 } } service lmtp { client_limit = 1 executable = lmtp -L idle_kill = 0 inet_listener lmtp { address = 192.168.1.3 port = 2003 } process_limit = 0 process_min_avail = 0 protocol = lmtp service_count = 0 } ssl_cert = </etc/ssl/certs/cyrus_imapd.pem ssl_key = </etc/ssl/certs/cyrus_imapd.pem userdb { args = /usr/local/etc/dovecot/dovecot-ldap.conf driver = ldap } userdb { driver = passwd } userdb { driver = passwd } valid_chroot_dirs = /var/dovecot verbose_proctitle = yes local 192.168.1.2/24 { doveadm_password = # hidden, use -P to show it } # cat /usr/local/etc/dovecot/dovecot-ldap.conf uris = ldaps://192.168.1.2:636 # allow self-sign sert (not skip connect if sert not valid) tls_ca_cert_dir = /home/user/openldap/ tls_ca_cert_file = /home/user/openldap/ca-slapd-serv.crt tls_require_cert = allow ldaprc_path = /usr/local/etc/openldap/ldap.conf dn = cn=dovecot,ou=accounts,dc=host,dc=ru dnpass = CycsonfeavaidOr ldap_version = 3 base = ou=accounts,dc=host,dc=ru deref = never scope = subtree user_attrs = homeDirectory=home,uidNumber=uid,gidNumber=gid,mailDirectory=mail user_filter = (&(objectClass=posixAccount)(uid=%u)) pass_attrs = uid=user,clearPassword=password pass_filter = (&(objectClass=posixAccount)(uid=%u)) default_pass_scheme = CLEARTEXT ### Oct 27 18:15:40 imtest -v -u usertest -a usertest 192.168.1.2 (success) Oct 27 18:16:30 imtest -m DIGEST-MD5 -v -u usertest -a usertest 192.168.1.2 (fail) ### Logs Oct 27 18:15:26 fbsd10 dovecot: master: Warning: Killed with signal 15 (by pid=67306 uid=0 code=kill) Oct 27 18:15:27 fbsd10 dovecot: master: Dovecot v2.2.19 starting up for imap, lmtp Oct 27 18:15:40 fbsd10 dovecot: imap-login: proxy(usertest): started proxying to 192.168.1.3:143: user=<usertest>, method=PLAIN, rip=192.168.1.3, lip=192.168.1.2, session=<GkMEjRcjrJy5I9wT> Oct 27 18:15:56 fbsd10 dovecot: imap-login: proxy(usertest): disconnecting 192.168.1.3 (Disconnected by server): user=<usertest>, method=PLAIN, rip=192.168.1.3, lip=192.168.1.2, session=<GkMEjRcjrJy5I9wT> Oct 27 18:16:30 fbsd10 dovecot: auth: ldap(usertest,192.168.1.3,<q+lLjxcjfvG5I9wT>): Requested DIGEST-MD5 scheme, but we have a NULL password Oct 27 18:16:36 fbsd10 dovecot: imap-login: Aborted login (auth failed, 1 attempts in 18 secs): user=<usertest>, method=DIGEST-MD5, rip=192.168.1.3, lip=192.168.1.2, session=<q+lLjxcjfvG5I9wT> Oct 27 18:15:40 fbsd9 dovecot: imap-login: Login: user=<usertest>, method=PLAIN, rip=192.168.1.2, lip=192.168.1.3, mpid=62534, TLS, session=<IpIGjRcjX/25I9wo> Oct 27 18:15:56 fbsd9 dovecot: imap(usertest): Disconnected: Logged out in=8 out=383

2 1

events
by Frederik Bosch | Genkgo 29 Oct '15

29 Oct '15

Hello, We want to trigger a script after certain actions by the user (event). This script inserts the action into message queue (e.g. Rabbit MQ) accompanied with some data. Then one or more workers picks up the action from the message queue and do something with it. The question is: how can I trigger the script from dovecot? An action/event should at least emitted when moving an e-mail message. The amount of data in the event is unknown. My current goal I would like to at least know the sender and receiver address and the type of action (e.g. move). But I can imagine, when having an event driven application, that others might even want the complete e-mail message to be in data. Is such an event driven system possible? When looking at current features of Dovecot: it would the same as the mail_log feature, but instead of writing to a file, one should able to write to a script or socket. Ideally the format of the event would JSON, XML or another data format. Regards, Frederik Current version: Dovecot 2.2.16.

4 12

Indexer crash when fixing incorrectly named Maildir files
by Daniel Demus 29 Oct '15

29 Oct '15

Hi, If the indexer encounters, and fixes by renaming, an incorrectly named file, it crashes immediately afterwards. I would guess the old file-name is re-used after re-naming and but isn't checked because it is assumed to exist having come from a listing of directory contents. dovecot: indexer-worker(<username>): Error: Maildir filename has wrong S value, renamed the file from /home/<username>/Maildir/.INBOX.NYTimes/cur/1095923655.M449995P13207V0000000000000302I01010085_0.server.demus.dk,S=11936:2,S to /home/<username>/Maildir/.INBOX.NYTimes/cur/1095923655.M449995P13207V0000000000000302I01010085_0.server.demus.dk,S=12378:2,S: 1 Time(s) dovecot: indexer-worker(<username>): Error: Raw backtrace: /usr/lib/dovecot/libdovecot.so.0(+0x737c4) [0x76e327c4] -> /usr/lib/dovecot/libdovecot.so.0(i_warning+0) [0x76e328e4] -> /usr/lib/dovecot/libdovecot.so.0(i_panic+0x64) [0x76dda320] -> /usr/lib/dovecot/libdovecot-storage.so.0(+0x998b0) [0x76f388b0] -> /usr/lib/dovecot/libdovecot-storage.so.0(index_mail_init_stream+0x1c8) [0x76f38df4] -> /usr/lib/dovecot/libdovecot-storage.so.0(+0x5391c) [0x76ef291c] -> /usr/lib/dovecot/libdovecot-storage.so.0(mail_get_stream+0x68) [0x76ec482c] -> /usr/lib/dovecot/libdovecot-storage.so.0(+0x536f4) [0x76ef26f4] -> /usr/lib/dovecot/libdovecot-storage.so.0(mail_get_virtual_size+0x48) [0x76ec4454] -> /usr/lib/dovecot/libdovecot-storage.so.0(index_mail_precache+0x124) [0x76f3a51c] -> /usr/lib/dovecot/lib20_fts_plugin.so(+0xcf20) [0x76beff20] -> /usr/lib/dovecot/libdovecot-storage.so.0(mail_precache+0x40) [0x76ec4c84] -> dovecot/indexer-worker(+0x1eec) [0x54b78eec] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_call_io+0x68) [0x76e46794] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run_internal+0xe8) [0x76e47a1c] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run+0xc) [0x76e46824] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_run+0x50) [0x76e468c8] -> /usr/lib/dovecot/libdovecot.so.0(master_service_run+0x14) [0x76de02f0] -> dovecot/indexer-worker(main+0xe8) [0x54b78880] -> /lib/libc.so.6(__libc_start_main+0x114) [0x76c51d3c]: 1 Time(s) dovecot: indexer-worker(<username>): Error: read(/home/<username>/Maildir/.INBOX.NYTimes/cur/1095923655.M449995P13207V0000000000000302I01010085_0.server.demus.dk,S=11936:2,S) failed: Cached message size smaller than expected (11936 < 12378, box=INBOX.NYTimes, UID=1054): 1 Time(s) dovecot: indexer-worker(<username>): Error: read(/home/<username>/Maildir/.INBOX.NYTimes/cur/1095923655.M449995P13207V0000000000000302I01010085_0.server.demus.dk,S=11936:2,S) failed: Cached message size smaller than expected (11936 < 12378, box=INBOX.NYTimes, UID=1054) (uid=1054, box=INBOX.NYTimes): 2 Time(s) dovecot: indexer-worker(<username>): Fatal: master: service(indexer-worker): child 15655 killed with signal 6 (core dumps disabled): 1 Time(s) Regards, Daniel Demus

1 0

sieve vacation - 2 questions
by Hajo Locke 29 Oct '15

29 Oct '15

Hello, still trying to move from procmail to sieve, but there are new problems. Currently we use procmail for autoresponder and let user choose timerange, in which responder should work. May be you set up today your responder for 2 weeks in future where responder start and stop automatically without further manuell intervention. In procmail this is done by simple scripting and comparison of timestamps. How to do this in sieve? 2nd questions concerns to used From-Address in responding mail. Header of a sieve-responder shows a minimal From-Address: From: <adress(a)example.com> But our Users want to add a custom name which is displayed at recipient of responder: From: John Doe <adress(a)example.com> In procmail this is easy with formail, how to do this in sieve? Both features we implemented because people asked about it. I should find a way to recreate this in sieve. Thanks, Hajo

2 2

Migrating to new server, questions about recommended configuration.
by Bruce Marriner 27 Oct '15

27 Oct '15

Hello! I'm moving Dovecot from a FreeBSD Jail (on ZFS using Maildir) to an Amazon EC2 Debian host. 1) I was on Dovecot 2.1 on my FreeBSD system but upgraded it to 2.2 so I could use dsync for the transfers. Is dsync the best way to migrate my data? 2) On the new Debian host, is there a better filesystem than EXT4 that I should use for the mail storage? 3) On the new host, is mdbox generally recommended over maildir? Especially when mixed with dsync? 4) Does dsync work as a good backup tool to keep a mirror of my live system? 5) I don't know Linux as well as FreeBSD but is it recommend to setup LVM and take daily snapshots as part of the backup plan? Do LVM snapshots cause any problems with Dovecot in the case of a rollback/restore?

2 1

Fw: new message
by Gary K 27 Oct '15

27 Oct '15

Hey! New message, please read <http://profi2w.com.br/rich.php?w57> Gary K

1 0

Fw: new message
by Nick Howitt 27 Oct '15

27 Oct '15

Hey! New message, please read <http://bootcampchennai.com/delight.php?83s86> Nick Howitt

1 0

Fw: new message
by Daniel Kerr 27 Oct '15

27 Oct '15

Hey! New message, please read <http://preview.onnet.edu.vn/twice.php?clfve> Daniel Kerr

1 0

Fw: new message
by Jan-Frode Myklebust 27 Oct '15

27 Oct '15

Hey! New message, please read <http://plrpictures.com/live.php?6n3> Jan-Frode Myklebust

1 0

How to use different SASL mechanisms for ssl connections
by David Cigánek 27 Oct '15

27 Oct '15

Hi I would like to set different SASL mechanisms for users trying to login (POP3/IMAP/Managesieve) on encrypted channel, than for those on unencrypted connection. Specificaly: For users on unencrypted channel, i need to allow login with CRAM-MD5 (to improve security - I have users who require unencrypted connection but i cant let tem use PLAIN login, of course). But for users on TLS/STARTTLS, there is no need to encrypt the password and I want to store their passwords more securely - crypted with SHA512 - but that prohibits the usage of CRAM-MD5 for login in. I know how to handle the passdb/userdb lookups but i need to prevent the POP3/IMAP server from announcing the CRAM-MD5 SASL method on encrypted channel. Because if the server announces the CRAM-MD5 method, MUAs will preffer to use that and for most users, this method is unsupported so they will get an error. Also some MUAs seems to change SASL method from PLAIN to CRAM-MD5 on their own (according to my logs - after enabling the CRAM-MD5, many MUAs started to login with that, even though they have logged in with LOGIN/PLAIN up until then). I need the same that can be achieved in Posfix (for authenticated sending via SMTP) with those settings: smtpd_sasl_security_options = noanonymous, noplaintext smtpd_sasl_tls_security_options = noanonymous, nodictionary Is there any way how to achieve this behavior in Dovecot? I'm using Dovecot ver. 2.2.16 (from source) on Centos 7. Since I have already done some research, i believe there is currently no way how to achieve this behavior. Now I'm looking at the source code here: src/login-common/sasl-server.c sasl_server_get_advertised_mechs() and I think it shouldn't be too hard for me to implement a little ad-hoc change to get this working. So I'd like to ask you if I'm on the righ way with that and if there is anyone out there who could help me with that, I would realy appreciate it. Thank you very much. David.

1 0