- dovecot - dovecot.org

Admin access to sieve filters with managesieve
by Christian Theune 15 Jul '15

15 Jul '15

Hi, I’ve been a long-time user of Cyrus and started using sieve with Dovecot recently. A question that came up is: how do I access a users’s sieve scripts through managesieve without their credentials? Managesieve allows separating authentation and the corresponding mailbox identification, right? That’s what I used with cyrus sieve all the time. :) I didn’t find documentation in the wiki or googling where to configure someone as admin in Dovecot so he can access foreign sieve scripts through managesieve. Pointers? Am I using the right words? Cheers, Christian — Christian Theune · ct(a)flyingcircus.io · +49 345 219401 0 Flying Circus Internet Operations GmbH · http://flyingcircus.io Forsterstraße 29 · 06112 Halle (Saale) · Deutschland HR Stendal HRB 21169 · Geschäftsführer: Christian. Theune, Christian. Zagrodnick

3 3

doveadm search -A problem with dropped privileges
by Sebastian Kricner 14 Jul '15

14 Jul '15

Hello, if you want to answer to this mail, please send it directly to me. I have found a big issue with the following command "doveadm -search -A". It whatsoever works by setting doveadm_worker_count = 0 in the dovecot.conf configuration file. The problem is that doveadm-server or something similar uses privileges of "nobody" and so it fails searching e-mails. Instead also the process tries to create a maildir for "nobody": Debug: Namespace : /var/mail/nobody doesn't exist yet, using default permissions Debug: Namespace : Using permissions from /var/mail/nobody: mode=0700 gid=default Error: User initialization failed: Namespace '': mkdir(/var/mail/nobody) failed: Permission denied (euid=65534(nobody) egid=65534(nobody) missing +w perm: /var/mail, we're not in group 12(mail), dir owned by 0:12 mode=0775) Error: search: User init failed Error: userdb lookup: connect(/var/run/dovecot//auth-userdb) failed: Permission denied (euid=65534(nobody) egid=65534(nobody) missing +r perm: /var/run/dovecot//auth-userdb, we're not in group 12(mail), dir owned by 0:0 mode=0755) Error: search: User lookup failed: Internal error occurred. Refer to server log for more information. Even after setting permissions, so that the process can create a maildir for "nobody" in the /var/mail location, it fails to "setresgid" to the particular user to be scanned. It can´t work because it is not possible to gain other user privileges from another user. # 2.2.16: /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.7 # OS: Linux Gentoo Base System release 2.2 auth_cache_negative_ttl = xx mins auth_cache_size = xx M auth_cache_ttl = xx mins auth_mechanisms = xx xx auth_worker_max_count = xx base_dir = /var/run/dovecot/ default_process_limit = xx dict { expire = sqlite:/xx } doveadm_worker_count = 1 first_valid_gid = xx first_valid_uid = xx login_greeting = xx.xx mail_location = maildir:/xx/xx/%u mail_privileged_group = xx managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate passdb { args = scheme=SHA512 /xx/xx/xx.xx driver = passwd-file } plugin { expire = xx expire2 = xx expire_dict = proxy::expire sieve = ~/.xx.xx sieve_dir = ~/.xx } protocols = imap sieve service auth { unix_listener auth-client { group = xx mode = 0660 } unix_listener auth-userdb { group = xx mode = 0660 } } service dict { unix_listener dict { mode = 0666 } } service imap-login { inet_listener imap { port = 0 } process_limit = 6 service_count = 1 } ssl_cert = </xx/xx/xx/xx.xx.xx ssl_key = </xx/xx/xx/xx.xx.xx ssl_parameters_regenerate = xx days userdb { driver = passwd } protocol lda { mail_plugins = sieve expire } protocol imap { imap_idle_notify_interval = xx mins mail_max_userip_connections = xx mail_plugins = expire } Regards Sebastian Kricner -- http://tuxwave.net -- the difference to think makes it real!

1 0

does dovecot support aio(asynchronous IO)
by boyd 13 Jul '15

13 Jul '15

Dear, Does dovecot support aio(asynchronous IO)? Or do we have a plan/need to support it? Thanks!

1 0

doveadm save message ...
by Hardy Flor 11 Jul '15

11 Jul '15

How can I set the flags for a saved message without search?

2 1

Error while executing dovecot
by Sachin Kulkarni1 10 Jul '15

10 Jul '15

Hello All, I am trying to execute dovecot by below command /opt/app/dovecot/latest/sbin/dovecot -c /opt/app/dovecot/latest/etc/dovecot/dovecot.conf I am getting below error doveconf: Fatal: Error in configuration file /opt/app/dovecot/latest/etc/dovecot/dovecot.conf: default_login_user doesn't exist: dovenull please guide me to resolve this. Thanks and Regards, Sachin ============================================================================================================================ Disclaimer: This message and the information contained herein is proprietary and confidential and subject to the Tech Mahindra policy statement, you may review the policy at http://www.techmahindra.com/Disclaimer.html externally http://tim.techmahindra.com/tim/disclaimer.html internally within TechMahindra. ============================================================================================================================

2 1

Re: Systemd and listen restriction to localhost not enforced
by Joseph Tam 09 Jul '15

09 Jul '15

Sven Strickroth <sven(a)cs-ware.de> writes: > in /etc/dovecot/conf.d/10-master.conf I have restricted IMAP to > localhost only: > > service imap-login { > inet_listener imap { > address = 127.0.0.1 > #port = 143 > } > inet_listener imaps { > #port = 993 > #ssl = yes > } > } > > However, /lib/systemd/system/dovecot.socket make it listen on > 0.0.0.0:143 and [::]:143 causing the service being available to > the public which it should not. - IMHO this is a security issue. I don't know much about systemd, but you'll probably need dovecot configuration listen = 127.0.0.1 Joseph Tam <jtam.home(a)gmail.com>

1 0

Systemd and listen restriction to localhost not enforced
by Sven Strickroth 09 Jul '15

09 Jul '15

Hi, in /etc/dovecot/conf.d/10-master.conf I have restricted IMAP to localhost only: service imap-login { inet_listener imap { address = 127.0.0.1 #port = 143 } inet_listener imaps { #port = 993 #ssl = yes } } However, /lib/systemd/system/dovecot.socket make it listen on 0.0.0.0:143 and [::]:143 causing the service being available to the public which it should not. - IMHO this is a security issue. PS: When starting dovecot I got: Jul 6 22:52:14 srv1 dovecot[19921]: Error: systemd listens on port 143, but it's not configured in Dovecot. Closing. Jul 6 22:52:14 srv1 dovecot: master: Error: systemd listens on port 143, but it's not configured in Dovecot. Closing. -- Best regards, Sven Strickroth PGP key id F5A9D4C4 @ any key-server

1 0

vsz_limit of service doveadm "ignored"?
by Philipp 08 Jul '15

08 Jul '15

Hello, dovecot 2.2.18 on CentOS6.5 Jul 08 11:53:44 dsync-server(system): Fatal: master: service(doveadm): child 32554 returned error 83 (Out of memory (service doveadm { vsz_limit=521 MB }, you may need to increase it) - set CORE_OUTOFMEM=1 environment to get core dump) I tried increasing to 1 G, 1024 M or even disabling via value of zero -- to no change. Every other service has the famous 18446744073709551615 B limit. default_vsz_limit = 2 G The second node with the same setup/config is happily accepting a higher value, since both come from the same provisioning I cannot see (or expect) differences around ulimit and thelike. The configuration comes from a single file, so no include drama or such. Any pointers why the setting is being ignored?

1 0

ESEARCH multiple folders
by Peter Chiochetti 08 Jul '15

08 Jul '15

FTS-Solr is blazingly fast; yet searching e.g. an archive with subfolders still is slow; I learned, that this is a feature/bug of the imap protocol. So I'd like to ask: Does or will dovecot support the "IMAP4 Multimailbox SEARCH Extension" specified in RFC 7377? -- Kind regards Peter

2 2

Scalability with high density servers and proxies, TCP port limits
by Christian Balzer 08 Jul '15

08 Jul '15

Hello, first post in 3 years, kinda shows how painless Dovecot is. ^o^ Also this isn't really a dovecot issue, alas it's involved and since there are some large scale implementations of it I hope somebody here has some insights I might have missed. Currently we're running this setup: 1. LVS (DR mode) in a HA configuration (2 node cluster) 2. Dovecot in proxy mode on a 2 node cluster 3. Dovecot on actual mailbox servers (dual node DRBD clusters) There are about 500k users, but most of them use POP3, so there are usually less than 6k IMAP sesions at any given time. This is about to change, I'm looking at potentially millions of users who will have all semi-permanent IMAP sessions. We already have a pure SSD based mailbox cluster and based on the experiences with that another one is on order that will be able to easily handle about 500k users with regards to IOPS and other needs. However there's the issue of having all these concurrent IMAP sessions. Namely, running out of ephemeral ports. Lets assume 2 million users and 50k ports per IP and revisit the setup above. 1. LVS should have no problem, from experience and tests I expect a well tuned and spec'ed machine to handle millions of connections. This is in DR mode, in NAT mode I assume things would run into a wall a lot quicker. But even if LVS should run out of steam, there's a wide selection of high capacity load balancers available. 2. Here is where the fun starts. Each IMAP session that gets proxied to the real mailbox server needs a port for the outgoing connection. So to support 2 million sessions we need 40 IP addresses here. Ouch. And from a brief test having multiple IP addresses per server won't help either (Dovecot unsurprisingly picks the main IP when establishing a proxy session to the real mailbox), at least not with just one default GW. 3. All of this gets repeated on the actual mailbox servers, by either having a lot of low density servers or (preferably) high density servers with multiple IP addresses. Am I on track so far or missing something obvious? How many concurrent connections do you (hello Timo) think dovecot in proxy mode can handle? High performance mode of course in this case. I'm interested in internal limitations, assume that CPU and RAM are amply supplied. Any and all feedback is appreciated. Regards, Christian -- Christian Balzer Network/Systems Engineer chibi(a)gol.com Global OnLine Japan/Fusion Communications http://www.gol.com/

2 3