- dovecot - dovecot.org

Re: Dovecot & LDAP Take #2: Authentication failed and logging
by Paolo Cravero 02 Mar '15

02 Mar '15

This is the user DN: > cn=Klara Fall,ou=People,dc=[domainname],dc=de According to your Dovecot configuration > auth_bind_userdn = cn=%u,ou=People,dc=**[domainname]**,dc=de if you login with "klarafall" it will be expanded into cn=klarafall,ou=People,dc=[domainname],dc=de which is not the correct DN for Mrs Klara. So if you login with "Klara Fall" it should work, but that will probably mess up the things on Dovecot filesystem. I am strongly against setting a static DN when dealing with LDAP authentication. LDAP servers are optimized to serve search requests, so let yours do the job. Allow Dovecot to lookup the correct DN based on the attribute you supply (uid) and then authenticate. This should be achieved if you comment out the auth_bind_userdn line. Paolo Cravero

3 2

mdbox attachment errors
by Daniel Miller 02 Mar '15

02 Mar '15

Getting some errors like: Feb 26 12:19:43 bubba dovecot: imap(dmiller(a)amfes.com): Error: read(attachments-connector(/var/mail/amfes.com/dmiller/mdbox/storage/m.7089… failed: read(/var/mail/attachments/f6/f4/f6f4f3b882bf3488af632389d4aaba8adc332b12-60ab750a1aa4b554da1600009db5accb[base64:18 b/l]) failed: open(/var/mail/attachments/f6/f4/f6f4f3b882bf3488af632389d4aaba8adc332b12-60ab750a1aa4b554da1600009db5accb) failed: No such file or directory (uid=19555, box=Sent) Feb 26 12:19:43 bubba dovecot: imap(dmiller(a)amfes.com): Disconnected: Internal error occurred. Refer to server log for more information. [2015-02-26 12:19:43] in=159 out=1003 Browsing to the ../attachments/f6/f4 folder, I find no files but a "hashes" folder, which has a f6f4f3b882bf3488af632389d4aaba8adc332b12 file of size that feels appropriate for the expected PDF attachment. -- Daniel

3 2

userdb passwd-file default_fields uid not expanding %variable
by Tim Jones 02 Mar '15

02 Mar '15

Hi all, I'm trying to set up a very simple shared mail server, where each 'domain' is a system user, i.e. 'example.com' is a real user with /home/example.com/, a uid of 5001 (and gid 'example.com' of 5001). Each domain\user has their own maildir inside their home, and a plain passwd-file with the virtual mail users associated with that domain. Version & config info: # dovecot -n # 2.2.13: /etc/dovecot/dovecot.conf # OS: Linux 3.2.0-4-amd64 x86_64 Debian 7.8 auth_mechanisms = plain login auth_verbose = yes disable_plaintext_auth = no mail_location = mbox:~/mail:INBOX=/var/mail/%u namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = username_format=%n /home/%d/mail_users driver = passwd-file } protocols = " imap lmtp pop3" ssl = no userdb { args = username_format=%n /home/%d/mail_users default_fields = uid=%d gid=%d home=/home/%d/mail/%n mail=maildir:/home/%d/mail/%n driver = passwd-file } Every time I try to authenticate via imap, I get the error > <timestamp> <host> dovecot: auth: Fatal: passwd-file userdb: Invalid uid: %d If I put fixed a uid and gid in the userdb default_fields line: > default_fields = uid=example.com gid=example.com home=/home/%d/mail/%n mail=maildir:/home/%d/mail/%n authentication passes without a problem, but of course, only for users of example.com. Checking the wiki (http://wiki2.dovecot.org/UserDatabase#Userdb_settings) clearly states that the default_fields values support %variables, so I'm not sure if I'm missing some other config required for this to work. Many thanks in advance, Tim Jones Software Development +34 612345678 C/ Quintanavides 15, Edificio 2, Planta 1ª Parque Empresarial Vía Norte de Metrovacesa Las Tablas 28050 Madrid Skype: tim.jones.fon All information in this email is confidential

2 3

Require certificate for external clients
by Karol Babioch 02 Mar '15

02 Mar '15

Hi list, I'm currently looking into ways of making use of client certificates. I want to force external clients (i.e. anything outside the local subnet) to use client certificates. It is my understanding that this in itself can be achieved with the "ssl_require_client_cert" setting. However, I also want local clients (i.e. anything from a specific subnet) to be able to authenticate by the usual means (i.e. password-based). As far as I know dovecot is not able to operate on multiple ports, as stated in the FAQ [1]. The redirect approach, which is also mentioned there, is of no help to me, because in my case I would need a different setup on both ports. Other suggestions [2] won't work in my case either. I probably could get away with using "imaps" for external clients, while using "imap" (without SSL) for internal ones. Having said this, I don't quite like the idea, especially since the traffic might pass through some potentially unsecure networks and I don't want to bother with VPN/SSH tunnels for that purpose. A native SSL/TLS solution would be very much appreciated. Is there a (recommended) way to do this? Thanks in advance. Best regards, Karol Babioch [1]: http://wiki.dovecot.org/QuestionsAndAnswers#Is_it_possible_to_have_Dovecot_… [2]: http://www.dovecot.org/list/dovecot/2010-November/054804.html

3 2

Re: Require certificate for external clients
by Joseph Tam 02 Mar '15

02 Mar '15

Karol Babioch <karol(a)babioch.de> writes: >> You can share libraries, binaries, >> log files, but use separate configuration files, specifying different >> ports/addresses/ssl-configs/auth/access parameters. Then you can fire >> them both up >> >> dovecot -c /dovecot/etc/dovecot-1.conf >> dovecot -c /dovecot/etc/dovecot-2.conf > > I will have to look into it. I'm afraid that I would have to fiddle > around with the default unit files. What are "unit files"? > Also I'm not completely sure how this would work with all of the > configuration files that have been split off into small chunks and get > included at some point. This is probably going to be messy rather > quickly :'(. I don't see why it would be messy. If the conf.d/* are the same, you can use the same config directory. If they differ, you can can copy those files to another config directory (e.g. conf-d/* -> conf-2.d/), modify the snippets that differ, then include this alternate set of configurations !include conf-2.d/* > Thanks for your suggestion. You're welcome. Joseph Tam <jtam.home(a)gmail.com>

1 0

dsync panic
by Greg Rivers 02 Mar '15

02 Mar '15

As per <http://wiki2.dovecot.org/Migration/Dsync>, I'm running the following command on a local dovecot server to replicate email for a single user from a remote IMAP server: doveadm -D \ -o imapc_host=remote.imap.server \ -o imapc_user=gcr \ -o imapc_password=XXXXXXXX \ -o imapc_list_prefix=IMAP \ -o imapc_features="rfc822.size fetch-headers" \ -o mail_prefetch_count=20 \ -o mail_fsync=never \ backup -R -u gcr imapc: This runs fine for a while and successfully copies quite a lot of mail, but always aborts before completion with the following error: dsync(gcr): Panic: file mail-transaction-log.c: line 271 (mail_transaction_log_rotate): assertion failed: (file->locked) The exit code is 262. Does anyone know why this might happen or how to fix it? -- Greg Rivers

1 0

Re: Require certificate for external clients
by Joseph Tam 01 Mar '15

01 Mar '15

Karol Babioch <karol(a)babioch.de> writes: > As far as I know dovecot is not able to operate on multiple ports, as > stated in the FAQ [1]. > > [1]: > http://wiki.dovecot.org/QuestionsAndAnswers#Is_it_possible_to_have_Dovecot_… That should be qualified as "Is it possible to have Dovecot imap/pop daemons listening on multiple ports for a single running instance." You can run two instances of dovecot, each on a different port or multi-homed listening address. You can share libraries, binaries, log files, but use separate configuration files, specifying different ports/addresses/ssl-configs/auth/access parameters. Then you can fire them both up dovecot -c /dovecot/etc/dovecot-1.conf dovecot -c /dovecot/etc/dovecot-2.conf That's the rough sketch of how to do it. Joseph Tam <jtam.home(a)gmail.com>

2 1

users of dbox format
by Andreas Kasenides 28 Feb '15

28 Feb '15

I am interested in finding out your experiences with using the dbox format (especially mdbox) if you use this format. I am contemplating changing my maildir setup to mdbox but I still need to make a case for it against maildir which has become a de-facto standard and provides sort of a secure basis in case of software changes. Your input will be appreciated. -- Andreas Kasenides Senior IT Officer Dept. of Computer Science, University of Cyprus Tel: 22892714, Fax: 22892701 (5B4ANK)

4 4

ACL Error
by Bobber 28 Feb '15

28 Feb '15

I'm trying to set up global ACLs. I have the following in the config file: > # acl > mail_plugins = acl > > protocol imap { > mail_plugins = $mail_plugins imap_acl > } > > plugin { > # Without global ACLs: > #acl = vfile > > # With global ACL files in /etc/dovecot/dovecot-acls file (v2.2.11+): > #acl = vfile:/etc/dovecot/dovecot-acl > acl = vfile:/usr/local/etc/dovecot/dovecot-acl > } And here is my dovecot-acl: > user=bobber lrwstipekxa > authenticated lr But when I restart dovecot and try to access folders, I get the following errors in the log file: > Error: Global ACL file /usr/local/etc/dovecot/dovecot-acl line 1: > Unknown ID 'lrwstipekxa' Any ideas what's causing this? -- *Bob Wooldridge* Blog: http://kc0dxf.net/blog/

2 1

userdb passwd-file default_fields uid not expanding %variable
by Tim Jones 27 Feb '15

27 Feb '15

Hi all, I'm trying to set up a very simple shared mail server, where each 'domain' is a system user, i.e. 'example.com' is a real user with /home/example.com/, a uid of 5001 (and gid 'example.com' of 5001). Each domain\user has their own maildir inside their home, and a plain passwd-file with the virtual mail users associated with that domain. Version & config info: > # dovecot -n > # 2.2.13: /etc/dovecot/dovecot.conf > # OS: Linux 3.2.0-4-amd64 x86_64 Debian 7.8 > auth_mechanisms = plain login > auth_verbose = yes > disable_plaintext_auth = no > mail_location = mbox:~/mail:INBOX=/var/mail/%u > namespace inbox { > inbox = yes > location = > mailbox Drafts { > special_use = \Drafts > } > mailbox Junk { > special_use = \Junk > } > mailbox Sent { > special_use = \Sent > } > mailbox "Sent Messages" { > special_use = \Sent > } > mailbox Trash { > special_use = \Trash > } > prefix = > } > passdb { > args = username_format=%n /home/%d/mail_users > driver = passwd-file > } > protocols = " imap lmtp pop3" > ssl = no > userdb { > args = username_format=%n /home/%d/mail_users > default_fields = uid=%d gid=%d home=/home/%d/mail/%n > mail=maildir:/home/%d/mail/%n > driver = passwd-file > } Every time I try to authenticate via imap, I get the error > <timestamp> <host> dovecot: auth: Fatal: passwd-file userdb: Invalid uid: > %d > If I put fixed a uid and gid in the userdb default_fields line: > default_fields = uid=example.com gid=example.com home=/home/%d/mail/%n > mail=maildir:/home/%d/mail/%n authentication passes without a problem, but of course, only for users of example.com. Checking the wiki (http://wiki2.dovecot.org/UserDatabase#Userdb_settings) clearly states that the default_fields values support %variables, so I'm not sure if I'm missing some other config required for this to work. Many thanks in advance, [image: Fon] <http://www.fon.com/>Tim JonesSoftware Development+34 612345678 C/ Quintanavides 15, Edificio 2, Planta 1ª Parque Empresarial Vía Norte de Metrovacesa Las Tablas 28050 MadridSkype: tim.jones.fonAll information in this email is confidential <http://corp.fon.com/legal/email-disclaimer>

1 0