- dovecot - dovecot.org

SSL certificate problem (SSL alert number 42)
by Boyandin Konstantin 23 Jul '14

23 Jul '14

Hello, After client (Thunderbird, now version 31.0) updated today, it stopped connecting to Dovecot IMAP4S. The infamous "SSL alert number 42" is reported. Mail server uses local (created for intranet) CA certificate as root. I would appreciate pieces of advice on how to handle that without enabling plaintext authentication over insecure channels. Other intranet services work with this local CA quite fine. Thank you in advance. Required data: # dovecot --version 2.0.9 # doveconf -n # 2.0.9: /etc/dovecot/dovecot.conf # OS: Linux 2.6.32-431.5.1.el6.x86_64 x86_64 CentOS release 6.5 (Final) auth_username_format = %n default_process_limit = 1200 disable_plaintext_auth = yes first_valid_uid = 300 mail_location = mbox:~/mail:INBOX=/var/mail/%n mail_privileged_group = mail mbox_write_locks = fcntl passdb { driver = pam } protocols = imap pop3 service anvil { client_limit = 6000 } service auth { client_limit = 6000 } ssl_ca = </etc/pki/company/cacert.pem ssl_cert = </etc/pki/company/company.crt ssl_cipher_list = ALL:!LOW ssl_key = </etc/pki/company/company.key userdb { driver = passwd } verbose_ssl = yes Records posted to Dovecot log file: Jul 23 11:01:26 mailserver dovecot: imap-login: Warning: SSL: where=0x10, ret=1: before/accept initialization [10.x.x.x] Jul 23 11:01:26 mailserver dovecot: imap-login: Warning: SSL: where=0x2001, ret=1: before/accept initialization [10.x.x.x] Jul 23 11:01:26 mailserver dovecot: imap-login: Warning: SSL: where=0x2002, ret=-1: SSLv2/v3 read client hello A [10.x.x.x] Jul 23 11:01:26 mailserver dovecot: imap-login: Warning: SSL: where=0x2001, ret=1: SSLv3 read client hello A [10.x.x.x] Jul 23 11:01:26 mailserver dovecot: imap-login: Warning: SSL: where=0x2001, ret=1: SSLv3 write server hello A [10.x.x.x] Jul 23 11:01:26 mailserver dovecot: imap-login: Warning: SSL: where=0x2001, ret=1: SSLv3 write certificate A [10.x.x.x] Jul 23 11:01:26 mailserver dovecot: imap-login: Warning: SSL: where=0x2001, ret=1: SSLv3 write key exchange A [10.x.x.x] Jul 23 11:01:26 mailserver dovecot: imap-login: Warning: SSL: where=0x2001, ret=1: SSLv3 write server done A [10.x.x.x] Jul 23 11:01:26 mailserver dovecot: imap-login: Warning: SSL: where=0x2001, ret=1: SSLv3 flush data [10.x.x.x] Jul 23 11:01:26 mailserver dovecot: imap-login: Warning: SSL: where=0x2002, ret=-1: SSLv3 read client certificate A [10.x.x.x] Jul 23 11:01:26 mailserver dovecot: imap-login: Warning: SSL: where=0x2002, ret=-1: SSLv3 read client certificate A [10.x.x.x] Jul 23 11:01:26 mailserver dovecot: imap-login: Warning: SSL: where=0x2001, ret=1: SSLv3 read client key exchange A [10.x.x.x] Jul 23 11:01:26 mailserver dovecot: imap-login: Warning: SSL: where=0x2001, ret=1: SSLv3 read finished A [10.x.x.x] Jul 23 11:01:26 mailserver dovecot: imap-login: Warning: SSL: where=0x2001, ret=1: SSLv3 write session ticket A [10.x.x.x] Jul 23 11:01:26 mailserver dovecot: imap-login: Warning: SSL: where=0x2001, ret=1: SSLv3 write change cipher spec A [10.x.x.x] Jul 23 11:01:26 mailserver dovecot: imap-login: Warning: SSL: where=0x2001, ret=1: SSLv3 write finished A [10.x.x.x] Jul 23 11:01:26 mailserver dovecot: imap-login: Warning: SSL: where=0x2001, ret=1: SSLv3 flush data [10.x.x.x] Jul 23 11:01:26 mailserver dovecot: imap-login: Warning: SSL: where=0x20, ret=1: SSL negotiation finished successfully [10.x.x.x] Jul 23 11:01:26 mailserver dovecot: imap-login: Warning: SSL: where=0x2002, ret=1: SSL negotiation finished successfully [10.x.x.x] Jul 23 11:01:26 mailserver dovecot: imap-login: Warning: SSL alert: where=0x4004, ret=554: fatal bad certificate [10.x.x.x] Jul 23 11:01:26 mailserver dovecot: imap-login: Warning: SSL alert: where=0x4008, ret=256: warning close notify [10.x.x.x] Jul 23 11:01:26 mailserver dovecot: imap-login: Disconnected (no auth attempts): rip=10.x.x.x, lip=10.y.y.y, TLS: SSL_read() failed: error:14094412:SSL routines:SSL3_READ_BYTES:sslv3 alert bad certificate: SSL alert number 42 Sincerely, Konstantin

2 1

[patch] enable ECDH auto functions based on feature defines, not on version number
by Hanno Böck 22 Jul '14

22 Jul '14

Hello, I recently tried to build my system with libressl instead of openssl. In dovecot one issue that popped up was that libressl doesn't have the ECDH auto functions from openssl 1.0.2 beta versions. However as the #ifdef's in dovecot's code check for the openssl version and libressl's version numbers are higher the compilation fails there. Attached is a patch that will change that checks. Instead of checking for the version number it checks for the availability of the feature itself (by checking for the define of SSL_CTRL_SET_ECDH_AUTO). This should make this check more robust and work independently of the version number of the used openssl instance. cu, -- Hanno Böck http://hboeck.de/ mail/jabber: hanno(a)hboeck.de GPG: BBB51E42

1 0

BUG: Authentication client sent unknown handshake command
by Lukas Haase 22 Jul '14

22 Jul '14

Hi, Some time ago my dovecot started to become BUGgy: Evertime I restart the system, dovecot is started but I cannot login. I see the following information in the logs: Jul 4 04:04:36 mail dovecot: auth: passwd-file(user,127.11.91.218,<nfkQjFT9vwCADFra>): no passwd file: /etc/dovecot/imap.passwd Jul 4 04:04:36 mail dovecot: auth: Error: BUG: Authentication client sent unknown handshake command: REQUEST?1183186945?20438?1?a8c7241e7b0778f9f0125da760cd16fa Jul 4 04:04:36 mail dovecot: imap: Error: Authentication server didn't send valid SPID as expected: MECH#011PLAIN#011plaintext Jul 4 04:04:36 mail dovecot: imap: Error: Disconnected from auth server, aborting (client-pid=20438 client-id=1) Jul 4 04:04:36 mail dovecot: imap-login: Internal login failure (pid=20438 id=1) (internal failure, 1 succesful auths): user=<user>, method=PLAIN, rip=127.11.91.218, lip=73.82.101.172, mpid=20439, TLS, session=<nfkQjFT9vwCADFra> It does not help to restart the client. But when I then restart the server service dovecot restart it works again. But this is very dangerous because the server might reboot and I might not immideately have the chance to restart dovecot manually. What's going on here? mail:/# uname -a Linux mail 2.6.32-openvz-042stab090.2-amd64 #1 SMP Sat Jun 21 00:22:42 MSK 2014 i686 GNU/Linux mail:/# dovecot --version 2.1.7 Thanks, Luke

3 5

subfolders in public mailboxes
by Burak Arslan 21 Jul '14

21 Jul '14

Hello, I added this to the configuration: namespace { type = public separator = . prefix = public. location = maildir:/var/mail/public subscriptions = no list = yes } and I can list maildirs inside these folders correctly. however, I can't see any subfolders. The issue seems to be that /var/mail/public dir itself is interpreted as a maildir directory. However, what I'd like to do is to have a bunch of directories inside /var/mail/public and treat them as separate maildirs. (I'd like to use this to make a few existing mailboxes public) is this possible? Best regards, Burak

2 1

Mailboxes not showing up in MS Outlook
by Jerry 21 Jul '14

21 Jul '14

Sat, 19 Jul 2014 15:03:03 -0400 I am not sure exactly where the problem is here. I am using a sieve script that sorts various incoming messages into their own mailbox. MS Outlook does not show those folders if they are not directly under INBOX. EXAMPLE: drwx------ 31 vmail vmail 1.0K 2014-07-19 14:46:55 EDT ./ drwx------ 3 vmail vmail 512B 2014-07-02 13:52:03 EDT ../ drwx------ 5 vmail vmail 512B 2014-07-10 08:33:03 EDT .Bass/ drwx------ 5 vmail vmail 512B 2014-07-16 07:33:18 EDT .Commissioners/ drwx------ 5 vmail vmail 512B 2014-07-08 13:41:19 EDT .Commissioners.Cordrey/ drwx------ 5 vmail vmail 512B 2014-07-03 17:01:31 EDT .Dover/ drwx------ 5 vmail vmail 512B 2014-07-19 08:32:05 EDT .Drafts/ drwx------ 5 vmail vmail 512B 2014-07-18 19:07:15 EDT .Fitts/ drwx------ 5 vmail vmail 512B 2014-07-08 13:41:19 EDT .Gering/ drwx------ 5 vmail vmail 512B 2014-07-19 08:32:05 EDT .Green/ drwx------ 5 vmail vmail 512B 2014-07-18 18:59:06 EDT .Haywood/ drwx------ 5 vmail vmail 512B 2014-07-03 17:01:31 EDT .Hornik/ drwx------ 5 vmail vmail 512B 2014-07-19 14:45:29 EDT .INBOX.Deleted Items/ drwx------ 5 vmail vmail 512B 2014-07-18 08:58:21 EDT .INBOX.Drafts/ drwx------ 5 vmail vmail 512B 2014-07-18 08:58:13 EDT .INBOX.Junk E-mail/ drwx------ 5 vmail vmail 512B 2014-07-19 14:46:56 EDT .INBOX.PSNC/ drwx------ 5 vmail vmail 512B 2014-07-19 14:46:57 EDT .INBOX.SGWASA/ drwx------ 5 vmail vmail 512B 2014-07-18 08:58:13 EDT .INBOX.Sent Items/ drwx------ 5 vmail vmail 512B 2014-07-19 14:46:58 EDT .INBOX.UNRBA/ drwx------ 5 vmail vmail 512B 2014-07-18 07:40:05 EDT .Locklear/ drwx------ 5 vmail vmail 512B 2014-07-08 13:39:58 EDT .PlanningBoard/ drwx------ 5 vmail vmail 512B 2014-07-19 08:32:05 EDT .Queue/ drwx------ 5 vmail vmail 512B 2014-07-03 17:01:31 EDT .SawyerHomes/ drwx------ 5 vmail vmail 512B 2014-07-19 08:32:05 EDT .Sent/ drwx------ 5 vmail vmail 512B 2014-07-19 06:54:07 EDT .Trash/ drwx------ 5 vmail vmail 512B 2014-07-10 19:19:51 EDT .Vicki/ drwx------ 5 vmail vmail 512B 2014-07-18 15:31:06 EDT .Westall/ drwx------ 2 vmail vmail 23K 2014-07-19 14:44:42 EDT cur/ -rw------- 1 vmail vmail 14B 2014-07-02 20:30:10 EDT dovecot-keywords -rw------- 1 vmail vmail 10K 2014-07-19 14:45:18 EDT dovecot-uidlist -rw------- 1 vmail vmail 8B 2014-07-18 08:58:13 EDT dovecot-uidvalidity -r--r--r-- 1 vmail vmail 0B 2014-07-02 13:52:04 EDT dovecot-uidvalidity.53b446e2 -rw------- 1 vmail vmail 2.6K 2014-07-08 14:26:45 EDT dovecot.index -rw------- 1 vmail vmail 78K 2014-07-19 14:44:42 EDT dovecot.index.cache -rw------- 1 vmail vmail 21K 2014-07-19 14:45:18 EDT dovecot.index.log -rw------- 1 vmail vmail 1.8K 2014-07-19 14:46:55 EDT dovecot.mailbox.log drwx------ 2 vmail vmail 512B 2014-07-02 14:15:43 EDT new/ In the above example, only the following are displayed: .INBOX.Deleted Items/ .INBOX.Drafts/ .INBOX.Junk E-mail/ .INBOX.PSNC/ .INBOX.SGWASA/ .INBOX.Sent Items/ .INBOX.UNRBA/ Do I have a configuration problem? dovecot -n # 2.2.13: /usr/local/etc/dovecot/dovecot.conf # OS: FreeBSD 10.0-RELEASE-p3 amd64 ufs auth_mechanisms = plain login cram-md5 digest-md5 lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes log_path = /var/log/dovecot mail_location = maildir:/var/mail/vmail/%d/gerard managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave duplicate namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = username_format=%u /usr/local/etc/dovecot/user/passwd driver = passwd-file } passdb { args = scheme=CRYPT username_format=%u /usr/local/etc/dovecot/user/passwd driver = passwd-file } passdb { driver = pam } passdb { args = scheme=CRYPT username_format=%u /usr/local/etc/dovecot/user/passwd driver = passwd-file } plugin { sieve_global_dir = /usr/local/etc/dovecot/sieve/ sieve_global_path = /usr/local/etc/dovecot/sieve/default.sieve } postmaster_address = postmaster(a)seibercom.net service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0666 user = postfix } unix_listener auth-userdb { group = vmail mode = 0666 user = vmail } } service imap-login { inet_listener imap { port = 143 } inet_listener imaps { port = 993 ssl = yes } } service pop3-login { inet_listener pop3 { port = 110 } inet_listener pop3s { port = 995 ssl = yes } } ssl_cert = </etc/ssl/certs/dovecot.pem ssl_key = </etc/ssl/private/dovecot.pem userdb { args = username_format=%u /usr/local/etc/dovecot/user/passwd default_fields = uid=vmail gid=vmail driver = passwd-file } userdb { driver = passwd } userdb { args = username_format=%u /usr/local/etc/dovecot/user/passwd driver = passwd-file } protocol lda { mail_plugins = sieve sieve } -- Jerry

3 2

Dovecot Replication: First Run
by Asai 19 Jul '14

19 Jul '14

Greetings, I'm working on building a redundant Dovecot server which will be replicated with my original. I would like to know if there's any potential problems I could run into in running this for the first time. For example, during an initial sync is it possible for the new server to sync improperly with the original and delete all of the emails on the original? Are there any gotchas that I should be aware of when doing a first run? -- --Asai

1 1

Difference btw. Dovecot Director and Dovecot Proxy
by Nathan Schultheiss 19 Jul '14

19 Jul '14

Hello, For a few days I try to understand what program (Dovecot Director or Dovecot Proxy) I should use for my email architecture. We are a hospital, and for security reasons, we must host ourselves our emails, and we must leave Google Apps... I wish to make a Dovecot backend for each department of the hospital. Each backend Dovecot has a local storage. Server 01: cardiology Server 02: emergency ... Server 05: administration Dovecot looks in the database which server to use to store email (lmtp) and transfer the mail for storage. I do not understand if I have to work with Dovecot Director or Proxy if I would that LMTP or IMAP request are forwarded to the right backend. Each have self storage and have not access to the other backend storage (no nfs, no network storage, ...). Users indicate imap.hospital.local, this point to Dovecot Director or Proxy and Dovecot check the login/password and forward the user to the right backend. In my database I put user@hospital = storage host 172.16.2.10 = folder /home/vmail/user/ (Maildir) I've read that the Director can refer the user to the same backend when there is a activ session (POP, IMAP, LMTP) But can we tell him to always refer the user to the same backend (IMAP and LMTP) ? I've found this picture schema who user have Dovecot Proxy => Dovecot Director => Dovecot Backend And I'm confused why they have proxy + director ?!? Can anyone tell me if I need to focus on Dovecot Director or Dovecot Proxy to create the architecture of this hospital ? My question is probably stupid for Dovecot sysadmin, but I'm lost in the WIKI :) Thanks in advance, Nathan

2 2

Postfix user@domain splitting
by Ricardo Branco 18 Jul '14

18 Jul '14

I have been trying looking though all the wiki documents to setup LMTP. It now seems to all be connected except that it keeps saying that the user is not recognised when postfix sends to LMTP, it sends the full recipent email address but seems that on the dovecot side it is unable to work with this. I have checked the userdb and made sure its using %n but alas it still does not work. Currently ive had to revert to using LDA as it works fine with that but i still dont know how as the postfix config variable $RECIPIENT is the full email address and does not seem to matter to LDA.

4 11

ulimit warning when restarting
by Will Yardley 18 Jul '14

18 Jul '14

When restarting Dovecot 2.2.10 (via atrpms) on RHEL 6, I get the error: Warning: fd limit (ulimit -n) is lower than required under max. load (1024 < 4096), because of default_client_limit # doveconf default_internal_user default_internal_user = dovecot Should dovecot print this warning based on $default_internal_user, or based on root? As root: # ulimit -n 1024 As user dovecot: $ ulimit -n 49152 $ whoami dovecot # grep dovecot /etc/security/limits.conf dovecot hard locks 49152 dovecot hard nofile 49152 dovecot hard maxlogins 8192 dovecot soft locks 49152 dovecot soft nofile 49152 dovecot soft maxlogins 8192

3 2

Panic: file mail-storage.c
by giovanni＠neweden.uk.to 18 Jul '14

18 Jul '14

Greetings, In my installation I have debian 7.6 dovecot 2.2.13 dovecot-antispamplugin VERSION=2.0 for this enviroment some users cannot get imap connections. Here below an excerpt the log file. Jul 09 23:54:07 imap(xx(a)xxx.co.uk): Panic: file mail-storage.c: line 2158(mailbox_copy): assertion failed: (!ctx->unfinished) ul 09 23:54:07 imap(xx(a)xxx.co.uk): Error: Raw backtrace: /usr/local/lib/dovecot/libdovecot.so.0(+0x6bb4f) [0x7fd796ccdb4f] -> /usr/local/lib/dovecot/libdovecot.so.0(+0x6bbae) [0x7fd796ccdbae] -> /usr/local/lib/dovecot/libdovecot.so.0(i_fatal+0) [0x7fd796c871ee] -> /usr/local/lib/dovecot/libdovecot-storage.so.0(+0x82519) [0x7fd796fb9519] -> dovecot/imap() [0x40dba4] -> dovecot/imap(command_exec+0x3c) [0x41822c] -> dovecot/imap() [0x417290] -> dovecot/imap() [0x41734a] -> dovecot/imap(client_handle_input+0x115) [0x417605] -> dovecot/imap(client_input+0x72) [0x4179b2] -> /usr/local/lib/dovecot/libdovecot.so.0(io_loop_call_io+0x4e) [0x7fd796cde81e] -> /usr/local/lib/dovecot/libdovecot.so.0(io_loop_handler_run_internal+0xd7) [0x7fd796cdf7f7] -> /usr/local/lib/dovecot/libdovecot.so.0(io_loop_handler_run+0x9) [0x7fd796cde8a9] -> /usr/local/lib/dovecot/libdovecot.so.0(io_loop_run+0x38) [0x7fd796cde928] -> /usr/local/lib/dovecot/libdovecot.so.0(master_service_run+0x13) [0x7fd796c8c4d3] -> dovecot/imap(main+0x277) [0x40c067] -> /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xfd) [0x7fd7968f5ead] -> dovecot/imap() [0x40c1c5] for others users imap connection is ok with antispam plugin working fine (antispam_backend = spool2dir) To enable the imap connections for the unlucky users (with the previous error) I had to remove the anti spam plugin. Does anybody is experiencing the same errors? cheers Giovanni

1 0