- dovecot - dovecot.org

blowfish crypt
by Edgar Pettijohn 14 Jan '15

14 Jan '15

I'm setting up a new server and am planning on using blowfish crypt. This page from the wiki http://wiki2.dovecot.org/Authentication/PasswordSchemes says the password will begin with $2a$, however mine are starting $2b$. Is this wrong on the wiki or am I doing something wrong? Just want to catch this before it becomes a problem. Thanks, Edgar

1 1

dovecot and glusterfs
by Michael Schwartzkopff 14 Jan '15

14 Jan '15

Hi, I did some experiments with dovecot on a glusterfs on the active nodes without a director. So I had concurrent access to the files. With the help of the available documentation about NFS and fcntl locks I managed to find out the following: With the plain mbox format dovecot seems to apply and to honor the fcntl locks. But since this format is not used any more in real setups, it is useless. With mdbox and maildir format I could reliably crash my mail storage just by delivering mails to the both dovecots via LMTP to the same user. In maildir dovecot seems not the set / respect the fnctl locks of the index file. dotlocks do not seems to work either with mdbox. So I think the only solution os to use a director in a real world setup. Or is there any non-obvious trick that I did not check? I think it would be really nice if dovecot could use glusterfs for realy scalable postbox servers. Mit freundlichen Grüßen, Michael Schwartzkopff -- [*] sys4 AG http://sys4.de, +49 (89) 30 90 46 64, +49 (162) 165 0044 Franziskanerstraße 15, 81669 München Sitz der Gesellschaft: München, Amtsgericht München: HRB 199263 Vorstand: Patrick Ben Koetter, Marc Schiffbauer Aufsichtsratsvorsitzender: Florian Kirstein

4 6

Proxying when src and dest on non standard ports
by Thomas HUMMEL 13 Jan '15

13 Jan '15

Hello, I want to test dovecot proxying, on a user basis, in a simple set up (proxy, no proxy_maybe and forward the passwd to the remote server). This seem pretty simple except that, in order to test it alongside the production server, I set up 3 servers : . the proxy, listening to pop and imap on non standard ports 9143, 9993, 9110, 9995 . a proxy destination for some users, listening on 10143, 10993, 109110, 10995 . another proxy destination for some other users, listening on 20145, 20993, 209110, 20995 But there seems to be only one 'port' extra_field, so how can I handle the proxying of both IMAP and POP3 (especially for the same user who can use both) ? Thanks. -- Thomas Hummel | Institut Pasteur <hummel(a)pasteur.fr> | Groupe Exploitation et Infrastructure

1 0

Re: dovecot-2.2.15 process dovecot/imap segfaults when dict process has troubles
by Marcin Mirosław 13 Jan '15

13 Jan '15

W dniu 13.01.2015 o 13:53, Lazy pisze: > I can't reproduce this with redis dict. > > Could You provide us with a doveconf -n ? > Does this also happen with other dict engines ? Working configuration: auth_cache_size = 64 k auth_cache_ttl = 10 mins auth_master_user_separator = * auth_mechanisms = plain login deliver_log_format = msgid=%m: from=%f: phys=%p: virt=%w %$ dict { domainquota = pgsql:/etc/dovecot/dovecot-dict-sql-domain.conf.ext lastlogin = pgsql:/etc/dovecot/dovecot-dict-sql.conf.ext quota = pgsql:/etc/dovecot/dovecot-dict-sql.conf.ext } first_valid_gid = 999 first_valid_uid = 999 last_valid_gid = 999 last_valid_uid = 999 lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes listen = * mail_gid = 999 mail_location = maildir:~/.maildir:INDEX=/data/poczta/indeksy/%d/%n mail_log_prefix = "%s(%u) <%{session}>: " mail_plugins = acl fts fts_squat listescape quota notify mail_log stats zlib mail_temp_dir = /data/poczta/tmp mail_uid = 999 mailbox_list_index = yes managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include vari ables body enotify environment mailbox date ihave duplicate namespace { location = maildir:%%h/.maildir:INDEX=/data/poczta/indeksy/shared/%d/%n prefix = shared/%%n/ type = shared } namespace inbox { inbox = yes location = mailbox Archive { auto = subscribe special_use = \Archive } mailbox Archives { special_use = \Archive } mailbox Drafts { special_use = \Drafts } mailbox Junk { auto = subscribe special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Spam { special_use = \Junk } mailbox Trash { auto = subscribe special_use = \Trash } mailbox Wiadomości-śmieci { special_use = \Junk } mailbox Wiadomo&AVs-ci-&AVs-mieci { special_use = \Junk } prefix = separator = / } passdb { driver = pam master = yes pass = yes } passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } plugin { acl = vfile:/data/poczta/acl/global-acls:cache_secs=60 acl_shared_dict = file:/data/poczta/acl/shared-mailboxes.db fts = squat fts_squat = partial=4 full=10 last_login_dict = proxy::lastlogin last_login_key = lastlogin/%u/%s/%r listescape_char = \ quota = dict:User quota::proxy::quota quota_rule2 = Trash:storage=+100M sieve = file:~/sieve;active=~/.dovecot.sieve sieve_default = /etc/dovecot/sieve/sieve_default_spam-to-junk.sieve stats_command_min_time = 1 mins stats_domain_min_time = 12 hours stats_ip_min_time = 12 hours stats_memory_limit = 1M stats_refresh = 30 s stats_session_min_time = 15 mins stats_track_cmds = yes stats_user_min_time = 1 hours } postmaster_address = postmaster(a)example.com protocols = imap pop3 lmtp sieve quota_full_tempfail = yes service auth-worker { user = root } service auth { unix_listener auth-client { group = mail mode = 0660 } unix_listener auth-userdb { mode = 0777 } } service dict { unix_listener dict { group = poczta mode = 0660 } } service stats { fifo_listener stats-mail { group = poczta mode = 0660 } } ssl_cert = </etc/ssl/private/example.com.crt ssl_cipher_list = DEFAULT:!EXPORT:!LOW:!MEDIUM:!MD5 ssl_dh_parameters_length = 2048 ssl_key = </etc/ssl/private/example.com.key ssl_protocols = !SSLv2 !SSLv3 userdb { driver = prefetch } userdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } verbose_proctitle = yes protocol lmtp { mail_plugins = acl fts fts_squat listescape quota notify mail_log stats zlib sieve } protocol lda { mail_plugins = quota sieve } protocol imap { mail_max_userip_connections = 25 mail_plugins = acl fts fts_squat listescape quota notify mail_log stats zlib imap_acl imap_quota imap_stats imap_zlib last_login } protocol pop3 { mail_plugins = acl fts fts_squat listescape quota notify mail_log stats zlib last_login } Then I'm adding: quota = dict:Quota:%d:proxy::domainquota and I'm doing: chmod 000 /etc/dovecot/dovecot-dict-sql-domain.conf.ext Next I'm restarting dovecot, trying to use IMAP account (reading, removing emails etc.) and from time to time dovecot/imap throws core. Marcin

1 0

Moving or "upgrading" from MD5 to SSHA512
by Jyri Hovila [Turvamies.fi] 13 Jan '15

13 Jan '15

Hello, world! I have a long-running Dovecot & Postfix installation using PostgreSQL back-end. Until now I've been using MD5 hashing but would like to "upgrade" to the salted SSHA512. Is there a way to configure Dovecot so that it would automatically detect the type of the hash stored in the database, so that users who have changed their password (and thus being hashed with SHA512) and users still having an MD5 hash would both be able to authenticate at the same time? Yours, Jyri -- +358-50-5632104 (24/7) +358-46-8822157 (backup) jyri.hovila(a)turvamies.fi

3 3

dovecot-2.2.15 process dovecot/imap segfaults when dict process has troubles
by Marcin Mirosław 13 Jan '15

13 Jan '15

Hi! I hope it's not too late to wish all the best in 2015 year! I'm writing the email because I've noticed that if dict process has any troubles with configuration then dovecot/imap throws segfault: log: Jan 12 16:51:59 mail dovecot: dict: Error: Failed to initialize dictionary 'lastlogin': dict pgsql: Can't open configuration file /etc/dovecot/dovecot-dict-sql.conf.ext: Permission denied Jan 12 16:51:59 mail dovecot: dict: Error: Failed to initialize dictionary 'lastlogin': dict pgsql: Can't open configuration file /etc/dovecot/dovecot-dict-sql.conf.ext: Permission denied Jan 12 16:52:00 mail dovecot: master: Error: service(imap): child 24243 killed with signal 11 (core dumped) and here is backtrace: (gdb) bt #0 io_remove_full (_io=0x7fb02b0afce0, closed=false) at ioloop.c:119 #1 0x00007fb02aac5f40 in io_remove (io=<optimized out>) at ioloop.c:154 #2 0x00007fb02aa841b2 in client_dict_finish_transaction (dict=dict@entry=0x7fb02b0afc20, id=<optimized out>, ret=ret@entry=-1) at dict-client.c:274 #3 0x00007fb02aa84286 in client_dict_disconnect (dict=dict@entry=0x7fb02b0afc20) at dict-client.c:459 #4 0x00007fb02aa8493d in client_dict_deinit (_dict=0x7fb02b0afc20) at dict-client.c:519 #5 0x00007fb02aa28ece in last_login_dict_deinit (user=<optimized out>) at last-login-plugin.c:34 #6 0x00007fb02aa28f92 in last_login_user_deinit (user=0x7fb02b0ab400) at last-login-plugin.c:46 #7 0x00007fb02ab820bf in mail_user_unref (_user=_user@entry=0x7fb02b0bbdc8) at mail-user.c:163 #8 0x00007fb02ac1ee0d in client_default_destroy (client=0x7fb02b0bbd50, reason=<optimized out>) at imap-client.c:284 #9 0x00007fb02ac29549 in client_kill_idle (client=0x7fb02b0bbd50) at main.c:105 #10 0x00007fb02ac296a5 in client_kill_idle (client=0x7fb02b0bbd50) at main.c:129 #11 imap_die () at main.c:121 #12 0x00007fb02aac661d in io_loop_call_io (io=0x7fb02b093ce0) at ioloop.c:498 #13 0x00007fb02aac7a15 in io_loop_handler_run_internal (ioloop=ioloop@entry=0x7fb02b091740) at ioloop-epoll.c:220 #14 0x00007fb02aac66d5 in io_loop_handler_run (ioloop=ioloop@entry=0x7fb02b091740) at ioloop.c:545 #15 0x00007fb02aac677a in io_loop_run (ioloop=0x7fb02b091740) at ioloop.c:522 #16 0x00007fb02aa5b5aa in master_service_run (service=0x7fb02b0915d0, callback=<optimized out>) at master-service.c:566 #17 0x00007fb02ac116cd in main (argc=<optimized out>, argv=<optimized out>) at main.c:412 Marcin

1 0

[PATCH] Make Delivered-To optional
by Nagy, Attila 13 Jan '15

13 Jan '15

Hi, I've read at least one e-mail on this list about making delivered-to in lmtpd optional, but now I need this too, so I made a patch. The default remains as is now (enabled). Rationale: I would like to dsync users and I have catchall POP mailboxes (meaning: a single mailbox gets the mails for a lot of e-mail addresses). If I deliver the e-mails to Dovecot's lmtpd as the original RCPT TO, the Delivered-To header can be used for the POP client to sort the messages on their side to the correct mailbox, but because Dovecot sees this as a new user, it adds it to the replicator.db. Now imagine a single mailbox with thousands of e-mail addresses, this will make thousands of entries in replicator.db, all of which Dovecot would like to replicate independently... If I deliver to the mailbox uid, Dovecot dsync will work right (only one user will be added, no matter how many different e-mail addresses end up in this mailbox), but the Delivered-To will contain the uid, so the user can't use that to sort the messages into their final destination on their side. So the solution here is that I disable the addition of Delivered-To header in Dovecot (because it doesn't know what is the original address) and add it in an upper layer, so during the lmtp transaction, the message will already contain the right value. Currently Dovecot adds another Delivered-To line, which confuses the clients. Please add this feature to Dovecot. Thanks,

1 0

Re: Maildir permissions on creation?
by Von Random 13 Jan '15

13 Jan '15

Yes, and it is not my use case, sadly. ACLs are meant for imap, not filesystem access and mail_access_groups is also useless for some reason. It just does not change anything. Probably because I don't use mail_location and variables when I provide path for home. (It's stored as is in a database on mailbox creation.) 26.12.2014, 12:07, "Tobi" <tobster(a)brain-force.ch>: > Have you checked the dovecot wiki for 'filepermissions in shared mailboxes' ? > Explains how dovecot set ACL when creating mailboxes > > Am 26. Dezember 2014 09:37:37 MEZ, schrieb Von Random <von(a)vdrandom.org>: >> Err, my bad, of course 0640 on files in case of setgid on directories. >> >> 26.12.2014, 11:36, "Von Random" <von(a)vdrandom.org>: >>> The main reason is that I don't want to provide backup user with >> unnecessary write permissions within maildirs and mail user within >> backup logs dir. I was talking about mail_user:mail_group 0750 on dirs >> and 0640 on files. (Or, possibly, mail_user:backup_group 2750 and >> 2640.) >>> 26.12.2014, 11:19, "Tobi" <tobster(a)brain-force.ch>: >>>> Whats the reason you do not want to use default dovecot user. Your >> idea would assume that at least the group must have write access. For >> me a no-go on mailboxes. >>>> Am 24. Dezember 2014 13:21:15 MEZ, schrieb Von Random >> <von(a)vdrandom.org>: >>>>> Hello. >>>>> >>>>> In my configuration dovecot reads home from mysql and uses no >> variables >>>>> within it. It uses Maildir++ storage with virtual users. I also >> happen >>>>> to use LMTP. >>>>> >>>>> I want to use a backup solution that does not involve running >> itself as >>>>> root. Neither do I want to run it as dovecot's mail user. >>>>> >>>>> And there lies the problem: dovecot creates maildirs with 0700 and >>>>> files within them inherit that set of permissions. And there seems >> to >>>>> be no sane way to control it. I think I've figured out what to >> patch in >>>>> order to change that default, but if possible, I'd like to avoid >> doing >>>>> that. >>>>> >>>>> tl;dr: is it possible to change the default set of permissions for >> new >>>>> maildirs created by dovecot? >>>> - -- >>>> Diese Nachricht wurde von meinem Android-Mobiltelefon mit K-9 Mail >> gesendet. >>>>>> -----BEGIN PGP SIGNATURE----- >>>>>> Version: APG v1.1.1 >>>>>> >>>>>> iQI7BAEBCgAlBQJUnRoiHhxUb2JpIDx0b2JzdGVyQGJyYWluLWZvcmNlLmNoPgAK >>>>>> CRA1HOYlqGik5L9iD/9FIE2JzWfB7fWJEbI3vVg+ar4LRGwW1xNIf8ahlytPbsmH >>>>>> D9dFP3kWpJH6TO41AksNjz/FxHcUqSrlsKYTFUsDZCyb9Zyxd8Jv+dH04FwUzw+y >>>>>> kq+ayoylnTN7Q8mQnqkUpWEuYd5ohWbbUUSguwzN8Zd1T4jCFR9/Lvu0cweE6meu >>>>>> mBGwvXBbfBP4El+mAM2lKnoMXQpMycS6aX7FwQ/fBaoWSkzg/2az69UtqG6LLF67 >>>>>> ZhJkbn17cpT3y/l/2nV5urdcFVh8RoSXNuYyMN4r7IDKQ6BPsneD+839LS9X/gP/ >>>>>> QMuo5nO5xdx4q1bT9gtv1zz5eKAJ1f3R2oPZyxdpiV5PruSY3J3kvu0cF0aJvQF6 >>>>>> +s0iDsoDBcueB6JEUnYAarteWvBvxRnqb8ytju1xbIEkKLZtaS8Gf2cpZ8eA+Ha/ >>>>>> D0zkYfq7bt+Ra7BY6Qh7XMfiN5z9eWe5RqOmVLZRLf9N75U6wWa+fmXpvlqEtGNV >>>>>> pKsgif/ivCHiA24+JSJ1PBRjwO36Tu4MsSlT2WnkvyFBQzFzg9T00fl+uTXzgNEz >>>>>> SBta2wmXk9XVJ9mPzfNrAaAA3+T6H90Sj1CbRt7NZx30UdwYoIL5XXEtnG0p1XdS >>>>>> moe91H2UE+NT+jgj7emAOLxJf86vIwiHCqI0Zl/7wVNJEnKBXJP5WIHcdEDEHg== >>>>>> =Tl/z >>>>>> -----END PGP SIGNATURE----- > > - -- > Diese Nachricht wurde von meinem Android-Mobiltelefon mit K-9 Mail gesendet. > -----BEGIN PGP SIGNATURE----- > Version: APG v1.1.1 > > iQI7BAEBCgAlBQJUnSVbHhxUb2JpIDx0b2JzdGVyQGJyYWluLWZvcmNlLmNoPgAK > CRA1HOYlqGik5GvTEACYhFfqS5hK4rAoHCzDd5vFwCLIE/ESheJhREbpewE4k7Nq > BGR1hKygYeAnj3w1CB9R4sgRBOTHSpRuIzk1ZMId5UuQOBxy8ukRzA5xiAoP22lw > AxB6Ek7e7VLz0998GmoN7uw1t5tczR1SkHscs0XfuBCBJrvo79DHYs7CP18oDTic > m5NVJS0MZzJGWPSDGwN6WPwRbLZMTZHc79h+WTmYz9Fzet2As71npvP0PiLd4hQP > xMlgUXCF1vXTUPUGf/NtQfy/xjaww4sEMqOxpigjLLMmnz+OFPo9Mar0uWvNBCgq > 3rTUqAUaMcLS8ANyvqzPXXba67dl+rNYuK33tWom+H17JzNf1rdYKxtc7IVQgm/E > RfYhIejH9yQR0/8CHw+ySF3mJdiQsZHMKL4PwXhRzp9OuOU8RZts1bve8pJEHGSr > ZQjqjiNB/DyE0s9uNh94U58mwGT8FKHQPR52EPF2WyNlyet1aYUCNQlXm2Qe+3FI > k4D4eJpRfWIHS5x7NALuwrki+/OqFvDphzKCTmhIC2Qa8UnKvxaS9VccW2Z5D9R9 > PHoOb2pgm5bIOUtsWUCykDiTwh5IA0jReoGPRlXmFK/tuhHawdrbfUlQ/YrVAX8w > p+FhchB5e5LNnBOjIXDB9c+viuobF3qo3uoOqjAwGTkEqIdwsiswCUPfjZJD+A== > =XfBH > -----END PGP SIGNATURE-----

2 1

pigeonhole: upgrade 0.4.3 -> 0.4.6 broke script storage
by Petar Bogdanovic 12 Jan '15

12 Jan '15

Hi, I ran into some troubles while upgrading pigeonhole: crane dovecot: lda(petar): Error: sieve: Failed to access user storage (temporary failure) crane dovecot: lda(petar): Error: sieve: file storage: Could not find storage root directory; path was left unconfigured and autodetection failed After reading through the changelog, I noticed that there have been some changes in the script storage location syntax but that old prefix-less paths should still work fine. My lda-configuration is very simple: # lda protocol lda { mail_plugins = sieve postmaster_address = <snip> } plugin { sieve = /data/dovecot/user/%u.sieve sieve_extensions = +editheader sieve_max_redirects = 50 } And even if I change $sieve to: sieve = file:/data/dovecot/user/%u.sieve the error messages disappear but based on the sudden unfiltered wave of mails in my INBOX that I usually store somewhere else, I guess the path still doesn't work. Any ideas? Thanks, Petar Bogdanovic

2 3

Dovecot replication over TCP/SSL, certificate error
by Jonas Plitt 12 Jan '15

12 Jan '15

Hi All, I'm running TCP-based dsync replication on two dovecot nodes. Nowdays i tried to enable SSL (TCPS). I changed mail_replica prefix from tcp:* to tcps:* and added ssl=yes to the inet_listener. Then on running *doveadm sync* i'm getting the following message: " *doveadm(example(a)example.com <example(a)example.com>): Error: Couldn't initialize SSL context: Can't load CA certs from directory /etc/ssl/certs: error:02001024:system library:fopen:File name too longdoveadm: Error: Failed to iterate through some users*" this is my config (part): *ssl_cert = </etc/ssl/certs/alpha-servers.pemssl_key = </etc/ssl/private/alpha-servers.keyssl_ca = </etc/ssl/certs/startcom-ca-bundle.pemssl_client_ca_dir = /etc/ssl/certsssl_client_ca_file = </etc/ssl/certs/startcom-ca.pemssl_protocols = !SSLv2 !SSLv3* The file startcom-ba-bundle contains the complete chain. The file startcom-ca contains only the ca certificate. Can anybody help, please? -- with kind regards, Jonas

2 2