- dovecot - dovecot.org

PAM and YubiKeys
by Jack 29 Jul '14

29 Jul '14

Hi List, I am trying to get authentication to Dovecot with a Yubikey OTP. I have the PAM modules installed and can successfully authenticate to ssh with the Yubikey, so I am confident that the network level and Yubikey configuration is correct. I can also authenticate to Dovecot via PAM using a plain password, however when I try to use the Yubikey authentication with Dovecot things don't go well. Network monitoring reveals that the software does not even attempt to connect to the authentication servers. My Dovecot authentication is configured as follows :- passdb { driver = pam args = failure_show_msg=yes dovecot override_fields = proxy host=1.2.3.4 master=XXXXXX pass=XXXXXX } userdb { driver = passwd-file args = username_format=%u /etc/dovecot/users } The dovecot Pam config file is :- auth sufficient pam_yubico.so id=99999 key="xxxxxxxxxxx" authfile=/etc/yubikey_mappings debug @include common-auth @include common-account @include common-session When failing to authenticate with Dovecot, the PAM debug log shows :- [../pam_yubico.c:parse_cfg(761)] called. [../pam_yubico.c:parse_cfg(762)] flags 0 argc 4 [../pam_yubico.c:parse_cfg(764)] argv[0]=id=xxxxxx [../pam_yubico.c:parse_cfg(764)] argv[1]=key="xxxxxx" [../pam_yubico.c:parse_cfg(764)] argv[2]=authfile=/etc/yubikey_mappings [../pam_yubico.c:parse_cfg(764)] argv[3]=debug [../pam_yubico.c:parse_cfg(765)] id=xxxxxx [../pam_yubico.c:parse_cfg(766)] key="xxxxxxxxx" [../pam_yubico.c:parse_cfg(767)] debug=1 [../pam_yubico.c:parse_cfg(768)] alwaysok=0 [../pam_yubico.c:parse_cfg(769)] verbose_otp=0 [../pam_yubico.c:parse_cfg(770)] try_first_pass=0 [../pam_yubico.c:parse_cfg(771)] use_first_pass=0 [../pam_yubico.c:parse_cfg(772)] authfile=/etc/yubikey_mappings [../pam_yubico.c:parse_cfg(773)] ldapserver=(null) [../pam_yubico.c:parse_cfg(774)] ldap_uri=(null) [../pam_yubico.c:parse_cfg(775)] ldapdn=(null) [../pam_yubico.c:parse_cfg(776)] user_attr=(null) [../pam_yubico.c:parse_cfg(777)] yubi_attr=(null) [../pam_yubico.c:parse_cfg(778)] yubi_attr_prefix=(null) [../pam_yubico.c:parse_cfg(779)] url=(null) [../pam_yubico.c:parse_cfg(780)] capath=(null) [../pam_yubico.c:parse_cfg(781)] token_id_length=12 [../pam_yubico.c:parse_cfg(782)] mode=client [../pam_yubico.c:parse_cfg(783)] chalresp_path=(null) [../pam_yubico.c:pam_sm_authenticate(823)] get user returned: jack [../pam_yubico.c:pam_sm_authenticate(929)] conv returned 44 bytes [../pam_yubico.c:pam_sm_authenticate(947)] Skipping first 0 bytes. Length is 44, token_id set to 12 and token OTP always 32. [../pam_yubico.c:pam_sm_authenticate(954)] OTP: ccccccbcitfdueencldivbcjvghvikdtrnujbgubirru ID: ccccccbcitfd [../pam_yubico.c:pam_sm_authenticate(985)] ykclient return value (101): Could not parse server response [../pam_yubico.c:pam_sm_authenticate(1038)] done. [Authentication service cannot retrieve authentication info] A successful authentication (via ssh) looks like [../pam_yubico.c:parse_cfg(761)] called. [../pam_yubico.c:parse_cfg(762)] flags 1 argc 4 [../pam_yubico.c:parse_cfg(764)] argv[0]=id=xxxx [../pam_yubico.c:parse_cfg(764)] argv[1]=key="xxxxxxxxxxxxxxxxxx" [../pam_yubico.c:parse_cfg(764)] argv[2]=authfile=/etc/yubikey_mappings [../pam_yubico.c:parse_cfg(764)] argv[3]=debug [../pam_yubico.c:parse_cfg(765)] id=xxxxxx [../pam_yubico.c:parse_cfg(766)] key="xxxxxxxxxxxxxxxxxxx" [../pam_yubico.c:parse_cfg(767)] debug=1 [../pam_yubico.c:parse_cfg(768)] alwaysok=0 [../pam_yubico.c:parse_cfg(769)] verbose_otp=0 [../pam_yubico.c:parse_cfg(770)] try_first_pass=0 [../pam_yubico.c:parse_cfg(771)] use_first_pass=0 [../pam_yubico.c:parse_cfg(772)] authfile=/etc/yubikey_mappings [../pam_yubico.c:parse_cfg(773)] ldapserver=(null) [../pam_yubico.c:parse_cfg(774)] ldap_uri=(null) [../pam_yubico.c:parse_cfg(775)] ldapdn=(null) [../pam_yubico.c:parse_cfg(776)] user_attr=(null) [../pam_yubico.c:parse_cfg(777)] yubi_attr=(null) [../pam_yubico.c:parse_cfg(778)] yubi_attr_prefix=(null) [../pam_yubico.c:parse_cfg(779)] url=(null) [../pam_yubico.c:parse_cfg(780)] capath=(null) [../pam_yubico.c:parse_cfg(781)] token_id_length=12 [../pam_yubico.c:parse_cfg(782)] mode=client [../pam_yubico.c:parse_cfg(783)] chalresp_path=(null) [../pam_yubico.c:pam_sm_authenticate(823)] get user returned: jack [../pam_yubico.c:pam_sm_authenticate(929)] conv returned 44 bytes [../pam_yubico.c:pam_sm_authenticate(947)] Skipping first 0 bytes. Length is 44, token_id set to 12 and token OTP always 32. [../pam_yubico.c:pam_sm_authenticate(954)] OTP: ccccccbcitfdetdfkbjrtfbuhgbtjgethkdebcgthgde ID: ccccccbcitfd [../pam_yubico.c:pam_sm_authenticate(985)] ykclient return value (0): Success [../pam_yubico.c:authorize_user_token(221)] Using system-wide auth_file /etc/yubikey_mappings [../pam_yubico.c:check_user_token(178)] Authorization line: jack:ccccccbcitfd [../pam_yubico.c:check_user_token(182)] Matched user: jack [../pam_yubico.c:check_user_token(187)] Authorization token: ccccccbcitfd [../pam_yubico.c:check_user_token(190)] Match user/token as jack/ccccccbcitfd [../pam_yubico.c:pam_sm_authenticate(1038)] done. [Success] I have just noticed that the 'flags' is set to 1 by ssh. I don't know where (or if) I can control how Dovecot sets that flag or if it has any relevance. The Pam configuration line for Yubikey is identical in the ssh configuration. Does anyone have any idea what is going wrong? Thanks in advance, Jack

1 0

identify MUA connecting?
by Juan Pablo 29 Jul '14

29 Jul '14

Hello I am using dovecot 1.2.15 on ubuntu. Is it possible to somehow log the MUA information that is connecting to Dovecot? The reason I am wanting to do this is I would like to know if people are getting their email on personal devices instead of work secured / standardized phones.

9 12

Missing IMAP Subfolders
by Tim 29 Jul '14

29 Jul '14

I've recently encountered an issue with my IMAP folders on Dovecot 2.0.19. When I telnet into my account and perform a list, I get the following response: A list "" "*" * LIST (\Unmarked) "." "INBOX" A OK List completed. However I know there are subfolders here and have examined the server directly via SSH and strangely: a select INBOX.Clients * OK [CLOSED] Previous mailbox closed. * FLAGS (\Answered \Flagged \Deleted \Seen \Draft) * OK [PERMANENTFLAGS (\Answered \Flagged \Deleted \Seen \Draft \*)] Flags permitted. * 0 EXISTS * 0 RECENT * OK [UIDVALIDITY 1394028715] UIDs valid * OK [UIDNEXT 1] Predicted next UID * OK [HIGHESTMODSEQ 1] Highest a OK [READ-WRITE] Select completed. When I also subscribe to a couple if these which I am able to to do despite not being able to "LIST" them, I get this with LIST-EXTENDED: a04 LIST (SUBSCRIBED RECURSIVEMATCH) "*" "*" * LIST (\Subscribed \NonExistent) "." "INBOX" (CHILDINFO ("SUBSCRIBED")) * LIST (\Subscribed \NonExistent) "." "INBOX.Clients" (CHILDINFO ("SUBSCRIBED")) * LIST (\Subscribed \NonExistent) "." "INBOX.Clients.Bob" a04 OK List completed. Just not sure why a LIST is not giving me a full list as it's causing problems subscribing to these with Mail Clients. Any help is appreciated!

1 0

incremental mailbox syncs for quick migration
by Jogi Hofmüller 29 Jul '14

29 Jul '14

Hi all, We are facing quite large mailboxes (>10GB) in our migration from cyrus to dovecot. I did a test on one mailbox and repeated the sync a couple of times with the expected result that the second, third, etc. sync took only seconds compared to minutes for the first sync. We use this command to sync a mailbox: doveadm backup -R -u USER imapc: Are there any problems to be expected when we first do a sync for all mailboxes but do not migrate the users right away but instead do the actual migration using a second sync? Cheers, -- j.hofmüller http://thesix.mur.at/

1 0

problem migrating shared folders from cyrus to dovecot
by Jogi Hofmüller 29 Jul '14

29 Jul '14

Hi all, We face a problem migrating shared mailboxes from an old cyrus server to dovecot. Whereas migrating regular users works like a charm, the shared mailboxes cannot be migrated. dsync/doveadm states: "Error: Failed to access mailbox INBOX: Mailbox does not exist". This is somehow true since the shared mailboxes live not under user.mailbox but rather under shared.mailbox (cyrus special). Has anyone a solution for this peculiar problem? Cheers, -- j.hofmüller http://thesix.mur.at/

1 0

Multiple servers and NFS
by Richard Hector 29 Jul '14

29 Jul '14

Hi all, For some reason, I didn't go to http://wiki2.dovecot.org/NFS until now, and I'm starting to get worried ... The plan was to have multple servers (MXes) receiving mail, and delivering via LMTP to multiple backend dovecot servers (with amavis in front of dovecot; LMTP both sides). Then we'd have multiple servers for clients to use IMAP or POP3. This is more or less how the system already works, except with Courier IMAP, and postfix on the backends, delivering to maildirs with procmail. But with the recommendation to use the Director for both IMAP/POP3 and LMTP - that starts to sound like I need a whole bunch more servers to run Directors and proxies, and even then it might not be a good idea to have different servers running lmtp and imap/pop. One possible mitigating point is that our 'load balancing' is DNS round-robin, so a given client will probably stick with a single imap/pop server anyway, but if the user has multiple clients (desktop/mobile etc) then they may still hit different servers. Can someone clarify best practice for a setup needing multiple servers for load balancing and redundancy? Is Courier already likely to have been suffering these problems? Oh, the NFS server is a NetApp Filer, if that matters. I'm using dovecot 2.2.9 from debian wheezy backports, in order to get the quota policy daemon support. Thanks, Richard

9 19

Dovecot mailstore performance tuning
by Murray Trainer 29 Jul '14

29 Jul '14

HI All, We have a couple of dovecot director proxies and six backed mailstores each accessing mailboxes stored on five NFSv4 filsystems with about 1TB of mail on each in maildir format. We have about 800 max users on each mailstore at peak times and performance appears to starting to degrade at these times. The mailstores are pretty recent hardware with 64GB of RAM and 24 cores. The NFS storage is EMC VNX and we are doing about 250 I/O per sec upto max of 500 on each filesystem. I need to squeeze more performance out of these servers whether that is in the NFS client, Dovecot or Linux OS/kernel areas. We use LDAP for auth and I am doing some tuning in that area. The NFS filesystems are mounted with the options below: 10.11.0.238:/mailbox_store_01 on /home1 type nfs4 (rw,relatime,vers=4.0,rsize=65536,wsize=65536,namlen=255,hard,nordirplus,proto=tcp,port=0,timeo=600,retrans=2,sec=sys,clientaddr=10.11.0.96,local_lock=none,addr=10.11.0.238) My dovecot config is below. I am not seeing any obvious issues in the server logs. Any suggestions on how to improve performance would be appreciated. Thanks Murray # doveconf -n # 2.2.9: /etc/dovecot/dovecot.conf doveconf: Warning: service auth { client_limit=40960 } is lower than required under max. load (41280) doveconf: Warning: service anvil { client_limit=40970 } is lower than required under max. load (41183) # OS: Linux 3.13-0.bpo.1-amd64 x86_64 Debian 7.5 auth_cache_size = 64 M auth_cache_ttl = 2 hours auth_failure_delay = 0 auth_mechanisms = plain login auth_username_chars = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789!#$-=?^_{}~./@+%" auth_username_translation = +@ auth_worker_max_count = 256 base_dir = /var/run/dovecot/ disable_plaintext_auth = no first_valid_gid = 1001 first_valid_uid = 1001 mail_fsync = always mail_location = maildir:~/ managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave mmap_disable = yes namespace { inbox = yes location = prefix = INBOX. type = private } passdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } plugin { acl = vfile quota = maildir quota_rule = INBOX.Trash:ignore } protocols = " imap lmtp sieve pop3" service anvil { client_limit = 40970 } service auth-worker { user = dovecot } service auth { client_limit = 40960 unix_listener auth-userdb { group = mail mode = 0666 user = dovecot } } service imap-login { chroot = login inet_listener imap { address = *, [::] port = 143 } inet_listener imaps { address = * port = 993 ssl = yes } process_limit = 20480 process_min_avail = 32 service_count = 1 user = dovecot vsz_limit = 256 M } service imap { process_limit = 40960 vsz_limit = 256 M } service lmtp { inet_listener lmtp { address = 27.54.95.41 port = 24 } process_min_avail = 32 } service managesieve-login { client_limit = 40960 process_limit = 120 process_min_avail = 5 service_count = 0 vsz_limit = 64 M } service managesieve { process_limit = 4096 vsz_limit = 256 M } service pop3-login { chroot = login inet_listener pop3 { address = *, [::] port = 110 } inet_listener pop3s { address = * port = 995 ssl = yes } process_limit = 20480 process_min_avail = 32 service_count = 1 user = dovecot vsz_limit = 256 M } service pop3 { process_limit = 40960 vsz_limit = 256 M } ssl_cert =

2 1

Re: identify MUA connecting?
by Joseph Tam 29 Jul '14

29 Jul '14

Juan Pablo <juanpablo83(a)openmailbox.org> writes: > That is what I was not sure. I did not know what information was > possible available. I was thinking or hoping something same as http logs My dovecot 2 installation logs this information. E.g. Jul 26 07:13:02 server dovecot: imap(user): ID sent: name=iPad Mail, version=11D201, os=iOS, os-version=7.1.1 (11D201) Jul 26 07:13:38 server dovecot: imap-login: ID sent: name=com.google.android.email, os=android, os-version=4.4.4; KTU84P, vendor=LGE, x-android-device-model=Nexus 4, x-android-mobile-net-operator=Koodo, AGUID=...: user=<>, rip={client-ip}, lip={server-ip}, TLS, session=<BH7SSxn/CQBFrJG2> If you want this info, upgrade, as a later poster suggests. Joseph Tam <jtam.home(a)gmail.com>

1 0

Dovecot pigeonhole help sought
by Timothy Murphy 29 Jul '14

29 Jul '14

I'm running postfix + dovecot + dovecot-pigeonhole on my CentOS-7 home server. I would like spam to finish up in ~/Maildir/.Spam/ . Spam is being marked, but is not separated - it ends up with all the other email in ~/Maildir/cur/ . Evidently there is some step I have omitted to take. I give the output of "sudo doveconf -n" below. The file ~/.dovecot.sieve reads: ------------------------------ # Sieve Filter require ["fileinto","regex","envelope","vacation"]; if header :contains "X-Spam-Flag" "YES" { fileinto "/home/tim/Maildir/.Spam/"; } ------------------------------ When I run "sudo systemctl restart dovecot" I see the line Jul 27 18:54:23 alfred dovecot: master: Dovecot v2.2.10 starting up for imap, pop3, lmtp, sieve (core dumps disabled) in /var/log/maillog Output of "sudo doveconf -n > dovecot.conf" ------------------------------ # 2.2.10: /etc/dovecot/dovecot.conf # OS: Linux 3.10.0-123.4.4.el7.x86_64 x86_64 CentOS Linux release 7.0.1406 (Core) listen = * mail_debug = yes mail_location = maildir:~/Maildir managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave mbox_write_locks = fcntl namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { driver = pam } plugin { sieve = ~/.dovecot.sieve sieve_dir = ~/sieve } protocols = imap pop3 lmtp sieve ssl = required ssl_cert = </etc/pki/dovecot/certs/dovecot.pem ssl_key = </etc/pki/dovecot/private/dovecot.pem userdb { driver = passwd } protocol lmtp { mail_plugins = " sieve" } protocol lda { mail_plugins = " sieve" } ------------------------------ Any advice or suggestions gratefully received.

5 4

Error after Upgrade
by Jim Knuth 29 Jul '14

29 Jul '14

Hello, after upgrade (Debian wheezy) from dovecot 2:2.2.13-1~auto+103 => 2:2.2.13-1~auto+113 I discovered that in my log and all mails stuck in the Queue. I’ve had downgrade v 2:2.2.13-1~auto+103 an everything is fine. What’s wrong? Any ideas or solution greatly appreciated. Thanks. Jul 25 11:03:01 server2 dovecot: lmtp(25638): Fatal: master: service(lmtp): child 25638 killed with signal 11 (core dumps disabled) Jul 25 11:03:01 server2 dovecot: lmtp(25639): Connect from local Jul 25 11:03:01 server2 dovecot: lmtp(25639): Fatal: master: service(lmtp): child 25639 killed with signal 11 (core dumps disabled) Jul 25 11:03:01 server2 postfix/lmtp[25617]: 20773D10003: to=<web7p1(a)server1.art-domains.de>, orig_to=<jk(a)jkart.de>, relay=server1.art-domains.de[private/dovecot-lmtp], delay=0.05, delays=0.03/ 0/0.01/0.02, dsn=4.4.2, status=deferred (lost connection with server1.art-domains.de[private/dovecot-lmtp] while sending end of data -- message may be sent more than once) Jul 25 11:03:01 server2 amavis[25541]: (25541-01) Passed CLEAN {RelayedInbound}, [213.203.238.6]:53401 [193.175.143.182] <postfixbuch-users-bounces(a)listen.jpberlin.de> -> <jk(a)jkart.de>, Queue-I D: 62B8BD10001, Message-ID: <53D21B91.2070109(a)fh-landshut.de>, mail_id: AE71HPGl9ZR5, Hits: -5, size: 13518, queued_as: 20773D10003, 2771 ms Jul 25 11:03:01 server2 amavis[25541]: (25541-01) Passed CLEAN, <postfixbuch-users-bounces(a)listen.jpberlin.de> -> <jk(a)jkart.de>, Hits: -5, tag=-9999.9, tag2=2.5, kill=3, queued_as: 20773D10003, L/Y/0/0 Jul 25 11:03:01 server2 postfix/lmtp[25607]: 62B8BD10001: to=<jk(a)jkart.de>, relay=127.0.0.1[127.0.0.1]:10024, delay=3.9, delays=1.2/0/0.01/2.8, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[ 127.0.0.1]:10025): 250 2.0.0 Ok: queued as 20773D10003) Jul 25 11:03:01 server2 postfix/qmgr[25508]: 62B8BD10001: removed Jul 25 11:03:02 server2 postfix/lmtp[25615]: 20773D10003: to=<web1p9(a)server1.art-domains.de>, orig_to=<admin(a)art-domains.de>, relay=server1.art-domains.de[private/dovecot-lmtp], delay=0.06, del ays=0.03/0/0.03/0.01, dsn=4.4.2, status=deferred (lost connection with server1.art-domains.de[private/dovecot-lmtp] while sending end of data -- message may be sent more than once) Jul 25 11:03:02 server2 dovecot: lmtp(25653): Connect from local Jul 25 11:03:02 server2 dovecot: lmtp(25653): Fatal: master: service(lmtp): child 25653 killed with signal 11 (core dumps disabled) -- Mit freundlichen Grüßen, with kind regards, Jim Knuth --------- Die Freiheit der Rede hat den Nachteil, daß immer wieder Dummes, Häßliches und Bösartiges gesagt wird. Wenn wir aber alles in allem nehmen, sind wir doch eher bereit, uns damit abzufinden, als sie abzuschaffen. [Churchill]

3 5