- dovecot - dovecot.org

R: Re: SORT capability
by absolutely_free＠libero.it 01 Dec '14

01 Dec '14

# dovecot -n |grep -i sort (nothing) Maybe to full list is only available after authentication? # telnet localhost 143 Trying ::1... Connected to localhost. Escape character is '^]'. * OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE STARTTLS AUTH=PLAIN AUTH=LOGIN AUTH=DIGEST-MD5 AUTH=CRAM-MD5] Dovecot ready. a login XXXXXXXXXXX YYYYYYYYYYYYYYYY a OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE SORT SORT=DISPLAY THREAD=REFERENCES THREAD=REFS MULTIAPPEND UNSELECT CHILDREN NAMESPACE UIDPLUS LIST-EXTENDED I18NLEVEL=1 CONDSTORE QRESYNC ESEARCH ESORT SEARCHRES WITHIN CONTEXT=SEARCH LIST-STATUS] Logged in >----Messaggio originale---- >Da: h.reindl(a)thelounge.net >Data: 01/12/2014 12.21 >A: <dovecot(a)dovecot.org> >Ogg: Re: SORT capability > > > >Am 01.12.2014 um 12:19 schrieb absolutely_free(a)libero.it: >> why I don't see SORT capability on my dovecot server? >> >> # telnet localhost 143 >> Trying ::1... >> Connected to localhost. >> Escape character is '^]'. >> * OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE STARTTLS AUTH=PLAIN AUTH=LOGIN AUTH=DIGEST-MD5 AUTH=CRAM-MD5] Dovecot ready. >> 1 capability >> * CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE STARTTLS AUTH=PLAIN AUTH=LOGIN AUTH=DIGEST-MD5 AUTH=CRAM-MD5 >> 1 OK Capability completed. >> a logout >> * BYE Logging out >> a OK Logout completed. >> Connection closed by foreign host > >DUNNO > >mabye output of "dovecot -n" knows > >

2 1

Unable to see virtual users
by Randall Gellens 01 Dec '14

01 Dec '14

I have a new Dovecot v2.2.9 installation and am having trouble getting virtual users recognized. Also, the example configuration listed on the Wiki generates config errors. Note that I haven't tried running dovecot yet, I wanted to verify that the config looked good first. First, my configuration. I'm trying to use /etc/dovecot/users as my combined userdb and passdb file, with all users having a UID/GID of vmail, and a home directory of /local/mnt/home/<user> ---------- $ sudo doveconf -n # 2.2.9: /etc/dovecot/dovecot.conf # OS: Linux 3.13.0-39-generic x86_64 Ubuntu 14.04.1 LTS ext4 auth_verbose = yes log_timestamp = "%Y-%m-%d %H:%M:%S " mail_location = mdbox:/local/mnt/mail/%n managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = username_format=%n /etc/dovecot/users driver = passwd-file } passdb { driver = pam } plugin { sieve = ~/.dovecot.sieve sieve_dir = ~/sieve } postmaster_address = randy(a)qti.qualcomm.com protocols = " imap sieve pop3" ssl_cert = </etc/dovecot/dovecot.pem ssl_key = </etc/dovecot/private/dovecot.pem userdb { args = username_format=%n /etc/dovecot/users default_fields = uid=vmail gid=vmail home=/local/mnt/home/%n driver = passwd-file } userdb { driver = passwd } ---------- Next, my /etc/dovecot/users file: $ cat /etc/dovecot/users fred:x test:{SSHA}amehbJZYxKWuIbywINVNWxKcPrWi27a+ poptest2:x poptest3:x ---------- If I ask dovecot what it knows about user 'test' it says the user doesn't exist: $ sudo doveadm user test field valueuserdb lookup: user test doesn't exist ---------- If I ask about a user in /etc/passwd, it finds it: $ sudo doveadm user nobody field value uid 65534 gid 65534 home /nonexistent mail mdbox:/local/mnt/mail/nobody system_groups_user nobody ---------- As an aside, when I copied the sample config entries from http://wiki2.dovecot.org/UserDatabase it got config errors: userdb { driver = passwd-file args = username_format=%n /etc/dovecot/users default_fields = uid=vmail gid=vmail override_fields = skip = never result_failure = continue result_internalfail = continue result_success = return-ok } The 'skip', 'result_failure', etc. entries all generated config errors as being unknown. Since these were just explicitly setting config variables to their default values, I deleted them. It does seem odd that the config sample from the Wiki generated errors though. -- Randall Gellens Opinions are personal; facts are suspect; I speak for myself only -------------- Randomly selected tag: --------------- The difference between stupidity and genius is that genius has its limits. --Albert Einstein

3 6

Working with Active Directory on Windows Server 2012 R2
by Aaron Jenkins 30 Nov '14

30 Nov '14

Hi all, I’m having issues getting Dovecot to work with AD on 2012 R2 in a test environment. Background: AD is running on dc1.ad.automaton.uk<http://dc1.ad.automaton.uk>, the domain is ad.automaton.uk<http://ad.automaton.uk>. The DNS server is running on ad.automaton.uk<http://ad.automaton.uk> and the automaton.uk<http://automaton.uk> DNS is set up correctly in the test environment in that everything resolves to the correct IP address and I can authenticate with whichever LDAP clients (ldapsearch, ApacheDS, sssd). It refuses to bind on Dovecot for some reason. aaron@mail:/var/log$ uname -a Linux mail.ad.automaton.uk 3.16.0-23-generic #31-Ubuntu SMP Tue Oct 21 17:56:17 UTC 2014 x86_64 x86_64 x86_64 GNU/Linux aaron@mail:/var/log$ dovecot --version 2.2.9 aaron@mail:/var/log$ dpkg -l | grep dovecot ii dovecot-core 1:2.2.9-1ubuntu5 amd64 secure POP3/IMAP server - core files ii dovecot-gssapi 1:2.2.9-1ubuntu5 amd64 secure POP3/IMAP server - GSSAPI support ii dovecot-imapd 1:2.2.9-1ubuntu5 amd64 secure POP3/IMAP server - IMAP daemon ii dovecot-ldap 1:2.2.9-1ubuntu5 amd64 secure POP3/IMAP server - LDAP support aaron@mail:/var/log/$ cat dovecot-debug.log … Nov 19 09:22:23 auth: Debug: auth client connected (pid=10345) Nov 19 09:22:23 auth: Debug: client in: AUTH 1 PLAIN service=imap secured session=pkJxdDkISwAK0zcd lip=10.211.55.33 rip=10.211.55.29lport=993 rport=56395 Nov 19 09:22:23 auth: Debug: client passdb out: CONT 1 Nov 19 09:22:23 auth: Debug: client in: CONT 1 (previous base64 data may contain sensitive data) Nov 19 09:22:29 auth: Debug: client passdb out: FAIL 1 user=aaron.jenkins temp Nov 19 09:22:29 auth: Debug: client in: AUTH 2 PLAIN service=imap secured session=pkJxdDkISwAK0zcd lip=10.211.55.33 rip=10.211.55.29lport=993 rport=56395 resp= (previous base64 data may contain sensitive data) Nov 19 09:22:39 auth: Debug: client passdb out: FAIL 2 user=aaron.jenkins temp Nov 19 09:22:40 auth: Debug: client in: AUTH 3 PLAIN service=imap secured session=pkJxdDkISwAK0zcd lip=10.211.55.33 rip=10.211.55.29lport=993 rport=56395 Nov 19 09:22:44 auth: Debug: client passdb out: CONT 3 Nov 19 09:22:44 auth: Debug: client in: CONT 3 (previous base64 data may contain sensitive data) Nov 19 09:22:50 auth: Debug: client passdb out: FAIL 3 user=aaron.jenkins temp Nov 19 09:22:50 auth: Debug: client in: AUTH 4 PLAIN service=imap secured session=pkJxdDkISwAK0zcd lip=10.211.55.33 rip=10.211.55.29lport=993 rport=56395 resp= (previous base64 data may contain sensitive data) Nov 19 09:22:56 auth: Debug: client passdb out: FAIL 4 user=aaron.jenkins temp (I’ve removed the base64 as it might contain passwords I actually use, if it’s important I’ll re-run it with a different password unredacted) Do you guys have any ideas on how to get it working with 2012 R2? I know the LDAP is quite funky but I suspect that’s why it doesn’t work. Also, attached is my sssd config as it’s working fine in case it might provide any insights.

2 5

how to start a replication master-master correctly
by Eduardo Casarero 28 Nov '14

28 Nov '14

Hi all, I currently have one dovecot 2.2.15 working and I would like to add a second master server. If I configure the second server and enable the dsync in both servers, the sync will copy everything from A to B ? I mean, B server won't remove messages in A as it doesn't have anything in its users mailbox? The second master server will be a cold server just for contingency. Thanks

3 2

Re: Offtopic, spam+AV
by Reindl Harald 28 Nov '14

28 Nov '14

Am 28.11.2014 um 17:45 schrieb Jorge Bastos: > In my previous servers I have clamav+spamassassin configured in postfix, but > things as, scan only outgoing emails it's not possible. > > What's the best option for these two filtering now adays? besides that this is the wrong list why should it not be possible? * clamav-milter exists * spamass-milter exists * "-o receive_override_options=no_milters" exists normally you have submission (587) for authenticated mail and MX (25) for inbound mail and both can have their own receive_override_options our MX is a own server delivering already filtered messages to the mailstorage on a different vserver in the LAN via port 10025 the service 10025 is only reachable from one IP (the MX LAN interface) and has "receive_override_options=no_milters" while all other smtpd services in "master.cf" use their own milter setup adjusted for outgoing mail and both machines share a careful maintained bayes-database trained on one machine and deployed with rsync

1 0

Offtopic, spam+AV
by Jorge Bastos 28 Nov '14

28 Nov '14

Hi guys, In my previous servers I have clamav+spamassassin configured in postfix, but things as, scan only outgoing emails it's not possible. What's the best option for these two filtering now adays? Thanks in advanced,

1 0

Re: failed login message
by Rajesh M 28 Nov '14

28 Nov '14

thank you for guidance, just to recap the issue was about squirrelmail giving a wrong message : "connection dropped by imap server" instead of "invalid user or password" as advised i connected using command line on both my old and new servers, and have posted the details including the output of dovevcot -n. 1) command prompt login. i put wrong password telnet x.x.x.x 143 * OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE START TLS AUTH=PLAIN AUTH=LOGIN AUTH=DIGEST-MD5 AUTH=CRAM-MD5] ready. 1 login acc(a)mydomain.com wrongpass 1 NO [AUTHENTICATIONFAILED] Authentication failed. 2) DOVECOT LOG output CURRENT SERVER Nov 28 08:48:39 imap-login: Info: Disconnected (auth failed, 1 attempts in 72 secs): user=<acc(a)mydomain.com, method=PLAIN, rip=120.62.202.70, lip=103.241.181.155, session=<4PxKs+II2QB4PspG> OLD SERVER Nov 28 09:06:08 imap-login: Info: Disconnected (auth failed, 1 attempts): user=<acc(a)mydomain.com>, method=PLAIN, rip=120.62.202.70, lip=72.35.76.156 3) DOVECOT CONFIG FILE DETAILS # dovecot -n # 2.2.7: /etc/dovecot/dovecot.conf # OS: Linux 2.6.32-431.29.2.el6.x86_64 x86_64 CentOS release 6.5 (Final) auth_cache_negative_ttl = 0 auth_cache_size = 32 M auth_cache_ttl = 30 mins auth_mechanisms = plain login digest-md5 cram-md5 default_login_user = vpopmail disable_plaintext_auth = no first_valid_gid = 89 first_valid_uid = 89 log_path = /var/log/dovecot.log login_greeting = ready. mail_max_userip_connections = 50 mail_plugins = " quota" managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave namespace { inbox = yes location = prefix = separator = . type = private } passdb { args = cache_key=%u webmail=127.0.0.1 driver = vpopmail } plugin { quota = maildir:ignore=Trash quota_rule = ?:storage=0 } protocols = imap pop3 service imap-login { client_limit = 256 process_limit = 400 process_min_avail = 12 service_count = 0 vsz_limit = 384 M } service pop3-login { client_limit = 1000 process_limit = 400 process_min_avail = 12 service_count = 0 vsz_limit = 512 M } ssl_cert = </var/qmail/control/servercert.pem ssl_dh_parameters_length = 2048 ssl_key = </var/qmail/control/servercert.pem userdb { args = cache_key=%u quota_template=quota_rule=*:backend=%q driver = vpopmail } protocol imap { imap_client_workarounds = delay-newmail mail_plugins = " quota imap_quota" } protocol pop3 { pop3_client_workarounds = outlook-no-nuls oe-ns-eoh pop3_fast_size_lookups = yes pop3_lock_session = no pop3_no_flag_updates = yes } thank you for your time and patience. rajesh ----- Original Message ----- From: Gedalya [mailto:gedalya@gedalya.net] To: 24x7server@24x7server.net,dovecot@dovecot.org Sent: Tue, 25 Nov 2014 05:54:49 -0500 Subject: Re: failed login message On 11/25/2014 04:49 AM, 24x7server(a)24x7server.net wrote: > thanks for your reply > > i intentionaly put the wrong password and checked the dovecot log and the message i got was > > # tail -f /var/log/dovecot.log | grep "xxx(a)yyy.com" > Nov 25 08:47:46 imap-login: Info: Aborted login (auth failed, 1 attempts in 2 secs): user=<xxx(a)yyy.com>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, > secured, session=<xObTWqYIwgB/AAAB> > > but in the squirrelmail login page instead of the message "unknown user or password incorrect" i get the message > > ERROR: Connection dropped by IMAP server. > Query: LOGOUT > > > in my old server where it is working correctly dovecot logs shows the error > > Nov 25 14:46:12 imap-login: Info: Aborted login (auth failed, 1 attempts): user=<"xxx(a)yyy.com">, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, secured > > and squirrelmail gives the error : "unknown user or password incorrect" which is correct. > > is there any other place i need to check or some other config file (either squirrelmail or dovecot) that i need to modify > > could you kindly guide me > 1. Please carefully read http://dovecot.org/mailinglists.html 2. Please carefully follow the instructions at http://dovecot.org/mailinglists.html. In your case, post full details for both servers. 3. Try to manually log in to both servers using e.g. telnet in order to see any differences in the way they respond. Something like $ telnet 192.168.9.11 143 Trying 192.168.9.11... Connected to 192.168.9.11. Escape character is '^]'. * OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE STARTTLS LOGINDISABLED] Dovecot ready. 1 login gedalya 1234 * BAD [ALERT] Plaintext authentication not allowed without SSL/TLS, but your client did it anyway. If anyone was listening, the password was exposed. 1 NO [PRIVACYREQUIRED] Plaintext authentication disallowed on non-secure (SSL/TLS) connections. 2 logout * BYE Logging out 2 OK Logout completed. Connection closed by foreign host. (that's how it responds in my specific case as I disallow plaintext login) Or if you need TLS (like me): $ openssl s_client -starttls imap -quiet -connect 192.168.9.11:143 depth=2 C = IL, O = StartCom Ltd., OU = Secure Digital Certificate Signing, CN = StartCom Certification Authority verify error:num=19:self signed certificate in certificate chain verify return:0 . OK Pre-login capabilities listed, post-login capabilities have more. 1 login gedalya 1234 1 NO [AUTHENTICATIONFAILED] Authentication failed. 2 logout * BYE Logging out 2 OK Logout completed.

2 1

auth(default) :Aborted: Worker is buggy
by 刘莹莹 28 Nov '14

28 Nov '14

Hi dovecot when I modify SIEVE_DEFAULT_MAX_REDIRECTS = 25 in sieve-file:dovecot-1.2-sieve-0.1.7/src/lib-sieve/sieve-limits.h I found this problem occurs about once a week,I'm not sure if it was caused by modify SIEVE_DEFAULT_MAX_REDIRECTS = 25 , defaulte is SIEVE_DEFAULT_MAX_REDIRECTS = 4: LOG: Nov 25 11:20:12 imap-login: Info: Login: user=<any(a)rails.cn>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, secured Nov 25 11:20:12 auth(default): Error: BUG: Worker sent reply with id 230, expected 231 Nov 25 11:20:12 auth(default): Error: worker-server(lwh(a)rails.cn,127.0.0.1): Aborted: Worker is buggy dovecot -n: namespace: type: private separator: / inbox: yes list: yes subscriptions: yes namespace: type: shared separator: / prefix: shared/%%u/ location: maildir:%Lh/%Ld/%%n/:INDEX=%Lh/%Ld/%Ln/shared/%%u list: children auth default: mechanisms: plain login default_realm: com user: txmail master_user_separator: * verbose: yes debug: yes debug_passwords: yes passdb: driver: passwd-file args: /etc/dovecot.master pass: yes master: yes passdb: driver: dict args: /etc/dovecot-memcached.conf userdb: driver: dict args: /etc/dovecot-memcached.conf socket: type: listen client: path: /var/spool/postfix/dovecot-auth mode: 438 user: postfix group: postfix master: path: /var/run/dovecot/auth-master mode: 438 user: txmail group: txmail plugin: quota_warning: storage=90%% %Lh/bin/dovecot-quota-warning.sh 90 %u quota_warning2: storage=95%% %Lh/bin/dovecot-quota-warning.sh 95 %u acl: vfile acl_shared_dict: file:/%Lh/%Ld/shared-mailboxes.db quota: maildir quota_rule: *:storage=10M expire: * 7 expire_dict: proxy::expire auth_socket_path: /var/run/dovecot/auth-master sieve: /opt/nsmail/data/sieve/%Ld/%Ln/.dovecot.sieve autocreate: trash autosubscribe: trash autocreate2: rubbishs autosubscribe2: rubbishs autocreate3: &XfJT0ZABkK5O9g- autosubscribe3: &XfJT0ZABkK5O9g- autocreate4: &g0l6Pw- autosubscribe4: &g0l6Pw- autocreate5: decrypt dict: expire: mysql:/etc/dovecot-expire.conf THANKS YINGYING

2 1

Move mail behavior
by Martin Stigge 27 Nov '14

27 Nov '14

Hi! I've recently migrated my IMAP mail setup from a server running an older Debian Squeeze with dovecot 1.2.15 to a new Debian Jessie system with dovecot 2.2.13. In the old setup, it used to be so that a mail moved from a folder to another one was marked as deleted in the originating folder (in dovecot 1.2.15). In the new setup, the mail just disappears from the originating folder (with dovecot 2.2.13). The mail arrives properly in the target folder, so that's fine. But I actually liked the old behavior. I observe this with Evolution as well as Icedove (Thunderbird) mail clients, which is why I assume that it's actually a change in the IMAP server behavior. Is it supposed to behave like that? Is there a way to configure this? Regards, Martin

2 2

2.2.15: SMTP submission server?
by Ron Leach 27 Nov '14

27 Nov '14

List, we're migrating to 2.2 from a 1.x version. There has been mention from time to time of a dovecot SMTP submission server. Last I saw was Timo suggesting this would be a 2.3 feature, but that there was already a 'basic' capability in 2.2 that, more or less, merely provided a secured/authorised SMTP submission. I haven't found anything about this in the wiki, but the feature is of interest to us. I would like to *not* have our MTA capable of being exploited as a relay (it isn't, at the moment) whereas users are logging into our dovecot from offsite using imaps with passwords. While moving to 2.2, I'd like to try to use a secure SMTP submission *separate* from the MTA so that that software, with whatever vulnerabilities or weaknesses it might have, remained locked down and could not relay, if at all possible. (Imaps with passwords means the login details are not transmitted in cleartext and, so, leak no security to an observer of the communications channel. Doubtless there are other weaknesses somewhere but, at least, when using hotel wifi, for example, there is little chance of revealing login details to a packet sniffer. It won't be perfect, there are probably other vulnerabilities, not least in the underlying OSs at each end, but the connection - which is a serious vulnerability in many places - will be as good as is practical to make it.) So, is there some kind of SMTP submission service for a logged in dovecot user, and how would a client make use of that? Is it possible to setup 2.2.15 for this? And, crucially, would the connections between the client (eg at a hotel in some unreliable location) be encrypted right from the start, not using STARTTLS, as is the case in imaps? And, just to be really demanding, could we configure its use on a non-standard port? regards, Ron

6 11