- dovecot - dovecot.org

imap/pop3/lmtp proxy question/problem
by Jogi Hofmüller 25 Jun '14

25 Jun '14

Dear list, We are finally back to our task of migrating from cyrus to dovecot. dovecot mostly does what we want in terms of POP3/IMAP server. Now we are preparing for migration. The plan is to use dovecot as proxy for not-yet migrated accounts. This works wonderfully for IMAP but not for LMTP. Here's what I find in the logs when I try to deliver e-mail to the dovecot lmtp port: Jun 25 19:03:06 klee dovecot: lmtp(5037): Debug: none: root=, index=, indexpvt=, control=, inbox=, alt= Jun 25 19:03:06 klee dovecot: lmtp(5037): Connect from IP-address Jun 25 19:03:06 klee dovecot: lmtp(5037): Debug: user USER: Auth PASS lookup returned temporary failure: reason=Configured passdbs don't support crentials lookups Jun 25 19:03:06 klee dovecot: lmtp(5037): Debug: auth input: reason=Configured passdbs don't support crentials lookups Delivery works fine without proxy (lmtp_proxy = no). What I would need to do is to configure the proxy part so that POP3/IMAP uses the accounts username/password and LMTP uses a special account to deliver e-mail. This is dovecot-ldap.auth (the =proxy=y will be replaced by a field from ldap once the tests work): uris = ldaps://our.ldap.server/ tls = no auth_bind = yes base = dc=mur,dc=at deref = never scope = subtree user_attrs = =home=/srv/vmail/mail/%Lu,=uid=999,=gid=999 user_filter = (&(objectClass=posixAccount)(uid=%u)) pass_attrs = uid=user,userPassword=password,=proxy=y,=host=our.imap.server,=starttls=yes iterate_attrs = uid=user iterate_filter = (objectClass=posixAccount) dovecot -n # 2.2.13: /etc/dovecot/dovecot.conf # OS: Linux 3.14-1-amd64 x86_64 Debian jessie/sid auth_verbose = yes disable_plaintext_auth = no lmtp_proxy = yes login_greeting = Dovecot is spitze! mail_debug = yes mail_location = maildir:/srv/vmail/mail/%u mail_plugins = acl namespace { hidden = no inbox = no list = children location = maildir:/srv/vmail/mail/%%u:INDEX=/srv/vmail/mail/%u/shared/%%u prefix = shared.%%u. separator = . subscriptions = yes type = shared } namespace inbox { hidden = no ignore_on_failure = no inbox = yes list = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk { auto = subscribe special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox Trash { auto = subscribe special_use = \Trash } prefix = INBOX. separator = . subscriptions = yes type = private } passdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } plugin { acl = vfile acl_shared_dict = file:/var/lib/dovecot/db/shared-mailboxes.db sieve = ~/.dovecot.sieve sieve_dir = ~/sieve } protocols = " imap lmtp pop3" service auth { unix_listener auth-userdb { group = vmail user = vmail } } service lmtp { inet_listener lmtp { address = 172.16.16.78 port = 24 } user = vmail } ssl_cert = </etc/dovecot/server.pem ssl_key = </etc/dovecot/private/server.pem userdb { driver = prefetch } userdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } protocol lmtp { mail_plugins = acl quota sieve postmaster_address = postmaster(a)mur.at } protocol imap { mail_plugins = acl imap_acl } Regards, -- j.hofmüller Gerüchtegenerator http://plagi.at/geruecht

1 0

sievec drops privileges unexpectedly
by Matthijs Kooijman 25 Jun '14

25 Jun '14

(Please keep me CC'd, I'm not subscribed) Hi folks, I'm using dovecot 2.1.7 (from Debian stable) with sieve. I have default sieve script configured, which lives in /etc/dovecot/sieve. I use dovecot-lda running under the virtual-mail user, which does not have write access to the /etc/dovecot/sieve directory. Now, when a mail gets delivered, I get the following message in my logs. Jun 25 14:29:43 mail dovecot: lda(2001): Error: sieve: binary save: failed to create temporary file: open(/etc/dovecot/sieve/default.svbin.mail.local.18902.) failed: Permission denied (euid=2009(virtual-mail) egid=2009(virtual-mail) missing +w perm: /etc/dovecot/sieve, dir owned by 0:0 mode=0755) Jun 25 14:29:43 mail dovecot: lda(2001): Error: sieve: the lda sieve plugin does not have permission to save global sieve script binaries; global sieve scripts like /etc/dovecot/sieve/default need to be pre-compiled using the sievec tool Due to the lack of permissions, this is of course expected. However, when I then try to precompile the script using sievec, that also fails: # sievec /etc/dovecot/sieve/default sievec(root): Error: sieve: binary save: failed to create temporary file: open(/etc/dovecot/sieve/default.svbin.mail.local.18952.) failed: Permission denied (euid=2009(virtual-mail) egid=2009(virtual-mail) missing +w perm: /etc/dovecot/sieve, dir owned by 0:0 mode=0755) So, apparently sievec drops privileges to the virtual-mail user. Why does this happen? It seems kind of counter-productive - I don't see a way to properly run sievec as root now? How is this supposed to work? Now I wrote this, I realized that it might be related that I have specified mail_uid and mail_gid globally in my dovecot.conf file. Perhaps those are intended to only be put inside the protocol imap and protocol lda blocks? This would mean duplicating of this bit of configuration, which doesn't really sound nice. Gr. Matthijs PS, here's my dovecot -n output: # 2.1.7: /etc/dovecot/dovecot.conf # OS: Linux 3.10-1-amd64 x86_64 Debian 7.5 log_timestamp = "%Y-%m-%d %H:%M:%S " mail_access_groups = spamd-access mail_debug = yes mail_gid = virtual-mail mail_location = Maildir:~/Folders:INBOX=~/INBOX:LAYOUT=fs mail_uid = virtual-mail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave passdb { args = /etc/dovecot/dovecot-ldap.conf driver = ldap } plugin { antispam_backend = pipe antispam_pipe_program = /usr/bin/spamc antispam_pipe_program_args = --socket=/var/run/spamd.socket antispam_pipe_program_notspam_arg = --learntype=ham antispam_pipe_program_spam_arg = --learntype=spam antispam_spam = Spam antispam_trash_pattern_ignorecase = trash;Deleted *;Prullenbak;Verwijderde * sieve = ~/sieve sieve_dir = ~/sieve.d sieve_global_path = /etc/dovecot/sieve/default } protocols = imap sieve service auth { unix_listener auth-client { group = Debian-exim mode = 0600 user = Debian-exim } unix_listener auth-master { group = virtual-mail mode = 0600 user = virtual-mail } user = nobody } ssl_cert = <ssl/mail.tikatika.nl.crt-chain ssl_key = <ssl/mail.tikatika.nl.key userdb { args = home=/data/mail/%u allow_all_users=yes uid=virtual-mail gid=virtual-mail driver = static } protocol imap { mail_plugins = antispam } protocol lda { lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes mail_plugins = sieve postmaster_address = }

2 2

Remove all messages in a mailbox
by Murray Trainer 25 Jun '14

25 Jun '14

Hi All, I am having trouble removing all messages in a mailbox. The command below doesn't remove all the messages: doveadm expunge -u user@domain mailbox '*' all Do I need to add .* or other? THanks Murray

2 1

ot: accepting self certs into win pc?
by voytek＠sbt.net.au 24 Jun '14

24 Jun '14

few month ago, I've got a new Dovecot/Postfix server with self issued certificate (like the previous server), transferred users, all went well EXCEPT for one user on Win/Outlook (or Outlook Express) who tells me his new PC 'doesn't want to accept certificate' (sorry, I'm short on exact details at this time) I need to get it sorted out, I expect it 'should just work' like it did for other users, BUT, before I start looking, trying to 'educate myself' better if any one has any pointers, dos or don't regarding win email clients with self certified server, pls point me that way is using IE with www.dom.com/mycert.crt good point to start ? (after copying mycer.crt to web linked directory first?) thanks, V

7 17

Wheezy Dovecot workarounds
by Steve Litt 24 Jun '14

24 Jun '14

Hi all, In switching from Ubuntu to Debian Wheezy (7.5 64bit, network install), I'm finding some surprises in getting Dovecot to work. PROBLEM: As installed, the package manager doesn't give you the dovecot executable. WORKAROUND: To install the dovecot executable, you need to follow these instructions: http://wiki2.dovecot.org/HowTo/DebianStable PROBLEM: Even when you install Dovecot, it doesn't work, as evidenced by the inability of a local email client to talk to it. Further elements of the symptom are that nmap -A -T4 LocalIPAddress, whether LocalIPAddress is the IP of eth0, or 127.0.0.1, fails to find any open ports. Telnet can't operate dovecot at port 143, and openssl can't operate it at 993. However, bizarrly, executing these same commands on a remote machine into the original machine (including accessing the machine's Dovecot from an email client) work perfectly. WORKAROUND To "solve" this problem, do the following raindance as root: ifdown lo ifup lo After the raindance, local access to Dovecot works perfectly, and all nmap commands perform as expected. LOL, hey man, don't shoot me, I'm just the messenger. SteveT Steve Litt * http://www.troubleshooters.com/ Troubleshooting Training * Human Performance

4 3

Mangesieve security question
by Vijay Rajah 24 Jun '14

24 Jun '14

Hello, I have a dovecot 2.2.6 on a Linux platform. I have configured manageseive extension. I have opened the manageseive port (4190) to entire world. (since I need my thunderbird and other clients to create seive scripts). I just wanted to know if it is ok to open that port to everyone, and get some feedback on some security measures specific to manageseive. -Thanks in advance Vijay PS: I have taken reasonable server hardening measures. This question is specific to manageseive.

2 1

Wishlist: add a variable %{x509} expanding to the client cert in Dovecot-auth
by Guilhem Moulin 24 Jun '14

24 Jun '14

Hi there, As of Dovecot 2.2.9, it's possible to enable passwordless authentication using client certificates [1]: ssl_ca = </etc/ssl/ca.pem ssl_verify_client_cert = yes auth_ssl_username_from_cert = yes (Password checking can be bypassed by returning the extra fields ‘password= nopassword’ in the passdb when the variable ‘%k’ expands to "valid".) However this requires the server admin to set up a PKI. Having a variable %{x509} expanding to the X.509 client cert in Dovecot-auth would remove such hassle and instead provide a way to manage authorized clients in the fashion of OpenSSH's ‘authorized_keys’. Postfix has a similar configuration option: relay_clientcerts [2]. There, the keys for the lookup table can be either client cert fingerprints or public key fingerprints (the digest algorithm can be configured with smtpd_tls_fingerprint_digest). I can't see why %{x509} should digest the certificate and not merely PEM-encode it, but having another %{pubkey} variable expanding to the (PEM-encoded) cert's SubjectPublicKeyInfo block would surely be useful :-) I wonder if there are other folks interested in having the client cert available in the passdb. Thanks, cheers, -- Guilhem. [1] http://wiki2.dovecot.org/SSL/DovecotConfiguration#Client_certificate_verifi… [2] http://www.postfix.org/postconf.5.html#relay_clientcerts

1 0

ACL group-override question
by Peter Chiochetti 23 Jun '14

23 Jun '14

Trying to get ACLs working, very basic setup: Virtual users are put into different acl_group via passdb. > u:{PLAIN}B::::::userdb_acl_groups=g The global acl file restricts what they can do. > * group-override=g > * group=g lr Shouldn't this mean, that the group rights override the user rights? The effect that I see though is, that the user "u" then may not do anything, not even lookup and read. The wiki text is not fully clear to me: It tells about disabling access fully (probably by specifying a non-existent group?). But this can only be one way to use group_override… -- peter

1 2

Dovecot authentication against active directory
by Tobias Dummert 23 Jun '14

23 Jun '14

Hello, i´ve got a problem with the dovecot authentication against active directory. I´m using dovecot 2.0.19 and windows server 2008 R2. When I try to login via telnet I get the following error message: a NO [AUTHENTICATIONFAILED] Authentication failed. My dovecot configuration: # 2.0.19: /etc/dovecot/dovecot.conf # OS: Linux 3.2.0-60-generic x86_64 Ubuntu 12.04.4 LTS ext4 auth_mechanisms = plain login auth_username_format = %Lu disable_plaintext_auth = no first_valid_gid = 1001 first_valid_uid = 1001 last_valid_gid = 1001 last_valid_uid = 1001 log_path = /var/log/dovecot.log mail_location = maildir:/srv/mail/%u passdb { args = /etc/dovecot/dovecot-ldap.conf driver = ldap } protocols = imap ssl = no syslog_facility = local7 userdb { args = /etc/dovecot/dovecot-ldap.conf driver = ldap } valid_chroot_dirs = /srv/mail My dovecot-ldap.conf: hosts = ************** dn = CN=*****,OU=*****,OU=*****,OU=*****,DC=******,DC=*****,DC=de dnpass = **************** tls = no debug_level = -1 ldap_version = 2 base = OU=*****,DC=*****,DC=*****,DC=de deref = never scope = subtree user_attrs = sAMAccountName=home user_filter = (&(ObjectClass=user)(|(mail=%u)(sAMAccountName=%u))) pass_filter = (&(ObjectClass=user)(sAMAccountName=%u)) default_pass_scheme = plain could anybody help me with this problem? Thanks in advance! Regards, Tobias Dummert

2 1

ACL group vs. owner question
by Peter Chiochetti 23 Jun '14

23 Jun '14

A hopefully simple question regarding the use of ACLs - the spirit being of taking away most permissions first and then adding them back selectively: In the global ACL declaration I have: > * owner lr > * group=SYS lrwstipekxa The owner is put into the SYS group via userdb extra field in static passwd file ("archiv" is a system user, but pam is disabled for the server): > archiv:::::::userdb_acl_groups=SYS Still, the group permissions do not get applied: > root@host:/etc/dovecot# doveadm -D acl debug -u archiv INBOX > […] > doveadm(archiv): Debug: Added userdb setting: plugin/acl_groups=SYS > doveadm(archiv): Debug: Effective uid=1002, gid=1001, home=/home/archiv > doveadm(archiv): Debug: acl: No acl_shared_dict setting - shared mailbox listing is disabled > doveadm(archiv): Debug: Namespace inbox: type=private, prefix=, sep=, inbox=yes, hidden=no, list=yes, subscriptions=yes location=maildir:~/Maildir > doveadm(archiv): Debug: maildir++: root=/home/archiv/Maildir, index=, indexpvt=, control=, inbox=/home/archiv/Maildir, alt= > doveadm(archiv): Debug: acl: initializing backend with data: vfile:/etc/dovecot/dovecot-acl > doveadm(archiv): Debug: acl: acl username = archiv > doveadm(archiv): Debug: acl: owner = 1 > doveadm(archiv): Debug: acl vfile: Global ACL file: /etc/dovecot/dovecot-acl > doveadm(archiv): Info: Mailbox 'INBOX' is in namespace '' > doveadm(archiv): Info: Mailbox path: /home/archiv/Maildir > doveadm(archiv): Info: All message flags are shared across users in mailbox > doveadm(archiv): Debug: acl vfile: file /home/archiv/Maildir/dovecot-acl not found > doveadm(archiv): Info: User archiv has rights: lookup read > doveadm(archiv): Info: Mailbox in user's private namespace > doveadm(archiv): Info: Mailbox INBOX is visible in LIST My question: Shouldn't this work? (In a stock setup.) PS: when I add "* group-override=SYS" to /etc/dovecot/dovecot-acl the user will not even be able to list INBOX. PPS: As an aside, the setup also switches any sytem or /virtual/ users during login in local.conf: > userdb { > driver = static > args = uid=archiv gid=archiv home=/home/archiv user=archiv > } but I get the above result without that switching when I make it read: > userdb { > driver = static > args = home=/home/archiv > } So I suppose that it's not relevant in this case… Thank you in advance -- peter

2 2