- dovecot - dovecot.org

[Dovecot] Plugin mail-filter tangles
by Stanislas SABATIER 05 Jun '14

05 Jun '14

System installed : Dovecot 2.2.12 as IMAP server and Postfix as MTA. Dovecot and Postfix connected via LMTP + Dovecot mail plugin 'mail-filter' to encrypt/decrypt emails on the fly with public/private users' RSA keys. Case study : You have 3 (virtuals) users belonging to 3 different domains, all managed by your Dovecot server. One of these users is connected to Dovecot with MUA Thunderbird, and he's writing an email to someone outside of yours domains, but he puts the two others users' email addresses in CC : mail from user1(a)domain1.dovecot --> to: someone@outside, CC: user2(a)domain2.dovecot, user3(a)domaine3.dovecot What happens (as far as I can understand) : The email is submitted to Postfix : one copy is delivered outside, the other is passed to Dovecot via LMTP for user2 & user3 @dovecot Dovecot is handling the final delivery, through mail-filter plugin as follow : 1. both users contexts are created from user_db queries 2. mail-filter plugin is init for user2 3. /mail_user_created/ for user2 4. mai-filter plugin arguments are parsed for user2 5. â¦/mail_allocated/ then /mail_save_begin/ for user2 (at this stage, the email is encrypted with users2 params) 6. Dovecot tells to LMTP that mail for user2 is delivered 7. then, â we are still in user2 context â, an other /mail_allocated/ is run, followed by a /istream_opened/ 8. mail user context is swithed to user3 --> /mail_user_created/ --> plugin's args parsed --> â¦ /mail_allocated/ 9. andâ¦ Dovecot tells to LMTP that mail for user3 is delivered So, it appears that Dovecot is re-using user2's email to pass it to user3 by opening an istream in user2's context. In my configuration, Dovecot can't do that because it has not the user2's private rsa key to reopen the email it has just encrypted, so it passes the email to user3 with user2 encryption params. Final result : user3 is receiving the email encrypted with user2's rsa key ! Problem : how to force Dovecot to deinit then reinit mail-filter plugin for each user to be sure that each email is encrypted with the right key before it is saved to users' mailboxes ? Thank you in advance for your help. Stan.

5 16

[Dovecot] SQL passdb, LDAP userdb
by Kristof Bajnok 05 Jun '14

05 Jun '14

Hi, in my current setup, LDAP authentication + userdb works fine. I'd like to integrate Dovecot with Shibboleth. I have a custom module at the IdP (*) that inserts short-time tokens to an SQL table at user authentication, and I want Dovecot to use the token table for passdb but keep LDAP for storing the userdb (uid, quota, etc) I thought it was simple as omitting the sql user_query, but I got: Warning: mysql: Query failed, retrying: Table 'webmail.users' doesn't exist Error: sql(user@domain,ipaddr): User query failed: Table 'webmail.users' doesn't exist (using built-in default user_query: SELECT home, uid, gid FROM users WHERE username = '%n' AND domain = '%d') Do you have any hints how to do this? Thanks, Kristof (*): in SAML there is an Identity Provider that does user authentication, which is separated from the services

2 2

[Dovecot] [dovecot]Quota per user from openldap
by Selcuk Yazar 05 Jun '14

05 Jun '14

Hi, in dovecot documentation i try to implement quota per users. i added dovecot-ldap.conf file user_attrs = homeDirectory=home, uidNumber=uid, gidNumber=gid, mailbox=mail, quota=quota_rule=*:bytes=%$ and i see in logs quota(quota_rule=*:bytes=%$)=*:bytes=241800 Debug: Added userdb setting: plugin/quota_rule=*:bytes=241800 but still mail is delivering , i'not sure other settings about 20-imap.conf and 20-pop3.conf from documentation. what is the correct steps for this? thanks in advance -- Selçuk YAZAR

3 2

Re: [Dovecot] R: Info about sharing mail folder
by Steffen Kaiser 05 Jun '14

05 Jun '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On Tue, 3 Jun 2014, Gianluca Calloni wrote: > In folder /var/vmail/example.com/user_a i've a dovecot-acl file with " > user=test(a)example.com lrwstipekxa " > > IN mysql table user_shares i set: > > +---------------------+------------------+-------+ > | from_user | to_user | dummy | > +---------------------+------------------+-------+ > | user_a(a)example.com | test(a)example.com | 1 | > +---------------------+------------------+-------+ > > and the doveadm acl command: > > doveadm acl get -u user_a(a)example.com INBOX > ID > Global Rights > user=test(a)example.com > admin create delete expunge insert lookup post read write write-deleted > write-seen You have shared user_a's INBOX to test(a)example.com > doveadm acl get -u user_a(a)example.com INBOX.FOLDER_A > ID > Global Rights > user=test(a)example.com > admin create delete expunge insert lookup post read write write-deleted > write-seen > > doveadm acl get -u user_a(a)example.com INBOX.FOLDER_B > ID > Global Rights > user=test(a)example.com > admin create delete expunge insert lookup post read write write-deleted > write-seen > > doveadm acl get -u user_a(a)example.com INBOX.FOLDER_C > ID > Global Rights > user=test(a)example.com > admin create delete expunge insert lookup post read write write-deleted > write-seen > > Of course, user test(a)example.com can see all subfolder. Reading your post.. > I can set an dovecot-acl file in each subfolder to set the permission? Yes, remove all dovecot-acl files and add it into those folders you want to share. Or remove all dovecot-acl files and: doveadm acl add -u user_a(a)example.com INBOX.FOLDER_B \ user=test(a)example.com create read ... > > -----Messaggio originale----- > Da: dovecot [mailto:dovecot-bounces@dovecot.org] Per conto di Steffen Kaiser > Inviato: martedì 3 giugno 2014 15:45 > A: Dovecot Mailing List > Oggetto: Re: [Dovecot] Info about sharing mail folder > > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > On Tue, 3 Jun 2014, Gianluca Calloni wrote: > >> But i need to know if is possible for user_a(a)mydomain.com to share >> only 1 or >> 2 subfolder (E.g. .INBOX.FOLDER_A and .INBOX.FOLDER_B shared, >> .INBOX_FOLDER_C not shared) > > What's the dovecot-acl in .INBOX and the three directories mentioned above? > > Or: > > doveadm acl get -u user_a(a)mydomain.com INBOX > doveadm acl get -u user_a(a)mydomain.com INBOX.FOLDER_A > doveadm acl get -u user_a(a)mydomain.com INBOX.FOLDER_B > doveadm acl get -u user_a(a)mydomain.com INBOX.FOLDER_C > > Did you've share "INBOX" instead of the the subfolders A and B? > - -- Steffen Kaiser -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) iQEVAwUBU477Wnz1H7kL/d9rAQJQTgf+MF+++/j56SbuXae8wZismkJhL5Z1NNHF bd8i5JqMhpSzh4dPb7IhdzJySZ7T5zJgDviCvnscldLrlb9+wAQwx6aB+iw929R4 wdtgjEE0hAnZuMpyTPvCL8gwmL4B/kpbvXZIGJbmIVgkh6iBGorHRKbSxFjlUKQW 9ZuiUsAmX4UJslJDisScJuPT6uB93K/cdOoMCa5D8a9IacDYoP3nrhH1kn3K7IXo xCNId2YoeDqA3OWzp+NM8ahS6MYqIN432oYP1eViAmY0pTHdoWKMBmTeskGY2ajz FG7CSv1x6WeEyyzdE7dSth+j4nqQIh0hkIS6vQYMuMTLuwq/rJW4dA== =8fCy -----END PGP SIGNATURE-----

2 1

Re: [Dovecot] Odd ownership of the dovecot-uidlist file
by Bruce 04 Jun '14

04 Jun '14

Hi, Please see my responses below, On 04/06/14 01:35, dovecot-request(a)dovecot.org wrote: > Message: 4 > Date: Tue, 3 Jun 2014 09:33:48 +0200 (CEST) > From: Steffen Kaiser >> >Jun 3 11:38:51 brio dovecot: Dovecot postlogin.sh running as hamish@XXXXX >> >(/mnt/spool/keepers/h/XXXXX/hamish) userid = 7053 (7053) - uidlist = 26624 >> >Jun 3 11:38:51 brio dovecot: Dovecot for hamish@XXXXX finished, uidlist now = >> >26624 > who is user 26624? Is the uid valid at all? If it is invalid, are there > other files owned by this uid? Maybe only one of your NFS server has this > uid in its /etc/passwd? Is user "hamish" shared to another user somehow, > either via symlinks, ACLs, ...? UID 26624 is a valid user ('info' of domain14552) but under a compleltly different domain name (hamish is under domain25367). However that user has also not logged in around the time the ownership was changed. There is no relevance to the two users, except that they exist on the system and for some reason this issue happened to the hamish user. The NFS server does not know about the UIDs, it just provides the numeric IDs which is translated on the dovecot/exim servers by NSS and Dovecotr using the replicated MySQL database. Additionally both users have existed for some time and the databases are in sync. Customers also do not have any access to the file system so there will be no symlinks in place. Its also not a single server that we are seeing the issue on, it maybe one Dovecot server accessing one NFS server. Then the next time its a different Dovecot server accessing a different NFS server. >> >the logs for that time which is abnormal (a whole bunch of other logins from >> >other customers but nothing from those two users and no errors) > What about cron jobs, message delivery, backups, ... anything that > possibly can alter that file. I don't think, it's a Dovecot issue, unless > the uid 26624 is valid and hamish is shared with that user. Nothing besides Courier being replaced by Dovecot has changed in the server setup (although I could be wrong there, but we are going through one component at a time and until this issue is resolved we are not moving onto the next), and the only file which is being modified is a file which only Dovecot maintains. There are hourly backups which do an rsync to another server in case of hardware failure, there are scripts which move mailboxes between NFS servers but they show up in logs. Exim has no need to touch a dovecot controlled file, and when it writes mail into the maildir its writing as the correct user. It also seem odd that one login is fine then randomly the next login the file ownership has changed, nothing happens in between the two logins which are in some cases only 5 to 10 minutes apart. All I am really looking for is ideas on where to look, as it seems odd that nobody else is reporting this, and since its a reasonably new setup its possibly something we have done in the config (which I posted in my first email). Is there a reliable way to run a script directly when a dovecot session starts and finishes so we could output the ownership before and after which may also help eliminate the session itself. Cheers, Bruce

3 3

Re: [Dovecot] dovecot shared folder
by Mihai Badici 04 Jun '14

04 Jun '14

I think I broke the thread. It was a follow up of this post from May 12: >I try to create a shared directory in dovecot. When accessing ( from >roundcube) i can't subscribe or list the namespace. It looks like I don't >have rights. >This is an extract from debug log: When I try to create a new folder in >"Public" (i don't have rights, but i can try) loooks like the process crash: >May 12 23:10:07 imap: Debug: Module loaded: >/usr/lib/dovecot/lib01_acl_plugin.so May 12 23:10:07 imap: Debug: Module loy >12 23:10:07 imap(Mihai.*Badici*): Debug: acl vfile: file /etc/dovecot/dovecot- >acl//.DEFAULT not found May 12 23:10:07 imap(Mihai.*Badici*): Debug: acl vfile: >reading file /home/dovecot/public/dovecot-acl May 12 23:10:07 >imap(Mihai.*Badici*): Fatal: master: service(imap): child 5013 killed with >signal 11 (core dumps disabled) On Tuesday 13 May 2014 22:12:38 you wrote: > On Tuesday 13 May 2014 15:53:55 you wrote: > > On 13.5.2014, at 10.21, Mihai Badici <mihai(a)badici.ro> wrote: > > > I try to create a shared directory in dovecot. > > > When accessing ( from roundcube) i can't subscribe or list the > > > namespace. > > > It looks like I don't have rights. > > > > > > This is an extract from debug log: > > > When I try to create a new folder in "Public" (i don't have rights, but > > > i > > > can > > > > > try) loooks like the process crash: > > .. > > > > > May 12 23:10:07 imap(Mihai.Badici): Fatal: master: service(imap): child > > > 5013 killed with signal 11 (core dumps disabled) > > > > Yep. Can you get gdb backtrace? http://dovecot.org/bugreport.html > > I have this: > (gdb) core /home/dovecot/private/Mihai.Badici/core > [New LWP 1186] > Failed to read a valid object file image from memory. > Core was generated by `dovecot/imap'. > Program terminated with signal 11, Segmentation fault. > #0 0xb756b4b3 in ?? () -- Mihai Bădici http://mihai.badici.ro

1 0

[Dovecot] empty emails with 2.2.13/pigeonhole
by Cor Bosman 04 Jun '14

04 Jun '14

I recently upgraded from 2.2.10 to 2.2.13, and also upgraded pigeonhole. Ever since im seeing some empty emails appear in my inbox. Return-Path: <cricket(a)stats2.xs4all.net> Delivered-To: <cor> Received: from imapdirector1.xs4all.net ([194.109.26.173]) by userimap9.xs4all.nl (Dovecot) with LMTP id CHu0MUDDjlOBdwAAwvsqNQ for <cor>; Wed, 04 Jun 2014 08:57:04 +0200 Thats all this mail contains. This only happens using LMTP/Sieve, and with many different senders/recipients. Debug log shows nothing out of the ordinary, except that the mail seems to be corrupted by the time it hits sieve. It's very hard to diagnose. Our path is kind of lengthy, and in theory it could happen everywhere. Mail first arrives on incoming MX server which is sendmail. From there it's sent to a dovecot director using lmtp, which sends it to a server that does final delivery with sieve. Im not sure where the email gets corrupted. Any extra debugging I could turn on? Two extra things to note. So far it seems to only happen to emails that would have hit a matching sieve filter rule. I have asked a dozen people to verify this, and all emails would have matched a filter if all was well. Instead, it gets dropped into the inbox because pigeonhole seems to be working with the corrupt file and cant match any rules anymore. And second, 99% of our email is handled differently, from the sendmail server directly into a local mailer, and that never causes issues. We're in the process of switching to lmtp. Any insights? cor

3 2

[Dovecot] /etc/passwd userdb and long usernames
by Nicolás Reynolds 04 Jun '14

04 Jun '14

hi! i've configured dovecot to lookup usernames in /etc/passwd and it's working ok but it's having some problems retrieving info when the username is longer than 32 chars (i know it isn't recommended but everything seemed to work ok except for the hardcoded limit in useradd...) i found this on logs showing extra characters on the home field: http://pastie.org/pastes/9257902/text?key=vsxstofu3rf5wum4aic5va is there a limit on username length? i "solved" it by setting auth_username_format = %0.30u -- http://partidopirata.com.ar

1 0

Re: [Dovecot] dovecot shared folder
by Mihai Badici 04 Jun '14

04 Jun '14

On Wednesday 14 May 2014 08:31:57 you wrote: > On Wednesday 14 May 2014 01:02:28 you wrote: > Finally i found time to build another machine and try to debug : I found my slackbuild stripped the debug symbols so i made some changes and : Program terminated with signal SIGSEGV, Segmentation fault. #0 0x00007f06319e9ffc in acl_mailbox_get_aclobj (box=0x18f3140) at acl- mailbox.c:31 31 return abox->aclobj; (gdb) bt full #0 0x00007f06319e9ffc in acl_mailbox_get_aclobj (box=0x18f3140) at acl- mailbox.c:31 abox = 0x0 #1 0x00007f06317d7599 in cmd_myrights (cmd=0x18eefd0) at imap-acl- plugin.c:331 ns = 0x18ec480 box = 0x18f3140 mailbox = 0x18cd2a8 "Public" orig_mailbox = 0x18d8bd0 "Public" rights = 0x18d5cb8 str = 0x7f0631e2e708 <bsearch+88> #2 0x000000000041c947 in command_exec (cmd=0x18eefd0) at imap-commands.c:158 hook = 0x18d60e0 ret = false #3 0x000000000041b828 in client_command_input (cmd=0x18eefd0) at imap- client.c:778 client = 0x18ee3d0 command = 0x7fffbea4e480 __FUNCTION__ = "client_command_input" #4 0x000000000041bb3c in client_command_input (cmd=0x18eefd0) at imap- client.c:839 client = 0x18ee3d0 command = 0x18d5cb8 __FUNCTION__ = "client_command_input" #5 0x000000000041bc5c in client_handle_next_command (client=0x18ee3d0, remove_io_r=0x7fffbea4e50d) at imap-client.c:877 No locals. #6 0x000000000041bce3 in client_handle_input (client=0x18ee3d0) at imap- client.c:889 _data_stack_cur_id = 3 ret = false remove_io = false handled_commands = false __FUNCTION__ = "client_handle_input" #7 0x000000000041be80 in client_input (client=0x18ee3d0) at imap-client.c:931 cmd = 0x18e2cb8 output = 0x18eee10 bytes = 23 __FUNCTION__ = "client_input" #8 0x00007f063225b5d4 in io_loop_call_io (io=0x18eeee0) at ioloop.c:441 ioloop = 0x18d5730 t_id = 2 __FUNCTION__ = "io_loop_call_io" #9 0x00007f063225d580 in io_loop_handler_run_internal (ioloop=0x18d5730) at ioloop-epoll.c:220 ctx = 0x18d63c0 events = 0x18d7230 event = 0x18d7230 list = 0x18d7e20 io = 0x18eeee0 ---Type <return> to continue, or q <return> to quit--- tv = {tv_sec = 1799, tv_usec = 998998} events_count = 5 msecs = 1799999 ret = 1 i = 0 j = 0 call = true __FUNCTION__ = "io_loop_handler_run_internal" #10 0x00007f063225b76e in io_loop_handler_run (ioloop=0x18d5730) at ioloop.c:488 No locals. #11 0x00007f063225b6c8 in io_loop_run (ioloop=0x18d5730) at ioloop.c:465 __FUNCTION__ = "io_loop_run" #12 0x00007f06321e8258 in master_service_run (service=0x18d55c0, callback=0x4292eb <client_connected>) at master-service.c:566 No locals. #13 0x0000000000429652 in main (argc=1, argv=0x18d5390) at main.c:400 set_roots = {0x63a260 <imap_setting_parser_info>, 0x0} login_set = {auth_socket_path = 0x18cd050 "\210Ð\214\001", postlogin_socket_path = 0x0, postlogin_timeout_secs = 60, callback = 0x42909f <login_client_connected>, failure_callback = 0x429275 <login_client_failed>, request_auth_token = 1} service_flags = MASTER_SERVICE_FLAG_KEEP_CONFIG_OPEN storage_service_flags = MAIL_STORAGE_SERVICE_FLAG_DISALLOW_ROOT username = 0x0 c = -1 (gdb)

1 1

[Dovecot] Dovecot + NFS + FreeBSD breakage ?
by Xavier Beaudouin 04 Jun '14

04 Jun '14

Hi, I am trying to update my old mails servers from dovecot 2.1.15 to 2.2.12 (freebsd ports) and upgrade to FreeBSD 10.0-P3. My mail storage are on NFS with index also. On 2.1.15 everything is ok, and in 10-mail.conf I have the good things to be added as wiki tell me (eg http://wiki2.dovecot.org/NFS) BUT, when I try a single connection like : $ telnet ::1 110 Trying ::1... Connected to localhost. Escape character is '^]'. +OK Dovecot ready. user test@domain +OK pass thebloodypass Connection closed by foreign host. Looking the log : Jun 4 10:09:10 mail03 dovecot: master: Dovecot v2.2.12 starting up for imap, pop3, lmtp Jun 4 10:09:20 mail03 dovecot: pop3-login: Login: user=<test@domain>, method=PLAIN, rip=::1, lip=::1, mpid=5540, secured, session=<7x47Jf76IQAAAAAAAAAAAAAAAAAAAAAB> Jun 4 10:09:20 mail03 dovecot: pop3(kiwi(a)oav.net): Fatal: nfs flush requires mail_fsync=always This is very strange since : # doveconf -n | grep -E 'sync|nfs' mail_fsync = always mail_nfs_index = yes mail_nfs_storage = yes So either there is some breakage somewhere or something that is buggy somewhere... Here is my doveconf -n : # 2.2.12: /usr/local/etc/dovecot/dovecot.conf # OS: FreeBSD 10.0-RELEASE-p3 amd64 auth_cache_size = 1 M auth_mechanisms = plain login digest-md5 cram-md5 auth_username_chars = abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ01234567890.-_@% auth_verbose = yes disable_plaintext_auth = no dotlock_use_excl = no lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes lmtp_rcpt_check_quota = yes lmtp_save_to_detail_mailbox = yes lock_method = dotlock mail_debug = yes mail_fsync = always mail_location = maildir:~/Maildir:INDEX=/index/%d/%1n/%n mail_nfs_index = yes mail_nfs_storage = yes mail_plugins = quota trash mail_log notify zlib fts fts_lucene mailbox_list_index = yes managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave mmap_disable = yes namespace inbox { inbox = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Sent { auto = subscribe special_use = \Sent } mailbox Trash { auto = subscribe special_use = \Trash } mailbox badh { auto = subscribe special_use = \Junk } mailbox spam { auto = subscribe special_use = \Junk } prefix = } passdb { args = /usr/local/etc/dovecot/dovecot-ldap.conf.ext driver = ldap } plugin { fts = lucene fts_lucene = whitespace_chars=@.+ mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename mail_log_fields = uid box msgid size quota = maildir quota_grace = 10%% quota_rule2 = Trash:storage=+10%% quota_rule3 = spam:storage=+20%% trash = /usr/local/etc/dovecot/dovecot-trash.conf zlib_save = bz2 zlib_save_level = 9 } service auth { unix_listener /var/spool/postfix/private/auth { group = wheel mode = 0666 user = postfix } } service lmtp { inet_listener lmtp { port = 24 } } ssl_ca = </usr/local/etc/CA/ca-bundle.pem ssl_cert = </usr/local/etc/CA/domain_chain.pem ssl_key = </usr/local/etc/CA/domain_chain.pem ssl_prefer_server_ciphers = yes submission_host = server:25 userdb { args = /usr/local/etc/dovecot/dovecot-ldap.conf.ext driver = ldap } verbose_proctitle = yes protocol lmtp { mail_plugins = quota trash mail_log notify zlib fts fts_lucene sieve } protocol lda { mail_plugins = quota trash mail_log notify zlib fts fts_lucene sieve } protocol imap { mail_plugins = quota trash mail_log notify zlib fts fts_lucene imap_quota imap_zlib } protocol pop3 { mail_plugins = quota trash mail_log notify zlib fts fts_lucene } NFS mounts on freebsd : 172.31.0.1:/vol/mail/data on /mail (nfs, noatime) 172.31.0.1:/vol/mail/index/tmp on /index (nfs, noatime) NFS server is also a FreeBSD (with ZFS). I can give ssh accesss to this box. Regards, Xavier

1 1