-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1

On Fri, 25 Oct 2013, Rusty Ross wrote:

Actually replication is working (mostly). Here are two issues at present:

Post you config: doveconf -n and references ext-files.

I see that the dovecot documentation states that %u expands to the user’s short name, but then why does the following in 10-mail.conf:

mail_location = maildir:/Library/Server/Mail/Data/mail/%u

...expand to the user’s GUID?

Maybe it's overriden by other settings, or by userdb, or ... .

Steffen Kaiser -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux)

iQEVAwUBUmoOPF3r2wJMiz2NAQK6fgf+IcsNKcO4E3ahsmklD2+vrF/aaWcv7ksA mZLYkQeC0003S5AXv49VZmT32cQsWaqNLLXBB+4VcS9Jfn9YvjmJcAxMDSyYm/pj tx1mtKMnaQ6XAUOIQLgtpp9XaVlF8L8TaNdOLEeXkVNWMaVYZYNk5JERlwnXyJiR YHtbNhnmBTz8/JPDqECjbn1hHtU5SfHqAZ3MQIpPAyWhvR7yMCX8TGS1JmeMWeBd Ij5+ZmmiGMpRfXYb7Bs/HKd3uslJAQqlfLG+20ULa086A5yJvuf1Ls/JZhZrpJG3 N1XM8ILjoVJDW0ZTc3tJja7tE3X48FmDRdvHocjPMI/x5fGiQab84Q== =HEP8 -----END PGP SIGNATURE-----

Ah, that’s beautiful, Mike. I didn’t realize that there was a directory of symlinks based on short names. That fixes that. Thank you.

(You don't you have any thoughts only getting replication to ignore the “submit” user, do you?)

Best, Rusty

On Oct 25, 2013, at 10:44 AM, Mike Abbott michael.abbott@apple.com wrote:

...

default_fields = home=/Library/Server/Mail/Data/mail/%u

Try:

default_fields = home=/Library/Server/Mail/Data/mail/users/%u

What (if anything) will disabling urlauth break in Apple’s world? I am assuming they took the trouble to implement it for a reason.

PS: I actually randomized the password for example purposes when I posted to the list. :)

Rusty

On Oct 25, 2013, at 11:05 AM, Mike Abbott michael.abbott@apple.com wrote:

...

(You don't you have any thoughts only getting replication to ignore the “submit” user, do you?)

Just remove it from your config and disable urlauth. That will also fix the security hole you opened when you sent your submit user's password to the list :).

On Oct 25, 2013, at 2:20 AM, Steffen Kaiser skdovecot@smail.inf.fh-brs.de wrote:

please post your configuration.

# doveconf -n # 2.2.5: /Library/Server/Mail/Config/dovecot/dovecot.conf # OS: Darwin 13.0.0 x86_64 hfs auth_mechanisms = cram-md5 plain login apop digest-md5 auth_realms = server1.rustytest.lan auth_socket_path = /var/run/dovecot/auth-userdb auth_username_format = %n debug_log_path = /Library/Logs/Mail/mail-debug.log default_internal_user = _dovecot default_login_user = _dovenull disable_plaintext_auth = no doveadm_password = secret doveadm_port = 12345 dsync_remote_cmd = ssh -l%{login} %{host} /Applications/Server.app/Contents/ServerRoot/usr/bin/doveadm dsync-server -u%u first_valid_gid = 6 first_valid_uid = 6 imap_id_log = * imap_id_send = "name" * "version" * imap_urlauth_submit_user = submit info_log_path = /Library/Logs/Mail/mail-info.log log_path = /Library/Logs/Mail/mail-err.log login_log_format_elements = user=<%u> method=%m rip=%r lip=%l mpid=%e %c mail_access_groups = mail mail_attribute_dict = file:/Library/Server/Mail/Data/attributes/attributes.dict mail_location = maildir:/Library/Server/Mail/Data/mail/%u mail_log_prefix = "%s(pid %p user %u): " mail_plugins = quota zlib acl fts fts_sk notify replication managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave mdbox_rotate_size = 200 M namespace acl-mailboxes { list = children location = maildir:/Library/Server/Mail/Data/mail/users/%%u:INDEX=/Library/Server/Mail/Data/mail/shared/%%u prefix = shared.%%u. separator = . subscriptions = no type = shared } namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } namespace list-archives { list = children location = maildir:/Library/Server/Mail/Data/listserver/messages/archive/lists/%%u:INDEX=/Library/Server/Mail/Data/listserver/messages/archive/shared/%%u prefix = archives.%%u. separator = . subscriptions = no type = shared } passdb { driver = od } passdb { args = /Library/Server/Mail/Config/dovecot/submit.passdb driver = passwd-file } plugin { acl = vfile:/Library/Server/Mail/Config/dovecot/global-acls:cache_secs=300 acl_shared_dict = file:/Library/Server/Mail/Data/shared/shared-mailboxes fts = sk mail_replica = remote:root@server2.rustytest.lan quota = maildir:User quota quota_warning = storage=100%% quota-exceeded %u sieve = /Library/Server/Mail/Data/rules/%u/dovecot.sieve sieve_dir = /Library/Server/Mail/Data/rules/%u stats_refresh = 30 secs stats_track_cmds = yes } postmaster_address = postmaster@server1.rustytest.lan protocols = imap pop3 lmtp sieve quota_full_tempfail = yes service aggregator { fifo_listener replication-notify-fifo { user = _dovecot } unix_listener replication-notify { user = _dovecot } } service auth { extra_groups = _keytabusers idle_kill = 15 mins unix_listener auth-userdb { user = _dovecot } } service dns_client { unix_listener dns-client { mode = 0600 } } service doveadm { inet_listener { port = 12345 } } service imap-login { inet_listener imap { port = 143 } inet_listener imaps { port = 993 ssl = yes } service_count = 0 } service imap { client_limit = 5 process_limit = 200 service_count = 0 } service indexer-worker { user = _dovecot } service lmtp { unix_listener lmtp { mode = 0600 } } service managesieve-login { inet_listener sieve { port = 4190 } } service pop3-login { inet_listener pop3 { port = 110 } inet_listener pop3s { port = 995 ssl = yes } } service pop3 { client_limit = 5 process_limit = 200 service_count = 0 } service quota-exceeded { executable = script /Applications/Server.app/Contents/ServerRoot/usr/libexec/dovecot/quota-exceeded.sh unix_listener quota-exceeded { group = mail mode = 0660 user = _dovecot } user = _dovecot } service quota-warning { executable = script /Applications/Server.app/Contents/ServerRoot/usr/libexec/dovecot/quota-warning.sh unix_listener quota-warning { group = mail mode = 0660 user = _dovecot } user = _dovecot } service replicator { process_min_avail = 1 unix_listener replicator-doveadm { mode = 0600 } } service stats { fifo_listener stats-mail { mode = 0600 user = _dovecot } } ssl = required ssl_ca =

# cat auth-od.conf.ext # Authentication using Open Directory. Included from 10-auth.conf. # # Version 2.2.x (AR14759611)

passdb { # OD cache refresh intervals. The positive cache TTL applies to # enabled accounts. The negative cache TTL applies to disabled # accounts. Nonexistent accounts are not cached. # arguments: args = pos_cache_ttl=3600 neg_cache_ttl=60 # use_getpwnam_ext=yes blocking=no driver = od }

userdb { # OD cache refresh intervals. The positive cache TTL applies to # enabled accounts. The negative cache TTL applies to disabled # accounts. Nonexistent accounts are not cached. # Set enforce_quotas to yes to deny message delivery and message # copying when user account has exceeded their quota. # Use global_quota to enable system wide quota. Individual # quotas override global quota. # additional args: pos_cache_ttl=3600 neg_cache_ttl=60 # luser_relay=<userid> enforce_quotas=no # use_getpwnam_ext=yes blocking=no driver = od args = partition=/Library/Server/Mail/Config/dovecot/partition_map.conf enforce_quotas=no default_fields = home=/Library/Server/Mail/Data/mail/B3E33468-AAC1-41A3-8E7E-B85012658884 }

# cat /Library/Server/Mail/Config/dovecot/submit.passdb submit:{PLAIN}AQ32W5sFMZ1RUWErZskeTt:214:6::/var/empty::

As a side note, Apple is apparently using “submit” for imap_urlauth_submit_user (see doveconf -n, above) but I personally have no idea what that settings does.

Rusty

On Oct 25, 2013, at 9:36 AM, Steffen Kaiser skdovecot@smail.inf.fh-brs.de wrote:

That's why doveadm user \* returns "submit" as user. That's an Apple (or however made your package of Dovecot) question then, IMHO.

Maybe. But assuming it’s there to stay (as per Apple), do you have any ideas about how to get the replication plugin to ignore it?

Rusty

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1

On Fri, 25 Oct 2013, Rusty Ross wrote:

ie:

home /Library/Server/Mail/Data/mail/10C94BF9-5CC4-4DDB-B0F0-5D23F22B2D9F mail maildir:/Library/Server/Mail/Data/mail/10C94BF9-5CC4-4DDB-B0F0-5D23F22B2D9F

instead of:

home /Library/Server/Mail/Data/mail/mary mail maildir:/Library/Server/Mail/Data/mail/10C94BF9-5CC4-4DDB-B0F0-5D23F22B2D9F

Sorry, but I have no experience with MacOSX server stuff. "od" seems to mean "OpenDirectory", which is some LDAP implementation. You probably find some od-dovecot-adapter/conf-file, like this http://wiki2.dovecot.org/AuthDatabase/LDAP/Userdb . The conf does not point to a specific conf file, so I cannot give no clues.

Steffen Kaiser -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux)

iQEVAwUBUmp2/13r2wJMiz2NAQKIfwf+Ko0CtNtubVwQpV+jDyYkv5A4Iy1kh4gY /4dNBxG9WTmr/6a84yrXHuhbr0ScnSMnv2xWnZHCAYc2NtpZ6Ba8XxG7kwJZ9WzA RcvAqzFFVbwSJSPQhqYNKbEn5iTIpSo5SJapAkldsEaX+Pyj7fiI6BcopfjAGlT9 7eeGbSxuuVmdZ2Zer+eC/hnHW+YHVW8bES7ojq5E5vYxlqVnDvm2d3HDNukSp/p+ cogz4hV3Bf3bENdx79EGXKgz08PiQpoig7bbr5jmEvWk4+nYmwYzqVQ6Q8SJ7Dx+ KfaS69LZ8c3IgvhhL9AVENNoIbhmQsytaxWWDSqdsIi/o1evAUy/eQ== =ORl0 -----END PGP SIGNATURE-----

On Oct 25, 2013, at 9:42 AM, Steffen Kaiser skdovecot@smail.inf.fh-brs.de wrote:

I'm pretty sure, that the od driver does return a "mail" field overriding the default mail_location setting. Therefore home=/Library/Server/Mail/Data/mail/%u gets not expanded.

I don’t believe this is true, since I manually added:

default_fields = home=/Library/Server/Mail/Data/mail/%u

to

userdb { args = partition=/Library/Server/Mail/Config/dovecot/partition_map.conf enforce_quotas=no default_fields = home=/Library/Server/Mail/Data/mail/%u driver = od }

Before I added it, home was empty:

# doveadm user 'mary' field value uid 214 gid 6 home mail maildir:/Library/Server/Mail/Data/mail/10C94BF9-5CC4-4DDB-B0F0-5D23F22B2D9F quota maildir:User quota:noenforcing quota_rule *:storage=0 mail_location maildir:/Library/Server/Mail/Data/mail/10C94BF9-5CC4-4DDB-B0F0-5D23F22B2D9F sieve /Library/Server/Mail/Data/rules/10C94BF9-5CC4-4DDB-B0F0-5D23F22B2D9F/dovecot.sieve sieve_dir /Library/Server/Mail/Data/rules/10C94BF9-5CC4-4DDB-B0F0-5D23F22B2D9F sieve_storage /Library/Server/Mail/Data/rules/10C94BF9-5CC4-4DDB-B0F0-5D23F22B2D9F

Rusty

On Oct 25, 2013, at 2:20 AM, Steffen Kaiser skdovecot@smail.inf.fh-brs.de wrote:

please post your configuration.

Sorry, my previous config email contains a typo. Please disregard the "cat auth-od.conf.ext” in that email.

This is the accurate one:

# cat auth-od.conf.ext # Authentication using Open Directory. Included from 10-auth.conf. # # Version 2.2.x (AR14759611)

passdb { # OD cache refresh intervals. The positive cache TTL applies to # enabled accounts. The negative cache TTL applies to disabled # accounts. Nonexistent accounts are not cached. # arguments: args = pos_cache_ttl=3600 neg_cache_ttl=60 # use_getpwnam_ext=yes blocking=no driver = od }

userdb { # OD cache refresh intervals. The positive cache TTL applies to # enabled accounts. The negative cache TTL applies to disabled # accounts. Nonexistent accounts are not cached. # Set enforce_quotas to yes to deny message delivery and message # copying when user account has exceeded their quota. # Use global_quota to enable system wide quota. Individual # quotas override global quota. # additional args: pos_cache_ttl=3600 neg_cache_ttl=60 # luser_relay=<userid> enforce_quotas=no # use_getpwnam_ext=yes blocking=no driver = od args = partition=/Library/Server/Mail/Config/dovecot/partition_map.conf enforce_quotas=no default_fields = home=/Library/Server/Mail/Data/mail/%u }