October 2006 - dovecot

[Dovecot] Authenticating dovecot against Active Directory using bsdauth and login_ldap
by Martin Croker 15 Oct '06

15 Oct '06

All, I'm working in a multi-platform environment where user accounts are already held in Active Directory. I'm been trying to setup dovecot to perform user authentication against Active Directory using ldap. My Environment is: Platform OpenBSD 3.9 Dovecot Version 1.0.rc7 Active Directory Windows 2003 The approach I've taken (being the only one I was able to make work) is to use login_ldap to perform bind authentication against Active Directory/LDAP and authenticate dovecot using bsdauth. As far as I can tell the dovecot ldap authentication module requires access to the encrypted password field to which Active Directory does not permit access. Simulated LDAP login fails and when debug is enabled writes the following to /var/log/maillog ==== /var/log/maillog ================ Oct 15 20:12:27 server dovecot: auth(default): client in: AUTH 1 PLAIN service=IMAP secured lip=127.0.0.1 rip=127.0.0.1 resp=***********************== Oct 15 20:12:27 server dovecot: auth(default): bsdauth(mcrokerx,127.0.0.1): invalid password field Oct 15 20:12:28 server dovecot: auth(default): client out: FAIL 1 user=mcrokerx Oct 15 20:12:38 server dovecot: imap-login: Aborted login: user=<mcrokerx>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, secured ======================================= It appears that the cause of these log messages are the following lines of code in src/auth/passdb-bsdauth.c ==== src/auth/passdb-bsdauth.c ======== 29 if (!IS_VALID_PASSWD(pw->pw_passwd)) { 30 auth_request_log_info(request, "bsdauth", 31 "invalid password field"); 32 callback(PASSDB_RESULT_USER_DISABLED, request); 33 return; 34 } ======================================= These lines seem to require that the pw structure contains the encrypted password in pw->pw_passwd. Where login_ldap is used against Active Directory the encrypted password is not available to bsdauth and instead pw->pw_passwd contains '*'. If auth_userokay is called independently it is however able to authenticate the user correctly, as such I wonder if the IS_VALID_PASSWD check is actually necessary. It could be that my entire approach is wrong in which case I'm happy to be put right; however it seems that lines 29-34 need modification to correctly support this behaviour of bsdauth. This is beyond my limited ability in c but temporarily removing these lines of code from passdb-bsdauth.c has enabled me to authenticate dovecot against login_ldap (and thereby against Active Directory). My config files are: ==== /etc/dovecot.conf ================ base_dir = /var/dovecot/ ssl_cert_file = /etc/ssl/certs/server.crt ssl_key_file = /etc/ssl/private/server.key disable_plaintext_auth = no login_dir = /var/dovecot/login login_user = _dovecot mmap_no_write = yes protocol imap { imap_client_workarounds = delay-newmail outlook-idle netscape-eoh tb-extra-mailbox-sep } protocol pop3 { pop3_uidl_format = %08Xu%08Xv pop3_client_workarounds = outlook-no-nuls oe-ns-eoh } auth default { mechanisms = plain passdb bsdauth { } userdb passwd-file { args = /etc/passwd } user = root } plugin { } ======================================= ==== /etc/login.conf (exert) ========== staff:\ :auth=-ldap:\ :x-ldap-server=10.0.0.23:\ :x-ldap-port=389:\ :x-ldap-noreferrals:\ :x-ldap-uscope=subtree:\ :x-ldap-basedn=dc=my,dc=domain,dc=co,dc=uk:\ :x-ldap-binddn=cn=UnixUser,cn=Users,dc=my,dc=domain,dc=co,dc=uk:\ :x-ldap-bindpw=mypassword:\ :x-ldap-filter=(&(objectClass=user)(mail=%u)):\ :datasize-cur=512M:\ :datasize-max=infinity:\ :maxproc-max=256:\ :maxproc-cur=128:\ :requirehome@:\ :tc=default: ======================================= Note: for login_ldap to work it is necessary that the user information (minus password) is replicated on the localhost. I've done this using a relatively inelegant script which for completeness is below. I guess adding some error checking would be a good idea. ==== ldapsync.ksh ===================== #!/bin/ksh ldapsearch -h 10.0.0.23 \ -D cn=UnixUser,cn=Users,dc=my,dc=domain,dc=co,dc=uk \ -b cn=Users,dc=my,dc=domain,dc=co,dc=uk \ -w mypassword \ -v \ -x "(objectClass=user)" | while read key value ; do if [ "$key" == name: ]; then ldap_name="$value" fi # User Mail field as Unix name - remove @my.domain.co.uk if necessary if [ "$key" == mail: ]; then ldap_mail=$( echo "$value" | sed 's/@.*//g' ) if ( id 2>/dev/null >/dev/null $ldap_mail ); then usermod -c "$ldap_name" -s osbin/nologin -g staff -L staff $ldap_mail else useradd -d /home/$ldap_mail -c "$ldap_name" -s /sbin/nologin -m -g staff -L staff $ldap_mail fi ldap_name="" ldap_mail="" fi done ======================================= Martin

2 1

[Dovecot] unknown dovecot error. imap or logging rate?
by OpenMacNews 15 Oct '06

15 Oct '06

hi, i've dovecot cvs 10branch installed on OSX 10.4.7. when i login from my MUA (in this example, Mulberry), functionally all looks OK. BUT, i *do* see one error in the log output, dovecot: Aug 27 20:43:25 Error: IMAP(testuser(a)mydomain.com): Sending log messages too fast, throttling.. Is this an imap error? or is it 'just' the error of logging too fast? if the latter, what to do about it? or, is the throttling normal behavior? the complete context follows: dovecot: Aug 27 20:43:25 Info: auth(default): client in: AUTH 1 PLAIN service=IMAP secured lip=10.0.0.6 rip=10.0.0.6 dovecot: Aug 27 20:43:25 Info: auth(default): client out: CONT 1 dovecot: Aug 27 20:43:25 Info: auth(default): client in: CONT<hidden> dovecot: Aug 27 20:43:25 Info: auth(default): client out: OK 1 user=testuser(a)mydomain.com quota=maildir:storage=4096 dovecot: Aug 27 20:43:25 Info: auth(default): master in: REQUEST 27335 1 dovecot: Aug 27 20:43:25 Info: auth(default): master out: USER 2 testuser(a)mydomain.com static uid=301 gid=301 home=/var/Mail/Dovecot/Domains/mydomain.com/Accounts/testuser nice=10 dovecot: Aug 27 20:43:25 Info: imap-login: Login: user=<testuser(a)mydomain.com>, method=PLAIN, rip=10.0.0.6, lip=10.0.0.6, TLS dovecot: Aug 27 20:43:25 Info: IMAP(testuser(a)mydomain.com): Effective uid=301, gid=301 dovecot: Aug 27 20:43:25 Info: IMAP(testuser(a)mydomain.com): Loading modules from directory: /usr/local/dovecot-plugins/imap dovecot: Aug 27 20:43:25 Info: IMAP(testuser(a)mydomain.com): Module loaded: /usr/local/dovecot-plugins/imap/lib01_quota_plugin.so dovecot: Aug 27 20:43:25 Info: IMAP(testuser(a)mydomain.com): Module loaded: /usr/local/dovecot-plugins/imap/lib02_imap_quota_plugin.so dovecot: Aug 27 20:43:25 Info: IMAP(testuser(a)mydomain.com): Namespace: type=private, prefix=Private/, sep=/, inbox=yes, hidden=no, subscriptions=no dovecot: Aug 27 20:43:25 Info: IMAP(testuser(a)mydomain.com): maildir: data=/var/Mail/Dovecot/Domains/mydomain.com/Accounts/testuser/Maildir:INDEX… dovecot: Aug 27 20:43:25 Info: IMAP(testuser(a)mydomain.com): maildir: root=/var/Mail/Dovecot/Domains/mydomain.com/Accounts/testuser/Maildir, index=/var/Mail/Dovecot/Indexes/mydomain.com/testuser, control=, inbox= dovecot: Aug 27 20:43:25 Info: IMAP(testuser(a)mydomain.com): Namespace: type=public, prefix=Public/, sep=/, inbox=no, hidden=no, subscriptions=no dovecot: Aug 27 20:43:25 Info: IMAP(testuser(a)mydomain.com): maildir: data=/var/Mail/Dovecot/Domains/mydomain.com/Public dovecot: Aug 27 20:43:25 Info: IMAP(testuser(a)mydomain.com): maildir: root=/var/Mail/Dovecot/Domains/mydomain.com/Public, index=/var/Mail/Dovecot/Domains/mydomain.com/Public, control=, inbox= dovecot: Aug 27 20:43:25 Info: IMAP(testuser(a)mydomain.com): Namespace: type=shared, prefix=Shared/, sep=/, inbox=no, hidden=no, subscriptions=no dovecot: Aug 27 20:43:25 Error: IMAP(testuser(a)mydomain.com): Sending log messages too fast, throttling.. dovecot: Aug 27 20:43:25 Info: IMAP(testuser(a)mydomain.com): maildir: data=/var/Mail/Dovecot/Domains/mydomain.com/Shared dovecot: Aug 27 20:43:26 Info: IMAP(testuser(a)mydomain.com): maildir: root=/var/Mail/Dovecot/Domains/mydomain.com/Shared, index=/var/Mail/Dovecot/Domains/mydomain.com/Shared, control=, inbox= thanks, richard -- /"\ \ / ASCII Ribbon Campaign X against HTML email, vCards / \ & micro$oft attachments [GPG] OpenMacNews at gmail dot com fingerprint: 50C9 1C46 2F8F DE42 2EDB D460 95F7 DDBD 3671 08C6

2 1

[Dovecot] Messages not expunged
by Jackie Hunt 15 Oct '06

15 Oct '06

Hi all, I'm doing some testing between U of Washington IMAP server (which we currently run) and Dovecot on a IBM AIX system. I created a 50M mailbox, made up of 262 msgs. I'm using a Perl Script with the imap::client module to fetch each message and then flag it for deletion. At the end of the test, I run an expunge to delete all the messages. UofW imap server ran fine, messages gone. With dovecot I found the messages were not being expunged. The log indicated they were, but then said 262 messages existed at the end. After more checking, I found the file system I was using was low on disk space (<50M). As soon as I added more disk space, and reran the test with dovecot the messages were indeed expunged. Is this normal imap protocol behavior? I thought I would see an error message or something in the dovecot log. Does dovecot duplicate the mailbox before expunge? There wasn't room on our system to do that. Thanks much for any insights/info. Jackie --- Jackie Hunt ACNS Voice: (970) 663-3789 Colorado State University FAX: (970) 491-1958 Fort Collins, CO 80523 Email: jackie.hunt(a)colostate.edu

2 3

[Dovecot] Make user name CaSe Insensitive
by FlashWebHost.com 15 Oct '06

15 Oct '06

Hi, I have mail box info(a)mydomain.com stored in MySQL db. But dovecot is allowing me to login as both INFO(a)MYDOMAIN.COM info(a)mydomain.com Shows two mail boxes. The small letter account is the one mail server really deliver all mails. Is there any way i can specify all login names are small letters, so that user always access real mail box ? Regards, Yujin ------------------------------------ http://www.flashwebhost.com

4 6

[Dovecot] Restricting Services (POP or IMAP)
by Odhiambo WASHINGTON 15 Oct '06

15 Oct '06

It would be great to have a HOWTO in the wiki, on how to restrict services by username in dovecot, so some users are allowed IMAP and others not allowed. As concerns restricting users by IP, I believe that is a bad idea. It's almost a useless idea, imnsho, because they can connect from another IP. It's easy to restrict services by IP using a firewall or by using inetd. -Wash http://www.netmeister.org/news/learn2quote.html DISCLAIMER: See http://www.wananchi.com/bms/terms.php -- +======================================================================+ |\ _,,,---,,_ | Odhiambo Washington <wash(a)wananchi.com> Zzz /,`.-'`' -. ;-;;,_ | Wananchi Online Ltd. www.wananchi.com |,4- ) )-,_. ,\ ( `'-'| Tel: +254 20 313985-9 +254 20 313922 '---''(_/--' `-'\_) | GSM: +254 722 743223 +254 733 744121 +======================================================================+ Don't take life too seriously -- you'll never get out of it alive.

5 8

Re: [Dovecot] Out of memory errors
by Bill Boebel 15 Oct '06

15 Oct '06

On Tue, October 10, 2006 1:03 pm, Timo Sirainen <tss(a)iki.fi> said: > I think I remember someone else also talking about memory leaks with > LDAP.. Unless it was also you. :) I guess I'll have to try find it, or > at least create some debugging/statistics patch which could be used to > figure out where the problem is.. > Wasn't me, but I would definitely run such a patch to help track down the source. Bill

2 1

[Dovecot] failed authentication with digest-md5 (rc9)
by LeVA 15 Oct '06

15 Oct '06

Hi! I'm using rc9 and DIGEST-MD5 passwords. Sometimes it works, sometimes it's not... When failed, I get this in the logs: 12:45:11 Info: auth(default): client in: AUTH 1 DIGEST-MD5 \ service=POP3 secured lip=<lip> rip=<rip> resp=<something_long> 12:45:11 Info: auth(default): client out: CONT 1 <something_long> 12:45:11 Info: auth(default): client in: CONT 1 <something_long> 12:45:11 Info: auth(default): digest-md5(?,<rip>): Unknown QoP value 12:45:12 Info: auth(default): client out: FAIL 1 12:45:12 Info: pop3-login: Aborted login: method=DIGEST-MD5, rip=<rip>, lip=<lip>, TLS Using KMail 1.9.4. Daniel -- LeVA

3 9

[Dovecot] Dovecot rc9 error (More information)
by Daniel 15 Oct '06

15 Oct '06

Hi This happens when email is copied/moved from the inbox to another folder on the same imap account. The mail client goes into a loop with the below errors logged. This is on a 64bit Linux machine using the Maildir storage format. After doing a 'rm dovecot*' from the Maildir folder of the account having the problem the client can log in again but if the client tries to copy again it gets the same error. RC9 appears to be broken on this box. I have tested connecting form a windows machine and I get the same with thunderbird. I have tried with different accounts and they get the same problem. I have down graded to RC8 and all is working OK so seems to be a problem introduced with RC9. I have a 32bit Linux server with RC9 installed which has around 2000 accounts on it and this has no problems so maybe not affecting 32bit machines. If I can give any more information please let me know. Am getting this error with Dovecot rc9 on a imap account. Oct 15 10:55:28 bajor dovecot: imap-login: Login: user=<rachele>, method=plain, rip=192.168.1.1, lip=192.168.1.254 Oct 15 10:55:28 bajor dovecot: IMAP(rachele): file mail-cache-transaction.c: line 709 (mail_cache_add): assertion failed: (fixed_size == (unsigned int)-1 || fixed_size == data_size) Oct 15 10:55:28 bajor dovecot: child 27632 (imap) killed with signal 6 Oct 15 10:55:28 bajor dovecot: imap-login: Login: user=<rachele>, method=plain, rip=192.168.1.1, lip=192.168.1.254 Oct 15 10:55:29 bajor dovecot: IMAP(rachele): file mail-cache-transaction.c: line 709 (mail_cache_add): assertion failed: (fixed_size == (unsigned int)-1 || fixed_size == data_size) Oct 15 10:55:29 bajor dovecot: child 27636 (imap) killed with signal 6 Oct 15 10:55:29 bajor dovecot: imap-login: Login: user=<rachele>, method=plain, rip=192.168.1.1, lip=192.168.1.254 Oct 15 10:55:29 bajor dovecot: IMAP(rachele): file mail-cache-transaction.c: line 709 (mail_cache_add): assertion failed: (fixed_size == (unsigned int)-1 || fixed_size == data_size) Oct 15 10:55:29 bajor dovecot: child 27638 (imap) killed with signal 6 Oct 15 10:55:30 bajor dovecot: imap-login: Login: user=<rachele>, method=plain, rip=192.168.1.1, lip=192.168.1.254 Oct 15 10:55:30 bajor dovecot: IMAP(rachele): file mail-cache-transaction.c: line 709 (mail_cache_add): assertion failed: (fixed_size == (unsigned int)-1 || fixed_size == data_size) Oct 15 10:55:30 bajor dovecot: child 27641 (imap) killed with signal 6 Oct 15 10:55:30 bajor dovecot: imap-login: Login: user=<rachele>, method=plain, rip=192.168.1.1, lip=192.168.1.254 Oct 15 10:55:31 bajor dovecot: IMAP(rachele): file mail-cache-transaction.c: line 709 (mail_cache_add): assertion failed: (fixed_size == (unsigned int)-1 || fixed_size == data_size) Oct 15 10:55:31 bajor dovecot: child 27645 (imap) killed with signal 6 Oct 15 10:55:31 bajor dovecot: imap-login: Login: user=<rachele>, method=plain, rip=192.168.1.1, lip=192.168.1.254 Oct 15 10:55:31 bajor dovecot: IMAP(rachele): file mail-cache-transaction.c: line 709 (mail_cache_add): assertion failed: (fixed_size == (unsigned int)-1 || fixed_size == data_size) Oct 15 10:55:31 bajor dovecot: child 27649 (imap) killed with signal 6 Oct 15 10:55:31 bajor dovecot: imap-login: Login: user=<rachele>, method=plain, rip=192.168.1.1, lip=192.168.1.254 Oct 15 10:55:32 bajor dovecot: IMAP(rachele): file mail-cache-transaction.c: line 709 (mail_cache_add): assertion failed: (fixed_size == (unsigned int)-1 || fixed_size == data_size) Oct 15 10:55:32 bajor dovecot: child 27653 (imap) killed with signal 6 -- Regards Daniel ----------------------------- Registered Linux user #234279

1 0

[Dovecot] request to have dovecot authenticator driver 'officially' included/supported
by OpenMacNews 14 Oct '06

14 Oct '06

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 hi all, per the exim docs @: http://exim.org/exim-html-4.62/doc/html/spec_html/ch36.html a cyrus_sasl authenticator driveer is 'included' in exim core. given that Dovecot has become a very attractive alternative for an increasing number of folks, and there's a patch against exim 4.43 here: http://www.exim.org/eximwiki/AuthenticatedSmtpUsingDovecot that allows use of Dovecot's native sasl implementation as an authenticator, and that is _seems_ to apply against 4.63 ok, might it be possible to get this integrated into exim core, and have it become 'official'? thanks, richard - -- /"\ \ / ASCII Ribbon Campaign X against HTML email, vCards / \ & micro$oft attachments [GPG] OpenMacNews at gmail dot com fingerprint: 50C9 1C46 2F8F DE42 2EDB D460 95F7 DDBD 3671 08C6 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (Darwin) iEYEARECAAYFAkUC+eIACgkQlffdvTZxCMbG4wCgnczsi9zX6Xkg5MLi6JTez5d+ a+YAn0MIYI7gHW//8N5bxani1CoEAcJm =ZN2w -----END PGP SIGNATURE-----

5 16

[Dovecot] MySQL stored proc authorization
by Chaos Engine 14 Oct '06

14 Oct '06

On my Gentoo box until today I had dovecot-1.0_rc7 and used following entry in /etc/dovecot/dovecot-sql.conf password_query = call Authorize('%u', '%n', '%d') Simply put dovecot is calling my mysql stored routine which handles authorization. Until today, when I updated dovecot to dovecot-1.0_rc8 it worked flawlessly. With this version executing stored proc dies with: Password query failed: PROCEDURE mailsql.Authorize can't return a result set in the given context Replacing stored proc call with select .... statement does the thing, but it's stored procedures are ... generally better to do things on DB imvho :-) Downgrading to dovetot-1.0_rc7 fixes the problem immediately. Of course /etc/dovecot/dovecot.conf remains the same in either case. Is this a bug or change made on purpose? -- Chaos greets U

2 6