October 2006 - dovecot

[Dovecot] passdb checkpassword and lastauth
by Max A 18 Oct '06

18 Oct '06

Hi. If checkpassword interface is used for working with vpopmail, function vpopmail "Record time and ip of last auth attempt" (--enable-auth-logging option for configure) won't work - the file "lastauth" is created in Maildir, but does not contain ip-address. If I had correctly understood, dovecot woldn't have set a enviroment variable TCPREMOTEIP for vchkpw. If changes are made in auth/passdb-checkpassword.c (a patch in attachment), everything will work. Probably, the patch is incorrect and does not solve all problems, however the request is to pay attention to existence of the problem. Also it is possible, that a similar problem exists with other variables TCP UCSPI protocol (http://cr.yp.to/proto/ucspi-tcp.txt) P.S. If use the interface vpopmail instead of checkpassword, the file "lastauth" will not be created at all, that is a little bit inconvenient. ********************************** System: dovecot-1.0.rc10 vpopmail-5.4.17 ASP Linux Server II (RHEL3 clone) kernel 2.4.21-47.EL.aspsmp CPU architecture: x86 (IBM xSeries 336) Filesystem: ext3 ********************************** dovecot configuration: base_dir = /var/run/dovecot/ protocols = imap pop3 disable_plaintext_auth = no ssl_disable = yes login_greeting = Ready. first_valid_uid = 89 last_valid_uid = 89 first_valid_gid = 89 last_valid_gid = 89 protocol imap { listen = 81.26.136.8:144 mail_executable = /usr/local/libexec/dovecot/imap mail_plugins = quota imap_quota mail_plugin_dir = /usr/local/lib/dovecot/imap imap_client_workarounds = delay-newmail outlook-idle netscape-eoh tb-extra-mailbox-sep } protocol pop3 { listen = 81.26.136.8:112 login_executable = /usr/local/libexec/dovecot/pop3-login mail_executable = /usr/local/libexec/dovecot/pop3 pop3_uidl_format = %f mail_plugins = quota mail_plugin_dir = /usr/local/lib/dovecot/pop3 pop3_client_workarounds = outlook-no-nuls oe-ns-eoh } auth default { mechanisms = plain login passdb checkpassword { args = /var/qmail/vpopmail/bin/vchkpw } userdb prefetch { } user = root } dict { } plugin { quota = maildir } *************************************** dovecot configure options: ./configure \ --disable-ipv6 \ --prefix=/usr/local \ --sysconfdir=/etc/dovecot \ --without-passwd \ --without-passwd-file \ --without-shadow \ --without-pam \ --without-bsdauth \ --with-checkpassword \ --with-vpopmail \ --without-static-userdb \ --with-prefetch-userdb \ --without-sql \ --without-pgsql \ --without-mysql \ --without-sqlite \ --with-ssl=openssl \ --with-pop3d \ --without-deliver \ --with-storages=maildir \ --with-docs ***************************************** vpopmail configure options: ./configure \ --enable-auth-module=cdb \ --enable-logging=p \ --enable-md5-passwords \ --enable-make-seekable \ --enable-file-sync \ --enable-ip-alias-domains \ --enable-clear-passwd \ --disable-roaming-users \ --disable-learn-passwords \ --disable-passwd \ --enable-auth-logging diff -ur dovecot-1.0.rc10.orig/src/auth/passdb-checkpassword.c dovecot-1.0.rc10/src/auth/passdb-checkpassword.c --- dovecot-1.0.rc10.orig/src/auth/passdb-checkpassword.c 2006-08-22 06:37:56.000000000 +0400 +++ dovecot-1.0.rc10/src/auth/passdb-checkpassword.c 2006-10-17 16:47:09.000000000 +0400 @@ -226,6 +226,10 @@ env_put(t_strconcat("REMOTE_IP=", net_ip2addr(&request->remote_ip), NULL)); + env_put(t_strconcat("TCPREMOTEIP=", + net_ip2addr(&request->remote_ip), + NULL)); + } if (request->master_user != NULL) { env_put(t_strconcat("MASTER_USER=",

1 0

[Dovecot] 1.0.rc10 released
by Timo Sirainen 18 Oct '06

18 Oct '06

http://dovecot.org/releases/dovecot-1.0.rc10.tar.gz http://dovecot.org/releases/dovecot-1.0.rc10.tar.gz.sig I've finally read all the mails in the mailing list and in my INBOX. If I haven't replied to some of your mail, please resend it. Remember that since 1.0.rc9 release dovecot.index.cache files will get rebuilt in 64bit systems, and it's probably better to delete them manually so you don't get errors in log files. There are only a couple of issues left in my v1.0-TODO list: - Master process appears to be leaking log fds with kqueue. Could someone again give me access to a system where this happens? - Login process problems. How well does it work now? Hopefully well enough that v1.0 could be released. - LDAP authentication is leaking memory? Can anyone confirm this? Even better, can someone figure out what exactly is leaking? :) Not a v1.0 blocker though. I think v1.0 will be released once no-one has reported any major problems for a Dovecot release in 2-4 weeks. I think login process handling is the only potentially major problem left. There are a few patches from people that I haven't forgotten, but I've decided not to put them into v1.0 anymore: - Filesystem quota group. I don't think it's that important feature, and it might break something. - HFS+ hardlink avoiding - Managesieve - vmailmgr support And finally the changes in this release: * When matching allowed_nets IPs, convert IPv6-mapped-IPv4 addresses to actual IPv4 addresses first. + IMAP: Try to avoid sending duplicate/useless message flag updates + Added support for non-plaintext authentication for vpopmail if it returns plaintext passwords. Based on patch by Remi Gacogne. + Added %D modified to return "sub.domain.org" as "sub,dc=domain,dc=org" (for LDAP queries). Patch by Andrey Panin. - rc9 broke cache files in 64bit systems - deliver works now with mail_chroot - auth cache didn't work properly with multiple passdbs - Fixes to handling CRLF linefeeds in mboxes.

13 22

[Dovecot] autoconf check for ldap not linking with -lber
by Jorgen Lundman 18 Oct '06

18 Oct '06

Maybe not a big deal, but generally you (used to?) link against both: configure:31276: checking for ldap_init in -lldap configure:31311: gcc -o conftest -std=gnu99 -I/usr/local/include -Wall -W -Wmiss ing-prototypes -Wmissing-declarations -Wpointer-arith -Wchar-subscripts -Wformat =2 -Wbad-function-cast -I/usr/sfw/include -L/usr/local/lib conftest.c -lldap -lsocket -lnsl -lrt -lsendfile >&5 Undefined first referenced symbol in file ber_sockbuf_io_readahead /usr/local/lib/libldap.so ber_sockbuf_alloc /usr/local/lib/libldap.so ber_sockbuf_io_fd /usr/local/lib/libldap.so But could be special situation as my LDAP version is fixed, due to production environment using it. It also failed when OpenLDAP was linked against OpenSSL, since it does not try with the SSL libraries. Lund -- Jorgen Lundman | <lundman(a)lundman.net> Unix Administrator | +81 (0)3 -5456-2687 ext 1017 (work) Shibuya-ku, Tokyo | +81 (0)90-5578-8500 (cell) Japan | +81 (0)3 -3375-1767 (home)

2 3

[Dovecot] defunct processes
by LDB 18 Oct '06

18 Oct '06

I am using SuSE 10.1 and dovecot version 0.99.14-5. dovecot 6267 660 0 14:45 ? 00:00:00 imap-login dovecot 6285 660 0 14:45 ? 00:00:00 pop3-login dovecot 6371 660 0 14:45 ? 00:00:00 imap-login postfix 6454 12811 0 14:46 ? 00:00:00 smtp -t unix -u dovecot 6511 660 0 14:46 ? 00:00:00 pop3-login postfix 6550 12811 0 14:46 ? 00:00:00 showq -t unix -u dovecot 6576 660 0 14:46 ? 00:00:00 imap-login dovecot 6579 660 0 14:46 ? 00:00:00 pop3-login root 6580 666 1 14:46 ? 00:00:00 [dovecot-auth] <defunct> ldb 6581 660 0 14:46 ? 00:00:00 pop3 After dovecot has been up and running for a while (1 month or so), it tends to get hung up and unresponsive. I do a "ps" and I have a whole host of defunct processes. To restore service, I have to manually kill all dovecot processes and start it up again. Is this a symptom of my version or my configuration? Thanks, LDB

3 8

[Dovecot] Strange POP3 problem...
by Mike Cisar 18 Oct '06

18 Oct '06

I've been having this problem for a long time now. It started when I first began to use Dovecot (0.9x) and seems to have been occurring more and more frequently as we've progressed through the betas and now into RC7. I have been kind of chaulking it up to a "user issue" since the problem only seems to occur for one user (who has one machine at his office, and one at his weekend cabin... problem occurs with equal frequency on both of his machines). Lately it's been occurring about once every couple of days, but still nothing that I have been able to reproduce with any particular email or frequency. However as luck would have it the problem occurred today while I was onsite at the client's office so I was at least able to see that end of things at the same time. Essentially the user will have a number of messages in their mailbox (today for example 13) the download of mail will go just fine until one particular message and then the download will just stop, eventually returning an error message. Trying to receive mail again will retrieve messages 1-9 again and fail in the same spot. If you log in via IMAP and delete the following message (ie. the message after the one that was last received) you can then POP for mail again and the remaining messages in the mailbox will download. In the log all we see is the following (over and over)... Aug 28 16:14:51 mail dovecot: pop3-login: Login: user=<xxxxx>, method=PLAIN, rip=vvv.www.xxx.yyy, lip=vvv.www.xxx.yyy Aug 28 16:15:32 mail dovecot: POP3(xxxxx): Disconnected top=0/0, retr=9/170375, del=0/13, size=1349520 >From the client side I get the following in Outlook Express... "Your server has unexpectedly terminated the connection..." "...POP3, Server Response: '+OK 795 octets'..." Interestingly 795 bytes is the size of the "bad" email (the one that won't download). Any thoughts? Cheers, >>>>> Mike <<<<<

8 9

[Dovecot] Index files
by Steven F Siirila 17 Oct '06

17 Oct '06

I am doing some testing with Dovecot and wondered if it was normal for the deliver program to create index files for an Inbox (the test Inbox is over 7MB), but to not update the index files after the initial creation, even though messages continue to come into the mailbox. Note that during this testing, no IMAP or POP accesses are being made. Would it matter if a command-line program such as mutt were reading/updating the Inbox in question? Shouldn't Dovecot delivery be continually updating the index files as new messages arrive in the Inbox? -- Steven F. Siirila Office: Lind Hall, Room 130B Internet Services E-mail: sfs(a)umn.edu Office of Information Technology Voice: (612) 626-0244 University of Minnesota Fax: (612) 626-7593

2 4

[Dovecot] dovecot tpop3d UIDL mbox
by antencek＠volja.net 17 Oct '06

17 Oct '06

Hello All! I am new to this list so I hope I'm not in the wrong list with my question. First, I have to say that dovecot is (in my opinion) one of the best POP3/IMAP servers arround. I especialy like its' simplicity (configuration) and powerfullness (speed, auth mechs). In my production environment I would like to cange from tpop3d to dovecot, but I have only one little problem :). This is my situation: pop3 server: tpop3d mail fromat: mbox (/var/mail/username) UIDL: tpop3d UIDL format Since there are users who let mail on server, I need to keep UIDL. The problem is that the patch which gives dovecot the capability to replay with tpop3d UIDL format apparently works only on maildir mailboxes. Is there any resonable solution to my problem? TIA. Regards, Antencek

3 2

[Dovecot] allow_nets and mysql question
by Alex Samorukov 17 Oct '06

17 Oct '06

Hi. I want to use allow_nets in my configuration, but i have some troubles which i cant resolve. To use allow_nets i creates `allow_nets` text field in my mysql users table. My query is: from: dovecot/sql.conf: password_query = SELECT crypt as password, maildir as userdb_mail, 6 AS userdb_uid,6 AS userdb_gid, allow_nets FROM users WHERE id = '%u' from dovecot.conf: auth default { mechanisms = plain passdb sql { args = /usr/local/etc/dovecot/sql.conf } userdb prefetch { } user = root } To check this i added address 193.193.193.100/32 (which is not my address) and tried to connect from localhost (using telnet). And it allow me to connect! May be i did something wrong, but i cant explain this, so i`m asking for your help. Here is debug information: Dovecot v1.0.rc10 starting up auth-worker(default): mysql: Connected to localhost (maildb) auth(default): client in: AUTH 1 PLAIN service=POP3 secured lip=10.0.0.1 rip=10.0.0.1 resp=<hidden> auth-worker(default): sql(testuser(a)example.com,10.0.0.1): query: SELECT allow_nets,crypt as password, maildir as userdb_mail, 1005 AS userdb_uid,6 AS userdb_gid FROM users WHERE id = 'testuser(a)example.com' auth-worker(default): auth(testuser(a)example.com,10.0.0.1): allow_nets: Matching for network 193.193.193.100/32 auth-worker(default): passdb(testuser(a)example.com,10.0.0.1): allow_nets check failed: IP not in allowed networks auth(default): client out: OK 1 user=testuser(a)example.com auth(default): master in: REQUEST 1 65787 1 auth(default): master out: USER 1 testuser(a)example.com mail=/usr/local/vdomains/example.com/users/testuser/Maildir/ uid=1005 gid=6 pop3-login: Login: user=<testuser(a)example.com>, method=PLAIN, rip=10.0.0.1, lip=10.0.0.1, secured POP3(testuser(a)example.com): Effective uid=1005, gid=6 POP3(testuser(a)example.com): maildir: data=/usr/local/vdomains/example.com/users/testuser/Maildir/ POP3(testuser(a)example.com): maildir: root=/usr/local/vdomains/example.com/users/testuser/Maildir, index=/usr/local/vdomains/example.com/users/testuser/Maildir, control=, inbox= POP3(testuser(a)example.com): Disconnected: Logged out top=0/0, retr=0/0, del=0/7, size=1362269

2 3

[Dovecot] auth problem
by Lampa 17 Oct '06

17 Oct '06

hello, i new to list but i need little help. I need only imap (later pop3),i have own checkpassword and own user/password database. i'm using last version v1.0.rc10 But i have problem with auth, user is authorized but cannot login, here is log: dovecot: Oct 17 15:00:36 Info: Dovecot v1.0.rc10 starting up dovecot: Oct 17 15:00:40 Info: auth(default): client in: AUTH 1 PLAIN service=IMAP lip=10.0.0.1 rip=10.0.0.13 resp=AG1kdgBza29sYTY2Ng== dovecot: Oct 17 15:00:40 Info: auth(default): checkpassword(lampa,10.0.0.13): Executed: /usr/local/checklocalpwd/checkpassword.pl /usr/local/dovecot/bin/dovecot/checkpassword-reply dovecot: Oct 17 15:00:40 Info: auth(default): checkpassword(lampa,10.0.0.13): Received input: userdb_user=lampa userdb_home=/home/_mail/lampa userdb_uid=65534 userdb_gid=65534 dovecot: Oct 17 15:00:40 Info: auth(default): checkpassword(lampa,10.0.0.13): Received no input dovecot: Oct 17 15:00:40 Info: auth(default): checkpassword(lampa,10.0.0.13): exit_status=0 dovecot: Oct 17 15:00:40 Info: auth(default): client out: OK 1 user=lampa dovecot: Oct 17 15:00:40 Info: auth(default): master in: REQUEST 1 17950 1 dovecot: Oct 17 15:00:40 Info: auth(default): master out: USER 1 lampa user=lampa home=/home/_mail/lampa uid=65534 gid=65534 dovecot: Oct 17 15:00:40 Info: imap-login: Internal login failure: user=<lampa>, method=PLAIN, rip=10.0.0.13, lip=10.0.0.1 dovecot: Oct 17 15:00:40 Error: Logins with UID 65534 (user lampa) not permitted (see first_valid_uid in config file) i think that problem is that uid and gid is set to user nobody instead 508 and 502 (user lampa , end of message is passwd file) uid 65534 is user nobody (used in auth section in conf, if i set it to root everyhting is ok) this is my config: base_dir = /var/run/dovecot/ protocols = imap listen = 10.0.0.1 disable_plaintext_auth = no log_path = /var/log/dovecot/dovecot.log info_log_path = /var/log/dovecot/dovecot.info log_timestamp = "%b %d %H:%M:%S " ssl_disable = yes login_dir = /var/run/dovecot/login login_chroot = yes login_user = dovecot mail_debug = yes mail_log_prefix = "%Us(%u): " verbose_proctitle = yes first_valid_uid = 508 last_valid_uid = 508 first_valid_gid = 502 last_valid_gid = 502 protocol imap { login_executable = /usr/local/dovecot/bin/imap-login mail_executable = /usr/local/dovecot/bin/imap } auth_executable = /usr/local/dovecot/bin/dovecot-auth auth_verbose = yes auth_debug = yes auth_debug_passwords = yes auth default { mechanisms = plain passdb checkpassword { args = /usr/local/checklocalpwd/checkpassword.pl } userdb prefetch { } user = nobody } in file i must comment out chdir $home (program was unable to chdir) i think due to chroot /usr/local/checklocalpwd/checkpassword.pl: #!/usr/bin/perl use POSIX; use strict qw(vars); my $PASSWD_FILE = "/usr/local/qmail/control/passwd2"; %ENV=(); my($len, $buf); open (USER, "<&=3") || _exit(2); $len = read(USER, $buf, 512); close USER; _exit(2) if $len < 4; my($user, $pass) = split /\x00/, $buf; $user = lc $user; $buf = "\x00" x $len; my $cwd = getcwd; my ($passwd, $uid, $gid, $gcos, $home, $shell) = ""; open F, $PASSWD_FILE || _exit(111); while (<F>) { if (/^$user:/) { ($user, $passwd, $uid, $gid, $gcos, $home, $shell) = split(/:/); } } close F; _exit(2) unless $uid; if (crypt($pass, $passwd) ne $passwd) { _exit(1); } $ENV{USER} = $user; $ENV{UID} = $uid + 0; $ENV{HOME} = $home; $ENV{SHELL} = $shell; _exit(111) unless $ENV{UID}; #chdir $home || _exit(111); $) = $gid; $( = $gid; $> = $uid; $< = $uid; exec @ARGV; _exit(0); here is passwd/user file: lampa:HSExFJNuwlKvk:508:502::/home/_mail/lampa:/bin/false

1 0

Re: [Dovecot] File isn't in mbox format: /home/foo/mail/Trash
by Phil Roffe 17 Oct '06

17 Oct '06

> On Mon, 2006-10-16 at 05:40 -0500, James Lupolt wrote: >> > Hello, >> > >> > I'm seeing the following error on a server: >> > >> > File isn't in mbox format: /home/foo/mail/Trash >> > >> > The Trash file is full of the following at the beginning: >> > >> > ^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^ >> > >> > I've repaired the file several times, but this keeps happening. Would >> > any of you mind offering me some insight into what could be causing this >> > and how to fix it? >> > > This is a known problem with v0.99.x. The mbox code has been rewritten > in 1.0rc versions and it doesn't have this problem, so I'd just suggest > upgrading. We had a problem with this several months ago. The alarming aspect of the corruption is when it occurs at the beginning of an email (i.e. ^@^@^@From:...). Emails can be lost/appended to the bottom of the previous email. I've seen this problem several times on our deployment and tracked it down to what appears to be NFS locking issues. Are you storing mails on an NFS mounted filesystem? If so check the following... http://wiki.dovecot.org/NFS We're running dovecot-1.0 beta5 (admittedly not an rc version but >beta4 which is mentioned in the NFS wiki section) so I'm not sure the mbox rewrite from v0.99.x has fixed the problem. We had several applications accessing the mbox (Dovecot and Pine mainly). Reconfiguring Pine to use IMAP (using Dovecot) rather than write to the mbox directly appears to have fixed the problem and we have had no corruption for several months now. So, my question is am I wrong to assume NFS locking/corruption? Does anyone know if this is really a Dovecot or NFS issue? Phil

3 4