October 2008 - dovecot

[Dovecot] mixed client ssl certs and non cert
by Harondel J. Sibble 23 Oct '08

23 Oct '08

How do I setup mixed authentication so that I can have say a couple of machines on my lan only use ssl without client certs, but have all the other machines connecting from remotely required to have ssl certs to connect to imap? This is with Dovecot 1.1.4 on CentOS 5.2 -- Harondel J. Sibble Sibble Computer Consulting Creating Solutions for the small and medium business computer user. help(a)pdscc.com (use pgp keyid 0x3AD5C11D) http://www.pdscc.com (604) 739-3709 (voice/fax) (604) 686-2253 (pager)

2 1

[Dovecot] logging IMAP username rather than UNIX username
by Dale Gallagher 23 Oct '08

23 Oct '08

Hi there I'd like to change my setup to log the _actual_ IMAP user's login, rather than the UNIX username. My system uses a virtual uid setup with qmail, where the mailboxes are owned by the 'vmail' user and authentication is via checkpassword using user%domain (ie email, just with % instead of @). So dovecot is recording _all_ logins as: imap-login: Login: user=<vmail>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, secured I have the following log format specified: login_log_format_elements = user=<%u> method=%m rip=%r lip=%l %c I have also tried: login_log_format_elements = user=<%n@%d> method=%m rip=%r lip=%l %c However, this results in a log file entry of: imap-login: Login: user=<vmail@>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, secured How do I configure dovecot to log the _actual_ username which the client supplies during authentication? Thanks Dale

2 3

[Dovecot] Dovecot returns the same UIDL for another message
by Alexander Shikoff 23 Oct '08

23 Oct '08

Hello, I have a serious problem with dovecot and mbox format. dovecot returns the same UIDL for new messages and as result some MUAs don't retrieve new mail. UIDs returned by UIDL command look like 000000*1c*49006cec And there is a moment when dovecot stops incrementing marked digits. In other words when new message arrive to mbox, UIDL command returns used UID. I'll show with example: 1. Send some message and try to retrieve UIDL via telnet: # echo test-mailbox-1 | mail -s Test-1 mbox(a)cu.kiev.ua # telnet pop3.cu.kiev.ua 10110 Trying 193.108.130.4... Connected to emx.itcons.net.ua. Escape character is '^]'. +OK IT Consulting POP3/IMAP Server USER mbox(a)cu.kiev.ua +OK PASS XXX +OK Logged in. LIST +OK 1 messages: 1 1155 . UIDL +OK 1 0000001c49006cec . RETR 1 +OK 1155 octets [...] . DELE 1 +OK Marked to be deleted. QUIT +OK Logging out, messages deleted. Connection closed by foreign host. 2. Send another message and try to retrieve UIDL via telnet: # echo test-mailbox-1 | mail -s Test-1 mbox(a)cu.kiev.ua # telnet pop3.cu.kiev.ua 10110 Trying 193.108.130.4... Connected to emx.itcons.net.ua. Escape character is '^]'. +OK IT Consulting POP3/IMAP Server USER mbox(a)cu.kiev.ua +OK pass XXX +OK Logged in. UIDL +OK 1 0000001c49006cec . QUIT +OK Logging out. Connection closed by foreign host. My dovecot's version is 1.1.3. # 1.1.3: /usr/local/etc/dovecot.conf base_dir: /var/run/dovecot/ protocols: pop3 listen: *:10110 ssl_disable: yes disable_plaintext_auth: no shutdown_clients: no login_dir: /var/run/dovecot/login login_executable: /usr/local/libexec/dovecot/pop3-login login_greeting: IT Consulting POP3/IMAP Server login_processes_count: 64 verbose_proctitle: yes first_valid_uid: 26 last_valid_uid: 26 first_valid_gid: 6 last_valid_gid: 6 mail_privileged_group: mail mail_location: mbox:/var/mail:INBOX=/var/mail/%Ln:INDEX=MEMORY maildir_copy_preserve_filename: yes mail_executable: /usr/local/libexec/dovecot/pop3 mail_plugins: quota mail_plugin_dir: /usr/local/lib/dovecot/pop3 pop3_client_workarounds: outlook-no-nuls oe-ns-eoh auth default: passdb: driver: sql args: /usr/local/etc/dovecot/passdb.sql userdb: driver: sql args: /usr/local/etc/dovecot/mailbox.sql userdb: driver: sql args: /usr/local/etc/dovecot/maildir.sql plugin: quota: maildir -- MINO-RIPE

3 4

[Dovecot] ManageSieve textual fronend wanted
by Edgar Fuß 23 Oct '08

23 Oct '08

Is there some simple textual frontend to the ManageSieve protocol somewhat easier to use than gnutls-cli? I.e. something to use like managesieve -u ef putscript myscript < /tmp/myscript Password: managesieve -u ef setactive myscript Password: simply doing the TLS authentication and length computation for me.

3 2

[Dovecot] dovecot 1.0 to 1.1 upgrade and filesystem separators
by Ian Thurlbeck 23 Oct '08

23 Oct '08

Dear All I have a test system where I am trying out 1.1.4 On the old 1.0rc6 (!) system I had edited: src/lib-storage/index/maildir/mail-storage.h to change: #define MAILDIR_FS_SEP ';' #define MAILDIR_FS_SEP_S ";" so I can get some mail folder hierarchy and '.'s in folder names - this all worked perfectly. Under 1.1.4 the MAILDIR_FS_SEP lines are no longer present. What is the current practice for doing what I was doing before ? Many thanks! Ian -- Ian Thurlbeck http://www.stams.strath.ac.uk/ Statistics and Modelling Science, University of Strathclyde Livingstone Tower, 26 Richmond Street, Glasgow, UK, G1 1XH Tel: +44 (0)141 548 3667 Fax: +44 (0)141 552 2079 The University of Strathclyde is a charitable body, registered in Scotland, number SC015263.

2 2

Re: [Dovecot] Panic 1.1.4
by Timo Sirainen 23 Oct '08

23 Oct '08

On Wed, 2008-10-15 at 08:35 +0200, Andre Hübner wrote: > Hi, > > > oops, sorry, I meant actually: > > > fr 6 > > p *stream.parent > > p *stream.parent.real_stream > > No, problem. i have enough cores ;) So it happens regularly? Can you reproduce it? I can't really see how it's crashing. Could you apply the attached patch, and also compile the lib/*.c and lib-mail/istream-header-filter.c without -O2 so the backtrace will be more usable? (I usually do it by removing -O2 from the subdirs' Makefile and then make clean + make in those subdirs.)

2 1

Re: [Dovecot] displaying IMAP folders that are in ~/mail/ at same level as inbox
by David London 23 Oct '08

23 Oct '08

> El Miércoles, 22 de Octubre de 2008 a las 04:04, David London escribió: >> Thanks Laurent (and Charles re the age of the dovecot software), >> >> It looks like we've got what you say is needed (see configuration file >> below). In addition the test accounts are brand new ones on the test >> system, not ones that have been moved over so .mailboxlist is not there - >> just .subscriptions >> >> Maybe what I'm trying to do is just not possible ... > > You can get it in the client. For example, in thunderbird, in Server > settings->advanced should be something like "IMAP server directory" (I'm > using an spanish version of thunderbird, so don't know the exact english name > for the option). Similar options exists for other clients. > > HTH. > -- > Joseba Torre. CIDIR Bizkaia. Thanks Jose, Yes in the advanced options on email clients there is always a place to put the root folder path or (some similar name) and on the old server I used ~/mail/ in all of the email clients (thunderbird, outlook, seamonkey etc) and that worked fine. Doing that on the new dovecot based server produces the effect I've described - a folder called mail visible at the same level as inbox and the other IMAP folders inside that. On the older imapd based server doing the same thing produced a view of inbox with no mail folder ... just the IMAP folders in it displayed at the same level as inbox. Regards, David _________________________________________________________________

1 0

[Dovecot] mail_location & NFS mounted home dirs
by Roger Hale 23 Oct '08

23 Oct '08

Hi, I'm fairly new to Dovecot, migrating from a POP-only system with /var/mail only mailboxes. I'm currently on version 1.0.10 on Solaris 10, but I don't think that's relevant to the question. I'm a little overwhelmed by the number of configuration options at the moment. I took the "standard" mail_location = mbox:~/mail:INBOX=/var/mail/%u setting in dovecot.conf. This mostly works fine, but home dirs are NFS mounted and in the event that an NFS server is down users cannot read their mail. This is the case even for users who only use POP. So, my question is, do folks on this list have good suggestions for optimum ways to deal with this so that users (perhaps only POP users) can read their mail independent of home directories being available? I think I can make something up, but I'd rather take a standard approach if there is one. If this has already been discussed I apologise - just point me to it as I didn't find it. Thx, Roger _________________________________________________________________ X Factor: latest video, features and more. Click here! http://clk.atdmt.com/GBL/go/115454063/direct/01/

1 0

[Dovecot] dovecot-deliver occasionally fails to deliver, leaving no clues
by Lucas Madar 22 Oct '08

22 Oct '08

Hello, I have a FreeBSD 7.1 x86 system using dovecot with postfix and a mysql user database. Everything works completely fine, except that on occasion dovecot-deliver fails. When postfix tries to redeliver the message in about 15 minutes, it succeeds. So this isn't a very big problem, just an annoying puzzle. Here's the postfix log. At first, I thought it could be a postfix delivery problem. Oct 17 00:36:22 xxxxxxx postfix/pipe[16017]: 41E581CC5B: to=<xxxx(a)xxxxx.xxx >, relay=dovecot, delay=0.04, delays=0. 01/0/0/0.03, dsn=4.3.0, status=deferred (temporary failure) I turned on delivery logging to see what I'd get, and I simply get this: deliver(xxxxxx(a)xxxxx.xxx): Oct 17 00:36:22 Info: Loading modules from directory: /usr/local/lib/dovecot/lda deliver(xxxxxx(a)xxxxx.xxx): Oct 17 00:36:22 Info: Module loaded: /usr/ local/lib/dovecot/lda/lib90_cmusieve_plugin.so (normally, here it would print out more info about the user, as "auth input" lines, but it doesn't when it fails in this way) Dovecot is not dumping core, or even printing out any error message that I can see. I have all logging turned on (except for passwords), and I still seem to get nothing. I've attached my dovecot -n output, which doesn't seem to contain the logging I have set up for deliver: log_path = /var/log/delivery.log info_log_path = /var/log/delivery.log mail_debug = yes auth_debug = yes auth_verbose = yes Any clue as to what could be going on here? Thanks, Lucas

2 8

[Dovecot] dovecot and postfix with tls and dovecot sasl issues for smtp clients
by Harondel J. Sibble 22 Oct '08

22 Oct '08

This issue is peripherally related to the following thread Re: [Dovecot] client certs with godaddy ssl cert This is running on CentOS 5.2 with latest Atrpms for Dovecot as of this weekend. # rpm -qa | grep dovecot dovecot-sieve-1.1.5-8.el5 dovecot-1.1.4-0_81.el5 With assistance from Rainer Frey (Inxmail GmbH), I am able to successfully use client ssl certs for imap access on both my Nokia e61i and Thunderbird 2.0.0.17, problem now is dovecot sasl and postfix smtp authentication. Using the same self created CA that generates and certifies the ssl client certs in Postfix and using Dovecot SASL, I always get client didn't send proper ssl cert when trying to do a tls based smtp connection from either the e61i or tbird. Cranking up the peer debug level in Postfix, I see the connection is always rejected by Dovecot SASL eg Oct 21 16:39:07 myserver postfix/smtpd[18189]: vstream_buf_get_ready: fd 15 got 45 Oct 21 16:39:07 myserver postfix/smtpd[18189]: < mycomp.myserver.net[10.11.12.5]: AUTH PLAIN ********************************************= Oct 21 16:39:07 myserver postfix/smtpd[18189]: xsasl_dovecot_server_first: sasl_method PLAIN, init_response **************************************== Oct 21 16:39:07 myserver postfix/smtpd[18189]: vstream_fflush_some: fd 16 flush 64 Oct 21 16:39:07 myserver postfix/smtpd[18189]: vstream_buf_get_ready: fd 16 got 58 Oct 21 16:39:07 myserver postfix/smtpd[18189]: xsasl_dovecot_handle_reply: auth reply: FAIL?1?reason=Client didn't present valid SSL certificate Oct 21 16:39:07 myserver postfix/smtpd[18189]: warning: mycomp.myserver.net[10.11.12.5]: SASL PLAIN authentication failed: Client didn't present valid SSL certificate Oct 21 16:39:07 myserver postfix/smtpd[18189]: > mycomp.myserver.net[10.11.12.5]: 535 5.7.0 Error: authentication failed: Client didn't present valid SSL certificate Oct 21 16:39:07 myserver postfix/smtpd[18189]: watchdog_pat: 0x868a570 Oct 21 16:39:07 myserver postfix/smtpd[18189]: vstream_fflush_some: fd 15 flush 85 Oct 21 16:39:07 myserver dovecot: auth(default): client in: AUTH 1 PLAIN service=smtp resp=*********************************************== Oct 21 16:39:07 myserver dovecot: auth(default): PLAIN(?): Client didn't present valid SSL certificate Oct 21 16:39:07 myserver dovecot: auth(default): client out: FAIL 1 reason=Client didn't present valid SSL certificate Oct 21 16:39:07 myserver postfix/smtpd[18189]: vstream_buf_get_ready: fd 15 got 12 Oct 21 16:39:07 myserver postfix/smtpd[18189]: < mycomp.myserver.net[10.11.12.5]: AUTH LOGIN Oct 21 16:39:07 myserver postfix/smtpd[18189]: xsasl_dovecot_server_first: sasl_method LOGIN Oct 21 16:39:07 myserver postfix/smtpd[18189]: vstream_fflush_some: fd 16 flush 26 Oct 21 16:39:07 myserver postfix/smtpd[18189]: vstream_buf_get_ready: fd 16 got 58 Oct 21 16:39:07 myserver postfix/smtpd[18189]: xsasl_dovecot_handle_reply: auth reply: FAIL?2?reason=Client didn't present valid SSL certificate Not sure where to look now, I've configured dovecot and postfix as per their respective wiki's Here are the relevant config entries /etc/postfix/main.cf ### Oct 11/08 - added to allow dovecot sasl for smtp auth smtpd_sasl_type = dovecot # Can be an absolute path, or relative to $queue_directory smtpd_sasl_path = private/auth # and the common settings to enable SASL: smtpd_sasl_auth_enable = yes smtpd_recipient_restrictions = permit_sasl_authenticated, reject_unauth_destination smtpd_sasl_security_options = noanonymous ### Oct 11/08 - added to allow tls smtp authentication with client certs smtpd_tls_auth_only = yes smtp_use_tls = yes smtpd_use_tls = yes smtp_tls_note_starttls_offer = yes smtpd_tls_loglevel = 2 smtpd_tls_received_header = yes smtpd_tls_session_cache_timeout = 3600s tls_random_source = dev:/dev/urandom myhostname = server.myserver.net ### these are the self signed CA based authentication keys, this CA created ### the client certs for the nokia e61i and the Thunderbird 2.0.0.17 smtpd_tls_key_file = /etc/postfix/ssl/server.myserver.net.key smtpd_tls_cert_file = /etc/postfix/ssl/server.myserver.net.crt ### this is the ca cert and crl combined smtpd_tls_CAfile = /etc/postfix/ssl/ca1.crt dovecot -n # 1.1.4: /etc/dovecot.conf protocols: imaps pop3s ssl_listen(default): *:993 ssl_listen(imap): *:993 ssl_listen(pop3): *:995 ssl_ca_file: /etc/openvpn/easy-rsa/keys/combined-ca-and-crl.crt ssl_cert_file: /etc/pki/dovecot/certs/dovecot-chained.cert ssl_key_file: /etc/pki/tls/private/server.myserver.net.key ssl_verify_client_cert: yes ssl_require_client_cert = yes verbose_ssl: yes login_dir: /var/run/dovecot/login login_executable(default): /usr/libexec/dovecot/imap-login login_executable(imap): /usr/libexec/dovecot/imap-login login_executable(pop3): /usr/libexec/dovecot/pop3-login mail_location: mbox:~/mail:INBOX=/var/spool/mail/%u:INDEX=~/mail/.imap/indexes mail_debug: yes mail_executable(default): /usr/libexec/dovecot/imap mail_executable(imap): /usr/libexec/dovecot/imap mail_executable(pop3): /usr/libexec/dovecot/pop3 mail_plugin_dir(default): /usr/lib/dovecot/imap mail_plugin_dir(imap): /usr/lib/dovecot/imap mail_plugin_dir(pop3): /usr/lib/dovecot/pop3 auth default: mechanisms: plain login debug: yes debug_passwords: yes ssl_require_client_cert: yes passdb: driver: pam userdb: driver: passwd socket: type: listen client: path: /var/spool/postfix/private/auth mode: 432 user: postfix group: postfix Interestingly enough the mode line in the dovecot.conf file is set as 0660, not 432 as noted above?!?!? What else should I be looking at to troubleshoot this issue? -- Harondel J. Sibble Sibble Computer Consulting Creating Solutions for the small and medium business computer user. help(a)pdscc.com (use pgp keyid 0x3AD5C11D) http://www.pdscc.com (604) 739-3709 (voice/fax) (604) 686-2253 (pager)

4 7