June 2009 - dovecot - dovecot.org

[Dovecot] imaptest build problems
by Scott Haneda 27 Jul '09

27 Jul '09

I am not sure this is the correct list, please forgive if it is not, and point me in the right direction. I downloaded the latest http://www.imapwiki.org/ImapTest/Installation from http://dovecot.org/nightly/imaptest/imaptest-latest.tar.gz cd imaptest-20090401 $./configure checking for a BSD-compatible install... /usr/bin/install -c checking whether build environment is sane... configure: error: ls -t appears to fail. Make sure there is not a broken alias in your environment configure: error: newly created file is older than distributed files! Check your system clock Here is the config log http://dl.getdropbox.com/u/340087/Drops/05.28.09/config-4d3972ab-233922.log Some tests: $date Thu May 28 23:37:13 PDT 2009 $ls -lt total 2688 -rw-r--r--@ 1 me staff 4552 May 28 23:37 config.log drwxr-xr-x@ 28 me staff 952 May 28 23:33 src -rw-r--r--@ 1 me staff 27278 Mar 31 19:04 ChangeLog -rw-r--r--@ 1 me staff 1456 Mar 31 19:04 imaptest-config.h.in -rw-r--r--@ 1 me staff 19599 Mar 31 19:04 Makefile.in -rwxr-xr-x@ 1 me staff 671381 Mar 31 19:04 configure -rw-r--r--@ 1 me staff 262586 Mar 31 19:04 aclocal.m4 -rw-r--r--@ 1 me staff 925 Mar 31 19:04 configure.in -rw-r--r--@ 1 me staff 38 Jul 12 2008 AUTHORS -rw-r--r--@ 1 me staff 211 Jul 12 2008 COPYING -rw-r--r--@ 1 me staff 26536 Jul 12 2008 COPYING.LGPL -rw-r--r--@ 1 me staff 145 Jul 12 2008 Makefile.am -rw-r--r--@ 1 me staff 9498 Dec 2 2007 INSTALL -rwxr-xr-x@ 1 me staff 15936 Dec 2 2007 depcomp -rwxr-xr-x@ 1 me staff 9233 Dec 2 2007 install-sh -rwxr-xr-x@ 1 me staff 11014 Dec 2 2007 missing -rw-r--r--@ 1 me staff 0 Dec 2 2007 NEWS -rw-r--r--@ 1 me staff 0 Dec 2 2007 README -rw-r--r--@ 1 me staff 0 Dec 2 2007 stamp.h.in -rwxr-xr-x@ 1 me staff 42037 Jan 7 2007 config.guess -rwxr-xr-x@ 1 me staff 30253 Jan 7 2007 config.sub -rw-r--r--@ 1 me staff 198422 Jan 7 2007 ltmain.sh -- Scott * If you contact me off list replace talklists@ with scott@ *

2 5

[Dovecot] Problems with ioloop on MacOS
by David Abrahams 27 Jul '09

27 Jul '09

I've been using the macports version of dovecot, which is 1.1.11, on MacOS 10.5.6 $ /opt/local/sbin/dovecot --exec-mail imap Fatal: kevent(EV_ADD, 0) failed: Operation not supported This version is configured --with-ioloop=kqueue The problem seems to be known, if not understood: http://lists.apple.com/archives/Darwin-userlevel/2008/Dec/msg00010.html However, if I use --with-ioloop=poll, I eventually get IMAP(dave): [9079]: invalid I/O fd 0, callback 0x9330 (not from the above command; it's a little later when Gnus tries to interact with dovecot through the shell) I've been unable to build/install any later versions of dovecot on MacOS. autogen.sh fails like this: ... glibtoolize: putting auxiliary files in `.'. glibtoolize: copying file `./ltmain.sh' glibtoolize: Consider adding `AC_CONFIG_MACRO_DIR([m4])' to configure.in and glibtoolize: rerunning glibtoolize, to keep the correct libtool macros in-tree. glibtoolize: Consider adding `-I m4' to ACLOCAL_AMFLAGS in Makefile.am. configure.in:281: installing `./config.guess' configure.in:282: required file `./config.rpath' not found configure.in:281: installing `./config.sub' configure.in:5: installing `./install-sh' configure.in:5: installing `./missing' src/auth/Makefile.am: installing `./depcomp' autoreconf: automake failed with exit status: 1 -- Dave Abrahams BoostPro Computing http://www.boostpro.com

2 1

[Dovecot] dovecot 1.2rc5 fails to authenticate user via GSSAPI
by Michal Hlavinka 20 Jul '09

20 Jul '09

Hi, we're facing problem where dovecot 1.2rc5 is not able to authenticate user via gssapi. (I'm forwarding information from red hat's bugzilla) Steps to reproduce: 1. Install dovecot with kerberos support, create mailboxes for the client 2. Get initial credentials on client side 3. Attempt to log in via dovecot using gssapi -> login failed Client side 1. Email client displays: "[AUTHENTICATIONFAILED] Authentication failed." 2. klist before login shows: Valid starting Expires Service principal 06/18/09 20:01:01 06/19/09 20:01:01 krbtgt/realm@realm 3. klist after login attempt shows: Valid starting Expires Service principal 06/18/09 20:01:01 06/19/09 20:01:01 krbtgt/realm@realm 06/18/09 20:01:28 06/19/09 20:01:01 imap/mail.domain@realm Server side 1. /var/log/maillog: dovecot: auth(default): gssapi(user,192.168.0.1): authn_name not authorized dovecot: imap-login: Aborted login (auth failed, 1 attempts): user=<user>, method=GSSAPI, rip=192.168.0.1, lip=192.168.0.2, TLS ---------------- It is possible for the same user to login via other mechanisms. The issue reproduced with different email clients. Evolution and a custom java-based client were attempted. example of dovecot.conf: protocols = imap mail_location = maildir:/home/virtual/%u/Maildir protocol imap { } auth_krb5_keytab=/etc/dovecot.keytab auth default { mechanisms = gssapi userdb static { args = uid=vmail gid=vmail home=/home/virtual/%u } } ------------------------- Exactly the same dovecot setup was working just fine with dovecot 1.1 series. Authentication using kinit works just fine and kerberos infrastructure is functioning well as I use kerberos auth for other services like apache and ssh successfully. /var/log/maillog with using auth_debug=yes can be found here: https://bugzilla.redhat.com/attachment.cgi?id=348710 Regards, Michal Hlavinka

3 12

[Dovecot] v3.0 architecture
by Timo Sirainen 15 Jul '09

15 Jul '09

I just had a thought. It's probably going to be too big of a change for v2.0, so something to think about for v3.0: Supporting multiple UIDs is difficult. Currently expire-tool and v2.0's LMTP server are implemented in a way that it's always running as root and only temporarily dropping privileges. So any security hole in there gives the attacker root privileges. Not very nice. With a single UID it's possible (or will be) to just use that one UID for the process without running as root. User sharing mailboxes to another user with different UID is even more difficult. Currently the only practical way to implement this is to assign read-write permissions to some group and have all mail files owned by that group. Not very nice. Sharing mailboxes between users located in different servers is impossible if the disk isn't somehow shared. All of these can be solved the same way: 1. imap, pop3, lmtp, etc. processes will be running without any privileges, very much like imap/pop3-login nowadays. Nobody-chrooted to empty directory. 2. Create storage processes that are started as needed. They can be configured in different security/performance settings: One storage process per user, one storage process per UID, setuid-root style shared storage process for multiple UIDs. 3. Mail processes talk to storage processes via some protocol. They can talk via UNIX socket or TCP/IP. If an existing connection can't handle the target UID, a new connection is made that either reuses an existing storage proces or creates a new one. 4. IMAP can finally implement truly simultaneously running queries (where it makes sense) by creating more storage processes if existing ones are busy handling longer-running commands. This also allows using the same storage process for multiple simultaneous IMAP connections and mail deliveries (and etc). The storage processes can also hang around and keep mailboxes open after all connections have closed it (dynamically figured out when it makes sense) to handle webmail clients that create lots of short-living connections or POP3 clients who poll for new mail every minute. The big problem is what the protocol should be. Use some existing RPC protocol? It should be something extensible so that a plugin in imap process can talk to a plugin in storage process, without the base processes knowing anything about the details (e.g. imap-quota plugin asking quota usage from storage's quota plugin). In any case the client side API should be asynchronous. That can make it annoyingly difficult to use though. Wonder if I could switch to erlang or something for the imap/pop3 processes :)

9 13

[Dovecot] Can expire-tool skip folders with "expire time in future" errors?
by Ralph Seichter 10 Jul '09

10 Jul '09

Hi folks, when I run expire-tool, I often see messages like the following: # dovecot --exec-mail ext /usr/libexec/dovecot/expire-tool Info: user/Trash: stop, expire time in future: Fri May 22 17:42:23 2009 the server's dovecot.conf contains the following line: expire = Trash 2 Junk 7 */News 30 */Reports 7 >From what I observe, an error of "expire time in future" in one of the Trash folders stops expire-tool alltogether, meaning that remaining folders like News or Reports don't get processed at all? Is this interpretation correct? If so, can I convince expire-tool to skip errors and continue processing other folders? -R

4 23

[Dovecot] Managesieve fails to retrieve scripts > 8kB on Dovecot 1.1.16
by John Marshall 10 Jul '09

10 Jul '09

After some help with debugging tips on #dovecot, I have established that a sieve script on Dovecot 1.1.16 has to be less than 8kB in order to be retrieved by a managesieve client. I have been using managesieve for about 6 months over as many 1.1.n versions of dovecot as have been around during that time and hit this problem when I upgraded to Dovecot 1.1.16. I have gone back to Dovecot 1.1.15 and can once again manage my 9kB sieve script remotely. Symptoms were that managesieve login was OK but instead of displaying my sieve script, the script editing window was empty. After 30 seconds the client gave me a timeout message. If I entered a small script in the empty client edit window and saved it, the new, small script was saved to the server and became active. I could then successfully retrieve and edit that small script. I tried hacking a few lines at a time out of my 9kB script (locally on the server). When it was down to 8.4KB I still couldn't get it through managesieve. The next hack took it down to 7.7kB and I could get that through managesieve. So, I'm guessing there's a magic 8192 number in there somewhere - perhaps a buffer? Server dovecot 1.1.16 dovecot-sieve 1.1.6 dovecot-managesieve 0.10.6 FreeBSD 7.2 Client Thunderbird 2.0.21 Sieve 0.1.6 A special thanks to all who write this stuff: it's great! -- John Marshall

3 12

[Dovecot] System users, mbox format and global ACLs
by Axel Luttgens 08 Jul '09

08 Jul '09

I need some help here... ;-) I'm experimenting with global ACLs, but just fail to understand very basic behaviors. So, before digging into the source code, I would really be delighted if someone could immediately point a mistake I'm making and miserably overlooking. The output of dovecot -n is provided at the end of this email. Just in case, conforming to the suggestion made in http://wiki.dovecot.org/ACL , I've specified a CONTROL directory; but I get a similar behavior without it. As far as the acl plugin is concerned, I've just specified a directory for global ACLs; whether that directory is populated or not doesn't seem to have an impact on the observed behavior. Here's the structure of the test user's home directory: total 0 drwx------ 4 testuser people 136 26 jui 13:52 . drwxr-xr-x 3 root admin 102 19 mai 16:56 .. drwxr-xr-x 4 testuser people 136 28 jui 17:09 _mailboxes drwxr-xr-x 2 testuser people 68 28 jui 17:07 _mboxesctrl ./_mailboxes: total 96 drwxr-xr-x 4 testuser people 136 28 jui 17:09 . drwx------ 4 testuser people 136 26 jui 13:52 .. drwx------ 3 testuser people 102 19 mai 17:02 .imap -rw------- 1 testuser people 48685 25 jui 16:58 inbox ./_mailboxes/.imap: total 0 drwx------ 3 testuser people 102 19 mai 17:02 . drwxr-xr-x 4 testuser people 136 28 jui 17:09 .. drwx------ 5 testuser people 170 23 jui 18:02 INBOX ./_mailboxes/.imap/INBOX: total 88 drwx------ 5 testuser people 170 23 jui 18:02 . drwx------ 3 testuser people 102 19 mai 17:02 .. -rw------- 1 testuser people 1376 23 jui 18:02 dovecot.index -rw------- 1 testuser people 26624 28 jui 10:23 dovecot.index.cache -rw-rw-rw- 1 testuser people 10284 25 jui 17:57 dovecot.index.log ./_mboxesctrl: total 0 drwxr-xr-x 2 testuser people 68 28 jui 17:07 . drwx------ 4 testuser people 136 26 jui 13:52 .. I've tried various combinations of permissions and ownership, again without any obvious influence. The manual creation of directory ~/_mboxesctrl/.imap doesn't seem to be more helpful. So, let's go to the heart of my "problem": # telnet 127.0.0.1 imap Trying 127.0.0.1... Connected to localhost. Escape character is '^]'. * OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE AUTH=PLAIN] Dovecot ready. a1 login testuser ****** a1 OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE SORT THREAD=REFERENCES THREAD=REFS MULTIAPPEND UNSELECT IDLE CHILDREN NAMESPACE UIDPLUS LIST-EXTENDED I18NLEVEL=1 CONDSTORE QRESYNC ESEARCH ESORT SEARCHRES WITHIN CONTEXT=SEARCH] Logged in a2 list "" * * LIST (\NoInferiors \UnMarked) "/" "dovecot-acl-list" * LIST (\HasNoChildren \UnMarked) "/" "INBOX" a2 OK List completed. a3 logout * BYE Logging out a3 OK Logout completed. Connection closed by foreign host. And indeed, a file named "dovecot-acl-list" has now been created under the _mailboxes directory: ./_mailboxes: total 96 drwxr-xr-x 5 testuser people 170 28 jui 17:11 . drwx------ 4 testuser people 136 26 jui 13:52 .. drwx------ 3 testuser people 102 19 mai 17:02 .imap -rw-r--r-- 1 testuser people 0 28 jui 17:11 dovecot-acl-list -rw------- 1 testuser people 48685 25 jui 16:58 inbox This is the only file to have been created consecutively to the telnet session. Is such a file supposed to be created there? If yes, why? I would have tended to believe that it is more a server internal matter than a name having to appear in the namespace. More generally, is such a file supposed to be created at all? After all, the configuration doesn't explicitely mention per-mailbox ACLs at all... Anyway, this is what gets written in mail.log for the whole telnet session: dovecot[82305]: auth(default): new auth connection: pid=82374 dovecot[82305]: auth(default): client in: AUTH 1 PLAIN service=imap secured lip=127.0.0.1 rip=127.0.0.1 lport=143 rport=49879 resp=<hidden> dovecot[82305]: auth-worker(default): pam(testuser,127.0.0.1): lookup service=imap dovecot[82305]: auth-worker(default): pam(testuser,127.0.0.1): #1/1 style=1 msg=Password: dovecot[82305]: auth(default): client out: OK 1 user=testuser dovecot[82305]: auth(default): master in: REQUEST 8 82327 1 dovecot[82305]: auth(default): passwd(testuser,127.0.0.1): lookup dovecot[82305]: auth(default): master out: USER 8 testuser system_groups_user=testuser uid=2001 gid=2001 home=/Volumes/ALMbpSpare/ People/a/testuser dovecot[82305]: imap-login: Login: user=<testuser>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, secured dovecot[82305]: IMAP(testuser): Loading modules from directory: /usr/ local/dovecot-1.2.rc7/lib/dovecot/imap dovecot[82305]: IMAP(testuser): Module loaded: /usr/local/ dovecot-1.2.rc7/lib/dovecot/imap/lib01_acl_plugin.so dovecot[82305]: IMAP(testuser): Effective uid=2001, gid=2001, home=/ Volumes/ALMbpSpare/People/a/testuser dovecot[82305]: IMAP(testuser): acl: No acl_shared_dict setting - shared mailbox listing is disabled dovecot[82305]: IMAP(testuser): mbox: data=~/_mailboxes:INBOX=~/ _mailboxes/inbox:CONTROL=~/_mboxesctrl dovecot[82305]: IMAP(testuser): fs: root=/Volumes/ALMbpSpare/People/a/ testuser/_mailboxes, index=, control=/Volumes/ALMbpSpare/People/a/ testuser/_mboxesctrl, inbox=/Volumes/ALMbpSpare/People/a/testuser/ _mailboxes/inbox dovecot[82305]: IMAP(testuser): acl: initializing backend with data: vfile:/usr/local/etc/dovecot-acls dovecot[82305]: IMAP(testuser): acl: acl username = testuser dovecot[82305]: IMAP(testuser): acl: owner = 1 dovecot[82305]: IMAP(testuser): acl vfile: Global ACL directory: /usr/ local/etc/dovecot-acls dovecot[82305]: IMAP(testuser): acl vfile: file /usr/local/etc/ dovecot-acls//.DEFAULT not found dovecot[82305]: IMAP(testuser): Namespace : Using permissions from / Volumes/ALMbpSpare/People/a/testuser/_mailboxes: mode=0755 gid=-1 dovecot[82305]: IMAP(testuser): acl vfile: file /usr/local/etc/ dovecot-acls/.temp.ALMbp.local.82375.f9efcb24711711fb not found dovecot[82305]: IMAP(testuser): acl vfile: file /Volumes/ALMbpSpare/ People/a/testuser/_mboxesctrl/.imap/.temp.ALMbp.local. 82375.f9efcb24711711fb/dovecot-acl not found dovecot[82305]: IMAP(testuser): acl vfile: file /usr/local/etc/ dovecot-acls/INBOX not found dovecot[82305]: IMAP(testuser): acl vfile: file /Volumes/ALMbpSpare/ People/a/testuser/_mboxesctrl/.imap/INBOX/dovecot-acl not found dovecot[82305]: IMAP(testuser): acl vfile: file /usr/local/etc/ dovecot-acls/dovecot-acl-list not found dovecot[82305]: IMAP(testuser): acl vfile: file /Volumes/ALMbpSpare/ People/a/testuser/_mboxesctrl/.imap/dovecot-acl-list/dovecot-acl not found dovecot[82305]: IMAP(testuser): Disconnected: Logged out bytes=23/431 Why does the server seem to expect to find a temp file under ~/ _mboxesctrl/.imap? As well as, more surprisingly, under /usr/local/etc/ dovecot-acls? In a word: Some bad configuration of mine? Or some bug somewhere? Or do I just don't understand ACLs as implemented by dovecot? TIA, Axel # 1.2.rc7: /usr/local/etc/dovecot.conf # OS: Darwin 9.7.0 i386 protocols: pop3 imap ssl: no disable_plaintext_auth: no login_dir: /usr/local/var/run/dovecot/login login_executable(default): /usr/local/dovecot-1.2.rc7/libexec/dovecot/ imap-login login_executable(imap): /usr/local/dovecot-1.2.rc7/libexec/dovecot/ imap-login login_executable(pop3): /usr/local/dovecot-1.2.rc7/libexec/dovecot/ pop3-login first_valid_uid: 2001 mail_location: mbox:~/_mailboxes:INBOX=~/_mailboxes/inbox:CONTROL=~/ _mboxesctrl mail_debug: yes mbox_read_locks: flock mbox_write_locks: flock dotlock mail_executable(default): /usr/local/dovecot-1.2.rc7/libexec/dovecot/ imap mail_executable(imap): /usr/local/dovecot-1.2.rc7/libexec/dovecot/imap mail_executable(pop3): /usr/local/dovecot-1.2.rc7/libexec/dovecot/pop3 mail_plugins(default): acl mail_plugins(imap): acl mail_plugins(pop3): mail_plugin_dir(default): /usr/local/dovecot-1.2.rc7/lib/dovecot/imap mail_plugin_dir(imap): /usr/local/dovecot-1.2.rc7/lib/dovecot/imap mail_plugin_dir(pop3): /usr/local/dovecot-1.2.rc7/lib/dovecot/pop3 pop3_lock_session(default): no pop3_lock_session(imap): no pop3_lock_session(pop3): yes pop3_uidl_format(default): %08Xu%08Xv pop3_uidl_format(imap): %08Xu%08Xv pop3_uidl_format(pop3): %08Xv%08Xu auth default: debug: yes passdb: driver: pam args: * userdb: driver: passwd plugin: acl: vfile:/usr/local/etc/dovecot-acls

2 5

[Dovecot] Problem with sieve and german umlauts
by M. Bobkiewicz 08 Jul '09

08 Jul '09

Dear list, I?m running a postfix (2.5.6) / Dovecot (1.1.11) on a Centos 5.2 box. I?ve written a small gui application to simply create Out of Office replys with sieve. The resulting code did work with maildrop without any problems. Now sieve fails when it meets any german umlauts like ä or ü. It just stops compiling the scripts and complains about the missing "};". A simple fix is to just replace the umlauts, but that doesn?t meet the expectations of my users. Is there any escape code I could use or any way to place the mail text outside the script? Best regards, Mike

3 2

[Dovecot] Dovecot 1.2rc7 / Sieve Plugin problem / Namespaces
by reg9009 08 Jul '09

08 Jul '09

Hi, I've got a problem with Dovecot 1.2rc7 and a Sieve script which should store eMails in a subfolder. It always fails with Jun 28 14:56:43 deliver(): Error: sieve: msgid=<4A47687D.30903(a)some.domain>: failed to store into mailbox '': Invalid mailbox name Jun 28 14:56:43 deliver(): Error: sieve: script /home/dovecot/sieve/info/dovecot.sieve failed with unsuccessful implicit keep This is with dovecot-libsieve. Same happens with cmusieve, though the message is slightly different: Jun 28 14:55:39 deliver(): Info: cmusieve: Executing script /home/dovecot/sieve/info/dovecot.sievec Jun 28 14:55:39 deliver(): Info: sieve runtime error: Keep: Generic Error Sieve script: if header :comparator "i;ascii-casemap" :contains "X-Spam-Level" "*****" { fileinto "INBOX/Junk"; stop; } I tried "INBOX.Junk", "Junk", etc., but no success. Namespace section in dovecot.conf: namespace private { separator = / prefix = INBOX/ inbox = yes #hidden = yes #list=yes } Same configuration works with cmusieve and Dovecot 1.1.16. I assume some problems with the namespace separator. Anyone got any ideas or got sieve running with namespace separator "/" and prefix "INBOX"? Regards, Sebastian

2 4

[Dovecot] GSSAPI cross-realm fixed
by Bryan Jacobs 08 Jul '09

08 Jul '09

Attached is a patch which in my environment (Linux/Heimdal 1.2.1) fixes cross-realm GSSAPI authentication. Changes it makes: 1. When using krb5_kuserok, do not call gss_compare_name to check that authn_name and authz_name are the same. Instead, make TWO calls to krb5_kuserok, one for each ID. If both IDs are acceptable, allow the login. 2. Disable checking that the name is a GSS_KRB5_PRINCIPAL_NAME, as this doesn't appear to be always the case for the authz_name. If I create a .k5login listing both username@REALM1 and username@REALM2, and make that file follow the appropriate security restrictions (world read, user only write permissions), this lets me use GSSAPI logins with principals from either REALM1 or REALM2. This leaves untouched the behavior in the case where krb5_kuserok is not available. Bryan Jacobs

2 3