November 2010 - dovecot

[Dovecot] Static userdb with LDAP passdb but without "allow_all_users=yes"?
by Andreas Ntaflos 03 Dec '10

03 Dec '10

Hi, Is it possible to have a static user database along with an LDAP password database and *not* be forced to set "allow_all_users=yes" for the userdb? The wiki page on static user database says "Normally static userdb handles this by doing a passdb lookup instead." How should the passdb behave in order for this to work? In my tests (on a test server) I am using Dovecot 2.0.7 and Postfix 2.7.0 on Ubuntu 10.04.1. I use (or am trying to use) LMTP with Dovecot and Postfix according to the HOWTO in the wiki [1] as well as dynamic address verification with LMTP [2]. Users are virtual, using a static userdb and passwords from LDAP. I also serve local system users which is why I also have userdb and passdb pam, but this isn't the issue here. Delivering mail to an existing virtual user works fine as far as I can see but when a non-existent user is the recipient Dovecot complains that the passdb doesn't support lookups: postfix/smtpd[26469]: connect from remote-smtp.example.net[10.0.0.10] postfix/cleanup[26474]: 772A760B25: message- id=<20101125172409.772A760B25(a)mailtest.example.com> postfix/qmgr[27672]: 772A760B25: from=<double- bounce(a)mailtest.example.com>, size=276, nrcpt=1 (queue active) dovecot: lmtp(22109): Connect from local dovecot: auth: Error: static(not-a-user(a)test01.example.com): passdb doesn't support lookups, can't verify user's existence dovecot: lmtp(22109): Error: user not-a-user(a)test01.example.com: Auth USER lookup failed dovecot: lmtp(22109): Disconnect from local: Client quit postfix/lmtp[26475]: 772A760B25: to=<not-a-user(a)test01.example.com>, relay=mailtest.example.com[private/dovecot-lmtp], delay=0.18, delays=0.17/0.01/0/0, dsn=4.3.0, status=undeliverable (host mailtest.example.com[private/dovecot-lmtp] said: 451 4.3.0 <not-a- user(a)test01.example.com> Internal error occurred. Refer to server log for more information. (in reply to RCPT TO command)) postfix/qmgr[27672]: 772A760B25: removed postfix/smtpd[26469]: NOQUEUE: reject: RCPT from remote- smtp.example.net[10.0.0.10]: 450 4.1.1 <not-a-user(a)test01.example.com>: Recipient address rejected: unverified address: ho st mailtest.example.com[private/dovecot-lmtp] said: 451 4.3.0 <not-a- user(a)test01.example.com> Internal error occurred. Refer to server log for more information. (in reply to RCPT TO command); from=<andreas.ntaflos(a)example.net> to=<not-a-user(a)test01.example.com> proto=ESMTP helo=<remote-smtp.example.net> postfix/smtpd[26469]: disconnect from remote-smtp.example.net[10.0.0.10] I've uploaded this log file excerpt for your viewing convenience to https://daff.pseudoterminal.org/misc/dovecot/failed_delivery.log More relevant information (doveconf -n, dovecot-ldap.conf) is found below. I can also provide a log excerpt from a successful delivery to an existing virtual user, if needed. To summarise: I want to use LMTP, dynamic address verification, a static user database and an LDAP password database. Can it be done without having to rely on the MTA (Postfix) to verify existing users? Thanks in advance! Andreas [1] http://wiki2.dovecot.org/HowTo/PostfixDovecotLMTP [2] http://wiki2.dovecot.org/LDA/Postfix dovecot-ldap.conf: uris = ldap://ldap.example.com:389 tls = yes tls_ca_cert_file = /etc/ssl/certs/ca-certificates.crt base = ou=virtualDomains,dc=example,dc=com dn = uid=dovecot,ou=services,dc=example,dc=com dnpass = xxx pass_attrs=uid=user, userPassword=password pass_filter=(&(objectClass=hostedAccount)(uid=%u)(accountEnabled=TRUE)) iterate_attrs = uid=user iterate_filter = (objectClass=hostedAccount) doveconf -n: https://daff.pseudoterminal.org/misc/dovecot/doveconf-n.txt -- Andreas Ntaflos Vienna, Austria GPG Fingerprint: 6234 2E8E 5C81 C6CB E5EC 7E65 397C E2A8 090C A9B4

2 4

[Dovecot] dovecot is confused about mail_location
by Eric Raymond 01 Dec '10

01 Dec '10

IMAP logins via fetchmail are failing on my mailserver root@grelber:/home/esr# tail -f /var/log/mail.err Nov 24 16:56:48 grelber dovecot: IMAP(cathy): mail_location not set and autodetection failed: Mail storage autodetection failed with home=/home/cathy Nov 24 16:56:48 grelber dovecot: IMAP(cathy): Fatal: Namespace initialization failed Nov 24 16:57:39 grelber dovecot: IMAP(cathy): mail_location not set and autodetection failed: Mail storage autodetection failed with home=/home/cathy Nov 24 16:57:39 grelber dovecot: IMAP(cathy): Fatal: Namespace initialization failed Nov 24 16:57:52 grelber dovecot: IMAP(cathy): mail_location not set and autodetection failed: Mail storage autodetection failed with home=/home/cathy Nov 24 16:57:52 grelber dovecot: IMAP(cathy): Fatal: Namespace initialization failed Nov 24 17:05:15 grelber dovecot: IMAP(cathy): mail_location not set and autodetection failed: Mail storage autodetection failed with home=/home/cathy Nov 24 17:05:15 grelber dovecot: IMAP(cathy): Fatal: Namespace initialization failed Nov 24 17:09:41 grelber dovecot: IMAP(cathy): mail_location not set and autodetection failed: Mail storage autodetection failed with home=/home/cathy Nov 24 17:09:41 grelber dovecot: IMAP(cathy): Fatal: Namespace initialization failed However: root@grelber:/home/esr# dovecot -n # 1.2.9: /etc/dovecot/dovecot.conf # OS: Linux 2.6.32-24-generic x86_64 Ubuntu 10.04.1 LTS log_timestamp: %Y-%m-%d %H:%M:%S login_dir: /var/run/dovecot/login login_executable: /usr/lib/dovecot/imap-login mail_privileged_group: mail mail_location: mbox:~/mail:/var/mail/%u mbox_write_locks: fcntl dotlock auth default: passdb: driver: pam userdb: driver: passwd And cathy is a real user: root@grelber:/home/esr# grep cathy /etc/passwd cathy:x:1001:1001:Cathy Raymond,,,:/home/cathy:/bin/bash oot@grelber:/home/esr# ls -l /var/mail/cathy -rw------- 1 cathy mail 14296599 2010-11-24 17:30 /var/mail/cathy Dovecot appears confused about whether or not mail_location is set. Just to make matters more perplexing, when *I* fetch from IMAP - using a fetchmail configuration identical except for username - it works. This is driving me nuts. Help? -- <a href="http://www.catb.org/~esr/">Eric S. Raymond</a> "Taking my gun away because I might shoot someone is like cutting my tongue out because I might yell `Fire!' in a crowded theater." -- Peter Venetoklis

6 16

[Dovecot] LMTP with address extension
by ckubu 01 Dec '10

01 Dec '10

hallo, I have a problem configuring lmtp service. I use postfix+dovcot2.0.7 with "recipient_delimeter = -". If i switch to dovecot-lda, all works fine, but going to lmtp service it dosn't. Maybe it works with default delimeter "+", but i plan to move from qmail system with many existent mailboxes. Enclosed some configuration/logentries. Can you give me a hint ? Best Wishes Christoph -- dovecot logfile: ================ dovecot: auth: Debug: master in: USER#0112#011test-tr(a)my-domain.de#011service=lmtp dovecot: auth: Debug: sql(test-tr(a)my-domain.de): SELECT '/var/vmail/' || maildir as home, '5000' AS uid, '5000' AS gid FROM mailbox WHERE username = 'test-tr(a)my-domain.de' and active = true dovecot: auth: sql(test-tr(a)my-domain.de): Unknown user dovecot: auth: Debug: master out: NOTFOUND#0112 dovecot: lmtp(3525): Debug: auth input: dovecot: lmtp(3525): Disconnect from local: Client quit postfix transport configuration: ================================ virtual_transport = lmtp:unix:private/dovecot-lmtp doveconf -n: ============ # 2.0.7: /usr/local/dovecot-2.0.7/etc/dovecot/dovecot.conf # OS: Linux 2.6.32-5-vserver-amd64 x86_64 Debian squeeze/sid ext3 auth_debug = yes auth_debug_passwords = yes auth_mechanisms = plain login digest-md5 cram-md5 apop auth_socket_path = /var/run/dovecot/auth-userdb auth_verbose = yes auth_verbose_passwords = plain base_dir = /var/run/dovecot/ disable_plaintext_auth = no first_valid_gid = 5000 first_valid_uid = 5000 hostname = mx.warenform.de last_valid_gid = 5000 last_valid_uid = 5000 listen = 1.2.3.4 mail_debug = yes mail_gid = vmail mail_location = maildir:/var/vmail/%d/%n/Maildir mail_plugins = autocreate mail_uid = vmail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date passdb { args = /usr/local/dovecot/etc/dovecot/sql-connect.conf.ext driver = sql } plugin { autocreate = Spam autosubscribe = Spam sieve = ~/.dovecot.sieve sieve_dir = ~/sieve sieve_global_dir = /usr/local/dovecot/etc/dovecot/sieve/global/ sieve_global_path = /usr/local/dovecot/etc/dovecot/sieve/default.sieve } postmaster_address = admin(a)my-domain.de protocols = imap pop3 sieve lmtp service auth { unix_listener auth-userdb { group = vmail mode = 0600 user = vmail } } service imap-login { inet_listener imap { address = 127.0.0.1 , 1.2.3.4 } inet_listener imaps { address = 1.2.3.4 } } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0660 user = postfix } } service pop3-login { inet_listener pop3 { address = 1.2.3.4 }} shutdown_clients = no ssl_cert = </etc/postfix/ssl/servercert.pem ssl_key = </etc/postfix/ssl/servercert.pem syslog_facility = local1 userdb { args = /usr/local/dovecot/etc/dovecot/sql-connect.conf.ext driver = sql } protocol lmtp { mail_plugins = autocreate sieve } protocol lda { mail_plugins = autocreate sieve } protocol imap { mail_max_userip_connections = 24 mail_plugins = autocreate autocreate ssl_cert = </etc/postfix/ssl/imap_warenform_de.crt ssl_key = </etc/postfix/ssl/imap_warenform_de.key } protocol pop3 { mail_max_userip_connections = 10 pop3_client_workarounds = outlook-no-nuls oe-ns-eoh ssl_cert = </etc/postfix/ssl/pop_warenform_de.crt ssl_key = </etc/postfix/ssl/pop_warenform_de.key }

3 4

[Dovecot] Virtual Users, PAM authentication, MySql backend
by Álvaro Leão 30 Nov '10

30 Nov '10

Hi, I'm sorry if this is a silly question, but i know that is not possible in Courier, so, I need to check if I can do it with Dovecot. Can I use PAM authentication, witch get the users data from a external database (like mysql)? I've found many ways to do this stuff disconnectedly (like pam authentication with passwd ), but i can put all together? I can't use the passwd... Thank's, Álvaro

3 4

[Dovecot] 2.0.7 (a131a498731f): Core Dump on parsing Config
by Thomas Leuxner 30 Nov '10

30 Nov '10

Trying to fix the 'lmtp' temp error, the latest HG core dumps right away: Nov 30 04:15:41 spectre dovecot: master: Dovecot v2.0.7 (a131a498731f) starting up Nov 30 04:15:41 spectre dovecot: master: Error: service(log): child 30087 killed with signal 11 (core dumped) Nov 30 04:15:41 spectre dovecot: master: Error: service(log): command startup failed, throttling Dump seems to be not very useful though. $ gdb /usr/lib/dovecot/imap /var/run/dovecot/core GNU gdb (GDB) 7.0.1-debian Copyright (C) 2009 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html> This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type "show copying" and "show warranty" for details. This GDB was configured as "x86_64-linux-gnu". For bug reporting instructions, please see: <http://www.gnu.org/software/gdb/bugs/>... Reading symbols from /usr/lib/dovecot/imap...Reading symbols from /usr/lib/debug/usr/lib/dovecot/imap...done. (no debugging symbols found)...done. warning: core file may not match specified executable file. Core was generated by `/usr/sbin/dovecot -c /etc/dovecot/dovecot.conf'. Program terminated with signal 11, Segmentation fault. #0 0x0000000000408719 in str_c@plt () #0 0x0000000000408719 in str_c@plt () No locals. #1 0x00000000016711f8 in ?? () No symbol table info available. #2 0x00007f95ccf52b90 in ?? () No symbol table info available. #3 0x0000000000000000 in ?? () No symbol table info available. Current language: auto The current source language is "auto; currently asm". # 2.0.7 (5e82c5b1b4a9): /etc/dovecot/dovecot.conf # OS: Linux 2.6.32-5-amd64 x86_64 Debian squeeze/sid auth_verbose = yes mail_location = mdbox:~/mdbox mail_plugins = acl quota managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date namespace { hidden = no inbox = yes location = prefix = separator = / type = private } namespace { list = yes location = maildir:/var/vmail/public:LAYOUT=fs:INDEX=~/public prefix = Public/ separator = / subscriptions = no type = public } passdb { args = username_format=%u /var/vmail/auth.d/%d/passwd driver = passwd-file } plugin { acl = vfile:/var/vmail/conf.d/%d/acls:cache_secs=300 mail_log_events = expunge mailbox_delete quota = dict:user::file:%h/mdbox/dovecot-quota quota_rule = *:storage=1GB quota_rule2 = Trash:storage=+10%% sieve = ~/.dovecot.sieve sieve_dir = ~/sieve sieve_global_dir = /var/vmail/conf.d/%d/sieve } protocols = imap lmtp service auth-worker { user = doveauth } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } user = doveauth } service imap-login { inet_listener imap { address = 1.2.3.4 port = 143 } inet_listener imaps { port = 0 } } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0660 user = postfix } } ssl_cert = </etc/ssl/certs/host_domain_tld.crt ssl_key = </etc/ssl/private/host_domain_tld.key syslog_facility = local1 userdb { args = username_format=%u /var/vmail/auth.d/%d/passwd driver = passwd-file } verbose_proctitle = yes protocol lmtp { mail_plugins = acl quota sieve } protocol imap { mail_plugins = acl quota imap_acl imap_quota mail_log notify }

2 2

[Dovecot] 2.07 Debian Segfault has gone.....
by Bernd Schmelter 30 Nov '10

30 Nov '10

....since new package available :-) tnx Benn dovecot --version: 2.0.7 (6e6d3a1cf799) ..Upgrade: dovecot-imapd:i386 (2.0.7-0~auto+33, 2.0.7-0~auto+34)...

1 0

[Dovecot] How to know if dovecot director is running OK?
by Antonio Perez-Aranda 30 Nov '10

30 Nov '10

I'm using director on dovecot 2.0 At present, I know that two instances are connected, If I stop of one system, then I can watch how to the connections are closed on port 5000. I defined 5000 as director port. I have one user (user1) connected to kvm1 (192.168.13.100) and kvm2 (192.168.13.101) servers vía telnet telnet kvm1 143 and then login telnet kvm2 143 and then login If try to execute doveadm director status I can watch the two server like that: [root@kvm1 ~]# doveadm director status mail server ip vhosts users 192.168.13.100 100 0 192.168.13.101 100 0 If I try to find if a server has been asigned to user, but I don't know if it is running correctly [root@kvm1 ~]# doveadm director status user1 Current: not assigned Hashed: 192.168.13.101 Initial config: 192.168.13.101 [root@kvm2 ~]# doveadm director status user1 Current: not assigned Hashed: 192.168.13.101 Initial config: 192.168.13.101 Is there any way to test if it really running?

2 9

[Dovecot] 2.0.7 (a131a498731f) segfaults on Debian
by Bernd Schmelter 30 Nov '10

30 Nov '10

after aptitude upgrade it segfaults. syslog: Nov 30 15:42:05 serv dovecot: master: Dovecot v2.0.7 (a131a498731f) starting up (core dumps disabled) Nov 30 15:42:05 serv kernel: [ 50.920530] dovecot[1474]: segfault at 0 ip 0804fa9c sp bf87ba80 error 4 in dovecot[8048000+c000] Nov 30 15:42:05 serv kernel: [ 50.921140] dovecot[1475]: segfault at 0 ip 0804fa9c sp bf87bab0 error 4 in dovecot[8048000+c000] Nov 30 15:42:05 serv kernel: [ 50.921550] dovecot[1476]: segfault at 0 ip 0804fa9c sp bf87bab0 error 4 in dovecot[8048000+c000] Nov 30 15:42:05 serv dovecot: master: Error: service(anvil): child 1474 killed with signal 11 (core dumps disabled) Nov 30 15:42:05 serv dovecot: master: Error: service(anvil): command startup failed, throttling Nov 30 15:42:05 serv dovecot: master: Error: service(log): child 1475 killed with signal 11 (core dumps disabled) Nov 30 15:42:05 serv dovecot: master: Error: service(log): command startup failed, throttling Nov 30 15:42:05 serv dovecot: master: Error: service(ssl-params): child 1476 killed with signal 11 (core dumps disabled) Nov 30 15:42:05 serv dovecot: master: Error: service(ssl-params): command startup failed, throttling apt-history: Start-Date: 2010-11-30 15:33:35 Upgrade: hdparm:i386 (9.27-2.1, 9.32-1), libx11-data:i386 (1.3.3-3, 1.3.3-4), dovecot-imapd:i386 (2.0.7-0~auto+30, 2.0.7-0~auto+33), dovecot-pop3d:i386 (2.0.7-0~auto+30, 2.0.7-0~auto+33), libx11-6:i386 (1.3.3-3, 1.3.3-4), dovecot-common:i386 (2.0.7-0~auto+30, 2.0.7-0~auto+33) End-Date: 2010-11-30 15:34:26 imho the upgraded packages havn`t relations to dovecot Benn -- GRATIS! Movie-FLAT mit über 300 Videos. Jetzt freischalten unter http://portal.gmx.net/de/go/maxdome

2 2

[Dovecot] "doveadm auth user" requiring a tty
by Axel Luttgens 30 Nov '10

30 Nov '10

Hello, "doveadm auth user password" may be scripted without a glitch. But this comes with the usual problem of a "ps" command showing the password, which may be especially annoying in case of a single-letter typo: the almost correct password is then visible for about two seconds... Clearing the password argument (zeroing it) in doveadm-auth.c, in the hope to reduce the window during which the password may be catched, didn't prove successful. "doveadm auth user" could be an alternative, but it imperatively requires a tty, which may not always easily nor efficiently be available in a scripting environment. I thus ended with this very quick and dirty hack (I guess this should be named that way): --- askpass.original.c 2010-05-31 18:36:52.000000000 +0200 +++ askpass.c 2010-11-27 19:12:03.000000000 +0100 @@ -16,8 +16,24 @@ char ch; int fd; + // A very crude attempt... this supposes that STDIN not being a tty + // may never happen outside of "doveadm auth", and that STDIN will + // always be clean. + //if (!isatty(STDIN_FILENO)) + // i_fatal("stdin isn't a TTY"); if (!isatty(STDIN_FILENO)) - i_fatal("stdin isn't a TTY"); + { + pos = 0; + while (read(STDIN_FILENO, &ch, 1) > 0) { + if (pos >= buf_size-1) + break; + if (ch == '\n' || ch == '\r') + break; + buf[pos++] = ch; + } + buf[pos] = '\0'; + return; + } fputs(prompt, stderr); fflush(stderr); but this for sure must overlook a lot of things. What would be the best way to achieve a scriptable "doveadm auth", say through php's proc_open(), without possibly compromise passwords? TIA, Axel

2 2

[Dovecot] Plan: ACL changes
by Timo Sirainen 30 Nov '10

30 Nov '10

Global ACLs are intended to apply to a few mailboxes for all users. For example you could have a master user called "spam" that would have access to each user's "spam" mailbox, but nothing else. Global ACLs are kind of ugly. A mailbox's ACL is found from exactly the same name as what the mailbox's virtual name is. So for example if you have namespace { separator = / prefix = foo/ } And you have a mailbox called foo/bar, the global ACL is looked up from the <global dir>/foo/bar. The problem there of course is what if you want to set global ACLs for "foo". You can't have both directory and a file called "foo". So if this happens, Dovecot instead looks up the ACLs from <global dir>/foo/.DEFAULT file. The name for this file is slightly confusing, and also of course if there really is a mailbox called ".DEFAULT" it won't really work well. Global acl is currently configured by giving its path to acl setting, such as: plugin { acl = vfile:/etc/dovecot/global-acls } So plan #1: deprecate this usage. If global-acls is a directory, keep using the old method. But the new preferred method would be for it to be a file that contains all of the global ACLs. Typically there should be very few entries, so this should also be more efficient. Also this would allow setting default ACLs for namespaces by using wildcards. For example you could have: * masteruser +lrw spam spamuser +lr test/* testuser +lr etc. The * would match only within a single namespace, so if you had more than one, the * entry would match only the one having prefix="". The * entry would be especially helpful for master users who you intend to have access to user's all mailboxes. Currently there is no good way to implement this. Plan #2: Add support for per-user default namespace ACLs. In the mail root directory if "dovecot-default-acl" file exists, it's used as the default ACLs. I'm not entirely sure what should happen if it conflicts with the global ACLs. Probably they both should be simply merged, since both can only be created by an admin. Probably the per-user ACL should be allowed to override the global ACLs. Any thoughts? Since neither of these would break backwards compatibility, I could add them to v2.0.x.

4 9