October 2011 - dovecot

[Dovecot] To query two SQL tables for user verification over LMTP, should I use (a) two separate lookups? or (b) just one lookup with a boolean query?
by jake0534＠airpost.net 12 Oct '11

12 Oct '11

Hey all I've been running a Dovecot 1X server for awhile. Most of the config was pretty simple using flat files. I'm switching to Dovecot 2X now, and want to switch to using SQL for lookups so I can share info with the Postfix front end. For starters I setup two SIMPLE SQL tables -- a 'users' table and a 'aliases' table, where each user can have many aliases. I want to have Postfix check Dovecot's SASL/LMTP passdb to see if a <user>@<domain> exists. If yes, deliver through LMTP. If NO, reject it. Here are the table definitions so far, CREATE TABLE user ( userid TINYINT, user VARCHAR(64), domain VARCHAR(128), password VARCHAR(64), PRIMARY KEY (userid), UNIQUE (user,domain) ); CREATE TABLE alias ( aliasid TINYINT, alias VARCHAR(64), user VARCHAR(64), domain VARCHAR(128), PRIMARY KEY (aliasid), UNIQUE (domain,user,alias), CONSTRAINT fk_alias1 FOREIGN KEY (user) REFERENCES user (user) ON DELETE NO ACTION ON UPDATE NO ACTION, CONSTRAINT fk_alias2 FOREIGN KEY (domain) REFERENCES user (domain) ON DELETE NO ACTION ON UPDATE NO ACTION ); With flat file and just one table, 'users', I get how to setup LMTP. I can get Postfix delivering/rejecting over LMTP depending on if the user exists in the Dovecot passdb or not. I don't get how to do the SQL query in Dovecot if I have the TWO tables. An inbound <user>@<domain> needs to be auth'd as valid if it exists in EITHER 'user' OR 'alias' table. Do I need to use a single lookup for passdb with some sort of "IF EXISTS IN TABLE 'user' OR TABLE 'alias'" query? Or do I need to have TWO lookups, the main one for 'user' and a fallback one for 'alias' (like talked about here http://wiki2.dovecot.org/Authentication/MultipleDatabases)? Cheers! Jake

2 5

[Dovecot] using ecc-certificates (ellyptic curve) will not establish connection
by Fresel Michal - hi competence e.U. 11 Oct '11

11 Oct '11

hi I want to use ECC(ellyptic curve cryptography) for SSL-connections but somehow dovecot doesn't like my ECC-certificates :( I tried to test using following scenario: machine: debian 6 (x64) dovecot 2.0.15-0~auto+21 ((f6a2c0e8bc03) from http://xi.rename-it.nl/debian openssl 1.0.0e-2 from testing (as the default 0.9.8o-4squeeze3 needs also the parameter -cipher ECCdraft for testing) creating keys+cert for ecc (i.e. curves prime192v1, secp521r1) # openssl ecparam -name prime192v1 -genkey -out prime192v1.key # openssl req -new -key prime192v1.key -out prime192v1.csr # openssl req -x509 -in prime192v1.csr -key prime192v1.key -out prime192v1.crt testing these in 2 windows # openssl s_server -cert prime192v1.crt -key prime192v1.key -www # openssl s_client note: when using the default openssl version 0.9.8o-4squeeze3 you need to append -cipher ECCdraft output (cut) ... New, TLSv1/SSLv3, Cipher is ECDHE-ECDSA-AES256-SHA Server public key is 192 bit Secure Renegotiation IS supported Compression: zlib compression Expansion: zlib compression SSL-Session: Protocol : SSLv3 Cipher : ECDHE-ECDSA-AES256-SHA Session-ID: xxxxx Session-ID-ctx: Master-Key: xxxxx Key-Arg : None PSK identity: None PSK identity hint: None Compression: 1 (zlib compression) Start Time: xxxxx Timeout : 7200 (sec) Verify return code: 18 (self signed certificate) looks promising - also for the secp521r1 curve but when changing dovecot.conf to use these keys and certificates it won't use them and return errors # openssl s_client -port 993 CONNECTED(00000003) 140543456835240:error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure:s3_pkt.c:1195:SSL alert number 40 140543456835240:error:1409E0E5:SSL routines:SSL3_WRITE_BYTES:ssl handshake failure:s3_pkt.c:591: --- no peer certificate available --- No client certificate CA names sent --- SSL handshake has read 7 bytes and written 0 bytes --- New, (NONE), Cipher is (NONE) Secure Renegotiation IS NOT supported Compression: NONE Expansion: NONE SSL-Session: Protocol : SSLv3 Cipher : 0000 Session-ID: Session-ID-ctx: Master-Key: Key-Arg : None PSK identity: None PSK identity hint: None Start Time: xxxxx Timeout : 7200 (sec) Verify return code: 0 (ok) --- and the log gives (using verbose_ssl = yes in dovecot.conf) ==> /var/log/mail.log <== dovecot: imap-login: Warning: SSL: where=0x10, ret=1: before/accept initialization [127.0.0.1] ==> /var/log/mail.info <== dovecot: imap-login: Warning: SSL: where=0x10, ret=1: before/accept initialization [127.0.0.1] ==> /var/log/mail.warn <== dovecot: imap-login: Warning: SSL: where=0x10, ret=1: before/accept initialization [127.0.0.1] ==> /var/log/mail.log <== dovecot: imap-login: Warning: SSL: where=0x2001, ret=1: before/accept initialization [127.0.0.1] ==> /var/log/mail.info <== dovecot: imap-login: Warning: SSL: where=0x2001, ret=1: before/accept initialization [127.0.0.1] ==> /var/log/mail.warn <== dovecot: imap-login: Warning: SSL: where=0x2001, ret=1: before/accept initialization [127.0.0.1] ==> /var/log/mail.log <== dovecot: imap-login: Warning: SSL alert: where=0x4008, ret=552: fatal handshake failure [127.0.0.1] ==> /var/log/mail.info <== dovecot: imap-login: Warning: SSL alert: where=0x4008, ret=552: fatal handshake failure [127.0.0.1] ==> /var/log/mail.warn <== dovecot: imap-login: Warning: SSL alert: where=0x4008, ret=552: fatal handshake failure [127.0.0.1] ==> /var/log/mail.log <== dovecot: imap-login: Warning: SSL: where=0x2002, ret=-1: SSLv3 read client hello C [127.0.0.1] ==> /var/log/mail.info <== dovecot: imap-login: Warning: SSL: where=0x2002, ret=-1: SSLv3 read client hello C [127.0.0.1] ==> /var/log/mail.warn <== dovecot: imap-login: Warning: SSL: where=0x2002, ret=-1: SSLv3 read client hello C [127.0.0.1] ==> /var/log/mail.log <== dovecot: imap-login: Warning: SSL: where=0x2002, ret=-1: SSLv3 read client hello C [127.0.0.1] dovecot: imap-login: Disconnected (no auth attempts): rip=127.0.0.1, lip=127.0.0.1, TLS handshaking: SSL_accept() failed: error:1408A0C1:SSL routines:SSL3_GET_CLIENT_HELLO:no shared cipher ==> /var/log/mail.info <== dovecot: imap-login: Warning: SSL: where=0x2002, ret=-1: SSLv3 read client hello C [127.0.0.1] dovecot: imap-login: Disconnected (no auth attempts): rip=127.0.0.1, lip=127.0.0.1, TLS handshaking: SSL_accept() failed: error:1408A0C1:SSL routines:SSL3_GET_CLIENT_HELLO:no shared cipher ==> /var/log/mail.warn <== dovecot: imap-login: Warning: SSL: where=0x2002, ret=-1: SSLv3 read client hello C [127.0.0.1] from doveconf -a: ssl = required ssl_ca = ssl_cert = </etc/ssl/certs/prime192v1.crt ssl_cert_username_field = commonName ssl_cipher_list = ALL:!LOW:!SSLv2:!EXP:!aNULL ssl_key = </etc/ssl/certs/prime192v1.key ssl_key_password = ssl_parameters_regenerate = 168 ssl_verify_client_cert = no Has anybody already tested this and made it working? Or do i have just to recompile everything to make it work? Greetings Mike

1 1

[Dovecot] inbox issue
by Eric Broch 10 Oct '11

10 Oct '11

I have dovecot 2.0.11 installed on a CentOS 5.7 email server. Two of the server email clients, one using Outlook and the other Thunderbird, have had all the contents of their inbox disappear only to reappear at a later time. One client's inbox email reappeared upon receiving a test email (to check if it would show up in the inbox) from another user. Has anyone heard of such a thing? Here's a dump of my dovecot configuration. # 2.0.11: /etc/dovecot/dovecot.conf # OS: Linux 2.6.18-238.19.1.el5 i686 CentOS release 5.7 (Final) auth_anonymous_username = anonymous auth_cache_negative_ttl = 1 hours auth_cache_size = 32 M auth_cache_ttl = 1 hours auth_debug = no auth_debug_passwords = no auth_default_realm = auth_failure_delay = 2 secs auth_first_valid_uid = 500 auth_gssapi_hostname = auth_krb5_keytab = auth_last_valid_uid = 0 auth_master_user_separator = auth_mechanisms = plain login digest-md5 cram-md5 auth_realms = auth_socket_path = auth-userdb auth_ssl_require_client_cert = no auth_ssl_username_from_cert = no auth_use_winbind = no auth_username_chars = abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ01234567890.-_@ auth_username_format = %Lu auth_username_translation = auth_verbose = no auth_verbose_passwords = no auth_winbind_helper_path = /usr/bin/ntlm_auth auth_worker_max_count = 30 base_dir = /var/run/dovecot config_cache_size = 1 M debug_log_path = default_client_limit = 1000 default_idle_kill = 60 default_internal_user = dovecot default_login_user = dovenull default_process_limit = 100 default_vsz_limit = 256 M deliver_log_format = msgid=%m: %$ dict_db_config = director_doveadm_port = 0 director_mail_servers = director_servers = director_user_expire = 15 mins disable_plaintext_auth = no dotlock_use_excl = yes doveadm_socket_path = doveadm-server doveadm_worker_count = 0 first_valid_gid = 1 first_valid_uid = 89 hostname = imap_capability = imap_client_workarounds = imap_id_log = imap_id_send = imap_idle_notify_interval = 2 mins imap_logout_format = bytes=%i/%o imap_max_line_length = 64 k import_environment = TZ info_log_path = last_valid_gid = 0 last_valid_uid = 0 lda_mailbox_autocreate = no lda_mailbox_autosubscribe = no lda_original_recipient_header = libexec_dir = /usr/libexec/dovecot listen = *, :: lmtp_proxy = no lmtp_save_to_detail_mailbox = no lock_method = fcntl log_path = /var/log/dovecot.log log_timestamp = "%b %d %H:%M:%S " login_access_sockets = login_greeting = Dovecot toaster ready. login_log_format = %$: %s login_log_format_elements = user=<%u> method=%m rip=%r lip=%l mpid=%e %c login_trusted_networks = mail_access_groups = mail_attachment_dir = mail_attachment_fs = sis posix mail_attachment_hash = %{sha1} mail_attachment_min_size = 128 k mail_cache_fields = flags mail_cache_min_mail_count = 0 mail_chroot = mail_debug = no mail_fsync = optimized mail_full_filesystem_access = no mail_gid = mail_home = mail_location = mail_log_prefix = "%s(%u): " mail_max_keyword_length = 50 mail_max_lock_timeout = 0 mail_max_userip_connections = 10 mail_never_cache_fields = imap.envelope mail_nfs_index = no mail_nfs_storage = no mail_plugin_dir = /usr/lib/dovecot mail_plugins = mail_privileged_group = mail_save_crlf = no mail_temp_dir = /tmp mail_uid = mailbox_idle_check_interval = 30 secs mailbox_list_index_disable = no maildir_copy_with_hardlinks = yes maildir_stat_dirs = no maildir_very_dirty_syncs = no master_user_separator = mbox_dirty_syncs = yes mbox_dotlock_change_timeout = 2 mins mbox_lazy_writes = yes mbox_lock_timeout = 5 mins mbox_min_index_size = 0 mbox_read_locks = fcntl mbox_very_dirty_syncs = no mbox_write_locks = dotlock fcntl mdbox_preallocate_space = no mdbox_rotate_interval = 0 mdbox_rotate_size = 2 M mmap_disable = no namespace { hidden = no inbox = yes list = yes location = prefix = INBOX. separator = . subscriptions = yes type = private } namespace { hidden = no inbox = no list = yes location = maildir:/home/vpopmail/domains/acemt.com/shared/projects prefix = projects. separator = . subscriptions = yes type = public } passdb { args = cache_key=%u webmail=127.0.0.1 deny = no driver = vpopmail master = no pass = no } plugin/quota = maildir pop3_client_workarounds = pop3_enable_last = no pop3_fast_size_lookups = no pop3_lock_session = no pop3_logout_format = top=%t/%p, retr=%r/%b, del=%d/%m, size=%s pop3_no_flag_updates = no pop3_reuse_xuidl = no pop3_save_uidl = no pop3_uidl_format = %08Xu%08Xv postmaster_address = protocols = imap quota_full_tempfail = no recipient_delimiter = + rejection_reason = Your message to <%t> was automatically rejected:%n%r rejection_subject = Rejected: %s sendmail_path = /usr/sbin/sendmail service anvil { chroot = empty client_limit = 0 drop_priv_before_exec = no executable = anvil extra_groups = group = idle_kill = 4294967295 secs privileged_group = process_limit = 1 process_min_avail = 1 protocol = service_count = 0 type = anvil unix_listener anvil-auth-penalty { group = mode = 0600 user = } unix_listener anvil { group = mode = 0600 user = } user = $default_internal_user vsz_limit = 18446744073709551615 B } service auth-worker { chroot = client_limit = 1 drop_priv_before_exec = no executable = auth -w extra_groups = group = idle_kill = 0 privileged_group = process_limit = 0 process_min_avail = 0 protocol = service_count = 1 type = unix_listener auth-worker { group = mode = 0600 user = $default_internal_user } user = vsz_limit = 18446744073709551615 B } service auth { chroot = client_limit = 4096 drop_priv_before_exec = no executable = auth extra_groups = group = idle_kill = 0 privileged_group = process_limit = 1 process_min_avail = 0 protocol = service_count = 0 type = unix_listener auth-client { group = mode = 0600 user = } unix_listener auth-login { group = mode = 0600 user = $default_internal_user } unix_listener auth-master { group = mode = 0600 user = } unix_listener auth-userdb { group = mode = 0600 user = } unix_listener login/login { group = mode = 0666 user = } user = $default_internal_user vsz_limit = 18446744073709551615 B } service config { chroot = client_limit = 0 drop_priv_before_exec = no executable = config extra_groups = group = idle_kill = 0 privileged_group = process_limit = 0 process_min_avail = 0 protocol = service_count = 0 type = config unix_listener config { group = mode = 0600 user = } user = vsz_limit = 18446744073709551615 B } service dict { chroot = client_limit = 1 drop_priv_before_exec = no executable = dict extra_groups = group = idle_kill = 0 privileged_group = process_limit = 0 process_min_avail = 0 protocol = service_count = 0 type = unix_listener dict { group = mode = 0600 user = } user = $default_internal_user vsz_limit = 18446744073709551615 B } service director { chroot = client_limit = 0 drop_priv_before_exec = no executable = director extra_groups = fifo_listener login/proxy-notify { group = mode = 00 user = } group = idle_kill = 4294967295 secs privileged_group = process_limit = 1 process_min_avail = 0 protocol = service_count = 0 type = unix_listener director-admin { group = mode = 0600 user = } unix_listener login/director { group = mode = 00 user = } user = $default_internal_user vsz_limit = 18446744073709551615 B } service dns_client { chroot = client_limit = 1 drop_priv_before_exec = no executable = dns-client extra_groups = group = idle_kill = 0 privileged_group = process_limit = 0 process_min_avail = 0 protocol = service_count = 0 type = unix_listener dns-client { group = mode = 0666 user = } unix_listener login/dns-client { group = mode = 0666 user = } user = $default_internal_user vsz_limit = 18446744073709551615 B } service doveadm { chroot = client_limit = 1 drop_priv_before_exec = no executable = doveadm-server extra_groups = group = idle_kill = 0 privileged_group = process_limit = 0 process_min_avail = 0 protocol = service_count = 1 type = unix_listener doveadm-server { group = mode = 0600 user = } user = vsz_limit = 18446744073709551615 B } service imap-login { chroot = login client_limit = 0 drop_priv_before_exec = no executable = imap-login extra_groups = group = idle_kill = 0 inet_listener imap { address = port = 143 ssl = no } inet_listener imaps { address = port = 993 ssl = yes } privileged_group = process_limit = 0 process_min_avail = 0 protocol = imap service_count = 1 type = login user = $default_login_user vsz_limit = 64 M } service imap { chroot = client_limit = 1 drop_priv_before_exec = no executable = imap extra_groups = group = idle_kill = 0 privileged_group = process_limit = 1024 process_min_avail = 0 protocol = imap service_count = 1 type = unix_listener login/imap { group = mode = 0666 user = } user = vsz_limit = 18446744073709551615 B } service lmtp { chroot = client_limit = 0 drop_priv_before_exec = no executable = lmtp extra_groups = group = idle_kill = 0 privileged_group = process_limit = 0 process_min_avail = 0 protocol = lmtp service_count = 0 type = unix_listener lmtp { group = mode = 0666 user = } user = vsz_limit = 0 } service log { chroot = client_limit = 0 drop_priv_before_exec = no executable = log extra_groups = group = idle_kill = 0 privileged_group = process_limit = 1 process_min_avail = 0 protocol = service_count = 0 type = log user = vsz_limit = 18446744073709551615 B } service pop3-login { chroot = login client_limit = 0 drop_priv_before_exec = no executable = pop3-login extra_groups = group = idle_kill = 0 inet_listener pop3 { address = port = 110 ssl = no } inet_listener pop3s { address = port = 995 ssl = yes } privileged_group = process_limit = 0 process_min_avail = 0 protocol = pop3 service_count = 1 type = login user = $default_login_user vsz_limit = 64 M } service pop3 { chroot = client_limit = 1 drop_priv_before_exec = no executable = pop3 extra_groups = group = idle_kill = 0 privileged_group = process_limit = 1024 process_min_avail = 0 protocol = pop3 service_count = 1 type = unix_listener login/pop3 { group = mode = 0666 user = } user = vsz_limit = 18446744073709551615 B } service ssl-params { chroot = client_limit = 0 drop_priv_before_exec = no executable = ssl-params extra_groups = group = idle_kill = 0 privileged_group = process_limit = 0 process_min_avail = 0 protocol = service_count = 0 type = startup unix_listener login/ssl-params { group = mode = 0666 user = } user = vsz_limit = 18446744073709551615 B } shutdown_clients = yes ssl = yes ssl_ca = ssl_cert = </var/qmail/control/servercert.pem ssl_cert_username_field = commonName ssl_cipher_list = ALL:!LOW:!SSLv2:!EXP:!aNULL ssl_key = </var/qmail/control/servercert.pem ssl_key_password = ssl_parameters_file = ssl-parameters.dat ssl_parameters_regenerate = 168 ssl_verify_client_cert = no submission_host = syslog_facility = mail userdb { args = cache_key=%u quota_template=quota_rule=*:backend=%q driver = vpopmail } valid_chroot_dirs = verbose_auth = no verbose_proctitle = no verbose_ssl = no version_ignore = no protocol imap { imap_client_workarounds = delay-newmail }

3 2

Re: [Dovecot] Filesystem quotas
by Joseph Tam 10 Oct '11

10 Oct '11

Timo Sirainen writes in response to Steve Fatula's query: > With imap_quota plugin it allows IMAP client to see how much quota is > used/left. You could also enable quota warnings. And configure the > quota exceeded error message. It could also prevent the catch-22 situation I wrote about earlier whereby a filesystem out-of-space condition will result in a user not being able get themselves out of that situation, since a mailbox operation (like a delete and expunge) will not be able to create a lockfile. Having quotas handled by the IMAP/LDA will allow extra room to handle this impasse. Disabling dotlock or using dotlock_try locking method are some other workarounds. Joseph Tam <jtam.home(a)gmail.com>

2 1

[Dovecot] Timeout leak in get quota
by Danilo 10 Oct '11

10 Oct '11

Hello! I wrote perl script for read current quota usage, it works but when I run the program I receive a warning in Dovecot log: 2011-09-29 14:45:30 doveadm(guest(a)testmail.com): Warning: Timeout leak: 0x7f14800ad970 This is the script: =============================== #!/usr/bin/perl use strict; use Socket; use IO::Handle; socket(TSOCK, PF_UNIX, SOCK_STREAM,0); connect(TSOCK, sockaddr_un("/var/run/dovecot/doveadm-server")) or print("ERROR!"); print "VERSION\tdoveadm-server\t1\t0\n"; print "\tguest\(a)testmail.com\tquota get\n"; print "=" x 20 . "\n"; if (defined(my $messg = <TSOCK>)) { print $messg; print TSOCK "VERSION\tdoveadm-server\t1\t0\n"; TSOCK->flush; print TSOCK "\tguest\(a)testmail.com\tquota get\n"; TSOCK->flush; $messg = <TSOCK>; print $messg; $messg = <TSOCK>; print $messg; close TSOCK; } ============================= I hope someone could help me to fix the warning. Thanks in advance, Dany

3 3

Re: [Dovecot] Group ACL
by Daniel L. Miller 10 Oct '11

10 Oct '11

On 10/7/2011 11:08 PM, Daniel L. Miller wrote: > On 10/6/2011 8:38 AM, Daniel L. Miller wrote: >> Using Dovecot 2.0, LDAP userdb & passdb, with prefetch: >> >> [..] >> >> I have added permissions for "$allshared" to a mailbox's Inbox. It >> does not appear in the shared folders list. Other mailboxes, with >> explicit permission for a given username, work fine. What am I doing >> wrong? >> > Am I, as usual, doing something wrong? > Is there anything else I should supply to help diagnose the issue? -- Daniel

1 0

[Dovecot] Filesystem quotas
by Steve Fatula 10 Oct '11

10 Oct '11

I am wondering if I really need to use dovecot quota functions or not. Assume for the moment, that, each system user has a quota defined using Linux quotas, and that the Maildir is within their quota limited directory. So, any mail (or files created by the user etc) that would exceed the quota obviously can't be created. In such an environment, is there any advantage to implementing the same quota already defined in the filesystem via dovecot? Or, can I just make things simpler and ignore dovecot quotas? Assuming I keep the index and control files out of the quota limited directories. I presume if exceeding filesystem quota, the mail will not be delivered of course. If using lmtp, I presume it stays in the queue to retry later for some period of time. Steve

4 4

Re: [Dovecot] Group ACL
by Daniel L. Miller 08 Oct '11

08 Oct '11

On 10/6/2011 8:38 AM, Daniel L. Miller wrote: > Using Dovecot 2.0, LDAP userdb & passdb, with prefetch: > > [..] > > I have added permissions for "$allshared" to a mailbox's Inbox. It > does not appear in the shared folders list. Other mailboxes, with > explicit permission for a given username, work fine. What am I doing > wrong? > Am I, as usual, doing something wrong? -- Daniel

1 0

[Dovecot] lazy expunge namespaces
by Micah Anderson 07 Oct '11

07 Oct '11

I turned on lazy_expunge and configured a namespace following the wiki[0] instructions for mdbox configuration: namespace { inbox = yes location = prefix = separator = . } namespace { hidden = yes inbox = no list = no location = prefix = INBOX. separator = . } namespace { location = mdbox:~/mdbox:MAILBOXDIR=expunged prefix = EXPUNGED. separator = . } This created an EXPUNGED mailbox in my client (thunderbird), which was greyed out. When I deleted things, they got put in the EXPUNGED mailbox, as expected, but I could not access them to try and "restore" them. The server would say that the mailbox did not exist. micah 0. http://wiki2.dovecot.org/Plugins/Lazyexpunge --

1 0

[Dovecot] doveadm mailbox subscribe wildcard
by Micah Anderson 07 Oct '11

07 Oct '11

Hi, I noticed that wildcards work like the following, as described in the man page: # doveadm mailbox list -s -u bob dovecot* dovecot dovecot/pigeonhole dovecot/pigeonhole/2.0 however, wildcard subscriptions don't work: # doveadm mailbox subscribe -u bob dovecot* # doveadm mailbox list -s -u bob dovecot* dovecot dovecot* dovecot/pigeonhole dovecot/pigeonhole/2.0 It seems I subscribed the non-existant mailbox called 'dovecot*' -- is there a better way to handle this? thanks! micah --

3 3