July 2012 - dovecot - dovecot.org

[Dovecot] Wrong remote IP (rip) in mail.log using IMAP login
by tyli 02 Aug '13

02 Aug '13

Dear list users While trying to secure our dovecot server with fail2ban I came across the following problem: We use dovecot (1.2.9, ubuntu package) behind a NAT, and failed login attempts are logged with our firewall as the remote ip. Example: Apr 15 08:36:26 mail dovecot: imap-login: Disconnected (auth failed, 6 attempts): user=<xy>, method=PLAIN, rip=192.168.0.1, lip=192.168.0.3 Therefore I would ban 192.168.0.1 which means that I ban EVERY user. Funny thing is that POP3 login attempts are logged correctly: Apr 13 11:05:50 mail dovecot: pop3-login: Disconnected (auth failed, 1 attempts): user=<sgvyniwx>, method=PLAIN, rip=217.81.27.55, lip=192.168.0.3 Any ideas how to change this? Thanks in advance tyli

5 5

[Dovecot] Proxying improvements in v2.1.2
by Timo Sirainen 16 Jul '13

16 Jul '13

I just committed a couple of features that will make life easier for some types of proxying setups: 1. IMAP proxying has already for a while supported sending local/remote IP/port to backend server, which can use it for logging and other purposes. I've now implemented this for POP3 as well, although only the remote IP/port is forwarded, not local IP/port. I implemented this also for LMTP in v2.2 tree, but haven't bothered to backport that change. Both POP3 and LMTP uses XCLIENT command that is compatible to Postfix's (XCLIENT ADDR=1.2.3.4 PORT=110). 2. proxy_maybe=yes + host=host.example.com actually works now. As long as host.example.com DNS lookup returns one IP that belongs to the current server the proxying is skipped. 3. auth_proxy_self = 1.2.3.4 setting means that if proxy_maybe=yes and host=1.2.3.4 then Dovecot assumes that this is a local login and won't proxy it, even if 1.2.3.4 isn't the actual local IP. This can be helpful if the host field contains load balancer's IP address instead of the server's. You can add more than one IP (space separated) and of course everything related to this works just as well with hostnames as with IPs (even when hostname expands to multiple IPs).

2 2

[Dovecot] Zero-sized Maildir files and index corruption on over-quota
by Edgar Fuß 28 Jun '13

28 Jun '13

We are using Postfix as an MTA delivering via Dovecot's LDA (with sieve). We also use Dovecot as a POP/IMAP server. Mail storage is Maildir on NFS, indexes are stored locally. Quotas are FS quotas enforced by the NFS server. The Dovecot version is 1.2.11. Recently, for one user being over quota, some attempts to deliver mail bounced as expected while some others resulted in zero-sized Maildir files. I can verify zero-sized files in cur, while I cannot tell whether they were already zero-sized in new. However, since nobody except Dovecot is accessing the mail storage, it's either Dovecot's LDA or Dovecot's IMAP producing the zero-sized files. Logs show successful delivery (deliver: stored mail into mailbox 'INBOX') but ,,Corrupted index cache file /var/db/dovecot/indexes/XXX/.INBOX/dovecot.index.cache: Corrupted virtual size for uid=YYY: 0 != NNNN'' alerts on IMAP access. It looks like all mails which correctly got bounced are >64KB while those resulting in zero-sized files are <64KB (there is one >32KB). My first guess would be that maybe for large files, write() fails, while for small ones, close() fails or there is some buffering involved for large files.

3 10

[Dovecot] traffic statistics
by Martin Waschbüsch 28 Jun '13

28 Jun '13

Hi all, Does anyone know a good tool to gather traffic statistics for imap? And what level of logging would I need to set for dovecot to make it happen. Ideally this would be able to filter per domain, too. ;-) Thanks a lot, Martin -- Martin Waschbüsch IT-Dienstleistungen Lautensackstr. 16 80687 München Telefon: +49 89 57005708 Fax: +49 89 57868023 Mobil: +49 170 2189794 martin(a)waschbuesch.de http://martin.waschbuesch.de

4 5

[Dovecot] Released Pigeonhole v0.2.4 for Dovecot v2.0.14
by Stephan Bosch 26 Mar '13

26 Mar '13

Hello Dovecot users, I release a new version of Pigeonhole tonight. This release extends the configuration capabilities of the include and vacation extensions, adds the ihave extension (RFC 5463), and fixes a few small other things. Judging by Timo's plans, this will be one of the last feature releases for Dovecot v2.0, since I'll be switching active development to Dovecot v2.1 once that matures a little more. Changelog v0.2.4: + Vacation extension: finally added support for using the original recipient in vacation address check. It is also possible to disable the recipient address check entirely. Check doc/vacation.txt for configuration information. + Include extension: made limits on the include depth and the total number of included scripts configurable. Check doc/include.txt for configuration information. + Implemented ihave extension. This allows checking for the availability of Sieve language extensions at 'runtime'. Actually, this is checked at compile time. At runtime the interpreter checks whether extensions that were not previously available are still unavailable. If the situation changed, the script is re-compiled and the ihave tests are evaluated again. + Sieve: optimized compilation of tests that yield constant results (i.e. known at compile tme), such as 'true' and 'false'. No code is produced anymore for script sections that are never executed. Also, semantics are not verified anymore in uncompiled script sections. + Made vnd.dovecot.debug extension available to the LDA plugin instead of only the command line tools. + Sieve: redirect action now adds X-Sieve-Redirected-From header (mainly for people using SPF/SRS). - Sieve: fixed bug in handling flags and keywords; in case of error an assertion was triggered. - Script storage: improved handling of unconfigured user home directory. Originally this would produce an unhelpful error message. - Imap4flags extension: prevent forcibly enabling imap4flags when imapflags is enabled. - Fixed various -Wunused-but-set-variable compiler warnings. - Include extension: forgot to check variable identifier syntax for 'global' command. - Sieve: fixed debug mode; no messages were logged in some situations. - sievec tool: forgot to enable -D (debug) parameter. The release is available as follows: http://www.rename-it.nl/dovecot/2.0/dovecot-2.0-pigeonhole-0.2.4.tar.gz http://www.rename-it.nl/dovecot/2.0/dovecot-2.0-pigeonhole-0.2.4.tar.gz.sig Refer to http://pigeonhole.dovecot.org and the Dovecot v2.0 wiki for more information. Have fun testing this new release and don't hesitate to notify me when there are any problems. Regards, -- Stephan Bosch stephan(a)rename-it.nl

2 1

[Dovecot] doveadm purge -A via doveadm-proxy director fails after some users
by Daniel Parthey 06 Oct '12

06 Oct '12

Hi, we have configured userdb and passdb in the director and try to iterate all users and pass the "purge" command via doveadm proxy to port 19000 on the correct director backend host. A single purge -u username(a)example.org via doveadm-proxy works correctly, but iterating over some users with -A fails. Note: users/domains have been anonymized in output: ------------------------------------------------------------------------ mail04:~# /usr/bin/doveadm -c /etc/dovecot-director/dovecot-director.conf -D purge -A 2>&1 doveadm(root): Debug: Loading modules from directory: /usr/lib/dovecot/modules/doveadm doveadm(root): Debug: Skipping module doveadm_acl_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/lib10_doveadm_acl_plugin.so: undefined symbol: acl_user_module (this is usually intentional, so just ignore this message) doveadm(root): Debug: Skipping module doveadm_expire_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/lib10_doveadm_expire_plugin.so: undefined symbol: expire_set_lookup (this is usually intentional, so just ignore this message) doveadm(root): Debug: Skipping module doveadm_quota_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/lib10_doveadm_quota_plugin.so: undefined symbol: quota_user_module (this is usually intentional, so just ignore this message) doveadm(root): Debug: Skipping module doveadm_zlib_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/lib10_doveadm_zlib_plugin.so: undefined symbol: i_stream_create_deflate (this is usually intentional, so just ignore this message) doveadm(root): Debug: Skipping module doveadm_fts_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/lib20_doveadm_fts_plugin.so: undefined symbol: fts_list_backend (this is usually intentional, so just ignore this message) doveadm(user01(a)domain1.example.org): Debug: auth input: user=user01(a)domain1.example.org proxy host=10.129.3.193 proxy_refresh=86400 doveadm(user02(a)domain1.example.org): Debug: auth input: user=user02(a)domain1.example.org proxy host=10.129.3.193 proxy_refresh=86400 doveadm(user03(a)domain1.example.org): Debug: auth input: user=user03(a)domain1.example.org proxy host=10.129.3.192 proxy_refresh=86400 doveadm(user04(a)domain1.example.org): Debug: auth input: user=user04(a)domain1.example.org proxy host=10.129.3.192 proxy_refresh=86400 doveadm(user05(a)domain1.example.org): Debug: auth input: user=user05(a)domain1.example.org proxy host=10.129.3.190 proxy_refresh=86400 doveadm(user06(a)domain1.example.org): Debug: auth input: user=user06(a)domain1.example.org proxy host=10.129.3.193 proxy_refresh=86400 doveadm(user07(a)domain1.example.org): Debug: auth input: user=user07(a)domain1.example.org proxy host=10.129.3.190 proxy_refresh=86400 doveadm(user08(a)domain1.example.org): Debug: auth input: user=user08(a)domain1.example.org proxy host=10.129.3.193 proxy_refresh=86400 doveadm(user01(a)domain2.example.org): Debug: auth input: user=user01(a)domain2.example.org proxy host=10.129.3.193 proxy_refresh=86400 doveadm(user09(a)domain1.example.org): Debug: auth input: user=user09(a)domain1.example.org proxy host=10.129.3.190 proxy_refresh=86400 10 / 94doveadm(user10(a)domain1.example.org): Debug: auth input: user=user10(a)domain1.example.org proxy host=10.129.3.190 proxy_refresh=86400 doveadm(user11(a)domain1.example.org): Debug: auth input: user=user11(a)domain1.example.org proxy host=10.129.3.191 proxy_refresh=86400 doveadm(user12(a)domain1.example.org): Debug: auth input: user=user12(a)domain1.example.org proxy host=10.129.3.193 proxy_refresh=86400 doveadm(user13(a)domain1.example.org): Debug: auth input: user=user13(a)domain1.example.org proxy host=10.129.3.190 proxy_refresh=86400 doveadm(user14(a)domain1.example.org): Debug: auth input: user=user14(a)domain1.example.org proxy host=10.129.3.193 proxy_refresh=86400 doveadm(user15(a)domain1.example.org): Debug: auth input: user=user15(a)domain1.example.org proxy host=10.129.3.191 proxy_refresh=86400 doveadm(user16(a)domain1.example.org): Debug: auth input: user=user16(a)domain1.example.org proxy host=10.129.3.191 proxy_refresh=86400 doveadm(user17(a)domain1.example.org): Debug: auth input: user=user17(a)domain1.example.org proxy host=10.129.3.193 proxy_refresh=86400 doveadm(user18(a)domain1.example.org): Debug: auth input: user=user18(a)domain1.example.org proxy host=10.129.3.193 proxy_refresh=86400 doveadm(user19(a)domain1.example.org): Debug: auth input: user=user19(a)domain1.example.org proxy host=10.129.3.192 proxy_refresh=86400 20 / 94doveadm(user20(a)domain1.example.org): Debug: auth input: user=user20(a)domain1.example.org proxy host=10.129.3.193 proxy_refresh=86400 doveadm(user21(a)domain1.example.org): Debug: auth input: user=user21(a)domain1.example.org proxy host=10.129.3.193 proxy_refresh=86400 doveadm(user22(a)domain1.example.org): Debug: auth input: user=user22(a)domain1.example.org proxy host=10.129.3.193 proxy_refresh=86400 doveadm(user02(a)domain2.example.org): Debug: auth input: user=user02(a)domain2.example.org proxy host=10.129.3.190 proxy_refresh=86400 doveadm(user23(a)domain1.example.org): Debug: auth input: user=user23(a)domain1.example.org proxy host=10.129.3.193 proxy_refresh=86400 doveadm(user24(a)domain1.example.org): Debug: auth input: user=user24(a)domain1.example.org proxy host=10.129.3.193 proxy_refresh=86400 doveadm(user01(a)domain3.example.org): Debug: auth input: user=user01(a)domain3.example.org proxy host=10.129.3.193 proxy_refresh=86400 doveadm(user25(a)domain1.example.org): Debug: auth input: user=user25(a)domain1.example.org proxy host=10.129.3.192 proxy_refresh=86400 doveadm(user26(a)domain1.example.org): Debug: auth input: user=user26(a)domain1.example.org proxy host=10.129.3.191 proxy_refresh=86400 doveadm(user27(a)domain1.example.org): Debug: auth input: user=user27(a)domain1.example.org proxy host=10.129.3.190 proxy_refresh=86400 30 / 94doveadm(user28(a)domain1.example.org): Debug: auth input: user=user28(a)domain1.example.org proxy host=10.129.3.193 proxy_refresh=86400 doveadm(user29(a)domain1.example.org): Debug: auth input: user=user29(a)domain1.example.org proxy host=10.129.3.191 proxy_refresh=86400 doveadm(user30(a)domain1.example.org): Debug: auth input: user=user30(a)domain1.example.org proxy host=10.129.3.193 proxy_refresh=86400 doveadm(user31(a)domain1.example.org): Debug: auth input: user=user31(a)domain1.example.org proxy host=10.129.3.193 proxy_refresh=86400 doveadm(user31(a)domain1.example.org): Error: doveadm server failure doveadm: Error: Failed to iterate through some users ------------------------------------------------------------------------ The user "user31(a)domain1.example.org" is proxied to the correct backend host according to director status, but the dovecot.log on the doveadm service backend host shows the following error: Jun 29 15:40:31 10.129.3.249 dovecot: doveadm(user31(a)domain1.example.org): Error: user user31(a)domain1.example.org: Error reading configuration: net_connect_unix(/var/run/dovecot/config) failed: Permission denied Jun 29 15:40:31 10.129.3.249 dovecot: doveadm(user31(a)domain1.example.org): Error: purge: User lookup failed: Internal error occurred. Refer to server log for more information. The wiki http://wiki2.dovecot.org/Services#doveadm states that the privileges are (temporarily) dropped to the mail user's privileges after userdb lookup. It seems that from the second purge on which is passed over a single doveadm connection, the user lookup fails. It also seems a bit strange, that the "-A" parameter can be observed in the doveadm tcp stream to the backend, since iteration should be already done in the director and the backend should purge only a single user: D username(a)example.org purge -A Is there a bug or have I misconfigured/overlooked something? Configs of mailbox backend and director are attached. Kind regards Daniel

2 8

[Dovecot] Auth worker max line size
by Emmanuel Dreyfus 09 Sep '12

09 Sep '12

Hello I have been playing with some exotic authentication scheme with Dovecot and PAM. That involves sending really large base64 encoded data as the IMAP password, and I have hit a line limit in Dovecot, with AUTH_WORKER_MAX_LINE_LENGTH set to 1024. This limit is especially frustrating since other parts of the software use much larger limits: MAX_INBUF_SIZE 4096 MAX_IMAP_LINE 8192 AUTH_CLIENT_MAX_LINE_LENGTH 8192 I had to make the patch attached below to get my authentication working. I can live with this local patch, but given the much more liberal limits of MAX_INBUF_SIZE at 4096 makes we wonder if this 1024 limit on AUTH_WORKER_MAX_LINE_LENGTH could not be a bug. Or is there a security concern at using more than 1kB? Opinions? (please Cc: me, I'm not subscribed ot the list) --- src/auth/auth-worker-client.h.orig 2009-06-23 18:32:15.000000000 +0200 +++ src/auth/auth-worker-client.h 2009-06-23 18:32:33.000000000 +0200 @@ -1,8 +1,8 @@ #ifndef AUTH_WORKER_CLIENT_H #define AUTH_WORKER_CLIENT_H -#define AUTH_WORKER_MAX_LINE_LENGTH 1024 +#define AUTH_WORKER_MAX_LINE_LENGTH 4096 struct auth_worker_client *auth_worker_client_create(struct auth *auth, int fd); void auth_worker_client_destroy(struct auth_worker_client **client); void auth_worker_client_unref(struct auth_worker_client **client); -- Emmanuel Dreyfus manu(a)netbsd.org

3 5

Re: [Dovecot] Removing specific entry in user/auth cache
by Joseph Tam 07 Sep '12

07 Sep '12

Francisco Wagner C. Freire <wgrcunha(a)gmail.com> writes: > On Wed, Jun 27, 2012 at 9:24 AM, Timo Sirainen <tss(a)iki.fi> wrote: > >> On 27.6.2012, at 14.10, Angel L. Mateo wrote: >> >>> We have dovecot configured with auth cache. Is there any way to >> remove a specific entry (not all) from this cache? >> >> Nope. What do you need it for? > > I dont known about Angel, but for me is useful because sometimes i need to > deactivate smtp/imap/pop access from accounts, or change their home after > storage migration, and removing a specific record i can use a long time > cache. I'm not sure that the auth cache holds that information, but I think you can at least invalidate a particular auth cache entry by 1) Changing the user password (and save the previous hash) 2) Authenticate using the new credentials (and invalidate the auth cache entry). For example, you can just do a manual connection on your dovecot server x login someuser newpassword This will replace the cache entry with a new one. 3) When you are ready to put the account back online, change the password back to the original. A password mismatch forces a resync to your authentication system which will restore the auth cache. Joseph Tam <jtam.home(a)gmail.com>

4 8

[Dovecot] dovecot stats: useful data to gather
by Patrick Ben Koetter 06 Sep '12

06 Sep '12

Timo, following our discussion on dovecot stats at the LinuxTag 2012 my team and I sat down and put together a list of stat items we think to be useful in daily dovecot usage. Besides pulling together all the data we also think it would be useful to have an SNMP interface to access the stats. Our offer to create and contribute a standalone web interface for dovecot stats stands. Here are the stats we believe to be useful: Login/Logout - total number login success/time - total number login failure/time - total number per authentication mechanism - total number plain sessions - total number STARTTLS sessions - total number of currently connected users (pop3/pop3s/imap/imaps/managesieve) - login names of connected users (not really stats, but great for actions regarding those uses e.g. force logout) - total number logout commands/time - total number BYE responses (autologout) Mailbox state - Inflow rate (number incoming messages/time) - Deleted rate (number \Deleted flagged messages/time) - Expunge rate (number Expunge operations/time) - total number current messages mailboxes normal storage - total number current messages mailboxes alt storage - total number read messages mailboxes normal storage - total number read messages mailboxes alt storage - per user number current messages mailboxes normal storage - per user number current messages mailboxes alt storage - per user number read messages mailboxes normal storage - per user number read messages mailboxes alt storage Mailbox Quota - total number persons under soft-quota per quota - total number persons above or equal soft-quota per quota - total number persons above or equal hard-quota per quota Performance - minimum time to write a message - maximum time to write a message - average time to write a message - minimum time to modify a message - maximum time to modify a message - average time to modify a message - minimum time to delete a message - maximum time to delete a message - average time to delete a message - minimum time search operations - maximum time search operations - average time search operations Regards, p@rick -- state of mind () http://www.state-of-mind.de Franziskanerstraße 15 Telefon +49 89 3090 4664 81669 München Telefax +49 89 3090 4666 Amtsgericht München Partnerschaftsregister PR 563

5 5

[Dovecot] dovecot stats error
by Robert Schetterer 25 Aug '12

25 Aug '12

Hi Timo, any idea whats this related too ? dovecot: stats: Error: Mail server input error: UPDATE-SESSION: stats shrank: mrbytes 21703727 < 25193928 -- Best Regards MfG Robert Schetterer

3 3