April 2013 - dovecot - dovecot.org

[Dovecot] v2.2.rc6 released
by Timo Sirainen 08 Apr '13

08 Apr '13

http://dovecot.org/releases/2.2/rc/dovecot-2.2.rc6.tar.gz http://dovecot.org/releases/2.2/rc/dovecot-2.2.rc6.tar.gz.sig Some more fixes to bugs I noticed today while trying out some new things in production. Note especially the replicator-doveadm socket change, see http://wiki2.dovecot.org/Replication for how to configure it. This change allowed local replicator to notify the remote replicator about user being synced. * replicator: Don't create replicator-doveadm socket by default. This way doveadm replicator commands don't accidentally start an unconfigured replicator server. + replicator: Have remote dsync notify the remote replicator that a user was just synced. This way the replicators are kept roughly in sync. + Added ssl_client_ca_file to specify the CA certs as a file. This is needed (instead of ssl_client_ca_dir) in RedHat-based systems. + Added "doveadm fs" commands, mainly to debug lib-fs backends. - Mailbox list indexes weren't using proper file permissions based on the root directory.

2 2

[Dovecot] mdbox and folders containing both messages and sub-folders
by Rich Wales 08 Apr '13

08 Apr '13

I've got Dovecot 2.2r5 (Ubuntu package version 2:2.2.0~rc5-0~auto+1 from the "testing-auto/dovecot-2.2" repository on xi.rename-it.nl) running on a brand-new Ubuntu 12.04.2 server. I'm trying to configure Dovecot (using the "mdbox" mailbox format) to allow folders to contain both messages and sub-folders. However, it's not working consistently. I need to have folders with both messages and sub-folders because I'm trying to migrate mail from an existing (but soon-to-be-retired) Cyrus server, and the existing body of mail has folders of this sort. I'm currently using the following configuration line: mail_location = mdbox:~/mdbox:DIRNAME=.indexes:INDEX=~/mdbox/indexes and am using the Larch program to do an IMAP-to-IMAP copy of one of my family member's mail from the old Cyrus server to the new Dovecot server. When I examine the "mailboxes" directory tree, I see some directories that (correctly) contain both the renamed ".indexes" directory and also directories for IMAP subfolders. However, the Larch output is showing many errors of the form "mailbox cannot contain messages", and some of the messages could not be migrated because of this problem. Am I doing something wrong? Or is the "folders containing both messages and sub-folders" feature simply broken for the "mdbox" format -- meaning presumably that I'll be forced either to use the Maildir format, or else abandon Dovecot entirely and install Cyrus on my new mail server instead? Rich Wales richw(a)richw.org

7 14

[Dovecot] autocreate mailbox but no sub folders
by Arnaud Abélard 08 Apr '13

08 Apr '13

Hello, We have been using lda_mailbox_autocreate to avoid to intialize empty mailboxes upon account creations. This does the job allright except that dovecot-lda is also allowed to autocreate sub folders which is a problem when using addresses extensions (adress+folder(a)domain.tld) It's easy for a malicious user to flood a mailbox with tons of subfolders. Is there a way to tell dovecot-lda it can only create the initial mailbox and maybe some special folders but nothing else? Thanks, Arnaud -- Arnaud Abélard jabber: arnaud.abelard(a)univ-nantes.fr / twitter: ArnY Administrateur Système DSI Université de Nantes -

2 1

[Dovecot] replicator/dsync over tcp
by Michael Grimm 08 Apr '13

08 Apr '13

Hi -- I am testing replicator/dsync over tcp, and I did run into some issues. First of all I did need to extend http://wiki2.dovecot.org/Replication to get dsync over tcp running without ssl: | # dsync over tcp default port | # | doveadm_port = 12345 | service doveadm { | # running dsync over tcp and using ssl | # added-->| user = vmail | inet_listener { added-->| address = 1.2.3.4 | port = 12345 | # ssl = yes | } | } | plugin { | # this host replicates to remote host | # | mail_replica = tcp:SERVER-A.TLD That didn't work ... | dovecot: doveadm(test): Error: doveadm_password not set, can't authenticate to remote server ... thus, I needed to add: added-->| local 1.2.3.4 { added-->| # password for client authentication by doveadm server added-->| # added-->| doveadm_password = secret added-->| # allow client to only use specified list of commands (default is all): added-->| # added-->| #doveadm_allowed_commands = added-->| } 1. Question: may one include "secret" from a file? Well, that runs like a charm! Now, I did try to add ssl by activating "ssl = yes" in 'service doveadm' (see above) and adding ... | # used by replicator/dsync over tcp | # | ssl_client_ca_dir = /<path-to>/ssl/certs ... and ... | mail_replica = tcps:SERVER-A.TLD But, this didn't work (logfile at remote server): | dovecot: doveadm(test): Invalid certificate: self signed certificate: /OU=dovecot server/CN=OTHER-NAME.TLD/emailAddress=postmaster(a)OTHER-NAME.TLD | dovecot: doveadm(test): Error: SERVER-A.TLD: Received invalid SSL certificate | dovecot: doveadm(test): Error: sync: Disconnected from remote The OTHER-NAME.TLD is served by my additional settings used by my MUAs: | ssl_cert = </<path-to>/ssl/certs/OTHER-NAME.TLD.pem | ssl_key = </<path-to>/ssl/private/OTHER-NAME.TLD.pem I did supply SERVER-A.TLD certs and private certificates at both servers as well, but dovecot seems to use those of OTHER-NAME.TLD for replicator/dsync instead :-( 2. Question: May I config the certificate that should be used for replicator/dsync and that might be different from those used by my MUAs (other then pointing to '/<path-to>/ssl/certs')? I am quite sure that I screwed my config somehow, but I cannot find the cause. Thus, someone? Thanks, and with kind regards, Michael

2 4

[Dovecot] v2.1.16 released
by Timo Sirainen 07 Apr '13

07 Apr '13

http://dovecot.org/releases/2.1/dovecot-2.1.16.tar.gz http://dovecot.org/releases/2.1/dovecot-2.1.16.tar.gz.sig + Added quota-status policy service for Postfix + Added "doveadm batch" command to run multiple commands before moving onto the next user (useful only with -A and -u <usermask>) + Added forwards compatibility for v2.2 index files - mdbox: Index rebuilding crashed in some situations - Fixed a race condition with setting \Recent flags - Fixed a crash when decoding a specific message (decoding is done for SEARCH TEXT/BODY and with full text search indexing, so this couldn't fully DoS a user)

7 24

Re: [Dovecot] [Dovecot-de] Dovecot Quota via policy service abfragen
by Andreas Meyer 07 Apr '13

07 Apr '13

Ralf Hildebrandt <Ralf.Hildebrandt(a)charite.de> wrote: > * Andreas Meyer <anmeyer(a)anup.de>: > > > Habe ich jetzt neben quota_grace = 10%% auch rausgenommen. > > Gut. > > > Apr 7 19:38:35 delta postfix/smtpd[23037]: connect from p54B32BC9.dip.t-dialin.net[84.179.43.201] > > Apr 7 19:38:36 delta postfix/smtpd[23037]: setting up TLS connection from p54B32BC9.dip.t-dialin.net[84.179.43.201] > > Apr 7 19:38:36 delta postfix/smtpd[23037]: TLS connection established from p54B32BC9.dip.t-dialin.net[84.179.43.201]: TLSv1 with cipher DHE-RSA-AES128-SHA (128/128 bits) > > Apr 7 19:38:37 delta postfix/smtpd[23037]: NOQUEUE: client=p54B32BC9.dip.t-dialin.net[84.179.43.201], sasl_method=CRAM-MD5, sasl_username=anmeyer(a)anup.de > > Apr 7 19:39:01 delta postfix/smtpd[23139]: connect from localhost[127.0.0.1] > > Apr 7 19:39:01 delta postfix/smtpd[23139]: 9C1BA1B30FB0: client=localhost[127.0.0.1] > > Apr 7 19:39:01 delta postfix/cleanup[23142]: 9C1BA1B30FB0: message-id=<20130407193818.62d8c328(a)itxnew.bitcorner.intern> > > Apr 7 19:39:01 delta postfix/qmgr[22234]: 9C1BA1B30FB0: from=<anmeyer(a)anup.de>, size=1492149, nrcpt=1 (queue active) > > Apr 7 19:39:01 delta postfix/smtpd[23139]: disconnect from localhost[127.0.0.1] > > Apr 7 19:39:02 delta postfix/smtpd[23037]: disconnect from p54B32BC9.dip.t-dialin.net[84.179.43.201] > > Apr 7 19:39:02 delta postfix/pipe[23143]: 9C1BA1B30FB0: to=<miles(a)anup.de>, relay=dovecot, delay=0.56, delays=0.33/0/0/0.23, dsn=4.3.0, status=deferred (temporary failure) > > Na dann sind deine Restrictions falsch und die Mail wird "OK"'ed bevor > der Policy Server gefragt wird. > > > Ich habe warn_if_reject check_policy_service inet:127.0.0.1:12340 > > ziemlich am Anfang der recipient_restrictions gesetzt nachdem ich > > den check am Ende hatte noch nach postgrey. > > > > smtpd_recipient_restrictions = > > ---> hier einbauen <--- > ist ja nur zum Test > > > check_sender_access hash:/etc/postfix/access_sender, > > permit_mynetworks, > > permit_sasl_authenticated, > > reject_invalid_helo_hostname, > > reject_unlisted_recipient, > > warn_if_reject check_policy_service inet:127.0.0.1:12340 > > reject_unknown_sender_domain, > > check_sender_access pcre:/etc/postfix/umlaute.pcre, > > check_recipient_access pcre:/etc/postfix/umlaute.pcre, > > reject_unauth_destination, > > reject_rbl_client bl.spamcop.net, > > reject_rbl_client zen.spamhaus.org, > > check_client_access cidr:/etc/postfix/client.cidr, > > check_policy_service inet:127.0.0.1:10023 That did the trick! The order of the recipient_restricitons was wrong. Apr 7 20:24:55 delta postfix/smtpd[23806]: connect from p54B32BC9.dip.t-dialin.net[84.179.43.201] Apr 7 20:24:55 delta postfix/smtpd[23806]: setting up TLS connection from p54B32BC9.dip.t-dialin.net[84.179.43.201] Apr 7 20:24:56 delta postfix/smtpd[23806]: TLS connection established from p54B32BC9.dip.t-dialin.net[84.179.43.201]: TLSv1 with cipher DHE-RSA-AES128-SHA (128/128 bits) Apr 7 20:24:56 delta postfix/smtpd[23806]: NOQUEUE: reject: RCPT from p54B32BC9.dip.t-dialin.net[84.179.43.201]: 552 5.2.2 <miles(a)anup.de>: Recipient address rejected: Quota exceeded (mailbox for user is full); from=<anmeyer(a)anup.de> to=<miles(a)anup.de> proto=ESMTP helo=<itxnew.bitcorner.intern> Apr 7 20:24:56 delta postfix/smtpd[23806]: lost connection after RCPT from p54B32BC9.dip.t-dialin.net[84.179.43.201] Apr 7 20:24:56 delta postfix/smtpd[23806]: disconnect from p54B32BC9.dip.t-dialin.net[84.179.43.201] The MUA does not get rid of the mail, when it would exceed the quota. But now the next problem. I cannot send this mail and get the following with smtpd_recipient_restrictions = check_policy_service inet:127.0.0.1:12340 check_sender_access hash:/etc/postfix/access_sender, permit_mynetworks, permit_sasl_authenticated, .... Apr 7 20:31:43 delta postfix/smtpd[23820]: connect from p54B32BC9.dip.t-dialin.net[84.179.43.201] Apr 7 20:31:44 delta postfix/smtpd[23820]: setting up TLS connection from p54B32BC9.dip.t-dialin.net[84.179.43.201] Apr 7 20:31:45 delta postfix/smtpd[23820]: TLS connection established from p54B32BC9.dip.t-dialin.net[84.179.43.201]: TLSv1 with cipher DHE-RSA-AES128-SHA (128/128 bits) Apr 7 20:31:46 delta postfix/smtpd[23820]: warning: problem talking to server 127.0.0.1:12340: Success Apr 7 20:31:46 delta postfix/smtpd[23820]: NOQUEUE: reject: RCPT from p54B32BC9.dip.t-dialin.net[84.179.43.201]: 451 4.3.5 Server configuration problem; from=<anmeyer(a)anup.de> to=<dovecot(a)listen.jpberlin.de> proto=ESMTP helo=<itxnew.bitcorner.intern> Apr 7 20:31:46 delta postfix/smtpd[23820]: lost connection after RCPT from p54B32BC9.dip.t-dialin.net[84.179.43.201] Apr 7 20:31:46 delta postfix/smtpd[23820]: disconnect from p54B32BC9.dip.t-dialin.net[84.179.43.201] the mail is not sent out. I deactivated the check to get sent mail sent. Andreas

1 0

[Dovecot] IDLE and inactivity
by Andreas Meyer 07 Apr '13

07 Apr '13

Good day! Apr 07 10:59:40 imap(anmeyer(a)anup.de): Info: Disconnected: Disconnected in IDLE in=725 out=2546 Apr 07 10:59:59 imap(anmeyer(a)anup.de): Info: Disconnected for inactivity in=952 out=25789 Please someone explain to me the IDLE state and the inactivity state an what the numbers at in= and out= means! Andreas

2 1

Re: [Dovecot] [Dovecot-de] Dovecot Quota via policy service abfragen
by Andreas Meyer 07 Apr '13

07 Apr '13

Hallo Waffenmeister! Ralf Hildebrandt <Ralf.Hildebrandt(a)charite.de> wrote: > > Apr 7 14:07:52 delta postfix/qmgr[19078]: 1D8921B31260: from=<anmeyer(a)anup.de>, size=1492149, nrcpt=1 (queue active) > > Apr 7 14:07:53 delta postfix/pipe[19091]: 1D8921B31260: to=<miles(a)anup.de>, relay=dovecot, delay=2542, delays=2542/0.01/0/0.29, dsn=4.3.0, status=deferred (temporary failure) > > Ich sehe hier nur einen Fehler vom transport "dovecot". > > > plugin { > > quota = maildir:User quota > > quota_grace = 10%% > > quota_rule = *:storage=500MB > > quota_rule2 = Trash:storage=+10%% > > > > quota_status_success = DUNNO > > quota_status_nouser = DUNNO > > quota_status_overquota = 552 5.2.2 Mailbox is full / Mailbox ist voll > > Lass mal das quota_status_overquota feld weg. Habe ich jetzt neben quota_grace = 10%% auch rausgenommen. Apr 7 19:38:35 delta postfix/smtpd[23037]: connect from p54B32BC9.dip.t-dialin.net[84.179.43.201] Apr 7 19:38:36 delta postfix/smtpd[23037]: setting up TLS connection from p54B32BC9.dip.t-dialin.net[84.179.43.201] Apr 7 19:38:36 delta postfix/smtpd[23037]: TLS connection established from p54B32BC9.dip.t-dialin.net[84.179.43.201]: TLSv1 with cipher DHE-RSA-AES128-SHA (128/128 bits) Apr 7 19:38:37 delta postfix/smtpd[23037]: NOQUEUE: client=p54B32BC9.dip.t-dialin.net[84.179.43.201], sasl_method=CRAM-MD5, sasl_username=anmeyer(a)anup.de Apr 7 19:39:01 delta postfix/smtpd[23139]: connect from localhost[127.0.0.1] Apr 7 19:39:01 delta postfix/smtpd[23139]: 9C1BA1B30FB0: client=localhost[127.0.0.1] Apr 7 19:39:01 delta postfix/cleanup[23142]: 9C1BA1B30FB0: message-id=<20130407193818.62d8c328(a)itxnew.bitcorner.intern> Apr 7 19:39:01 delta postfix/qmgr[22234]: 9C1BA1B30FB0: from=<anmeyer(a)anup.de>, size=1492149, nrcpt=1 (queue active) Apr 7 19:39:01 delta postfix/smtpd[23139]: disconnect from localhost[127.0.0.1] Apr 7 19:39:02 delta postfix/smtpd[23037]: disconnect from p54B32BC9.dip.t-dialin.net[84.179.43.201] Apr 7 19:39:02 delta postfix/pipe[23143]: 9C1BA1B30FB0: to=<miles(a)anup.de>, relay=dovecot, delay=0.56, delays=0.33/0/0/0.23, dsn=4.3.0, status=deferred (temporary failure) > > Also ich vermisse das reject-warning von postfix und es hat auch nicht den > > Anschein, dass postfix den Status der Quota bei dovecot über port 12340 > > abfrägt. > > Naja, vielleicht steht es an der falschen Stelle in den Restrictions! > Das muss passieren BEVOR irgendwas ein OK zurückgibt. Ich habe warn_if_reject check_policy_service inet:127.0.0.1:12340 ziemlich am Anfang der recipient_restrictions gesetzt nachdem ich den check am Ende hatte noch nach postgrey. smtpd_recipient_restrictions = check_sender_access hash:/etc/postfix/access_sender, permit_mynetworks, permit_sasl_authenticated, reject_invalid_helo_hostname, reject_unlisted_recipient, warn_if_reject check_policy_service inet:127.0.0.1:12340 reject_unknown_sender_domain, check_sender_access pcre:/etc/postfix/umlaute.pcre, check_recipient_access pcre:/etc/postfix/umlaute.pcre, reject_unauth_destination, reject_rbl_client bl.spamcop.net, reject_rbl_client zen.spamhaus.org, check_client_access cidr:/etc/postfix/client.cidr, check_policy_service inet:127.0.0.1:10023 Andreas

1 0

[Dovecot] v2.2.rc5 released
by Timo Sirainen 07 Apr '13

07 Apr '13

http://dovecot.org/releases/2.2/rc/dovecot-2.2.rc5.tar.gz http://dovecot.org/releases/2.2/rc/dovecot-2.2.rc5.tar.gz.sig One more API change that required also a Pigeonhole modification. A few other random fixes. I'm planning on making v2.2.0 release on Monday. Please test before that. :)

7 7

Re: [Dovecot] MOSTLY SOLVED: Re: client limit and STARTTLS
by Reindl Harald 07 Apr '13

07 Apr '13

Am 07.04.2013 12:36, schrieb David Benfell: > On 04/07/2013 03:15 AM, Reindl Harald wrote: >> Am 06.04.2013 10:09, schrieb David Benfell: >>> So I changed it again: >>> >>> default_process_limit = 128 default_client_limit = 512 >>> >>> And now it seems to be fine. But I'm mystified because what you >>> say is the case on your system, that is, that the process limit >>> needs to be greater than the client limit, is what I would >>> expect: wouldn't each client require at least one process? > >> no, 512x128 = 65536 connections each process can serve >> default_client_limit clients > > Thanks a million! I had no idea that was how it worked. I would think > that 65536 would be enough. ;-) http://wiki2.dovecot.org/LoginProcess High-performance mode: It works by using a number of long running login processes, each handling a number of connections. This loses much of the security benefits of the login process design, because in case of a security hole (in Dovecot or SSL library) the attacker is now able to see other users logging in and steal their passwords, read their mails, etc. Default client_limit * process_limit = 1000*100 = 100k connections vsz_limit should be increased to avoid out of memory errors, especially if you're using SSL/TLS.

1 0