June 2014 - dovecot - dovecot.org

Crash in service imap with version 2.2.13
by Urban Loesch 03 Jul '14

03 Jul '14

Hi, yesterday I upgraded to version 2.2.13 under Debian Squeeze. Since today morning sometimes my logfile shows the folling error: .. Jun 24 10:14:16 mailstore dovecot: imap(user(a)domain.net pid:23434 session:<jf6yi5D8TADD/vzh>): Fatal: master: service(imap): child 23434 killed with signal 11 (core dumped) ... The kernel error log shows: ... Jun 24 10:14:16 mailstore kernel: [13959701.899726] imap[23434]: segfault at 1012acec0 ip 00007f7dd89b5e52 sp 00007ffffd33d9b0 error 4 in libdovecot-storage.so.0.0.0[7f7dd88ed000+10d000] ... This seems only to happen in conjunction with Horde Webmail. Other IMAP clients aren't affected. I made a backtrace: -----> start backtrace <----- Core was generated by `dovecot/imap'. Program terminated with signal 11, Segmentation fault. #0 mail_index_strmap_uid_exists (ctx=0x7ffffd33d9f0, uid=8442) at mail-index-strmap.c:395 395 mail-index-strmap.c: No such file or directory. in mail-index-strmap.c (gdb) bt full #0 mail_index_strmap_uid_exists (ctx=0x7ffffd33d9f0, uid=8442) at mail-index-strmap.c:395 rec = 0x1012acec0 #1 0x00007f7dd89b79ab in mail_index_strmap_view_renumber (_sync=<value optimized out>) at mail-index-strmap.c:842 ctx = {view = 0x12b2d80, input = 0x0, end_offset = 0, highest_str_idx = 0, uid_lookup_seq = 0, lost_expunged_uid = 0, data = 0x0, end = 0x0, str_idx_base = 0x0, rec = {uid = 0, ref_index = 0, str_idx = 0}, next_ref_index = 0, rec_size = 0, too_large_uids = 0} str_idx = 0 count = 1 ret = <value optimized out> prev_uid = 8442 i = 0 dest = 0 count2 = <value optimized out> #2 mail_index_strmap_write (_sync=<value optimized out>) at mail-index-strmap.c:1189 ret = <value optimized out> #3 mail_index_strmap_view_sync_commit (_sync=<value optimized out>) at mail-index-strmap.c:1236 sync = <value optimized out> view = <value optimized out> #4 0x00007f7dd899fc23 in mail_thread_index_map_build (box=<value optimized out>, args=<value optimized out>, ctx_r=<value optimized out>) at index-thread.c:332 last_uid = 8442 search_ctx = <value optimized out> mail = <value optimized out> seq1 = 0 tbox = 0x12af2e0 headers_ctx = 0x12b7e50 search_args = <value optimized out> seq2 = <value optimized out> wanted_headers = {0x7f7dd89d8542 "message-id", 0x7f7dd89d9f96 "in-reply-to", 0x7f7dd89d9fa2 "references", 0x0} #5 mail_thread_init (box=<value optimized out>, args=<value optimized out>, ctx_r=<value optimized out>) at index-thread.c:569 tbox = 0x12af2e0 ctx = 0x12afc10 search_ctx = 0x12b2b20 ret = <value optimized out> __FUNCTION__ = "mail_thread_init" #6 0x0000000000414ef3 in imap_thread (cmd=0x12a7eb0) at cmd-thread.c:90 ctx = <value optimized out> str = 0x12afbd0 #7 cmd_thread (cmd=0x12a7eb0) at cmd-thread.c:281 client = 0x12a72b0 thread_type = MAIL_THREAD_REFERENCES sargs = 0x12b04a0 args = 0x128faf8 charset = 0x128fc18 "US-ASCII" str = 0x128fc08 "REFERENCES" ret = <value optimized out> #8 0x00000000004181fd in command_exec (cmd=0x12a7eb0) at imap-commands.c:158 hook = 0x128d110 ret = <value optimized out> #9 0x00000000004172e0 in client_command_input (cmd=0x12a7eb0) at imap-client.c:778 client = 0x12a72b0 command = <value optimized out> __FUNCTION__ = "client_command_input" #10 0x0000000000417376 in client_command_input (cmd=0x12a7eb0) at imap-client.c:839 client = 0x12a72b0 command = 0x12acd00 __FUNCTION__ = "client_command_input" #11 0x000000000041765d in client_handle_next_command (client=0x12a72b0) at imap-client.c:877 No locals. #12 client_handle_input (client=0x12a72b0) at imap-client.c:889 _data_stack_cur_id = 3 ret = 80 remove_io = <value optimized out> handled_commands = false ---Type <return> to continue, or q <return> to quit--- __FUNCTION__ = "client_handle_input" #13 0x00000000004179ef in client_input (client=0x12a72b0) at imap-client.c:931 cmd = <value optimized out> output = 0x12a7cf0 bytes = <value optimized out> __FUNCTION__ = "client_input" #14 0x00007f7dd869808e in io_loop_call_io (io=0x12a7dc0) at ioloop.c:441 ioloop = 0x128c760 t_id = 2 __FUNCTION__ = "io_loop_call_io" #15 0x00007f7dd869923f in io_loop_handler_run_internal (ioloop=<value optimized out>) at ioloop-epoll.c:220 ctx = 0x128d3f0 event = 0x128e260 list = 0x128ee50 io = 0x12acde0 tv = {tv_sec = 4, tv_usec = 996567} msecs = <value optimized out> ret = 1 i = 0 call = false __FUNCTION__ = "io_loop_handler_run_internal" #16 0x00007f7dd8698119 in io_loop_handler_run (ioloop=0x12acde0) at ioloop.c:488 No locals. #17 0x00007f7dd86981a8 in io_loop_run (ioloop=0x128c760) at ioloop.c:465 __FUNCTION__ = "io_loop_run" #18 0x00007f7dd8645153 in master_service_run (service=0x128c5f0, callback=0x20fa) at master-service.c:566 No locals. #19 0x0000000000420f87 in main (argc=1, argv=0x128c3a0) at main.c:410 set_roots = {0x428fc0, 0x0} login_set = {auth_socket_path = 0x1284050 "\210@(\001", postlogin_socket_path = 0x0, postlogin_timeout_secs = 60, callback = 0x421180 <login_client_connected>, failure_callback = 0x421120 <login_client_failed>, request_auth_token = 1} service_flags = <value optimized out> storage_service_flags = MAIL_STORAGE_SERVICE_FLAG_DISALLOW_ROOT username = 0x0 c = <value optimized out> -----> end backtrace <----- Have you any idea how I can solve this? Many thanks Urban Loesch doveconf -n: ... # 2.2.13 (38cd37cea8b1): /etc/dovecot/dovecot.conf # OS: Linux 3.4.67-vs2.3.3.9-rol-em64t-efigpt x86_64 Debian 6.0.9 ext4 auth_cache_negative_ttl = 0 auth_cache_size = 80 M auth_cache_ttl = 1 weeks auth_mechanisms = plain login auth_verbose = yes default_client_limit = 2000 deliver_log_format = msgid=%m: %$ %p %w disable_plaintext_auth = no login_trusted_networks = INTERNAL_IPS mail_gid = mailstore mail_location = mdbox:/home/vmail/%d/%n:INDEX=/home/dovecotindex/%d/%n mail_log_prefix = "%s(%u pid:%p session:<%{session}>): " mail_plugins = " quota mail_log notify zlib" mail_uid = mailstore mailbox_idle_check_interval = 1 mins managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave duplicate imapflags notify mdbox_rotate_size = 10 M namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Items" { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = separator = / type = private } passdb { args = /etc/dovecot/dovecot-sql-account.conf driver = sql } plugin { mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename flag_change save mailbox_create append mail_log_fields = uid box msgid size from mail_log_group_events = no quota = dict:Storage used::file:%h/dovecot-quota quota_rule2 = Trash:storage=+100M quota_warning = storage=95%% quota-warning 95 %u quota_warning2 = storage=80%% quota-warning 80 %u sieve = ~/.dovecot.sieve sieve_dir = ~/sieve sieve_extensions = +notify +imapflags sieve_max_redirects = 15 zlib_save = gz zlib_save_level = 9 } protocols = imap pop3 lmtp sieve service auth-worker { service_count = 0 vsz_limit = 512 M } service auth { unix_listener auth-userdb { group = mailstore mode = 0660 user = root } } service imap-login { inet_listener imap { port = 143 } process_limit = 256 process_min_avail = 50 service_count = 1 } service imap { process_limit = 2048 process_min_avail = 50 service_count = 1 vsz_limit = 512 M } service lmtp { inet_listener lmtp { address = * port = 24 } unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0666 user = postfix } } service pop3-login { inet_listener pop3 { port = 110 } process_limit = 256 process_min_avail = 25 service_count = 1 } service pop3 { process_limit = 256 process_min_avail = 25 service_count = 1 } service quota-warning { executable = script /usr/local/rol/dovecot/quota-warning.sh unix_listener quota-warning { user = mailstore } user = mailstore } ssl = no ssl_cert = </etc/dovecot/ssl/dovecot.pem ssl_key = </etc/dovecot/ssl/dovecot.key userdb { args = /etc/dovecot/dovecot-sql-account.conf driver = sql } protocol lmtp { mail_fsync = optimized mail_plugins = " quota mail_log notify zlib sieve zlib" } protocol imap { imap_client_workarounds = tb-extra-mailbox-sep imap_id_log = * imap_logout_format = bytes=%i/%o session=<%{session}> mail_max_userip_connections = 40 mail_plugins = " quota mail_log notify zlib imap_quota imap_zlib" } protocol pop3 { mail_plugins = " quota mail_log notify zlib" pop3_logout_format = bytes_sent=%o top=%t/%p, retr=%r/%b, del=%d/%m, size=%s uidl_hash=%u session=<%{session}> } ....

2 2

Bug in quota_get_status
by Franz Knipp 03 Jul '14

03 Jul '14

Hi, the configuration option lmtp_rcpt_check_quota = yes didn't work, so I traced down the problem: quota_get_status (quota_storage.c:89) calls quota_test_alloc (quota.c:1352) with size = 0 bytes, which leads always to a FALSE result in quota_is_over (quota.c:1305). I've fixed the function quota_is_over by considering ctx->bytes_over and ctx->count_over. See the included patch. Kind regards, Franz -- Franz Knipp, +43 664 3980169 qnipp GmbH, Hauptstraße 54, 7064 Oslip, Österreich http://qnipp.com http://qnipp.com/qnipp.vcf

3 3

Mailboxes are in Maildir format. Any good backup tips? Had success with version control?
by deoren 03 Jul '14

03 Jul '14

I'm still pretty new to running a mail server, but one thing I've come to appreciate over the years is a good backup strategy. Since I have always run my own servers for practice and for personal use I don't have access to Enterprise backup solutions. Because of that I usually just fall back to scripts and tarballs and offload the content on a regular basis. Right now I'm using LVM snapshots + tarballs for daily backups, but I'd like to get better coverage for incremental changes that occur throughout the day. The size of existing content is low, but (small) changes are frequent. I went with Maildir format because based on my reading it is referred to as time tested and corruption resistant. Because individual emails are stored as separate files this also leads me to believe that a version control system (Git, SVN) would allow for easy point in time restores. I'm also going to research the GNU tar utility's support for incremental archives as that sounds promising. Suggestions and warnings are most welcome. Thanks!

15 22

[Dovecot] TLS/SSL for Win8 & Outlook
by Sebastian Goodrick 02 Jul '14

02 Jul '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello I recently upgraded to dovecot 2.1.7 (as supplied with Debian Weezy). All clients work as expected except for Outlook (2013 &2010) on Win8 with a SSL/TLS connection. (Thunderbird on Win8 and Outlook 2013 on Win 7 works fine. On my previous dovecot version 1.2.13 all clients worked.) As far as I understand, one difference is the support for TLS1.2 and SSL3. And on the client side Win8 is now connecting through the Microsoft Unified Security Protocol Provider. My logs show these issues: Dovecot: May 06 21:05:43 imap-login: Warning: SSL: where=0x2002, ret=-1: SSLv3 read client certificate A [78.42.x.x] May 06 21:05:43 imap-login: Warning: SSL: where=0x2002, ret=-1: SSLv3 read client certificate A [78.42.x.x] May 06 21:05:43 imap-login: Warning: SSL failed: where=0x2002: SSLv3 read client certificate A [78.42.x.x] May 06 21:05:43 imap-login: Info: Disconnected (no auth attempts in 0 secs): user=<>, rip=78.42.x.x, lip=144.76.x.x, TLS handshaking: Disconnect Outlook 2013 (contains German, translation in []): IMAP: 12:30:02 [db] Mit 'mail.xxx.de' wird eine Verbindung an Port 143 hergestellt. [A connection to port 143 is established with 'mail.xxx.de'] [snip] IMAP: 12:30:02 [rx] * OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE STARTTLS AUTH=PLAIN AUTH=LOGIN AUTH=DIGEST-MD5 AUTH=CRAM-MD5] Welcome at mail.xxx.de [snip] IMAP: 12:30:02 [rx] hmpc OK Pre-login capabilities listed, post-login capabilities have more.IMAP: 12:30:02 [tx] ekum STARTTLS IMAP: 12:30:02 [db] OnNotify: asOld = 5, asNew = 5, ae = 3 IMAP: 12:30:02 [rx] ekum OK Begin TLS negotiation now. IMAP: 12:30:02 [db] Mit 'Microsoft Unified Security Protocol Provider' wird eine sichere Verbindung ausgehandelt. [A secure connection is negotiated with 'Microsoft Unified Security Protocol Provider'] IMAP: 12:30:02 [db] OnNotify: asOld = 5, asNew = 6, ae = 2 IMAP: 12:30:03 [db] Die Verbindung mit 'mail.xxx.de' wurde geschlossen. [Connection to 'mail.xxx.de' has been closed.] IMAP: 12:30:03 [db] OnNotify: asOld = 6, asNew = 0, ae = 5 IMAP: 12:30:03 [db] ERROR: "Es kann keine sichere Verbindung mit dem Server hergestellt werden.", hr=2148322330 [Can't establish a secure connection with the server.] My settings for ssl_protocols and ssl_cipher_list are empty. Since it works with most clients, I assume no broken certificates or my dovecot configuration. The connection fails at the TLS/SSL handshake. Has anyone seen this behaviour, too? Is there a setting (for ssl_protocols and ssl_cipher_list) to support Outlook on Win8? Thanks, Sebastian -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iEYEARECAAYFAlNqhkwACgkQR7+YB0QzbnqEFQCdHBPPpFB/pqgZ9FR81h/vcGy5 hkoAn2iuq+AUwQCN3yEtGIWuPAfpm2bs =WrvL -----END PGP SIGNATURE-----

6 29

[Dovecot] lazy_expunge and shared folders
by Florian 02 Jul '14

02 Jul '14

Hi, since migration to Dovecot 2.2 I have troubles with lazy_expunge as soon as a user shares a folder. The user the folder is shared to cannot login anymore, dovecot logs Fatal: lazy_expunge: Unknown namespace: '.EXPUNGED/' - When no folder is shared lazy_expunge is working fine, deleted mails are moved to the expunged namespace and can be recovered without any problems. - Sharing folders works as long as I disable lazy_expunge. I have used the config (with minor changes) with dovecot 2.0 for years without any problem. Switching to dovecot 2.2.10 (atrps repository) or 2.2.12 (dovecot enterprise repo) lazy_expunge and acl do not work together anymore. Is it a bug, a known limitation or is something wrong with my config? Any hints are welcome. Thanks in advance, Florian dovecot -n # 2.2.12.12 (03196f188677): /etc/dovecot/dovecot.conf # OS: Linux 2.6.32-042stab085.20 x86_64 CentOS release 6.5 (Final) auth_cache_negative_ttl = 10 mins auth_cache_size = 10 M auth_cache_ttl = 2 hours auth_failure_delay = 10 secs auth_mechanisms = plain login auth_socket_path = /var/run/dovecot/auth-userdb base_dir = /var/run/dovecot/ disable_plaintext_auth = no first_valid_gid = 105 first_valid_uid = 105 hostname = ... imap_client_workarounds = delay-newmail tb-extra-mailbox-sep tb-lsub-flags imap_idle_notify_interval = 10 mins last_valid_uid = 105 listen = ... lmtp_save_to_detail_mailbox = yes login_log_format_elements = user=<%u> method=%m rip=%r lip=%l mpid=%e %c mail_gid = vimap mail_home = /var/imap/spool/%1n/%n mail_location = mdbox:~/mdbox mail_plugins = " fts fts_lucene acl" mail_temp_dir = /var/imap/tmp mail_uid = vimap managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave mbox_write_locks = fcntl mdbox_rotate_interval = 1 days namespace { list = children location = mdbox:/var/imap/spool/%%1n/%%n/mdbox:INDEXPVT=/var/imap/spool/%1n/%n/mdbox/shared/%%u prefix = User/%%u/ separator = / subscriptions = no type = shared } namespace expunged { hidden = yes list = no location = mdbox:/var/imap/spool/%1n/%n/mdbox:MAILBOXDIR=expunged prefix = .EXPUNGED/ separator = / subscriptions = no type = private } namespace inbox { inbox = yes location = mdbox:/var/imap/spool/%1n/%n/mdbox mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Learn { auto = subscribe } mailbox Learn/Ham { auto = subscribe } mailbox Learn/Spam { auto = subscribe } mailbox Sent { auto = subscribe special_use = \Sent } mailbox Spam { auto = subscribe special_use = \Junk } mailbox Trash { auto = subscribe special_use = \Trash } mailbox virtual/All { special_use = \All } mailbox virtual/Flagged { special_use = \Flagged } prefix = separator = / type = private } passdb { args = /etc/dovecot/master-users driver = passwd-file master = yes } passdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } passdb { args = /etc/dovecot/extra-users driver = passwd-file } plugin { acl = vfile:/var/imap/global-acls:cache_secs=300 acl_shared_dict = file:/var/imap/shared-mailboxes/shared-mailboxes fts = lucene fts_autoindex = yes fts_lucene = whitespace_chars=@. lazy_expunge = .EXPUNGED/ lazy_expunge_only_last_instance = yes recipient_delimiter = + sieve = ~/.dovecot.sieve sieve_dir = ~/sieve sieve_max_actions = 32 sieve_max_redirects = 4 sieve_max_script_size = 1M } pop3_client_workarounds = outlook-no-nuls oe-ns-eoh postmaster_address = postmaster@... protocols = imap pop3 lmtp sieve service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } unix_listener auth-userdb { group = vimap mode = 0600 user = vimap } user = $default_internal_user } service imap-login { process_min_avail = 4 service_count = 0 } service imap { process_limit = 1024 vsz_limit = 256 M } service lmtp { inet_listener lmtp { address = ... port = 24 } } service managesieve-login { inet_listener sieve { port = 4190 } inet_listener sieve_deprecated { port = 2000 } service_count = 1 vsz_limit = 64 M } service pop3-login { inet_listener pop3s { port = 995 ssl = yes } process_min_avail = 4 service_count = 0 } service pop3 { process_limit = 512 } ssl_cert = </etc/dovecot/ssl/... ssl_key = </etc/dovecot/ssl/... userdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } userdb { args = uid=vimap gid=vimap home=/var/imap/spool/%1n/%n driver = static } protocol lda { mail_plugins = " fts fts_lucene acl sieve" } protocol imap { mail_max_userip_connections = 20 mail_plugins = " fts fts_lucene acl imap_acl" } protocol lmtp { mail_plugins = " fts fts_lucene acl sieve" } protocol sieve { mail_max_userip_connections = 10 managesieve_implementation_string = Dovecot Pigeonhole managesieve_logout_format = bytes=%i/%o managesieve_max_line_length = 65536 } protocol pop3 { mail_max_userip_connections = 20 }

4 4

Imaptest script testing
by kaustubh 02 Jul '14

02 Jul '14

http://www.imapwiki.org/ImapTest/ <http://www.imapwiki.org/ImapTest/> I am doing imap testing using imaptest scripts. But, i am unable to append message. APPEND INBOX "15-Jun-2015 05:30:05 -0700" "From:abc@gmail.com" "Subject: test. HI this is msg". This command i am using in my testing script. Command executed properly. But, it is not appending mail which is i entered into command. Imaptest appending his own mail into mailbox. please tell me whether i am doing it wrong way. How to append msg i entered into command using imaptest ?? -- View this message in context: http://dovecot.2317879.n4.nabble.com/Imaptest-script-testing-tp48607.html Sent from the Dovecot mailing list archive at Nabble.com.

2 1

Managing users and home dirs
by deano-dovecot＠areyes.com 02 Jul '14

02 Jul '14

For those of you using virtual users, and SQL, how are you managing your users and their home dirs ? That is, what process do you use for adding/deleting users, creating their home dirs etc ? I suppose it's easy enough to do manually, inserting rows in the database, creating dirs, chown/chmod yada yada, but there must be a better way to do it ... If you're doing dovecot replication then it gets even more cumbersome, having to duplicate the effort in two places (and make sure it's correct). I have a nice test setup using Percona XtraDB Clustering in a 3-node cluster which works swimmingly, albeit in VMs only at the moment. A master DB node and two dovecot nodes. Dovecot replication is up and running nicely too, and I almost have all the communications going over ipsec tunnels, so it will be nice and secure. I'm thinking of something like a cronjob with two tasks, the first would periodically scan the home dirs and compare the users to what's in the database. When it finds a new userdir (plus a file labeled PASSWD) the script would add the user to the database, create the Maildir and whatever else, then delete the PASSWD file. DB replication will push that to the other nodes. The second task is scanning the user database and comparing to the home dirs - basically opposite of the first cronjob. When it finds a user in the DB that doesn't have a home dir, it would create it and whatever else is needed. This way, to add a user one would just create a PASSWD file in /var/mail/domain.com/newusername/PASSWD on either of the dovecot replication partner systems. The first cronjob task would discover the newusername dir, create the user in the DB, create the Maildir, chown/chmod etc. and delete the PASSWD file, so it's ready to go on that system. DB replication pushes the user table to the other nodes. The second task on the other dovecot system will discover a new user in the DB that doesn't have a home dir, and do its thing to create it all. So the whole create-a-new-user process becomes something like this on either dovecot system : mkdir -p /var/mail/domain.com/newusername ; echo "changeme" > /var/mail/domain.com/newusername/PASSWD A max of 5 minutes later the user is added to the database, and the home dir/Maildir/etc/etc is created on both dovecot systems. D.

2 2

i need a little advice with dovecot master user
by Francesco 02 Jul '14

02 Jul '14

Hello, As a step to migrate to a newer version of dovecot, i've been asked to configure a master user for logging in into mailboxes of a dovecot 1.2. I've followed the instructions from this page: http://wiki1.dovecot.org/Authentication/MasterUsers but appearently something is going wrong. I've turned on the auth verbose and what i get in the log is: 2014-06-30 15:25:03 auth(default): Info: passdb(administrator,127.0.0.1,master): Master user logging in as user(a)domain.tld but the output from a telnet session says: Trying 127.0.0.1... Connected to localhost.localdomain. Escape character is '^]'. * OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE STARTTLS AUTH=LOGIN AUTH=PLAIN] server ready. a1 login user(a)domain.tld*administrator <administrator password> a1 NO [AUTHORIZATIONFAILED] Authorization failed what i noticed is that if i type a wrong password i get an AUTHENTICATIONFAILED, which, to me, sounds different from authorization. what am i doing wrong? here is the auth configuration: ____________________________________ auth_master_user_separator=* auth default { mechanisms = login plain passdb sql { args = /etc/dovecot/dovecot-sql.conf } passdb passwd-file { args = /etc/dovecot/passwd.masterusers master = yes pass = yes } userdb sql { args = /etc/dovecot/dovecot-sql.conf } userdb static { args = uid=65000 gid=65000 mail=maildir:/var/utenti/ADS/%Lu/Maildir } passdb pam { } user = root socket listen { client { path = /var/spool/postfix/private/auth mode = 0660 user = postfix group = postfix } } } ____________________________________

2 1

Login failure with SElinux enforcing + Sqlite user DB
by G H 30 Jun '14

30 Jun '14

I am having a very strange issue with Dovecot + Sqlite + SELinux in enforcing. I am able to log in via IMAPS if SELinux is in permissive, but not able to do so when in enforcing. I do not see any SELinux denials even with dontaudit's enabled. I am running Centos 5 on x86_64 with a customized kernel build and SElinux Strict policy. The log dumps below are in the following order: 1. My syslog output when SElinux is enforcing 2. My mail client's protocol log (using Sylpheed) 3. My syslog output when SElinux is permissive. From the audit log, syscall 2 (from the message "type=SYSCALL ... syscall=2 success=no" appears to be sys_open for x86_64 architectures. syscall 87 is sys_unlink. Why is my mail client getting a SQL error message even though dovecot's auth log reported login success? Is this a sqlite problem instead of a dovecot one? FYI, I am using dovecot-2.2.10 (from ATrpms.net) and sqlite-3.3.6-7 There appears to be several options related to the temporary store on sqlite's documentation, the solution may be to use memory (instead of files) for temporary tables... dovecot: auth-worker(29695): Debug: Module loaded: /usr/lib64/dovecot/auth/libdriver_mysql.so dovecot: auth-worker(29695): Debug: Module loaded: /usr/lib64/dovecot/auth/libdriver_pgsql.so dovecot: auth-worker(29695): Debug: Module loaded: /usr/lib64/dovecot/auth/libdriver_sqlite.so dovecot: auth-worker(29695): Debug: sql(mailadmin,10.0.77.80): query: SELECT password FROM users WHERE username = 'mailadmin' dovecot: auth: Debug: client passdb out: OK 1 user=mailadmin dovecot: auth: Debug: master in: REQUEST 3487432705 29692 1 17d4d0374be5dec51ce20917470caed8 session_pid=29696 request_auth_token dovecot: auth-worker(29695): Debug: sql(mailadmin,10.0.77.80): SELECT username FROM users WHERE username = 'mailadmin' AND view_mail = 't' AND 'imap' = 'imap' dovecot: auth: Debug: master userdb out: USER 3487432705 mailadmin uid=97 gid=12 home=/var/mail/mailadmin auth_token=e0d0ed3080574ab089f1a5302d43110ffa15ec42 dovecot: imap-login: Login: user=<mailadmin>, method=PLAIN, rip=10.0.77.80, lip=10.0.78.223, mpid=29696, TLS, session=<0C+M3A/9OwCsEQFQ> audispd: node=myhost.somewhere type=SYSCALL msg=audit(1404144473.421:46298): arch=c000003e syscall=2 success=no exit=-13 a0=7fff97f77ce0 a1=c2 a2=1a4 a3=0 items=1 ppid=29697 pid=29699 auid=7033 uid=8 gid=12 euid=8 suid=8 fsuid=8 egid=12 sgid=12 fsgid=12 tty=(none) ses=108 comm="sqlite3" exe="/usr/bin/sqlite3" subj=system_u:system_r:dovecot_t:s0 key="access" audispd: node=myhost.somewhere type=CWD msg=audit(1404144473.421:46298): cwd="/var/run/dovecot" audispd: node=myhost.somewhere type=PATH msg=audit(1404144473.421:46298): item=0 name="./sqlite_ZPh8vGq4ia1CCsJ" inode=8192027 dev=fb:02 mode=040755 ouid=0 ogid=97 rdev=00:00 obj=system_u:object_r:dovecot_var_run_t:s0 audispd: node=myhost.somewhere type=EOE msg=audit(1404144473.421:46298): audispd: node=myhost.somewhere type=SYSCALL msg=audit(1404144473.422:46299): arch=c000003e syscall=2 success=no exit=-13 a0=7fff97f77ce0 a1=c2 a2=1a4 a3=0 items=1 ppid=29697 pid=29699 auid=7033 uid=8 gid=12 euid=8 suid=8 fsuid=8 egid=12 sgid=12 fsgid=12 tty=(none) ses=108 comm="sqlite3" exe="/usr/bin/sqlite3" subj=system_u:system_r:dovecot_t:s0 key="access" audispd: node=myhost.somewhere type=CWD msg=audit(1404144473.422:46299): cwd="/var/run/dovecot" audispd: node=myhost.somewhere type=PATH msg=audit(1404144473.422:46299): item=0 name="./sqlite_9i9aIbK0rBuJWFS" inode=8192027 dev=fb:02 mode=040755 ouid=0 ogid=97 rdev=00:00 obj=system_u:object_r:dovecot_var_run_t:s0 ... REPEATED MANY TIMES ... audispd: node=myhost.somewhere type=SYSCALL msg=audit(1404145638.097:46407): arch=c000003e syscall=87 success=yes exit=0 a0=608872 a1=60aa50 a2=60e0d0 a3=0 items=2 ppid=29774 pid=29776 auid=7033 uid=8 gid=12 euid=8 suid=8 fsuid=8 egid=12 sgid=12 fsgid=12 tty=(none) ses=108 comm="sqlite3" exe="/usr/bin/sqlite3" subj=system_u:system_r:dovecot_t:s0 key="delete" audispd: node=myhost.somewhere type=CWD msg=audit(1404145638.097:46407): cwd="/var/run/dovecot" dovecot: imap(mailadmin): Debug: Effective uid=97, gid=12, home=/var/mail/mailadmin dovecot: imap(mailadmin): Debug: Namespace inbox: type=private, prefix=, sep=, inbox=yes, hidden=no, list=yes, subscriptions=yes location=mdbox:/var/mail/mailadmin dovecot: imap(mailadmin): Debug: fs: root=/var/mail/mailadmin, index=, indexpvt=, control=, inbox=, alt= audispd: node=myhost.somewhere type=PATH msg=audit(1404145638.097:46407): item=0 name="/var/lib/maildb/" inode=3735776 dev=fb:02 mode=040775 ouid=0 ogid=12 rdev=00:00 obj=system_u:object_r:var_lib_t:s0 audispd: node=myhost.somewhere type=PATH msg=audit(1404145638.097:46407): item=1 name="/var/lib/maildb/users.db-journal" inode=3735779 dev=fb:02 mode=0100600 ouid=8 ogid=12 rdev=00:00 obj=system_u:object_r:var_lib_t:s0 audispd: node=myhost.somewhere type=EOE msg=audit(1404145638.097:46407): * creating IMAP4 connection to 10.0.78.223:993 ... * SSL certificate of 10.0.78.223 previously accepted [12:17:37] IMAP4< * OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE AUTH=PLAIN] Dovecot ready. [12:17:37] IMAP4> 1 CAPABILITY [12:17:37] IMAP4< * CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE AUTH=PLAIN [12:17:37] IMAP4< 1 OK Pre-login capabilities listed, post-login capabilities have more. [12:17:37] IMAP4> 2 AUTHENTICATE PLAIN [12:17:37] IMAP4< + [12:17:37] IMAP4> **************** [12:17:37] IMAP4< SQL error: unable to open database file ** LibSylph-WARNING: [12:17:37] IMAP4 authentication failed. dovecot: auth-worker(29747): Debug: Module loaded: /usr/lib64/dovecot/auth/libdriver_mysql.so dovecot: auth-worker(29747): Debug: Module loaded: /usr/lib64/dovecot/auth/libdriver_pgsql.so dovecot: auth-worker(29747): Debug: Module loaded: /usr/lib64/dovecot/auth/libdriver_sqlite.so dovecot: auth-worker(29747): Debug: sql(mailadmin,10.0.77.80): query: SELECT password FROM users WHERE username = 'mailadmin' dovecot: auth: Debug: client passdb out: OK 1 user=mailadmin dovecot: auth: Debug: master in: REQUEST 1811939329 29745 1 8ec504decee63fdeb7c94b1193a70872 session_pid=29748 request_auth_token dovecot: auth-worker(29747): Debug: sql(mailadmin,10.0.77.80): SELECT username FROM users WHERE username = 'mailadmin' AND view_mail = 't' AND 'imap' = 'imap' dovecot: auth: Debug: master userdb out: USER 1811939329 mailadmin uid=97 gid=12 home=/var/mail/mailadmin auth_token=2015ca3583c60fd9108a639c35c066d2613a2219 dovecot: imap-login: Login: user=<mailadmin>, method=PLAIN, rip=10.0.77.80, lip=10.0.78.223, mpid=29748, TLS, session=<BkhN7Q/9wACsEQFQ> audispd: node=myhost.somewhere type=SYSCALL msg=audit(1404144754.513:46369): arch=c000003e syscall=87 success=yes exit=0 a0=7fffc59431a0 a1=0 a2=7ffa4c972b40 a3=0 items=2 ppid=29749 pid=29751 auid=7033 uid=8 gid=12 euid=8 suid=8 fsuid=8 egid=12 sgid=12 fsgid=12 tty=(none) ses=108 comm="sqlite3" exe="/usr/bin/sqlite3" subj=system_u:system_r:dovecot_t:s0 key="delete" audispd: node=myhost.somewhere type=CWD msg=audit(1404144754.513:46369): cwd="/var/run/dovecot" audispd: node=myhost.somewhere type=PATH msg=audit(1404144754.513:46369): item=0 name="/var/tmp/" inode=2 dev=fb:01 mode=041777 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:tmp_t:s0 audispd: node=myhost.somewhere type=PATH msg=audit(1404144754.513:46369): item=1 name="/var/tmp/sqlite_vxCdWSgpDUDm7VV" inode=98307 dev=fb:01 mode=0100600 ouid=8 ogid=12 rdev=00:00 obj=system_u:object_r:tmp_t:s0 audispd: node=myhost.somewhere type=EOE msg=audit(1404144754.513:46369): audispd: node=myhost.somewhere type=SYSCALL msg=audit(1404144754.513:46370): arch=c000003e syscall=87 success=yes exit=0 a0=7fffc59431a0 a1=0 a2=7ffa4c972b40 a3=0 items=2 ppid=29749 pid=29751 auid=7033 uid=8 gid=12 euid=8 suid=8 fsuid=8 egid=12 sgid=12 fsgid=12 tty=(none) ses=108 comm="sqlite3" exe="/usr/bin/sqlite3" subj=system_u:system_r:dovecot_t:s0 key="delete" audispd: node=myhost.somewhere type=CWD msg=audit(1404144754.513:46370): cwd="/var/run/dovecot" audispd: node=myhost.somewhere type=PATH msg=audit(1404144754.513:46370): item=0 name="/var/tmp/" inode=2 dev=fb:01 mode=041777 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:tmp_t:s0 audispd: node=myhost.somewhere type=PATH msg=audit(1404144754.513:46370): item=1 name="/var/tmp/sqlite_4h8lCyF8htbWvZb" inode=98310 dev=fb:01 mode=0100600 ouid=8 ogid=12 rdev=00:00 obj=system_u:object_r:tmp_t:s0 audispd: node=myhost.somewhere type=EOE msg=audit(1404144754.513:46370): ... REPEATED MANY TIMES ... audispd: node=myhost.somewhere type=SYSCALL msg=audit(1404144754.533:46373): arch=c000003e syscall=87 success=yes exit=0 a0=608872 a1=60aa50 a2=60e0d0 a3=0 items=2 ppid=29749 pid=29751 auid=7033 uid=8 gid=12 euid=8 suid=8 fsuid=8 egid=12 sgid=12 fsgid=12 tty=(none) ses=108 comm="sqlite3" exe="/usr/bin/sqlite3" subj=system_u:system_r:dovecot_t:s0 key="delete" audispd: node=myhost.somewhere type=CWD msg=audit(1404144754.533:46373): cwd="/var/run/dovecot" audispd: node=myhost.somewhere type=PATH msg=audit(1404144754.533:46373): item=0 name="/var/lib/maildb/" inode=3735776 dev=fb:02 mode=040775 ouid=0 ogid=12 rdev=00:00 obj=system_u:object_r:var_lib_t:s0 audispd: node=myhost.somewhere type=PATH msg=audit(1404144754.533:46373): item=1 name="/var/lib/maildb/users.db-journal" inode=3735779 dev=fb:02 mode=0100600 ouid=8 ogid=12 rdev=00:00 obj=system_u:object_r:var_lib_t:s0 audispd: node=myhost.somewhere type=EOE msg=audit(1404144754.533:46373): dovecot: imap(mailadmin): Debug: Effective uid=97, gid=12, home=/var/mail/mailadmin dovecot: imap(mailadmin): Debug: Namespace inbox: type=private, prefix=, sep=, inbox=yes, hidden=no, list=yes, subscriptions=yes location=mdbox:/var/mail/mailadmin dovecot: imap(mailadmin): Debug: fs: root=/var/mail/mailadmin, index=, indexpvt=, control=, inbox=, alt=

1 0

unsubscribe
by Dave Gattis 30 Jun '14

30 Jun '14

Dave Gattis Suhner Manufacturing, Inc. IT Manager 43 Anderson Rd SW Rome, GA 30161 Phone: 706-314-2943 Fax: 706-235-8045 <mailto:dave.gattis@suhner.com> dave.gattis(a)suhner.com <http://www.suhner.com/> www.suhner.com Description: Description: Description: suhner_100_logo_standard NOTE: This message and all attachments should be considered confidential and proprietary to Suhner Manufacturing Inc and are intended only for the individual or company to whom addressed, and only for the purpose stated or intended. Any other viewing, copying, distribution or other use of this information is prohibited. If you received this message in error, please immediately notify the sender and then delete.

2 1