March 2015 - dovecot - dovecot.org

core not dumped
by James 20 Mar '15

20 Mar '15

There is some underlying problem with imap-login but in order to debug it I'd like to see a core file. On error dovecot reports "core not dumped". If I put "abort()" in the code at the point it is reporting then a core file is written, so there is no OS reason why a core can not be written. It appears to be dovecot's choice to control the child. In an attempt to obtain a core file I have: service imap-login { chroot = drop_priv_before_exec = yes user = dovecot } How can I make imap-login to produce a core file? Syslog error report: Mar 18 09:22:28 MAILHOST dovecot: [ID 583609 mail.crit] imap-login: Fatal: master: service(imap-login): child 10812 killed with signal 11 (core not dumped) [last ip=111.222.333.444] Should anyone care at this point (before I've looked at a core file) the error is related to; imap-login: Disconnected (no auth attempts in 0 secs): user=<>, James.

3 4

Re: fast doveadm search results
by Joseph Tam 20 Mar '15

20 Mar '15

Vu Ngoc VU <vvu(a)mcra.fr> writes: > My goal is to be able to find mails quickly with "doveadm search". > We are using dovecot in a corporate. And some managers, sometimes ask to delete some messages. > These messages are "unwanted" ones: mistakenly sent, defamatory... > > So, that situations appear rarely, but when asked, they expected me to > deleted quickly these messages from few to thousands of users > mailboxes. > > Is that possible to change behaviour of Dovecot, some headers like > sender, message-id, date are stored in cache for at least 48h? (7 days > would be better). So is this a fair summary of what you are asking: you want to load dovecot's caches with searchable items (i.e. specified headers) *and* have them expire and removed from caches after a preset amount of time? Caches are persistent: once an item is cached, it stays in the cache. I can't think of a good way to purge them without a lot of bother, but maybe you don't really need this. If you want to preload the cache with searchable items, you can periodically run a search/fetch command, which will load the cache with headers you want. http://www.dovecot.org/list/dovecot/2010-October/053521.html Maybe you can even add these items into the cache upon delivery, but someone more knowlegable than I would have to help you with that. The FTS/Solr plugin might also help. You seem to be optimizing the wrong problem. Reading between the lines of your message, your management wants a technical solution to a human problem (someone did an oops). Joseph Tam <jtam.home(a)gmail.com>

1 0

Released Pigeonhole v0.4.7 for Dovecot v2.2.16
by Stephan Bosch 20 Mar '15

20 Mar '15

Hello Dovecot users, Here is the final 0.4.7 release. No changes were committed since the last release candidate. Changelog v0.4.7: * editheader extension: Made protection against addition and deletion of headers configurable separately. Also, the `Received' and `Auto-Submitted' headers are no longer protected against addition by default. * Turned message envelope address parse errors into warnings. * The interpreter now accepts non-standard domain names, e.g. containing '_'. + Implemented the Sieve index extension (RFC 5260). + Implemented support for the mboxmetadata and servermetadata extensions (RFC 5490). + Implemented new sieve commands for the doveadm command line utility. These commands are currently limited to ManageSieve operations, but the other current sieve tools will be migrated to doveadm in the near future as well. + Added more debug output about binary up-to-date checking. + Added script metadata to binary dump output. - Fixed Sieve script binary up-to-date checking by normalizing the script location. - The Sieve interpreter now flushes the duplicate database during start phase of result execution rather than commit phase. This makes sure locks on the duplicate database are released as soon as possible, preventing contention. - Performed a few optimizations in the lexical scanner of the language. - Fixed bug in `:matches' match-type that made a pattern without wildcards match as if there were a '*' at the beginning. - Fixed crash in validation of the string parameter of the comparator tag. - extprograms extension: Made sure supplemental group privileges are also dropped. This was a problem reported by Debian lintian. - Fixed bug in handling of binary errors for action side-effects and message overrides. - file script storage: Restructured storage initialization to address backwards compatibility issues. - dict script storage: Fixed small memory allocation bug. The release is available as follows: http://pigeonhole.dovecot.org/releases/2.2/dovecot-2.2-pigeonhole-0.4.7.tar… http://pigeonhole.dovecot.org/releases/2.2/dovecot-2.2-pigeonhole-0.4.7.tar… Refer to http://pigeonhole.dovecot.org and the Dovecot v2.x wiki for more information. Have fun testing this new release and don't hesitate to notify me when there are any problems. Regards, -- Stephan Bosch stephan(a)rename-it.nl

1 0

check if anvil is working
by Leonardo Rodrigues 19 Mar '15

19 Mar '15

Hi, Is there any way of making sure the anvil service, used to penalty login fails, is working ? I dont see anything on the logs regarding it neither have it configured. It's not on my configuration files, but it can be seen on a 'dovecot -a' dump. Should it be logging something ? Should i have enabled it somehow ? Thanks for the answers. [root@correio log]# dovecot --version 2.2.13 (from dovecot -a dump) service anvil { chroot = empty client_limit = 0 drop_priv_before_exec = no executable = anvil extra_groups = group = idle_kill = 4294967295 secs privileged_group = process_limit = 1 process_min_avail = 1 protocol = service_count = 0 type = anvil unix_listener anvil-auth-penalty { group = mode = 0600 user = } unix_listener anvil { group = mode = 0600 user = } user = $default_internal_user vsz_limit = 18446744073709551615 B } -- Atenciosamente / Sincerily, Leonardo Rodrigues Solutti Tecnologia http://www.solutti.com.br Minha armadilha de SPAM, NÃO mandem email gertrudes(a)solutti.com.br My SPAMTRAP, do not email it

1 0

fast doveadm search results
by Vu Ngoc VU 19 Mar '15

19 Mar '15

hello, I've posted same question here months ago. But obtaine no answer, even not a "you question is stupid". So I don't know what to think about that. My goal is to be able to find mails quickly with "doveadm search". We are using dovecot in a corporate. And some managers, sometimes ask to delete some messages. These messages are "unwanted" ones: mistakenly sent, defamatory... So, that situations appear rarely, but when asked, they expected me to deleted quickly these messages from few to thousands of users mailboxes. Is that possible to change behaviour of Dovecot, some headers like sender, message-id, date are stored in cache for at least 48h? (7 days would be better). I've read this page : http://wiki2.dovecot.org/Design/Indexes/Cache but cannot understand every parts. "A specific decision can be forced by ORing it with MAIL_CACHE_DECISION_FORCED." Is OR in this sentence like AND/OR comparators? Where to put "MAIL_CACHE_DECISION_FORCED"? "mail-cache-decisions.c file contains the rules how Dovecot changes the decisions." <-- is it in this file? My setup is 2.2.9 on Ubuntu 14.04 running on OpenVZ containers with 2 Director and 2 imap/pop3 backends. The storage is shared via NFS. Is this the performance problem? If dovecot has metadata I want in its cache, I cannot see how this is a problem. Can these settings be useful for my case? mail_always_cache_fields = mail_cache_fields = flags mail_cache_min_mail_count = 0 mail_never_cache_fields = imap.envelope Thanks.

2 2

Support for multiple passwords?
by Conrad Kostecki 18 Mar '15

18 Mar '15

Hi! Currently, the passwords are stored in plaintext for my dovecot, as I am still using cram-md5 AND digest-md5. I have still to offer that, as I have some deprecated clients, therefore, I am unable to hash at least those passwords for that accounts. I've found on the Wiki: > In future it's possible that Dovecot could support multiple passwords > in different schemes for a single user. Is there any news about this? Are there still any plans to support this maybe in future? For my understanding, that would solve my problem, that I could define a password in both schemes (cram and digest) and don't have to use plaintext password? Cheers Conrad

3 6

passwd file for quota
by Cliff Hayes 18 Mar '15

18 Mar '15

I need to implement quota. I read as much as I could including http://wiki2.dovecot.org/HowTo/SimpleVirtualInstall But my current /etc/passwd file does not have the password in it as shown in dovecot docs ... there is an x where the password should be. I created a program that creates a passwd file in the proper format with the proper extra quota fields for all users (except it has an x where the password should be). I plan to store it in /etc/dovecot How do I get dovecot to stop looking at /etc/passwd and start looking at /etc/dovecot/passwd? And hopefully that will not affect how it gets the password (pam) because when users change their password from webmail of course dovecot will need to be looking in the same place. # dovecot -n output # 2.0.9: /etc/dovecot/dovecot.conf # OS: Linux 2.6.32-431.29.2.el6.x86_64 x86_64 Scientific Linux release 6.5 (Carbon) auth_failure_delay = 5 secs auth_username_format = %Ln auth_verbose_passwords = plain first_valid_uid = 9 mail_access_groups = mail mail_location = maildir:~/Maildir managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date mbox_write_locks = fcntl passdb { driver = pam } plugin { sieve = ~/.dovecot.sieve sieve_after = /dovecotSieveAfter/ sieve_dir = ~/sieve } protocols = imap lmtp sieve service managesieve-login { inet_listener sieve { port = 4190 } } ssl_ca = </etc/pki/dovecot/certs/intermediate20150202.crt ssl_cert = </etc/pki/dovecot/certs/avalon20150202.crt ssl_key = </etc/pki/dovecot/private/avalon20150129.key ssl_verify_client_cert = yes userdb { driver = passwd } protocol lmtp { log_path = /var/log/dovecot-lmtp.log mail_plugins = " sieve" } protocol lda { log_path = /var/log/dovecot-lda.log mail_plugins = " sieve" }

2 4

Roundcubemail problem with Dovecot
by Robert Moskowitz 18 Mar '15

18 Mar '15

I am getting "Connection to storage server failed." in roundcubemail. On doing a google search If find: http://help.directadmin.com/item.php?id=473 Which puts the problem at dovecot. I did get a dovecot update back on 3-5 and that would match to my one roundcube mail user complaining and the delays I am seeing with thunderbird and outlook users. So with my setup, I am trying to figure what are the index files to delete. Say for myself, I am seeing: /home/vmail/htt-consult.com/rgm/dovecot.index /home/vmail/htt-consult.com/rgm/dovecot.index.cache /home/vmail/htt-consult.com/rgm/dovecot.index.log /home/vmail/htt-consult.com/rgm/.Drafts/dovecot.index /home/vmail/htt-consult.com/rgm/.Drafts/dovecot.index.cache /home/vmail/htt-consult.com/rgm/.Drafts/dovecot.index.log /home/vmail/htt-consult.com/rgm/.Sent/dovecot.index /home/vmail/htt-consult.com/rgm/.Sent/dovecot.index.cache /home/vmail/htt-consult.com/rgm/.Sent/dovecot.index.log /home/vmail/htt-consult.com/rgm/.Spam/dovecot.index /home/vmail/htt-consult.com/rgm/.Spam/dovecot.index.cache /home/vmail/htt-consult.com/rgm/.Spam/dovecot.index.log /home/vmail/htt-consult.com/rgm/.Trash/dovecot.index /home/vmail/htt-consult.com/rgm/.Trash/dovecot.index.cache /home/vmail/htt-consult.com/rgm/.Trash/dovecot.index.log Do I delete all of these? The index.cache files are quite large.

1 1

Re: Dovecot current number of connections being used.
by Joseph Tam 18 Mar '15

18 Mar '15

Jaime Ventura writes: > Is there an easy way to get how many connections are being handled at a > moment? This works: doveadm who -1 2>/dev/null | wc -l If yopu only want to coutn IMAP connections (not POP3), doveadm who -1 2>/dev/null | grep -Fc imap Joseph Tam <jtam.home(a)gmail.com>

2 1

Proxying of non "plain" SASL mechnisms.
by Peter Mogensen 18 Mar '15

18 Mar '15

Hi, I understand from earlier discussions that the reason dovecot doesn't support proxying of other SASL mechanisms than those which supply the plaintext password is that in general it would be possible to proxy any SASL mechanism since it might protect against man-in-the-middle attacks (which would prevent proxying). However, that has led to choice between letting users use PLAIN (or equivalent), or to have the proxy access the target hosts by "master" password. Of course, having the plaintext password the proxy could in principle do other challenge/response SASL handshakes with the target backend, but right now only LOGIN and PLAIN is implemented. So I wondered about the rationale for not just forward the SASL handshake. - First, blindly forwardning will not do, since the mech data has to be decoded anyway to do any per/user passdb lookup (to, say, find the target host). But you don't need authentication to actually succeed to do that. You only need AuthZ-id or AuthN-id. - Secondly, the design of the interaction between imap-login processes and the auth-service in general prevent in general to forward multi-handshake SASL mechanisms, since the authentication must be done before the proxying can be started. But it doesn't prevent forwarding of single handshake SASL mechanisms which use SASL-IR. - Thirdly, while it's correct that some SASL mechanisms protect against man-in-the-middle attacks, that doesn't apply for most single-handshake SASL-IR mechanisms unless they do some kind of channel-binding. (like SASL EXTERNAL) For example, the GS2-KRB5 SASL mech would be perfectly forwarded if just the Kerberos ticket doesn't put restrictions on the client IP-address. So, why not just extend the support for proxy authentication forwarding to any single-handskake SASL-IR mechanism, which doesn't use channel-binding? (which includes PLAIN, but also GS2-KRB5, and possibly others). /Peter

2 2