October 2016 - dovecot

Requiring client certificate on only one interface
by Braden Thomas 02 Oct '16

02 Oct '16

Hi, I'm trying to require client certificates on only one interface. I'm running dovecot 2.1.7. There have been a couple of recent threads about this kind of configuration: http://dovecot.org/list/dovecot/2016-August/105244.html (Aug 2016) http://www.dovecot.org/list/dovecot/2016-February/103067.html (Feb 2016) However, these threads recommend an approach that no longer works. Specifically, the "-l" or "-P" arguments to imap-login no longer work. Is there currently a recommended way to configure dovecot like this? Braden

1 0

Re: Bug: Shared Mailbox - Case Sensitivity
by Aki Tuomi 01 Oct '16

01 Oct '16

Can you provide doveconf -n? ---Aki TuomiDovecot oy -------- Original message --------From: Leander Schäfer <info(a)netocean.de> Date: 01/10/2016 03:41 (GMT+02:00) To: Aki Tuomi <aki.tuomi(a)dovecot.fi>, Dovecot Mailing List <dovecot(a)dovecot.org>, Timo Sirainen <tss(a)iki.fi> Subject: Re: Bug: Shared Mailbox - Case Sensitivity Am I missing something, or might this be a bug as it seems to me? Am 16.09.16 um 14:21 schrieb Leander Schäfer: > Hi Aki, > > > Thanks for your advice. Yes, I'm aware of this. Yet lowercasing should > be the default since Dovecot 2.1.x., isn't it? Yet I wouldn't know > where exactly to implement this %L, since the ACLs are set through > IMAP commands through the users mailclient like Thunderbird. So in > other words, the email address to whom the user want to grant ACLs > provided by the user's mailclient, has nothing to do with my auth > backend where e.g. %u => %Lu would apply. PLease correct me if I'm > wrong here. > > > It clearly looks like a bug of the internal processing of the > "dovecot-acl-list" files. It simply lacks on a lowercase enforcement > in the code, like it already seems to do for the "dovecot-acl" file. > > > Best regards > > Leander Schäfer > > > > Am 16.09.16 um 12:53 schrieb Aki Tuomi: >> >> On 16.09.2016 12:54, Leander Schäfer wrote: >>> Hi, >>> >>> unfortunately I found a bug in Dovecot's ACL handling for shared >>> mailboxes. It turns out Dovecot doesn't enforce lower casing the >>> privileged username to whom the mailbox should be shared to. This >>> results in a invalid configuration. Users get confused, since they >>> passed on a valid email address in their ACL setup. >>> >>> /usr/local/www/default/mail/test(a)mydomain.localdomain/maildir/.Spam/dovecot-acl >>> >>> >>> user=leander(a)mydomain.localdomain eilrwts >>> ^^ works >>> >>> /usr/local/www/default/mail/leander(a)mydomain.localdomain/maildir/dovecot-acl >>> >>> >>> user=test(a)mydomain.localdomain eilrwts >>> ^^ works >>> >>> /usr/local/www/default/mail/test(a)mydomain.localdomain/maildir/.Drafts/dovecot-acl >>> >>> >>> user=Leander(a)MyDomain.LocalDomain eilrwts >>> ^^ Doesn't work >>> >>> Best regards >>> Leander Schäfer >> Hi! Did you know you can use %Lu instead of %u to force lowercasing? >> >> Aki

1 0

Re: NFSv4 and Maildir
by Joseph Tam 01 Oct '16

01 Oct '16

> we have a setup with (CentOS 6) Director+Dovecot, Maildir as storage on > NetApp NFS v3. Every time I try to switch to NFS v4 I found issue with > lock (and others). So for me NFSv4 with Maildir is "unstable" or need a > fine tuning that I don't know. I found the same thing, and turning off write delegation seemed to have solved the problem. I still don't know why, though. Joseph Tam <jtam.home(a)gmail.com>

2 1

Bug: Shared Mailbox - Case Sensitivity
by Leander Schäfer 01 Oct '16

01 Oct '16

Hi, unfortunately I found a bug in Dovecot's ACL handling for shared mailboxes. It turns out Dovecot doesn't enforce lower casing the privileged username to whom the mailbox should be shared to. This results in a invalid configuration. Users get confused, since they passed on a valid email address in their ACL setup. /usr/local/www/default/mail/test(a)mydomain.localdomain/maildir/.Spam/dovecot-acl user=leander(a)mydomain.localdomain eilrwts ^^ works /usr/local/www/default/mail/leander(a)mydomain.localdomain/maildir/dovecot-acl user=test(a)mydomain.localdomain eilrwts ^^ works /usr/local/www/default/mail/test(a)mydomain.localdomain/maildir/.Drafts/dovecot-acl user=Leander(a)MyDomain.LocalDomain eilrwts ^^ Doesn't work Best regards Leander Schäfer

3 4

acl_group not working not working correctly
by Leander Schäfer 01 Oct '16

01 Oct '16

Hi, I'm trying to setup group based ACLs coming from OpenLDAP. My setup doesn't require a POSIX Group match. In the Dovecot configuration file I have this: "user_attrs = [...], mailAclGroups=acl_groups" as well as "acl = vfile:/usr/local/etc/dovecot/global-acls:cache_secs=300". The user has "public" in the LDAP attribute "mailAclGroups". It seems to get everything right. I checked with doveadm - and I see public ist listed as expected: cat /var/log/debug.log [...] Sep 16 23:39:04 WM-01 dovecot: auth: Debug: client passdb out: OK 1 user=leander(a)mydomain.localdomain acl_groups=public [...] cat /usr/local/etc/dovecot/global-acls INBOX owner lrwstipekxa Drafts owner lrwstipeka Sent owner lrwstipeka Spam owner lrwstipeka Trash owner lrwstipeka Public authenticated l Public group-override=public lrwstipekx Public/* group-override=public lrwstipekx doveadm mailbox list -u leander(a)mydomain.localdomain Drafts Sent Trash Spam Shared Public Public/Service Center Shared/test(a)mydomain.localdomain Shared/test(a)mydomain.localdomain/Drafts Shared/test(a)mydomain.localdomain/Sent Shared/test(a)mydomain.localdomain/Trash Shared/test(a)mydomain.localdomain/Spam INBOX But here comes the strange thing: telnet equal to Thunderbird: . LIST "" "*" * LIST (\HasNoChildren \Drafts) "/" Drafts * LIST (\HasNoChildren \Sent) "/" Sent * LIST (\HasNoChildren \Trash) "/" Trash * LIST (\HasNoChildren \Junk) "/" Spam * LIST (\Noselect \HasChildren) "/" Shared * LIST (\HasChildren) "/" Shared/test(a)mydomain.localdomain * LIST (\HasNoChildren) "/" Shared/test(a)mydomain.localdomain/Drafts * LIST (\HasNoChildren) "/" Shared/test(a)mydomain.localdomain/Sent * LIST (\HasNoChildren) "/" Shared/test(a)mydomain.localdomain/Trash * LIST (\HasNoChildren) "/" Shared/test(a)mydomain.localdomain/Spam * LIST (\HasNoChildren) "/" INBOX . OK List completed (0.000 + 0.000 + 0.092 secs). Public and Public/* shoul be listed as well, but it isn't. Any idea why it is behaving like this? Thanks Best regards Leander Schäfer

1 1