June 2016 - dovecot - dovecot.org

nginx proxy to dovecot servers
by KT Walrus 03 Jun '16

03 Jun '16

I’m trying to understand how the nginx mail proxy and dovecot work. As a I understand it, nginx can listen on a IP:port for IMAP connections. NGINX then can invoke a PHP script to do authorization and backend server selection. Does NGINX than proxy to the backend dovecot IMAP server all subsequent IMAP commands that the user’s mail client requests? Does the backend dovecot IMAP server do its own authentication with another MySQL password lookup? Or, since NGINX has done the authentication, the password_query lookup is skipped on the dovecot server? I assume the dovecot IMAP server still needs to do a MySQL user_query lookup (to find the location of the user’s mailbox on the server), but I am wondering whether the password will be checked twice, once by NGINX and a second time by dovecot IMAP. Kevin

4 6

zlib corrupted data
by Angel L. Mateo 03 Jun '16

03 Jun '16

Hello, We are having performance problems with one of our users. We are having a server (2.1.16) for about 8000 users. This server is a vmware vm with 8 cores and 32GB of RAM. Normally, it is working fine, but when one of our users access his email, then the load increases a lot and this high load is maintained while the user is connected. Looking for problems with this user I have found that trying to move messages from one folder to another I have errors like: doveadm(mctm(a)um.es): Error: zlib.read(/mail/users/mailboxes/um.es/mc/mctm/mdbox/storage/m.1486): corrupted data at 30152376 doveadm(mctm(a)um.es): Error: zlib_istream.seek(/mail/users/mailboxes/um.es/mc/mctm/mdbox/storage/m.1486) failed: Invalid argument doveadm(mctm(a)um.es): Error: zlib.read(/mail/users/mailboxes/um.es/mc/mctm/mdbox/storage/m.1473): corrupted data at 7175520 doveadm(mctm(a)um.es): Error: zlib_istream.seek(/mail/users/mailboxes/um.es/mc/mctm/mdbox/storage/m.1473) failed: Invalid argument but a doveadm dump of these files shows no problem. Is there any way to debug this problem? How could I fix it? -- Angel L. Mateo Martínez Sección de Telemática Área de Tecnologías de la Información y las Comunicaciones Aplicadas (ATICA) http://www.um.es/atica Tfo: 868887590 Fax: 868888337

1 0

AD query timeout might be result size limit exceeded
by Julien Lambot 03 Jun '16

03 Jun '16

Hello list I've been struggling for a while trying to configure multiple domain ldap authentication with full e-mail address authentication. Which in fact was not the issue. There where some discrepancies between the doc and our actual configuration (see appendix A/ ) Seems that pass_filters and user_filters don't need much special settings for our setup. Now it's working correctly at the sole exception that when an OU contains "lots" of users (>200) i suspect that the ldapseach query fails. We can well authenticate when we have 50 users in an OU, but not when the number raises (I don't have the exact number above which it locks). Is there a parameter that we can set to increase the result size limit (as i suspect this to be the cause of this possible bug)? If I query manually it's ok (ldapsearch) if I use "doveadm auth user.name(a)domain.tld", it succeed also but I wonder if it doesn't use the winbind authentication instead. Here is our ldap-auth configuration hosts = master.domain.local:389 dn = DOMAIN\ro-user dnpass = password debug_level = 2 auth_bind = yes #auth_bind_userdn = cn=%u,OU=_myou,OU=Utilisateurs,OU=ouname,DC=domain,DC=local (tried with and without with no better results) ldap_version = 3 #deref = never #base = OU=InfrastructureManagement,DC=domain,DC=local (works has a few users) base = OU=_myou,OU=Utilisateurs,OU=ouname,DC=domain,DC=local scope = subtree user_filter = (&(objectclass=person)(mail=%u)) pass_filter = (&(objectclass=person)(mail=%u)) and some logs in appendix B/ Thanks for any hints on this. Have a nice day appendix A/ # 2.1.7: /etc/dovecot/dovecot.conf # OS: Linux 3.2.0-4-amd64 x86_64 Debian 7.7 auth_mechanisms = plain login auth_socket_path = /var/run/dovecot/auth-userdb default_vsz_limit = 1 G disable_plaintext_auth = no first_valid_gid = 5000 first_valid_uid = 5000 last_valid_gid = 50000 last_valid_uid = 50000 mail_gid = 5000 mail_home = /var/vmail/%d/%n mail_location = maildir:~/mail mail_privileged_group = virtmail mail_uid = 5000 namespace inbox { hidden = no inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = subscriptions = yes } passdb { args = scheme=plain-md5 username_format=%u /etc/dovecot/users driver = passwd-file } passdb { args = scheme=plain-md5 username_format=%u /etc/dovecot/users driver = passwd-file } passdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } passdb { args = /etc/dovecot/pirisusers-ldap.conf.ext driver = ldap } protocols = imap service auth { unix_listener auth-userdb { mode = 0666 user = virtmail } } ssl_cert = </etc/dovecot/dovecot.pem ssl_key = </etc/dovecot/private/dovecot.pem userdb { args = username_format=%u /etc/dovecot/users driver = passwd-file } userdb { args = username_format=%u /etc/dovecot/users driver = passwd-file } userdb { args = /etc/dovecot/dovecot-ldap-users.conf.ext driver = ldap } userdb { args = /etc/dovecot/pirisusers-ldap-users.conf.ext driver = ldap } protocol lda { postmaster_address = postmaster(a)domain.tld } protocol imap { mail_plugins = } appendix B/ May 19 12:57:36 iftstpupimap1 dovecot: auth: Error: ldap_int_select May 19 12:57:36 iftstpupimap1 dovecot: auth: Error: read1msg: ld 0x7fcc0a585fa0 msgid 14 all 1 May 19 12:57:36 iftstpupimap1 dovecot: auth: Error: read1msg: ld 0x7fcc0a585fa0 msgid 11 message type search-reference May 19 12:57:36 iftstpupimap1 dovecot: auth: Error: ldap_chase_v3referrals May 19 12:57:36 iftstpupimap1 dovecot: auth: Error: ldap_url_parse_ext(ldap://ForestDnsZones.domain.local/DC=ForestDnsZones,DC=domain,DC=local) May 19 12:57:36 iftstpupimap1 dovecot: auth: Error: re_encode_request: new msgid 15, new dn <DC=ForestDnsZones,DC=domain,DC=local> May 19 12:57:36 iftstpupimap1 dovecot: auth: Error: re_encode_request new request is: May 19 12:57:36 iftstpupimap1 dovecot: auth: Error: ldap_chase_v3referral: msgid 11, url "ldap://ForestDnsZones.domain.local/DC=ForestDnsZones,DC=domain,DC=local" May 19 12:57:36 iftstpupimap1 dovecot: auth: Error: ldap_send_server_request May 19 12:57:36 iftstpupimap1 dovecot: auth: Error: ldap_new_connection 0 1 1 May 19 12:57:36 iftstpupimap1 dovecot: auth: Error: ldap_int_open_connection May 19 12:57:36 iftstpupimap1 dovecot: auth: Error: ldap_connect_to_host: TCP ForestDnsZones.domain.local:389 May 19 12:57:36 iftstpupimap1 dovecot: auth: Error: ldap_new_socket: 21 May 19 12:57:36 iftstpupimap1 dovecot: auth: Error: ldap_prepare_socket: 21 May 19 12:57:36 iftstpupimap1 dovecot: auth: Error: ldap_connect_to_host: Trying 10.1.2.34:389 May 19 12:57:36 iftstpupimap1 dovecot: auth: Error: ldap_pvt_connect: fd: 21 tm: -1 async: 0 May 19 12:57:36 iftstpupimap1 dovecot: auth: Error: anonymous rebind via ldap_sasl_bind("") May 19 12:57:36 iftstpupimap1 dovecot: auth: Error: ldap_sasl_bind May 19 12:57:36 iftstpupimap1 dovecot: auth: Error: ldap_send_initial_request May 19 12:57:36 iftstpupimap1 dovecot: auth: Error: ldap_send_server_request May 19 12:57:36 iftstpupimap1 dovecot: auth: Error: ldap_result ld 0x7fcc0a585fa0 msgid 16 May 19 12:57:36 iftstpupimap1 dovecot: auth: Error: wait4msg ld 0x7fcc0a585fa0 msgid 16 (timeout 100000 usec) May 19 12:57:36 iftstpupimap1 dovecot: auth: Error: wait4msg continue ld 0x7fcc0a585fa0 msgid 16 all 1 May 19 12:57:36 iftstpupimap1 dovecot: auth: Error: ** ld 0x7fcc0a585fa0 Connections: May 19 12:57:36 iftstpupimap1 dovecot: auth: Error: * host: ForestDnsZones.domain.local port: 0 May 19 12:57:36 iftstpupimap1 dovecot: auth: Error: refcnt: 2 status: Connected May 19 12:57:36 iftstpupimap1 dovecot: auth: Error: last used: Thu May 19 12:57:36 2016 May 19 12:57:36 iftstpupimap1 dovecot: auth: Error: rebind in progress May 19 12:57:36 iftstpupimap1 dovecot: auth: Error: queue is empty May 19 12:57:36 iftstpupimap1 dovecot: auth: Error: May 19 12:57:36 iftstpupimap1 dovecot: auth: Error: * host: DomainDnsZones.domain.local port: 0 May 19 12:57:36 iftstpupimap1 dovecot: auth: Error: refcnt: 2 status: Connected May 19 12:57:36 iftstpupimap1 dovecot: auth: Error: last used: Thu May 19 12:57:36 2016 May 19 12:57:36 iftstpupimap1 dovecot: auth: Error: rebind in progress May 19 12:57:36 iftstpupimap1 dovecot: auth: Error: queue is empty May 19 12:57:36 iftstpupimap1 dovecot: auth: Error: May 19 12:57:36 iftstpupimap1 dovecot: auth: Error: * host: master.domain.local port: 389 (default) May 19 12:57:36 iftstpupimap1 dovecot: auth: Error: refcnt: 4 status: Connected May 19 12:57:36 iftstpupimap1 dovecot: auth: Error: last used: Thu May 19 12:57:36 2016 May 19 12:57:36 iftstpupimap1 dovecot: auth: Error: May 19 12:57:36 iftstpupimap1 dovecot: auth: Error: May 19 12:57:36 iftstpupimap1 dovecot: auth: Error: ** ld 0x7fcc0a585fa0 Outstanding Requests: May 19 12:57:36 iftstpupimap1 dovecot: auth: Error: * msgid 16, origid 16, status InProgress May 19 12:57:36 iftstpupimap1 dovecot: auth: Error: outstanding referrals 0, parent count 0 May 19 12:57:36 iftstpupimap1 dovecot: auth: Error: * msgid 14, origid 14, status InProgress May 19 12:57:36 iftstpupimap1 dovecot: auth: Error: outstanding referrals 0, parent count 0 May 19 12:57:36 iftstpupimap1 dovecot: auth: Error: * msgid 11, origid 11, status InProgress May 19 13:00:06 iftstpupimap1 dovecot: auth: Error: PLAIN(): Request 0.1 timeouted after 150 secs, state=1

1 1

Blowfish hashed passwords
by KT Walrus 03 Jun '16

03 Jun '16

The PHP app I’m using on my website uses PHP to generate password hashes to be stored into the user database. These password hashes use Blowfish encryption ("$2y$”). In fact, since PHP 5.3.0, PHP contains its own implementation of the hash types it supports including: - CRYPT_STD_DES - CRYPT_EXT_DES - CRYPT_MD5 - CRYPT_BLOWFISH - CRYPT_SHA256 - CRYPT_SHA512 The C code for these hash types is in https://github.com/php/php-src/tree/master/ext/standard <https://github.com/php/php-src/tree/master/ext/standard> I’m working on adding Dovecot to my site, but Dovecot doesn’t seem to support Blowfish password hashes (at least on Ubuntu 14.04). Would you consider adding built-in “fallback” support for Blowfish and SHA512 (which doesn’t seem to be supported either on Ubuntu 14.04 last time I checked) to an upcoming Dovecot release? You could probably take the source code from the GitHub PHP repo to incorporate support for these hash types in Dovecot. That way, Dovecot could easily use the same hash types that PHP supports regardless of what hash types are installed in the OS running Dovecot. And, I wouldn’t have to deal with a second set of hashes for Dovecot passdb for my existing user accounts. See PHP manual for crypt function: http://php.net/manual/en/function.crypt.php Kevin

2 1

stat .../.dovecot.sieve/tmp failed: Not a directory
by Robert Schetterer 02 Jun '16

02 Jun '16

Hi, i have stat .../.dovecot.sieve/tmp failed: Not a directory using sieve = file:~/sieve;active=~/.dovecot.sieve dovecot_2.2.24-1-auto-38 cause i can subscribe to dovecot sieve cant remember to see this in previous versions any idea ? Best Regards MfG Robert Schetterer -- [*] sys4 AG http://sys4.de, +49 (89) 30 90 46 64 Schleißheimer Straße 26/MG, 80333 München Sitz der Gesellschaft: München, Amtsgericht München: HRB 199263 Vorstand: Patrick Ben Koetter, Marc Schiffbauer Aufsichtsratsvorsitzender: Florian Kirstein

3 5

special-use for virtual folder
by Wolfgang Rosenauer 02 Jun '16

02 Jun '16

Hi, I'm running two different Dovecot servers (actually more but those are pretty similar and same versions 2.2.24). Today I configured a virtual All folder on both: namespace { location = virtual:/etc/dovecot/virtual:INDEX=~/virtual prefix = virtual. separator = . } mailbox virtual.All { special_use = \All } On this system the special-use flag is not applied to the folder (checked via LIST "" "*"). On the other system: namespace { location = virtual:/etc/dovecot/virtual:INDEX=~/virtual prefix = virtual/ separator = / } mailbox virtual/All { special_use = \All } On the second system I can see * LIST (\HasNoChildren \All) "/" virtual/All Besides the separator I don't see a big difference between both configurations. Any idea? Thanks, Wolfgang

1 1

forwarding emails using sieve
by Thorsten von Eicken 01 Jun '16

01 Jun '16

I know this is a tad tangential to dovecot, but maybe someone has some pointers for me. I'm trying to forward emails using the sieve filtering and redirect doesn't do it because it doesn't wrap the message in a new email, instead, it seems to just change the envelope From (and To). This causes the outbound relay to reject the message for security/spam reasons (forged From). It looks like the dovecot sieve implementation doesn't let me change the From header in the sieve script. Is there a way to accomplish what I'm looking for? Thanks!

3 3

Full subject on dovecot log
by Fabio S. Schmidt 01 Jun '16

01 Jun '16

Hi, I've noticed that when a subject is very long Dovecot doesn't show its full lenght on the logs. Is there any way to always register the full subject on the log? (I'm using dovecot 2.2) My best regards, Fabio S. Schmidt

1 0

Fatal Error with sdbox and attachment storage
by Wolfgang Baumgartner 01 Jun '16

01 Jun '16

Hello, we've shortly migrated to sdbox with attachment storage. Now there are many errors like this: May 30 14:11:17 rzw-x-mail2 dovecot: lmtp(21310, xxx.xxx(a)hswt.de): Panic: file fs-api.c: line 615 (fs_copy): assertion failed: (src->fs == dest->fs) May 30 14:11:17 rzw-x-mail2 dovecot: lmtp(21310, xxx.xxx(a)hswt.de): Error: Raw backtrace: /usr/lib/dovecot/libdovecot.so.0(+0x6b6fe) [0x7fae10a6d6fe] -> /usr/lib/dovecot/libdovecot.so.0(+0x6b7ec) [0x7fae10a6d7ec] -> /usr/lib/dovecot/libdovecot.so.0(i_fatal+0) [0x7fae10a248fb] -> /usr/lib/dovecot/libdovecot.so.0(fs_copy+0x90) [0x7fae10a2e4a0] -> /usr/lib/dovecot/libdovecot-storage.so.0(sdbox_copy+0x4e0) [0x7fae10d20c10] -> /usr/lib/dovecot/modules/lib10_quota_plugin.so(+0xbaab) [0x7fae10037aab] -> /usr/lib/dovecot/libdovecot-storage.so.0(mailbox_copy+0x7d) [0x7fae10d5d01d] -> /usr/lib/dovecot/libdovecot-lda.so.0(mail_deliver_save+0x196) [0x7fae110049d6] -> /usr/lib/dovecot/libdovecot-lda.so.0(mail_deliver+0xf3) [0x7fae11004e13] -> dovecot/lmtp [DATA](+0x6171) [0x7fae11434171] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_call_io+0x3f) [0x7fae10a7ed0f] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run_internal+0xf9) [0x7fae10a7fd09] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run+0x9) [0x7fae10a7ed79] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_run+0x38) [0x7fae10a7edf8] -> /usr/lib/dovecot/libdovecot.so.0(master_service_run+0x13) [0x7fae10a29dc3] -> dovecot/lmtp [DATA](main+0x165) [0x7fae114329b5] -> /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xf5) [0x7fae10678b45] -> dovecot/lmtp [DATA](+0x4a95) [0x7fae11432a95] May 30 14:11:17 rzw-x-mail2 dovecot: lmtp(21310, xxx.xxx(a)hswt.de): Fatal: master: service(lmtp): child 21310 killed with signal 6 (core dumps disabled) What can we do now? Migrate back to Maildir? Greetings Wolfgang Baumgartner System: Debian 8 with Dovecot 2.2.13 dovecot -n # 2.2.13: /etc/dovecot/dovecot.conf # OS: Linux 3.16.0-4-amd64 x86_64 Debian 8.4 auth_master_user_separator = * auth_mechanisms = plain login auth_verbose_passwords = yes disable_plaintext_auth = no mail_attachment_dir = /srv/archive/attachments mail_location = auto: mail_plugins = quota zlib acl managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave namespace { hidden = no list = children location = auto: prefix = shared.%%n. separator = . subscriptions = yes type = shared } namespace inbox { hidden = no inbox = yes list = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = INBOX. separator = . subscriptions = yes type = private } passdb { args = /etc/dovecot/master-users driver = passwd-file master = yes pass = yes } passdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } plugin { acl = vfile acl_shared_dict = file:/var/lib/dovecot/db/shared-mailboxes quota = dict:User quota::file:%h/dovecot-quota quota_grace = 20M quota_rule = *:storage=400M quota_rule2 = INBOX.Archiv:ignore quota_rule3 = INBOX.Trash:storage=+20M quota_status_nouser = DUNNO quota_status_overquota = 552 5.2.2 Mailbox is full / Mailbox ist voll quota_status_success = DUNNO quota_warning = storage=95%% quota-warning 95 %u quota_warning2 = storage=80%% quota-warning 80 %u sieve = ~/.dovecot.sieve sieve_default_name = roundcube sieve_dir = ~/sieve sieve_max_redirects = 15 zlib_save = gz zlib_save_level = 6 } protocols = " imap lmtp sieve pop3" service auth { inet_listener saslauth_via_dovecot { address = 141.40.2.7 port = 12341 } unix_listener auth-userdb { group = vmail user = vmail } } service imap-login { process_min_avail = 4 service_count = 0 } service imap { process_limit = 8192 } service lmtp { inet_listener lmtp { address = 141.40.2.7 port = 24 } } service managesieve-login { inet_listener sieve { port = 4190 } inet_listener sieve_deprecated { port = 2000 } } service pop3-login { process_min_avail = 4 service_count = 0 } service quota-status { client_limit = 1 executable = quota-status -p postfix inet_listener { address = 141.40.2.7 port = 12340 } } service quota-warning { executable = script /usr/local/bin/quota-warning.sh unix_listener quota-warning { user = vmail } user = vmail } ssl_cert = </etc/ssl/certs/cert.pem ssl_cipher_list = EDH+CAMELLIA:EDH+aRSA:EECDH+aRSA+AESGCM:EECDH+aRSA+SHA256:EECDH:+CAMELLIA128:+AES128:+SSLv3:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!DSS:!RC4:!SEED:!IDEA:!ECDSA:kEDH:CAMELLIA128-SHA:AES128-SHA ssl_key = </etc/ssl/private/key.pem ssl_prefer_server_ciphers = yes ssl_protocols = !SSLv3 !SSLv2 userdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } verbose_proctitle = yes protocol lmtp { mail_plugins = quota zlib acl sieve } protocol lda { mail_plugins = quota zlib acl sieve } protocol imap { mail_plugins = quota zlib acl imap_acl imap_quota imap_zlib } -- -------------------------------------------------------------- Hochschule Weihenstephan-Triesdorf, Rechenzentrum Dipl.-Ing. (FH) Wolfgang Baumgartner Am Weihenstephaner Berg 4, 85350 Freising Tel. 08161/71-5276 Fax: 08161/71-5116 E-Mail: wolfgang.baumgartner(a)hswt.de --------------------------------------------------------------

1 1

Not receiving mails
by Vijay Kumar 01 Jun '16

01 Jun '16

Hi, I have setup spam filter and opendkim key on our mail server with Postfix,Dovecot and OpenDKIM server. Following are few lines from dovecot.conf which were added to dovecot.conf. After troubleshooting, we removed the following lines and the login from webUI roundcube started working. Can someone please explain the importance of following lines in accordance with Opendkim? Should we disable plaintext authentication for opendkim to work? ----------------------------------------------------- disable_plaintext_auth = no mail_privileged_group = mail mail_location = mbox:~/mail:INBOX=/var/mail/%u userdb { driver = passwd } passdb { args = %s driver = pam } protocol imap { mail_plugins = " autocreate" } plugin { autocreate = Trash autocreate2 = Sent autosubscribe = Trash autosubscribe2 = Sent } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } } ssl=required ----------------------------------------------------- Thanks, Vijay --- http://www.matchfinder.in

1 0