- dovecot - dovecot.org

[Dovecot] ACL Groups
by Daniel L. Miller 17 Jun '11

17 Jun '11

From the wiki: ACL groups support works by returning a comma-separated acl_groups extra field <http://wiki2.dovecot.org/UserDatabase/ExtraFields> from userdb, which contains all the groups the user belongs to. User's UNIX groups have no effect on ACLs (you can "enable" them by using a special post-login script <http://wiki2.dovecot.org/PostLoginScripting>). I've read that over several times - I still don't understand that. Are "ACL Groups" defined and managed by Dovecot - and described somewhere else in the docs - or are they UNIX groups that previously had no affect on mail access but by being listed in the "acl_groups" field they now have relevance? -- Daniel

3 4

[Dovecot] pop3-login Error after dovecot 1.2.11 to dovecot 2.0.13
by Bradley Giesbrecht 17 Jun '11

17 Jun '11

I recently upgaded from dovecot 1.2.11 to 2.0.13. I used this command on my dovecont.conf after the upgrade and then moved the new file into place after removing some plugins. $ sudo doveconf -n -c dovecot-1.conf > dovecot-2.conf After 24+ hours with no issues I was getting pop3 login failures. ... /path/to/log/dovecot.log:master: Error: service(pop3): read(status) failed: Interrupted system call ... /path/to/log/dovecot.log:Jun 17 05:25:47 pop3-login: Error: master(pop3): Auth request timed out (received 0/12 bytes) /path/to/log/dovecot.log:Jun 17 05:25:47 pop3-login: Info: Internal login failure (pid=1796 id=1) (auth failed, 1 attempts): user=<rriveter(a)domainname.com>, method=APOP, rip=123.4.5.6, lip=123.7.8.9 /path/to/log/dovecot.log:Jun 17 05:25:47 pop3-login: Error: master(pop3): Auth request timed out (received 0/12 bytes) /path/to/log/dovecot.log:Jun 17 05:25:47 pop3-login: Info: Internal login failure (pid=1797 id=1) (auth failed, 1 attempts): user=<jdoe(a)domainname.com>, method=APOP, rip=123.4.5.6, lip=123.7.8.9 /path/to/log/dovecot.log:Jun 17 05:25:47 pop3-login: Error: master(pop3): Auth request timed out (received 0/12 bytes) /path/to/log/dovecot.log:Jun 17 05:25:47 pop3-login: Info: Internal login failure (pid=1798 id=1) (auth failed, 1 attempts): user=<gkhan(a)domainname.com>, method=APOP, rip=123.4.5.6, lip=123.7.8.9 /path/to/log/dovecot.log:Jun 17 05:25:47 pop3-login: Error: master(pop3): Auth request timed out (received 0/12 bytes) ... /path/to/log/dovecot.log:Jun 17 05:40:34 pop3-login: Error: net_connect_unix(pop3) failed: Operation timed out ... Bouncing dovecot has resolved the login issues for the present. Reading from the wiki I see my post-login scripts will need changing. http://wiki2.dovecot.org/Upgrading/2.0 Is there anything else obviously/dangerously wrong with the following doveconf output? I'm am still in the process of moving directives out of dovecot.conf into the new conf.d files. $ doveconf -n # 2.0.13: /path/to/etc/dovecot/dovecot.conf # OS: Darwin 9.8.0 Power Macintosh hfs auth_mechanisms = plain login cram-md5 ntlm apop default_internal_user = _dovecot default_login_user = _dovenull disable_plaintext_auth = no log_path = /path/to/log/dovecot.log mail_location = dbox:/path/to/mail/%d/%n/dbox mail_max_userip_connections = 30 managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date passdb { args = /path/to/etc/dovecot/dovecot_mysql.conf driver = sql } plugin { autocreate = Trash autocreate2 = Spam autosubscribe = Trash autosubscribe2 = Spam } protocols = imap pop3 service auth { unix_listener /path/to/var/spool/postfix/private/auth { group = _postfix mode = 0660 user = _postfix } unix_listener auth-master { mode = 0600 user = _vmail } unix_listener auth-userdb { group = _vmail user = _vmail } } service imap { executable = /path/to/dovecot/bin/log_imap_login.sh } service pop3 { executable = /path/to/dovecot/bin/log_pop3_login.sh } ssl_cert = </path/to/etc/ssl/certs/dovecot.pem ssl_key = </path/to/etc/ssl/private/dovecot.pem userdb { driver = prefetch } userdb { args = /path/to/etc/dovecot/dovecot_mysql.conf driver = sql } Thanks, Bradley Giesbrecht

1 0

[Dovecot] ACL enabled Public folder dovecot
by kumar shantanu 17 Jun '11

17 Jun '11

Hi All, I am trying to do ACL enabled Public folder on dovecot version 1.1.20, but the ACL thing is not working, the public folder is visible and accessible to everyone. My dovecot config for public folder is like ######## namespace public { separator = / prefix = Public/ location = maildir:/var/mail/public subscriptions = no } plugin { acl = vfile } ######### and I have my dovecot-acl file in /var/mail/public/.test which reads ** user=test(a)mydomain.com lrw ** but every user can see the public folders and subscribe to it, which I don't want :( Can someone please suggest. Thanks in Advance, Shantanu

2 3

[Dovecot] Converting CLIENT_MAIL_DATA_MAX_INMEMORY_SIZE to a configurable?
by Attila Nagy 17 Jun '11

17 Jun '11

Hi, Currently Dovecot's LMTPd writes incoming emails to mail_temp_dir if it's bigger than 128k. But I would like to spare those unnecessary operations (creating a file, deleting it, writing into it, reading from it, checking whether there is free space and if not, rejecting (temporarily) the message). Memory is cheap, disk IO is not. :) And BTW, on a lot of systems, /tmp is a memory file system already, so there is absolute no need for this. I only fired two greps so far before writing this mail, in the hope that I can spare writing, testing and sending a patch, which will be either rejected, or rewritten. :) So, am I right that the following constant would be needed to be converted into a configurable setting and the task is done? static int client_input_add(struct client *client, const unsigned char *data, size_t size) { if (client->state.mail_data->used + size <= CLIENT_MAIL_DATA_MAX_INMEMORY_SIZE && client->state.mail_data_output == NULL) { buffer_append(client->state.mail_data, data, size); return 0; } else { return client_input_add_file(client, data, size); } } It could be defaulted to 128k, but the user could set it "unlimited" (0 or -1, depending on the author's mood, 0 and/or -1 being unlimited, or 0 being 0, meaning don't even store a bit -doesn't really make sense to me). LMTP is mostly protected from the outside world, so I don't see too much DoS potential here (absolutely not more than in the tmpfs case). Thanks,

2 2

[Dovecot] I can't setup namespace per user (with settings keept in sql db)
by Marcin Mirosław 17 Jun '11

17 Jun '11

Hello! I'm trying to setup additional namespace. I'd like to have this setting per user and keep it in postgresql. Global namespace is defined in this way: namespace { inbox = yes location = prefix = separator = . } (mail_location is getting from db) I don't know how should looks like database field:( Now i have such configuration: user_query = select .... dovecot_location AS location, dovecot_namespace AS namespace FROM ... In db i have this: # select dovecot_location, dovecot_namespace from exim_users where dovecot_namespace is not null; dovecot_location | dovecot_namespace ---------------------------+------------------- location="mdbox:~/.mdbox" | prefix="testn" (1 row) but this isn't good configuration. I've got in log: debug: sql(marcin(a)mejor.pl,62.121.127.119): SELECT '/dane/domeny/mejor.pl/mail/marcin/' as home, dovecot_typ_skrzynki ||':'|| '/dane/domeny/mejor.pl/mail/marcin/' ||' .'|| dovecot_typ_skrzynki as mail_location, '*:bytes='||quota_mb||'M' as quota_rule , dovecot_location AS location, dovecot_namespace AS namespace FROM exim_users WHE RE login = lower('marcin') AND domena = lower('mejor.pl') Debug: master out: USER#0112138832897#011marcin@mejor.pl#011home=/dane/domeny/mejor.pl/mail/marcin/#011mail_location=maildir:/dane/domeny/mejor.pl/mail/marcin/.maildi r#011quota_rule=*:bytes=0M#011location=location="mdbox:~/.mdbox"#011namespace=prefix="testn" Login: user=<marcin(a)mejor.pl>, method=CRAM-MD5, rip=62.121.127.119, lip=193.238.12.139, mpid=17929, TLS Debug: Loading modules from directory: /usr/lib/dovecot Debug: Module loaded: /usr/lib/dovecot/lib10_quota_plugin.so Debug: Module loaded: /usr/lib/dovecot/lib11_imap_quota_plugin.so Debug: Module loaded: /usr/lib/dovecot/lib15_notify_plugin.so Debug: Module loaded: /usr/lib/dovecot/lib20_autocreate_plugin.so Debug: Module loaded: /usr/lib/dovecot/lib20_fts_plugin.so Debug: Module loaded: /usr/lib/dovecot/lib20_mail_log_plugin.so Debug: Module loaded: /usr/lib/dovecot/lib20_zlib_plugin.so Debug: Module loaded: /usr/lib/dovecot/lib21_fts_squat_plugin.so Debug: Module loaded: /usr/lib/dovecot/lib30_imap_zlib_plugin.so Debug: Added userdb setting: mail_location=maildir:/dane/domeny/mejor.pl/mail/marcin/.maildir Debug: Added userdb setting: plugin/quota_rule=*:bytes=0M Debug: Added userdb setting: plugin/location=location="mdbox:~/.mdbox" Debug: Added userdb setting: namespace=prefix="testn" Debug: Effective uid=8, gid=12, home=/dane/domeny/mejor.pl/mail/marcin/ Debug: Quota root: name=User quota backend=dict args=:proxy::quota Debug: Quota rule: root=User quota mailbox=* bytes=0 messages=0 Debug: dict quota: user=marcin(a)mejor.pl, uri=proxy::quota, noenforcing=0 Debug: Namespace : type=private, prefix=, sep=., inbox=yes, hidden=no, list=yes, subscriptions=yes location=maildir:/dane/domeny/mejor.pl/mail/marcin/.maildir Debug: maildir++: root=/dane/domeny/mejor.pl/mail/marcin/.maildir, index=, control=, inbox=/dane/domeny/mejor.pl/mail/marcin/.maildir Debug: Namespace : type=private, prefix=, sep=, inbox=no, hidden=no, list=yes, subscriptions=yes location=maildir:/dane/domeny/mejor.pl/mail/marcin/.maildir Debug: maildir++: root=/dane/domeny/mejor.pl/mail/marcin/.maildir, index=, control=, inbox= Error: user marcin(a)mejor.pl: Initialization failed: namespace configuration error: Duplicate namespace prefix: "" Error: Invalid user settings. Refer to server log for more information. I've got stuck, i don't have idea how configuration should looks:( Thanks for any help! dovceot-2.0.13

1 0

Re: [Dovecot] ZFS Filesystem Quota under Solaris 10 and Sparc
by Roger Fujii 17 Jun '11

17 Jun '11

*Jürgen Obermann wrote:* > Since we upgraded last year to Solaris 10 with zfs filesystems on our > Sparc server still using a similar setup with separate filesystems for > home directories and inboxes we have no working quota plugin anymore. > Currently we use dovecot 2.0.13. > > Are there any plans or whishes to get the filesystem quota code > working again under zfs and Solaris? > How are you setting up the zfs quotas? The original zfs implementation didn't have user quotas. You could only add quotas to individual file systems as a whole. They apparently added it into the source base in 2009: http://blogs.oracle.com/chrisg/entry/user_and_group_quotas_for but I'm not sure when/if it made it to production. My sol10u8 * (10/09) has it in the man page, but I know some things in the man page isn't in s10 (like sharesmb), so, as they say, ymmv. The current doc for user quotas are here: http://download.oracle.com/docs/cd/E19253-01/819-5461/gazud/index.html If you don't want to use the filesystem quotas, you have to change your rules/configuration to match what dovecot has. See doc/wiki/Quota.Configuration.txt. Hope this helps. -r

1 0

[Dovecot] quota_rule beeing ignored and set to system soft! quota
by Leon Meßner 16 Jun '11

16 Jun '11

Hi, originating from the same Problem Edgar Fuß described here [1] about "Zero-sized Maildir files and index corruption on over-quota" i setup quota = fs:user quotas with a quota_rule set to 1.5G to prevent getting those zero sized mail files. What happens now is that when the user is over system soft quota (1G) mails stop beeing delivered. Jun 16 19:05:45 mail dovecot: deliver(elont1): msgid=<20110616185545.05ab0f56@x201t>: save failed to INBOX: Quota exceeded (mailbox for user is full) This is bad as users get notified per mail by a script about beeing over quota (this mail is now beeing deferred). If i don't set a quota_rule i still get 0byte files (quota is ignored). If i set a higher than system quota quota_rule it still uses the system soft quota. I have a seconary mailserver which already uses dovecot 2.x but i can't test the feature there as it's running inside a jail and thus has no access to quota. I would like to keep this machine on 1.2.16 for now. dovecot -n output is below. thanks, Leon [1] http://www.dovecot.org/list/dovecot/2010-October/053554.html 19:20_root@mail:/usr/local/etc# dovecot -n # 1.2.16: /usr/local/etc/dovecot.conf # OS: FreeBSD 7.3-RELEASE-p2 amd64 log_path: /var/log/dovecot.log protocols: imaps pop3s managesieve listen: mail.physik-pool.tu-berlin.de ssl_cert_file: /etc/private/mail.physik.tu-berlin.de.pem ssl_key_file: /etc/private/physik.tu-berlin.de_privatekey.pem login_dir: /var/run/dovecot/login login_executable(default): /usr/local/libexec/dovecot/imap-login login_executable(imap): /usr/local/libexec/dovecot/imap-login login_executable(pop3): /usr/local/libexec/dovecot/pop3-login login_executable(managesieve): /usr/local/libexec/dovecot/managesieve-login login_processes_count: 6 login_max_processes_count: 512 verbose_proctitle: yes first_valid_uid: 200 mail_privileged_group: mail mail_location: maildir:~/maildir mmap_disable: yes mail_nfs_storage: yes mail_nfs_index: yes mail_executable(default): /usr/local/libexec/dovecot/imap mail_executable(imap): /usr/local/libexec/dovecot/imap mail_executable(pop3): /usr/local/libexec/dovecot/pop3 mail_executable(managesieve): /usr/local/libexec/dovecot/managesieve mail_plugins(default): quota imap_quota mail_plugins(imap): quota imap_quota mail_plugins(pop3): quota mail_plugins(managesieve): mail_plugin_dir(default): /usr/local/lib/dovecot/imap mail_plugin_dir(imap): /usr/local/lib/dovecot/imap mail_plugin_dir(pop3): /usr/local/lib/dovecot/pop3 mail_plugin_dir(managesieve): /usr/local/lib/dovecot/managesieve imap_client_workarounds(default): delay-newmail netscape-eoh tb-extra-mailbox-sep imap_client_workarounds(imap): delay-newmail netscape-eoh tb-extra-mailbox-sep imap_client_workarounds(pop3): imap_client_workarounds(managesieve): pop3_client_workarounds(default): pop3_client_workarounds(imap): pop3_client_workarounds(pop3): outlook-no-nuls oe-ns-eoh pop3_client_workarounds(managesieve): namespace: type: private separator: / inbox: yes list: yes subscriptions: yes namespace: type: private separator: / prefix: mail/ location: mbox:~/mail list: yes subscriptions: yes lda: postmaster_address: postmaster(a)physik.tu-berlin.de log_path: info_log_path: mail_plugins: sieve quota quota_full_tempfail: yes sendmail_path: /usr/sbin/sendmail auth default: mechanisms: gssapi plain login krb5_keytab: /etc/mail.krb5.keytab gssapi_hostname: mail.physik-pool.tu-berlin.de worker_max_count: 120 passdb: driver: pam args: session=yes failure_show_msg=yes max_requests=100 userdb: driver: passwd args: blocking=yes plugin: sieve: ~/.dovecot.sieve sieve_dir: ~/.sieve quota_rule: *:storage=15728640 quota: fs:user

1 0

[Dovecot] Global ACLs
by Daniel L. Miller 16 Jun '11

16 Jun '11

If I have: plugin { acl = vfile:/usr/local/etc/dovecot/global-acls:cache_secs=300 } And then a file /usr/local/etc/dovecot/global-acls/.DEFAULT with owner lrwstipekxa user=dmiller lrwstipekxa Does that give me unconditional access to all mailboxes? -- Daniel

1 0

[Dovecot] Removal of mailist duplicates?
by Peter Bell 16 Jun '11

16 Jun '11

I am using mpop to fetch mail from my service provider (who use dovecot). I use dovecot to hold all my mail on a local slackware server, with sieve filters, based on 'List-Id', directing mailist postings to their own folders. I use thunderbird to read my mail on an ubuntu desktop. When I receive a reply to a posting I make to a mailist (such as this one), replies I receive are usually sent to me with cc to the list. I would expect, then, to receive the message twice - once in my personal mailbox, and once to the mailist folder. However, this doesn't happen - I only see the posting in the mailist folder. Can anyone tell me at which stage in the process the other message is being supressed? -- ------------------------------------------------------------------- Peter Bell Mob: +63 (0) 9287 340 343 Tagum City, Philippines. Tel: +63 (0) 84 400 5085 email/msn: peter(a)bellfamily.org.uk Tel: +44 (0) 118 331 0000

4 6

[Dovecot] limiting number of login attempts from same ip
by Jürgen Obermann 16 Jun '11

16 Jun '11

Hello, is it possible to limit the number of pop3 (or imap) login attempts from one IP with dovecot to stop attackers? We recently had an attack from one IP-address lasting 50 minutes that tried 50000 pop3-logins with guessed users and passwords. I know about Fail2Ban but really would prefer an easy to configure solution inside of dovecot. Dovecot has this anvil daemon, can it be used for that purpose? We use dovcot version 2.0.12 under Solaris 10, the pop3-login part of the configuration looking like that: service pop3-login { chroot = login client_limit = 0 drop_priv_before_exec = no executable = pop3-login extra_groups = group = idle_kill = 0 inet_listener pop3 { address = port = 110 ssl = no } inet_listener pop3s { address = port = 995 ssl = yes } privileged_group = process_limit = 0 process_min_avail = 0 protocol = pop3 service_count = 1 type = login user = $default_login_user vsz_limit = 64 M } Thanks, Jürgen -- Hochschulrechenzentrum der | Mail: Juergen.Obermann(a)hrz.uni-giessen.de Justus-Liebig-Universitaet | WWW: http://www.uni-giessen.de/obermann/ Heinrich-Buff-Ring 44 | Tel: 0641-99-13054 (0641-99-13001) D-35392 Giessen, Germany | Fax: 0641-99-13009

10 14