- dovecot - dovecot.org

[Dovecot] passdb pam and userdb passwd "Authentication failure" errors
by Mark Alan 08 Dec '10

08 Dec '10

While using Ubuntu 10.10 + Dovecot 1.2.12 + Postfix 2.7.1-1: To enable virtual accounts, I am using the following /etc/dovecot/auth.d/virtualsomename.auth file: passdb passwd-file { args = /etc/dovecot/passwd } userdb static { args = uid=vmail gid=vmail home=/home/vmail/%u } EOT cat /etc/dovecot/passwd looks like this: test:{PLAIN}pass bill:{PLAIN}secret timo@example.com:{PLAIN}hello123 dave@example.com:{PLAIN}world234 Issuing a 'sudo dovecot -n' shows: .../... auth default: verbose: yes debug: yes debug_passwords: yes passdb: driver: pam passdb: driver: passwd-file args: /etc/dovecot/passwd userdb: driver: passwd userdb: driver: static args: uid=vmail gid=vmail home=/home/vmail/%u .../... and while trying to connect to Dovecot as dave(a)example.com the log shows: 2010-12-04 18:15:58 auth(default): Info: new auth connection: pid=15334 2010-12-04 18:15:58 auth(default): Info: client in: AUTH 1 PLAIN service=smtp nologin lip=127.0.1.1 rip=127.0.1.1 resp=AGRhdmVAZXhhbXBsZS5jb20Ad29ybGQyMzQ= 2010-12-04 18:15:58 auth-worker(default): Info: pam(dave(a)example.com,127.0.1.1): lookup service=dovecot 2010-12-04 18:15:58 auth-worker(default): Info: pam(dave(a)example.com,127.0.1.1): #1/1 style=1 msg=Password: 2010-12-04 18:16:00 auth-worker(default): Info: pam(dave(a)example.com,127.0.1.1): pam_authenticate() failed: Authentication failure (password mismatch?) (given password: world234) 2010-12-04 18:16:00 auth(default): Info: passwd-file(dave(a)example.com,127.0.1.1): lookup: user=dave(a)example.com file=/etc/dovecot/passwd 2010-12-04 18:16:00 auth(default): Info: client out: OK 1 user=dave(a)example.com I have 2 questions: QUESTION 1: To avoid those Authentication failure errors should I also comment out the passdb pam {...} and userdb passwd {...} blocks in the main /etc/dovecot/dovecot.conf? I was thinking in something like: sudo sed -i '/passdb pam {/,/}/s/^/#/' /etc/dovecot/dovecot.conf sudo sed -i '/userdb passwd {/,/}/s/^/#/' /etc/dovecot/dovecot.conf QUESTION 2: the final email arrives with an email header that includes: Received: from desk.example.com (unknown [127.0.1.1]) (using TLSv1 with cipher DHE-RSA-AES128-SHA (128/128 bits)) (No client certificate requested) by mail.example.com (Postfix) with ESMTPSA id F24707FE6D for <example(a)example.com>; Sat, 4 Dec 2010 18:16:00 +0000 (WET) Does this mean that I have SSL/TLS properly configured? The "No client certificate requested" is supposed to be there? Thank you. M.

3 4

[Dovecot] How to handle "Waiting for authentication process..."
by A.L.E.C 08 Dec '10

08 Dec '10

Sometimes, when dovecot authentication processes are busy, dovecot write reply "Waiting for authentication process to respond.." to client. Roundcube webmail do not understand it and invalidate user session. My question is what is a good practise to handle this situation by client software? One Roundcube user proposes to detect such response then wait a moment and try again. Is there any standard for this? How long should we wait? More info here: http://trac.roundcube.net/ticket/1487450 -- Aleksander 'A.L.E.C' Machniak LAN Management System Developer [http://lms.org.pl] Roundcube Webmail Developer [http://roundcube.net] --------------------------------------------------- PGP: 19359DC1 @@ GG: 2275252 @@ WWW: http://alec.pl

2 2

[Dovecot] local seen flags with shared mailboxes
by Tim Mauerbach 08 Dec '10

08 Dec '10

Hello all, after recent upgrade from 2.0.5 to 2.0.8 it seems that local seen flags for mails reside in shared mailboxes doesn´t work anymore. Before the upgrade I had read mails with account #1. Account #2 (who has access via acl) saw the mails still as unread. Now, no matter who read the mails, the other account see the same flags, immediately. I read the related wiki pages again and tried to find any configuration error, unfortunately without much success. I´ve attached output from "doveconf -n" and a debug logfile. Thanks a lot! Tim

2 2

Re: [Dovecot] mail.err
by Karsten Bräckelmann 08 Dec '10

08 Dec '10

Please *do* keep the thread on the list, by replying to the list only. On Tue, 2010-12-07 at 18:07 -0500, Paul Cartwright wrote: > On 12/07/2010 05:25 PM, Karsten Bräckelmann wrote: > > Even though this *really* is not related to dovecot at all, while we're > > here, I might as well try to help nonetheless -- failing with an IPv6 > > address does look familiar. I don't recall the log messages, since I > > mostly debugged with fetchmail directly. > > I don't think I am using IPv6, actually I KNOW I'm not using it, I'm > pretty sure I turned off that functionality.. I don't think my router > supports it.. > I KNOW I didn't try to add that functionality to either fetchmail, > Postfix or Divecot! As I mentioned in another post, your log message clearly shows the IPv6 address is being used. And yes, your host obviously is capable of that. You don't need to specifically enable it with fetchmail. It will under certain circumstances default to IPv6, which in your case happened. As also mentioned, your postfix seems to not bind to the IPv6 address by default, though, or it has deliberately been disabled. Moreover, your router is not even in the picture here -- just like dovecot, FWIW. Fetchmail fetches the mail from a remote server, and tries to deliver it locally. That local delivery step is generating the log messages. A mail, sent from and to your box. Long after the data stream passed your router... [ long snip, including your fetchmailrc general settings ] > I will add what you have there, and see what happens, thanks! -- char *t="\10pse\0r\0dtu\0.@ghno\x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4"; main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i<l;i++){ i%8? c<<=1: (c=*++x); c&128 && (s+=h); if (!(h>>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}}

1 0

[Dovecot] IMAP Timeout Leak
by qmail＠top-consulting.net 08 Dec '10

08 Dec '10

My Dovecot config is as follows: # 1.2.14: /usr/local/etc/dovecot.conf # OS: FreeBSD 6.3-RELEASE i386 protocols: imap pop3 imaps pop3s listen(default): *:143 listen(imap): *:143 listen(pop3): *:110 ssl_listen(default): *:993 ssl_listen(imap): *:993 ssl_listen(pop3): *:995 ssl_ca_file: /usr/local/certs/gd_bundle.crt ssl_cert_file: /usr/local/certs/imap.crt ssl_key_file: /usr/local/certs/rsa.imap.key disable_plaintext_auth: no login_dir: /var/run/dovecot/login login_executable(default): /usr/local/libexec/dovecot/imap-login login_executable(imap): /usr/local/libexec/dovecot/imap-login login_executable(pop3): /usr/local/libexec/dovecot/pop3-login login_greeting: MAIL ready. login_processes_count: 50 login_max_processes_count: 500 max_mail_processes: 798 mail_max_userip_connections(default): 100 mail_max_userip_connections(imap): 100 mail_max_userip_connections(pop3): 10 verbose_proctitle: yes first_valid_uid: 89 first_valid_gid: 89 mail_privileged_group: mail mail_uid: 89 mail_gid: 89 mail_location: maildir:~/Maildir mmap_disable: yes mail_nfs_storage: yes mail_nfs_index: yes lock_method: dotlock mail_executable(default): /usr/local/libexec/dovecot/imap mail_executable(imap): /usr/local/libexec/dovecot/imap mail_executable(pop3): /usr/local/libexec/dovecot/pop3 mail_plugins(default): quota imap_quota fts fts_solr antispam virtual acl imap_acl mail_plugins(imap): quota imap_quota fts fts_solr antispam virtual acl imap_acl mail_plugins(pop3): virtual mail_plugin_dir(default): /usr/local/lib/dovecot/imap mail_plugin_dir(imap): /usr/local/lib/dovecot/imap mail_plugin_dir(pop3): /usr/local/lib/dovecot/pop3 imap_client_workarounds(default): delay-newmail netscape-eoh tb-extra-mailbox-sep imap_client_workarounds(imap): delay-newmail netscape-eoh tb-extra-mailbox-sep imap_client_workarounds(pop3): pop3_client_workarounds(default): pop3_client_workarounds(imap): pop3_client_workarounds(pop3): outlook-no-nuls oe-ns-eoh namespace: type: private separator: . inbox: yes list: yes subscriptions: yes namespace: type: private separator: . prefix: INBOX. hidden: yes list: no subscriptions: yes namespace: type: private separator: . prefix: Labels. location: virtual:~/Maildir/Labels:INDEX=MEMORY list: yes subscriptions: yes namespace: type: shared separator: . prefix: shared.%%n. location: maildir:%%h/Maildir:INDEX=~/Maildir/shared/%%u list: children lda: sendmail_path: /usr/sbin/sendmail auth default: mechanisms: plain login digest-md5 cram-md5 username_format: %Lu verbose: yes passdb: driver: vpopmail args: webmail=192.168.1.4 userdb: driver: vpopmail args: quota_template=quota_rule=*:backend=%q socket: type: listen master: path: /var/run/dovecot/auth-master mode: 384 user: vpopmail plugin: fts: solr fts_solr: break-imap-search url=http://192.168.1.4:8983/solr/ quota: maildir quota_rule: ?:storage=0 antispam_signature: X-DSPAM-Signature antispam_trash: trash;Trash;Deleted Items antispam_spam: Spam antispam_dspam_binary: /usr/local/bin/dspam antispam_dspam_args: --client;--user;vpopmail acl: vfile acl_shared_dict: proxy::acl dict: acl: mysql:/usr/local/etc/dovecot-dict-sql.conf and I see the following error in the logs: Timeout leak: 0x80ff950 Running it through gdb, I get this: (gdb) x 0x80ff950 0x80ff950 <client_dict_timeout>: 0x53e58955 Is it a problem with the ACL plugin ?

2 1

[Dovecot] imap/pop proxy and filter
by Mike Korizek 07 Dec '10

07 Dec '10

Hi I use dovecot as imap/pop proxy. Is it possible to filter the messages before they get delivered to the client? Thanks for any hint how to achieve this. Mike

2 3

[Dovecot] proxy and gpg processing
by Mike 07 Dec '10

07 Dec '10

Hi I have dovecot running as pure proxy for accessing imap and pop mailboxes on other servers. How can I do the following scenario: When a client user reads a gpg signed or gpg encrypted email through the proxy, can I verify/decrypt the email before it gets delivered to the client user? Ideally I would like to write a perl program which processes the email within the proxy before it gets delivered to the user. With Sieve I can not do this, is there another way to achieve this? Thanks for any hint. Mike

1 0

Re: [Dovecot] imap/pop proxy and filter
by Mike Korizek 07 Dec '10

07 Dec '10

On 12/07/2010 12:18 AM, Paul Cartwright wrote: > On 12/06/2010 06:04 PM, Mike Korizek wrote: >> I use dovecot as imap/pop proxy. >> Is it possible to filter the messages before they get delivered to the >> client? >> > > http://wiki.dovecot.org/LDA/Sieve My understanding was, that Sieve requires LDA but I do not have local mailboxes as I only use the imap/pop proxy functionality. Can I use Sieve for mail filtering despite I do not have local mailboxes? Thanks, Mike

1 0

[Dovecot] imap limits please ?
by Spyros Tsiolis 06 Dec '10

06 Dec '10

Hello, Finally managed to sync an outlook client to dovecot. Looks like it's working. Questions though ; : What are the limits? Number of Folders ? Number of mails per folder ? E.g. for a client of mine, I know that she uses about 5Gb of data at the moment (and counting). Now, this same outlook client consists of the following : 1. about thirty (30) folders ranging from 1000 messages per folder to 100 messages per folder 2. A "Sent Items" folder with about 4,000 messages (and counting) 3. A "Deleted Items" folder with about 5,500 messages (and counting) System, now, is a CentOS 5.5 32-bit on an hp/compaq dl360 (G3) with RAID1 76,3Gb Disks UW320 and four (4Gb) of RAM Output of "dovecot -n" : ------------------------------------------------------------ # 1.2.16: /etc/dovecot/dovecot.conf # OS: Linux 2.6.18-194.17.4.el5 i686 CentOS release 5.5 (Final) ext3 base_dir: /var/run/dovecot/ log_path: /var/log/dovecot/dovecot.log info_log_path: /var/log/dovecot/dovecot-info.log ssl_parameters_regenerate: 48 verbose_ssl: yes login_dir: /var/run/dovecot//login login_executable: /usr/local/dovecot/libexec/dovecot/imap-login login_greeting: * Dovecot ready * login_max_processes_count: 32 mail_location: maildir:/var/MailRoot/domains/%d/%n/Maildir mail_plugins: zlib auth default: verbose: yes debug: yes debug_passwords: yes passdb: driver: passwd-file args: /etc/dovecot/passwd passdb: driver: pam userdb: driver: static args: uid=vmail gid=vmail home=/home/vmail/%u userdb: driver: passwd ------------------------------------------------------------ Any answer would be greatly appreciated since I am trying to know the systems' limits. Thank you kindly all, spyros ---- "I merely function as a channel that filters music through the chaos of noise" - Vangelis

2 1

[Dovecot] CentOS 5 + selinux
by Marcelo Roccasalva 06 Dec '10

06 Dec '10

I've just installed CentOS 5.5 and dovecot 2.0.7. Out of the box, it worked ok with local user accounts. Then I enable selinux and I could no loger login to imap server. I can deal with that via a local policy. But I found dovecot tried to open /etc/shadow: type=AVC msg=audit(1291490764.101:670): avc: denied { read } for pid=16130 comm="auth" name="shadow" dev=md2 ino=96335 scontext=user_u:system_r:dovecot_t:s0 tcontext=system_u:object_r:shadow_t:s0 tclass=file type=AVC msg=audit(1291500097.318:818): avc: denied { getattr } for pid=17350 comm="auth" path="/etc/shadow" dev=md2 ino=95396 scontext=user_u:system_r:dovecot_t:s0 tcontext=system_u:object_r:shadow_t:s0 tclass=file even it is configured for pam passdb: # dovecot -n # 2.0.7: /etc/dovecot/dovecot.conf # OS: Linux 2.6.18-194.26.1.el5 x86_64 CentOS release 5.5 (Final) mbox_write_locks = fcntl passdb { driver = pam } ssl_cert = </etc/pki/dovecot/certs/dovecot.pem ssl_key = </etc/pki/dovecot/private/dovecot.pem userdb { driver = passwd } I straced the process and it efectively tries to open /etc/shadow. I don't want to disable selinux but I'm not happy letting dovecot read my /etc/shadow. Is there a guide to selinux and dovecot? -- Marcelo "¿No será acaso que ésta vida moderna está teniendo más de moderna que de vida?" (Mafalda)

2 1