- dovecot - dovecot.org

Re: [Dovecot] I stream read - stale NFS file handle (reboot of server)
by Damon Atkins 29 Mar '10

29 Mar '10

NFS Security 101 for NFSv2 and v3 (NOT NFSv4 a long time ago I was part of the discussion group for NFSv4 spec the short comings of v2 and v3 have been fixed) SRV: Server Exports File System /abc/123 access only to host=xyz.domain.com XYZ: Client Mount mount's SRV:/abc/123 SRV: "mountd" gets a request from SRV check access list, and if the client is allowed access, returns File Handle for the top of the mount point (I will call this the FileSystemHandle, this changes after every reboot) XYZ: Client talks to the SRV NFS Server "nfsd" using FileSystemHandle (which represents /abc/123), To find a FileHandle for a file the client sends the NFS server the FileSystemHandle, then finds the next File Handle (/mydir) and the next FileHandle (myfile) and the client has found the FileHandle for /abc/123/mydir/myfile NFSD (v2/v3) is stateless other than the information provided by mountd (mount requests) and lockd (file locking). When you share/export a file system, as part of this a FileSystemHandle is generated and stored somewhere for /abc/123 most likely store in the kernel. SRV: Reboots, a new FileSystemHandle is allocated XYZ: Reports Stale File Handle for everything (if not most things) which was mounted from SRV or the mount point on the client does not respond. A long time ago FileSystemHandle would stay the same between reboots and you wouldn't get this problem other than on an individual file. To handle deleted files which are in use by NFS clients some servers rename them to .nfs* because if one client deleted and other clients where accessing the file then they would get Stale NFS handle. Once in a while a NFS server will do find $dir -type f -name .nfs\* -mtime +7 -mount -exec rm -f {} \; to clean up. NFSv4 does not use mountd or lockd. My advice to anyone on old versions of NFS upgrade to NFSv4 as soon as possible and implement KerbV5 for improved authentication and disallow NFSv2/3 access. If you do not get the Stale File Handle error when the server reboots, it most likely means the FileSystemHandle is not changing between reboots, but then you may have more security issues. Software which Clusters NFS Servers ensures that the node which takes over, uses the same FileSystemHandle (which may only change if the whole Cluster is shutdown) Cheers Damon.

2 4

[Dovecot] failed: Too many open files
by Masaharu Kawada 29 Mar '10

29 Mar '10

Dear list, I have questions about content of the following error messages. ---</var/log/secure>--- dovecot-auth:　PAM　unable　todlopen(/lib/security/pam_nologin.so) dovecot-auth:　PAM　[error:/lib/security/pam_nologin.so:　cannot　open　shared　object　file:　Too　many　open　files] dovecot-auth:　PAM　adding　faulty　module:/lib/security/pam_nologin.so dovecot-auth:　PAM　_pam_load_conf_file:　unable　to　open　/etc/pam.d/system-auth dovecot-auth:　PAM　unable　to　dlopen(<*unknown　module　path*>) dovecot-auth:　PAM　[error:　*unknown　module　path*>:　cannot　open　shared　object　file:　Too　many　open　files] dovecot-auth:　PAM　adding　faulty　module:　<*unknown　module　path*> dovecot-auth:　PAM　_pam_load_conf_file:　unable　to　open　/etc/pam.d/system-auth dovecot-auth:　PAM　_pam_load_conf_file:　unable　to　open　/etc/pam.d/system-auth dovecot-auth:　PAM　unable　to　dlopen(/lib/security/pam_deny.so) dovecot-auth:　PAM　[error:/lib/security/pam_deny.so:　cannot　open　shared　object　file:　Too　many　open　files] dovecot-auth:　PAM　adding　faulty　module:/lib/security/pam_deny.so ---</var/log/maillog>--- dovecot: auth(default): pam(xxx(a)xxx.com,127.0.0.1): pipe() failed: Too many open files dovecot: auth(default): pam(xxx(a)xxx.com,127.0.0.1): pipe() failed: Too many open files It seems that this is due to that there are files existed to open beyond its limitation. Other information that could be relevant are as follows. # ulimit -n 1024 # cat /proc/`cat /var/run/dovecot/master.pid`/limits cat: /proc/7273/limits: No such file or directory # lsof -p `cat /var/run/dovecot/master.pid` | wc -l 29 # ls /proc/`pidof dovecot-auth`/fd | wc -l 1024 >From the above result, dovecot-auth proccess opened 10243 files, and that seems to be the limit. So I expect that adding following lines into /etc/init.d/dovecot could be fix this issue. # vi /etc/init.d/dovecot --- . /etc/init.d/functions ulimit -n 4098 <-add test -x /usr/sbin/dovecot || exit 0 <-add if [ -f /etc/sysconfig/dovecot ]; then . /etc/sysconfig/dovecot fi --- Is my understanding right? Even if so, how could I verify what files are opened by dovecot-auth? I would very much appreciate it if someone in this list could provide comments/suggestions. Sincerely,

3 6

[Dovecot] Improper use of IN-USE in case of a failed authentication
by Rainer Weikusat 28 Mar '10

28 Mar '10

RFC2449 defines the IN-USE extended POP3 response code as 8.1.2. The IN-USE response code This occurs on an -ERR response to an AUTH, APOP, or PASS command. It indicates the authentication was successful, but the user's maildrop is currently in use (probably by another POP3 client). http://www.faqs.org/rfcs/rfc2449.html In contrast to this, the POP3 login code in client_authenticate.c will send IN-USE whenever authentication was not successful because of some kind of internal failure[*]. [*] Noticed during experiments with a shell SQL database driver which only ever returns errors as reaction to any query. I happen to know of at least one (partial) client implementation (I happen to have written which is used by an iPhone application for POP3 user credential verification) which actually interprets IN-USE as it is defined by the RFC.

2 2

[Dovecot] dsync multiserver
by Renaud Allard 28 Mar '10

28 Mar '10

Hello, Maybe I am missing something obvious here (I would hope so), but is there any way to use dovecot deliver to spawn dsync to replicate changes. And dovecot to trigger dsync to sync mailboxes when a change has been done. Thanks

2 1

[Dovecot] permanent flags (are very permanent)
by Oliver Eales 28 Mar '10

28 Mar '10

Hello, first of all i am not sure wheter this is a correct behavior according to the RFC or not... Problem is, when i set a new custom permanent flag (e.g. testflag) and remove it afterwards, the flag still stays in the list of the permanent flags of this drawer even if there are no messages left with this flag set. So the keyword list gets "polluted" with unused flags. * OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE STARTTLS AUTH=PLAIN] uc.vodafone.de Mailservices ready. AA login user notmypass AA OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE SORT SORT=DISPLAY THREAD=REFERENCES THREAD=REFS MULTIAPPEND UNSELECT IDLE CHILDREN NAMESPACE UIDPLUS LIST-EXTENDED I18NLEVEL=1 CONDSTORE QRESYNC ESEARCH ESORT SEARCHRES WITHIN CONTEXT=SEARCH QUOTA] Logged in A0 SELECT inbox * FLAGS (\Answered \Flagged \Deleted \Seen \Draft NonJunk Junk) * OK [PERMANENTFLAGS (\Answered \Flagged \Deleted \Seen \Draft NonJunk Junk \*)] Flags permitted. * 3805 EXISTS * 0 RECENT * OK [UNSEEN 1] First unseen. * OK [UIDVALIDITY 1260979519] UIDs valid * OK [UIDNEXT 4465] Predicted next UID * OK [HIGHESTMODSEQ 1] Highest A0 OK [READ-WRITE] Select completed. A1 STORE 1 +FLAGS (testflag) * FLAGS (\Answered \Flagged \Deleted \Seen \Draft NonJunk Junk testflag) * OK [PERMANENTFLAGS (\Answered \Flagged \Deleted \Seen \Draft NonJunk Junk testflag \*)] Flags permitted. * 1 FETCH (FLAGS (Junk testflag)) A1 OK Store completed. A2 SEARCH KEYWORD testflag * SEARCH 1 A2 OK Search completed (0.043 secs). A3 STORE 1 -FLAGS (testflag) * 1 FETCH (FLAGS (Junk)) A3 OK Store completed. A4 select inbox * OK [CLOSED] Previous mailbox closed. * FLAGS (\Answered \Flagged \Deleted \Seen \Draft NonJunk Junk testflag) * OK [PERMANENTFLAGS (\Answered \Flagged \Deleted \Seen \Draft NonJunk Junk testflag \*)] Flags permitted. * 3805 EXISTS * 0 RECENT * OK [UNSEEN 1] First unseen. * OK [UIDVALIDITY 1260979519] UIDs valid * OK [UIDNEXT 4465] Predicted next UID * OK [HIGHESTMODSEQ 1] Highest A4 OK [READ-WRITE] Select completed. So the new testflag keyword is now in the list even across logins. Regards, Oliver Eales

2 3

[Dovecot] Fix for the consume_results leak
by Rainer Weikusat 28 Mar '10

28 Mar '10

I'm not really comfortable with making non-trivial changes to this code but here is at least a fix for the PGresult leak (verified to both apply to 1.2.11 and 2.0.beta4). ----- --- dovecot/src/lib-sql/driver-pgsql.c 15 Mar 2010 18:18:14 -0000 1.1.1.2 +++ dovecot/src/lib-sql/driver-pgsql.c 26 Mar 2010 14:13:18 -0000 1.1.1.2.4.1 @@ -247,6 +247,17 @@ return 0; } +static inline int more_results(PGconn *pg) +{ + PGresult *pgres; + + pgres = PQgetResult(pg); + if (!pgres) return 0; + + PQclear(pgres); + return 1; +} + static void consume_results(struct pgsql_db *db) { do { @@ -255,7 +266,7 @@ if (PQisBusy(db->pg)) return; - } while (PQgetResult(db->pg) != NULL); + } while (more_results(db->pg)); if (PQstatus(db->pg) == CONNECTION_BAD) io_remove_closed(&db->io);

2 2

[Dovecot] convert v1.2 config to v2.0
by Odhiambo Washington 27 Mar '10

27 Mar '10

How do I convert a version 1.2.x config into a v2.0 config? Some command? -- Best regards, Odhiambo WASHINGTON, Nairobi,KE +254733744121/+254722743223 _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ "If you have nothing good to say about someone, just shut up!." -- Lucky Dube

2 1

[Dovecot] INBOX. namespace
by Brian Candler 27 Mar '10

27 Mar '10

I am trying to configure dovecot-1.2.11 to have the same IMAP namespacing as courier-imap as per http://wiki.dovecot.org/Migration/Courier, but failing badly. I have a test maildir with INBOX and folder 'junk'. Without fiddling with namespaces, this works fine: there are 91 msgs in INBOX and 2 in junk. a namespace * NAMESPACE (("" ".")) NIL NIL a OK Namespace completed. a examine INBOX ... * 91 EXISTS ... a OK [READ-ONLY] Select completed. a examine junk ... * 2 EXISTS ... a OK [READ-ONLY] Select completed. Now I make the following addition to dovecot.conf: namespace private { separator = . prefix = INBOX. inbox = yes hidden = no } After this the inbox appears to be empty, and I cannot select the junk folder at all: a namespace * NAMESPACE (("INBOX." ".")) NIL NIL a OK Namespace completed. a examine INBOX * FLAGS (\Answered \Flagged \Deleted \Seen \Draft) * OK [PERMANENTFLAGS ()] Read-only mailbox. * 0 EXISTS * 0 RECENT * OK [UIDVALIDITY 1269605071] UIDs valid * OK [UIDNEXT 1] Predicted next UID * OK [HIGHESTMODSEQ 1] Highest a OK [READ-ONLY] Select completed. a examine INBOX.junk * OK [CLOSED] Previous mailbox closed. a NO Mailbox doesn't exist: junk Furthermore I can select "INBOX.INBOX" (although that's empty as well) a examine INBOX.INBOX * FLAGS (\Answered \Flagged \Deleted \Seen \Draft) * OK [PERMANENTFLAGS ()] Read-only mailbox. * 0 EXISTS * 0 RECENT * OK [UIDVALIDITY 1269605071] UIDs valid * OK [UIDNEXT 1] Predicted next UID * OK [HIGHESTMODSEQ 1] Highest a OK [READ-ONLY] Select completed. a examine INBOX.INBOX.INBOX * OK [CLOSED] Previous mailbox closed. a NO Mailbox doesn't exist: INBOX.INBOX a examine junk a NO Unknown namespace. Have I misunderstood what I'm supposed to be doing here? The other relevant setting is: mail_location: maildir:%h but I've not changed this; as I say, this works just fine without meddling with namespaces. Many thanks, Brian.

2 4

[Dovecot] Dovecot 2.0beta4 changset 11014 dict: Panic: file driver-mysql.c
by e-frog 27 Mar '10

27 Mar '10

Hi, With the latest hg version I see panics with dict process whenever a message is received via lmtp. This didn't happen with the original beta4 release. Mar 27 11:45:51 ubuntu-test dovecot: dict: mysql: Connected to localhost (mails) Mar 27 11:45:51 ubuntu-test postfix/lmtp[5261]: 0F22B27F0D: to=<test(a)ubuntu-test.localdomain>, orig_to=<test(a)ubuntu-test.localdomain>, relay=ubuntu-test.localdomain[dovecot-lmtp], delay=0.41, delays=0.06/0.01 /0.22/0.11, dsn=2.0.0, status=sent (250 2.0.0 <test(a)ubuntu-test.localdomain> WsNlE9/hrUuOFAAA7I0XzQ Saved) Mar 27 11:45:51 ubuntu-test dovecot: master: service(dict): child 5263 killed with signal 6 (core not dumped) Mar 27 11:45:51 ubuntu-test dovecot: master: service(dict): command startup failed, throttling Mar 27 11:45:51 ubuntu-test dovecot: lmtp(5262, test): WsNlE9/hrUuOFAAA7I0XzQ: sieve: msgid=<4BADE1E9.7000709(a)ubuntu-test.localdomain>: from=test(a)ubuntu-test.localdomain: stored mail into mailbox 'INBOX' Mar 27 11:45:51 ubuntu-test dovecot: dict: Panic: file driver-mysql.c: line 633 (transaction_send_query): assertion failed: (rows != (my_ulonglong)-1) Mar 27 11:45:51 ubuntu-test dovecot: dict: Raw backtrace: /usr/lib/dovecot/libdovecot.so.0 [0xb773dd92] -> /usr/lib/dovecot/libdovecot.so.0 [0xb773ddff] -> /usr/lib/dovecot/libdovecot.so.0(i_erro r+0) [0xb77198ee] -> dovecot/dict [0x80506aa] -> dovecot/dict [0x80506e6] -> dovecot/dict(sql_transaction_commit_s+0x20) [0x804f730] -> dovecot/dict [0x804de42] -> /usr/lib/dovecot/libdovecot.so. 0(dict_transaction_commit_async+0x2f) [0xb771e4ff] -> dovecot/dict [0x804c930] -> dovecot/dict [0x804c35d] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run+0xe2) [0xb774a2d2] -> /usr/lib/d ovecot/libdovecot.so.0(io_loop_run+0x30) [0xb7749320] -> /usr/lib/dovecot/libdovecot.so.0(master_service_run+0x2a) [0xb7736dfa] -> dovecot/dict(main+0x19c) [0x804d00c] -> /lib/tls/i686/cmov/libc. so.6(__libc_start_main+0xe6) [0xb72dab56] -> dovecot/dict [0x804c051] Mar 27 11:45:51 ubuntu-test postfix/qmgr[2335]: 0F22B27F0D: removed Mar 27 11:45:51 ubuntu-test dovecot: lmtp(5262): read(/var/run/dovecot/dict) failed: Remote disconnected Mar 27 11:45:51 ubuntu-test dovecot: lmtp(5262): Disconnect from local: Client quit Thanks, e-frog ------------------------------------------------------------------------- # 2.0.beta4: /etc/dovecot/dovecot.conf # OS: Linux 2.6.31-20-generic-pae i686 Ubuntu 9.10 auth_debug = yes auth_socket_path = /var/run/dovecot/auth-userdb auth_username_format = %Ln deliver_log_format = msgid=%m: from=%f: %$ dict { dictionary = mysql:/etc/dovecot/dovecot-dict-sql.conf } disable_plaintext_auth = no lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes mail_debug = yes namespace { hidden = no inbox = yes list = yes location = prefix = separator = / subscriptions = yes type = private } namespace { location = virtual:/etc/dovecot/virtual:INDEX=~/.maildir/control prefix = virtual/ separator = / subscriptions = no type = private } passdb { args = /etc/dovecot/dovecot-sql.conf driver = sql } plugin { fts = squat fts_squat = partial=4 full=10 quota = dict:user::proxy::dictionary sieve = ~/.dovecot.sieve sieve_before = /etc/dovecot/sieve-global/ sieve_dir = ~/.sieve } postmaster_address = postmaster@ubuntu-test protocols = imap lmtp managesieve quota_full_tempfail = yes sendmail_path = /usr/lib/sendmail service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } unix_listener auth-userdb { mode = 0666 } } service dict { unix_listener dict { mode = 0666 } } service lmtp { unix_listener /var/spool/postfix/dovecot-lmtp { group = postfix mode = 0660 user = postfix } } service managesieve-login { inet_listener sieve_deprecated { port = 2000 } } ssl_cert = </etc/ssl/certs/dovecot.pem ssl_key = </etc/ssl/private/dovecot.pem userdb { args = /etc/dovecot/dovecot-sql.conf driver = sql } verbose_proctitle = yes protocol managesieve { mail_plugins = virtual } protocol lmtp { mail_plugins = virtual quota sieve } protocol lda { info_log_path = /var/log/deliver.log log_path = /var/log/deliver.log mail_plugins = virtual quota sieve } protocol imap { mail_plugins = quota imap_quota fts fts_squat virtual }

1 0

Re: [Dovecot] dovecot user
by Stan Hoeppner 27 Mar '10

27 Mar '10

Timo Sirainen put forth on 3/27/2010 2:18 AM: > On Sat, 2010-03-27 at 02:10 -0500, Stan Hoeppner wrote: >>> Maybe the native english speakers (and I'd think only a subset of them too). I had never heard of dovetail. >> >> I'm guessing that's because you're not a woodworker, or know any. ;) It's a >> great hobby if you ever found the spare time. > > Sure. But we're talking about UNIX admin kind people here. Somehow I > doubt they spent much attention to woodworking classes at school (we > actually had such classes, and I might know the Finnish word for > dovetail if someone told me it, but I doubt it's common knowledge in > either language). Probably depends on what city/state/province/country as well. I'm in the midwest USA, and alot of people in general, sysadmins or not, are DIY type folks. You grow up on a farm or in a small town and learn a whole lot of non computer stuff (including basic woodworking) before going to college and then to the big city for the sysadmin job. Then you visit mom/dad on the weekends, and they have you rebuilt the kitchen and bathroom. Then you decide to rebuild your own kitchen and bathroom. And then your neighbors find out you know how to do that kind of work and ... you lose a few more weekends. :( >>> I want something that's at least potentially understandable to people who understand english (and not just native speakers). I wouldn't know why some process is owned by user "dovel". That might not even make me realize it's a Dovecot process. >> >> How about "pigeon"? Dovecots house two kinds of birds, doves, and, far more >> often, pigeons. So, pigeon should be the new user name. No one knows what >> the heck a "dovecot" is until they look it up anyway (at least non Scots), >> so using "pigeon" is in keeping with naming your server Dovecot. There. >> Now that that's settled... > > But Dovecot is the name of the software, and admins know that, even if > they have no clue what it means. dove* as the username makes them think > of Dovecot regardless. You think anyone is going to add the user "pigeon" to any groups? I'm thinking that, as with "dovenull", that most would avoid touching "pigeon" at all costs. Then again, some may think their system was hacked, and want to remove the user "pigeon" lol. If your main goal is getting people to leave that user alone, I think pigeon would definitely fit the bill. And it adds a bit of humor to the mix since pigeons tend to crap all over everything. ;) >> dovecot dove-main >> dovecot-auth dove-auth >> imap-login dove-imaplgn >> pop3-login dove-poplgn >> imap dove-imap >> pop3 dove-pop3 >> >> Just a thought. But a nice thought at that. :) > > But you're talking about process names, right? That's already changed in > v2.0. You have one "dovecot" process and everything else is "dovecot/*". > For example: > > root 1840 0.0 0.0 43140 1328 pts/0 S+ 05:02 0:00 /usr/local/sbin/dovecot -F > dovecot 1841 0.0 0.0 30568 976 pts/0 S+ 05:02 0:00 dovecot/anvil > root 1842 0.0 0.0 30676 1120 pts/0 S+ 05:02 0:00 dovecot/log > root 2500 0.0 0.1 38524 2760 pts/0 S+ 08:59 0:00 dovecot/lmtp > root 2501 0.0 0.2 37684 4372 pts/0 S+ 08:59 0:00 dovecot/config > dovecot 2502 0.0 0.1 68500 3112 pts/0 S+ 08:59 0:00 dovecot/auth Ahh, sw333t! I haven't played with 2.0 yet so I hadn't seen this yet. That's precisely the kinda thing I had in mind. See? Great minds think alike. (most of the time anyway) ;) -- Stan

1 0