- dovecot - dovecot.org

[Dovecot] Released Sieve v0.1.11 and ManageSieve v0.11.8 for Dovecot v1.2.3
by Stephan Bosch 10 Aug '09

10 Aug '09

Hello Dovecot users, Apart from unfinished development of the date extension, this is a set of bug-fix releases. A few portability issues were found, a few stupidities were fixed and the ManageSieve proxy now also works with TLS. Most notably, the include extension had an issue regarding the expansion of $HOME in the personal include path. I've built a project site at: http://pigeonhole.dovecot.org Changelog Sieve v0.1.11: + Built skeleton implementation for the date extension (RFC5260). It compiles, but it does not do anything useful yet. Therefore, it is not part of the default compilation. - Fixed ARM portability issues caused by char type not being signed on that platform. Reading optional operands from a binary would fail for action side effects. Also, an accidental mixup of an int return type with bool caused the interpreter to continue on ARM even though an error occured. - Removed direct stdint.h includes to prevent portability issues. - Fixed segfault bug in the handling of script open failures. - Include: improved user error messages and system log messages. - Fixed copy-paste mixup between sieve_after and sieve_before settings in the LDA Sieve plugin. If only a sieve_after script was active, nothing would have been executed. Patch by Mike Abbott. - Include: fixed a bug in HOME substitution in the sieve_dir path. Surfaced in ManageSieve. Changelog ManageSieve v0.11.8: - Fixed TLS support for proxying ManageSieve. The protocol state machine was incorrect. Also added a check that disables ssl when 'starttls' is not enabled for the user. This produces a proper warning in the log file. There is no such thing as a managesieveS protocol which has SSL from the start. The releases are available as follows: Sieve: http://www.rename-it.nl/dovecot/1.2/dovecot-1.2-sieve-0.1.11.tar.gz http://www.rename-it.nl/dovecot/1.2/dovecot-1.2-sieve-0.1.11.tar.gz.sig ManageSieve (package + patch): http://www.rename-it.nl/dovecot/1.2/dovecot-1.2-managesieve-0.11.8.tar.gz http://www.rename-it.nl/dovecot/1.2/dovecot-1.2-managesieve-0.11.8.tar.gz.s… http://www.rename-it.nl/dovecot/1.2/dovecot-1.2.3-managesieve-0.11.8.diff.gz http://www.rename-it.nl/dovecot/1.2/dovecot-1.2.3-managesieve-0.11.8.diff.g… Have fun testing the new releases and don't hesitate to notify me when there are problems. Regards, -- Stephan Bosch stephan(a)rename-it.nl

3 3

[Dovecot] virtual plugin and ACL
by Nikita Koshikov 10 Aug '09

10 Aug '09

Hello list, We are using virtual plugin for to provide users two additional folders: Company/all - it contains all messages in user's mailbox Company/favorites - here is flagged messages. Here is namespace part of config file: namespace private { prefix = Company/ separator = / location = virtual:/var/mail/virtual:INDEX=MEMORY:LAYOUT=maildir++ subscriptions = no } Everything works fine, but problem arises when someone rename or delete virtual mailbox. With above config, 1 user make changes to his mailbox, but changes distribute for entire domain. First, I have tried to add :CONTROL=/data/mail/%d/%n/data/virtual to location part of virtual namespace, but I have no luck with such settings. Directory /data/mail/%d/%n/data/virtual not even been created. Then I tried to setup ACL for virtual mailbox. Adding "acl" to mail_plugins in imap and lda section and acl=vfile to plugins config. Under /var/mail/virtual in each mailbox I create dovecot-acl file contaning: user=koshikov.n lrwstiekxa authenticated lrwstipe But this didn't work. * OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE AUTH=PLAIN AUTH=LOGIN] Server ready. a login test qwe a OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE SORT THREAD=REFERENCES THREAD=REFS MULTIAPPEND UNSELECT IDLE CHILDREN NAMESPACE UIDPLUS LIST-EXTENDED I18NLEVEL=1 CONDSTORE QRESYNC ESEARCH ESORT SEARCHRES WITHIN CONTEXT=SEARCH QUOTA] Logged in a list "" * * LIST (\HasNoChildren) "/" "Sent" * LIST (\HasNoChildren) "/" "Drafts" * LIST (\HasNoChildren) "/" "Spam" * LIST (\HasNoChildren) "/" "Trash" * LIST (\HasNoChildren) "/" "INBOX" * LIST (\Noselect \HasChildren) "/" "Company" * LIST (\HasNoChildren) "/" "Company/all" * LIST (\HasNoChildren) "/" "Company/favorites" a OK List completed. a select Company/all * FLAGS (\Answered \Flagged \Deleted \Seen \Draft NonJunk) * OK [PERMANENTFLAGS (\Answered \Flagged \Deleted \Seen \Draft NonJunk \*)] Flags permitted. * 13 EXISTS * 0 RECENT * OK [UIDVALIDITY 1249459221] UIDs valid * OK [UIDNEXT 14] Predicted next UID * OK [NOMODSEQ] No permanent modsequences a OK [READ-WRITE] Select completed. a getacl a BAD Error in IMAP command GETACL: Unknown command. a rename Company/all Company/test a OK Rename completed. After "rename completed" in /var/mail/virtual new file dovecot-acl-list is appear with content: 1249457074 test How can I get workaround for this situation ? I just need to restrict my users renaming and deleting virtualboxes.

2 2

[Dovecot] how secure is Dovecot when exposed to the Internet?
by Florin Andrei 10 Aug '09

10 Aug '09

$ dovecot -n # 1.1.11: /etc/dovecot/dovecot.conf # OS: Linux 2.6.28-11-server x86_64 Ubuntu 9.04 protocols: imap imaps managesieve I need to make an IMAP (actually imaps) server available over the Internet. Unfortunately, VPN is not available (not all clients support VPN), so I will have to expose the imaps port to the Internet. My question is: how reliable is Dovecot in such a setup? I am not talking about encryption (protecting the traffic between server and client). I am talking about having the daemon exposed to anything coming in from the Internet, buffer overflows and stuff like that. What's the security history of this software in situations like this? -- Florin Andrei http://florin.myip.org/

2 2

[Dovecot] http://wiki.dovecot.org/LDA typo
by LEVAI Daniel 09 Aug '09

09 Aug '09

-Note that dovecot.conf file must be world readable to enable deliver process read it, while running with user priviledges. +Note that dovecot.conf file must be world readable to enable deliver process read it, while running with user privileges. -- LÉVAI Dániel PGP key ID = 0x4AC0A4B1 Key fingerprint = D037 03B9 C12D D338 4412 2D83 1373 917A 4AC0 A4B1

2 2

[Dovecot] Wiki entry for expire plugin, PostgreSQL trigger needs update
by Stefan Förster 09 Aug '09

09 Aug '09

The wiki entry at http://wiki.dovecot.org/Plugins/Expire needs an update for Dovecot 1.2 and PostgreSQL: -- v1.2+: CREATE OR REPLACE FUNCTION merge_expires() RETURNS TRIGGER AS $$ BEGIN IF exists(SELECT 1 FROM expires WHERE username = NEW.username AND mailbox = NEW.mailbox) THEN UPDATE expires SET expire_stamp = NEW.expire_stamp WHERE username = NEW.username AND mailbox = NEW.mailbox; RETURN NULL; ELSE RETURN NEW; END IF; END; $$ LANGUAGE plpgsql; CREATE TRIGGER mergeexpires BEFORE INSERT ON expires FOR EACH ROW EXECUTE PROCEDURE merge_expires(); At least that's what I think after looking at the code: iter = dict_iterate_init(dict, DICT_EXPIRE_PREFIX, DICT_ITERATE_FLAG_RECURSE | DICT_ITERATE_FLAG_SORT_BY_VALUE); /* We'll get the oldest values (timestamps) first */ while (dict_iterate(iter, &key, &value) > 0) { /* key = DICT_EXPIRE_PREFIX<user>/<mailbox> */ userp = key + strlen(DICT_EXPIRE_PREFIX); [...] T_BEGIN { username = t_strdup_until(userp, p); If this code does somehow iterate usernames which are not present in the dict, I apologize. Cheers Stefan

1 1

[Dovecot] User Auth
by Richard Harwood 09 Aug '09

09 Aug '09

Hello all, I am new to the mailing list and I'm in the process of setting up a LAMP + mail server. I have configured my MTA (Postfix) to deliver messages to: /var/spool/mail/vhosts/domain.tld/name I have configured Dovecot as follows: -- # 1.2.2: /usr/local/etc/dovecot.conf protocols: imap imaps pop3 ssl: no disable_plaintext_auth: no login_dir: /usr/local/var/run/dovecot/login login_executable(default): /usr/local/libexec/dovecot/imap-login login_executable(imap): /usr/local/libexec/dovecot/imap-login login_executable(pop3): /usr/local/libexec/dovecot/pop3-login mail_privileged_group: mail mail_location: mbox:/var/spool/mail/vhosts/%d:INBOX=/var/spool/mail/vhosts/%d/%n mail_debug: yes mail_executable(default): /usr/local/libexec/dovecot/imap mail_executable(imap): /usr/local/libexec/dovecot/imap mail_executable(pop3): /usr/local/libexec/dovecot/pop3 mail_plugin_dir(default): /usr/local/lib/dovecot/imap mail_plugin_dir(imap): /usr/local/lib/dovecot/imap mail_plugin_dir(pop3): /usr/local/lib/dovecot/pop3 lda: postmaster_address: postmaster(a)example.com auth default: debug: yes passdb: driver: passwd-file args: /etc/passwd.dovecot userdb: driver: passwd -- Password excepted, my passwd.dovecot file containing a single virtual user looks like: richard:{plain}password:504:505::/home/vmail The uid/gid is the same as used by Postfix (a dedicated vmail user/group). That user/group owns the mbox I am trying to manipulate in this example. When I attempt to login via telnet on port 110 I get the error: +OK Dovecot ready. user richard(a)richardaharwood.com +OK pass password -ERR Authentication failed. It seems to dislike the fact I specify the domain as part of the login username. If I repeat and login as: user richard - I am authenticated, however I get the error: -ERR [IN-USE] Couldn't open INBOX: Internal error occurred. Refer to server log for more information. Tailing the maillog, I see the following: Aug 8 17:19:01 richardaharwood dovecot: auth(default): client in: AUTH 1 PLAIN service=pop3 secured lip=83.170.110.193 rip=83.170.110.193 lport=110 rport=58115 resp=<hidden> Aug 8 17:19:01 richardaharwood dovecot: auth(default): passwd-file(richard,83.170.110.193): lookup: user=richard file=/etc/passwd.dovecot Aug 8 17:19:01 richardaharwood dovecot: auth(default): client out: OK 1 user=richard Aug 8 17:19:01 richardaharwood dovecot: auth(default): master in: REQUEST 4 3603 1 Aug 8 17:19:01 richardaharwood dovecot: auth(default): passwd(richard,83.170.110.193): lookup Aug 8 17:19:01 richardaharwood dovecot: auth(default): master out: USER 4 richard system_groups_user=richard uid=500 gid=500 home=/home/richard Aug 8 17:19:01 richardaharwood dovecot: POP3(richard): Effective uid=500, gid=500, home=/home/richard Aug 8 17:19:01 richardaharwood dovecot: POP3(richard): mbox: data=/var/spool/mail/vhosts/:INBOX=/var/spool/mail/vhosts//richard Aug 8 17:19:01 richardaharwood dovecot: POP3(richard): fs: root=/var/spool/mail/vhosts, index=, control=, inbox=/var/spool/mail/vhosts//richard Aug 8 17:19:01 richardaharwood dovecot: POP3(richard): open(/var/spool/mail/vhosts//richard) failed: Permission denied (euid=500(richard) egid=500(richard) missing +x perm: /var/spool/mail/vhosts/) Aug 8 17:19:01 richardaharwood dovecot: POP3(richard): Couldn't open INBOX: Internal error occurred. Refer to server log for more information. [2009-08-08 17:19:01] Aug 8 17:19:01 richardaharwood dovecot: POP3(richard): Couldn't open INBOX top=0/0, retr=0/0, del=0/0, size=0 Aug 8 17:19:01 richardaharwood dovecot: pop3-login: Login: user=<richard>, method=PLAIN, rip=83.170.110.193, lip=83.170.110.193, secured Assuming I could login with richard(a)richardaharwood.com, I should imagine Dovecot will successfully find the inbox, which is located at /var/spool/mail/vhosts/richardaharwood.com/richard in this example. I also notice the effective uid/gid is not that specified in the passwd file? The uid/gid appears to be that of my own ssh account which is not connected to the mail account that I wish to simply access as a virtual user. Would anyone be kind enough to point me in the right direction? In a nutshell, where am I going wrong with my authentication? This is a basic setup for the time being, until I get my head around it, but any pointers would be really appreciated. Have spent quite a few hours but I don't feel much closer to getting to the bottom of it! :) Many thanks, Richard

2 1

[Dovecot] multiple auth-client sockets
by LEVAI Daniel 09 Aug '09

09 Aug '09

Hi! I'm gonna need to use dovecot's auth-client socket in an authentication program. Now the auth-client socket is only used by my MTA, which is postfix. Because postfix's smtpd process (which uses the auth-client socket) runs chrooted under postfix's spool directory, I must create the auth-client socket under that spool directory. However, to reach that socket from another chrooted program is impossible. Can I create multiple instances of auth-client sockets? I tried to define another client {} stanza in socket listen {} in dovecot.conf, but only the last client socket got created. I need only a true or false response from dovecot regarding the authentication, and I thought that this is exactly what auth-client socket will do. However, if I can not reach it, is there any alternative to this? What's up with the auth-master or auth-worker sockets? Are they capable of respond to an auth request too? btw, I'm running dovecot-1.2.3 Thanks! Daniel -- LÉVAI Dániel PGP key ID = 0x4AC0A4B1 Key fingerprint = D037 03B9 C12D D338 4412 2D83 1373 917A 4AC0 A4B1

3 3

[Dovecot] autocreate plugin fails to subscribe mailbox in public namespace
by Stefan Förster 09 Aug '09

09 Aug '09

Hi, I'm one step away from replacing a 7 years old qmail/uw-imapd setup with some state of the art soft- and hardware. We got migration scripts and test almost done - just one thing that keeps failing: The autocreate plugin is supposed to subscribe new users to different mailboxes, one of them being in namespace "Public." - this subscription to "Public.announcements" fails. Below is a dovecot -n - and no, there are no error messages in the logs. # 1.2.2: /etc/dovecot/dovecot.conf # OS: Linux 2.6.30-bpo.1-amd64 x86_64 Debian 5.0.2 log_timestamp: %Y-%m-%d %H:%M:%S protocols: imap imaps managesieve listen(default): *:143 listen(imap): *:143 listen(managesieve): * ssl_listen(default): *:993 ssl_listen(imap): *:993 ssl_listen(managesieve): ssl_cert_file: /etc/ssl/owncerts/snakeoil.crt ssl_key_file: /etc/ssl/private/snakeoil.key login_dir: /var/run/dovecot/login login_executable(default): /usr/lib/dovecot/imap-login login_executable(imap): /usr/lib/dovecot/imap-login login_executable(managesieve): /usr/lib/dovecot/managesieve-login verbose_proctitle: yes mail_privileged_group: vmail mail_location: maildir:~/Maildir mbox_write_locks: fcntl dotlock mail_executable(default): /usr/lib/dovecot/imap mail_executable(imap): /usr/lib/dovecot/imap mail_executable(managesieve): /usr/lib/dovecot/managesieve mail_process_size: 384 mail_plugins(default): quota imap_quota fts fts_squat acl autocreate expire trash mail_plugins(imap): quota imap_quota fts fts_squat acl autocreate expire trash mail_plugins(managesieve): mail_plugin_dir(default): /usr/lib/dovecot/modules/imap mail_plugin_dir(imap): /usr/lib/dovecot/modules/imap mail_plugin_dir(managesieve): /usr/lib/dovecot/modules/managesieve namespace: type: private separator: . inbox: yes list: yes subscriptions: yes namespace: type: public separator: . prefix: Public. location: maildir:/export/vmailboxes/public:INDEX=~/Maildir/public list: yes lda: postmaster_address: postmaster(a)test.cite.lan hostname: testvm06.test.cite.lan mail_plugins: quota sieve expire trash auth_socket_path: /var/run/dovecot/auth-master auth default: mechanisms: plain login cram-md5 passdb: driver: ldap args: /etc/dovecot/dovecot-ldap.conf userdb: driver: ldap args: /etc/dovecot/dovecot-ldap.conf socket: type: listen client: path: /var/spool/postfix/private/auth mode: 432 user: postfix group: sasl master: path: /var/run/dovecot/auth-master mode: 384 user: vmail group: vmail plugin: quota: maildir:User quota quota_warning: storage=90%% /usr/local/bin/quota-warning.sh 90 quota_warning2: storage=95%% /usr/local/bin/quota-warning.sh 95 sieve: ~/.dovecot.sieve sieve_storage: ~/sieve sieve_extensions: +imapflags fts: squat fts_squat: partial=4 full=10 acl: vfile autocreate: Trash autocreate2: Drafts autocreate3: Sent autocreate4: learn-spam autosubscribe: Trash autosubscribe2: Drafts autosubscribe3: Sent autosubscribe4: learn-spam autosubscribe5: Public.announcements autosubscribe6: INBOX expire: Trash 60 Trash/* 60 expire_dict: proxy::expire trash: /etc/dovecot/dovecot-trash.conf dict: expire: pgsql:/etc/dovecot/dovecot-dict-expire.conf Any hints are really appreciated. Cheers Stefan BTW: If anybody is interested, I could provide load and usage statistics of our old and new software once step 1 of our migration (new hardware is step 2) is done. Only ~1000 users, but still...

2 1

[Dovecot] fatal: no SASL authentication mechanisms
by Ebbe Hjorth 09 Aug '09

09 Aug '09

Hi, I have setup freebsd, postfix, dovecot and maia, but all the time i get the following error in /var/log/maillog - and i cant google me to the solution, please advice. Aug 9 12:18:49 mail02 dovecot: auth(default): Authentication client trying to connect to master socket Aug 9 12:18:49 mail02 postfix/smtpd[1356]: fatal: no SASL authentication mechanisms Aug 9 12:18:50 mail02 postfix/master[777]: warning: process /usr/local/libexec/postfix/smtpd pid 1355 exit status 1 Aug 9 12:18:50 mail02 postfix/master[777]: warning: /usr/local/libexec/postfix/smtpd: bad command startup -- throttling Aug 9 12:18:50 mail02 amavis[834]: (00834-04) mail_via_smtp: 450 4.4.1 Can't connect to 127.0.0.1 port 10025, Bad file descriptor at /usr/local/sbin/amavisd-maia line 6599, <GEN12> line 229., id=00834-04 mail02# dovecot -n # 1.1.16: /usr/local/etc/dovecot.conf # OS: FreeBSD 7.2-RELEASE-p2 i386 ufs protocols: imap imaps pop3 pop3s ssl_cert_file: /etc/ssl/dovecot/cert.pem ssl_key_file: /etc/ssl/dovecot/key.pem disable_plaintext_auth: no login_dir: /var/run/dovecot/login login_executable(default): /usr/local/libexec/dovecot/imap-login login_executable(imap): /usr/local/libexec/dovecot/imap-login login_executable(pop3): /usr/local/libexec/dovecot/pop3-login login_greeting: Apz.dk mail server ready. login_greeting_capability(default): yes login_greeting_capability(imap): yes login_greeting_capability(pop3): no verbose_proctitle: yes first_valid_uid: 125 last_valid_uid: 125 first_valid_gid: 125 last_valid_gid: 125 mail_privileged_group: mail mail_location: maildir:/usr/local/virtual/%d/%n mail_executable(default): /usr/local/libexec/dovecot/imap mail_executable(imap): /usr/local/libexec/dovecot/imap mail_executable(pop3): /usr/local/libexec/dovecot/pop3 mail_plugin_dir(default): /usr/local/lib/dovecot/imap mail_plugin_dir(imap): /usr/local/lib/dovecot/imap mail_plugin_dir(pop3): /usr/local/lib/dovecot/pop3 imap_client_workarounds(default): delay-newmail netscape-eoh tb-extra-mailbox-sep imap_client_workarounds(imap): delay-newmail netscape-eoh tb-extra-mailbox-sep imap_client_workarounds(pop3): pop3_client_workarounds(default): pop3_client_workarounds(imap): pop3_client_workarounds(pop3): outlook-no-nuls oe-ns-eoh auth default: mechanisms: plain login username_format: %Lu passdb: driver: sql args: /usr/local/etc/dovecot-sql.conf userdb: driver: sql args: /usr/local/etc/dovecot-sql.conf socket: type: listen client: path: /var/run/dovecot/auth-client mode: 432 master: path: /var/spool/postfix/private/auth mode: 432 user: postfix group: postfix

2 2

[Dovecot] Creating a "default" domain
by Charles Sprickman 09 Aug '09

09 Aug '09

Hello, I'm setting up a test server to work through the issues involved in bringing a bunch of vpopmail/qmail/courier users into a postfix/dovecot server. So far I'm seeing lots of info to aid in the transition. One thing I'm lost on is that since Dovecot is providing all the auth mechanisms rather than vpopmail, I'm not sure how to emulate a particular vpopmail behavior we rely on. Vpopmail allows for the concept of a "default" domain for authentication. So if I have a bunch of domains, and one is "example.com", users in that domain can login with only the username part of their id (ie: "john") rather than supplying the domain (ie: "john(a)example.com"). I need to continue to offer this unless I want to walk a few hundred users through reconfiguring their mail clients. :) Any pointers? Thanks, Charles ___ Charles Sprickman NetEng/SysAdmin Bway.net - New York's Best Internet - www.bway.net spork(a)bway.net - 212.655.9344

2 2