- dovecot - dovecot.org

[Dovecot] umask and mails
by Nicolas Letellier 03 Sep '08

03 Sep '08

Hello. I would like to have rights like 750 in my mailboxes (in /var/mail/vmails/domain.tld/user). http://wiki.dovecot.org/DovecotServerInstallations/RHEL/2_Users?highlight=(… I see an option called umask (in dovecot.conf). I set umask = 0750 in dovecot.conf. This option add good rights to directories, but not to the mail received (always in 700). Do you have a solution? Thanks. -- - Nicolas.

2 2

[Dovecot] checkpassword migration script in Python
by Dan Udey 03 Sep '08

03 Sep '08

Hey all, First post to the list, so here goes, hope I don't break any rules (I didn't see any rules about not being overly verbose) I spent a long time looking for anything that would help me migrate from our old IMAP server to our new one without a lot of client-side fuss, multiple e-mail accounts, and so on. I find that a lot of our users get confused by having two 'inboxes' in Outlook (one local, unused, and one IMAP), so I figured the easier I could make it, the better. I figured there must be some way to do what I was looking for, but I couldn't find it, so I hacked up a little something to do the job. As the saying goes, it's nasty, brutish, and short, but in my tests it's done everything I needed it to. The problem: Our old mail system is hosted by another company, outsourced before I was hired, so I don't have access to the old user/ passwd database, nor to their e-mail store; thus, I cannot do a clean, simple migration by upgrading in-place as I have done on other servers. The solution IMAP authentication proxying. The idea is that I don't need to know the password, because the user's mail client knows the password, so all I need is for it to tell me, and then I can create their user. That is what this script is for. To use, set up your authentication backend (passdb) first, and then after that section, add a 'passdb checkpassword' section containing this script. Thus, the following will happen. 1. Valid users who log into your system will be authenticated as you would expect. 2. Users who could not be authenticated will fall through to the checkpassword section 3. Checkpassword will look for the user in the password database; if they exist, it is assumed that it is a valid user, but incorrect password, and checkpassword fails the user as well. 4. If the user is not currently in the database, it will initiate an IMAP4 connection to the remote host specified. If it succeeds in logging in to the remote host, then we assume that the user is a valid user and can be migrated to the local server. They are added to the database, along with their password. It then **fails the user's login regardless** 5. It /logs the username and password into the database/ so that another process can use that information to migrate their e-mail over to the new server (not yet implemented). 6. If the IMAP connection fails, the login is failed as well, and dovecot continues as normal until it has exhausted all other passdb backends. Interested? A few things to note about the script: 1. It's a brutal hack. Really, ugly stuff. However, it gets the job done, if your system is similar enough to mine. 2. It only works on MySQL. I only use MySQL in our system, so there's no point for me to add other DBs, nor any way to test. 3. It doesn't support remote servers using SSL. Our current system doesn't use it, so again, it's hard to test. 4. It does not currently migrate mailboxes. I'm working on this (see below). 5. If your schema is at all different from mine, you will likely have to rewrite all of the SQL. There's not much I can do about this. 6. If your backend database doesn't use MySQL, you're largely boned. Exception: rewrite add_user() to do whatever you need to do to add users to your system. 7. The script will **ALWAYS RETURN A FAILED LOGIN TO DOVECOT**. This is because there are too many variables on every configuration, and writing code for all of them is absurd. This way, the user's first login will always fail, and their second login will always succeed. If you want to avoid this, place your normal passdb authentication **both before and after this checkpassword section**. That way, it will check once, fail, pass to checkpassword, and then check again, success. TODO: 1. Make it not ugly. Break more junk off into functions (e.g. IMAP verification) 2. Send the user an e-mail ('Welcome to the server, sorry your mail is gone, we'll fix that soon') 3. Spawn another process to run imapsync in the background to migrate the user's old mailboxes over. This would be very site-dependent, as there are a lot of variables. It might be best done as a cronjob that polls the database every however often (1 minute? 2 minutes?) or a daemon that sits in the background watching the db for changes, or even accepting the data directly. 4. Stop being so verbose in my first postings to mailing lists. 5. Lots of other things. URLS Blah blah blah where's the code. Here you go. Pretty syntax-highlighted version for browsing before you download, in case I'm an evil hacker: http://cdslash.net/temp/python/checkpassword.py Ugly monochrome version for downloading so you don't get line numbers in your junk: http://cdslash.net/temp/python/checkpassword.raw Questions, comments? I probably won't be on the list very long, so if you want to ask something or have a suggestion, feel free to let me know by e-mail at the address listed in the file's license notification. Alternately, find me on Freenode, occasionally in #dovecot or always in #macosx, as Darien, or some variant thereof. PS: The code is licensed under a boilerplate MIT license lifted from the OSI license page. If you want it under a different license, let me know. ;) Thanks, Dan

1 0

[Dovecot] authorizing users
by Wade Smart 03 Sep '08

03 Sep '08

Im trying to clarify if I understand correctly about authorizing users. "The simplest login method is sending the user login info in plain text and allowing access only to users that already have UNIX access (ie. in /etc/passwd) to the machine dovecot is running on." Im using fetchmail postfix dovecot on my own personal computer to get my mail from two servers. What Im wanting to understand is, is this saying that since I am already a user on my own system, that by using /etc/passwd that I would use my username and password in say thunderbird to login to dovecot to get my mail?

2 1

[Dovecot] Dovecot-1.1.2 segfaults in mail_cache_header_fields_get_offset
by Mike Abbott 03 Sep '08

03 Sep '08

Dovecot 1.1.2 crashes reliably for me now on a Mac OS X machine. Here's some info: --- Telnet session --- $ telnet localhost 143 Trying 127.0.0.1... Connected to localhost. Escape character is '^]'. * OK Dovecot ready. a login user1 password a OK Logged in. b select inbox * FLAGS (\Answered \Flagged \Deleted \Seen \Draft) * OK [PERMANENTFLAGS (\Answered \Flagged \Deleted \Seen \Draft \*)] Flags permitted. * 1 EXISTS * 1 RECENT * OK [UNSEEN 1] First unseen. * OK [UIDVALIDITY 1218731580] UIDs valid * OK [UIDNEXT 2] Predicted next UID b OK [READ-WRITE] Select completed. c fetch 1 rfc822.size Connection closed by foreign host. --- Error log --- dovecot: Aug 29 11:24:30 Info: imap-login: Login: user=<user1>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, secured dovecot: Aug 29 11:24:33 Error: IMAP(user1): Corrupted transaction log file /Volumes/Spool/spool/user1/mail/dovecot.index.log: hdr.size too large (75497472) dovecot: Aug 29 11:24:33 Warning: IMAP(user1): fscking index file / Volumes/Spool/spool/user1/mail/dovecot.index dovecot: Aug 29 11:24:48 Error: child 66917 (imap) killed with signal 11 --- Backtrace --- mail_cache_header_fields_get_offset + 214 mail_cache_header_fields_read + 37 mail_cache_open_and_verify + 167 mail_cache_field_exists + 77 index_mail_set_seq + 306 index_storage_search_next_nonblock + 464 mailbox_search_next + 52 imap_fetch + 345 cmd_fetch + 639 client_command_input + 33 client_command_input + 463 client_handle_input + 242 client_input + 151 io_loop_handler_run + 272 io_loop_run + 39 main + 1671 start + 52 If I do the exact same telnet all over again, the imap process crashes in the same place, but without reporting the "fscking index file" error first. Attached are all the post-fsck dovecot* files from the user's inbox maildir. For other users I see this error before imap crashes: dovecot: Aug 29 11:45:23 Error: IMAP(user2): Rebuilding index file / Volumes/Spool/spool/user2/mail/dovecot.index: CPU architecture changed Attached are pre- and post-rebuild copies of that user's dovecot* files, and also a copy from after a second telnet session which also crashed. It's possible this is a 32/64-bit incompatibility issue (imap is a 64- bit program for me; mail might have been delivered by a 32-bit deliver or previously read by a 32-bit imap) but more likely the dovecot* files are just hosed in some way. I can provide more information if you ask soon, but I can't keep this server broken for too long.

2 3

[Dovecot] Authentication problems
by Rodti MacLeary 02 Sep '08

02 Sep '08

Hi there, I'm in a bit of a dilemma and wonder if anyone can help. Over the weekend I bought a new dedicated server and moved my mail/web over to it. I'd used the Sarge[1] tutorial at workaround.org for the old server and as I'd wanted to move to Dovecot for a while I decided to use their Etch[2] tutorial for the new one. For the most part everything's working nicely, but I seem to be having problems with (mostly non-SSL) SMTP authentication. In this install Postfix passes SASL authentication to Dovecot. For most clients using SSL this works fine, but as soon as SSL is off it fails. This is despite having disable_plaintext_auth set to 'no'. Furthermore it appears that some clients w/SSL are also failing. Outlook being the major culprit. I'm completely stumped. I've pasted a copy of the output from dovecot -n below. Thanks in advance! Rodti [1] http://workaround.org/articles/ispmail-sarge [2] http://workaround.org/articles/ispmail-etch --------------------------------------------- # 1.0.13: /etc/dovecot/dovecot.conf log_timestamp: %Y-%m-%d %H:%M:%S protocols: imap imaps pop3 pop3s disable_plaintext_auth: no login_dir: /var/run/dovecot/login login_executable(default): /usr/lib/dovecot/imap-login login_executable(imap): /usr/lib/dovecot/imap-login login_executable(pop3): /usr/lib/dovecot/pop3-login mail_privileged_group: mail mail_location: maildir:/home/vmail/%d/%n/Maildir mail_executable(default): /usr/lib/dovecot/imap mail_executable(imap): /usr/lib/dovecot/imap mail_executable(pop3): /usr/lib/dovecot/pop3 mail_plugin_dir(default): /usr/lib/dovecot/modules/imap mail_plugin_dir(imap): /usr/lib/dovecot/modules/imap mail_plugin_dir(pop3): /usr/lib/dovecot/modules/pop3 pop3_uidl_format(default): pop3_uidl_format(imap): pop3_uidl_format(pop3): %08Xu%08Xv namespace: type: private separator: . prefix: INBOX. inbox: yes auth default: mechanisms: plain login cram-md5 passdb: driver: sql args: /etc/dovecot/dovecot-sql.conf userdb: driver: passwd userdb: driver: static args: uid=5000 gid=5000 home=/home/vmail/%d/%n allow_all_users=yes socket: type: listen client: path: /var/spool/postfix/private/auth mode: 432 user: postfix group: postfix master: path: /var/run/dovecot/auth-master mode: 384 user: vmail

3 5

[Dovecot] Dovecot 1.1.2, index_mailbox_set_recent_seq crash again
by Andreas M. Kirchwitz 02 Sep '08

02 Sep '08

Hi folks, after about 3 weeks without any problems, I've found this crash in yesterday's logfile (again related to index_mailbox_set_recent_seq): Aug 16 03:39:58 linux dovecot: IMAP(user1): Raw backtrace: imap [0x80cf8e0] -> imap [0x80cf93a] -> imap [0x80cf26c] -> imap [0x809d11a] -> imap(index_mailbox_set_recent_seq+0x3e) [0x809d15e] -> imap(mbox_sync+0x105d) [0x80823fd] -> imap [0x807a454] -> imap(index_transaction_commit+0x4e) [0x809ddfe] -> imap(cmd_copy+0x35f) [0x805b26f] -> imap(cmd_uid+0x59) [0x805f3d9] -> imap [0x805fd7c] -> imap [0x805fe25] -> imap [0x80605e5] -> imap(client_input+0x5e) [0x80607fe] -> imap(io_loop_handler_run+0x100) [0x80d7230] -> imap(io_loop_run+0x28) [0x80d63c8] -> imap(main+0x4a1) [0x8068321] -> /lib/libc.so.6(__libc_start_main+0xe0) [0x149390] -> imap [0x805a101] I don't know what IMAP operation caused that crash. The client (Thunderbird 2.0.0.16) silently reconnected without any notification. No obvious problems since yesterday. Dovecot 1.1.2 is running on Fedora 8 Linux 32 Bit with all patches and custom OpenSSL 0.9.8h. [ output of "dovecot -n" ] # 1.1.2: /usr/local/dovecot/etc/dovecot.conf ssl_cert_file: /usr/local/dovecot/etc/dovecot.crt ssl_key_file: /usr/local/dovecot/etc/dovecot.key login_dir: /usr/local/dovecot/var/run/dovecot/login login_executable: /usr/local/dovecot/libexec/dovecot/imap-login mail_location: mbox:~/Mail:INBOX=/var/spool/mail/%u auth default: mechanisms: plain login digest-md5 cram-md5 passdb: driver: passwd-file args: /usr/local/dovecot/etc/dovecot.passwd userdb: driver: passwd-file args: /usr/local/dovecot/etc/dovecot.passwd Greetings, Andreas

3 6

[Dovecot] tcp-wrapper patch for managesieve
by Edgar Fuß 02 Sep '08

02 Sep '08

Is there a place to store unofficial patches to ManageSieve? The attached patch is supposed to make ManageSieve (more precisely, managesieve-login) co-operate with a libwrapped (http://www.dovecot.org/patches/1.1/tcp-wrappers.patch) dovecot.

1 0

[Dovecot] "pam_start() failed: system error" with dovecot 1.1.2, cause unknown
by Adam McDougall 02 Sep '08

02 Sep '08

I would guess this is unlikely to be dovecot's fault, but I'm wondering if anyone has any ideas of what might have happened based on the evidence. My best guess is some kind of resource limit was reached but I don't see any evidence in the logs, and the condition is now gone. Suddenly this morning, one (and only one) of my dovecot servers decided to start failing all logins since 08:25:04 until we restarted dovecot, at which point they were working fine. The number of imap-login processes was under the limit, but there were some obvious PAM errors at the time. My account could still ssh to the system so I don't think it was a problem general authentication, and NIS on other systems was working fine. No one was logged into that server at the time the problems occurred, and I don't think anything happened to the actual pam libraries to make them missing since dovecot worked after a restart. I should have used other means to prevent people from using that dovecot instance rather than stopping it, and I'll do so if it happens again in hopes of further debugging. /var/log/maillog: Sep 2 08:25:01 hill dovecot: imap-login: Login: user=<userA>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, secured Sep 2 08:25:01 hill dovecot: IMAP(userA): Disconnected: Logged out bytes=127/568 Sep 2 08:25:01 hill dovecot: imap-login: Login: user=<userA>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, secured Sep 2 08:25:01 hill dovecot: IMAP(userA): Disconnected: Logged out bytes=282/9641 Sep 2 08:25:04 hill dovecot: imap-login: Login: user=<userA>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, secured Sep 2 08:25:04 hill dovecot: IMAP(userA): Disconnected: Logged out bytes=46/543 ***problem started here Sep 2 08:25:04 hill dovecot: auth-worker(default): pam(userA,127.0.0.1): pam_start() failed: system error Sep 2 08:25:04 hill dovecot: auth-worker(default): pam(userB,35.9.37.164): pam_start() failed: system error Sep 2 08:25:05 hill dovecot: auth-worker(default): pam(userC,35.9.37.164): pam_start() failed: system error Sep 2 08:25:06 hill dovecot: imap-login: Aborted login (auth failed, 1 attempts): user=<userB>, method=PLAIN, rip=35.9.37.164, lip=35.9.37.190, TLS Sep 2 08:25:06 hill dovecot: imap-login: Aborted login (auth failed, 1 attempts): user=<userA>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, secured Sep 2 08:25:07 hill dovecot: imap-login: Aborted login (auth failed, 1 attempts): user=<userC>, method=PLAIN, rip=35.9.37.164, lip=35.9.37.190, TLS ..... /var/log/messages: Sep 2 08:25:04 hill dovecot-auth: in openpam_load_module(): no pam_permit.so found Sep 2 08:25:04 hill dovecot-auth: in openpam_load_module(): no pam_login_access.so found Sep 2 08:25:05 hill dovecot-auth: in openpam_load_module(): no pam_nologin.so found Sep 2 08:25:10 hill dovecot-auth: in openpam_load_module(): no pam_unix.so found Sep 2 08:25:11 hill dovecot-auth: in openpam_load_module(): no pam_unix.so found Sep 2 08:25:20 hill dovecot-auth: in openpam_load_module(): no pam_opieaccess.so found Sep 2 08:25:20 hill dovecot-auth: in openpam_load_module(): no pam_opie.so found Sep 2 08:25:51 hill kernel: Sep 2 08:25:51 hill last message repeated 12 times Sep 2 08:27:52 hill kernel: Sep 2 08:27:52 hill last message repeated 37 times Sep 2 08:38:01 hill kernel: Sep 2 08:38:01 hill last message repeated 144 times Sep 2 08:48:06 hill kernel: Sep 2 08:48:06 hill last message repeated 129 times Sep 2 08:53:36 hill kernel: Sep 2 08:52:51 hill last message repeated 51 times

2 1

[Dovecot] Bad file descriptor with maildir and bzip2 files
by Chris Burton 02 Sep '08

02 Sep '08

Hi, I'm using the zlib plugin with dovecot 1.1.2 (on Centos 4.5, x86, ext3) and some bzip2 (version 1.0.2) compressed mail files are causing the following error to show in the logs when I click on the folder in outlook express. Aug 27 11:39:15 server-2 dovecot: IMAP(marchive): fstat(maildir) failed: Bad file descriptor Aug 27 11:39:17 Info: IMAP(marchive): Loading modules from directory: /usr/local/lib/dovecot/imap/ Aug 27 11:39:17 Info: IMAP(marchive): Module loaded: /usr/local/lib/dovecot/imap//lib20_zlib_plugin.so Aug 27 11:39:17 Info: IMAP(marchive): Effective uid=606, gid=609, home=/home/marchive Aug 27 11:39:17 Info: IMAP(marchive): maildir: data=/var/spool/maildir/marchive Aug 27 11:39:17 Info: IMAP(marchive): maildir++: root=/var/spool/maildir/marchive, index=, control=, inbox=/var/spool/maildir/marchive Aug 27 11:39:18 Info: IMAP(marchive): Disconnected: Internal error occurred. Refer to server log for more information. [20 08-08-27 11:39:18] bytes=246/1040 I attached strace to it and got the following: 11:39:18.193667 open("/var/spool/maildir/marchive/.2003.INBOX.Charlie.Old.OldInbox.2004/cur/1169027932.P30745Q17M499928.server-2:2,S=103418,Z", O_RDONLY|O_LARGEFILE) = 11 11:39:18.194130 fstat64(11, {st_mode=S_IFREG|0644, st_size=47637, ...}) = 0 11:39:18.194494 pread64(11, "BZh91AY&SY\231\206Z\257\0S\360\377\200\177\3746,U\357\377\377\377\377\377\360\277"..., 4096, 0) = 4096 11:39:18.200204 dup(11) = 12 11:39:18.200557 close(11) = 0 11:39:18.200916 fcntl64(12, F_GETFL) = 0x8000 (flags O_RDONLY|O_LARGEFILE) 11:39:18.200971 fstat64(12, {st_mode=S_IFREG|0644, st_size=47637, ...}) = 0 11:39:18.201104 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7ff2000 11:39:18.201216 _llseek(12, 0, [0], SEEK_CUR) = 0 11:39:18.201355 fstat64(12, {st_mode=S_IFREG|0644, st_size=47637, ...}) = 0 11:39:18.201478 brk(0x9e61000) = 0x9e61000 11:39:18.201612 read(12, "BZh91AY&SY\231\206Z\257\0S\360\377\200\177\3746,U\357\377\377\377\377\377\360\277"..., 4096) = 4096 11:39:18.201694 read(12, "\277\217\261\0g!\273\')/3\343V\336\276}\273/\210I\26^\255\304\323\r\275Wts\3773"..., 4096) = 4096 11:39:18.201793 mmap2(NULL, 3600384, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7c68000 11:39:18.205993 read(12, "~\214\261E*@[\200\245\302\232\201\334\331\272\225NQ\244\260\371\3473cc\312\255\326\246\17\'\222"..., 4096) = 4096 < continues reading from the file > 11:39:18.225970 read(12, "+:E\225\7\217W\264\367\27\226\262i9\34\227=\350\250BcmF\306\'\231m\265\233\337\343\237"..., 4096) = 2581 11:39:18.226040 read(12, "", 4096) = 0 < 26x more of this read > 11:39:18.233913 munmap(0xb7c68000, 3600384) = 0 11:39:18.234070 close(12) = 0 11:39:18.234120 munmap(0xb7ff2000, 4096) = 0 11:39:18.234184 fcntl64(12, F_GETFL) = -1 EBADF (Bad file descriptor) 11:39:18.234255 fstat64(12, 0xbff0a9a0) = -1 EBADF (Bad file descriptor) 11:39:18.234347 write(2, "\1Efstat(maildir) failed: Bad fil"..., 45) = 45 To me it looks like its trying to call fcntl on the handle its just closed? I've since decompressed these files and recompressed with "gzip -9" and they seem to be opening OK. dovecot -n gives: # 1.1.2: /usr/local/etc/dovecot.conf info_log_path: /var/log/dovecot.log protocols: imap imaps pop3 ssl_disable: yes disable_plaintext_auth: no login_dir: /usr/local/var/run/dovecot/login login_executable(default): /usr/local/libexec/dovecot/imap-login login_executable(imap): /usr/local/libexec/dovecot/imap-login login_executable(pop3): /usr/local/libexec/dovecot/pop3-login mail_location: maildir:/var/spool/maildir/%u mail_debug: yes mail_executable(default): /usr/local/libexec/dovecot/imap mail_executable(imap): /usr/local/libexec/dovecot/imap mail_executable(pop3): /usr/local/libexec/dovecot/pop3 mail_plugins: zlib mail_plugin_dir(default): /usr/local/lib/dovecot/imap/ mail_plugin_dir(imap): /usr/local/lib/dovecot/imap/ mail_plugin_dir(pop3): /usr/local/lib/dovecot/pop3/ imap_client_workarounds(default): delay-newmail imap_client_workarounds(imap): delay-newmail imap_client_workarounds(pop3): pop3_client_workarounds(default): pop3_client_workarounds(imap): pop3_client_workarounds(pop3): outlook-no-nuls auth default: passdb: driver: pam userdb: driver: passwd ChrisB.

3 6

[Dovecot] sieve plugin
by Андрей 02 Sep '08

02 Sep '08

I try to cinfigure dovecot run sieve scripts on incoming mail. In my dovecot.conf: <...> protocol lda { # Address to use when sending rejection mails. postmaster_address = root(a)vpcit.ru # Hostname to use in various parts of sent mails, eg. in Message-Id. # Default is the system's real hostname. hostname = vpcit.ru # Support for dynamically loadable plugins. mail_plugins is a space separated # list of plugins to load. #mail_plugins = mail_plugin_dir = /usr/lib/dovecot/modules/lda # Binary to use for sending mails. #sendmail_path = /usr/lib/sendmail # UNIX socket path to master authentication server to find users. auth_socket_path = /var/run/dovecot/auth-master # Enabling Sieve plugin for server-side mail filtering mail_plugins = cmusieve } <...> plugin { sieve = /var/mail/%d/%1n/%n/.dovecot.sieve } Then i set experiments on my maildir. In /var/mail/vpcit.ru/d/dukenukem i created script .dovecot.sieve: require "fileinto"; if header :comparator "i;ascii-casemap" :contains "Subject" "sieve check" { fileinto "Trash"; stop; } Permissions on /var/mail/vpcit.ru/d/dukenukem are: drwx------ 5000 mail So script should put every message that has "sieve check" subject into Trash folder. 1) Trash folder isn't created, should i create it manually? 2) Even when i create Trash folder and make 777 permissions to maildir, nothing happens (message is dropped into inbox dir) 3) Should i configure my Kontact (KMail) e-mail client some way? 4) What i've done incorrect? The mail system works fine at the moment for receive and send, trouble only with sieve scripting. Yours faithfully, Andrey.

3 4