- dovecot - dovecot.org

[Dovecot] dovecot performance
by Giorgenes Gelatti 19 Aug '08

19 Aug '08

Hello All, I've been studying dovecot for replacing my company's current system and I got a little worried about an aspect of the dovecot's design. I was surprised that dovecot doesn't use prefork for its mail processes, forking a new processes for each new client connection. Talking in the #dovecot channel I was gave a scenario of a system supporting ~40k users with 4 servers just fine. I wonder how well dovecot would scale if we increase this number of users by some order of magnitude like, say, 4M users. It is well known that preforking is a good pratice if you want to achieve a higher performance. When I was asked about it I readily answered: "of course it does". For my surprise later, i doesn't. Do you have any plans to support preforking in the near future? Best regards, giorgenes

5 13

[Dovecot] sendmail permissions denied
by CJ Keist 19 Aug '08

19 Aug '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Never mind On this, operator dumbness involved. Two directories above didn't allow general access into postfix home. - -------------------- With the sieve plugin trying to redirect or send vacation reply I'm getting the following error: Aug 19 13:12:52 goku deliver(joeblow): [ID 619685 mail.info] Module loaded: /use rM/mail-services/dovecot/lib/dovecot/lda/lib90_cmusieve_plugin.so Aug 19 13:12:52 goku deliver(joeblow): [ID 848615 mail.info] mbox: data=/top/students/UNGRAD/ES/joeblow/home/:INBOX=/userM/mail/joeblow Aug 19 13:12:52 goku deliver(joeblow): [ID 885103 mail.info] fs: root=/top/students/UNGRAD/ES/joeblow/home, index=, control=, inbox=/userM/mail/joeblow Aug 19 13:12:52 goku deliver(joeblow): [ID 223526 mail.info] cmusieve: Using sieve path: /top/students/UNGRAD/ES/joeblow/home/.dovecot.sieve Aug 19 13:12:52 goku deliver(joeblow): [ID 507699 mail.info] cmusieve: Executing script /top/students/UNGRAD/ES/joeblow/home/.dovecot.sievec Aug 19 13:12:52 goku deliver(joeblow): [ID 107833 mail.crit] Fatal: execv(/userM/mail-services/postfix/lib/sendmail) failed: Permission denied Aug 19 13:12:52 goku deliver(joeblow): [ID 260232 mail.error] Sendmail process terminated abnormally, exit status 75 Aug 19 13:12:52 goku deliver(joeblow): [ID 344163 mail.info] sieve runtime error: Vacation: Error sending mail Aug 19 13:12:52 goku deliver(joeblow): [ID 702911 mail.info] msgid=<48AB1B2E.4000007(a)colostate.edu>: saved mail to INBOX Aug 19 13:12:52 goku deliver(joeblow): [ID 368532 mail.error] sieve_execute_bytecode(/top/students/UNGRAD/ES/joeblow/home/.dovecot.sievec) failed Aug 19 13:12:52 goku postfix/local[10821]: [ID 197553 mail.info] EF96F2363C: to=<joeblow(a)engr.colostate.edu>, relay=local, delay=0.11, delays=0.02/0/0/0.09, dsn=2.0.0, status=sent (delivered to command: /userM/mail-services/dovecot/libexec/dovecot/deliver) Aug 19 13:12:52 goku postfix/qmgr[24972]: [ID 197553 mail.info] EF96F2363C: removed The sendmail path /userM/mail-services/postfix/lib/sendmail is correct the the permissions sendmail is: - -rwxr-xr-x 1 root root 602472 Aug 18 22:02 sendmail* I didn't have this problem with the test server. Any ideas? dovecot -n base_dir: /userM/mail-services/dovecot/var/run/dovecot/ protocols: imap imaps pop3 pop3s ssl_cert_file: /userM/mail-services/dovecot/etc/ssl/dovecot.pem ssl_key_file: /userM/mail-services/dovecot/etc/ssl/privkey.pem ssl_parameters_regenerate: 0 ssl_cipher_list: MEDIUM:!LOW disable_plaintext_auth: no login_dir: /userM/mail-services/dovecot/var/run/dovecot/login login_executable(default): /userM/mail-services/dovecot/libexec/dovecot/imap-log in login_executable(imap): /userM/mail-services/dovecot/libexec/dovecot/imap-login login_executable(pop3): /userM/mail-services/dovecot/libexec/dovecot/pop3-login login_greeting: Cyrus ready. login_max_processes_count: 1024 max_mail_processes: 1024 mail_location: mbox:~/:INBOX=/userM/mail/%u mail_debug: yes mmap_disable: yes mail_nfs_index: yes mail_executable(default): /userM/mail-services/dovecot/libexec/dovecot/imap mail_executable(imap): /userM/mail-services/dovecot/libexec/dovecot/imap mail_executable(pop3): /userM/mail-services/dovecot/libexec/dovecot/pop3 mail_plugin_dir(default): /userM/mail-services/dovecot/lib/dovecot/imap mail_plugin_dir(imap): /userM/mail-services/dovecot/lib/dovecot/imap mail_plugin_dir(pop3): /userM/mail-services/dovecot/lib/dovecot/pop3 auth default: mechanisms: plain login verbose: yes debug: yes passdb: driver: pam passdb: driver: passwd args: blocking=yes userdb: driver: passwd args: blocking=yes socket: type: listen client: path: /var/lib/postfix/private/auth mode: 432 user: postfix group: postfix - -- C. J. Keist Email: cj.keist(a)colostate.edu UNIX/Network Manager Phone: 970-491-0630 Engineering Network Services Fax: 970-491-5569 College of Engineering, CSU Ft. Collins, CO 80523-1301 All I want is a chance to prove 'Money can't buy happiness' -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (Darwin) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFIqyjlA29OFr7C6jcRAv6GAJ90UCY/clZa43NBCysv0ktlg11cVQCeOnkq ylkleO56B91KU/4CuAGBACc= =s9YN -----END PGP SIGNATURE-----

1 0

[Dovecot] sendmail permissions denied
by CJ Keist 19 Aug '08

19 Aug '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 With the sieve plugin trying to redirect or send vacation reply I'm getting the following error: Aug 19 13:12:52 goku deliver(joeblow): [ID 619685 mail.info] Module loaded: /use rM/mail-services/dovecot/lib/dovecot/lda/lib90_cmusieve_plugin.so Aug 19 13:12:52 goku deliver(joeblow): [ID 848615 mail.info] mbox: data=/top/students/UNGRAD/ES/joeblow/home/:INBOX=/userM/mail/joeblow Aug 19 13:12:52 goku deliver(joeblow): [ID 885103 mail.info] fs: root=/top/students/UNGRAD/ES/joeblow/home, index=, control=, inbox=/userM/mail/joeblow Aug 19 13:12:52 goku deliver(joeblow): [ID 223526 mail.info] cmusieve: Using sieve path: /top/students/UNGRAD/ES/joeblow/home/.dovecot.sieve Aug 19 13:12:52 goku deliver(joeblow): [ID 507699 mail.info] cmusieve: Executing script /top/students/UNGRAD/ES/joeblow/home/.dovecot.sievec Aug 19 13:12:52 goku deliver(joeblow): [ID 107833 mail.crit] Fatal: execv(/userM/mail-services/postfix/lib/sendmail) failed: Permission denied Aug 19 13:12:52 goku deliver(joeblow): [ID 260232 mail.error] Sendmail process terminated abnormally, exit status 75 Aug 19 13:12:52 goku deliver(joeblow): [ID 344163 mail.info] sieve runtime error: Vacation: Error sending mail Aug 19 13:12:52 goku deliver(joeblow): [ID 702911 mail.info] msgid=<48AB1B2E.4000007(a)colostate.edu>: saved mail to INBOX Aug 19 13:12:52 goku deliver(joeblow): [ID 368532 mail.error] sieve_execute_bytecode(/top/students/UNGRAD/ES/joeblow/home/.dovecot.sievec) failed Aug 19 13:12:52 goku postfix/local[10821]: [ID 197553 mail.info] EF96F2363C: to=<joeblow(a)engr.colostate.edu>, relay=local, delay=0.11, delays=0.02/0/0/0.09, dsn=2.0.0, status=sent (delivered to command: /userM/mail-services/dovecot/libexec/dovecot/deliver) Aug 19 13:12:52 goku postfix/qmgr[24972]: [ID 197553 mail.info] EF96F2363C: removed The sendmail path /userM/mail-services/postfix/lib/sendmail is correct the the permissions sendmail is: - -rwxr-xr-x 1 root root 602472 Aug 18 22:02 sendmail* I didn't have this problem with the test server. Any ideas? dovecot -n base_dir: /userM/mail-services/dovecot/var/run/dovecot/ protocols: imap imaps pop3 pop3s ssl_cert_file: /userM/mail-services/dovecot/etc/ssl/dovecot.pem ssl_key_file: /userM/mail-services/dovecot/etc/ssl/privkey.pem ssl_parameters_regenerate: 0 ssl_cipher_list: MEDIUM:!LOW disable_plaintext_auth: no login_dir: /userM/mail-services/dovecot/var/run/dovecot/login login_executable(default): /userM/mail-services/dovecot/libexec/dovecot/imap-log in login_executable(imap): /userM/mail-services/dovecot/libexec/dovecot/imap-login login_executable(pop3): /userM/mail-services/dovecot/libexec/dovecot/pop3-login login_greeting: Cyrus ready. login_max_processes_count: 1024 max_mail_processes: 1024 mail_location: mbox:~/:INBOX=/userM/mail/%u mail_debug: yes mmap_disable: yes mail_nfs_index: yes mail_executable(default): /userM/mail-services/dovecot/libexec/dovecot/imap mail_executable(imap): /userM/mail-services/dovecot/libexec/dovecot/imap mail_executable(pop3): /userM/mail-services/dovecot/libexec/dovecot/pop3 mail_plugin_dir(default): /userM/mail-services/dovecot/lib/dovecot/imap mail_plugin_dir(imap): /userM/mail-services/dovecot/lib/dovecot/imap mail_plugin_dir(pop3): /userM/mail-services/dovecot/lib/dovecot/pop3 auth default: mechanisms: plain login verbose: yes debug: yes passdb: driver: pam passdb: driver: passwd args: blocking=yes userdb: driver: passwd args: blocking=yes socket: type: listen client: path: /var/lib/postfix/private/auth mode: 432 user: postfix group: postfix - -- C. J. Keist Email: cj.keist(a)colostate.edu UNIX/Network Manager Phone: 970-491-0630 Engineering Network Services Fax: 970-491-5569 College of Engineering, CSU Ft. Collins, CO 80523-1301 All I want is a chance to prove 'Money can't buy happiness' -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (Darwin) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFIqx3LA29OFr7C6jcRAr2FAJ4lHPlswLAhQpwTLm788CkogrfB0QCfXHvs /2Ej000B55JKNjdRrk4/KIM= =wtuS -----END PGP SIGNATURE-----

1 0

[Dovecot] dovecot: Fatal: Time just moved backwards by 3603 seconds.
by Stephen Feyrer 19 Aug '08

19 Aug '08

<nervous_darting_eyes> Hi Everyone. </nervous_darting_eyes> Ooops I just broke my dovecot install. I've looked through the mailing list archives and not found anything relevant. When I try to connect to my mail server I get this message. "Could not connect to mail server chen.home.org; connection was refused" The last message in /var/log/mail.err is:- Aug 13 21:02:27 chen dovecot: Fatal: Time just moved backwards by 3603 seconds. This might cause a lot of problems, so I'll just kill myself now. http://wiki.dovecot.org/TimeMovedBackwards It seems this is my own fault. Time on my system is a little wonky so I reset the time and then I found out I'd broken Dovecot. I didn't realise that doing this would have an impact on dovecot. I read the web page and to be honest I'm not confident about hacking source code. I've reinstalled dovecot which worked except it hasn't solved my time travel problem. By the way since my first install of dovecot the config file seems to have changed a little but since I've tried to migrate my settings over the new file and been met with the same problem I don't think it's that. Is it possible to get dovecot working again? -- Regards Stephen.

6 11

[Dovecot] Anyone using LG Voyager (vx10000) with dovecot IMAP?
by Adam McDougall 19 Aug '08

19 Aug '08

Anyone using the mobile IMAP option on the LG Voyager (mobile phone) with dovecot? I think it costs $5 extra per month. Seems low enough just to try it and find out. Thanks

1 0

[Dovecot] SpamAssassin and Maildir with Dovecot
by Kenneth Porter 19 Aug '08

19 Aug '08

A patch has been proposed for SpamAssassin to process Maildir folders of spam: <https://issues.apache.org/SpamAssassin/show_bug.cgi?id=3003> Is this patch compatible with Dovecot's implementation of Maildir? For example, is anything needed to avoid stepping on Dovecot's metadata?

3 4

[Dovecot] POP3 dictionary attacks
by Kenneth Porter 18 Aug '08

18 Aug '08

I'm seeing strings of failed POP3 login attempts with obvious bogus usernames coming from different IP addresses. Today's originated from 216.31.146.19 (which resolves to neovisionlabs.com) This looks like a botnet attack. I got a similar probe a couple days ago. Is anyone else seeing these? The attack involves trying about 20 different names, about 3-4 seconds apart. Here's a few sample log lines: dovecot: Aug 15 04:15:45 Error: auth-worker(default): pam(mike,216.31.146.19): pam_authenticate() failed: User not known to the underlying authentication module dovecot: Aug 15 04:15:49 Error: auth-worker(default): pam(alan,216.31.146.19): pam_authenticate() failed: User not known to the underlying authentication module dovecot: Aug 15 04:15:53 Error: auth-worker(default): pam(info,216.31.146.19): pam_authenticate() failed: User not known to the underlying authentication module dovecot: Aug 15 04:15:57 Error: auth-worker(default): pam(shop,216.31.146.19): pam_authenticate() failed: User not known to the underlying authentication module Timo, can you add the port used in the attempt to the error log entry? (It does show up in the info log entry, but that means I need to correlate lines in the two log files.)

9 10

[Dovecot] IMAP maildir performance difference between dovecot-uidlist versions?
by Jack Stewart 17 Aug '08

17 Aug '08

Hi, Is there an IMAP performance difference using Maildir between using version 3 and version 1 of the dovecot-uidlist (either dovecot 1.0.7 or 1.1.2)? It isn't entirely clear to me there is any difference as the filename may contain the size/vsize information. The servers will eventually be running 1.1.2 with the maildir_copy_preserve_filename turned on. I'm doing a batch migration from courier to dovecot 1.0.7 and eventually dovecot 1.1.2. These servers are, and will continue to be, IMAP only (i.e. dedicated control/dovecot-uidlist files). The migration script is run once - no build on the fly. It does a readdir() to get the full filenames and make sure that list entries are only for existing files. As a result, there is almost complete freedom in the output format for the dovecot-uidlist. Many thanks in advance! ---Jack P.S. For better or worse, it does seem that once you are stuck with whatever initial version you choose. -- Jack Stewart IMSS, California Institute of Technology, M/C 1-10, 1200 E. California Blvd, Pasadena, CA 91125 jstewart(a)caltech.edu / 626-309-4690 http://www.imss.caltech.edu

2 1

Re: [Dovecot] POP3 dictionary attacks
by Bruce Bodger 16 Aug '08

16 Aug '08

On Aug 16, 2008, at 11:14 AM, Mark Sapiro wrote: >>> Exactly. These days, IP spoofing is most useful to hide the >>> identity of >>> the perpetrator of a DoS attack. It certainly is not applicable to a >>> dictionary attack on POP3 or other logins since with a spoofed >>> IP, the >>> perpetrator will never see the response to determine if the login >>> attempt was successful. >> >> I stand corrected... sorry. I was thinking of an http cross-site >> attack which also seems popular now-a-days. >> >> So if I read you right then you would consider the IP address shown >> in the original thread post.. >> >>> dovecot: Aug 15 04:15:45 Error: auth-worker(default): pam(mike, >>> 216.31.146.19): pam_authenticate() failed: User not known to the >>> underlying authentication module >>> dovecot: Aug 15 04:15:49 Error: auth-worker(default): pam(alan, >>> 216.31.146.19): pam_authenticate() failed: User not known to the >>> underlying authentication module >>> dovecot: Aug 15 04:15:53 Error: auth-worker(default): pam(info, >>> 216.31.146.19): pam_authenticate() failed: User not known to the >>> underlying authentication module >>> dovecot: Aug 15 04:15:57 Error: auth-worker(default): pam(shop, >>> 216.31.146.19): pam_authenticate() failed: User not known to the >>> underlying authentication module >> >> >> ..216.31.146.19, to be a party to the attack and therefore a >> candidate for locking out? > > > Yes. I do it (with my own script, not fail2ban, but it works the same > way). Thank you for the clarification. B. Bodger

1 0

[Dovecot] PAM session closes too soon
by Lauri Alanko 16 Aug '08

16 Aug '08

Hi. I'm trying to keep most of my data encrypted when possible, only keeping the decryption key in memory (and thus vulnerable to local attacks) when I'm actually using my data. In practice, this means using pam_mount to mount my home directory from an encrypted device. It almost looked like I could get this to work with mail as well, even when read via IMAP from a remote client: I placed my mail in the encrypted home directory, added pam_mount to /etc/pam.d/dovecot, and set session=yes in Dovecot's PAM configuration. Except that it didn't, quite: pam_mount worked just fine and mounted the encrypted disk using the IMAP password... and then immediately unmounted it, since for some reason session=yes means that Dovecot closes the session _immediately_ after opening it. This seems just silly. If a PAM session is to be used, then it seems obvious to me that its length should be exactly the length of the IMAP session. I can't see any reason for the current behavior, except maybe that it was a bit simpler to code and is sufficient for pam_mkhomedir (and only that). Can this be fixed with reasonable effort? Also, for pam_mount to work correctly, there must not be any file descriptors open in the mounted file system when the session closes, as otherwise unmounting is impossible. Will dovecot release all fds into the mail and index files when the session ends, or can it be made to do so? (UTSL is an acceptable answer.) Thanks in advance. Lauri Alanko la(a)iki.fi

2 1