- dovecot - dovecot.org

[Dovecot] Plugin when downloading mail
by martijn＠youngguns.nl 14 Aug '08

14 Aug '08

Is there a way to modify mail messages when they are downloaded using a special login. eg. my normal login for dovecot is martijn(a)youngguns.nl but when I log in using martijn(a)dosomething.youngguns.nl I would like to download my mail which are processed using a Perl script. The Perl script will modify the content of the message (the message body). So I don't want to change the header or IMAP flags. Martijn

3 2

[Dovecot] Corrupted index cache files
by Mike Abbott 14 Aug '08

14 Aug '08

I see these errors more often than I'd like from Dovecot-1.1.2 on Mac OS X 10.5.4 (names and numbers elided): Corrupted index cache file %s: Corrupted virtual size for uid=%d: %d ! = %d Corrupted index cache file %s: Broken virtual size for mail UID %d Corrupted index cache file %s: used_file_size too large How bad are these? What should I look for to find out why they happen? Other details: File system is HFS+ Mail store is maildir Hardware is Intel (Mac Pro) Thanks.

3 10

[Dovecot] Has anyone ever seen outlook do single sign on with dovecot/etc?
by Jason Gunthorpe 14 Aug '08

14 Aug '08

Hey all, I'm curious, has anyone been able to get outlook to do single sign on with a linux IMAP/SMTP back end? I have it doing NTLM authentication via the dovecot winbind module with Samba 3.2 just fine, but I have yet to see it try to use the cached windows logon credentials.. It appears to do an NTLM exchange with a blank password and then prompt for a password and then do an exchange with the given password. It does the same thing if PLAIN authentication is used. I'm starting to suspect MS deliberately hobbled outlook so that it uses the SSPI to exchange an entered password but not ever the logon credentials.. Does anyone know different? What a topsy-turvy world when thunderbird using SSPI works better on Windows than outlook. :| Thanks, Jason

1 0

[Dovecot] Disabling access for one user
by Kenneth Porter 14 Aug '08

14 Aug '08

I'm converting my system from mbox to Maildir one user at a time, and I'd like to disable access for the user I'm working on. Is there a way to tell Dovecot to lock out a specific user? Perhaps with a control file in the home directory? At the same time, how can I get sendmail+procmail to tempfail incoming messages for one user until I'm done?

5 9

Re: [Dovecot] Search for (any of) multiple terms slow
by Patrick Nagel 14 Aug '08

14 Aug '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On Wed, 13 Aug 2008 17:18:37 -0400, Timo Sirainen <tss(a)iki.fi> wrote: > On Aug 13, 2008, at 3:25 AM, Patrick Nagel wrote: > >> When searching for multiple terms at once ("any of") with >> Thunderbird/Dovecot >> (using FTS Squat indexes), it takes much longer (not double the >> time, or a bit >> more than that, but really much, much longer) than when I search for >> only one term. > > Yea, OR isn't supported by FTS plugin yet.. I had hoped no-one would > notice it ;) I guess I should do something about it. Heh, I see ;) As it is, the FTS plugin is quite useless to us though :( most of the time people are doing a (real world) search, they don't remember the exact word they're looking for. For example they only remember that the mail they're looking for contained "English" and "automobile" - or was it "Englisch" and "Automobil", because the mail was in German? So to get a list of all possible mails, they want to make use of the OR connection of search terms... > Requires a lot > more complexity to the code though.. Couldn't Dovecot just search the index with each single word (as it does now without OR), and then merge the results, filtering out double UIDs? This is probably not the most efficient way to solve this, but it would be definitely *much* faster than not using the indexes at all - and doesn't sound too complex to me. Are there any other not-yet-implemented SEARCH features that don't work with the FTS plugin? Thanks, Patrick. - -- STAR Software (Shanghai) Co., Ltd. http://www.star-group.net/ Phone: +86 (21) 3462 7688 x 826 Fax: +86 (21) 3462 7779 PGP key: https://stshacom1.star-china.net/keys/patrick_nagel.asc Fingerprint: E09A D65E 855F B334 E5C3 5386 EF23 20FC E883 A005 -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.9 (GNU/Linux) Comment: http://getfiregpg.org iEYEARECAAYFAkijga4ACgkQ7yMg/OiDoAUnFwCfXDUDHR+UdlMKkqwn2/nkB61I X3MAn1nK8KVW8RbtzQ6qQGipGb3uMXRa =I8Eh -----END PGP SIGNATURE-----

2 1

[Dovecot] Can't purge folders in Trash with listescape loaded in 1.1.2
by Adam McDougall 14 Aug '08

14 Aug '08

I made sure I didn't have the Trash folder open by restarting dovecot, then going to File -> Empty Trash in thunderbird. rawlog in, listescape loaded: 3 select "Trash" 4 list "" "Trash/*" 5 delete "Trash/test" 6 IDLE rawlog out, listescape loaded: * OK [RAWLOG TIMESTAMP] 2008-08-08 10:54:14 * FLAGS (\Answered \Flagged \Deleted \Seen \Draft Old NonJunk $MDNSent unknown-3 $Forwarded unknown-0 unknown-5 unknown-7 Junk unknown-1 unknown-4 unknown-9 unknown-10 $label1 $label4 $label5) * OK [PERMANENTFLAGS (\Answered \Flagged \Deleted \Seen \Draft Old NonJunk $MDNSent unknown-3 $Forwarded unknown-0 unknown-5 unknown-7 Junk unknown-1 unknown-4 unknown-9 unknown-10 $label1 $label4 $label5 \*)] Flags permitted. * 0 EXISTS * 0 RECENT * OK [UIDVALIDITY 1194838495] UIDs valid * OK [UIDNEXT 55158] Predicted next UID 3 OK [READ-WRITE] Select completed. * LIST (\HasNoChildren) "/" "Trash/test" 4 OK List completed. 5 NO Unknown internal list error + idling rawlog in, listescape loaded: 3 select "Trash" 4 list "" "Trash/*" 5 delete "Trash/test" 6 unsubscribe "Trash/test" 7 IDLE rawlog in, listescape loaded: * OK [RAWLOG TIMESTAMP] 2008-08-08 10:56:34 * FLAGS (\Answered \Flagged \Deleted \Seen \Draft Old NonJunk $MDNSent unknown-3 $Forwarded unknown-0 unknown-5 unknown-7 Junk unknown-1 unknown-4 unknown-9 unknown-10 $label1 $label4 $label5) * OK [PERMANENTFLAGS (\Answered \Flagged \Deleted \Seen \Draft Old NonJunk $MDNSent unknown-3 $Forwarded unknown-0 unknown-5 unknown-7 Junk unknown-1 unknown-4 unknown-9 unknown-10 $label1 $label4 $label5 \*)] Flags permitted. * 0 EXISTS * 0 RECENT * OK [UIDVALIDITY 1194838495] UIDs valid * OK [UIDNEXT 55158] Predicted next UID 3 OK [READ-WRITE] Select completed. * LIST (\HasNoChildren) "/" "Trash/test" 4 OK List completed. 5 OK Delete completed. 6 OK Unsubscribe completed. + idling dovecot -n: # 1.1.2: /usr/local/etc/dovecot.conf ssl_cert_file: /usr/local/etc/apache22/ssl/mail.pem ssl_key_file: /usr/local/etc/apache22/ssl/mail.pem login_dir: /var/run/dovecot/login login_executable: /usr/local/libexec/dovecot/imap-login login_max_processes_count: 512 max_mail_processes: 1024 mail_max_userip_connections: 25 verbose_proctitle: yes first_valid_uid: 1000 first_valid_gid: 1000 mail_access_groups: postlocal mail_location: maildir:%h/Maildir:CONTROL=%h/Maildir/dovecot/private/control:INDEX=%h/Maildir/dovecot/private/indexes mmap_disable: yes mail_nfs_storage: yes mail_nfs_index: yes mail_drop_priv_before_exec: yes mail_process_size: 1024 mail_plugins: acl fts fts_squat listescape quota imap_quota mail_log_max_lines_per_sec: 0 imap_client_workarounds: delay-newmail outlook-idle netscape-eoh tb-extra-mailbox-sep namespace: type: private separator: / inbox: yes list: yes subscriptions: yes namespace: type: private separator: / prefix: mail/ hidden: yes subscriptions: yes namespace: type: private separator: / prefix: Mail/ hidden: yes subscriptions: yes auth default: passdb: driver: pam userdb: driver: passwd args: system_user= socket: type: listen client: path: /var/spool/postfix/private/auth mode: 384 user: postfix group: postfix plugin: quota: fs:noenforcing:inode_per_mail acl: vfile:/usr/local/etc/dovecot-acls:cache_secs=10 fts: squat

2 2

[Dovecot] mbox empty messages in Sent folder
by Diego Liziero 13 Aug '08

13 Aug '08

I'm talking about mbox Sent folder, where some mailers append through imap server a copy of each message they send. Sometimes, just three header lines got appended instead of the whole mail message, such as: >From xxxxxxxx(a)xxxxxx.xxxxxx.xxxxx.xx.xx Fri May 23 12:30:14 2008 X-UID: 2852 Status: RO This happened in the past (dovecot-1.1-beta/rc with Evolution and with Thunderbird), and happened last week with dovecot-1.1-rc5 (+ last week hg patches). Anyone had a similar issue? Regards, Diego.

2 17

[Dovecot] 1.1.x problems
by Andre Hübner 13 Aug '08

13 Aug '08

Hi, since upgrading to 1.1.x i still have this bugs "Next message unexpectedly lost " I read this Maillist some months ago and i believe that im not the only one... The Panics and crashes in 1.1.1 are gone by upgrading to 1.1.2 but these "Next message unexpectedly lost " bugs are really annoying if users can't download complete mails. is there something new to this issue. all recommend changes did not help. The only thing i could do is downgrade to 1.0.15 and all works fine. i can not keep the 1.1.x versions in my repo untill this case is solved. :( Thanks Andre

3 4

[Dovecot] [PATCH] Support GSS-SPNEGO natively
by Jason Gunthorpe 13 Aug '08

13 Aug '08

I cooked this up while trying to figure out why thunderbird on Windows w/ SSPI was not working, but it turned out thunderbird does not use it, so I haven't been able to test it yet. I'm presenting it for discussion only, unless someone else can try it :) Modern versions of MIT kerberos support GSS-SPNEGO natively, but are only willing to negotiate for kerberos tickets and not NTLM messages. This is how the SPNEGO works in libapache-mod-auth-kerb-5.3 which simply passes SPNEGO packets directly to gssapi if the library is new enough. There is even a configure feature test for the gssapi library in that packages configure script. Note that Debian etch's standard kerb libaries (1.4) are not good enough for this. Having this work means the other gssapi policy knobs in dovecot, like auth_gssapi_hostname, work properly. Instead of 'whatever it is that samba does'. I guess it fixes the concerns about winbind accesses blocking (although don't the gssapi calls block??) In light of this it is really only useful to use winbind if you want to support NTLM as kerberos will do the necessary exchanges with the kdc for an Active Directory domain. In truth a proper and complete design would somehow layer the built in NTLM module under the SPNEGO negotiation and only pass NTLM messages off to samba but I doubt anyone cares with NTLM being rather obsolete. --- dovecot-1.0.13/src/auth/mech-gssapi.c 2007-12-11 11:52:08.000000000 -0700 +++ dovecot-1.0.13-jgg/src/auth/mech-gssapi.c 2008-08-11 23:52:15.000000000 -0600 @@ -417,4 +424,21 @@ mech_gssapi_auth_free }; +/* MTI Kerberos > 1.5 supports SPNEGO for Kerberos tickets internally. + Nothing else needs to be done here. Note however that this does not + support SPNEGO when the only available credential is NTLM.. */ +const struct mech_module mech_gssapi_spnego = { + "GSS-SPNEGO", + + MEMBER(flags) 0, + + MEMBER(passdb_need_plain) FALSE, + MEMBER(passdb_need_credentials) FALSE, + + mech_gssapi_auth_new, + mech_gssapi_auth_initial, + mech_gssapi_auth_continue, + mech_gssapi_auth_free +}; + #endif --- dovecot-1.0.13/src/auth/mech.c 2007-12-11 11:52:08.000000000 -0700 +++ dovecot-1.0.13-jgg/src/auth/mech.c 2008-08-11 21:30:56.000000000 -0600 @@ -72,6 +72,7 @@ extern struct mech_module mech_anonymous; #ifdef HAVE_GSSAPI extern struct mech_module mech_gssapi; +extern struct mech_module mech_gssapi_spnego; #endif void mech_init(void) @@ -86,6 +87,7 @@ mech_register_module(&mech_anonymous); #ifdef HAVE_GSSAPI mech_register_module(&mech_gssapi); + mech_register_module(&mech_gssapi_spnego); #endif } @@ -101,5 +103,6 @@ mech_unregister_module(&mech_anonymous); #ifdef HAVE_GSSAPI mech_unregister_module(&mech_gssapi); + mech_unregister_module(&mech_gssapi_spnego); #endif }

3 9

[Dovecot] [PATCH] Allow GSSAPI to work with multihomed hosts
by Jason Gunthorpe 13 Aug '08

13 Aug '08

I saw some past chatter on this in the list archives, but here is another stab and another rational. This patch follows a similar patch to openssh in that it allows any key in the specified keytab to match the incoming host key. This is necessary for multihomed hosts. See: https://bugzilla.mindrot.org/show_bug.cgi?id=928 IMAP/POP seem to be a strong candidate to be multihomed because they are very likely to have an internal to a firewall and external to a firewall name. Due to the way MIT kerberos handles host name resolution via reverse IP lookup this can often result in multiple principle names and there is simply nothing to be done about it. This is my situation.. When you add windows into the mix, which uses a totally different set of rules to determine the principle all hope seems to be lost to have a single service principle name for an imap server :( I was able to make things work for my environment using only the auth_gssapi_hostname feature if only MIT kerberos was used, but as soon as windows SSPI was involved it choose a different hostname. Thus we want to have GSSAPI to match any service principle in the keytab. As far as security concerns go, the admin can configure the keytab for dovecot to be seperate from the system key tab and contain only valid imap SPNs, but in truth it probably doesn't matter. I choose to just use the magic configurable: auth_gssapi_hostname = $ALL rather than introduce more configurables FWIW, after applying this I now am happy to say I have an Active Directory KDC, with dovecot providing gssapi auth to thunderbird on both linux (mit kerb 1.6) and windows (sspi).. --- dovecot-1.0.13/src/auth/mech-gssapi.c 2007-12-11 11:52:08.000000000 -0700 +++ dovecot-1.0.13-jgg/src/auth/mech-gssapi.c 2008-08-11 23:52:15.000000000 -0600 @@ -101,6 +101,13 @@ gss_name_t gss_principal; const char *service_name; + if (strcmp(request->auth->gssapi_hostname,"$ALL") == 0) { + auth_request_log_info(request, "gssapi", + "Using all keytab entires"); + *ret = GSS_C_NO_CREDENTIAL; + return GSS_S_COMPLETE; + } + if (strcasecmp(request->service, "POP3") == 0) { /* The standard POP3 service name with GSSAPI is called just "pop". */

2 2