- dovecot - dovecot.org

Re: [Dovecot] NTLM authentication from Outlook
by Lars Skovgaard 19 Nov '06

19 Nov '06

> Hi all > > I've enabled ntlm authentication in dovecot, and use dovecot sasl in > postfix as well. > > Authentication with ntlm works well from Mac OS X Mail.app, as well > as from Outlook Express, but fails with Outlook. Strangely enough, > ntml authentication works in Outlook when using smtp (via postfix), > but neither from imap or pop3 (both dovecot). As dovecot sasl handles > all authentication against a mysql userdb, this strikes me as very > strange. > > I've instructed my clients with Outlook to fetch mail using a ssl- > encrypted connection, and to send using ntlm-authentication. This > works, but I would like to have ntlm available as an option to all my > clients, without forcing them to change mail-clients. > > I've turned on auth_verbose, auth_debug and auth_debug_passwords, and > compared the passwordstring with the one calculated using dovecotpw, > and they match. The only odd thing is that the username is returned > from Outlook as an all-caps string, so user(a)domain.tld becomes > USER(a)DOMAIN.TLD. I don't know if it matters, but I don't think so, as > changing the user-login to an all-caps version doesn't solve the > problem. > > Any hints will be most welcome. > > /Lars Greetings, everyone I'm sorry, but I seem to have made a mistake regarding the passwordstring from Outlook – seems like the string I looked at was from MS Entourage... (that's what you get from trying to debug something when you're too tired to think straight). I've now enabled debugging again, and have tried logging in from Outlook with ntlm-authentication. The log-entries are as follows: Nov 16 23:29:09 SD-Server dovecot: auth(default): client in: AUTH 1 NTLM service=IMAP lip=192.168.2.2 rip=192.168.2.13 Nov 16 23:29:09 SD-Server dovecot: auth(default): client out: CONT 1 Nov 16 23:29:09 SD-Server dovecot: auth(default): client in: CONT 1 TlRM7IIog0ADQAuAAAFASgKAAAAD0AABgATVNTUAABYUEFSQkVKRFNHUlVQUAAAABGACgAAA lNQUNEU= Nov 16 23:29:09 SD-Server dovecot: auth(default): client out: CONT 1 TlRMTVNAAAAFAHgAeAAAAAAAADAA +H1XooTUAACAAAAyZ9yMNkAAdgBlAHIALgBsAG8AACYAJgBOAAAAUwBEAC0AUwBlAHIAYwBh AGwAAwAeAFMAyAC4AbABvsAAAAAGMAYRAAtAFMAZQByAHYAZQBQBAAA= Nov 16 23:29:09 SD-Server dovecot: auth(default): client in: CONT 1 TlRMAYAHwAAAAYABgAlAAAAAwADTVNTUAFQAAAAMAAAAAAAAEAH3ZyprYRPWIAAAAAAcgBkA EkATQBBAEMAWABQAAAAACsAAADAAAAGAABIAqMx1XpiwbAAAHAAcwAcABQNAEEAQwBYAFAAT ABpAHMAYQAgAFMAawBvAHYAZwBhAGAAAAAKIAgUBKAoAAAAPSQBAAAAAAAAAAAJILBz4x4RA Ixsp2rhFi8VB6g== Nov 16 23:29:09 SD-Server dovecot: auth(default): ntlm(?, 192.168.2.13): Username contains disallowed characters Nov 16 23:29:10 SD-Server dovecot: auth(default): client out: FAIL 1 The same account logs in without problems if I use a plaintext password (SSL-encrypted, since plaintext-login is disabled). in dovecot.conf I have the following: auth default { mechanisms = plain digest-md5 cram-md5 ntlm rpa } The authentication is done against a mysql-db, which until now has worked with every client I've tested (except Outlook). I have set up postfix to use dovecot-sasl, and use the same userdb for smtp-authentication. Strangely enough the exact same data is accepted when using ntml-authentication with smtp, though a warning is added to my logs. This is an example of a log-entry from an Outlook-user sending a mail: Nov 14 16:40:49 SD-Server postfix/smtpd[8354]: connect from unknown [hid.den.ip.adr] Nov 14 16:40:49 SD-Server dovecot: auth-worker(default): mysql: Connected to localhost (dovecot_auth) Nov 14 16:40:51 SD-Server postfix/smtpd[8354]: warning: unknown [hid.den.ip.adr]: SASL NTLM authentication failed: TlRMTVNTUAACAAMAZYAAQByAHAFAooAOINYZ// +97QAAAAAAAAUwBEAC0AUwBlAHIAdgBlAHIALgBsAG8AYwBhAGwAAwAeAFMARAAtAFAbABvA GMAYAAAAHgAeADAQAAAAAACYAJgBOBZQByAC4sAAAAAAA= Nov 14 16:40:51 SD-Server postfix/smtpd[8354]: AC6402D668E: client=unknown[hid.den.ip.adr], sasl_method=NTLM, sasl_username=user(a)domain.dk Nov 14 16:40:51 SD-Server postfix/cleanup[8358]: AC6402D668E: message- id=<006a01c70803$4dcd1b00$0200a8c0@acerce5220052b> Nov 14 16:41:13 SD-Server postfix/qmgr[8494]: AC6402D668E: from=<user(a)domain.dk>, size=819330, nrcpt=1 (queue active) Nov 14 16:41:16 SD-Server postfix/smtpd[8354]: disconnect from unknown [hid.den.ip.adr] Nov 14 16:41:29 SD-Server postfix/smtp[8361]: AC6402D668E: to=<user(a)otherdomain.dk>, relay=smtp.domain.dk[hid.den.ip.adr]:25, delay=37, delays=22/0.08/0.06/15, dsn=2.0.0, status=sent (250 156794624 mailfe12 Message accepted for delivery) Nov 14 16:41:29 SD-Server postfix/qmgr[8494]: AC6402D668E: removed The same warning is issued from postfix when a user sends mail from Outlook Express, but not when the same user sends from Thunderbird or Mail.app. In fact, I've only seen these problems when the users are using MS products. I really hope someone can shed some light on what is going on. Best regards Lars

2 1

[Dovecot] dovecot:IMAP(user) killed with signal 6
by Spil Oss 18 Nov '06

18 Nov '06

Hi all, After rc10 I have problems with imap and imaps Hi all, After rc10 I have problems with imap and imaps Nov 16 15:42:39 beastie dovecot: IMAP(user1): open(/home/user1/Maildir/.MeldWelSpam/dovecot-keywords) failed: Permission denied Nov 16 15:44:09 beastie dovecot: IMAP(user2): open(/home/user2/Maildir/.MeldWelSpam/dovecot-keywords) failed: Permission denied Nov 16 15:44:09 beastie dovecot: IMAP(user2): file maildir-keywords.c: line 222 (maildir_keywords_lookup_or_create): assertion failed: (mk->synced) Nov 16 15:44:09 beastie dovecot: child 98798 (imap) killed with signal 6 Nov 16 15:46:10 beastie dovecot: IMAP(user2): open(/home/user2/Maildir/.MeldWelSpam/dovecot-keywords) failed: Permission denied Nov 16 15:46:10 beastie dovecot: IMAP(user2): file maildir-keywords.c: line 222 (maildir_keywords_lookup_or_create): assertion failed: (mk->synced) Nov 16 15:46:10 beastie dovecot: child 98819 (imap) killed with signal 6 The Permission denied messages where there in rc10 as well, but that was not causing problems. These folders are symlinks to shared spam and ham folders for spamassassin learning. Any clue on how to fix this? FreeBSD-i386 6.1-RELEASE-p10 dovecot-1.0.r13 from ports Kind regards, Spil.

3 3

[Dovecot] updated gentoo ebuild provides dovecot-sieve
by Brian G. Peterson 18 Nov '06

18 Nov '06

I'm hoping that there are some Gentoo users on this list who will chime in on a bug that is near and dear to my heart. We've created an updated Gentoo ebuild that adds a sieve USE flag and builds dovecot-sieve if the use flag is enabled. The gentoo bug is here: https://bugs.gentoo.org/show_bug.cgi?id=141743 and the ebuild is available as an attachment to that bug, or as a patch attachment (in case you're not running rc14, or just prefer the look of a unified diff) Any gentoo users on this list are urged to install from the ebuild/patch on the bug, and *report back* on the bug or this list, so that the Gentoo dev will know that it's safe to add this to portage CVS. Thank You. Regards, - Brian

2 1

[Dovecot] Dovecot LDA, LDAP, Postfix and Spawning programs..
by Jorgen Lundman 18 Nov '06

18 Nov '06

Qmail, when using LDAP, a user can specify delvieryProgramPath, or a .qmail file, to launch something like procmail. Qmail correctly setuid() to the uids set for the user in LDAP, as well as set up the common env vars (HOME, USER, MAILDIR). We moved to Postfix but found that it is quite lacking in the features supported when it comes to "virtual" users. No .forward, and if you set up an alternate transport, they are run as "any user but root, nor postfix, nor the virtual-user's uid". And worse, does not even supply the HOME/MAILDIR values to transport delivery plugin. (Forcing it to getpwnam() or similar). I have an option to make my own setuid program to query LDAP (postmap -q would work), setuid() and call, say, procmail. It has been suggested I can use "maildrop" as it can talk to LDAP. However, I picked "Dovecot" as my pop3/imap program due to an irrational dislike of Courier imap. So, if I tried Dovecot-LDA, would it support the user optionally having a ".forward" file, or perhaps the LDAP attribute deliveryProgramPath, or some other way to filter based on subject/body to sort, and/or forward, mail? If it can use LDAP, will it setuid() to the users uid (as set in LDAP, assuming I cook the LDAP conf entries correctly) when delivering(I'd hope so!) and running external filters? I am still running rc10, which works well but flips out regularly. (Previously mentioned 'too many files open' bug, some leaks in locks) I will upgrade when the LDAP changes are deemed stable. Lund -- Jorgen Lundman | <lundman(a)lundman.net> Unix Administrator | +81 (0)3 -5456-2687 ext 1017 (work) Shibuya-ku, Tokyo | +81 (0)90-5578-8500 (cell) Japan | +81 (0)3 -3375-1767 (home)

2 1

[Dovecot] Failed Assert in RC13 on FC4
by Joseph D. Wagner 18 Nov '06

18 Nov '06

I received the following notices from logwatch: dovecot: IMAP(userid): file ioloop.c: line 22 (io_add): assertion failed: (fd >= 0): 1 Time(s) dovecot: child 16976 (imap) killed with signal 6: 1 Time(s) Please let me know if you need any further information from me. Joseph D. Wagner

2 1

[Dovecot] two assertion failures
by Mikhail Teterin 18 Nov '06

18 Nov '06

Hello! I was able to overcome the earlier-reported problems (of dovecot treating the standard mailboxes in /var/mail/ as directories) by specifying mail_location (continuing to use the 0.99-era dovecot.conf did not work). Then I started seeing assertion-failures like: file istream-raw-mbox.c: line 499 (istream_raw_mbox_get_body_size): assertion failed: (rstream->mail_size != (uoff_t)-1) these disappeared, when I disabled mmap-access (mmap is limited to 1Gb on FreeBSD/i386), although dovecot-0.99 worked... I can now get to my mail again, but every once in a while the following assertion kills the connection: file mail-transaction-log.c: line 273 (mail_transaction_log_close): assertion failed: (log->files == NULL) Please, advise... Thanks! -mi

2 1

[Dovecot] Auth checking also the service
by Alex 18 Nov '06

18 Nov '06

Hello everyone. I'm switching to dovecot from courier-imap and after some problems with Apple Mail client, now everything seems to be fine. The only problem that I have not solved yet is to check also the service (pop3, pop3s, imap, imaps) in the authentication phase. In courier-authlib I do this: MYSQL_SELECT_CLAUSE SELECT username, \ password, \ "", \ 1002, \ 1003, \ '/vmail', \ maildir, \ quota, \ name, \ "" \ FROM mailbox \ WHERE username="$(local_part)@$(domain)" \ AND active=1 \ AND $(service)=1 where $(service) can be pop3, pop3s, imap or imaps. Is it possible to do a similar thing in dovecot? Thank you in advance, Alex

3 4

[Dovecot] sieve newbie question
by matteo＠progettomio.net 17 Nov '06

17 Nov '06

Hi all, can you clarify my doubts about sieve? I understand what is it, but what's the different between use exim with rules + dovecot and use exim + dovecot-lda + sieve rules? i can create many kind of rules on exim, then i don't get the difference. if someone is so kind to explain me the main points i'll appreciate it! Regards, Matteo

3 3

[Dovecot] Help needed
by Ricardo Dias Campos 17 Nov '06

17 Nov '06

Hi. Days ago I sent a message to this list asking for help on a problem that seemed to me to be old: dovecot hangs and dovecot-auth posts log messages like: Nov 16 17:04:39 netuno dovecot: imap-login: Can't connect to auth server at default: Resource temporarily unavailable Nov 16 17:04:42 netuno dovecot: pop3-login: Can't connect to auth server at default: Resource temporarily unavailable Unfortunatelly when this happens the only way to recover is to restart dovecot. After I while I begun to clean the dovecot-auth processes (defunct or not) that remain in the process list and the cycle of running/hunging restart from 1 hang a day until it reaches 1 hang each 10 minutes, when I kill dovecot-auth again. I've seen some days ago some messages related to this problem but they were inconclusive, meaning that they didn't point to a solution. Any help is welcome. Thanks. Ricardo

1 0

[Dovecot] LDA Question
by Jeff 17 Nov '06

17 Nov '06

I need some advice about replacing maildrop with the Dovecot LDA. I need to replicate a setup that uses postfix+maildrop+spamassassin. We'll be using Dovecot 1rc13. In the current setup, maildrop reads a file called .mailfilter in each user's folder, then call spamassassin according to the user's preferences. The file is simple, and looks like this -- if ( $SIZE > 20971520 ) { EXITCODE=77 echo "Your email was rejected because it exceeded limit of 20 MB" exit } if ( $SIZE < 26144 ) { exception { xfilter "/usr/local/bin/spamc -u user(a)domain.com" } } exception { to "$DEFAULT/Maildir/" } What is the most straightforward way to have 'Deliver' do the same thing, without changing the way that SA gets called? Apologies in advance if this is a boneheaded question. I've been sorting through Sieve documentation and HOWTOs and I see everything but what I need.

2 1