- dovecot - dovecot.org

[Dovecot] dovecot permission denied problems.
by John Mc Donald 25 Jul '05

25 Jul '05

I am trying to setup dovecot on a FC4 machine. Access to the machine is provided through pam. When I login to the machine my home directory is mounted over nfs from a central file server. I have dovecot installed and running but it can't seem to access my home directory. When I try and access my mail I get the following three lines in /var/log/maillog: > Jul 25 12:46:04 escher imap-login: Login: ###### [::ffff:###.###.###.###] > Jul 25 12:46:04 escher dovecot: chdir(/home/######) failed with uid > ####: Permission denied > Jul 25 12:46:04 escher dovecot: child 13182 (imap) returned error 89 The uid that is used is the one associated with my home directory. As far as I understand it when you connect to dovecot the imap connection setuid's to the uid of the authenticated user so there should be no permission problems. To try and help in the debugging process I also setup a local user "testimap" using > /usr/sbin/useradd -d /tmp/testimap testimap I then try to use thunderbird to connect to it and I get the following in /var/log/maillog > Jul 25 12:54:54 escher imap-login: Login: testimap > [::ffff:###.###.###.###] > Jul 25 12:54:54 escher imap(testimap): mbox: Can't create root IMAP > folder /tmp/testimap/mail: Permission denied > Jul 25 12:54:54 escher imap(testimap): MAIL environment missing and > autodetection failed (home /tmp/testimap) > Jul 25 12:54:54 escher dovecot: child 13360 (imap) returned error 89 Can anyone tell me what I am doing wrong here? TIA, John. -- ================================== John Mc Donald, Dept. of Computer Science, National University of Ireland, Maynooth, Co. Kildare, Ireland. Email : johnmcd(a)cs.nuim.ie Tel: +353-1-7084589 Fax: +353-1-7083848 Web: http://www.cs.nuim.ie/~johnmcd GnuPG Key: http://www.cs.nuim.ie/~johnmcd/public_key.asc ==================================

2 2

[Dovecot] inotify support in dovecot
by Reuben Farrelly 25 Jul '05

25 Jul '05

Hi, I note that dovecot supported inotify from -test77, and now the Linux kernel supports it starting from linux-2.6.13-rc3. So in theory I should be set to go. I'm using an -mm kernel, and it was built with inotify, on FC4/devel. However when trying to build with it using --with-notify=inotify, I always seem to be getting this message: checking for poll... yes configure: error: inotify requested but not available, check for existence of <linux/inotify.h> /bin/sh ./config.status --recheck What is required for inotify to be recognised and built into dovecot? I've tried copying the header from linux-2.6/include/linux/inotify.h to the /usr/include/linux directory, but that didn't help - and seems wrong to do anyway. Has anyone else had any experiences with inotify/dovecot? reuben

2 3

[Dovecot] 1.0-test79
by Timo Sirainen 25 Jul '05

25 Jul '05

http://dovecot.org/test/ Now checks that field alignmentations are in indexes as they're expected. test78 crashed if it was wrong, earlier versions ignored the problem (and crashed with 64bit systems). Now if it's wrong, it prints error to log file and recreates the index. That means you probably should delete all dovecot.index files to avoid tons of errors in log files. Only mbox users need to do this. - LSUB: Don't crash if .subscriptions file can't be opened. Also in general give proper "permission denied" error if LIST/LSUB failed because of permission problems. - Maildir: Fix deadlocking when saving messages (noticeable with copying lots of messages with Thunderbird) - LDAP: user_global_uid/gid wasn't working. Also now they support having user/group names from /etc/passwd instead of just numbers. - passwd-file now supports variables in filename, so you can do eg. args = /etc/passwd.%d - Open/close PAM session if -session option is given. Patch by Pasi Sjöholm. - Added tb-extra-mailbox-sep workaround for Thunderbird+mbox problems.

6 9

[Dovecot] dovecot 1.0-stable (050721) rpm for FC3
by James Sun 25 Jul '05

25 Jul '05

OK, thanks for the all the helps I got from the list. I finally managed to get stable 1.0 (050721) built and running. To avoid the same hassels for others, I made an rpm. You can check it out at http://linux.junsun.net/rpms My main motivation to upgrade to this version is to avoid the "Status: O" header re-write bug in 0.99 versions. Cheers. Jun

1 0

[Dovecot] ssl_cipher_list
by Robert Allerstorfer 24 Jul '05

24 Jul '05

Hi, I have noticed the 'ssl_cipher_list' directive in the 1.0-test snapshots which is not in 0.99. It's default value seems to be "all:!low". However, this would not be compatible with openssl's cipher listing format. Thus, I would vote to change it's format to be openssl compatible. To be compatible, it has to be changed to "ALL:!LOW" (just upercased in this case). IMO, this would be helpful because executing openssl ciphers -v 'all:!low' would not return any cipher, but openssl ciphers -v 'ALL:!LOW' would return the expected cipher list such as ADH-AES256-SHA SSLv3 Kx=DH Au=None Enc=AES(256) Mac=SHA1 DHE-RSA-AES256-SHA SSLv3 Kx=DH Au=RSA Enc=AES(256) Mac=SHA1 DHE-DSS-AES256-SHA SSLv3 Kx=DH Au=DSS Enc=AES(256) Mac=SHA1 AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 ADH-AES128-SHA SSLv3 Kx=DH Au=None Enc=AES(128) Mac=SHA1 DHE-RSA-AES128-SHA SSLv3 Kx=DH Au=RSA Enc=AES(128) Mac=SHA1 DHE-DSS-AES128-SHA SSLv3 Kx=DH Au=DSS Enc=AES(128) Mac=SHA1 AES128-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(128) Mac=SHA1 DHE-DSS-RC4-SHA SSLv3 Kx=DH Au=DSS Enc=RC4(128) Mac=SHA1 EXP1024-DHE-DSS-RC4-SHA SSLv3 Kx=DH(1024) Au=DSS Enc=RC4(56) Mac=SHA1 export EXP1024-RC4-SHA SSLv3 Kx=RSA(1024) Au=RSA Enc=RC4(56) Mac=SHA1 export EXP1024-DHE-DSS-DES-CBC-SHA SSLv3 Kx=DH(1024) Au=DSS Enc=DES(56) Mac=SHA1 export EXP1024-DES-CBC-SHA SSLv3 Kx=RSA(1024) Au=RSA Enc=DES(56) Mac=SHA1 export EXP1024-RC2-CBC-MD5 SSLv3 Kx=RSA(1024) Au=RSA Enc=RC2(56) Mac=MD5 export EXP1024-RC4-MD5 SSLv3 Kx=RSA(1024) Au=RSA Enc=RC4(56) Mac=MD5 export EXP-KRB5-RC4-MD5 SSLv3 Kx=KRB5 Au=KRB5 Enc=RC4(40) Mac=MD5 export EXP-KRB5-RC2-CBC-MD5 SSLv3 Kx=KRB5 Au=KRB5 Enc=RC2(40) Mac=MD5 export EXP-KRB5-DES-CBC-MD5 SSLv3 Kx=KRB5 Au=KRB5 Enc=DES(40) Mac=MD5 export EXP-KRB5-RC4-SHA SSLv3 Kx=KRB5 Au=KRB5 Enc=RC4(40) Mac=SHA1 export EXP-KRB5-RC2-CBC-SHA SSLv3 Kx=KRB5 Au=KRB5 Enc=RC2(40) Mac=SHA1 export EXP-KRB5-DES-CBC-SHA SSLv3 Kx=KRB5 Au=KRB5 Enc=DES(40) Mac=SHA1 export KRB5-RC4-MD5 SSLv3 Kx=KRB5 Au=KRB5 Enc=RC4(128) Mac=MD5 KRB5-DES-CBC3-MD5 SSLv3 Kx=KRB5 Au=KRB5 Enc=3DES(168) Mac=MD5 KRB5-RC4-SHA SSLv3 Kx=KRB5 Au=KRB5 Enc=RC4(128) Mac=SHA1 KRB5-DES-CBC3-SHA SSLv3 Kx=KRB5 Au=KRB5 Enc=3DES(168) Mac=SHA1 EDH-RSA-DES-CBC3-SHA SSLv3 Kx=DH Au=RSA Enc=3DES(168) Mac=SHA1 EXP-EDH-RSA-DES-CBC-SHA SSLv3 Kx=DH(512) Au=RSA Enc=DES(40) Mac=SHA1 export EDH-DSS-DES-CBC3-SHA SSLv3 Kx=DH Au=DSS Enc=3DES(168) Mac=SHA1 EXP-EDH-DSS-DES-CBC-SHA SSLv3 Kx=DH(512) Au=DSS Enc=DES(40) Mac=SHA1 export DES-CBC3-SHA SSLv3 Kx=RSA Au=RSA Enc=3DES(168) Mac=SHA1 EXP-DES-CBC-SHA SSLv3 Kx=RSA(512) Au=RSA Enc=DES(40) Mac=SHA1 export EXP-RC2-CBC-MD5 SSLv3 Kx=RSA(512) Au=RSA Enc=RC2(40) Mac=MD5 export RC4-SHA SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=SHA1 RC4-MD5 SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5 EXP-RC4-MD5 SSLv3 Kx=RSA(512) Au=RSA Enc=RC4(40) Mac=MD5 export ADH-DES-CBC3-SHA SSLv3 Kx=DH Au=None Enc=3DES(168) Mac=SHA1 EXP-ADH-DES-CBC-SHA SSLv3 Kx=DH(512) Au=None Enc=DES(40) Mac=SHA1 export ADH-RC4-MD5 SSLv3 Kx=DH Au=None Enc=RC4(128) Mac=MD5 EXP-ADH-RC4-MD5 SSLv3 Kx=DH(512) Au=None Enc=RC4(40) Mac=MD5 export DES-CBC3-MD5 SSLv2 Kx=RSA Au=RSA Enc=3DES(168) Mac=MD5 RC2-CBC-MD5 SSLv2 Kx=RSA Au=RSA Enc=RC2(128) Mac=MD5 EXP-RC2-CBC-MD5 SSLv2 Kx=RSA(512) Au=RSA Enc=RC2(40) Mac=MD5 export RC4-MD5 SSLv2 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5 EXP-RC4-MD5 SSLv2 Kx=RSA(512) Au=RSA Enc=RC4(40) Mac=MD5 export I want dovecot to only accept high encrypted ciphers, thus it should support ssl_cipher_list = ALL:!ADH!LOW:!SSLv2:!EXP:+HIGH:+MEDIUM corresponding to a openssl list such as DHE-RSA-AES256-SHA SSLv3 Kx=DH Au=RSA Enc=AES(256) Mac=SHA1 DHE-DSS-AES256-SHA SSLv3 Kx=DH Au=DSS Enc=AES(256) Mac=SHA1 AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 KRB5-DES-CBC3-MD5 SSLv3 Kx=KRB5 Au=KRB5 Enc=3DES(168) Mac=MD5 KRB5-DES-CBC3-SHA SSLv3 Kx=KRB5 Au=KRB5 Enc=3DES(168) Mac=SHA1 EDH-RSA-DES-CBC3-SHA SSLv3 Kx=DH Au=RSA Enc=3DES(168) Mac=SHA1 EDH-DSS-DES-CBC3-SHA SSLv3 Kx=DH Au=DSS Enc=3DES(168) Mac=SHA1 DES-CBC3-SHA SSLv3 Kx=RSA Au=RSA Enc=3DES(168) Mac=SHA1 DHE-RSA-AES128-SHA SSLv3 Kx=DH Au=RSA Enc=AES(128) Mac=SHA1 DHE-DSS-AES128-SHA SSLv3 Kx=DH Au=DSS Enc=AES(128) Mac=SHA1 AES128-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(128) Mac=SHA1 DHE-DSS-RC4-SHA SSLv3 Kx=DH Au=DSS Enc=RC4(128) Mac=SHA1 KRB5-RC4-MD5 SSLv3 Kx=KRB5 Au=KRB5 Enc=RC4(128) Mac=MD5 KRB5-RC4-SHA SSLv3 Kx=KRB5 Au=KRB5 Enc=RC4(128) Mac=SHA1 RC4-SHA SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=SHA1 RC4-MD5 SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5 This would really make "Dovecot (...) written with security primarily in mind" Thanks for consideration! rob.

2 2

[Dovecot] feature or bug on delete?
by Cor Bosman 23 Jul '05

23 Jul '05

RFC 3501 mentions this: The DELETE command MUST NOT remove inferior hierarchical names. For example, if a mailbox "foo" has an inferior "foo.bar" (assuming "." is the hierarchy delimiter character), removing "foo" MUST NOT remove "foo.bar". It is an error to attempt to delete a name that has inferior hierarchical names and also has the \Noselect mailbox name attribute (see the description of the LIST response for more details). It is permitted to delete a name that has inferior hierarchical names and does not have the \Noselect mailbox name attribute. In this case, all messages in that mailbox are removed, and the name will acquire the \Noselect mailbox name attribute. This is what dovecot does: . create foo . OK Create completed. . create foo/bar . OK Create completed. . list "" "*" * LIST (\HasChildren) "/" "foo" * LIST (\HasNoChildren) "/" "foo/bar" . OK List completed. (some other output removed here) . delete foo . OK Delete completed. . list "" "*" * LIST (\HasNoChildren) "/" "foo/bar" . OK List completed. Reading the above section, shouldnt I be seeing a: * LIST (\Noselect \HasChildren) "/" "foo" Regards, Cor

2 2

[Dovecot] Assertion failure in mail-index-transaction.c
by Todd Burroughs 23 Jul '05

23 Jul '05

I just noticed one instance of this in the current CVS version: dovecot: Jul 18 15:25:48 Error: 5962 IMAP(mailuser): mbox sync: Expunged message reappeared in mailbox /mailhome/new/o/h/mailuser/mbox (UID 2834 < 2872) dovecot: Jul 18 15:25:48 Error: 5962 IMAP(mailuser): file mail-index-transaction.c: line 129 (mail_index_buffer_convert_to_uids): assertion failed: (*seq != 0) dovecot: Jul 18 15:25:48 Error: child 5962 (imap) killed with signal 6 (gdb) bt full #0 0xffffe410 in ?? () No symbol table info available. #1 0xbffff438 in ?? () No symbol table info available. #2 0x00000006 in ?? () No symbol table info available. #3 0x0000174a in ?? () No symbol table info available. #4 0xb7ef1d41 in raise () from /lib/tls/libc.so.6 No symbol table info available. #5 0xb7ef3529 in abort () from /lib/tls/libc.so.6 No symbol table info available. #6 0x0809a96a in i_internal_panic_handler ( fmt=0x6 <Address 0x6 out of bounds>, args=0x174a <Address 0x174a out of bounds>) at failures.c:374 No locals. #7 0x0809ad84 in i_panic ( format=0x80a772c "file %s: line %d (%s): assertion failed: (%s)") at failures.c:173 No locals. #8 0x08082711 in mail_index_buffer_convert_to_uids (t=0x80d14b8, array=0x80d14d0, range=1) at mail-index-transaction.c:129 view = (struct mail_index_view *) 0x80cfdc0 rec = Variable "rec" is not available. (gdb) bt #0 0xffffe410 in ?? () #1 0xbffff438 in ?? () #2 0x00000006 in ?? () #3 0x0000174a in ?? () #4 0xb7ef1d41 in raise () from /lib/tls/libc.so.6 #5 0xb7ef3529 in abort () from /lib/tls/libc.so.6 #6 0x0809a96a in i_internal_panic_handler ( fmt=0x6 <Address 0x6 out of bounds>, args=0x174a <Address 0x174a out of bounds>) at failures.c:374 #7 0x0809ad84 in i_panic ( format=0x80a772c "file %s: line %d (%s): assertion failed: (%s)") at failures.c:173 #8 0x08082711 in mail_index_buffer_convert_to_uids (t=0x80d14b8, array=0x80d14d0, range=1) at mail-index-transaction.c:129 #9 0x08083b87 in mail_index_transaction_commit (t=0x80d14b8, log_file_seq_r=0xbffff65c, log_file_offset_r=0xbffff660) at mail-index-transaction.c:183 #10 0x080703f4 in mbox_sync (mbox=0x80c5bc0, flags=Variable "flags" is not available. ) at mbox-sync.c:1623 #11 0x080710c9 in mbox_storage_sync_init (box=0x80c5bc0, flags=MAILBOX_SYNC_FLAG_FULL_READ) at mbox-sync.c:1700 #12 0x0808ef01 in mailbox_sync_init (box=0x0, flags=MAILBOX_SYNC_FLAG_FULL_READ) at mail-storage.c:334 #13 0x0805eb58 in imap_sync_nonselected (box=0x80c5bc0, flags=MAILBOX_SYNC_FLAG_FULL_READ) at imap-sync.c:166 #14 0x080580f6 in _cmd_select_full (cmd=0x80beba8, readonly=0) at cmd-select.c:39 #15 0x08058281 in cmd_select (cmd=0x80beba8) at cmd-select.c:92 #16 0x0805986b in _client_input (context=0x80beb68) at client.c:334 #17 0x0809ff3a in io_loop_handler_run (ioloop=0x80bd9b0) at ioloop-poll.c:184 #18 0x0809f569 in io_loop_run (ioloop=0x80bd9b0) at ioloop.c:218 #19 0x08060657 in main (argc=1, argv=0xbffffa34, envp=0xbffffa3c) at main.c:228 (gdb) p seq $1 = (uint32_t *) 0x80d4d18 (gdb) p *seq $2 = 0 (gdb) p view->map $3 = (struct mail_index_map *) 0x80c5fd0 (gdb) p *view->map $4 = {refcount = 3, hdr = {major_version = 7 '\a', minor_version = 0 '\0', base_header_size = 120, header_size = 200, record_size = 36, compat_data = "\001\b\004", indexid = 1113829460, flags = 0, uid_validity = 1113827022, next_uid = 2872, messages_count = 929, recent_messages_count = 0, seen_messages_count = 810, deleted_messages_count = 0, first_recent_uid_lowwater = 0, first_unseen_uid_lowwater = 1149, first_deleted_uid_lowwater = 2846, log_file_seq = 8, log_file_int_offset = 27912, log_file_ext_offset = 27912, sync_size = 9241460, sync_stamp = 1113863658, day_stamp = 1121659200, day_first_uid = {2855, 2849, 2849, 2753, 2753, 2753, 2491, 187}}, hdr_base = 0x80c60b0, records = 0x80c61d8, records_count = 929, extension_pool = 0x80ce490, extensions = { buffer = 0x80ce4c0, element_size = 28}, ext_id_map = {buffer = 0x80ce588, element_size = 4}, mmap_base = 0x0, mmap_size = 0, mmap_used_size = 0, buffer = 0x80c61b8, hdr_copy_buf = 0x80c6090, keyword_idx_map = { buffer = 0x0, element_size = 0}, write_to_disk = 0} (gdb) p t $5 = (struct mail_index_transaction *) 0x80d14b8 (gdb) p *t $6 = {refcount = 1, view = 0x80cfdc0, appends = {buffer = 0x80d4830, element_size = 8}, first_new_seq = 930, last_new_seq = 953, expunges = { buffer = 0x80d4810, element_size = 8}, updates = {buffer = 0x0, element_size = 0}, last_update_idx = 0, pre_hdr_change = '\0' <repeats 119 times>, pre_hdr_mask = '\0' <repeats 119 times>, post_hdr_change = '\0' <repeats 28 times>, "O\v", '\0' <repeats 89 times>, post_hdr_mask = '\0' <repeats 28 times>, "\001\001\001\001", '\0' <repeats 87 times>, ext_rec_updates = {buffer = 0x80d4750, element_size = 8}, ext_resizes = {buffer = 0x0, element_size = 0}, ext_resets = {buffer = 0x0, element_size = 0}, keyword_updates = {buffer = 0x0, element_size = 0}, keyword_resets = {buffer = 0x80d4730, element_size = 8}, cache_trans_ctx = 0x0, hide_transaction = 0, no_appends = 0, external = 1, pre_hdr_changed = 0, post_hdr_changed = 1, log_updates = 1} (gdb) p j $7 = 2 (gdb) p range $8 = 1

2 1

[Dovecot] pop3 authentication failure - password mismatch
by James Sun 23 Jul '05

23 Jul '05

I tried to run dovecot 1.0 built by myself but encountered the above problem. See the error traces below. First of all, the password and user are correct, as it worked with the 0.99 rpm version of dovecot. I also hand verified with ssh. I also attached the dovecot config file below. Any ideas? Jun fetchmail output on client: ------------------------------------- fetchmail: POP3< +OK Dovecot ready. fetchmail: POP3> CAPA fetchmail: POP3< +OK fetchmail: POP3< CAPA fetchmail: POP3< TOP fetchmail: POP3< USER fetchmail: POP3< UIDL fetchmail: POP3< RESP-CODES fetchmail: POP3< PIPELINING fetchmail: POP3< SASL PLAIN fetchmail: POP3< . fetchmail: POP3> USER jam fetchmail: POP3< +OK fetchmail: POP3> PASS * fetchmail: POP3< -ERR Authentication failed. fetchmail: Authentication failed. maillog on dovecot server: -------------------------------------- Jul 22 18:28:18 hsiufen dovecot: auth(default): passwd(jam,24.6.106.170): password mismatch Jul 22 18:28:19 hsiufen dovecot: pop3-login: Aborted login [24.6.106.170] Jul 22 18:29:32 hsiufen dovecot: Killed with signal 2 dovecot.conf ------------------ protocols = imap imaps pop3 pop3s listen = * ssl_disable = no disable_plaintext_auth = no protocol imap { login_executable = /root/local/encap/dovecot-1.0/libexec/dovecot/imap-login mail_executable = /root/local/encap/dovecot-1.0/libexec/dovecot/imap } protocol pop3 { login_executable = /root/local/encap/dovecot-1.0/libexec/dovecot/pop3-login mail_executable = /root/local/encap/dovecot-1.0/libexec/dovecot/pop3 } auth_executable = /root/local/encap/dovecot-1.0/libexec/dovecot/dovecot-auth auth_verbose = yes auth default { mechanisms = plain passdb = passwd userdb = passwd user = root }

2 3

[Dovecot] Stable Version
by Marc Perkel 23 Jul '05

23 Jul '05

I'm very new to Dovecot - still testing it - and planing to convert in the futire. I see a lot of rapid development here which I like. But I'm wondering if there is any kind of schedule for blessing 1.0 as official - or - what the custom is for a stable release. Just trying to think about when to jump in. I'm fairly brave, but the feature I need we just added today. -- Marc Perkel - marc(a)perkel.com Spam Filter: http://www.junkemailfilter.com My Blog: http://marc.perkel.com

2 1

[Dovecot] 1.0-test78
by Timo Sirainen 22 Jul '05

22 Jul '05

http://dovecot.org/test/ Fixes: - Crashes in non-x86 64bit systems - Bugs in cache file header caching (you probably should delete all dovecot.index.cache files to be sure the bug won't haunt you in future) - FETCH ENVELOPE patch by Chris Wakelin (I'll try to figure out what to do with the list patch later) Known bugs left: - Thunderbird + maildir: moving lots of messages from mailbox to another may cause deadlock (lock timeouts in half a minute or so and fails the operation). - I guess I should try to look at the Thunderbird + POP3 + lots of messages -> DELE error too again.. - I've heard that 1.0-tests are a lot slower than 0.99.x or 1.0-stable when checking new mail (with kmail), ie. client asking STATUS of all mailboxes. I've looked at their strace outputs and the difference (5-10x slower) comes from 1.0-test waiting longer in poll() for client input, which doesn't really make any sense to me. Can anyone verify this or think of reasons why this could happen? Maybe I'm setting some socket option differently, although I don't think I've changed anything..

8 15