- dovecot - dovecot.org

dovecot: imap Error: fts_solr: Query didn't return uid
by Randall Gellens 01 Jan '15

01 Jan '15

Anyone know what this means and what the implications are? dovecot: imap(user) Error: fts_solr: Query didn't return uid -- Randall Gellens Opinions are personal; facts are suspect; I speak for myself only -------------- Randomly selected tag: --------------- Men fear thought as they fear nothing else on earth, more than ruin, more even than death --Bertrand Russell

1 0

dovecot 2 low TCP speed (fetching big mail)
by Wojciech Puchar 01 Jan '15

01 Jan '15

i use dovecot 2 under FreeBSD (dovecot2-2.2.15 compiled from ports). tried both with kqueue enabled or not. everything works very fast, EXCEPT fetching big mail. tried multiple clients (thunderbird on windows, alpine on the same server, alpine on other unix server connected by 1Gb/s LAN) and fetching peaks at 1MB/s. NO SSL! could you please point me where to search for a problem. hints: writing over IMAP (eg. writing to Sent folder) works at full speed. Doesn't seem like a problem with unix server, every other service goes at speed 70-100MB/s both directions (like samba, ftp). tried to turn off "kqueue" compile time option, no difference. Please give me a hint at least what to check. Does dovecot use other way to sent data over TCP socket than other programs? thank you.

2 1

dovecot-auth only configuration
by Dan Langille 31 Dec '14

31 Dec '14

I am configuring a dovecot-auth only installation. Postfix will use dovecot for sasl auth. Here is the configuration I’ve settled upon. I welcome suggestions for improving this setup. Thanks. # doveconf -n # 2.2.15: /usr/local/etc/dovecot/dovecot.conf # OS: FreeBSD 9.3-RELEASE-p5 amd64 auth_mechanisms = plain login mail_max_userip_connections = 80 mail_privileged_group = mail passdb { args = scheme=SHA512-CRYPT /var/db/dovecot.users driver = passwd-file } protocols = none service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } user = root } userdb { args = /var/db/dovecot.users driver = passwd-file } verbose_proctitle = yes — Dan Langille http://langille.org/

1 0

Authenticating Virtual Users without domain
by Leon Kyneur 31 Dec '14

31 Dec '14

Hi, I'm trying to migrate a large number of users to a new Dovecot cluster. The existing mail system allows a user to authenticate with a bare username if they have connected to the correct local IP on the server. e.g. imap.somedomain.com = 1.1.1.1 imap.anotheromain.com = 2.2.2.2 charlie@somedomain can authnenticate as 'charlie' or 'charlie(a)somedomain.com' as long as he is connected to imap.somedomain.com (1.1.1.1) likewise for bare usernames if they connect to imap.anotherdomain.com. A previous colleague actually achieved this by hacking with the Dovecot source code and writing in a lookup table feature. The code is very old and won't patch cleanly to the latest 2.2.15 source. Another platform we are using (commercial product) also has this feature but we also need to migrate these users to Dovecot. I already have a Dovecot proxy layer for mailbox lookup - so ideally I would like to do this on my Dovecot proxies. I know I can also do this kind of thing if I swapped my dovecot proxy for Perdition, however I don't really want to do that. I've looked into checkpassword scripts and could possibly make something work (albeit ugly) - is this the right direction to take here? Thanks, Leon

2 1

Segmentation fault in pigeonhole lib-sieve
by Orion Poplawski 30 Dec '14

30 Dec '14

The sieve plugin for Thundirbird likes to rapidly compile work in progress sieve scripts to continually give feedback on any errors in the script. This can trigger segmentation faults in lib-sieve with certain pathologically incomplete sieve scripts. One example: #0 tag_comparator_validate (valdtr=0x7f291aa713a0, arg=0x7fff5c3cfa58, cmd=0x7f291aa69360) at sieve-comparators.c:143 143 if ( (*arg)->type != SAAT_STRING ) { Missing separate debuginfos, use: debuginfo-install bzip2-libs-1.0.6-12.el7.x86_64 glibc-2.17-55.el7_0.3.x86_64 sssd-client-1.11.2-68.el7_0.6.x86_64 zlib-1.2.7-13.el7.x86_64 (gdb) list 138 *arg = sieve_ast_argument_next(*arg); 139 140 /* Check syntax: 141 * ":comparator" <comparator-name: string> 142 */ 143 if ( (*arg)->type != SAAT_STRING ) { 144 sieve_argument_validate_error(valdtr, *arg, 145 ":comparator tag requires one string argument, but %s was found", 146 sieve_ast_argument_name(*arg) ); 147 return FALSE; (gdb) print arg $1 = (struct sieve_ast_argument **) 0x7fff5c3cfa58 (gdb) print *arg $2 = (struct sieve_ast_argument *) 0x0 So sieve_ast_argument_next() is returning NULL and we're trying to dereference it without checking. Here's a completely naive attempt at a patch: --- dovecot-2.2.15/dovecot-2.2-pigeonhole-0.4.3/src/lib-sieve/sieve-comparators.c.null 2014-01-01 15:46:39.000000000 -0700 +++ dovecot-2.2.15/dovecot-2.2-pigeonhole-0.4.3/src/lib-sieve/sieve-comparators.c 2014-12-29 14:01:00.233436697 -0700 @@ -140,6 +140,11 @@ static bool tag_comparator_validate /* Check syntax: * ":comparator" <comparator-name: string> */ + if ( *arg == NULL ) { + sieve_argument_validate_error(valdtr, *arg, + ":comparator tag requires one string argument, but none was found"); + return FALSE; + } if ( (*arg)->type != SAAT_STRING ) { sieve_argument_validate_error(valdtr, *arg, ":comparator tag requires one string argument, but %s was found", -- Orion Poplawski Technical Manager 303-415-9701 x222 NWRA, Boulder/CoRA Office FAX: 303-415-9702 3380 Mitchell Lane orion(a)nwra.com Boulder, CO 80301 http://www.nwra.com

2 2

PAM issues on OS X Yosemite
by Markus Mayer 30 Dec '14

30 Dec '14

Hi, I have been running dovecot successfully on OS X Mavericks for several months. After upgrading to Yosemite, however, PAM authentication for dovecot is failing. Or rather, creating the PAM session is failing. Either way, I can't get to my e-mail. $ /usr/pkg/sbin/dovecot --version 2.2.15 $ /usr/pkg/sbin/dovecot -n # 2.2.15: /usr/pkg/etc/dovecot/dovecot.conf # OS: Darwin 14.0.0 x86_64 hfs auth_debug = yes auth_verbose = yes mail_location = maildir:/Volumes/Secure/%u/Maildir mail_privileged_group = mail namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = session=yes dovecot driver = pam } ssl_cert = </usr/pkg/etc/openssl/certs/dovecot.pem ssl_key = </usr/pkg/etc/openssl/private/dovecot.pem userdb { driver = passwd } $ defaults read "/System/Library/CoreServices/SystemVersion" ProductVersion 10.10.1 Dec 30 13:21:47 my.host.name dovecot[49247]: auth: Debug: auth client connected (pid=49289) Dec 30 13:21:51 my.host.name dovecot[49247]: auth: Debug: client in: AUTH 1 PLAIN service=imap secured session=3bBdlHULNgAAAAAAAAAAAAAAAAAAAAAB lip=::1 rip=::1 lport=143 rport=52278 resp=<hidden> Dec 30 13:21:51 my.host.name dovecot[49247]: auth-worker(49286): Debug: pam(markus,::1): lookup service=dovecot Dec 30 13:21:51 my.host.name dovecot[49247]: auth-worker(49286): Debug: pam(markus,::1): #1/1 style=1 msg=Password: Dec 30 13:21:51 my.host.name dovecot[49247]: auth-worker(49286): Error: pam(markus,::1): pam_open_session() failed: session failure Dec 30 13:21:53 my.host.name dovecot[49247]: auth: Debug: client passdb out: FAIL 1 user=markus It does successfully verify my password. If I purposefully enter a wrong password the error becomes "pam_authenticate() failed: authentication error (password mismatch?)". So that portion is okay. Do you have any suggestions how I might find out why pam_open_session() is failing? The auth process *is* running as root. I have tried these two PAM configurations. The first one based on Maverick's /etc/pam.d/login and used to work fine on Mavericks. # dovecot: auth account password session auth optional pam_krb5.so use_kcminit auth optional pam_ntlm.so try_first_pass auth optional pam_mount.so try_first_pass auth required pam_opendirectory.so try_first_pass account required pam_nologin.so account required pam_opendirectory.so password required pam_opendirectory.so session required pam_launchd.so session required pam_uwtmp.so session optional pam_mount.so I tried to simplify it by using the one suggested on dovecot's PAM wiki. # dovecot: auth account password session auth required pam_opendirectory.so try_first_pass account required pam_nologin.so account required pam_opendirectory.so password required pam_opendirectory.so On Yosemite, neither works. Or, quite possibly, both configurations are fine and the problem lies elsewhere. Any pointers would be greatly appreciated. In the mean time I'll be using auth-passwdfile, since that works. Thanks, -Markus

1 0

SPECIAL-USE again
by Peter Mogensen 30 Dec '14

30 Dec '14

Hi, Great to see Thunderbird support SPECIAL-USE now. I would like to hear the list about the intended use of SPECIAL-USE. I get the impression from several earlier mails here that the intention is for the server to globally decide what the folder-name of a specific SPECIAL-USE folder is for all users. That's the way the documentation exemplifies it and what I get from posts like this: http://www.dovecot.org/list/dovecot/2013-February/088129.html I get the point that if *all* clients ignored the real folder-name and only obeyed SPECIAL-USE, the clients could locally in the GUI decide language and name of the \Sent, \Drafts, \Trash folders. And the real folder name would become just an opaque identifier. However that's not how the world is like. There are plenty of clients ignoring SPECIAL-USE and placing meaning in the actual folder name in a language of their own choice. It seems natural for me to let the user configure their own individual SPECIAL-USE tagging according to their language and/or mix of IMAP clients. - either by setting IMAP METADATA (RFC5464) or by having the userdb return entries like: "namespace/inbox/Papperskorg/specialuse=\Trash" (for a swede) /Peter PS: Also... Isn't there a need for a Sieve extension to allow "fileinto" to target a folder based on special-use ?

3 4

Re: doveadm pw generates different hash each time it is invoked
by Joseph Tam 29 Dec '14

29 Dec '14

reik red writes: > (I'm re-submittting after setting up a subscription, so I don't have to wait for the moderator) > , > What happened next surprised me greatly: if I specify "-s ssha", the > resulting hashed password changes each time I invoke "doveadm pw", but > if I do not specify the hashing method, I get the same password each time (as I > expect). What on earth is going on here? There must be something > fundamental that I am missing. "doveadm pw" is working correctly. CRAM-MD5 and SSHA use hashing in 2 different ways to authenticate a user. CRAM-MD5 is a challenge-response system where the server sends the client a random string each and every session. The client hashes the password and the random string and sends it to the server as proof of authenticity. The server performs the same calculation to verify. However, the server needs to know the password (or password equivalent) in order to duplicate the hash calculation. SSHA precomputes the random strings (salt) and hashes the password with it, and stores both salt and hash in the password database. During authentication, the password is (or ought to be) transmitted plain within a SSL connection from the client to the server, then the server hashes the password with the stored salt and compares with the hash in the database. Every time you run "doveadm pw -s sha" a new random salt is generated, hence a new hash is produced even though you use the same password. You would use challenge-response in situations where the communication channel is insecure (i.e. non-SSL). However, the drawback is the password database contains enough information for someone to authenticate if it should fall into the wrong hands. Joseph Tam <jtam.home(a)gmail.com>

1 0

Re: Awfully slow dovecot
by Joseph Tam 29 Dec '14

29 Dec '14

Robin Helgelin writes: > We?re using dovecot 1.0.7, which seems to be the latest version > available on CentOS 5. It wouldn't be a bad idea to update this if you can, even if you have to compile it yourself. You'll benefit from many bug fixes, one of which may solve your problem. > Downloading emails are dead slow. Really small emails goes quickly, > but normal emails and emails with attachments are so slow to download > it?s almost ridiculous. I?ve googled some and found that it could be > related to quota, but I disabled the quota plugins on imap with no > difference. The problem with "slowness" is that it can result from just about anything. I've seen reports of slowness caused by LDAP handups, filesystem and I/O polling, client issues, network issues, firewall issues, anti-virus stuff, resource starvation. That's just the stuff I remember. You'll need to dig further to reduce the scope of where it can be going wrong. I would suggest getting hints from - process tracing - network snooping - logs Test if it's a mail client issue by sampling more than one mail client (or better yet, talk IMAP directly to the server via telnet or netcat and download a large piece of Email). If that provokes a problem, work your way back to the server and do the same thing on the server itself (bypassing the network stack) and see if the problem still persists. Depending on what you find out, at least you'll know which side of the fence you should be looking at. (Also, asks yourself the obvious question: did you change anything before dovecot performance went down the tubes? New hardware? Patches?) Joseph Tam <jtam.home(a)gmail.com>

1 0

Deleting files in sdbox
by Jeff Mitchell 28 Dec '14

28 Dec '14

Hello, I'm curious as to what happens if I were to manually delete files in an sdbox on the server. A long time ago -- I'm not sure how, as it was several years ago -- something happened and a number of users got a large number of mail messages duplicated. Literally duplicated -- all headers, all body content. I have a script that can find these duplicated messages (by ignoring the first few and last few lines of each message, and using SHAs to compare and find the duplicates). However, I don't see a doveadm style command to manually delete messages, except for doveadm-expunge. In the past I've used that with search queries but my experience is that trying to do many individual operations on individual files with doveadm-expunge can be quite slow. So, if Dovecot is going to just say "huh, my indexes/metadata are wrong, lemme rebuild them", I'd rather just rm the messages and let Dovecot do its thing. Again, this is with sdbox storage. Dovecot version is 2.2.9. Thanks! --Jeff

3 3