- dovecot - dovecot.org

cram-md5 cache problem
by d tbsky 28 Jun '15

28 Jun '15

hi: I was using scientific linux 6 and had cache problem. I upgrade to scientific linux 7 but the problem is the same, so I try to find out why. dovecot version: 2.2.10. postfix + postfixadmin environment. use dovecot-lda to deliver local mail. if I enable cache with "auth_cache_size = 102400" and enable cram-md5 with "auth_mechanisms = plain login cram-md5". I have cache problem: if I change password at postfixadmin, I can not use the new password to login imap when old password is cached. dovecot log below: Jun 28 11:50:32 auth: Debug: client in: AUTH 6 CRAM-MD5 service=imap securedsession=xjn534sZ9gB/AAAB lip=127.0.0.1 rip=127.0.0.1 lport=143 rport=36342 Jun 28 11:50:32 auth: Debug: client passdb out: CONT 6 PDQzNTU5NTA4MTQxODg5NzUuMTQzNTQ2MzQzMkBtYWlsLmxoeS5jb20udHc+ Jun 28 11:50:32 auth: Debug: client in: CONT<hidden> Jun 28 11:50:32 auth: Debug: cache(test(a)test.example.com,127.0.0.1,<xjn534sZ9gB/AAAB>): hit: <hidden> user=test(a)test.example.com userdb_home=/share/postfix/domains/test.example.com/test/home userdb_mail=maildir:/share/postfix/domains/test.example.com/test userdb_uid=143 userdb_gid=143 Jun 28 11:50:32 auth: Info: cram-md5(test(a)test.example.com,127.0.0.1,<xjn534sZ9gB/AAAB>): password mismatch Jun 28 11:50:34 auth: Debug: client passdb out: FAIL 6 user=test(a)test.example.com Jun 28 11:50:34 imap-login: Debug: Ignoring unknown passdb extra field: Jun 28 11:50:34 imap-login: Info: Disconnected (auth failed, 1 attempts in 2 secs): user=<test(a)test.example.com>, method=CRAM-MD5, rip=127.0.0.1, lip=127.0.0.1, secured, session=<xjn534sZ9gB/AAAB> if I disable "cram-md5" with "auth_mechanisms = plain login". everything is fine. dovecot log below: Jun 28 11:32:24 auth: Debug: cache(test(a)test.example.com,127.0.0.1,<WNsin4sZ6gB/AAAB>): hit: <hidden> user=test(a)test.example.com userdb_home=/share/postfix/domains/test.example.com/test/home userdb_mail=maildir:/share/postfix/domains/test.example.com/test userdb_uid=143 userdb_gid=143 Jun 28 11:32:24 auth: Info: cache(test(a)test.example.com,127.0.0.1,<WNsin4sZ6gB/AAAB>): Password mismatch Jun 28 11:32:24 auth-worker(3711): Debug: sql(test(a)test.example.com,127.0.0.1): query: SELECT username as user, password, '/share/postfix/domains/test.example.com/test/home' as userdb_home, 'maildir:/share/postfix/domains/test.example.com/test' as userdb_mail, 143 as userdb_uid, 143 as userdb_gid FROM mailbox WHERE username = 'test(a)test.example.com' AND active = '1' Jun 28 11:32:24 auth: Debug: client passdb out: OK 15 user=test(a)test.example.com Jun 28 11:32:24 auth: Debug: master in: REQUEST 1951268865 3672 15 0b198494a7e732324f6d6c507b25c13e session_pid=3956 request_auth_token Jun 28 11:32:24 auth: Debug: prefetch(test(a)test.example.com,127.0.0.1,<WNsin4sZ6gB/AAAB>): success Regards, tbskyd

1 0

Out of bounds read error in wildcard_match.c
by Hanno Böck 27 Jun '15

27 Jun '15

Hi, I discovered an out of bounds read error in the file wildcard_match.c. Here's the code: /* find the end of each string */ while (*(++mask)); mask--; while (*(++data)); data--; The problem with this: It will search for the end of the strings (zero-terminated), but it'll only start at position 1, not at position 0 (because the ++ in front of the variable will first increment and then return the value). However these strings can be empty. This can be fixed by changing ++mask to mask++ (and same for data), then there must be a -=2 instead of -- afterwards. See attached patch. I found this by compiling dovecot with address sanitizer and running the test suite. cu, -- Hanno Böck http://hboeck.de/ mail/jabber: hanno(a)hboeck.de GPG: BBB51E42

1 0

"Sensible" location for Sieve scripts
by Andrew Beverley 26 Jun '15

26 Jun '15

I'm configuring some Sieve scripts for virtual users. I'd like to keep the Sieve scripts somewhere "sensible". Currently, all the mail goes into /var/mail/vhosts/<domain>/<mailbox> So I thought a good place for the sieve script might be in there as well, for example: /var/mail/vhosts/example.com/username/sieve Is there any reason *not* to store the sieve scripts in the same location as the mail? Thanks, Andy

3 4

replication notification with chroot users
by Tim Kuijsten 25 Jun '15

25 Jun '15

I'm getting the following error when using dovecot replication: dovecot: imap(foo(a)bar.com): Error: open(/var/dovecot/replication-notify-fifo) failed: No such file or directory I guess this has something to do with the fact that every user is chrooted in it's own homedir. Does dsync support dsync notification when all users are chrooted? lmtp does not seem to have this problem so new mails get replicated, but status changes don't. Thanks. -Tim Config on source: # 2.2.15: /etc/dovecot/dovecot.conf # OS: OpenBSD 5.7 amd64 auth_debug = yes auth_mechanisms = plain login auth_verbose = yes dsync_remote_cmd = /usr/bin/ssh imap.netsend.nl first_valid_gid = 30000 first_valid_uid = 30000 last_valid_gid = 30100 last_valid_uid = 30100 mail_debug = yes mail_home = /srv/vmail/%d/%n mail_location = maildir:~/Maildir mail_plugins = " notify replication" passdb { args = /passwd driver = passwd-file } passdb { args = /passwd_smtponly driver = passwd-file } plugin { mail_replica = remoteprefix:imap.netsend.nl } protocols = imap lmtp service aggregator { fifo_listener replication-notify-fifo { mode = 0666 } unix_listener replication-notify { mode = 0666 } } service auth-worker { chroot = /etc/mail unix_listener /etc/mail/auth-worker { mode = 0600 user = $default_internal_user } user = $default_internal_user } service auth { chroot = /etc/mail unix_listener /var/spool/postfix/private/dovecot-auth { group = _postfix mode = 0600 user = _postfix } } service imap-login { inet_listener imap { port = 0 } process_min_avail = 1 } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = _postfix mode = 0600 user = _postfix } } service replicator { process_min_avail = 1 unix_listener replicator-doveadm { mode = 0600 } } ssl = required ssl_cert = </etc/ssl/private/2015/chain.crt ssl_cipher_list = ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-CHACHA20-POLY1305:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:DHE-RSA-AES256-SHA256:ECDHE-RSA-AES256-SHA:DHE-RSA-AES256-SHA; ssl_dh_parameters_length = 2048 ssl_key = </etc/ssl/private/the.key ssl_prefer_server_ciphers = yes ssl_protocols = !SSLv2 !SSLv3 userdb { args = /passwd default_fields = uid=30000 gid=30000 home=/srv/vmail/%d/%n/./ driver = passwd-file } valid_chroot_dirs = /srv/vmail verbose_ssl = yes protocol imap { mail_max_userip_connections = 20 } config on destination imap.netsend.nl: # 2.2.15: /etc/dovecot/dovecot.conf # OS: OpenBSD 5.7 amd64 auth_debug = yes auth_mechanisms = plain login auth_verbose = yes first_valid_gid = 30000 first_valid_uid = 30000 last_valid_gid = 30100 last_valid_uid = 30100 mail_debug = yes mail_home = /srv/vmail/%d/%n mail_location = sdbox:~/dbox passdb { args = /passwd driver = passwd-file } passdb { args = /passwd_smtponly driver = passwd-file } protocols = imap lmtp service auth-worker { chroot = /etc/mail unix_listener /etc/mail/auth-worker { mode = 0600 user = $default_internal_user } user = $default_internal_user } service auth { chroot = /etc/mail unix_listener /var/spool/postfix/private/dovecot-auth { group = _postfix mode = 0600 user = _postfix } } service imap-login { inet_listener imap { port = 0 } process_min_avail = 1 } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = _postfix mode = 0600 user = _postfix } } ssl = required ssl_cert = </etc/ssl/private/2015/chain.crt ssl_cipher_list = ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-CHACHA20-POLY1305:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:DHE-RSA-AES256-SHA256:ECDHE-RSA-AES256-SHA:DHE-RSA-AES256-SHA; ssl_dh_parameters_length = 2048 ssl_key = </etc/ssl/private/the.key ssl_prefer_server_ciphers = yes ssl_protocols = !SSLv2 !SSLv3 userdb { args = /passwd default_fields = uid=30000 gid=30000 home=/srv/vmail/%d/%n/./ driver = passwd-file } valid_chroot_dirs = /srv/vmail verbose_ssl = yes protocol imap { mail_max_userip_connections = 20 }

1 0

imap-login: Authenticate PLAIN failed: Unsupported authentication mechanism - with Evolution
by lejeczek 25 Jun '15

25 Jun '15

I wonder if you know if Evolution works with dovecot TLS?

2 2

director
by jjhoffart 25 Jun '15

25 Jun '15

Hello, I am currently trying to setup dovecot with a director instance and have managed to configure to invocations of dovecot on my server but my dovecot log keeps giving me errors about authentication. A little background on my config I am running dovecot with postfix and using an LDAP directory. Here are the errors I am seeing in my logs. dovecot.log Jun 02 10:42:59 auth: Fatal: LDAP: ldap_init() failed with hosts: 1.1.1.1:389 Jun 02 10:42:59 master: Error: service(auth): command startup failed, throttling for 60 secs Jun 02 10:42:59 director: Error: Auth server disconnected unexpectedly Jun 02 10:42:59 pop3-login: Info: Disconnected: Auth process broken (disconnected before auth was ready, waited 0 secs): user=<>, rip=1.1.3.4, lip=1.1.1.1, session=<EumVoosXpQDAqAbv> Jun 02 10:43:59 auth: Fatal: LDAP: ldap_init() failed with hosts: 1.1.1.1:389 Jun 02 10:43:59 master: Error: service(auth): command startup failed, throttling for 60 secs Jun 02 10:43:59 director: Error: Auth server disconnected unexpectedly Jun 02 10:43:59 pop3-login: Info: Disconnected: Auth process broken (disconnected before auth was ready, waited 0 secs): user=<>, rip=1.1.1.1, lip=1.1.1.2, session=<rpEpposXxADAqAbv> dovecot-seive.log Jun 01 14:39:57 lda: Fatal: Internal error occurred. Refer to server log for more information. Jun 01 14:47:51 lda: Error: userdb lookup(postmaster(a)mydomain.com): Disconnected unexpectedly Jun 01 14:47:51 lda: Fatal: Internal error occurred. Refer to server log for more information. mail.log Jun 2 10:41:25 mail1 postfix/smtpd[2932]: name_mask: noanonymous Jun 2 10:41:25 mail1 postfix/smtpd[2932]: xsasl_dovecot_server_connect: Connecting Jun 2 10:41:25 mail1 postfix/smtpd[2932]: fatal: no SASL authentication mechanisms Jun 2 10:41:26 mail1 postfix/master[2068]: warning: process /usr/lib/postfix/smtpd pid 2932 exit status 1 Jun 2 10:41:26 mail1 postfix/master[2068]: warning: /usr/lib/postfix/smtpd: bad command startup -- throttling Jun 2 10:43:06 mail1 postfix/anvil[2934]: statistics: max connection rate 1/60s for (smtp:0.0.0.0) at Jun 2 10:41:25 Jun 2 10:43:06 mail1 postfix/anvil[2934]: statistics: max connection count 1 for (smtp:0.0.0.0) at Jun 2 10:41:25 Jun 2 10:43:06 mail1 postfix/anvil[2934]: statistics: max cache size 1 at Jun 2 10:41:25

2 1

Namespace Translation / IMAP Proxying
by Daniel van Ham Colchete 25 Jun '15

25 Jun '15

Hello everyone! About three years ago we migrated from Courier do Dovecot using the procedure at http://wiki2.dovecot.org/Migration/Courier. So we have a namespace prefix os "INBOX.". We are trying to implement the SOGo collaboration with Exchange ActiveSync integration with Android Lollipop devices. So, in this exact configuration (namespace prefix + ActiveSync + Android Lollipop) things dont work really well [1]. I'm trying to get an IMAP Proxy of any kind in front of my Dovecot system to translate my namespaces when SOGo connects to it. So instead of presenting INBOX and INBOX.Sent it should show INBOX and Sent. I tried to do it with imapc but couldn't find any configuration that would allow it. I also looked at Perdition IMAP Proxy and NGINX but couldn't find it there also. Does anyone knows a way to do it? Best, Daniel Colchete [1] https://lists.inverse.ca/sogo/arc/users/2015-06/msg00301.html

1 0

Fatal: -N parameter requires syncing with remote host
by lejeczek 25 Jun '15

25 Jun '15

hi I get with default (not declared) replication_dsync_parameters above errors, and for users that I'm trying to disable replication. I'm trying to disable with: override_fields = mail_replica="" in userdb and just in case (ldap) also user_attrs = =mail_replica="" my replication conf is pretty basic: service replicator { process_min_avail = 1 unix_listener replicator-doveadm { mode = 0660 } } service aggregator { fifo_listener replication-notify-fifo { user = vmail group = Domain Users mode = 0660 } unix_listener replication-notify { user = vmail group = Domain Users } } service doveadm { inet_listener { port = 12345 } } doveadm_password = secret # I can tell simple test: doveadm -v sync -f -u my(a)my.domain ssh vmail@server doveadm dsync-server -u me(a)my.domain works. It's for a user that I don't want replication. What am I missing here? many thanks

1 0

Re: Virtual Mailboxes
by dmiller＠amfes.com 25 Jun '15

25 Jun '15

My next bonehead maneuver - was more of the first! location = virtual:/var/mail/%%d/%%n/mdbox/mailboxes/virtual was adapted from my definition for my shared namespace. Which was intended to share OTHER users - which is why the '%%' prefixes are used. Changing to: location = virtual:/var/mail/%d/%n/mdbox/mailboxes/virtual Now I can actually view something! But I still have a challenge - the mailboxes don't allow subscriptions via IMAP. If I manually edit the "subscriptions" file I can force it and I can now browse & view - but I can't make changes via IMAP clients. What else am I missing? -- Daniel On 2015-06-22 10:31, dmiller(a)amfes.com wrote: > Any ideas on what I need to check or should post to help find the > problem? > > -- > Daniel > > > On 2015-06-20 14:50, dmiller(a)amfes.com wrote: >> The first bonehead maneuver seems to be: >> location = virtual:/var/mail/%%d/%%n/mdbox/virtual >> I'm thinking it should be: >> location = virtual:/var/mail/%%d/%%n/mdbox/mailboxes/virtual >> >> But...it didn't seem to make a difference. And if I have the >> "virtual" folder tree under a location other than >> "/var/mail/domain/user/mdbox/mailboxes" no names appear - so I think I >> have the files in the right place. Any ideas? >> >> -- >> Daniel >> >> >> On 2015-06-20 14:34, dmiller(a)amfes.com wrote: >>> >>> Having some trouble with my first attempt at virtual mailboxes. I've >>> enabled the plugin in 10-mail.conf, added a virtual namespace, and >>> created the dovecot-virtual files in the folders. >>> >>> I see the folder names in the list when I refresh the folders >>> available for subscription - but the folders cannot be subscribed to >>> and I can't view their contents. What obvious mistake did I make? >>> >>> doveconf -n: >>> auth_cache_size = 4 k >>> auth_mechanisms = plain login >>> default_login_user = nobody >>> default_vsz_limit = 1 G >>> dict { >>> acl = mysql:/usr/local/etc/dovecot/dovecot-dict-sql.conf.ext >>> } >>> disable_plaintext_auth = no >>> listen = * >>> mail_attachment_dir = /var/mail/attachments >>> mail_plugins = fts fts_solr acl zlib virtual >>> mail_shared_explicit_inbox = yes >>> managesieve_notify_capability = mailto >>> managesieve_sieve_capability = fileinto reject envelope >>> encoded-character vacation subaddress comparator-i;ascii-numeric >>> relational regex imap4flags copy include variables body enotify >>> environment mailbox date index ihave duplicate >>> mdbox_rotate_interval = 1 days >>> mdbox_rotate_size = 32 M >>> namespace { >>> hidden = no >>> inbox = yes >>> list = yes >>> location = >>> prefix = >>> separator = / >>> subscriptions = yes >>> type = private >>> } >>> namespace { >>> list = children >>> location = mdbox:/var/mail/%%d/%%n/mdbox >>> prefix = shared/%%n/ >>> separator = / >>> subscriptions = no >>> type = shared >>> } >>> namespace { >>> location = virtual:/var/mail/%%d/%%n/mdbox/virtual >>> prefix = virtual/ >>> separator = / >>> } >>> passdb { >>> args = /usr/local/etc/dovecot/dovecot-ldap.conf >>> driver = ldap >>> } >>> plugin { >>> acl = vfile:/usr/local/etc/dovecot/global-acls:cache_secs=300 >>> acl_shared_dict = proxy::acl >>> fts = solr >>> fts_autoindex = yes >>> fts_solr = break-imap-search url=http://solr.amfes.lan:8983/solr/ >>> sieve = ~/.dovecot.sieve >>> sieve_dir = ~/sieve >>> } >>> protocols = imap lmtp sieve >>> service auth { >>> unix_listener /var/spool/postfix/private/auth { >>> group = postfix >>> mode = 0660 >>> user = postfix >>> } >>> unix_listener auth-userdb { >>> group = mail >>> mode = 0600 >>> user = vmail >>> } >>> } >>> service dict { >>> unix_listener dict { >>> group = mail >>> mode = 0660 >>> user = vmail >>> } >>> } >>> service imap-login { >>> process_limit = 200 >>> process_min_avail = 10 >>> service_count = 1 >>> } >>> service lmtp { >>> process_min_avail = 5 >>> unix_listener /var/spool/postfix/private/dovecot-lmtp { >>> group = mail >>> mode = 0666 >>> user = vmail >>> } >>> } >>> service managesieve-login { >>> inet_listener sieve { >>> port = 4190 >>> } >>> inet_listener sieve_deprecated { >>> port = 2000 >>> } >>> process_min_avail = 0 >>> service_count = 1 >>> } >>> ssl_cert = </usr/local/etc/dovecot/ssl/certs/mail.amfes.com.crt >>> ssl_key = </usr/local/etc/dovecot/ssl/private/mail.amfes.com.key >>> userdb { >>> driver = prefetch >>> } >>> userdb { >>> args = /usr/local/etc/dovecot/dovecot-ldap.conf >>> driver = ldap >>> } >>> verbose_proctitle = yes >>> protocol lmtp { >>> mail_plugins = fts fts_solr acl zlib virtual sieve >>> } >>> protocol lda { >>> mail_plugins = fts fts_solr acl zlib virtual sieve >>> } >>> protocol imap { >>> imap_client_workarounds = tb-extra-mailbox-sep >>> imap_idle_notify_interval = 29 mins >>> mail_max_userip_connections = 50 >>> mail_plugins = fts fts_solr acl zlib virtual imap_acl >>> } >>> local 192.168.0.2 { >>> protocol imap { >>> ssl_cert = </usr/local/etc/dovecot/ssl/certs/mail.amfes.com.crt >>> ssl_key = </usr/local/etc/dovecot/ssl/private/mail.amfes.com.key >>> } >>> } >>> >>> Given my mail storage location of /var/mail/%%d/%%n, I have created: >>> /var/mail/mydomain/myname/virtual/newfolder >>> >>> and within that folder created a dovecot-virtual. I created a few >>> like >>> this from the wiki samples - the folder names are visible but no >>> contents. >>> >>> -- >>> Daniel

1 0

EXT4/LVM recommendations for 3TB of mdbox ?
by Nicolas C. 25 Jun '15

25 Jun '15

Hello, Do you have recommendations on EXT4 and LVM options for a 3TB file-system for mdbox? We currently use the mbox format on a XFS with poor performances since the update in v2.1 (Debian). We will switch to EXT4 to have the possibility of shrinking the file-system if needed (which is not possible with XFS), we currently have LVM partitions but with mdbox we will use LVM snapshots to backup the server in a consistent state. So, - any particular options to use with mkfs.ext4 for the creation of the FS ? - do you recommend a «thin» logical volume ? Our storage (IBM Storwize v7000) already have thin provisioning capabilities. The server will be a VMware virtual machine running Debian with RDM LUNs of 500GB. Data blocks will be automatically spread across several RAID disk (SSD, SAS, SATA) by the v7000. The «mdbox_rotate_size» will be configured around 10MB. Thanks, Nicolas C.

3 2

why would replicated to server ask for extra fs permissions?
by lejeczek 24 Jun '15

24 Jun '15

I think I'm near getting a simple replication, but on server which is still "empty" I get: Initialization failed: Namespace '': mkdir(/var/spool/mail/ccnr.biotechnology/nr412/Maildir) failed: Permission denied (euid=1187(nr412) egid=513(Domain Users) missing +w perm: /var/spool/mail, we're not in group 12(mail), dir owned by 0:12 mode=0775 but repl from server runs just fine and their configs are virtually identical. What I missed? many thanks

2 2

is it safe to have two backed used for the same user?
by lejeczek 24 Jun '15

24 Jun '15

hi everybody I wonder if it is safe (and wise) to have two passw-user databases for the same one user. I'm thinking, mail to me via pam mail to me(a)this.domain via ldap whole Maildir would be essentially the same one storage target, I see permissions have to be mangled, available to write for both vmail and actual uid. what do you think? Is it how it's done? regards

2 4

Quota question
by Ralf Hildebrandt 24 Jun '15

24 Jun '15

http://wiki2.dovecot.org/Quota/Configuration says: concat('*:bytes=', quota_limit_bytes) AS quota_rule and concat('*:bytes=', quota_limit_bytes) AS userdb_quota_rule but a generic quota_rule on the same page says: plugin { quota = maildir:User quota quota_rule = *:storage=1G quota_rule2 = Trash:storage=+100M } Are "bytes=" and "storage=" equivalent? http://wiki2.dovecot.org/UserDatabase/ExtraFields also shows "storage=": user_query = SELECT home, uid, gid, \ '*:storage=100M' as quota_rule, mail_plugins, \ 'gz' as `plugin/zlib_save` FROM users WHERE userid = '%u' -- [*] sys4 AG http://sys4.de, +49 (89) 30 90 46 64 Franziskanerstraße 15, 81669 München Sitz der Gesellschaft: München, Amtsgericht München: HRB 199263 Vorstand: Patrick Ben Koetter, Marc Schiffbauer Aufsichtsratsvorsitzender: Florian Kirstein

1 1

Migration from courier-imap to dovecot
by alex 23 Jun '15

23 Jun '15

hello, I search a solution to migrate a courier-impa mail accounts in maildir format to a dovecot mail accounts in sandbox format. The first server is an ubuntu 10.4 with courier-imap in maildir format, the accounts are managed by postfix 2.7.0 with MySQL The second server is an debian 7.8 (wheezy) with dovecot 2.2.13 in sdbox format, the accounts are managed by postfix 2.9.6 with MySQL My request is, how to import and convert the mail accounts ?? cordially, *--* *Alexandre Bagouet*

2 1

Assert test not compatible with s390(x) and ppc64 architectures
by Michal Hlavinka 23 Jun '15

23 Jun '15

Hi, we have found that assert test fails on some architectures: test-net.c:59: Assert failed: net_addr2ip("127.0.0.1", &ip) == 0 && ip.family == AF_INET && ip.u.ip4.s_addr == (127 | (1 << 24)) It seems as bug in test suit as test is expecting IPv4 address in LE format (0x0100007f), but it gets address in BE format(0x7f000001). Patch in attachment should fix this issue. Regards Michal Hlavinka

1 0

passdb pam and args/format
by lejeczek 23 Jun '15

23 Jun '15

I wonder if queries to/via pam are formatable? What I'm thinking I'd like to try is to use pam with users(a)local.domain. And I guess I'd have to loose domain part somehow. many thanks

1 0

a temporary failure
by lejeczek 23 Jun '15

23 Jun '15

dear all I have a postfix relaying to dovecot's lda but "strangely" it does not work, I mean I imaging it's me doing something wrong, yet I cannot figure out what. postfix logs: to=<me(a)my.domain>,orig_to=<root@localhost>, relay=dovecot, delay=39296, delays=39294/2.2/0/0.27, dsn=4.3.0, status=deferred (temporary failure) and dovecot logs no error, despite having debug to yes in couple of places, it shows: auth: Debug: master in: USER 1 me(a)my.domain service=lda auth-worker(25343): Debug: passwd(me(a)my.domain): lookup auth-worker(25343): passwd(me(a)my.domain): unknown user auth: Debug: ldap(me(a)my.domain): user search: base=ou=People,dc=my,dc=domain scope=subtree filter=(&(objectClass=person)(uid=me)) fields= auth: Debug: ldap(me(a)my.domain): result: objectClass=top,top,top,top, ... here goes the whole lot of ldap atrribs, and at the end: unused. For passdb & userdb in the configs I only configure ldap backed, nothing else. Ldap works, I can query it without failling. I believe it's very simple set up but I must be wrong somewhere. pass_filter = (&(objectClass=posixAccount)(uid=%n)) pass_attrs = uid=user=%n,userPassword=password user_attrs = =home=/var/spool/mail/%d/%n,=mail=maildir:/var/spool/mail/%d/%n/Maildir:INDEX=/var/spool/mail/%d/%n:CONTROL=/var/spool/mail/%d/%n user_filter = (&(objectClass=person)(uid=%n)) Any suggestions very appreciated. thanks

5 18

Proxy to more Servers
by Luca Bertoncello 23 Jun '15

23 Jun '15

Hi list! Finally I got the LDAP-Authentication work (it was a problem of the OU-Path... :( ). Now I can authenticate the user against the AD and forwarding the IMAP-Connection to the Exchange Server. Wow! My next problem: we have TWO ADs and TWO Exchange-Servers. The first AD has the users for the first Exchange, and the second AD for the second Exchange. I defined two files so: auth-ldap-OLDAD.conf.ext: passdb { driver = ldap args = /etc/dovecot/dovecot-ldap-OLDAD.conf.ext } userdb { driver = ldap args = /etc/dovecot/dovecot-ldap-OLDAD.conf.ext default_fields = imapc_user=%u imapc_password=%w imapc_ssl=imaps imapc_host=sphinx.company.local imapc_port=993 driver=imap uid=imapproxy gid=imapproxy home=/home/imapproxy } auth-ldap-NEWAD.conf.ext: passdb { driver = ldap args = /etc/dovecot/dovecot-ldap-NEWAD.conf.ext } userdb { driver = ldap args = /etc/dovecot/dovecot-ldap-NEWAD.conf.ext default_fields = imapc_user=%u imapc_password=%w imapc_ssl=imaps imapc_host=exchange01.ad.company.org imapc_port=993 driver=imap uid=imapproxy gid=imapproxy home=/home/imapproxy } Well, the authentication works as expected, but when a user of the second AD/Exchanges tries to log in, after a SUCCESSFULLY authentication can't speak with the new Exchange server... :( In the log of Dovecot I see: Jun 23 15:07:58 proxy01 dovecot: imap(chorris): Error: User initialization failed: Namespace '': Mailbox list driver imapc: missing imapc_host Jun 23 15:07:58 proxy01 dovecot: imap(chorris): Error: Invalid user settings. Refer to server log for more information. Could someone explain me, why the configuration for imapc_host in the second file are ignored? Thanks Luca Bertoncello (lucabert(a)lucabert.de)

1 0

allowing shell users to change passwords
by dave＠661.org 23 Jun '15

23 Jun '15

Does anyone else here have a need to allow shell users to change their imap/pop3 passwords? I came up with a little thing that works similarly to regular passwd(1), dovepasswd, which can be found at https://github.com/DavidGriffith/dovepasswd. It does the job for me and I'd love for other people to take a look and give me some feedback. -- David Griffith dave(a)661.org A: Because it fouls the order in which people normally read text. Q: Why is top-posting such a bad thing? A: Top-posting. Q: What is the most annoying thing in e-mail?

2 1

Problem with LDAP... again...
by Luca Bertoncello 23 Jun '15

23 Jun '15

Hi list! I'm always trying to configure Dovecot to ask our LDAP-Server (AD) in order to authenticate the users. I really don'know what can I do wrong... I configured my Dovecot so: hosts = chimaera.company.local dn = CN=mailproxy,CN=Users,DC=company,DC=local dnpass = SECRET sasl_bind = no tls = no debug_level = -1 auth_bind = yes ldap_version = 3 base = dc=company,dc=local deref = never scope = subtree user_filter = (&(sAMAccountName=%n)(objectClass=user)) pass_attrs = userPassword=password pass_filter = (&(samAccountName=%n)(objectClass=user)) default_pass_scheme = CRYPT If I try to login in, with my login and password, I see with ngrep that Dovecot ask the AD for my data AND GET THEM, then I see: T 10.0.46.4:49204 -> 192.168.168.23:389 [AP] 0p...ck."DC=DomainDnsZones,DC=company,DC=local................4....samAccountName..bertoncello....objectClass..user0. # T 192.168.168.23:389 -> 10.0.46.4:49204 [AP] 0........e................000004DC: LdapErr: DSID-0C0906E8, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, v1db1. This is what I see in Dovecot's log: Jun 23 11:26:43 proxy01 dovecot: auth: Debug: client in: AUTH#0111#011PLAIN#011service=imap#011secured#011session=7z8T/SsZ2AAKADPG#011lip=10.0.46.4#011rip=10.0.51.198#011lport=143#011rport=38104#011resp=<hidden> Jun 23 11:26:43 proxy01 dovecot: auth: Debug: ldap(bertoncello,10.0.51.198,<7z8T/SsZ2AAKADPG>): bind search: base=dc=company,dc=local filter=(&(samAccountName=bertoncello)(objectClass=user)) Jun 23 11:26:43 proxy01 dovecot: auth: Error: ldap_search Jun 23 11:26:43 proxy01 dovecot: auth: Error: put_filter: "(&(samAccountName=bertoncello)(objectClass=user))" Jun 23 11:26:43 proxy01 dovecot: auth: Error: put_filter: AND Jun 23 11:26:43 proxy01 dovecot: auth: Error: put_filter_list "(samAccountName=bertoncello)(objectClass=user)" Jun 23 11:26:43 proxy01 dovecot: auth: Error: put_filter: "(samAccountName=bertoncello)" Jun 23 11:26:43 proxy01 dovecot: auth: Error: put_filter: simple Jun 23 11:26:43 proxy01 dovecot: auth: Error: put_simple_filter: "samAccountName=bertoncello" Jun 23 11:26:43 proxy01 dovecot: auth: Error: put_filter: "(objectClass=user)" Jun 23 11:26:43 proxy01 dovecot: auth: Error: put_filter: simple Jun 23 11:26:43 proxy01 dovecot: auth: Error: put_simple_filter: "objectClass=user" Jun 23 11:26:43 proxy01 dovecot: auth: Error: ldap_build_search_req ATTRS: Jun 23 11:26:43 proxy01 dovecot: auth: Error: ldap_send_initial_request Jun 23 11:26:43 proxy01 dovecot: auth: Error: ldap_send_server_request Jun 23 11:26:43 proxy01 dovecot: auth: Error: ldap_result ld 0x1920bb0 msgid -1 Jun 23 11:26:43 proxy01 dovecot: auth: Error: wait4msg ld 0x1920bb0 msgid -1 (timeout 0 usec) Jun 23 11:26:43 proxy01 dovecot: auth: Error: wait4msg continue ld 0x1920bb0 msgid -1 all 0 Jun 23 11:26:43 proxy01 dovecot: auth: Error: ** ld 0x1920bb0 Connections: Jun 23 11:26:43 proxy01 dovecot: auth: Error: * host: chimaera.company.local port: 389 (default) Jun 23 11:26:43 proxy01 dovecot: auth: Error: refcnt: 2 status: Connected Jun 23 11:26:43 proxy01 dovecot: auth: Error: last used: Tue Jun 23 11:26:43 2015 Jun 23 11:26:43 proxy01 dovecot: auth: Error: Jun 23 11:26:43 proxy01 dovecot: auth: Error: Jun 23 11:26:43 proxy01 dovecot: auth: Error: ** ld 0x1920bb0 Outstanding Requests: Jun 23 11:26:43 proxy01 dovecot: auth: Error: * msgid 2, origid 2, status InProgress Jun 23 11:26:43 proxy01 dovecot: auth: Error: outstanding referrals 0, parent count 0 Jun 23 11:26:43 proxy01 dovecot: auth: Error: ld 0x1920bb0 request count 1 (abandoned 0) Jun 23 11:26:43 proxy01 dovecot: auth: Error: ** ld 0x1920bb0 Response Queue: Jun 23 11:26:43 proxy01 dovecot: auth: Error: Empty Jun 23 11:26:43 proxy01 dovecot: auth: Error: ld 0x1920bb0 response count 0 Jun 23 11:26:43 proxy01 dovecot: auth: Error: ldap_chkResponseList ld 0x1920bb0 msgid -1 all 0 Jun 23 11:26:43 proxy01 dovecot: auth: Error: ldap_chkResponseList returns ld 0x1920bb0 NULL Jun 23 11:26:43 proxy01 dovecot: auth: Error: ldap_int_select Jun 23 11:26:43 proxy01 dovecot: auth: Error: read1msg: ld 0x1920bb0 msgid -1 all 0 Jun 23 11:26:43 proxy01 dovecot: auth: Error: ber_get_next failed. Jun 23 11:26:43 proxy01 dovecot: auth: Error: ldap_result ld 0x1920bb0 msgid -1 Jun 23 11:26:43 proxy01 dovecot: auth: Error: wait4msg ld 0x1920bb0 msgid -1 (timeout 0 usec) Jun 23 11:26:43 proxy01 dovecot: auth: Error: wait4msg continue ld 0x1920bb0 msgid -1 all 0 Jun 23 11:26:43 proxy01 dovecot: auth: Error: ** ld 0x1920bb0 Connections: Jun 23 11:26:43 proxy01 dovecot: auth: Error: * host: chimaera.company.local port: 389 (default) Jun 23 11:26:43 proxy01 dovecot: auth: Error: refcnt: 2 status: Connected Jun 23 11:26:43 proxy01 dovecot: auth: Error: last used: Tue Jun 23 11:26:43 2015 Jun 23 11:26:43 proxy01 dovecot: auth: Error: Jun 23 11:26:43 proxy01 dovecot: auth: Error: Jun 23 11:26:43 proxy01 dovecot: auth: Error: ** ld 0x1920bb0 Outstanding Requests: Jun 23 11:26:43 proxy01 dovecot: auth: Error: * msgid 2, origid 2, status InProgress Jun 23 11:26:43 proxy01 dovecot: auth: Error: outstanding referrals 0, parent count 0 Jun 23 11:26:43 proxy01 dovecot: auth: Error: ld 0x1920bb0 request count 1 (abandoned 0) Jun 23 11:26:43 proxy01 dovecot: auth: Error: ** ld 0x1920bb0 Response Queue: Jun 23 11:26:43 proxy01 dovecot: auth: Error: Empty Jun 23 11:26:43 proxy01 dovecot: auth: Error: ld 0x1920bb0 response count 0 Jun 23 11:26:43 proxy01 dovecot: auth: Error: ldap_chkResponseList ld 0x1920bb0 msgid -1 all 0 Jun 23 11:26:43 proxy01 dovecot: auth: Error: ldap_chkResponseList returns ld 0x1920bb0 NULL Jun 23 11:26:43 proxy01 dovecot: auth: Error: ldap_int_select Jun 23 11:26:43 proxy01 dovecot: auth: Error: read1msg: ld 0x1920bb0 msgid -1 all 0 Jun 23 11:26:43 proxy01 dovecot: auth: Error: read1msg: ld 0x1920bb0 msgid 2 message type search-entry Jun 23 11:26:43 proxy01 dovecot: auth: Error: ldap_result ld 0x1920bb0 msgid -1 Jun 23 11:26:43 proxy01 dovecot: auth: Error: wait4msg ld 0x1920bb0 msgid -1 (timeout 0 usec) Jun 23 11:26:43 proxy01 dovecot: auth: Error: wait4msg continue ld 0x1920bb0 msgid -1 all 0 Jun 23 11:26:43 proxy01 dovecot: auth: Error: ** ld 0x1920bb0 Connections: Jun 23 11:26:43 proxy01 dovecot: auth: Error: * host: chimaera.company.local port: 389 (default) Jun 23 11:26:43 proxy01 dovecot: auth: Error: refcnt: 2 status: Connected Jun 23 11:26:43 proxy01 dovecot: auth: Error: last used: Tue Jun 23 11:26:43 2015 Jun 23 11:26:43 proxy01 dovecot: auth: Error: Jun 23 11:26:43 proxy01 dovecot: auth: Error: Jun 23 11:26:43 proxy01 dovecot: auth: Error: ** ld 0x1920bb0 Outstanding Requests: Jun 23 11:26:43 proxy01 dovecot: auth: Error: * msgid 2, origid 2, status InProgress Jun 23 11:26:43 proxy01 dovecot: auth: Error: outstanding referrals 0, parent count 0 Jun 23 11:26:43 proxy01 dovecot: auth: Error: ld 0x1920bb0 request count 1 (abandoned 0) Jun 23 11:26:43 proxy01 dovecot: auth: Error: ** ld 0x1920bb0 Response Queue: Jun 23 11:26:43 proxy01 dovecot: auth: Error: Empty Jun 23 11:26:43 proxy01 dovecot: auth: Error: ld 0x1920bb0 response count 0 Jun 23 11:26:43 proxy01 dovecot: auth: Error: ldap_chkResponseList ld 0x1920bb0 msgid -1 all 0 Jun 23 11:26:43 proxy01 dovecot: auth: Error: ldap_chkResponseList returns ld 0x1920bb0 NULL Jun 23 11:26:43 proxy01 dovecot: auth: Error: ldap_int_select Jun 23 11:26:43 proxy01 dovecot: auth: Error: read1msg: ld 0x1920bb0 msgid -1 all 0 Jun 23 11:26:43 proxy01 dovecot: auth: Error: read1msg: ld 0x1920bb0 msgid 2 message type search-reference Jun 23 11:26:43 proxy01 dovecot: auth: Error: ldap_chase_v3referrals Jun 23 11:26:43 proxy01 dovecot: auth: Error: ldap_url_parse_ext(ldap://DomainDnsZones.company.local/DC=DomainDnsZones,DC=company,DC=local) Jun 23 11:26:43 proxy01 dovecot: auth: Error: re_encode_request: new msgid 3, new dn <DC=DomainDnsZones,DC=company,DC=local> Jun 23 11:26:43 proxy01 dovecot: auth: Error: re_encode_request new request is: Jun 23 11:26:43 proxy01 dovecot: auth: Error: ber_dump: buf=0x1934920 ptr=0x1934992 end=0x19358fc len=114 Jun 23 11:26:43 proxy01 dovecot: auth: Error: 0000: 65 72 30 00 65 72 30 00 00 00 00 00 00 00 00 00 er0.er0......... Jun 23 11:26:43 proxy01 dovecot: auth: Error: 0010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ Jun 23 11:26:43 proxy01 dovecot: auth: Error: 0020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ Jun 23 11:26:43 proxy01 dovecot: auth: Error: 0030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ Jun 23 11:26:43 proxy01 dovecot: auth: Error: 0040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ Jun 23 11:26:43 proxy01 dovecot: auth: Error: 0050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ Jun 23 11:26:43 proxy01 dovecot: auth: Error: 0060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ Jun 23 11:26:43 proxy01 dovecot: auth: Error: 0070: 00 00 .. Jun 23 11:26:43 proxy01 dovecot: auth: Error: ldap_chase_v3referral: msgid 2, url "ldap://DomainDnsZones.company.local/DC=DomainDnsZones,DC=company,DC=local" Jun 23 11:26:43 proxy01 dovecot: auth: Error: ldap_send_server_request Jun 23 11:26:43 proxy01 dovecot: auth: Error: ldap_new_connection 0 1 1 Jun 23 11:26:43 proxy01 dovecot: auth: Error: ldap_int_open_connection Jun 23 11:26:43 proxy01 dovecot: auth: Error: ldap_connect_to_host: TCP DomainDnsZones.company.local:389 Jun 23 11:26:43 proxy01 dovecot: auth: Error: ldap_new_socket: 20 Jun 23 11:26:43 proxy01 dovecot: auth: Error: ldap_prepare_socket: 20 Jun 23 11:26:43 proxy01 dovecot: auth: Error: ldap_connect_to_host: Trying 192.168.168.26:389 Jun 23 11:26:43 proxy01 dovecot: auth: Error: ldap_pvt_connect: fd: 20 tm: -1 async: 0 Jun 23 11:26:43 proxy01 dovecot: auth: Error: attempting to connect: Jun 23 11:26:43 proxy01 dovecot: auth: Error: connect errno: 111 Jun 23 11:26:43 proxy01 dovecot: auth: Error: ldap_close_socket: 20 Jun 23 11:26:43 proxy01 dovecot: auth: Error: ldap_new_socket: 20 Jun 23 11:26:43 proxy01 dovecot: auth: Error: ldap_prepare_socket: 20 Jun 23 11:26:43 proxy01 dovecot: auth: Error: ldap_connect_to_host: Trying 192.168.168.23:389 Jun 23 11:26:43 proxy01 dovecot: auth: Error: ldap_pvt_connect: fd: 20 tm: -1 async: 0 Jun 23 11:26:43 proxy01 dovecot: auth: Error: attempting to connect: Jun 23 11:26:43 proxy01 dovecot: auth: Error: connect success Jun 23 11:26:43 proxy01 dovecot: auth: Error: anonymous rebind via ldap_sasl_bind("") Jun 23 11:26:43 proxy01 dovecot: auth: Error: ldap_sasl_bind Jun 23 11:26:43 proxy01 dovecot: auth: Error: ldap_send_initial_request Jun 23 11:26:43 proxy01 dovecot: auth: Error: ldap_send_server_request Jun 23 11:26:43 proxy01 dovecot: auth: Error: ldap_result ld 0x1920bb0 msgid 4 Jun 23 11:26:43 proxy01 dovecot: auth: Error: wait4msg ld 0x1920bb0 msgid 4 (timeout 100000 usec) Jun 23 11:26:43 proxy01 dovecot: auth: Error: wait4msg continue ld 0x1920bb0 msgid 4 all 1 Jun 23 11:26:43 proxy01 dovecot: auth: Error: ** ld 0x1920bb0 Connections: Jun 23 11:26:43 proxy01 dovecot: auth: Error: * host: DomainDnsZones.company.local port: 0 Jun 23 11:26:43 proxy01 dovecot: auth: Error: refcnt: 2 status: Connected Jun 23 11:26:43 proxy01 dovecot: auth: Error: last used: Tue Jun 23 11:26:43 2015 Jun 23 11:26:43 proxy01 dovecot: auth: Error: rebind in progress Jun 23 11:26:43 proxy01 dovecot: auth: Error: queue is empty Jun 23 11:26:43 proxy01 dovecot: auth: Error: Jun 23 11:26:43 proxy01 dovecot: auth: Error: * host: chimaera.company.local port: 389 (default) Jun 23 11:26:43 proxy01 dovecot: auth: Error: refcnt: 3 status: Connected Jun 23 11:26:43 proxy01 dovecot: auth: Error: last used: Tue Jun 23 11:26:43 2015 Jun 23 11:26:43 proxy01 dovecot: auth: Error: Jun 23 11:26:43 proxy01 dovecot: auth: Error: Jun 23 11:26:43 proxy01 dovecot: auth: Error: ** ld 0x1920bb0 Outstanding Requests: Jun 23 11:26:43 proxy01 dovecot: auth: Error: * msgid 4, origid 4, status InProgress Jun 23 11:26:43 proxy01 dovecot: auth: Error: outstanding referrals 0, parent count 0 Jun 23 11:26:43 proxy01 dovecot: auth: Error: * msgid 2, origid 2, status InProgress Jun 23 11:26:43 proxy01 dovecot: auth: Error: outstanding referrals 1, parent count 0 Jun 23 11:26:43 proxy01 dovecot: auth: Error: ld 0x1920bb0 request count 2 (abandoned 0) Jun 23 11:26:43 proxy01 dovecot: auth: Error: ** ld 0x1920bb0 Response Queue: Jun 23 11:26:43 proxy01 dovecot: auth: Error: Empty Jun 23 11:26:43 proxy01 dovecot: auth: Error: ld 0x1920bb0 response count 0 Jun 23 11:26:43 proxy01 dovecot: auth: Error: ldap_chkResponseList ld 0x1920bb0 msgid 4 all 1 Jun 23 11:26:43 proxy01 dovecot: auth: Error: ldap_chkResponseList returns ld 0x1920bb0 NULL Jun 23 11:26:43 proxy01 dovecot: auth: Error: ldap_int_select Jun 23 11:26:43 proxy01 dovecot: auth: Error: read1msg: ld 0x1920bb0 msgid 4 all 1 Jun 23 11:26:43 proxy01 dovecot: auth: Error: read1msg: ld 0x1920bb0 msgid 2 message type search-reference Jun 23 11:26:43 proxy01 dovecot: auth: Error: ldap_chase_v3referrals Jun 23 11:26:43 proxy01 dovecot: auth: Error: ldap_url_parse_ext(ldap://ForestDnsZones.company.local/DC=ForestDnsZones,DC=company,DC=local) Jun 23 11:26:43 proxy01 dovecot: auth: Error: re_encode_request: new msgid 5, new dn <DC=ForestDnsZones,DC=company,DC=local> Jun 23 11:26:43 proxy01 dovecot: auth: Error: re_encode_request new request is: Jun 23 11:26:43 proxy01 dovecot: auth: Error: ber_dump: buf=0x1936cc0 ptr=0x1936d32 end=0x1937c9c len=114 Jun 23 11:26:43 proxy01 dovecot: auth: Error: 0000: 65 72 30 00 65 72 30 00 00 00 00 00 00 00 00 00 er0.er0......... Jun 23 11:26:43 proxy01 dovecot: auth: Error: 0010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ Jun 23 11:26:43 proxy01 dovecot: auth: Error: 0020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ Jun 23 11:26:43 proxy01 dovecot: auth: Error: 0030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ Jun 23 11:26:43 proxy01 dovecot: auth: Error: 0040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ Jun 23 11:26:43 proxy01 dovecot: auth: Error: 0050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ Jun 23 11:26:43 proxy01 dovecot: auth: Error: 0060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ Jun 23 11:26:43 proxy01 dovecot: auth: Error: 0070: 00 00 .. Jun 23 11:26:43 proxy01 dovecot: auth: Error: ldap_chase_v3referral: msgid 2, url "ldap://ForestDnsZones.company.local/DC=ForestDnsZones,DC=company,DC=local" Jun 23 11:26:43 proxy01 dovecot: auth: Error: ldap_send_server_request Jun 23 11:26:43 proxy01 dovecot: auth: Error: ldap_new_connection 0 1 1 Jun 23 11:26:43 proxy01 dovecot: auth: Error: ldap_int_open_connection Jun 23 11:26:43 proxy01 dovecot: auth: Error: ldap_connect_to_host: TCP ForestDnsZones.company.local:389 Jun 23 11:26:43 proxy01 dovecot: auth: Error: ldap_new_socket: 21 Jun 23 11:26:43 proxy01 dovecot: auth: Error: ldap_prepare_socket: 21 Jun 23 11:26:43 proxy01 dovecot: auth: Error: ldap_connect_to_host: Trying 192.168.168.18:389 Jun 23 11:26:43 proxy01 dovecot: auth: Error: ldap_pvt_connect: fd: 21 tm: -1 async: 0 Jun 23 11:26:43 proxy01 dovecot: auth: Error: attempting to connect: Jun 23 11:26:43 proxy01 dovecot: auth: Error: connect success Jun 23 11:26:43 proxy01 dovecot: auth: Error: anonymous rebind via ldap_sasl_bind("") Jun 23 11:26:43 proxy01 dovecot: auth: Error: ldap_sasl_bind Jun 23 11:26:43 proxy01 dovecot: auth: Error: ldap_send_initial_request Jun 23 11:26:43 proxy01 dovecot: auth: Error: ldap_send_server_request Jun 23 11:26:43 proxy01 dovecot: auth: Error: ldap_result ld 0x1920bb0 msgid 6 Jun 23 11:26:43 proxy01 dovecot: auth: Error: wait4msg ld 0x1920bb0 msgid 6 (timeout 100000 usec) Jun 23 11:26:43 proxy01 dovecot: auth: Error: wait4msg continue ld 0x1920bb0 msgid 6 all 1 Jun 23 11:26:43 proxy01 dovecot: auth: Error: ** ld 0x1920bb0 Connections: Jun 23 11:26:43 proxy01 dovecot: auth: Error: * host: ForestDnsZones.company.local port: 0 Jun 23 11:26:43 proxy01 dovecot: auth: Error: refcnt: 2 status: Connected Jun 23 11:26:43 proxy01 dovecot: auth: Error: last used: Tue Jun 23 11:26:43 2015 Jun 23 11:26:43 proxy01 dovecot: auth: Error: rebind in progress Jun 23 11:26:43 proxy01 dovecot: auth: Error: queue is empty Jun 23 11:26:43 proxy01 dovecot: auth: Error: Jun 23 11:26:43 proxy01 dovecot: auth: Error: * host: DomainDnsZones.company.local port: 0 Jun 23 11:26:43 proxy01 dovecot: auth: Error: refcnt: 2 status: Connected Jun 23 11:26:43 proxy01 dovecot: auth: Error: last used: Tue Jun 23 11:26:43 2015 Jun 23 11:26:43 proxy01 dovecot: auth: Error: rebind in progress Jun 23 11:26:43 proxy01 dovecot: auth: Error: queue is empty Jun 23 11:26:43 proxy01 dovecot: auth: Error: Jun 23 11:26:43 proxy01 dovecot: auth: Error: * host: chimaera.company.local port: 389 (default) Jun 23 11:26:43 proxy01 dovecot: auth: Error: refcnt: 4 status: Connected Jun 23 11:26:43 proxy01 dovecot: auth: Error: last used: Tue Jun 23 11:26:43 2015 Jun 23 11:26:43 proxy01 dovecot: auth: Error: Jun 23 11:26:43 proxy01 dovecot: auth: Error: Jun 23 11:26:43 proxy01 dovecot: auth: Error: ** ld 0x1920bb0 Outstanding Requests: Jun 23 11:26:43 proxy01 dovecot: auth: Error: * msgid 6, origid 6, status InProgress Jun 23 11:26:43 proxy01 dovecot: auth: Error: outstanding referrals 0, parent count 0 Jun 23 11:26:43 proxy01 dovecot: auth: Error: * msgid 4, origid 4, status InProgress Jun 23 11:26:43 proxy01 dovecot: auth: Error: outstanding referrals 0, parent count 0 Jun 23 11:26:43 proxy01 dovecot: auth: Error: * msgid 2, origid 2, status InProgress Jun 23 11:26:43 proxy01 dovecot: auth: Error: outstanding referrals 2, parent count 0 Jun 23 11:26:43 proxy01 dovecot: auth: Error: ld 0x1920bb0 request count 3 (abandoned 0) Jun 23 11:26:43 proxy01 dovecot: auth: Error: ** ld 0x1920bb0 Response Queue: I can't understand why it happens... I can't understand why Dovecot says anonymous rebind via ldap_sasl_bind(""), too... Thanks for your help! Luca Bertoncello

1 0

Problem with LDAP... again...
by Luca Bertoncello 23 Jun '15

23 Jun '15

Hi list! I'm always trying to configure Dovecot to ask our LDAP-Server (AD) in order to authenticate the users. I really don'know what can I do wrong... I configured my Dovecot so: hosts = chimaera.company.local dn = CN=mailproxy,CN=Users,DC=company,DC=local dnpass = SECRET sasl_bind = no tls = no debug_level = -1 auth_bind = yes ldap_version = 3 base = dc=company,dc=local deref = never scope = subtree user_filter = (&(sAMAccountName=%n)(objectClass=user)) pass_attrs = userPassword=password pass_filter = (&(samAccountName=%n)(objectClass=user)) default_pass_scheme = CRYPT If I try to login in, with my login and password, I see with ngrep that Dovecot ask the AD for my data AND GET THEM, then I see: T 10.0.46.4:49204 -> 192.168.168.23:389 [AP] 0p...ck."DC=DomainDnsZones,DC=company,DC=local................4....samAccountName..bertoncello....objectClass..user0. # T 192.168.168.23:389 -> 10.0.46.4:49204 [AP] 0........e................000004DC: LdapErr: DSID-0C0906E8, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, v1db1. This is what I see in Dovecot's log: -- Dipl. Inf. Luca Bertoncello Hartigstraße 12 01127 Dresden Germany Tel: +49 351 4977290 Mobile: +49 177 3218409 Fax: +49 351 4977291 http://www.lucabert.de/ GPG-Key: http://www.lucabert.de/lucabert.asc E-Mail: lucabert(a)lucabert.de

1 0

LDAP authentication
by Luca Bertoncello 23 Jun '15

23 Jun '15

Hi again I'm trying to authenticate a user against an LDAP Server (well, our AD, but it can LDAP). This is my configuration: hosts = my.server.local auth_bind = yes ldap_version = 3 base = CN=Person,CN=Schema,CN=Configuration,DC=company,DC=local scope = subtree user_attrs = \ =home=/home/imapproxy/%u, \ =mail=maildir:/home/imapproxy/%u pass_attrs = uid=%u, userPassword=%w pass_filter = (&(objectClass=user)(sAMAccountName=%u)) auth_bind_userdn = company\%u If I try to login on the LDAP-Server using ldapsearch it works, but with Dovecot not... I see this in my log: Jun 22 16:14:08 proxy01 dovecot: auth: Debug: client in: AUTH#0111#011PLAIN#011service=imap#011secured#011session=+agW4xsZ4gAKADPG#011lip=10.0.46.4#011rip=10.0.51.198#011lport=143#011rport=34018#011resp=<hidden> Jun 22 16:14:08 proxy01 dovecot: auth: Debug: client passdb out: OK#0111#011user=bertoncello Jun 22 16:14:08 proxy01 dovecot: auth: Debug: master in: REQUEST#0111586495489#01117122#0111#01161785e0770d6c48e7316ab484bc2778c#011session_pid=17125#011request_auth_token Jun 22 16:14:08 proxy01 dovecot: auth: Debug: ldap(bertoncello,10.0.51.198,<+agW4xsZ4gAKADPG>): user search: base=CN=Person,CN=Schema,CN=Configuration,DC=company,DC=local scope=subtree filter=(&(objectClass=posixAccount)(uid=bertoncello)) fields= Jun 22 16:14:08 proxy01 dovecot: auth: Error: ldap(bertoncello,10.0.51.198,<+agW4xsZ4gAKADPG>): ldap_search(base=CN=Person,CN=Schema,CN=Configuration,DC=company,DC=local filter=(&(objectClass=posixAccount)(uid=bertoncello))) failed: Operations error Jun 22 16:14:08 proxy01 dovecot: auth: Debug: master userdb out: FAIL#0111586495489 Jun 22 16:14:08 proxy01 dovecot: imap: Error: Internal auth failure (client-pid=17122 client-id=1) Jun 22 16:14:08 proxy01 dovecot: imap-login: Internal login failure (pid=17122 id=1) (internal failure, 1 successful auths): user=<bertoncello>, method=PLAIN, rip=10.0.51.198, lip=10.0.46.4, mpid=17125, TLS, session=<+agW4xsZ4gAKADPG> and if I sniff with ngrep the comunication with the AD I see: #### T 10.0.46.4:58761 -> 192.168.168.23:389 [AP] 0....`........ # T 192.168.168.23:389 -> 10.0.46.4:58761 [AP] 0........a............ ## T 10.0.46.4:58761 -> 192.168.168.23:389 [AP] 0#...`......company\bertoncello..secret # T 192.168.168.23:389 -> 10.0.46.4:58761 [AP] 0........a............ ## T 10.0.46.4:58761 -> 192.168.168.23:389 [AP] 0....`........ # T 192.168.168.23:389 -> 10.0.46.4:58761 [AP] 0........a............ # T 10.0.46.4:58761 -> 192.168.168.23:389 [AP] 0.....c{.5CN=Person,CN=Schema,CN=Configuration,DC=company,DC=local................1....objectClass..posixAccount....uid..bertoncello0. # T 192.168.168.23:389 -> 10.0.46.4:58761 [AP] 0........e................000004DC: LdapErr: DSID-0C0906E8, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, v1db1. ## T 10.0.46.4:58761 -> 192.168.168.23:389 [AP] 0....B. ### T 192.168.168.23:389 -> 10.0.46.4:58761 [AR] .. and I can't understand why: 1) I read "objectClass..posixAccount" 2) The authentication does not work... Thanks for your help! Luca Bertoncello (lucabert(a)lucabert.de)

4 5

Re: Dovecot 2.2.16: disappearing messages, mismatched summaries, duplicated messages, excessive full re-downloads
by Joseph Tam 22 Jun '15

22 Jun '15

David Gessel writes: > As far as anyone has been able to determine, all artifacts are > resolved. I believe it is fair to say "SOLVED." As I often start > trying to solve problems by searching the list archives, I'll append my > description of the artifacts as googlebait to the bottom of this > message. To say that disabling the use of index files solved your problems is akin to saying amputating your foot solved your bunion problems. Ordinarily, indices ought to be a benefit -- it will help with I/O bottlenecks when mailboxes or number of users get huge. I can't tell from your list of problems whether they are the result of one or many causes, but fixing the index consistency problem would go a long way toward clearing up most of your problems. If INDEX=MEMORY is working for you and you don't see performance degradation, there's no harm in using it, but in my opinion, it may benefit you in the future to get to the bottom of the indexing problem rather than to lop it off altogether. > I am curious if setting INDEX=MEMORY "disables the index completely" as > per http://wiki2.dovecot.org/MailLocation: "If you really want to, you > can also disable the index files completely by appending > :INDEX=MEMORY." Or if there are index files in memory as one might > assume taking the directive literally, and if so, if these are > functionally equivalent to, say, Courier IMAP's caching model. The latter I believe. The important words in the wiki sentence is "index files", not "indexing". Dovecot is still indexing, exept that it builds it from scratch each and every time a worker process accesses a mailbox, so incurs a fixed overhead that cannot be used for the next session. Joseph Tam <jtam.home(a)gmail.com>

1 0

Re: Virtual Mailboxes
by dmiller＠amfes.com 22 Jun '15

22 Jun '15

Any ideas on what I need to check or should post to help find the problem? -- Daniel On 2015-06-20 14:50, dmiller(a)amfes.com wrote: > The first bonehead maneuver seems to be: > location = virtual:/var/mail/%%d/%%n/mdbox/virtual > I'm thinking it should be: > location = virtual:/var/mail/%%d/%%n/mdbox/mailboxes/virtual > > But...it didn't seem to make a difference. And if I have the > "virtual" folder tree under a location other than > "/var/mail/domain/user/mdbox/mailboxes" no names appear - so I think I > have the files in the right place. Any ideas? > > -- > Daniel > > > On 2015-06-20 14:34, dmiller(a)amfes.com wrote: >> >> Having some trouble with my first attempt at virtual mailboxes. I've >> enabled the plugin in 10-mail.conf, added a virtual namespace, and >> created the dovecot-virtual files in the folders. >> >> I see the folder names in the list when I refresh the folders >> available for subscription - but the folders cannot be subscribed to >> and I can't view their contents. What obvious mistake did I make? >> >> doveconf -n: >> auth_cache_size = 4 k >> auth_mechanisms = plain login >> default_login_user = nobody >> default_vsz_limit = 1 G >> dict { >> acl = mysql:/usr/local/etc/dovecot/dovecot-dict-sql.conf.ext >> } >> disable_plaintext_auth = no >> listen = * >> mail_attachment_dir = /var/mail/attachments >> mail_plugins = fts fts_solr acl zlib virtual >> mail_shared_explicit_inbox = yes >> managesieve_notify_capability = mailto >> managesieve_sieve_capability = fileinto reject envelope >> encoded-character vacation subaddress comparator-i;ascii-numeric >> relational regex imap4flags copy include variables body enotify >> environment mailbox date index ihave duplicate >> mdbox_rotate_interval = 1 days >> mdbox_rotate_size = 32 M >> namespace { >> hidden = no >> inbox = yes >> list = yes >> location = >> prefix = >> separator = / >> subscriptions = yes >> type = private >> } >> namespace { >> list = children >> location = mdbox:/var/mail/%%d/%%n/mdbox >> prefix = shared/%%n/ >> separator = / >> subscriptions = no >> type = shared >> } >> namespace { >> location = virtual:/var/mail/%%d/%%n/mdbox/virtual >> prefix = virtual/ >> separator = / >> } >> passdb { >> args = /usr/local/etc/dovecot/dovecot-ldap.conf >> driver = ldap >> } >> plugin { >> acl = vfile:/usr/local/etc/dovecot/global-acls:cache_secs=300 >> acl_shared_dict = proxy::acl >> fts = solr >> fts_autoindex = yes >> fts_solr = break-imap-search url=http://solr.amfes.lan:8983/solr/ >> sieve = ~/.dovecot.sieve >> sieve_dir = ~/sieve >> } >> protocols = imap lmtp sieve >> service auth { >> unix_listener /var/spool/postfix/private/auth { >> group = postfix >> mode = 0660 >> user = postfix >> } >> unix_listener auth-userdb { >> group = mail >> mode = 0600 >> user = vmail >> } >> } >> service dict { >> unix_listener dict { >> group = mail >> mode = 0660 >> user = vmail >> } >> } >> service imap-login { >> process_limit = 200 >> process_min_avail = 10 >> service_count = 1 >> } >> service lmtp { >> process_min_avail = 5 >> unix_listener /var/spool/postfix/private/dovecot-lmtp { >> group = mail >> mode = 0666 >> user = vmail >> } >> } >> service managesieve-login { >> inet_listener sieve { >> port = 4190 >> } >> inet_listener sieve_deprecated { >> port = 2000 >> } >> process_min_avail = 0 >> service_count = 1 >> } >> ssl_cert = </usr/local/etc/dovecot/ssl/certs/mail.amfes.com.crt >> ssl_key = </usr/local/etc/dovecot/ssl/private/mail.amfes.com.key >> userdb { >> driver = prefetch >> } >> userdb { >> args = /usr/local/etc/dovecot/dovecot-ldap.conf >> driver = ldap >> } >> verbose_proctitle = yes >> protocol lmtp { >> mail_plugins = fts fts_solr acl zlib virtual sieve >> } >> protocol lda { >> mail_plugins = fts fts_solr acl zlib virtual sieve >> } >> protocol imap { >> imap_client_workarounds = tb-extra-mailbox-sep >> imap_idle_notify_interval = 29 mins >> mail_max_userip_connections = 50 >> mail_plugins = fts fts_solr acl zlib virtual imap_acl >> } >> local 192.168.0.2 { >> protocol imap { >> ssl_cert = </usr/local/etc/dovecot/ssl/certs/mail.amfes.com.crt >> ssl_key = </usr/local/etc/dovecot/ssl/private/mail.amfes.com.key >> } >> } >> >> Given my mail storage location of /var/mail/%%d/%%n, I have created: >> /var/mail/mydomain/myname/virtual/newfolder >> >> and within that folder created a dovecot-virtual. I created a few like >> this from the wiki samples - the folder names are visible but no >> contents. >> >> -- >> Daniel

1 0

Dovecot as Proxy for __MORE__ Exchange-Servers
by Luca Bertoncello 22 Jun '15

22 Jun '15

Hi list! I'm trying to configure Dovecot 2.2.18 to act as proxy. Dovecot has to authentificate the users against an LDAP-Server (AD) and then act as IMAP-Proxy to an Exchange Server. Now the problem is, that we have TWO Exchange servers (and two ADs, too). How can I say to Dovecot that it has to search for the user in the first AD (and if found proxy to the first Exchange server) and if the user was not found, to search in the second AD (and if found proxy to the second Exchange server)? Thanks a lot Luca Bertoncello (lucabert(a)lucabert.de)

1 0