- dovecot - dovecot.org

ot: accepting self certs into win pc?
by voytek＠sbt.net.au 24 Jun '14

24 Jun '14

few month ago, I've got a new Dovecot/Postfix server with self issued certificate (like the previous server), transferred users, all went well EXCEPT for one user on Win/Outlook (or Outlook Express) who tells me his new PC 'doesn't want to accept certificate' (sorry, I'm short on exact details at this time) I need to get it sorted out, I expect it 'should just work' like it did for other users, BUT, before I start looking, trying to 'educate myself' better if any one has any pointers, dos or don't regarding win email clients with self certified server, pls point me that way is using IE with www.dom.com/mycert.crt good point to start ? (after copying mycer.crt to web linked directory first?) thanks, V

7 17

Wheezy Dovecot workarounds
by Steve Litt 24 Jun '14

24 Jun '14

Hi all, In switching from Ubuntu to Debian Wheezy (7.5 64bit, network install), I'm finding some surprises in getting Dovecot to work. PROBLEM: As installed, the package manager doesn't give you the dovecot executable. WORKAROUND: To install the dovecot executable, you need to follow these instructions: http://wiki2.dovecot.org/HowTo/DebianStable PROBLEM: Even when you install Dovecot, it doesn't work, as evidenced by the inability of a local email client to talk to it. Further elements of the symptom are that nmap -A -T4 LocalIPAddress, whether LocalIPAddress is the IP of eth0, or 127.0.0.1, fails to find any open ports. Telnet can't operate dovecot at port 143, and openssl can't operate it at 993. However, bizarrly, executing these same commands on a remote machine into the original machine (including accessing the machine's Dovecot from an email client) work perfectly. WORKAROUND To "solve" this problem, do the following raindance as root: ifdown lo ifup lo After the raindance, local access to Dovecot works perfectly, and all nmap commands perform as expected. LOL, hey man, don't shoot me, I'm just the messenger. SteveT Steve Litt * http://www.troubleshooters.com/ Troubleshooting Training * Human Performance

4 3

Mangesieve security question
by Vijay Rajah 24 Jun '14

24 Jun '14

Hello, I have a dovecot 2.2.6 on a Linux platform. I have configured manageseive extension. I have opened the manageseive port (4190) to entire world. (since I need my thunderbird and other clients to create seive scripts). I just wanted to know if it is ok to open that port to everyone, and get some feedback on some security measures specific to manageseive. -Thanks in advance Vijay PS: I have taken reasonable server hardening measures. This question is specific to manageseive.

2 1

Wishlist: add a variable %{x509} expanding to the client cert in Dovecot-auth
by Guilhem Moulin 24 Jun '14

24 Jun '14

Hi there, As of Dovecot 2.2.9, it's possible to enable passwordless authentication using client certificates [1]: ssl_ca = </etc/ssl/ca.pem ssl_verify_client_cert = yes auth_ssl_username_from_cert = yes (Password checking can be bypassed by returning the extra fields ‘password= nopassword’ in the passdb when the variable ‘%k’ expands to "valid".) However this requires the server admin to set up a PKI. Having a variable %{x509} expanding to the X.509 client cert in Dovecot-auth would remove such hassle and instead provide a way to manage authorized clients in the fashion of OpenSSH's ‘authorized_keys’. Postfix has a similar configuration option: relay_clientcerts [2]. There, the keys for the lookup table can be either client cert fingerprints or public key fingerprints (the digest algorithm can be configured with smtpd_tls_fingerprint_digest). I can't see why %{x509} should digest the certificate and not merely PEM-encode it, but having another %{pubkey} variable expanding to the (PEM-encoded) cert's SubjectPublicKeyInfo block would surely be useful :-) I wonder if there are other folks interested in having the client cert available in the passdb. Thanks, cheers, -- Guilhem. [1] http://wiki2.dovecot.org/SSL/DovecotConfiguration#Client_certificate_verifi… [2] http://www.postfix.org/postconf.5.html#relay_clientcerts

1 0

ACL group-override question
by Peter Chiochetti 23 Jun '14

23 Jun '14

Trying to get ACLs working, very basic setup: Virtual users are put into different acl_group via passdb. > u:{PLAIN}B::::::userdb_acl_groups=g The global acl file restricts what they can do. > * group-override=g > * group=g lr Shouldn't this mean, that the group rights override the user rights? The effect that I see though is, that the user "u" then may not do anything, not even lookup and read. The wiki text is not fully clear to me: It tells about disabling access fully (probably by specifying a non-existent group?). But this can only be one way to use group_override… -- peter

1 2

Dovecot authentication against active directory
by Tobias Dummert 23 Jun '14

23 Jun '14

Hello, i´ve got a problem with the dovecot authentication against active directory. I´m using dovecot 2.0.19 and windows server 2008 R2. When I try to login via telnet I get the following error message: a NO [AUTHENTICATIONFAILED] Authentication failed. My dovecot configuration: # 2.0.19: /etc/dovecot/dovecot.conf # OS: Linux 3.2.0-60-generic x86_64 Ubuntu 12.04.4 LTS ext4 auth_mechanisms = plain login auth_username_format = %Lu disable_plaintext_auth = no first_valid_gid = 1001 first_valid_uid = 1001 last_valid_gid = 1001 last_valid_uid = 1001 log_path = /var/log/dovecot.log mail_location = maildir:/srv/mail/%u passdb { args = /etc/dovecot/dovecot-ldap.conf driver = ldap } protocols = imap ssl = no syslog_facility = local7 userdb { args = /etc/dovecot/dovecot-ldap.conf driver = ldap } valid_chroot_dirs = /srv/mail My dovecot-ldap.conf: hosts = ************** dn = CN=*****,OU=*****,OU=*****,OU=*****,DC=******,DC=*****,DC=de dnpass = **************** tls = no debug_level = -1 ldap_version = 2 base = OU=*****,DC=*****,DC=*****,DC=de deref = never scope = subtree user_attrs = sAMAccountName=home user_filter = (&(ObjectClass=user)(|(mail=%u)(sAMAccountName=%u))) pass_filter = (&(ObjectClass=user)(sAMAccountName=%u)) default_pass_scheme = plain could anybody help me with this problem? Thanks in advance! Regards, Tobias Dummert

2 1

ACL group vs. owner question
by Peter Chiochetti 23 Jun '14

23 Jun '14

A hopefully simple question regarding the use of ACLs - the spirit being of taking away most permissions first and then adding them back selectively: In the global ACL declaration I have: > * owner lr > * group=SYS lrwstipekxa The owner is put into the SYS group via userdb extra field in static passwd file ("archiv" is a system user, but pam is disabled for the server): > archiv:::::::userdb_acl_groups=SYS Still, the group permissions do not get applied: > root@host:/etc/dovecot# doveadm -D acl debug -u archiv INBOX > […] > doveadm(archiv): Debug: Added userdb setting: plugin/acl_groups=SYS > doveadm(archiv): Debug: Effective uid=1002, gid=1001, home=/home/archiv > doveadm(archiv): Debug: acl: No acl_shared_dict setting - shared mailbox listing is disabled > doveadm(archiv): Debug: Namespace inbox: type=private, prefix=, sep=, inbox=yes, hidden=no, list=yes, subscriptions=yes location=maildir:~/Maildir > doveadm(archiv): Debug: maildir++: root=/home/archiv/Maildir, index=, indexpvt=, control=, inbox=/home/archiv/Maildir, alt= > doveadm(archiv): Debug: acl: initializing backend with data: vfile:/etc/dovecot/dovecot-acl > doveadm(archiv): Debug: acl: acl username = archiv > doveadm(archiv): Debug: acl: owner = 1 > doveadm(archiv): Debug: acl vfile: Global ACL file: /etc/dovecot/dovecot-acl > doveadm(archiv): Info: Mailbox 'INBOX' is in namespace '' > doveadm(archiv): Info: Mailbox path: /home/archiv/Maildir > doveadm(archiv): Info: All message flags are shared across users in mailbox > doveadm(archiv): Debug: acl vfile: file /home/archiv/Maildir/dovecot-acl not found > doveadm(archiv): Info: User archiv has rights: lookup read > doveadm(archiv): Info: Mailbox in user's private namespace > doveadm(archiv): Info: Mailbox INBOX is visible in LIST My question: Shouldn't this work? (In a stock setup.) PS: when I add "* group-override=SYS" to /etc/dovecot/dovecot-acl the user will not even be able to list INBOX. PPS: As an aside, the setup also switches any sytem or /virtual/ users during login in local.conf: > userdb { > driver = static > args = uid=archiv gid=archiv home=/home/archiv user=archiv > } but I get the above result without that switching when I make it read: > userdb { > driver = static > args = home=/home/archiv > } So I suppose that it's not relevant in this case… Thank you in advance -- peter

2 2

dovecot sieve vacation + lmtp protocol
by Florin Portase 23 Jun '14

23 Jun '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello, Here is my setup: dovecot - 2.2.11 pigeonhole - 0.4.2 qmail I was trying to create a vacation message, but after the sive script has been created and I was checking the logs I saw some strange errors: DOVECOT LOG Jun 18 16:52:24 lda(portase.florin(a)medianetork.ro): Error: lmtp client: connect(medianetork.ro, 25) failed: Connection refused Jun 18 16:52:24 lda(portase.florin(a)medianetork.ro): Error: smtp(medianetork.ro): RCPT TO failed: 451 4.4.0 Remote server not answering (connect) Jun 18 16:52:24 lda(portase.florin(a)medianetork.ro): Error: sieve: msgid=<OF380D0FC2.6E61F37A-ONC1257CFB.0051127E-C1257CFB.00511452(a)XXX.com>: failed to send vacation response to <ZZZ(a)XXX.com> (refer to server log for more information) DOVECOT config service lmtp { chroot = client_limit = 0 drop_priv_before_exec = no executable = lmtp extra_groups = group = idle_kill = 0 privileged_group = process_limit = 0 process_min_avail = 0 protocol = lmtp service_count = 0 type = #inet_listener lmtp { # address = 0.0.0.0 # port = 24 #} unix_listener lmtp { group = mode = 0666 user = } user = vsz_limit = 0 } protocol lmtp { #mail_fsync = optimized log_path = /var/log/dovecot/lmtp-errors.log info_log_path = /var/log//dovecot/lmtp.log mail_plugins = quota sieve autocreate expire } Am I missing something ??? Just to specify: domain medianetork.ro is accessible from outside on port 25 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQEcBAEBAgAGBQJTobZ9AAoJECEzxtLP+204AisH/2t83NS5GzFEv6JET3rJFW/k yN1/EM+Veg2CX7qvh0NPAQ/5/1f9MOdlyFUEs5vg1n2YGtBCfig6RFhP0OZNa2lK 38n99Vq3uutrTmviuv5pl4c8Jwlq68jlUlTK6DvKub58AVcqln6ljQt82HhfKl1+ lzQ/Igg6V9XT9vzcgdtumac4h+jNHuvoMv697dhK5/UfaV5tuFqKIHgLMampf4lz kc7x85xocK3C1+DQIepmpOgyHpjwBRi2KYzFii2s2jT0QWmhUHaD88BNnN8mkJxZ +1+IsWqyqSpxTx5ghIh0QiiUUBKmWcngRTs67PisDuVwvOmEy/ULkp1aEYwpD7Y= =3/1y -----END PGP SIGNATURE-----

3 3

Setting mail_attach_dir for destination on dsync
by Laeeth Isharc 23 Jun '14

23 Jun '14

Hi. What is the best way to do this, please ? I can override with -o but this applies to source as I read the docs. So I wish to do something like this dsync mirror -u myuser(a)me.com mdbox:/home/mail/myuser/mdboxcopy With either of: 1) attachments stored within message so mail_attachment_dir for dest being blank Or 2) attachments stored in a sub directory of mdboxcopy eg mdboxcopy/attach/ Timo hints that this is possible, but I cannot see how to do this, Any ideas ? Sent from my iPad

1 0

SIGSEGV in 2.2.13 with IMAP Proxying to an Exchange Server (dovecot/auth)
by Ralf Hildebrandt 22 Jun '14

22 Jun '14

Reading symbols from /usr/lib/dovecot/auth...Reading symbols from /usr/lib/debug//usr/lib/dovecot/auth...done. done. Attaching to program: /usr/lib/dovecot/auth, process 29099 [New LWP 29099] Core was generated by `dovecot/auth'. Program terminated with signal SIGSEGV, Segmentation fault. #0 0x00007f40b534c418 in array_append_i (count=<optimized out>, data=<optimized out>, array=<optimized out>) at ../../src/lib/array.h:148 #0 0x00007f40b534c418 in array_append_i (count=<optimized out>, data=<optimized out>, array=<optimized out>) at ../../src/lib/array.h:148 No locals. #1 imapc_connection_abort_commands_array (cmd_array=cmd_array@entry=0x2075270, dest_array=dest_array@entry=0x7fff4b6aa810, only_box=only_box@entry=0x0, keep_retriable=keep_retriable@entry=false) at imapc-connection.c:236 cmd = 0x7f40b61e3c1d <buffer_alloc+45> i = 0 #2 0x00007f40b534c69d in imapc_connection_abort_commands (conn=0x20751a0, only_box=0x0, keep_retriable=<optimized out>) at imapc-connection.c:250 cmdp = <optimized out> cmd = <optimized out> tmp_array = {arr = {buffer = 0x203f6a0, element_size = 8}, v = 0x203f6a0, v_modifiable = 0x203f6a0} reply = {state = IMAPC_COMMAND_STATE_DISCONNECTED, resp_text_key = 0x0, resp_text_value = 0x0, text_full = 0x7f40b534f6a6 "Disconnected from server", text_without_resp = 0x7f40b534f6a6 "Disconnected from server"} #3 0x00007f40b61f7d7f in io_loop_handle_timeouts_real (ioloop=0x2047790) at ioloop.c:410 timeout = 0x2077e00 item = 0x2077e00 tv = {tv_sec = 0, tv_usec = 0} tv_call = {tv_sec = 1403450802, tv_usec = 614093} t_id = 3 #4 io_loop_handle_timeouts (ioloop=ioloop@entry=0x2047790) at ioloop.c:423 _data_stack_cur_id = 2 #5 0x00007f40b61f8d34 in io_loop_handler_run_internal (ioloop=ioloop@entry=0x2047790) at ioloop-epoll.c:193 ctx = 0x204d270 list = <optimized out> io = <optimized out> tv = {tv_sec = 29, tv_usec = 999992} events_count = <optimized out> msecs = 30000 ret = 0 i = <optimized out> call = <optimized out> __FUNCTION__ = "io_loop_handler_run_internal" #6 0x00007f40b61f7ed9 in io_loop_handler_run (ioloop=ioloop@entry=0x2047790) at ioloop.c:488 No locals. #7 0x00007f40b61f7f58 in io_loop_run (ioloop=0x2047790) at ioloop.c:465 __FUNCTION__ = "io_loop_run" #8 0x00007f40b61a7133 in master_service_run (service=0x2047620, callback=<optimized out>) at master-service.c:566 No locals. #9 0x000000000040b96b in main (argc=1, argv=0x2047390) at main.c:393 c = <optimized out> ----- End forwarded message ----- -- Ralf Hildebrandt Geschäftsbereich IT | Abteilung Netzwerk Charité - Universitätsmedizin Berlin Campus Benjamin Franklin Hindenburgdamm 30 | D-12203 Berlin Tel. +49 30 450 570 155 | Fax: +49 30 450 570 962 ralf.hildebrandt(a)charite.de | http://www.charite.de

1 0

SIGSEGV in 2.2.13 with IMAP Proxying to an Exchange Server
by Ralf Hildebrandt 22 Jun '14

22 Jun '14

Reading symbols from /usr/lib/dovecot/imap...Reading symbols from /usr/lib/debug//usr/lib/dovecot/imap...done. done. Attaching to program: /usr/lib/dovecot/imap, process 28497 [New LWP 28497] Core was generated by `dovecot/imap'. Program terminated with signal SIGSEGV, Segmentation fault. #0 imapc_client_mailbox_cmd (box=0x0, callback=callback@entry=0x7fa3a78020e0 <imapc_simple_callback>, context=context@entry=0x7fffd738b940) at imapc-client.c:351 #0 imapc_client_mailbox_cmd (box=0x0, callback=callback@entry=0x7fa3a78020e0 <imapc_simple_callback>, context=context@entry=0x7fffd738b940) at imapc-client.c:351 cmd = <optimized out> __FUNCTION__ = "imapc_client_mailbox_cmd" #1 0x00007fa3a7802815 in imapc_mailbox_noop (mbox=mbox@entry=0x149d440) at imapc-storage.c:154 cmd = <optimized out> sctx = {client = 0x146c400, ret = -2} #2 0x00007fa3a7800d30 in imapc_mailbox_sync_init (box=0x149d440, flags=(MAILBOX_SYNC_FLAG_FULL_READ | MAILBOX_SYNC_FLAG_FIX_INCONSISTENT)) at imapc-sync.c:476 mbox = 0x149d440 list = <optimized out> capabilities = <optimized out> changes = true ret = 0 #3 0x00007fa3a78133c9 in mailbox_sync_init (box=box@entry=0x149d440, flags=(MAILBOX_SYNC_FLAG_FULL_READ | MAILBOX_SYNC_FLAG_FIX_INCONSISTENT)) at mail-storage.c:1677 _data_stack_cur_id = 4 ctx = <optimized out> #4 0x00007fa3a78134d7 in mailbox_sync (box=box@entry=0x149d440, flags=<optimized out>, flags@entry=MAILBOX_SYNC_FLAG_FULL_READ) at mail-storage.c:1725 ctx = 0x149d440 status = {sync_delayed_expunges = 0} #5 0x00007fa3a783ddcb in mailbox_expunge_all_data (box=0x149d440) at index-storage.c:648 ctx = 0x7fffd738bafc t = 0x7fffd738bafc mail = 0x0 search_args = 0x0 #6 index_storage_mailbox_delete (box=0x149d440) at index-storage.c:701 metadata = {guid = "\000\000\000\000\000\000\000\000\030\337z\247\000\000\000", virtual_size = 21615680, cache_fields = 0x0, precache_fields = (MAIL_FETCH_RECEIVED_DATE | MAIL_FETCH_SAVE_DATE | MAIL_FETCH_PHYSICAL_SIZE | MAIL_FETCH_IMAP_BODY | MAIL_FETCH_IMAP_ENVELOPE | MAIL_FETCH_HEADER_MD5 | MAIL_FETCH_UIDL_BACKEND | MAIL_FETCH_POP3_ORDER | unknown: 16777216), backend_ns_prefix = 0x7fa3a78144b0 <mailbox_open+16> "\211\302\061\300\205\322x\bH\203\304\030[]Ð\366\203\230\002", backend_ns_type = (unknown: 0)} status = {messages = 0, recent = 0, unseen = 21327392, uidvalidity = 0, uidnext = 1, first_unseen_seq = 0, first_recent_uid = 2806981817, last_cached_seq = 32675, highest_modseq = 21615680, highest_pvt_modseq = 140340866663231, keywords = 0x1, permanent_flags = 0, permanent_keywords = 0, allow_new_keywords = 0, nonpermanent_modseqs = 0, no_modseq_tracking = 0, have_guids = 0, have_save_guids = 0, have_only_guid128 = 0} ret_guid = <optimized out> #7 0x00007fa3a78146a7 in mailbox_delete (box=0x149d440) at mail-storage.c:1319 ret = <optimized out> #8 0x000000000040d0e1 in cmd_delete (cmd=0x148de40) at cmd-delete.c:39 client = <optimized out> ns = <optimized out> box = 0x149d440 name = 0x144c2b8 "postponed-msgs" errstr = <optimized out> error = 32767 disconnect = false #9 0x0000000000416cfc in command_exec (cmd=0x148de40) at imap-commands.c:158 hook = 0x14550e0 ret = <optimized out> #10 0x0000000000415d5f in client_command_input (cmd=0x148de40) at imap-client.c:778 client = 0x1499c10 command = <optimized out> __FUNCTION__ = "client_command_input" #11 0x0000000000415e15 in client_command_input (cmd=0x148de40) at imap-client.c:839 client = 0x1499c10 command = <optimized out> __FUNCTION__ = "client_command_input" #12 0x0000000000416115 in client_handle_next_command (remove_io_r=<synthetic pointer>, client=0x1499c10) at imap-client.c:877 No locals. #13 client_handle_input (client=client@entry=0x1499c10) at imap-client.c:889 _data_stack_cur_id = 3 remove_io = false handled_commands = false __FUNCTION__ = "client_handle_input" #14 0x00000000004164a2 in client_input (client=0x1499c10) at imap-client.c:931 cmd = 0x1465630 output = 0x148dd30 bytes = 32 __FUNCTION__ = "client_input" #15 0x00007fa3a7547e6f in io_loop_call_io (io=0x148be10) at ioloop.c:441 ioloop = 0x1454730 t_id = 2 __FUNCTION__ = "io_loop_call_io" #16 0x00007fa3a7548d77 in io_loop_handler_run_internal (ioloop=ioloop@entry=0x1454730) at ioloop-epoll.c:220 ctx = 0x14553c0 list = 0x1456e20 io = <optimized out> tv = {tv_sec = 4, tv_usec = 998377} events_count = <optimized out> msecs = <optimized out> ret = 1 i = 0 call = <optimized out> __FUNCTION__ = "io_loop_handler_run_internal" #17 0x00007fa3a7547ed9 in io_loop_handler_run (ioloop=ioloop@entry=0x1454730) at ioloop.c:488 No locals. #18 0x00007fa3a7547f58 in io_loop_run (ioloop=0x1454730) at ioloop.c:465 __FUNCTION__ = "io_loop_run" #19 0x00007fa3a74f7133 in master_service_run (service=0x14545c0, callback=callback@entry=0x41ee50 <client_connected>) at master-service.c:566 No locals. #20 0x000000000040b06f in main (argc=1, argv=0x1454390) at main.c:400 set_roots = {0x426ca0 <imap_setting_parser_info>, 0x0} login_set = {auth_socket_path = 0x144c048 "\001", postlogin_socket_path = 0x0, postlogin_timeout_secs = 60, callback = 0x41f200 <login_client_connected>, failure_callback = 0x41ef30 <login_client_failed>, request_auth_token = 1} service_flags = <optimized out> storage_service_flags = <optimized out> username = 0x0 c = <optimized out> -- Ralf Hildebrandt Geschäftsbereich IT | Abteilung Netzwerk Charité - Universitätsmedizin Berlin Campus Benjamin Franklin Hindenburgdamm 30 | D-12203 Berlin Tel. +49 30 450 570 155 | Fax: +49 30 450 570 962 ralf.hildebrandt(a)charite.de | http://www.charite.de

1 0

config best practice
by Egbert 20 Jun '14

20 Jun '14

Hi! We will soon start upgrading our Ubuntu mail server (running 2.0.19) from 12.04.1 LTSto 14.04 LTS. The dovecot config is still pretty much in 1.x style; one flat file called dovecot.conf. I can easily switch to a dovecot.conf with the "!include" lines and rename my flat config file to local.conf. I've tested that and it works fine. I could also try to move all lines in local.conf to the different XX-.conf files in the conf.d subdir. What is wise and best practice? Should one edit the files in conf.d? Or will the files in conf.d be overwritten on an update of dovecot? Then I'll better stick to the way of working with the dovecot.conf with the !includes and local.conf and assume that all files in conf.d are default settings. TNX for any advise! Egbert Jan, HCC!hobbynet, NL

4 4

Sis attachment deduplication
by Laeeth Isharc 20 Jun '14

20 Jun '14

Hi. Two questions: 1. Is this now reasonably stable for large mailboxes (c 2mm messages)? 2. Will this leave the filename in the message body unchanged? So for example if I have the same attachment called proposalfromvendor.pdf and proposaltoclient.pdf in two different emails, will the original names be kept ? Or will it replace the filename with some kind of numeric hash ? Many thanks. Laeeth Sent from my iPad

3 2

IMAP Chunking Thunderbird
by MrLINK 20 Jun '14

20 Jun '14

Hi, using dovecot-2.0.9-7.el6.x86_64 on CentOS release 6.5 (Final) I have an issue with thunderbird imap chunking. Some attachments are corrupted, because Thunderbird is just storing the first chunk. Since there are some workarounds by editing the "mail.imap.fetch_by_chunks" via about:config this is not the best choice for me because every client has to be edited. Is there a way to set a central value on the dovecot server (i.e disable chunking since this is not a client behaviour only)? Thanks in advance! MrLINK -- View this message in context: http://dovecot.2317879.n4.nabble.com/IMAP-Chunking-Thunderbird-tp48549.html Sent from the Dovecot mailing list archive at Nabble.com.

2 1

Suggestion: Split login_trusted_networks
by Peter Mogensen 20 Jun '14

20 Jun '14

Hi, It seems the use of login_trusted_networks is overloaded. Example: * It's used for indicating which hosts you trust to provide XCLIENT remote IP's. * It's used for indicating from which hosts you trust logins enough to disable auth penalty. (like in a webmail) However... trustwise, this is trusting two different entities. The first case you put trust in the host. In the second case, you actually put trust in the user which uses the webmail (unless of course the webmail it self implements auth-penalties). So you can't have one set of hosts which you trust for XCLIENT and another set of hosts you trust for not being the origin of brute force attacks. /Peter

1 0

Replication and namespaces
by Laeeth Isharc 19 Jun '14

19 Jun '14

Hi. Replication in dovecot is running into trouble as it is trying to sync virtual namespaces and does not like it. dsync parameters With v2.2.9+ you can configure what parameters replicator uses for the doveadm sync command: replication_dsync_parameters = -d -N -l 30 -U The -f and -s parameters are added automatically when needed. Usually the only change you may want to do is replace -N (= sync all namespaces) with -n <namespace> or maybe just add -x <exclude> parameter(s). ........ What is the description of namespace that follows -n or -x? -x virtual Or -x 0/ Where 0/ is the prefix for my virtual namespace Does not seem to stop it trying to sync the virtual namespace... What should I be doing instead? Do I need to use all the parameters above? Or can I just use the -x ? Sent from my iPa

1 0

dsync initial replication failing
by Cassidy Larson 19 Jun '14

19 Jun '14

Trying to get my new storage server synced up using dsync replication with SSH. Followed the wiki and everything works great for the initial sync, for about 4 hours, then I get some errors and it stops replicating: dsync-local(user(a)host.com): Warning: Failed to do incremental sync for mailbox INBOX, retry with a full sync dsync-local(user(a)host.com): Error: Remote command returned error 75: ssh -lusername <remote_ip> doveadm dsync-server -uuser(a)host.com -U It happened around 2am. I restarted the new server dovecot process and it started to copy back up again, and then happened about four hours later. I have about 10,000 accounts, and it chugs through the list to replicate pretty well (~300Mbps), so I know it's working. Just not sure why it's failing after it's working so great. Running 2.2.13 on both on FreeBSD. Both show this: # doveadm replicator status Queued 'sync' requests 0 Queued 'high' requests 0 Queued 'low' requests 0 Queued 'failed' requests 0 Queued 'full resync' requests 5645 Waiting 'failed' requests 0 Total number of known users 9957 Any ideas? Suggestions? Thanks, Cassidy

1 0

Re: config best practice
by Joseph Tam 19 Jun '14

19 Jun '14

From: Egbert <egbert(a)vandenbussche.nl> > The dovecot config is still pretty much in 1.x style; one flat file > called dovecot.conf. I can easily switch to a dovecot.conf with the > "!include" lines and rename my flat config file to local.conf. I've > tested that and it works fine. I could also try to move all lines in > local.conf to the different XX-.conf files in the conf.d subdir. What is > wise and best practice? Should one edit the files in conf.d? Or will the > files in conf.d be overwritten on an update of dovecot? Then I'll better > stick to the way of working with the dovecot.conf with the !includes and > local.conf and assume that all files in conf.d are default settings. I think you will hear from proponents of both styles. I would say use whatever works best for you. I personally use one dovecot.conf without any includes because I like having all my configs in one place. Less editing mutiple files, and less forgetting some configuration squirreled away in some conf.d file. Joseph Tam <jtam.home(a)gmail.com>

1 0

LDAP and MySQL in the same configuration
by Nicolas Cauchie 18 Jun '14

18 Jun '14

Hello there, Simple question, I'm losting hope when I search on Google : Is there a way to authenticate users from a LDAP database and to fetch their quotas stored in a MySQL database, both in the same configuration ? Thanks Nicolas --

1 0

Problem syncing mailboxes using doveadm sync
by Przemysław Orzechowski 18 Jun '14

18 Jun '14

Hi command im using command bellow on destination server rtying to make keep it in sync after initialy doing doveadm backup -R doveadm -Dv -o imapc_host=src.srv -o imapc_user=test(a)domain.tld -opop3c_user=test(a)domain.tld -o imapc_password='pass' -o pop3c_password='pass' -o mail_fsync=never -o mail_prefetch_count=20 sync -f -1 -R -u test(a)domain.tld imapc: Im using dovecot on both source and destination server (source is dovecot 1.0.10 destination is 2.2.9) Destination box is Ubuntu 14.04 LTS with dovecot installed using apt. When i create new mail message on the serrver where i run this command its not propagated to the remote (old) server Is this command wrong ?

3 4

RFE: dnsbl-support for dovecot
by Reindl Harald 17 Jun '14

17 Jun '14

after having my own dnsbl feeded by a honeypot and even mod_security supports it for webservers i think dovecot sould support the same to prevent dictionary attacks from known bad hosts, in our case that blacklist is 100% trustable and blocks before SMTP-Auth while normal RBL's are after SASL i admit that i am not a C/C++-programmer, but i think doing the DNS request and in case it has a result block any login attemt should be not too complex setup a own honeypot and feed rbldnsd with the sources is quite easy and in case of a own, trustable RBL where no foreigners report somebody by mistake it's relieable and scales well over many machines and services as long services supporting it mod_security: http://blog.inliniac.net/2007/02/23/blocking-comment-spam-using-modsecurity…

4 9

[Dovecot] Replication with virtual users and static userdb possible ?
by deano-dovecot＠areyes.com 17 Jun '14

17 Jun '14

Is it possible to get replication working in a virtual user setup that uses a static userdb ? My environment is fairly simple and typical - there's a single system user (vmail) that owns all the home dirs (/var/mail/domain.com/user). The virtual users (userid@domain.com:secretpassword) are kept in a single file (/var/mail/domain.com/PASSWD) that's unique per domain, and referenced as a static userdb : passdb { driver = passwd-file args = scheme=plain username_format=%u /var/mail/%d/PASSWD } userdb { driver = static args = uid=vmail gid=vmail home=/var/mail/%d/%n } I know the wiki http://wiki2.dovecot.org/Replication states that user listing must be enabled, but that's not available for a static userdb. The wiki http://wiki2.dovecot.org/UserDatabase/Static also says that it shouldn't be a problem because it will use do a passdb lookup instead (except for PAM which isn't used here). Unfortunately, it's not working. I've testing with ssh : dsync_remote_cmd = ssh -l vmail %{host} doveadm dsync-server -u%u -l%{lock_timeout} -n%{namespace} mail_replica = remote:vmail@server2.domain.com as well as with straight tcp (SSL for later) mail_replica = tcp:server2.domain.com:999 /var/log/mail.err shows the problems ... Jun 3 11:30:53 server1 dovecot: auth: Error: Trying to iterate users, but userdbs don't support it Jun 3 11:30:53 server1 dovecot: replicator: Error: User listing returned failure Jun 3 11:30:53 server1 dovecot: replicator: Error: listing users failed, can't replicate existing data Anyone else have it working ? I'm sure it's something simple that I've just overlooked. Thanks - D.

2 4

replicator, ldap virtual users and static userdb
by Alan McGinlay 17 Jun '14

17 Jun '14

Hi! I am trying to use the static userdb with virtual users stored in ldap and the replicator plugin. What is the best way to implement this? I was not able to find documentation about it. Thanks!

1 0

[Dovecot] Problem in Search IMAP with spaces in Subject
by Giovanni Mancuso 17 Jun '14

17 Jun '14

Hi, I deliver a test email (with 4 spaces in subject) into a maildir: Return-Path: <user(a)example.com> Delivered-To: <user(a)example.com> Received: from suse11 ([10.0.8.7]) by suse11 (Dovecot) with LMTP id Pf6zDTCaiFOUXwAA4Q5jHg for <user(a)example.com>; Fri, 30 May 2014 16:48:16 +0200 From: <user(a)example.com> To: <user(a)example.com> Message-ID: <9704BC6A-28D9-CBF2-A1D6-DD54F6AA9D9D(a)newsvilpec.babel.it> Subject: Test 4 Spaces Test But, if i search this email with 4 spaces in subject i don't find anthing: telnet 0 143 Trying 0.0.0.0... Connected to 0. Escape character is '^]'. * OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE AUTH=PLAIN] Dovecot ready. ab login user(a)example.com password ab OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE SORT SORT=DISPLAY THREAD=REFERENCES THREAD=REFS THREAD=ORDEREDSUBJECT MULTIAPPEND URL-PARTIAL CATENATE UNSELECT CHILDREN NAMESPACE UIDPLUS LIST-EXTENDED I18NLEVEL=1 CONDSTORE QRESYNC ESEARCH ESORT SEARCHRES WITHIN CONTEXT=SEARCH LIST-STATUS SPECIAL-USE BINARY MOVE QUOTA ACL RIGHTS=texk] Logged in ab select inbox * FLAGS (\Answered \Flagged \Deleted \Seen \Draft PEC_INBOX) * OK [PERMANENTFLAGS (\Answered \Flagged \Deleted \Seen \Draft PEC_INBOX \*)] Flags permitted. * 1 EXISTS * 1 RECENT * OK [UNSEEN 1] First unseen. * OK [UIDVALIDITY 1401785069] UIDs valid * OK [UIDNEXT 2] Predicted next UID ab OK [READ-WRITE] Select completed (0.002 secs). a1 SEARCH CHARSET UTF-8 SUBJECT "Test 4 Spaces" * SEARCH a1 OK Search completed (0.001 secs). a1 SEARCH CHARSET UTF-8 SUBJECT "Test 4 Spaces" * SEARCH 1 a1 OK Search completed (0.000 secs). ab logout * BYE Logging out ab OK Logout completed. Connection closed by foreign host. If i run the search with one space i find a mail. I use dovecot v2.2.12 on Linux suse11 x86_64 Thanks

1 1

Accessing a user mailbox from another user
by Angel L. Mateo 17 Jun '14

17 Jun '14

Hello, I'm looking for something maybe similar to master password but for final users and I don't know if there is already a way I could do it with dovecot. I have accounts that are used by a set of users who know their password. But I now want to remove this shared password and the users has to access to this shared account with their own password. Using shared folders is not an option (at least, not the first option) because of the behaviour our users are familiar with, such as: * They have and manage different sieve filters for the account * They have thier own Sent, Drafts, SPAM... for this shared account and their email client recognizes them as it (because they have its own account). What I'm looking for is something similar to master password, but for a user identifying as another regular user, not the "master" one. Do you know if there already is a way to configure a similar behaviour? I'm planning to configure an user and authentication backend (maybe pam) that gets users as <realuser>$<finaluser> and the realuser password, checks if <realuser> should access to <finaluser> and then returns <finaluser> mail location to dovecot. Any idea? -- Angel L. Mateo Martínez Sección de Telemática Área de Tecnologías de la Información y las Comunicaciones Aplicadas (ATICA) http://www.um.es/atica Tfo: 868887590 Fax: 868888337

1 0