- dovecot - dovecot.org

[Dovecot] v2.0.14 released
by Timo Sirainen 29 Aug '11

29 Aug '11

http://dovecot.org/releases/2.0/dovecot-2.0.14.tar.gz http://dovecot.org/releases/2.0/dovecot-2.0.14.tar.gz.sig It's been a while since the previous release.. I've been a bit busy with my newly created Dovecot support company, but it was also summer and I wasted some time doing nothing useful. :) Most of my recent time has gone to adding new features to v2.1 branch. I'm planning on releasing v2.1.alpha1 somewhat soon and the final v2.1.0 sometimes later this year. This v2.0.14 release also contains one larger new feature: Ability to list and kick imap/pop3 proxy connections. This is done via a new "ipc" process where all proxying login processes connect to, which allows doveadm to communicate with them. If you're not using these features, this change (and its potential bugs) should be pretty much invisible. BTW. I know there are still mails I haven't read & replied to. I'll try to get to them eventually, but you may as well re-send anything you want me to read sooner rather than 6 months from now. Some of the largest changes since v2.0.13: + doveadm: Added support for running mail commands by proxying to another doveadm server. + Added "doveadm proxy list" and "doveadm proxy kick" commands to list/kick proxy connections (via a new "ipc" service). + Added "doveadm director move" to assign user from one server to another, killing any existing connections. + Added "doveadm director ring status" command. + userdb extra fields can now return name+=value to append to an existing name, e.g. "mail_plugins+= quota". - script-login attempted an unnecessary config lookup, which usually failed with "Permission denied". - lmtp: Fixed parsing quoted strings with spaces as local-part for MAIL FROM and RCPT TO. - imap: FETCH BODY[HEADER.FIELDS (..)] may have crashed or not returned all data sometimes. - ldap: Fixed random assert-crashing with with sasl_bind=yes. - Fixes to handling mail chroots - Fixed renaming mailboxes under different parent with FS layout when using separate ALT, INDEX or CONTROL paths. - zlib: Fixed reading concatenated .gz files.

1 0

[Dovecot] unlink_directory failed with 'Device or resource busy' on NFS
by 김기태 29 Aug '11

29 Aug '11

Hi, I'm getting some errors while I'm trying to move mailboxes from IMAP server to Outlook client. The error message is "IMAP command is failed" and I think it is useless. Here are the error messages written to server's syslog. imap(name(a)domain.com<mailto:name@domain.com>): Error: unlink_directory(/data/domain.com/name/INBOX/direct/.nfs00000000000033fd000… failed: Device or resource busy imap(name(a)domain.com<mailto:name@domain.com>): Error: unlink_directory(/data/domain.com/name/INBOX/IDC/.nfs000000000000709d000000… failed: Device or resource busy imap(name(a)domain.com<mailto:name@domain.com>): Error: unlink_directory(/data/domain.com/name/INBOX/OSSEC/.nfs000000000000709f0000… failed: Device or resource busy How can I solve this problem? I'm using Dovecot 2.0.13 and my configurations are: # 2.0.13: /usr/local/dovecot/etc/dovecot/dovecot.conf # OS: Linux 2.6.38-11-server x86_64 Ubuntu 11.04 listen = * mail_fsync = always mail_location = maildir:~:LAYOUT=fs mail_nfs_index = yes mail_nfs_storage = yes mmap_disable = yes passdb { args = /usr/local/dovecot/etc/dovecot/dovecot-ldap.conf.ext driver = ldap } ssl_cert = </etc/postfix/tls/smtpd.cert ssl_key = </etc/postfix/tls/smtpd.key userdb { args = uid=65534 gid=65534 home=/data/%Ld/%Ln driver = static }

2 1

[Dovecot] Pop3 hanging up after login.
by Fabio Catunda 29 Aug '11

29 Aug '11

Hi, I'm trying to implement a second dovecot server on a second machine to try to load balance IMAP/POP3 services. The first machine is already running and is working pretty well with dovecot-pop3d 1:1.0.15-2.3+lenny1. The new machine is running dovecot-pop3d 1:1.2.15-7 and accessing the existing maildirs over a NFS share on /mnt/mail. When I try to telnet localhost 110 on the new machine it just freezes after the "pass MySecret", like this: # telnet localhost 110 Trying 127.0.0.1... Connected to localhost. Escape character is '^]'. +OK Bem Vindo. user my.user(a)mydomain.com.br +OK pass MySecret ... (Nothing else happens) If I try to stop Dovecot with /etc/init.d/dovecot stop it stops, but the pop3 process keep running and the only way to stop it is with kill -9. On my log I only can see this: Aug 27 15:03:40 radamante dovecot: auth(default): client in: AUTH#0112#011PLAIN#011service=pop3#011secured#011lip=127.0.0.1#011rip=127.0.0.1#011lport=110#011rport=60421#011resp=<hidden> Aug 27 15:03:40 radamante dovecot: auth-worker(default): pam(my.user(a)mydomain.com.br,127.0.0.1): lookup service=dovecot Aug 27 15:03:40 radamante dovecot: auth-worker(default): pam(my.user(a)mydomain.com.br,127.0.0.1): #1/1 style=1 msg=Password: Aug 27 15:03:42 radamante dovecot: auth-worker(default): pam(my.user(a)mydomain.com.br,127.0.0.1): pam_authenticate() failed: Authentication failure (password mismatch?) Aug 27 15:03:42 radamante dovecot: auth(default): cache(my.user(a)mydomain.com.br,127.0.0.1): miss Aug 27 15:03:42 radamante dovecot: auth(default): ldap(my.user(a)mydomain.com.br,127.0.0.1): pass search: base=ou=Users, dc=mydomain, dc=com, dc=br scope=subtree filter=(&(mail=my.user(a)mydomain.com.br)) fields=mail,userPassword Aug 27 15:03:42 radamante dovecot: auth(default): ldap(my.user(a)mydomain.com.br,127.0.0.1): result: mail(user@domain)=my.user@mydomain.com.br userPassword(password)=<hidden> Aug 27 15:03:42 radamante dovecot: auth(default): client out: OK#0112#011user=my.user@mydomain.com.br#011user@domain=my.user@mydomain.com.br Aug 27 15:03:42 radamante dovecot: auth(default): master in: REQUEST#0111#01130330#0112 Aug 27 15:03:42 radamante dovecot: auth(default): passwd(my.user(a)mydomain.com.br,127.0.0.1): lookup Aug 27 15:03:42 radamante dovecot: auth(default): passwd(my.user(a)mydomain.com.br,127.0.0.1): unknown user Aug 27 15:03:42 radamante dovecot: auth(default): ldap(my.user(a)mydomain.com.br,127.0.0.1): user search: base=ou=Users, dc=mydomain, dc=com, dc=br scope=subtree filter=(&(mail=my.user(a)mydomain.com.br)) fields=homeDirectory,uidNumber,gidNumber Aug 27 15:03:42 radamante dovecot: auth(default): ldap(my.user(a)mydomain.com.br,127.0.0.1): result: uidNumber(uidNumber)=3478 gidNumber(gidNumber)=513 homeDirectory(homeDirectory)=/home/samba/my.user Aug 27 15:03:42 radamante dovecot: auth(default): master out: USER#0111#011my.user@mydomain.com.br#011uidNumber=3478#011gidNumber=513#011homeDirectory=/home/samba/my.user Aug 27 15:03:42 radamante dovecot: pop3-login: Login: user=<my.user(a)mydomain.com.br>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, secured Aug 27 15:03:42 radamante dovecot: auth(default): new auth connection: pid=30330 Aug 27 15:03:42 radamante dovecot: POP3(my.user(a)mydomain.com.br): Effective uid=8, gid=8, home=(none) Aug 27 15:03:42 radamante dovecot: POP3(my.user(a)mydomain.com.br): maildir: data=/mnt/mail/mydomain.com.br/my.user/Maildir Aug 27 15:03:42 radamante dovecot: POP3(my.user(a)mydomain.com.br): maildir++: root=/mnt/mail/mydomain.com.br/my.user/Maildir, index=, control=, inbox=/mnt/mail/mydomain.com.br/my.user/Maildir Aug 27 15:03:42 radamante dovecot: POP3(my.user(a)mydomain.com.br): Namespace : Using permissions from /mnt/mail/mydomain.com.br/my.user/Maildir: mode=0700 gid=-1 By now I have no clue whats going on, any help is appreciated. I don't understand if the problem is the NFS share or if it's something with the new version of Dovecot on Debian. Some more info: # dovecot -n # 1.2.15: /etc/dovecot/dovecot.conf # OS: Linux 2.6.32-5-amd64 x86_64 Debian 6.0.2 nfs log_timestamp: %Y-%m-%d %H:%M:%S protocols: imap pop3 ssl: no disable_plaintext_auth: no login_dir: /var/run/dovecot/login login_executable(default): /usr/lib/dovecot/imap-login login_executable(imap): /usr/lib/dovecot/imap-login login_executable(pop3): /usr/lib/dovecot/pop3-login login_greeting: Bem Vindo. login_process_per_connection: no login_chroot: no login_process_size: 128 login_processes_count: 8 max_mail_processes: 2048 mail_max_userip_connections(default): 100 mail_max_userip_connections(imap): 100 mail_max_userip_connections(pop3): 10 verbose_proctitle: yes first_valid_uid: 1 last_valid_uid: 9999 last_valid_gid: 9999 mail_privileged_group: mail mail_uid: mail mail_gid: mail mail_location: maildir:/mnt/mail/%Ld/%Ln/Maildir mail_debug: yes mmap_disable: yes mail_nfs_storage: yes mail_nfs_index: yes maildir_copy_preserve_filename: yes mbox_write_locks: fcntl dotlock mail_executable(default): /usr/lib/dovecot/imap mail_executable(imap): /usr/lib/dovecot/imap mail_executable(pop3): /usr/lib/dovecot/pop3 mail_process_size: 512 mail_plugin_dir(default): /usr/lib/dovecot/modules/imap mail_plugin_dir(imap): /usr/lib/dovecot/modules/imap mail_plugin_dir(pop3): /usr/lib/dovecot/modules/pop3 imap_client_workarounds(default): delay-newmail imap_client_workarounds(imap): delay-newmail imap_client_workarounds(pop3): imap_idle_notify_interval(default): 30 imap_idle_notify_interval(imap): 30 imap_idle_notify_interval(pop3): 120 pop3_client_workarounds(default): pop3_client_workarounds(imap): pop3_client_workarounds(pop3): outlook-no-nuls oe-ns-eoh auth default: default_realm: mydomain.com.br cache_size: 1024 cache_negative_ttl: 0 username_format: %Lu failure_delay: 3 debug: yes passdb: driver: pam passdb: driver: ldap args: /etc/dovecot/dovecot-ldap.conf userdb: driver: passwd userdb: driver: ldap args: /etc/dovecot/dovecot-ldap.conf root@radamante:/etc/dovecot# egrep -v '^#|^$' dovecot-ldap.conf hosts = 192.168.5.37 192.168.5.124 sasl_bind = no tls = no auth_bind = no ldap_version = 3 base = ou=Users, dc=mydomain, dc=com, dc=br deref = never scope = subtree user_attrs = homeDirectory=homeDirectory,uidNumber=uidNumber,gidNumber=gidNumber user_filter = (&(mail=%u)) pass_attrs = mail=user@domain,userPassword=password pass_filter = (&(mail=%u)) default_pass_scheme = CRYPT Thanks in advance.

2 1

[Dovecot] occasional dovecot crash, core captured but no symbol table info?
by John Clements 27 Aug '11

27 Aug '11

Dovecot is crashing occasionally for me. Today it crashed six times in quick succession, as I fired up a computer (Mac) I hadn't used in a while, and my mail application (Apple Mail) tried to synchronize many large mailboxes. The log entries look like this: Aug 26 10:26:15 computer dovecot: dovecot: child 23223 (imap) killed with signal 6 (core dumped) Aug 26 10:26:30 computer dovecot: IMAP(granitemon): Panic: file istream-raw-mbox.c: line 583 (istream_raw_mbox_get_body_size): assertion failed: (rstream->body_offset != (uoff_t)-1) Aug 26 10:26:30 computer dovecot: IMAP(granitemon): Raw backtrace: imap() [0x80f0e1e] -> imap() [0x80f0e82] -> imap() [0x80f0809] -> imap(istream_raw_mbox_get_body_size+0x407) [0x8092f47] -> imap(istream_raw_mbox_next+0x25) [0x8093025] -> imap(istream_raw_mbox_seek+0x1f3) [0x8093323] -> imap(mbox_file_seek+0x55) [0x8093745] -> imap() [0x8095852] -> imap() [0x8095c8d] -> imap(index_mail_set_seq+0x153) [0x80a35c3] -> imap() [0x8095fb9] -> imap(index_storage_search_next_nonblock+0x13b) [0x80a763b] -> imap(mailbox_search_next_nonblock+0x2a) [0x80b5c1a] -> imap(mailbox_search_next+0x28) [0x80b5c68] -> imap(imap_fetch_more+0x274) [0x806a4c4] -> imap() [0x8062665] -> imap() [0x806753f] -> imap(client_output+0xeb) [0x806862b] -> imap() [0x810007e] -> imap(io_loop_handler_run+0xd6) [0x80f9aa6] -> imap(io_loop_run+0x20) [0x80f8f20] -> imap(main+0x5b4) [0x8070f24] -> /lib/i686/cmov/libc.so.6(__libc_start_main+0xe6) [0xb75f3c76] -> imap() [0x80603a1] Aug 26 10:26:30 computer dovecot: dovecot: child 23228 (imap) killed with signal 6 (core dumped) Here's the output of dovecot -n: clements@computer:/home/granitemon$ sudo dovecot -n # 1.2.15: /etc/dovecot/dovecot.conf # OS: Linux 2.6.32-5-686 i686 Debian 6.0.2 log_timestamp: %Y-%m-%d %H:%M:%S login_dir: /var/run/dovecot/login login_executable: /usr/lib/dovecot/imap-login mail_privileged_group: mail mbox_write_locks: fcntl dotlock lda: postmaster_address: postmaster(a)brinckerhoff.org mail_plugins: sieve auth default: passdb: driver: pam userdb: driver: passwd ... this is the version associated with debian stable. Finally, since I had coredumps enabled, I'm in a position to provide 'bt full', but it looks like my binaries are stripped, so I'm not getting source code line numbers. granitemon@computer:~$ gdb /usr/lib/dovecot/imap ./core GNU gdb (GDB) 7.0.1-debian Copyright (C) 2009 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html> This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type "show copying" and "show warranty" for details. This GDB was configured as "i486-linux-gnu". For bug reporting instructions, please see: <http://www.gnu.org/software/gdb/bugs/>... Reading symbols from /usr/lib/dovecot/imap...(no debugging symbols found)...done. warning: Can't read pathname for load map: Input/output error. Reading symbols from /lib/i686/cmov/libdl.so.2...(no debugging symbols found)...done. Loaded symbols for /lib/i686/cmov/libdl.so.2 Reading symbols from /usr/lib/libldap_r-2.4.so.2...(no debugging symbols found)...done. Loaded symbols for /usr/lib/libldap_r-2.4.so.2 Reading symbols from /lib/i686/cmov/librt.so.1...(no debugging symbols found)...done. Loaded symbols for /lib/i686/cmov/librt.so.1 Reading symbols from /lib/i686/cmov/libc.so.6...(no debugging symbols found)...done. Loaded symbols for /lib/i686/cmov/libc.so.6 Reading symbols from /lib/ld-linux.so.2...(no debugging symbols found)...done. Loaded symbols for /lib/ld-linux.so.2 Reading symbols from /usr/lib/liblber-2.4.so.2...(no debugging symbols found)...done. Loaded symbols for /usr/lib/liblber-2.4.so.2 Reading symbols from /lib/i686/cmov/libresolv.so.2...(no debugging symbols found)...done. Loaded symbols for /lib/i686/cmov/libresolv.so.2 Reading symbols from /usr/lib/libsasl2.so.2...(no debugging symbols found)...done. Loaded symbols for /usr/lib/libsasl2.so.2 Reading symbols from /usr/lib/libgnutls.so.26...(no debugging symbols found)...done. Loaded symbols for /usr/lib/libgnutls.so.26 Reading symbols from /lib/i686/cmov/libpthread.so.0...(no debugging symbols found)...done. Loaded symbols for /lib/i686/cmov/libpthread.so.0 Reading symbols from /usr/lib/libtasn1.so.3...(no debugging symbols found)...done. Loaded symbols for /usr/lib/libtasn1.so.3 Reading symbols from /usr/lib/libz.so.1...(no debugging symbols found)...done. Loaded symbols for /usr/lib/libz.so.1 Reading symbols from /usr/lib/libgcrypt.so.11...(no debugging symbols found)...done. Loaded symbols for /usr/lib/libgcrypt.so.11 Reading symbols from /usr/lib/libgpg-error.so.0...(no debugging symbols found)...done. Loaded symbols for /usr/lib/libgpg-error.so.0 Reading symbols from /lib/i686/cmov/libnss_compat.so.2...(no debugging symbols found)...done. Loaded symbols for /lib/i686/cmov/libnss_compat.so.2 Reading symbols from /lib/i686/cmov/libnsl.so.1...(no debugging symbols found)...done. Loaded symbols for /lib/i686/cmov/libnsl.so.1 Reading symbols from /lib/i686/cmov/libnss_nis.so.2...(no debugging symbols found)...done. Loaded symbols for /lib/i686/cmov/libnss_nis.so.2 Reading symbols from /lib/i686/cmov/libnss_files.so.2...(no debugging symbols found)...done. Loaded symbols for /lib/i686/cmov/libnss_files.so.2 Reading symbols from /lib/libgcc_s.so.1...(no debugging symbols found)...done. Loaded symbols for /lib/libgcc_s.so.1 Core was generated by `imap'. Program terminated with signal 6, Aborted. #0 0xb7788424 in __kernel_vsyscall () (gdb) bt full #0 0xb7788424 in __kernel_vsyscall () No symbol table info available. #1 0xb7607751 in raise () from /lib/i686/cmov/libc.so.6 No symbol table info available. #2 0xb760ab82 in abort () from /lib/i686/cmov/libc.so.6 No symbol table info available. #3 0x080f0e2e in ?? () No symbol table info available. #4 0x080f0e82 in ?? () No symbol table info available. #5 0x080f0809 in i_panic () No symbol table info available. #6 0x08092f47 in istream_raw_mbox_get_body_size () No symbol table info available. #7 0x08093025 in istream_raw_mbox_next () No symbol table info available. #8 0x08093323 in istream_raw_mbox_seek () No symbol table info available. #9 0x08093745 in mbox_file_seek () No symbol table info available. #10 0x08095852 in ?? () No symbol table info available. #11 0x08095c8d in ?? () No symbol table info available. #12 0x080a35c3 in index_mail_set_seq () No symbol table info available. #13 0x08095fb9 in ?? () No symbol table info available. #14 0x080a763b in index_storage_search_next_nonblock () No symbol table info available. #15 0x080b5c1a in mailbox_search_next_nonblock () No symbol table info available. #16 0x080b5c68 in mailbox_search_next () No symbol table info available. #17 0x0806a4c4 in imap_fetch_more () No symbol table info available. #18 0x08062665 in ?? () No symbol table info available. #19 0x0806753f in ?? () No symbol table info available. #20 0x0806862b in client_output () No symbol table info available. #21 0x0810007e in ?? () No symbol table info available. #22 0x080f9aa6 in io_loop_handler_run () ---Type <return> to continue, or q <return> to quit--- No symbol table info available. #23 0x080f8f20 in io_loop_run () No symbol table info available. #24 0x08070f24 in main () No symbol table info available. (gdb) q Does anyone have any suggestions, here? Many thanks in advance; let me know if I can provide more information! All the best, John Clements

3 2

Re: [Dovecot] limiting number of incorrect logins per connection
by alex＠ahhyes.net 27 Aug '11

27 Aug '11

Thanks for that. I will change it and recompile. Sorry for the grumpyness yesterday in my posts. Was having a bad day. Is there any chance of there being an option on future versions that allow a number of failed auth attempts to be specified before dropping the connection? The other thread you mentioned, I see someone devised a small patch in c to add this functionality. It didnt look like a lot of code to do it. What are your thoughts? ----- Reply message ----- From: "Timo Sirainen" <tss(a)iki.fi> Date: Sat, Aug 27, 2011 02:30 Subject: [Dovecot] limiting number of incorrect logins per connection To: "Alex" <alex(a)ahhyes.net> Cc: <dovecot(a)dovecot.org> login-common/client-common.h : #define CLIENT_LOGIN_TIMEOUT_MSECS (MASTER_LOGIN_TIMEOUT_SECS*1000) So set it to (45*60*1000) But I don't think there's much of a practical difference between these. On 26.8.2011, at 12.07, Alex wrote: > 3 minutes! I think that's too long, how can I drop that down to about 45 seconds? > > > On Fri, 26 Aug 2011 11:44:45 +0300, Timo Sirainen wrote: >> On 26.8.2011, at 10.25, Alex wrote: >> >>> Running Dovecot 2 on my server. It is regularly getting dictionary auth attacked. What I have noticed is that once connected to a pop3/imap login session, you can send endless incorrect usernames+passwords attempts. This is a problem for me... I use fail2ban to try and stop these script kiddies. The problem is that fail2ban detects the bad auths, firewalls the IP, however, since it's an "established" session, the attacker can keep authing away... It's only on a subsequent (new) connection that the firewalling will take effect. >> >> Umm. If client hasn't managed to log in in 3 minutes, it's >> disconnected (no matter what it does with the connection). >

1 0

Re: [Dovecot] On IMAP vhost login, only Username being used
by hobie＠rumormillnews.com 26 Aug '11

26 Aug '11

Found it. :) Not a dovecot problem but a field in Icedove (Thunderbird variant) that had been automatically filled in by the software "to serve you better". It's on the Server Settings page as "User Name". "Never mind..." :) --hobie > Recapping: I'm working to set up Dovecot 2.0.13 along with some additional software (qmail, vpopmail, squirrelmail). It's working fine with squirrelmail now, but trying to connect over SSL with a Thunderbird variant and using IMAP, authentication fails because Dovecot is trying to match only the front part of the name (the user part), ignoring the domain name part of what it's being sent. So, instead of seeking to match virtual user: > > joe_blow(a)some_domain.com > > ...it's trying to match: > > joe_blow > > ...and failing, since joe_blow is not a system user but is a virtual host user. With Squirrelmail, connecting from localhost via non-SSL IMAP, the match is handled correctly, no problem. I've run the runtbird.sh script but no light was shed on this by the resulting output, all it said was that authentication was failing. > > Has anyone else encountered this problem? Any suggestions on how to fix it or where to look for additional info? Thanks kindly. > > --hobie > >> I tried the runtbird.sh script, hoping for more info - all it did was > show that auth is failing. I don't understand why Dovecot is separating the username from the domain name, and trying to match only on the username. Seems like there must be a config setting that affects this and that I'm overlooking. Thanks ahead for any help with this. >> >> --hobie >> >> hobie wrote earlier: >> >> ===== >> >> Attempting IMAP SSL login on new installation, using Icedove (Debain > Thunderbird variant), login fails. Logs show Dovecot attempting to match username only, not username with domain name, on Vpopmail user, so of course no match. Tried with '@' in full username, also with '%'. What's missing? >> >> Log shows: >> >> Aug 24 19:30:48 debian dovecot: auth: Debug: client in: CONT<hidden> Aug > 24 19:30:48 debian dovecot: auth: Debug: Loading modules from directory: /usr/local/lib/dovecot/auth >> Aug 24 19:30:48 debian dovecot: auth: Debug: vpopmail(postmaster,[IP > redacted]): lookup user=postmaster domain= >> >> Current config: >> >> # 2.0.13: /usr/local/etc/dovecot/dovecot.conf >> # OS: Linux 2.6.32-5-amd64 x86_64 Debian 6.0.2 ext3 >> auth_debug = yes >> auth_verbose = yes >> disable_plaintext_auth = no >> first_valid_gid = 89 >> first_valid_uid = 89 >> mail_debug = yes >> mail_location = maildir:/home/vpopmail/domains/%d/%n/Maildir >> maildir_very_dirty_syncs = yes >> passdb { >> driver = vpopmail >> } >> protocols = imap pop3 >> ssl_cert = </etc/ssl/certs/dovecot.pem >> ssl_key = </etc/ssl/private/dovecot.pem >> userdb { >> args = quota_template=quota_rule=*:backend=%q >> driver = vpopmail >> } >> >> --hobie >> >> ===== >> > > > > > > >

1 0

[Dovecot] performance with 100k messages per folder
by Florin Andrei 26 Aug '11

26 Aug '11

dovecot-2.0-0.10.beta6.20100630.el6.x86_64 on CentOS 6. Virtual machine with 1 GB of RAM on VMWare. The configuration is more or less stock. Postfix receives then delivers to Dovecot. IMAP with mbox. Only one user account, but shared by several people via webmail (Roundcube webmail in Apache on the same machine). No other MUAs. 100k new messages per month, inbox is rotated monthly into a YYYYMM folder by a cron job. Only one monthly folder so far. Messages are never deleted (but I may start deleting old folders a year or two from now). This is mostly for reading, with occasional messages being forwarded. The email was pretty sluggish when logging in to the webmail interface. I asked the admin to increase the RAM from 0.5 to 1 GB. I changed mbox_very_dirty_syncs to yes. These measures seemed to accelerate it a lot. There's still a 1 sec pause when logging in, during which time the dovecot/imap process is using a lot of CPU. It looks like, as long as I give it enough RAM to keep the folders in memory, the whole thing should be fast enough, which is great. Any other tips-n-tricks to keep the email server speedy and the users happy? Should I worry about mbox_very_dirty_syncs as long as there are no other MUAs? -- Florin Andrei http://florin.myip.org/

2 1

[Dovecot] File Permissions and delivery
by Simon Brereton 26 Aug '11

26 Aug '11

Hi I'm very new to Dovecot (been using Courier for 5 years), but I've been persuaded of the merits of Dovecot and since the server needs upgrading that seems like the perfect time/excuse. On a test server, I set up postfix and installed Dovecot (running 32-bit Debian Squeeze, installed from apt-get). I mirrored the mail store (Maildirs, for historical reasons located under /var/spool/mail/virtual/domain.com/user). Then I ran the courier migration perl script and everything was fine and dandy. However, when I can to do the production migration, things weren't as smooth. The new server is 64-bit (not that I think it makes a difference, but if you're going to help me you should have all the information :) Again, I installed Postfix and Dovecot Took down the old server Mirrored the Maildirs Ran the migration script Restarted everything At this point everything looked like it was ok. Mail was being received and delivered to the Maildirs and the IMAP login was fine. However, I noticed errors in the logs when retreiving mail with the MUA along the lines of: Aug 26 16:59:48 mail dovecot: IMAP(simon(a)lydiard.net): open(/var/spool/mail/virtual/domain.net/simon/cur/1314328966.V801I166601bM7… failed: Permission denied (euid=999(mailsystem) egid=115(mailsystem) missing +r perm: /var/spool/mail/virtual/domain.net/simon/cur/1314328966.V801I166601bM756462.mail.net,S=2461:2,) After messing around with the chown and chmod (even though these were exactly the same as the test server) I finally discovered the issue. mail:~# ls /var/spool/mail/virtual/domain.net/simon/new/ -rwxrwx--- 1 postfix mailsystem 2.5K Aug 26 03:33 1314326000.V801I1666018M803015.mail.net,S=2461:2, -rwxrwx--- 1 postfix mailsystem 2.5K Aug 26 03:36 1314326209.V801I1666019M447273.mail.net,S=2460:2, -rw-rw---- 1 postfix mailsystem 2.5K Aug 26 04:00 1314327630.V801I166601aM308173.mail.net,S=2477:2, -rw------- 1 postfix mailsystem 2.5K Aug 26 04:22 1314328966.V801I166601bM756462.mail.net,S=2461:2, -rw------- 1 postfix mailsystem 1.1K Aug 26 16:28 1314372534.V801I166601cM615258.mail.net,S=1097:2, -rw------- 1 postfix mailsystem 1.1K Aug 26 16:31 1314372685.V801I166601dM264242.mail.net,S=1097:2, Mails are being delivered with 0600 permissions and not 0660 (the mails from courier seem to have all been 0770 as you can see). If I manually change the permission (to 0660) then I can see the mail in the MUA. After thinking for a while it occurred to me that this is covered in the LDA section. But making changes to the config file (either permissions or UID/GID) doesn't seem to make a difference. (Yes, I did restart postfix and dovecot after the changes). Anyway, here is my dovecot -n: mail:~# dovecot -n # 1.2.15: /etc/dovecot/dovecot.conf # OS: Linux 2.6.32-5-amd64 x86_64 Debian 6.0.2 ext3 log_timestamp: %Y-%m-%d %H:%M:%S protocols: imap imaps pop3 pop3s ssl_ca_file: /etc/ssl/keys/ca.crt ssl_cert_file: /etc/ssl/keys/mail.net.crt ssl_key_file: /etc/ssl/private/mail.net.key disable_plaintext_auth: no login_dir: /var/run/dovecot/login login_executable(default): /usr/lib/dovecot/imap-login login_executable(imap): /usr/lib/dovecot/imap-login login_executable(pop3): /usr/lib/dovecot/pop3-login mail_privileged_group: mailsystem mail_location: maildir:/var/spool/mail/virtual/%d/%n maildir_very_dirty_syncs: yes mbox_write_locks: fcntl dotlock mail_executable(default): /usr/lib/dovecot/imap mail_executable(imap): /usr/lib/dovecot/imap mail_executable(pop3): /usr/lib/dovecot/pop3 mail_plugins(default): quota imap_quota mail_plugins(imap): quota imap_quota mail_plugins(pop3): quota mail_plugin_dir(default): /usr/lib/dovecot/modules/imap mail_plugin_dir(imap): /usr/lib/dovecot/modules/imap mail_plugin_dir(pop3): /usr/lib/dovecot/modules/pop3 imap_client_workarounds(default): outlook-idle delay-newmail imap_client_workarounds(imap): outlook-idle delay-newmail imap_client_workarounds(pop3): pop3_client_workarounds(default): pop3_client_workarounds(imap): pop3_client_workarounds(pop3): outlook-no-nuls oe-ns-eoh lda: postmaster_address: postmaster@net mail_plugins: quota log_path: info_log_path: deliver_log_format: msgid=%m: %f: %$ auth default: mechanisms: plain login user: mailsystem verbose: yes passdb: driver: sql args: /etc/dovecot/dovecot-sql.conf userdb: driver: prefetch userdb: driver: static args: uid=999 gid=115 home=/var/spool/mail/virtual/%d/%n allow_all_users=yes socket: type: listen client: path: /var/spool/postfix/private/auth mode: 432 user: postfix group: mailsystem master: path: /var/run/dovecot/auth-master mode: 432 user: mailsystem group: mailsystem plugin: quota: maildir As you can see, I tried to go 0660 in both client and master. The portion of my master.cf 81 # SPB - Attempt to deliver with Dovecot LDA 82 dovecot unix - n n - - pipe 83 flags=DRhu user=mailsystem argv=/usr/lib/dovecot/deliver -f ${sender} -d ${user}@${nexthop} Is there anything else I should include? I'm pretty sure it's an error on my part. I'm just not clued up enough to know where. My second problem is that I thought I had things back to where they were before I messed with chown and chmod, but now I get this in the logs dovecot: dovecot: Fatal: chdir(/var/spool/mail/virtual/domain.net/simon//) failed: Permission denied (euid=999(mailsystem) egid=115(mailsystem) missing +x perm: /var/spool/mail/virtual) But the ls on that is exactly the same as on the test server: ls /var/spool/mail/virtual/ total 44K drwxrwS--- 11 postfix mailsystem 4.0K Aug 25 23:07 ./ drwxrwsr-x 5 amavis mailsystem 4.0K Oct 19 2009 ../ drwxrws--- 5 mailsystem mailsystem 4.0K Aug 26 02:33 domain.net/ So, now I'm stumped. I hope someone can spot the simple thing I've missed! Thanks. Simon

1 0

Re: [Dovecot] limiting number of incorrect logins per connection
by alex＠ahhyes.net 26 Aug '11

26 Aug '11

Hi, I saw that thread already, however it does not offer any solution that can be applied to dovecot directly. That thread has also been asleep for well over a year. It couldnt be that hard for the author to implement this function. It would only require a few lines of code. ----- Reply message ----- From: "Robert Schetterer" <robert(a)schetterer.org> Date: Fri, Aug 26, 2011 17:59 Subject: [Dovecot] limiting number of incorrect logins per connection To: <dovecot(a)dovecot.org> Am 26.08.2011 09:25, schrieb Alex: > Hi Guys, > > Running Dovecot 2 on my server. It is regularly getting dictionary auth > attacked. What I have noticed is that once connected to a pop3/imap > login session, you can send endless incorrect usernames+passwords > attempts. This is a problem for me... I use fail2ban to try and stop > these script kiddies. The problem is that fail2ban detects the bad > auths, firewalls the IP, however, since it's an "established" session, > the attacker can keep authing away... It's only on a subsequent (new) > connection that the firewalling will take effect. > > Why is there no configuration option such as "max auth attempts per > connection"? This would be useful, so once the limit is reached, the > connection is dropped. > > is there a patch/workaround? > there where equal questions in the past i.e read http://comments.gmane.org/gmane.mail.imap.dovecot/46204 -- Best Regards MfG Robert Schetterer Germany/Munich/Bavaria

1 0

Re: [Dovecot] On IMAP vhost login, only Username being used
by hobie＠rumormillnews.com 26 Aug '11

26 Aug '11

Recapping: I'm working to set up Dovecot 2.0.13 along with some additional software (qmail, vpopmail, squirrelmail). It's working fine with squirrelmail now, but trying to connect over SSL with a Thunderbird variant and using IMAP, authentication fails because Dovecot is trying to match only the front part of the name (the user part), ignoring the domain name part of what it's being sent. So, instead of seeking to match virtual user: joe_blow(a)some_domain.com ...it's trying to match: joe_blow ...and failing, since joe_blow is not a system user but is a virtual host user. With Squirrelmail, connecting from localhost via non-SSL IMAP, the match is handled correctly, no problem. I've run the runtbird.sh script but no light was shed on this by the resulting output, all it said was that authentication was failing. Has anyone else encountered this problem? Any suggestions on how to fix it or where to look for additional info? Thanks kindly. --hobie > I tried the runtbird.sh script, hoping for more info - all it did was show that auth is failing. I don't understand why Dovecot is separating the username from the domain name, and trying to match only on the username. Seems like there must be a config setting that affects this and that I'm overlooking. Thanks ahead for any help with this. > > --hobie > > hobie wrote earlier: > > ===== > > Attempting IMAP SSL login on new installation, using Icedove (Debain Thunderbird variant), login fails. Logs show Dovecot attempting to match username only, not username with domain name, on Vpopmail user, so of course no match. Tried with '@' in full username, also with '%'. What's missing? > > Log shows: > > Aug 24 19:30:48 debian dovecot: auth: Debug: client in: CONT<hidden> Aug 24 19:30:48 debian dovecot: auth: Debug: Loading modules from directory: /usr/local/lib/dovecot/auth > Aug 24 19:30:48 debian dovecot: auth: Debug: vpopmail(postmaster,[IP redacted]): lookup user=postmaster domain= > > Current config: > > # 2.0.13: /usr/local/etc/dovecot/dovecot.conf > # OS: Linux 2.6.32-5-amd64 x86_64 Debian 6.0.2 ext3 > auth_debug = yes > auth_verbose = yes > disable_plaintext_auth = no > first_valid_gid = 89 > first_valid_uid = 89 > mail_debug = yes > mail_location = maildir:/home/vpopmail/domains/%d/%n/Maildir > maildir_very_dirty_syncs = yes > passdb { > driver = vpopmail > } > protocols = imap pop3 > ssl_cert = </etc/ssl/certs/dovecot.pem > ssl_key = </etc/ssl/private/dovecot.pem > userdb { > args = quota_template=quota_rule=*:backend=%q > driver = vpopmail > } > > --hobie > > ===== >

1 0

[Dovecot] Dovecot 2.0.13 How to use POP3 order
by Nick Celebic 26 Aug '11

26 Aug '11

I saw a few commits for 2.0.13 that added MAIL_FETCH_POP3_ORDER, but I haven't been able to find any information on how to use it. I'm migrating from a Merak mail server into dovecot and all the email can be copied directly into a Maildir/cur directory. The filenames are just the timestamps. When I check with dovecot pop3, they seem to be randomly ordered. I'm hoping this provides a solution where it will look at the file list or stat order. If this isn't possible, can someone tell me how I can change the order in which dovecot lists mails in a UIDL in POP3? Thanks, Nick Celebic

2 1

[Dovecot] Catch22: user needs space to fix out of space condition
by Joseph Tam 25 Aug '11

25 Aug '11

A mail user reported that he filled up his INBOX (despite reminders he was approaching his filesystem quota), and furthermore, he could not fix the situation because he couldn't expunge message he marked for deletion. The dovecot logs revealed the cause dovecot: imap(user): Error: open(/var/mail/user.lock) failed: Disc quota exceeded This created an impasse where a user cannot free space because he needs to create a lock file that cannot be created because he needs free space. Is there any way out of this without administrator intervention? Joseph Tam <jtam.home(a)gmail.com>

5 4

[Dovecot] dovecot and maillists problem
by Костырев Александр Алексеевич 25 Aug '11

25 Aug '11

Hello there! I have a little trouble with using dovecot as lmtp and maillists. I use dovecot 2.0.13 with exim 4.72 on Debian 6.0. (All stuff at one host). info of maillists is store in mysql table, for example: +---------+-------------------------------------------------------------------------------------------------+ | name | recipients | +---------+-------------------------------------------------------------------------------------------------+ | Hab_Tax | 2504000067-253601001.253809737993@25.example.org,2721097514-272101001.271300057673@.example.org | +---------+-------------------------------------------------------------------------------------------------+ The problem is: When I send a letter to short maillist (as above) it get the same ID and stored only once in the maildir of one user who is the member of that maillist - that's ok, but When I send a letter to maillist with a large number of recipients it occurred that it's saved more than one, because of the headers added by dovecot lmtp (I've changed host name): diff letter_in_one_user/1314238006.M841940P6916.pink\,S\=12778136\,W\=12953189 letler_in_second_user/new/1314237993.M460165P6916.pink\,S\=12778136\,W\=12953189 3,4c3,4 < by pink.atlas-2.ru (Dovecot) with LMTP id 6UiGJBWuVU4EGwAA1nFjLA < ; Thu, 25 Aug 2011 13:06:46 +1100 --- > by pink.atlas-2.ru (Dovecot) with LMTP id VUeGJBWuVU4EGwAA1nFjLA > ; Thu, 25 Aug 2011 13:06:29 +1100 It's the same letter accept the date and id. What I get in logs is: I see that exim send letters in maillist with one and the same id: ...skipped... 13:06:46 1QwPKe-0001nU-U5 <2502(a)example.org> ... 13:06:47 1QwPKe-0001nU-U5 <2502(a)example.org> ... But in logs of dovecot I see: 13:06:14 msgid=<E1QwPKe-0001nU-U5(a)pink.example.org>: wUWGJBWuVU4EGwAA1nFjLA: 13:06:18 msgid=<E1QwPKe-0001nU-U5(a)pink.example.org>: wEWGJBWuVU4EGwAA1nFjLA: 13:06:22 msgid=<E1QwPKe-0001nU-U5(a)pink.example.org>: JkaGJBWuVU4EGwAA1nFjLA: 13:06:26 msgid=<E1QwPKe-0001nU-U5(a)pink.example.org>: i0aGJBWuVU4EGwAA1nFjLA: 13:06:30 msgid=<E1QwPKe-0001nU-U5(a)pink.example.org>: 8EaGJBWuVU4EGwAA1nFjLA: 13:06:34 msgid=<E1QwPKe-0001nU-U5(a)pink.example.org>: VUeGJBWuVU4EGwAA1nFjLA: 13:06:37 msgid=<E1QwPKe-0001nU-U5(a)pink.example.org>: ukeGJBWuVU4EGwAA1nFjLA: 13:06:42 msgid=<E1QwPKe-0001nU-U5(a)pink.example.org>: H0iGJBWuVU4EGwAA1nFjLA: 13:06:46 msgid=<E1QwPKe-0001nU-U5(a)pink.example.org>: hEiGJBWuVU4EGwAA1nFjLA: 13:06:47 msgid=<E1QwPKe-0001nU-U5(a)pink.example.org>: 6UiGJBWuVU4EGwAA1nFjLA: Also in dovecot log I've noticed that: at first auth is searching info in sql for 200 users then log continues with lmtp's info then auth is searching info in sql for another portion of users and this loop in log continues. Dovecot.conf: http://pastebin.com/ueCBU3bP dovecot.sql: http://pastebin.com/kqCq52mC dovecot.log http://pastebin.com/YiyMWpx1 exim.conf: http://pastebin.com/F4MNQkAx exim.log: http://pastebin.com/wn83TZpX

2 6

[Dovecot] On IMAP vhost login, only Username being used
by hobie＠rumormillnews.com 25 Aug '11

25 Aug '11

Attempting IMAP SSL login on new installation, using Icedove (Debain Thunderbird variant), login fails. Logs show Dovecot attempting to match username only, not username with domain name, on Vpopmail user, so of course no match. Tried with '@' in full username, also with '%'. What's missing? Log shows: Aug 24 19:30:48 debian dovecot: auth: Debug: client in: CONT<hidden> Aug 24 19:30:48 debian dovecot: auth: Debug: Loading modules from directory: /usr/local/lib/dovecot/auth Aug 24 19:30:48 debian dovecot: auth: Debug: vpopmail(postmaster,[IP redacted]): lookup user=postmaster domain= Current config: # 2.0.13: /usr/local/etc/dovecot/dovecot.conf # OS: Linux 2.6.32-5-amd64 x86_64 Debian 6.0.2 ext3 auth_debug = yes auth_verbose = yes disable_plaintext_auth = no first_valid_gid = 89 first_valid_uid = 89 mail_debug = yes mail_location = maildir:/home/vpopmail/domains/%d/%n/Maildir maildir_very_dirty_syncs = yes passdb { driver = vpopmail } protocols = imap pop3 ssl_cert = </etc/ssl/certs/dovecot.pem ssl_key = </etc/ssl/private/dovecot.pem userdb { args = quota_template=quota_rule=*:backend=%q driver = vpopmail } --hobie

2 1

[Dovecot] Post-login scripting with virtual users
by Mark Willcox 25 Aug '11

25 Aug '11

I am running Dovecot 2.0.13 on Fedora 15. I have migrated from a bincimap installation using checklocalpwd. All email is in folders owned by a unprivileged user, popuser. The email users are entirely virtual and have no relationship to actual linux users. My userdb calls return the UID and GID of popuser and all goes well retrieving the mail via POP3 and IMAP. I am trying to implement a Post-login script to register the IP address that the authentication came from. Dovecot seems to be trying to execute the script as the email non-user, which does not work. I have specified that the script should be run as popuser, but it still runs as devnull(a)dhzone.com for instance. Everything up top that point seems to be happening happily under popuser. I added a "user = popuser" directive and it had no effect that I could see. I know that dovecot read the directive because I changed it to "user = 555" and dovecot would not run because "555" is not a user. I tried adding a "User = popuser" within the unix_listener but that also had no effect. Any ideas? Thank you! ------------------------------ Here is my dovecot -n: # 2.0.13: /etc/dovecot/dovecot.conf # OS: Linux 2.6.40.3-0.fc15.x86_64 x86_64 Fedora release 15 (Lovelock) auth_debug = yes disable_plaintext_auth = no mail_debug = yes mbox_write_locks = fcntl passdb { args = /etc/dovecot/conf.d/dovecot-sql.conf.ext driver = sql } protocols = imap pop3 service imap-postpop { executable = script-login /usr/local/bin/set_postpop unix_listener imap-postpop { } user = popuser } service imap { executable = imap imap-postpop } ssl_cert = </etc/pki/dovecot/certs/dovecot.pem ssl_key = </etc/pki/dovecot/private/dovecot.pem userdb { args = /etc/dovecot/conf.d/dovecot-sql.conf.ext driver = sql } ----------------------------------------------------- The dovecot-sql.conf.ext looks like this: driver = mysql connect = host=localhost dbname=webmail user=xxxx password=xxxx password_query = SELECT id AS user, IF( clear IS NULL, CONCAT('{CRYPT}',crypto), CONCAT('{PLAIN}',clear)) AS password \ FROM users WHERE id = '%u' user_query = SELECT home, uid, gid \ FROM users WHERE id = '%u' ------------------------------- >From the maillog: Aug 24 13:01:57 callisto dovecot: auth: Debug: client out: OK#0111#011user=devnull(a)dhzone.com Aug 24 13:01:57 callisto dovecot: auth: Debug: master in: REQUEST... Aug 24 13:01:57 callisto dovecot: auth: Debug: sql(devnull(a)dhzone.com,75.221.209.232): SELECT home, uid, gid FROM users WHERE id = 'devnull(a)dhzone.com' Aug 24 13:01:57 callisto dovecot: auth: Debug: master out: USER#0114007264257#011devnull@dhzone.com#011home=/var/qmail/popbox/dhzone-com/devnull#011uid=555#011gid=555 Aug 24 13:01:57 callisto dovecot: imap-login: Login: user=<devnull(a)dhzone.com>, method=PLAIN, rip=75.221.209.232, lip=76.76.59.241, mpid=667 Aug 24 13:01:57 callisto dovecot: imap-postpop: Error: script-login: Error: user devnull(a)dhzone.com: Error reading configuration: net_connect_unix(/var/run/dovecot/config) failed: Permission denied Aug 24 13:01:57 callisto dovecot: imap-postpop: Error: script-login: Fatal: Internal error occurred. Refer to server log for more information. Aug 24 13:01:57 callisto dovecot: imap(devnull(a)dhzone.com): Post-login script denied access to user devnull(a)dhzone.com Aug 24 13:01:57 callisto dovecot: log: Error: service(imap-postpop): child 668 returned error 89 (Fatal failure) Aug 24 13:02:03 callisto dovecot: master: Warning: Killed with signal 15 (by pid=1 uid=0 code=kill) -- _________________ Mark Willcox Data Helper, Inc.

3 9

[Dovecot] Dovecot rejecting Vpopmail User 89
by hobie＠rumormillnews.com 24 Aug '11

24 Aug '11

I'm working to get Dovecot 2.0.13 working along with qmail, Vpopmail and Squirrelmail on a Debian 6.0.2 system, Dovecot compiled, not from a package. Vpopmail has a widely known assigned user/group ID of 89 and is the owner of all the mail folders. Regardless of value of first_valid_uid (1, 89, other), Dovecot denies Squirrelmail connection, saying it can't allow access to UID 89. "Couldn't drop privileges", it says. I'd be grateful for fixes, suggestions, or a pointer to an existing answer to this problem. Thanks ahead. :) Presently dovecot -n shows: # 2.0.13: /usr/local/etc/dovecot/dovecot.conf # OS: Linux 2.6.32-5-amd64 x86_64 Debian 6.0.2 ext3 auth_debug = yes disable_plaintext_auth = no mail_debug = yes mail_location = maildir:/home/vpopmail/domains/%d/%n/Maildir maildir_very_dirty_syncs = yes passdb { driver = vpopmail } protocols = imap pop3 ssl_cert = </etc/ssl/certs/dovecot.pem ssl_key = </etc/ssl/private/dovecot.pem userdb { driver = passwd } userdb { args = quota_template=quota_rule=*:backend=%q driver = vpopmail } --hobie

3 5

Re: [Dovecot] Dovecot rejecting Vpopmail User 89
by Rick Romero 24 Aug '11

24 Aug '11

Enable auth_verbose and check the logs. But I'm pretty sure that means Dovecot can't change to the Maildir folder. I assume the user's folder is owned by vpopmail:vchkpw? Is the Maildir NFS mounted or local? Rick Quoting hobie(a)rumormillnews.com: > Thanks, Rick. :) Changed first/last uid/gid so all show 89 and restarted > Dovecot, no change. Telnetting from remote or from localhost, Dovecot > closes the connection immediately after password is sent. (?) > > --hobie > >> Quoting hobie(a)rumormillnews.com: >> >>> I'm working to get Dovecot 2.0.13 working along with qmail, Vpopmail and >>> Squirrelmail on a Debian 6.0.2 system, Dovecot compiled, not from a >>> package. >>> >>> Vpopmail has a widely known assigned user/group ID of 89 and is the >>> owner >>> of all the mail folders. >>> >>> Regardless of value of first_valid_uid (1, 89, other), Dovecot denies >>> Squirrelmail connection, saying it can't allow access to UID 89. >>> "Couldn't >>> drop privileges", it says. I'd be grateful for fixes, suggestions, or a >>> pointer to an existing answer to this problem. Thanks ahead. :) >>> >> >> Here's mine - I set first and last uid AND gid. >> Can you telnet to port 110 and test? >> >> USER username >> PASS password >> LIST >> >> >> # 2.0.13: /usr/local/etc/dovecot/dovecot.conf >> # OS: FreeBSD 8.2-RELEASE amd64 >> auth_mechanisms = plain login digest-md5 cram-md5 >> auth_username_translation = %@ >> auth_verbose = yes >> base_dir = /var/run/dovecot/ >> default_login_user = vpopmail >> disable_plaintext_auth = no >> first_valid_gid = 89 >> first_valid_uid = 89 >> last_valid_gid = 89 >> last_valid_uid = 89 >> # run under tcpserver >> log_path = /dev/stderr >> login_greeting = Ready. >> mail_fsync = never >> mail_plugins = " quota zlib" >> mail_privileged_group = mail >> namespace { >> inbox = yes >> location = >> prefix = >> separator = . >> } >> namespace { >> hidden = yes >> inbox = no >> list = no >> location = >> prefix = INBOX. >> separator = . >> } >> passdb { >> driver = vpopmail >> } >> plugin { >> quota = maildir >> } >> protocols = imap pop3 >> service anvil { >> client_limit = 2000 >> } >> service auth { >> unix_listener auth-master { >> mode = 0600 >> } >> } >> service imap-login { >> client_limit = 384 >> process_limit = 512 >> process_min_avail = 25 >> service_count = 0 >> } >> service imap-postlogin { >> executable = script-login rawlog >> /usr/local/etc/dovecot/lastauth-imap.sh >> user = vpopmail >> } >> service imap { >> executable = /usr/local/libexec/dovecot/imap >> } >> service pop-postlogin { >> executable = script-login /usr/local/etc/dovecot/lastauth-pop.sh >> user = vpopmail >> } >> service pop3-login { >> client_limit = 384 >> process_limit = 512 >> process_min_avail = 25 >> service_count = 0 >> } >> service pop3 { >> executable = /usr/local/libexec/dovecot/pop3 >> } >> shutdown_clients = no >> ssl_cert = </etc/ssl/mail.pem >> ssl_key = </etc/ssl/mail.key >> ssl_key_password = password >> userdb { >> driver = vpopmail >> } >> verbose_proctitle = yes >> protocol imap { >> auth_socket_path = /var/run/dovecot/auth-master >> imap_client_workarounds = delay-newmail tb-extra-mailbox-sep >> mail_max_userip_connections = 10 >> mail_plugins = " quota zlib imap_zlib quota imap_quota" >> } >> protocol pop3 { >> auth_socket_path = /var/run/dovecot/auth-master >> mail_max_userip_connections = 10 >> mail_plugins = quota >> pop3_client_workarounds = outlook-no-nuls oe-ns-eoh >> pop3_uidl_format = %08Xu%08Xv >> >> >>

1 0

[Dovecot] BUG - lmtp multiple recipients fail - setuid issue?
by Boris Lordis 24 Aug '11

24 Aug '11

Hello, I am not having much luck on this particular issue so I wanted to make sure that this is registered as a potential bug. The essence of the problem is that for a given message addressed to multiple users, lmtp writes the message correctly to the first addressed user only, then subsequent user writes fail as the lmtp process doesn't run with the proper permissions and tries to link files from different users as part of its message writing. Below you can see that lmtp (running with steve's id, who was the first listed recipient) is trying to link a file in jerry's inbox meeting with failure: Jul 27 11:24:42 testmailserver dovecot: lmtp(12412, steve): Error: link(/spool/mail/j/jerry/mail/INBOX/u.20423, /spool/mail/s/steve/mail/INBOX/.temp.1311791081.P12412Q2M989550.testmailserver.) failed: Permission denied Jul 27 11:24:42 testmailserver dovecot: lmtp(12412, steve): +1IXBeVXME58MAAARoVNxQ: msgid <201107271824.p6RIOPa5020900 at backup.>: save failed to INBOX: Internal error occurred. Refer to server log for more information. [2011-07-27 11:24:41] Best regards, -Boris I am using version 2.0.13. dovecot -n shows this: # 2.0.13: /etc/dovecot/dovecot.conf # OS: Linux 2.6.32-71.29.1.el6.i686 i686 CentOS Linux release 6.0 (Final) ext4 auth_debug = yes auth_master_user_separator = * auth_verbose = yes auth_verbose_passwords = plain lda_mailbox_autocreate = yes mail_debug = yes mail_location = sdbox:/spool/mail/%1Ln/%Ln/mail:INBOX=/spool/mail/%1Ln/%Ln/mail/INBOX mbox_write_locks = fcntl passdb { args = /etc/dovecot/master-users driver = passwd-file master = yes } passdb { args = failure_show_msg=yes driver = pam } plugin { autocreate = INBOX autosubscribe = INBOX } service lmtp { inet_listener ltmp { port = 24 } } ssl_cert = </etc/pki/dovecot/certs/dovecot.pem ssl_key = </etc/pki/dovecot/private/dovecot.pem userdb { args = home=/spool/mail/%1Ln/%Ln driver = passwd } protocol lmtp { mail_plugins = " autocreate" }

2 2

[Dovecot] SiS
by Guy Deleeuw 24 Aug '11

24 Aug '11

Hello, SiS is implemented and stable in the last version ? Best Regards Guy

1 0

[Dovecot] Attachments not removed from single store
by Karsten Becker 24 Aug '11

24 Aug '11

Hi. Well, I've the next problem. I turned on the new attachment de-duplication stuff in the configuration. If I send an attchment between two accounts on my test system, the attment gets saved ion the configured mail_attachment_dir. But... if I delete it from the senders Send folder and the receivers Inbox (and of course empty Trash afterwards in both cases), the hashes and the attachment are not deleted in mail_attachment_dir (as I would expect). Is this a bug, or have I misunderstood the concept of storing attachments? Regards Karsten ------------------------------------------------ > # 2.0.13: /usr/local/dovecot-2.0.13/etc/dovecot/dovecot.conf > # OS: Linux 2.6.32-33-server x86_64 Ubuntu 10.04.3 LTS ext4 > doveconf: Warning: Dovecot was last started using /etc/dovecot/dovecot.conf, but this config is /usr/local/dovecot-2.0.13/etc/dovecot/dovecot.conf > auth_cache_negative_ttl = 0 > auth_cache_size = 10 M > auth_mechanisms = plain login > base_dir = /usr/local/dovecot/var/run/dovecot > dict { > acl = mysql:/etc/dovecot/dovecot-dict-shared-mailboxes-mysql.conf > expire = mysql:/etc/dovecot/dovecot-dict-expire-mysql.conf > quota = mysql:/etc/dovecot/dovecot-dict-quota-mysql.conf > } > log_timestamp = "%Y-%m-%d %H:%M:%S " > login_greeting = Company Institute > mail_attachment_dir = /srv/vmail/attachments > mail_attachment_hash = %{sha256} > mail_cache_min_mail_count = 2 > mail_debug = yes > mail_location = mdbox:/srv/vmail/user-mailboxes/%d/%n > mail_plugins = acl expire quota > mailbox_idle_check_interval = 1 mins > namespace { > inbox = yes > location = > prefix = > separator = / > subscriptions = yes > type = private > } > namespace { > list = children > location = mdbox:/srv/vmail/user-mailboxes/%%d/%%n > prefix = Users/%%d/%%n/ > separator = / > subscriptions = no > type = shared > } > namespace { > list = children > location = maildir:/srv/vmail/public_folders:INDEX=/srv/vmail/user-mailboxes/%d/%n/public_folders-seen:LAYOUT=fs > prefix = Folders/ > separator = / > subscriptions = no > type = public > } > passdb { > args = /etc/dovecot/dovecot-mysql.conf > driver = sql > } > plugin { > acl = vfile:/etc/dovecot/global-acls:cache_secs=300 > acl_shared_dict = proxy::acl > expire = Trash > expire2 = Trash/* > expire3 = Spam > expire4 = Spam/* > expire5 = Junk > expire6 = Junk/* > expire_dict = proxy::expire > quota = dict:User quota::proxy::quota > quota_rule = *:storage=10485760 > quota_rule2 = Trash:storage=+1048576 > quota_warning = storage=95%% quota-warning 95 %u > quota_warning2 = storage=80%% quota-warning 80 %u > } > postmaster_address = postmaster(a)company.eu > protocols = imap pop3 > service auth { > unix_listener /var/spool/postfix/private/auth_dovecot { > group = postfix > mode = 0660 > user = postfix > } > unix_listener auth-master { > mode = 0600 > user = vmail > } > user = root > } > service dict { > unix_listener dict { > mode = 0600 > user = vmail > } > } > service imap-login { > inet_listener imaps { > port = 993 > ssl = yes > } > process_min_avail = 2 > } > service imap { > vsz_limit = 512 M > } > service pop3-login { > inet_listener pop3s { > port = 995 > ssl = yes > } > } > service quota-warning { > executable = script /usr/local/bin/quota-warning.sh > user = vmail > } > ssl = required > ssl_cert = </etc/postfix/ssl/mail01.compdmz.local.crt > ssl_key = </etc/postfix/ssl/mail01.compdmz.local.key > userdb { > args = /etc/dovecot/dovecot-mysql.conf > driver = sql > } > verbose_proctitle = yes > protocol lda { > auth_socket_path = auth-master > postmaster_address = postmaster(a)company.eu > } > protocol imap { > imap_client_workarounds = delay-newmail tb-lsub-flags tb-extra-mailbox-sep > imap_max_line_length = 128 k > mail_plugins = acl expire quota imap_acl imap_quota > } > protocol pop3 { > pop3_client_workarounds = outlook-no-nuls oe-ns-eoh > }

2 2

[Dovecot] Bug report v2.0.13 - CentOS x86_64 - NFS - mbox
by Kostas Zorbadelos 24 Aug '11

24 Aug '11

Greetings to all. It's my first post to the list. We just completed a migration from qpopper to dovecot for our IMAP and POP3 services. We have a rather large mail environment (we are the biggest provider in Greece). So, here are the details: - Keep getting errors like these in our production environment Jul 22 00:18:21 pop01 dovecot: master: Error: service(pop3): child 4078 killed with signal 11 (core dumps disabled) Jul 22 00:19:31 pop03 dovecot: master: Error: service(pop3): child 18849 killed with signal 11 (core dumps disabled) --------------------------------------------------------------------- dovecot -n output --------------------------------------------------------------------- /opt/dovecot/sbin/dovecot -n # 2.0.13: /opt/dovecot/etc/dovecot/dovecot.conf # OS: Linux 2.6.18-92.1.22.el5 x86_64 CentOS release 5.5 (Final) auth_cache_negative_ttl = 10 mins auth_cache_size = 5 M auth_cache_ttl = 10 mins auth_verbose = yes default_client_limit = 5000 default_process_limit = 500 disable_plaintext_auth = no first_valid_uid = 200 listen = * log_timestamp = "%Y-%m-%d %H:%M:%S " login_greeting = <COMPANY> ready mail_access_groups = mail otemail disk root mail_fsync = always mail_location = mbox:INDEX=/var/index/dovecot/%2.16Hn/%2.254Hn/%u mail_nfs_storage = yes mbox_lock_timeout = 2 mins mbox_min_index_size = 200 k mbox_read_locks = dotlock_try fcntl mbox_write_locks = dotlock_try fcntl passdb { args = /opt/dovecot/etc/dovecot/dovecot-ldap.conf.ext driver = ldap } protocols = imap pop3 service auth-worker { user = dovenull } service imap-login { inet_listener imap { port = 143 } inet_listener imaps { port = 993 ssl = yes } } service pop3-login { inet_listener pop3 { port = 110 } inet_listener pop3s { port = 995 ssl = yes } } ssl = no userdb { args = /opt/dovecot/etc/dovecot/dovecot-ldap.conf.ext driver = ldap } verbose_proctitle = yes protocol imap { imap_client_workarounds = delay-newmail tb-extra-mailbox-sep mail_max_userip_connections = 100 } protocol pop3 { mail_max_userip_connections = 100 pop3_client_workarounds = outlook-no-nuls oe-ns-eoh pop3_fast_size_lookups = yes pop3_lock_session = yes pop3_reuse_xuidl = yes pop3_uidl_format = %08Xu%08Xv } I enabled core dumps in one of our backend servers and here is the relevant gdb trace: [root@pop08 ~]# gdb /opt/dovecot/libexec/dovecot/pop3 <path_to_core_file>/core.9273 GNU gdb (GDB) Red Hat Enterprise Linux (7.0.1-32.el5_6.2) Copyright (C) 2009 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html> This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type "show copying" and "show warranty" for details. This GDB was configured as "x86_64-redhat-linux-gnu". For bug reporting instructions, please see: <http://www.gnu.org/software/gdb/bugs/>... Reading symbols from /opt/dovecot/libexec/dovecot/pop3...(no debugging symbols found)...done. Reading symbols from /opt/dovecot/lib/dovecot/libdovecot-storage.so.0...(no debugging symbols found)...done. Loaded symbols for /opt/dovecot/lib/dovecot/libdovecot-storage.so.0 Reading symbols from /opt/dovecot/lib/dovecot/libdovecot.so.0...(no debugging symbols found)...done. Loaded symbols for /opt/dovecot/lib/dovecot/libdovecot.so.0 Reading symbols from /lib64/libdl.so.2...(no debugging symbols found)...done. Loaded symbols for /lib64/libdl.so.2 Reading symbols from /lib64/librt.so.1...(no debugging symbols found)...done. Loaded symbols for /lib64/librt.so.1 Reading symbols from /lib64/libc.so.6...(no debugging symbols found)...done. Loaded symbols for /lib64/libc.so.6 Reading symbols from /lib64/ld-linux-x86-64.so.2...(no debugging symbols found)...done. Loaded symbols for /lib64/ld-linux-x86-64.so.2 Reading symbols from /lib64/libpthread.so.0...(no debugging symbols found)...done. Loaded symbols for /lib64/libpthread.so.0 Core was generated by `dovecot/pop3'. Program terminated with signal 11, Segmentation fault. #0 0x00002b52e1027e54 in istream_raw_mbox_get_start_offset () from /opt/dovecot/lib/dovecot/libdovecot-storage.so.0 (gdb) bt full #0 0x00002b52e1027e54 in istream_raw_mbox_get_start_offset () from /opt/dovecot/lib/dovecot/libdovecot-storage.so.0 No symbol table info available. #1 0x00002b52e102b759 in ?? () from /opt/dovecot/lib/dovecot/libdovecot-storage.so.0 No symbol table info available. #2 0x00002b52e100a2c0 in index_mail_expunge () from /opt/dovecot/lib/dovecot/libdovecot-storage.so.0 No symbol table info available. #3 0x0000000000405e9c in client_update_mails () No symbol table info available. #4 0x00000000004061c1 in client_command_execute () No symbol table info available. #5 0x00000000004045b9 in client_handle_input () No symbol table info available. #6 0x00002b52e12df698 in io_loop_call_io () from /opt/dovecot/lib/dovecot/libdovecot.so.0 No symbol table info available. #7 0x00002b52e12e09d5 in io_loop_handler_run () from /opt/dovecot/lib/dovecot/libdovecot.so.0 No symbol table info available. #8 0x00002b52e12df62d in io_loop_run () from /opt/dovecot/lib/dovecot/libdovecot.so.0 No symbol table info available. #9 0x00002b52e12cdf13 in master_service_run () from /opt/dovecot/lib/dovecot/libdovecot.so.0 No symbol table info available. #10 0x0000000000403994 in main () No symbol table info available. (gdb) All traces of the crashes are identical, that is #0 0x00002b52e1027e54 in istream_raw_mbox_get_start_offset () from /opt/dovecot/lib/dovecot/libdovecot-storage.so.0 #1 0x00002b52e102b759 in ?? () from /opt/dovecot/lib/dovecot/libdovecot-storage.so.0 #2 0x00002b52e100a2c0 in index_mail_expunge () from /opt/dovecot/lib/dovecot/libdovecot-storage.so.0 #3 0x0000000000405e9c in client_update_mails () #4 0x00000000004061c1 in client_command_execute () #5 0x00000000004045b9 in client_handle_input () #6 0x00002b52e12df698 in io_loop_call_io () from /opt/dovecot/lib/dovecot/libdovecot.so.0 #7 0x00002b52e12e09d5 in io_loop_handler_run () from /opt/dovecot/lib/dovecot/libdovecot.so.0 #8 0x00002b52e12df62d in io_loop_run () from /opt/dovecot/lib/dovecot/libdovecot.so.0 #9 0x00002b52e12cdf13 in master_service_run () from /opt/dovecot/lib/dovecot/libdovecot.so.0 #10 0x0000000000403994 in main () We have mboxes over NFS and we also have an ldap user backend. For now, I do not have a scenario that reproduces the problem. Any idea, or input are highly appreciated. Of course I can provide any information requested (without exposing restricted company or client data) to help trace the problem and lead to the solution. Thanks and keep up the good work! Regards, Kostas Zorbadelos

3 8

[Dovecot] Cannot delete subfolder in public folder
by Karsten Becker 24 Aug '11

24 Aug '11

Hi there, I have the problem that I'm unable to delete a subfolder (again) I created within a public folder. I've already read about configuring Thunderbird to delete immediately - which I did. But it still doesn't work. I delete -> the folder is gone -> I get a TB error message saying "The folder doesn't exist" -> after restarting TB the folders appear again. Maybe someone has a hint. My tip is that I may have a wrong understanding of the ACL mechanism... :-( Regards from Berlin/Germany Karsten ------------------------ Log: > Aug 24 00:01:37 mail01 dovecot: imap(karsten.becker(a)company.eu): Debug: acl vfile: file /etc/dovecot/global-acls//.DEFAULT not found > Aug 24 00:01:37 mail01 dovecot: imap(karsten.becker(a)company.eu): Debug: acl vfile: file /srv/vmail/user-mailboxes/company.eu/karsten.becker/mailboxes/dovecot-acl not found > Aug 24 00:01:37 mail01 dovecot: imap(karsten.becker(a)company.eu): Debug: acl vfile: file /etc/dovecot/global-acls/Folders/test01/aaa not found > Aug 24 00:01:37 mail01 dovecot: imap(karsten.becker(a)company.eu): Debug: acl vfile: reading file /srv/vmail/public_folders/test01/aaa/dovecot-acl Here's the filesystem structure in /srv/vmail: > root@mail01.compdmz.local:/srv/vmail# ls -l public_folders/test01/ > total 20 > drwxr-xr-x 5 vmail vmail 4096 2011-08-23 23:50 aaa > drwxr-xr-x 2 vmail vmail 4096 2011-08-23 21:45 cur > -rw-r--r-- 1 vmail vmail 25 2011-08-23 22:19 dovecot-acl > drwxr-xr-x 2 vmail vmail 4096 2011-08-23 21:45 new > drwxr-xr-x 2 vmail vmail 4096 2011-08-23 21:45 tmp > root@mail01.compdmz.local:/srv/vmail# Here's the content of dovecot-acl (there are another ones in subfolder aaa with the same content, inherited during creation): > authenticated lrwstipekx Here's my configuration of Dovecot: > # 2.0.13: /usr/local/dovecot-2.0.13/etc/dovecot/dovecot.conf > # OS: Linux 2.6.32-33-server x86_64 Ubuntu 10.04.3 LTS ext4 > doveconf: Warning: Dovecot was last started using /etc/dovecot/dovecot.conf, but this config is /usr/local/dovecot-2.0.13/etc/dovecot/dovecot.conf > auth_cache_negative_ttl = 0 > auth_cache_size = 10 M > auth_mechanisms = plain login > base_dir = /usr/local/dovecot/var/run/dovecot > dict { > acl = mysql:/etc/dovecot/dovecot-dict-shared-mailboxes-mysql.conf > expire = mysql:/etc/dovecot/dovecot-dict-expire-mysql.conf > quota = mysql:/etc/dovecot/dovecot-dict-quota-mysql.conf > } > log_timestamp = "%Y-%m-%d %H:%M:%S " > login_greeting = Company Institute > mail_attachment_dir = /srv/vmail/attachments > mail_attachment_hash = %{sha256} > mail_cache_min_mail_count = 2 > mail_debug = yes > mail_location = mdbox:/srv/vmail/user-mailboxes/%d/%n > mail_plugins = acl expire quota > mailbox_idle_check_interval = 1 mins > namespace { > inbox = yes > location = > prefix = > separator = / > subscriptions = yes > type = private > } > namespace { > list = children > location = mdbox:/srv/vmail/user-mailboxes/%%d/%%n > prefix = Users/%%d/%%n/ > separator = / > subscriptions = no > type = shared > } > namespace { > list = children > location = maildir:/srv/vmail/public_folders:INDEX=/srv/vmail/user-mailboxes/%d/%n/public_folders-seen:LAYOUT=fs > prefix = Folders/ > separator = / > subscriptions = no > type = public > } > passdb { > args = /etc/dovecot/dovecot-mysql.conf > driver = sql > } > plugin { > acl = vfile:/etc/dovecot/global-acls:cache_secs=300 > acl_shared_dict = proxy::acl > expire = Trash > expire2 = Trash/* > expire3 = Junk > expire4 = Junk/* > expire_dict = proxy::expire > quota = dict:User quota::proxy::quota > quota_rule = *:storage=10485760 > quota_rule2 = Trash:storage=+1048576 > quota_warning = storage=95%% quota-warning 95 %u > quota_warning2 = storage=80%% quota-warning 80 %u > } > postmaster_address = postmaster(a)company.eu > protocols = imap pop3 > service auth { > unix_listener /var/spool/postfix/private/auth_dovecot { > group = postfix > mode = 0660 > user = postfix > } > unix_listener auth-master { > mode = 0600 > user = vmail > } > user = root > } > service dict { > unix_listener dict { > mode = 0600 > user = vmail > } > } > service imap-login { > inet_listener imaps { > port = 993 > ssl = yes > } > process_min_avail = 2 > } > service imap { > vsz_limit = 512 M > } > service pop3-login { > inet_listener pop3s { > port = 995 > ssl = yes > } > } > service quota-warning { > executable = script /usr/local/bin/quota-warning.sh > user = vmail > } > ssl = required > ssl_cert = </etc/postfix/ssl/mail01.compdmz.local.crt > ssl_key = </etc/postfix/ssl/mail01.compdmz.local.key > userdb { > args = /etc/dovecot/dovecot-mysql.conf > driver = sql > } > verbose_proctitle = yes > protocol lda { > auth_socket_path = auth-master > postmaster_address = postmaster(a)company.eu > } > protocol imap { > imap_client_workarounds = delay-newmail > imap_max_line_length = 128 k > mail_plugins = acl expire quota imap_acl imap_quota > } > protocol pop3 { > pop3_client_workarounds = outlook-no-nuls oe-ns-eoh > }

2 3

[Dovecot] acl with hierarchy separators mismatched config
by YAEGASHI Takeshi 24 Aug '11

24 Aug '11

Hi there, I'm testing dovecot 2.0.13 on Debian squeeze (deb from http://xi.rename-it.nl/debian) with the following doveconf -n. -------- # 2.0.13 (1449a2e2c1f5): /etc/dovecot/dovecot.conf # OS: Linux 2.6.26-2-openvz-amd64 i686 Debian 6.0.2 first_valid_uid = 8 mail_debug = yes mail_location = maildir:~/Maildir mail_plugins = listescape mail_log notify acl namespace { inbox = yes location = prefix = separator = / type = private } namespace { list = children location = maildir:/var/mail/public:INDEX=~/Maildir/public prefix = Public/ separator = / subscriptions = no type = public } passdb { driver = pam } plugin { acl = vfile } protocols = " imap" ssl = no userdb { args = uid=mail gid=mail home=/var/mail/private/%u driver = static } protocol imap { mail_plugins = listescape mail_log notify acl imap_acl } -------- My primary interest is acl and listescape enabled folders in the public namespace. I've chosen "/" as the hierarchy separator to support folder names with dots ("."). /var/mail/public is a maildir with the maildir++ layout where the separator is a dot ("."). So I set up intial acls and folders as follows: -------- # mkdir /var/mail/public # echo 'anyone lra' >/var/mail/public/dovecot-acl # maildirmake.dovecot /var/mail/public/.aaa # echo 'anyone lrwstipekxa' >/var/mail/public/.aaa/dovecot-acl # chown -R mail.mail /var/mail/public -------- But my attempt to create a mailbox under Public/aaa fails with "Permission denied". -------- # imtest -a yaegashi localhost S: * OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE AUTH=PLAIN] Dovecot ready. C: C01 CAPABILITY S: * CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE AUTH=PLAIN S: C01 OK Pre-login capabilities listed, post-login capabilities have more. Please enter your password: C: A01 AUTHENTICATE PLAIN ?????????????????/ S: * CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE SORT SORT=DISPLAY THREAD=REFERENCES THREAD=REFS MULTIAPPEND UNSELECT CHILDREN NAMESPACE UIDPLUS LIST-EXTENDED I18NLEVEL=1 CONDSTORE QRESYNC ESEARCH ESORT SEARCHRES WITHIN CONTEXT=SEARCH LIST-STATUS ACL RIGHTS=texk S: A01 OK Logged in Authenticated. Security strength factor: 0 . getacl Public * ACL "Public" "anyone" alr . OK Getacl completed. . getacl Public/aaa * ACL "Public/aaa" "anyone" akxeilprwtscd . OK Getacl completed. . create Public/aaa/bbb . NO [NOPERM] Permission denied -------- If the layout of /var/mail/public switched to "fs" where the separator is "/", mailbox creation succeeds as expected. -------- namespace { list = children location = maildir:/var/mail/public:INDEX=~/Maildir/public:LAYOUT=fs prefix = Public/ separator = / subscriptions = no type = public } -------- -------- # maildirmake.dovecot /var/mail/public/aaa # echo 'anyone lrwstipekxa' >/var/mail/public/aaa/dovecot-acl # chown -R mail.mail /var/mail/public # imtest -a yaegashi localhost .... . getacl Public * ACL "Public" "anyone" alr . OK Getacl completed. . getacl Public/aaa * ACL "Public/aaa" "anyone" akxeilprwtscd . OK Getacl completed. . create Public/aaa/bbb . OK Create completed. . getacl Public/aaa/bbb * ACL "Public/aaa/bbb" "anyone" akxeilprwtscd . OK Getacl completed. . create Public/aaa/1.2.3 . OK Create completed. . create Public/aaa/cur . NO Invalid mailbox name: Public/aaa/cur -------- Is this behavior expected? Misconfiguration or dovecot bug? I prefer the maildir++ layout with listescape as it's reserved-folder-name free (eg. cur new tmp). Regards, -- YAEGASHI Takeshi <yaegashi(a)debian.org>

2 2

[Dovecot] LDA and auth-userdb socket permissions
by a.smith＠ukgrid.net 24 Aug '11

24 Aug '11

Hi, just wanted to check this as the wiki seems to have contradictory information. With respect to running the LDA as multiple UIDs the wiki says: [QUOTE]If you're using more than one UID for users, you're going to have problems running dovecot-lda, as most MTAs won't let you run dovecot-lda as root[/QUOTE] But in the example for the config file the text reads: [QUOTE] service auth { unix_listener auth-userdb { mode = 0600 user = vmail # User running dovecot-lda #group = vmail # Or alternatively mode 0660 + dovecot-lda user in this group } } [/QUOTE] So it says you can stick the LDA user just in the (vmail or whatever) group and that is enough. So you aren't restricted to a single UID for access anymore... I tested this and the later did not work, that is if I put my LDA user in the group for the auth-userdb socket with permissions 0660 I got an error back from dovecot saying that the owner was incorrect. So, as it stands I guess the bit about setting group should be removed from the wiki? Secondly, why doesn't this currently work? Why is the owner all important? thanks Andy.

3 13

[Dovecot] dovecot and tcpwrappers
by Kees Lemmens 23 Aug '11

23 Aug '11

Hi, I used dovecot 1.x for quite a while and it worked fine. However, I used it through inetd and used hosts.allow/deny to restrict access to only certain groups of systems. Since yesterday I have dovecot 2.0.13. But in version 2.0.13 it seems that starting using inetd doesn't work anymore : I only get a strange error message if I try to connect using telnet : telnet localhost imap doveconf: Fatal: execvp(imap-login) failed: No such file or directory I tried a lot of things but couldn't get it going over inetd so I decided to start it directly using an init script, also because you say in the wiki this is (now) the preferred method. That indeed works fine, but I realised today that dovecot is now completely ignoring all my hosts.allow/deny settings and so is worldwide accessible ! Is dovecot indeed ignoring hosts.allow/deny ? And if so, how can I have the same amount of protection as I previously had with dovecot 1.x over inetd ? BTW: I tried to post on the mailinglist but it seems I can't access them it the moment, altough I did subscribe and login. Is there anything wrong ? Thanks for your reply ! -- With best regards, Kees Lemmens. ----------------------------------------------------------------------- Delft Institute of Applied Mathematics (DIAM), Faculty Electrical Engineering, Mathematics and Computer Science, Delft University of Technology, Delft, The Netherlands,

3 5