- dovecot - dovecot.org

Re: [Dovecot] Under POP attack - now to prevent?
by James Brown 30 Jun '09

30 Jun '09

On 05/06/2009, at 4:19 PM, James Brown wrote: > > Thanks to Curtis and others who replied. > > I managed to block the IP at our Firewall (learnt a few quirky > things about Astaro Security Gateway on the way!) > > In order to automate the process, Fail2Ban has been suggested. I > know this is getting a bit off topic, but has anyone installed in > Mac OS X 10.5.7? There is a how-to for 10.4 ( HOWTO Mac OS X Server > (10.4) - Fail2ban )- does this work unchanged in 10.5? > > Anyone managed to get Fail2Ban working on Leopard with Dovecot 1.2 > RC4? I'll answer my own question! There is a OS X Installer file at: LSA Mac OS X Ported and Developed Software | LSA Information Technology | University of Michigan Any regex experts out there that can help me set up Fail2Ban to stop this? Jun 5 11:48:20 mail dovecot[2620]: pop3-login: Aborted login (auth failed, 1 attempts): user=<audrey>, method=PLAIN, rip=85.189.169.94, lip=192.168.1.9 Jun 5 11:48:24 mail dovecot[2620]: pop3-login: Aborted login (auth failed, 1 attempts): user=<august>, method=PLAIN, rip=85.189.169.94, lip=192.168.1.9 Jun 5 11:48:24 mail dovecot[2620]: pop3-login: Aborted login (auth failed, 1 attempts): user=<autumn>, method=PLAIN, rip=85.189.169.94, lip=192.168.1.9 Jun 5 11:48:25 mail dovecot[2620]: pop3-login: Aborted login (auth failed, 1 attempts): user=<austin>, method=PLAIN, rip=85.189.169.94, lip=192.168.1.9 Jun 5 11:48:27 mail dovecot[2620]: pop3-login: Aborted login (auth failed, 1 attempts): user=<audrey>, method=PLAIN, rip=85.189.169.94, lip=192.168.1.9 Jun 5 11:48:28 mail dovecot[2620]: pop3-login: Aborted login (auth failed, 1 attempts): user=<autumn>, method=PLAIN, rip=85.189.169.94, lip=192.168.1.9 Jun 5 11:48:30 mail dovecot[2620]: pop3-login: Aborted login (auth failed, 1 attempts): user=<august>, method=PLAIN, rip=85.189.169.94, lip=192.168.1.9 Jun 5 11:48:31 mail dovecot[2620]: pop3-login: Aborted login (auth failed, 1 attempts): user=<autumn>, method=PLAIN, rip=85.189.169.94, lip=192.168.1.9 Many thanks, James.

2 1

[Dovecot] No folders listed in felamimail
by Jonathan Knight 30 Jun '09

30 Jun '09

Egroupware 1.4.004 I thought I try and solve a long standing bug we've had with felamimail not listing folders from our dovecot server. Watching dovecot's packet dumps I'm seeing dovecot do a namespace call and the a list call. Felamimail does a namespace and gets back * NAMESPACE (("" "/")) NIL NIL which is how I've configured dovecot to keep the client configuration very simple. Now Felamimail does a LIST "" "" which gets no folders returned and is obviously why it won't show anything in the felamimail display. I was expecting felamimail to do something more like: LIST "" "%" or LIST "" "*" Is there something I need to configure to make felamimail happy with our dovecot configuration? We use dovecot with outlook express, thunderbird (1,2,3), Mozilla, squirrelmail, iPod, iPhone and symbian with no issues so I'm tending towards felamimail being the source of the problem. Jon.

1 0

[Dovecot] Location of sieve_global_dir setting
by Rainer Frey 30 Jun '09

30 Jun '09

Hi, I'm a bit confused by the Wiki. Do the settings "sieve_dir" and "sieve_global_dir" belong to the lda or the plugin section (Dovecot 1.1.11)? Thanks Rainer

2 1

[Dovecot] SSL / TLS
by Carlos Williams 30 Jun '09

30 Jun '09

I am running Postfix and Dovecot on my mail server. I am required now to have SSL/TLS on my mail server. I did check and found out that I have a SSL certificate with Verisign issued to my mail servers FQDN. Now my question is when reading the Dovecot Wiki, I noticed it said that it is not common to use SSL but rather TLS on most mail servers. Even though SSL will work, which should I use on my server? We already have a purchased SSL certificate but does that really matter? Should I simply just revoke that certificate & use TLS instead? So when I read this link: http://wiki.dovecot.org/SSL/DovecotConfiguration Is it talking about a actual SSL certificate or TLS? Thanks for any clarification! - Carlos

8 12

[Dovecot] Users with large (4GB) inboxes crippling dovecot
by robforrest 29 Jun '09

29 Jun '09

Hi all, I'm new here and would very much appreciate any help you can give me. We are running a rather outdated mail server that until recently has been running beautifully. Under the pretense of "it is ain't broke, don't fix it" it hasn't been updated so is running Fedora Core 4 and dovecot v0.99.14. What is happening is that as users log in (via thunderbird), they are shown the contents of their mailboxes. However, when they try and access a given email, they get no response even if they wait upwards of 10 minutes. I believe that the problem has arisen from their huge inboxes, several users have inboxes in excess of 4GB. Do any of you know how I could split these large mbox files down in to manageable chunks of 1GB? Please be aware that I only have remote access to the server over a modest internet connection. Thanks again for any suggestions. Rob -- View this message in context: http://www.nabble.com/Users-with-large-%284GB%29-inboxes-crippling-dovecot-… Sent from the Dovecot mailing list archive at Nabble.com.

16 28

[Dovecot] Recommended Groupware?
by it-dovecot＠ml.epigenomics.com 29 Jun '09

29 Jun '09

Hi, is there a recommended groupware (email + calendar + address book + syncing with mobile devices) on top of an existing dovecot installation? Most existing commercially supported groupwares come with their own mail storage engine. I would like to keep dovecot as the email storage engine because of the maildir format which greatly helps with backup & restore. Regards -- Robert Sander

3 2

[Dovecot] Dovecot Expire doesn't work
by Stef Simoens 29 Jun '09

29 Jun '09

Hello, I'm using dovecot and I want to use the "expire" plugin. However, it doesn't work, i.e. mails do not get deleted. I ran `/usr/sbin/dovecot --exec-mail ext /usr/libexec/dovecot/expire-tool --test` and besides printing Info: stef/Trash: no messages left Info: stef/Spam: no messages left it doesn't do anything (especially not deleting e-mails). Obviously, in stef/Trash and stef/Spam, there are e-mails waiting to be deleted. I'm using dbox as mail storage; and use dbox:/var/mail/%u as mail_location in dovecot.conf. Furthermore, I'm running 1.1.16 on a gentoo PPC system. This is the output from `dovecot -n` # 1.1.16: /etc/dovecot/dovecot.conf # OS: Linux 2.6.29-gentoo-r2 ppc Gentoo Base System release 1.12.11.1 xfs listen: *, [::] ssl_cert_file: /etc/ssl/dovecot/server.pem ssl_key_file: /etc/ssl/dovecot/server.key login_dir: /var/run/dovecot/login login_executable: /usr/libexec/dovecot/imap-login verbose_proctitle: yes mail_privileged_group: mail mail_location: dbox:/var/mail/%u mail_plugins: expire auth default: verbose: yes debug: yes passdb: driver: pam args: * userdb: driver: passwd socket: type: listen master: path: /var/run/dovecot/auth-master mode: 384 plugin: quota: fs:Disk Quota expire: Trash 7 Spam 30 expire_dict: proxy::expire dict: expire: db:/var/lib/dovecot/expire.db A strace on `/usr/sbin/dovecot --exec-mail ext /usr/libexec/dovecot/expire-tool --test` shows the following output: mkdir("/var/mail/root", 0770) = -1 EEXIST (File exists) stat64("/var/mail/root/Trash/dbox-Mails", 0xbfda2708) = -1 ENOENT (No such file or directory) write(2, "Info: stef/Trash: no messages lef"..., 35Info: stef/Trash: no messages left ) = 35 which explains why nothing happens (stat64("/var/mail/root/Trash/dbox-Mails", which is empty, it should not even exist, but it passes by a mkdir), but why does it want to check /var/mail/root and not /var/mail/%u (i.e. why no stat64(/var/mail/stef/Trash/dbox-Mails))? Thanks for your help and kind regards, -- Stef Simoens

4 14

[Dovecot] LDAP Plugin fails to build in 1.2.rc7
by Paul Howarth 29 Jun '09

29 Jun '09

Hi, The LDAP Plugin fails to build (it doesn't attempt to build it) in 1.2.rc7 because $have_ldap_plugin is checked before it's assigned in configure.in. Patch attached. This was not a problem in 1.2.rc6 and earlier versions. Cheers, Paul.

2 1

[Dovecot] v1.2.rc7 released
by Timo Sirainen 29 Jun '09

29 Jun '09

http://dovecot.org/releases/1.2/rc/dovecot-1.2.rc7.tar.gz http://dovecot.org/releases/1.2/rc/dovecot-1.2.rc7.tar.gz.sig I'll make RC releases daily now until v1.2.0 is released, which will be either on Monday or Wednesday. Please test as much as possible. * Removed configure --with-deliver, --with-pop3d and --disable-ipv6 parameters. + Improved permission related error messages. - mbox: Don't write garbage to mbox if message doesn't have a body. - virtual: Fixed saving messages with keywords. - virtual: Fixed infinite looping bug. - zlib: Fixed error handling.

3 3

[Dovecot] Dovecot v1.2rc6 deliver to shared folder fails
by Steffen Kaiser 29 Jun '09

29 Jun '09

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello, out of curiosity I tested to deliver into a shared folder of another owner using Sieve. (Not that I intend to do so, but well ... ) Conf is attached. == Script require ["fileinto"]; fileinto "shared.testusr.test1.test2.test3"; == Dovecot logs: Jun 22 15:36:22 ux-2s11standby dovecot: deliver(user): acl vfile: file /home/testusr/test1/test2/test3/Maildir/dovecot-acl not found Jun 22 15:36:22 ux-2s11standby dovecot: deliver(user): Namespace shared.testusr/test1/test2/test3.: Permission lookup failed from /home/testusr/test1/test2/test3/Maildir Jun 22 15:36:22 ux-2s11standby dovecot: deliver(user): Namespace shared.testusr/test1/test2/test3.: Using permissions from /home/testusr/test1/test2/test3/Maildir: mode=0700 gid=-1 Jun 22 15:36:22 ux-2s11standby dovecot: deliver(user): dovecot-acl-list creation failed: safe_mkstemp(/home/testusr/test1/test2/test3/Maildir/temp.ux-2s11standby.25681.e8eb63ed74ac1dd2) failed: No such file or directory Jun 22 15:36:22 ux-2s11standby dovecot: deliver(user): sieve: msgid=<200906221336.n5MDaMGr025671(a)ux-2s11standby.inf.fh-bonn-rhein-sieg.de>: failed to store into mailbox 'testusr/test1/test2/test3': BUG: Unknown internal error Jun 22 15:36:22 ux-2s11standby dovecot: deliver(user): sieve: execution of script /home/user/.dovecot.sieve failed, but implicit keep was successful == LIST excerpt of user: * LIST (\Noselect \HasChildren) "." "shared.testusr" * LIST (\HasNoChildren) "." "shared.testusr.test1.test2.test3" * LIST (\HasNoChildren) "." "shared.testusr.INBOX" ACL of testusr: 4 getacl test1.test2.test3 * ACL "test1.test2.test3" "user" kxeilprwtscd "testusr" lrwstipekxacd Bye, - -- Steffen Kaiser -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.6 (GNU/Linux) iQEVAwUBSj+MBHWSIuGy1ktrAQJBeggApjdThbPJwgTfDyxhSfirUfT56HmxMqFi zsLuHZvNqdY+lQ/cQh9q9gal3UwAbtdcG7f6UgT5p6FZfx87l08DOoLw8j0C3CPC EG3Dk5aAsljLwlbcI5g06hSv8qwydI9ij16nybxEcVMUwtYXALzLtpHSOh/bYr/y +GrvyGTi3wfRom4+guoXa3t6+Wjk8MBvz4aF+JdK691sivQGvhPEUwQsG3e2emSa iOyBguCTtzvYMy18j9PitqspunPPrXaypi+6HzjgYz02T0qo7TZWRyxkCwc6/S2H NEkXLgkjg1ao6uGa9svJvQkK5fl2mfjZXidjL1hGZBLeVWCcnCWVLg== =08gf -----END PGP SIGNATURE-----

2 2

[Dovecot] automated email setup and white/blacklists
by Mediawire - Alistair Campion 29 Jun '09

29 Jun '09

We are running a Red Hat Enterprise Linux environment with Dovecot IIMAP, Exim and mySQL 5.0.81, Apache 2.2.11 We are looking for several server side scripts: 1. Create a user account automatically at the completion of our registration process. i.e. username(a)ourdomain.com and existing MD5 password that is associated with his/her user account 2. Add a new user to an existing subscriber email whitelist (add buddy function) 3. Add an existing user to an existing subscriber email blacklist (block buddy function) Our preference is to receive access to a publicly available scripts. Alternatively, to come to a commercial arrangement with a party who has written or who is prepared to write the same. Regards Alistair Campion mediawirelogo_sm3 Voice : +61 411-148-400 Email: <mailto:alistair@txtbuddies.com> alistair(a)mediawire.tv Web: <http://www.buddirewards.com> www.buddirewards.com Web: <http://www.txtbuddies.com/> www.txtbuddies.com Web: <http://www.myofficebuddies.com> www.myofficebuddies.com

2 1

[Dovecot] sievec error: "fileinto require missing"
by Braden McDaniel 29 Jun '09

29 Jun '09

I'm getting this error when compiling .dovecot.sieve: $ /usr/libexec/dovecot/sievec .dovecot.sieve .dovecot.sievec Info: line 3: fileinto require missing Unable to parse script: script errors: line 3: fileinto require missing .dovecot.sieve just looks like this: $ cat .dovecot.sieve if header :contains ["List-Id"] ["dovecot.dovecot.org"] { fileinto "INBOX.dovecot"; stop; } I'm probably doing something silly; but I don't see how what I've done differs significantly from examples I've found. And googling for "fileinto require missing" just got me to the sievec source code. What might be the problem here? -- Braden McDaniel <braden(a)endoframe.com>

2 2

[Dovecot] 1.2rc5 Panic: file virtual-sync.c
by e-frog 28 Jun '09

28 Jun '09

mail.log: Jun 6 14:40:19 server dovecot: IMAP(user): Panic: file virtual-sync.c: line 502 (virtual_sync_mailbox_box_remove): assertion failed: (rec_count >= uid_count) Jun 6 14:40:19 server dovecot: IMAP(user): Raw backtrace: imap [0x80f0d21] -> imap [0x80f0da2] -> imap [0x80f06d9] -> /usr/lib/dovecot/modules/imap/lib20_virtual_plugin.so [0xb7ec36b4] -> /usr/lib/dovecot/modules/imap/lib20_virtual_plugin.so [0xb7ec4c7b] -> /usr/lib/dovecot/modules/imap/lib20_virtual_plugin.so(virtual_storage_sync_init+0x634) [0xb7ec5dc4] -> imap(imap_sync_init+0x54) [0x806fff4] -> imap(cmd_sync_delayed+0x24b) [0x807031b] -> imap(client_handle_input+0x1bc) [0x80679ac] -> imap(client_input+0x5f) [0x806817f] -> imap(io_loop_handler_run+0xe0) [0x80f99d0] -> imap(io_loop_run+0x20) [0x80f8e50] -> imap(main+0x5f5) [0x8070b85] -> /lib/tls/i686/cmov/libc.so.6(__libc_start_main+0xe5) [0xb7ef8775] -> imap [0x805ff91] Jun 6 14:40:19 server dovecot: dovecot: child 13847 (imap) killed with signal 6 (core dumped) backtrace: GNU gdb 6.8-debian Copyright (C) 2008 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html> This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type "show copying" and "show warranty" for details. This GDB was configured as "i486-linux-gnu"... warning: Can't read pathname for load map: Input/output error. Reading symbols from /lib/tls/i686/cmov/libdl.so.2...Reading symbols from /usr/lib/debug/lib/tls/i686/cmov/libdl-2.9.so...done. done. Loaded symbols for /lib/tls/i686/cmov/libdl.so.2 Reading symbols from /lib/tls/i686/cmov/libc.so.6...Reading symbols from /usr/lib/debug/lib/tls/i686/cmov/libc-2.9.so...done. done. Loaded symbols for /lib/tls/i686/cmov/libc.so.6 Reading symbols from /lib/ld-linux.so.2...Reading symbols from /usr/lib/debug/lib/ld-2.9.so...done. done. Loaded symbols for /lib/ld-linux.so.2 Reading symbols from /usr/lib/dovecot/modules/imap/lib10_quota_plugin.so...done. Loaded symbols for /usr/lib/dovecot/modules/imap/lib10_quota_plugin.so Reading symbols from /usr/lib/dovecot/modules/imap/lib11_imap_quota_plugin.so...done. Loaded symbols for /usr/lib/dovecot/modules/imap/lib11_imap_quota_plugin.so Reading symbols from /usr/lib/dovecot/modules/imap/lib20_expire_plugin.so...done. Loaded symbols for /usr/lib/dovecot/modules/imap/lib20_expire_plugin.so Reading symbols from /usr/lib/dovecot/modules/imap/lib20_fts_plugin.so...done. Loaded symbols for /usr/lib/dovecot/modules/imap/lib20_fts_plugin.so Reading symbols from /usr/lib/dovecot/modules/imap/lib20_virtual_plugin.so...done. Loaded symbols for /usr/lib/dovecot/modules/imap/lib20_virtual_plugin.so Reading symbols from /usr/lib/dovecot/modules/imap/lib21_fts_squat_plugin.so...done. Loaded symbols for /usr/lib/dovecot/modules/imap/lib21_fts_squat_plugin.so Reading symbols from /lib/libgcc_s.so.1...done. Loaded symbols for /lib/libgcc_s.so.1 Core was generated by `imap [user 192.168.178.41]'. Program terminated with signal 6, Aborted. [New process 13847] #0 0xb8053424 in __kernel_vsyscall () (gdb) bt full #0 0xb8053424 in __kernel_vsyscall () No symbol table info available. #1 0xb7f0d6d0 in *__GI_raise (sig=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:64 resultvar = <value optimized out> pid = -1207693324 selftid = 13847 #2 0xb7f0f098 in *__GI_abort () at abort.c:88 act = {__sigaction_handler = {sa_handler = 0x935ee68, sa_sigaction = 0x935ee68}, sa_mask = {__val = {3215393416, 135195514, 3087272224, 0, 3215393536, 3215393524, 512, 0, 0, 3215393600, 3087472240, 134566395, 692, 0, 0, 0, 1, 135267902, 512, 1, 3215393524, 154529352, 69, 3215393652, 3215393496, 135197110, 154530076, 3215393524, 3215393528, 693, 154529384, 3086704259}}, sa_flags = 693, sa_restorer = 0x81062e9 <write_full+57>} sigs = {__val = {32, 0 <repeats 31 times>}} #3 0x080f0d35 in default_fatal_finish (type=<value optimized out>, status=0) at failures.c:160 backtrace = 0x935ea38 "imap [0x80f0d21] -> imap [0x80f0da2] -> imap [0x80f06d9] -> /usr/lib/dovecot/modules/imap/lib20_virtual_plugin.so [0xb7ec36b4] -> /usr/lib/dovecot/modules/imap/lib20_virtual_plugin.so [0xb7ec4c7b] -> "... #4 0x080f0da2 in i_internal_fatal_handler (type=LOG_TYPE_PANIC, status=0, fmt=0xb7ec6ab8 "file %s: line %d (%s): assertion failed: (%s)", args=0xbfa703d4 "ap¦¦\001") at failures.c:440 No locals. #5 0x080f06d9 in i_panic (format=0xb7ec6ab8 "file %s: line %d (%s): assertion failed: (%s)") at failures.c:207 No locals. #6 0xb7ec36b4 in virtual_sync_mailbox_box_remove (ctx=0x9632340, bbox=0x9374248, removed_uids=0x937427c) at virtual-sync.c:516 i = 3215393848 src = 0 dest = 135275874 uid = 154526136 vseq = 28 __PRETTY_FUNCTION__ = "virtual_sync_mailbox_box_remove" #7 0xb7ec4c7b in virtual_sync_backend_boxes (ctx=0x9632340) at virtual-sync.c:850 _data_stack_cur_id = 3 i = 10 ret = 0 #8 0xb7ec5dc4 in virtual_storage_sync_init (box=0x9373ba8, flags=MAILBOX_SYNC_FLAG_EXPUNGE) at virtual-sync.c:1445 sync_ctx = <value optimized out> ret = <value optimized out> #9 0x0806fff4 in imap_sync_init (client=0x936b188, box=0x9373ba8, imap_flags=IMAP_SYNC_FLAG_SAFE, flags=MAILBOX_SYNC_FLAG_EXPUNGE) at imap-sync.c:146 ctx = (struct imap_sync_context *) 0x958ff78 __PRETTY_FUNCTION__ = "imap_sync_init" #10 0x0807031b in cmd_sync_delayed (client=0x936b188) at imap-sync.c:579 cmd = <value optimized out> first_expunge = <value optimized out> first_nonexpunge = <value optimized out> __PRETTY_FUNCTION__ = "cmd_sync_delayed" #11 0x080679ac in client_handle_input (client=0x936b188) at client.c:724 ret = false remove_io = false handled_commands = true __PRETTY_FUNCTION__ = "client_handle_input" #12 0x0806817f in client_input (client=0x936b188) at client.c:748 ---Type <return> to continue, or q <return> to quit--- cmd = <value optimized out> output = (struct ostream *) 0x936b33c bytes = <value optimized out> __PRETTY_FUNCTION__ = "client_input" #13 0x080f99d0 in io_loop_handler_run (ioloop=0x93669b0) at ioloop-epoll.c:208 ctx = (struct ioloop_handler_context *) 0x9366ab8 event = (const struct epoll_event *) 0x9366af8 list = (struct io_list *) 0x936b3c0 io = (struct io_file *) 0x936b398 tv = {tv_sec = 4, tv_usec = 187729} t_id = 2 msecs = <value optimized out> ret = 1 i = 0 j = 0 call = <value optimized out> #14 0x080f8e50 in io_loop_run (ioloop=0x93669b0) at ioloop.c:338 No locals. #15 0x08070b85 in main (argc=Cannot access memory at address 0x3617 ) at main.c:323 No locals.

2 6

Re: [Dovecot] Lots of pop3-logins
by V S Rao 28 Jun '09

28 Jun '09

> > > Doing a "ps aux" on my Slackware box, I have approx 100 PID's of "pop3-login's going on. This is a production mail server, but it is getting VERY low traffic. In fact, only 3 people can "pop3" into it. I've check their e-mail clients, and they are not checking mail any more often than every 5 minutes. > > > > > > This is a new installation and I've had the server up and running since Sunday. If it matters, I'm using Postfix for the MTA and using the Dovecot SASL library to AUTH SMTP. > > > > > > Is this a cause for concern? Why does Dovecot need this many processes? > > > > > > > >> Because dovecot preforks the *-login processes to speed-up the login. > > > > >> No need to worry. > > > > 100 login sessions for just 3 connections? That is not right, no matter what. > > >> No, login_processes_count matters. > > How? If my understanding is correct, you have extra 3 login processes created to cater to new connections. So with only 3 POP3 users, why should so many login processes be spawned? I can understand 10-15. But 100 definitely indicates either the processes are not dying or something else happening on the system which is causing such high number of login processes. The system definitely needs to be checked for some kind of attack, a rogue process running on the system or something else. > >> My idle box has 64 imap-login processes and no, I'm not under a >> dictionary attack :) I am not sure what your load is (user base, system config etc), but I will give you my typical load here. I run mail server for about 6000 users with a mix of 70% POP3 and 30% IMAP (thro webmail). And here are the typical stats (I run a script in the background collecting this data every 5 secs): pop3-logins:12 pop3-connections:8 IMAP-logins:7 IMAP-connections:11 I have read other opinions in this thread by Timo & others. And I am interested in a few things. So if you will indulge me, maybe it will be useful for others who face these kind of issues Timo Wrote: You can also just decrease login_process_max_count Wouldn't decreasing the login_process_max_count simply create more problems. Now users will start experiencing timeouts sooner than before, because whatever is causing the login processes to increase (attack, rogue process or whatever) will *always* be trying to login and genuine users will be denied login. So without knowing the root cause of the issue simply decreasing or increasing the login_process_max_count will lead to other problems. Correct me if I am wrong. Rodman Wrote: I'll go ahead and lower that limit to something that fits my usage better. No, I think leave that value to default and try and identify the root cause and prevent it. Noel Wrote: What would be nice is, an anti brute force option Yes, that would be nice. But consider a situation where the system is not under brute force attack, but for some reason the number of login processes keep on increasing by the hour. This would ultimately lead the system to deny connections to the users. Is there a way to track what is happening? strace would be too complicated for us field guys to work with. Any suggestions? Regards --Rao

4 4

[Dovecot] Dovecot v1.2 ACL inheritance for new subfolders (aka copying ACLs)
by Steffen Kaiser 28 Jun '09

28 Jun '09

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello, http://wiki.dovecot.org/ACL mentions: "Currently there is no ACL inheritance." However this applies to a folder inherit ACLs to existing subfolders; when you share a folder and a non-owner creates a sub-folder within, no ACLs are set, hence, the creator cannot access the new folder. Could the "create mailbox"-process copy the ACLs to the sub-folder? Actually, I would like most, if this is done regardless if owner or non-owner creates subfolders. Bye, - -- Steffen Kaiser -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.6 (GNU/Linux) iQEVAwUBSj+FVnWSIuGy1ktrAQI81Af/aBOtllnFl1IP1RRMOri75cayXMWkiPkS GWKrZaK4vISUqL0yN0mSCMvP4sESwTndIn6kel3ZYqEDFrYWuhg+wAQx8XGxAfgs W1vsnlbPcQ6U02dtC7pGqhaFc8ZomLEFrO5xmDd+DEPTSqBiJzOz6C6mg7diqIuq Tmd0oGDqrP4shKt5y3oSM5tZSELnpQD2+J636JROlxvtuYgVti9M+DSPSjU3PRDs oS7eMUf9mmOt4BAUzWmq4mNda8NBFcDK3L70Lu5r1/maheEIcrDAlMmRTTtlShq8 FM2zXey5sLGMyuRhhlQmaefxuvYQosblbpGYlf6K71tKNPBzdFeR2A== =3pmt -----END PGP SIGNATURE-----

2 1

[Dovecot] bzip2 compression bug
by fernando＠dfcom.com.br 28 Jun '09

28 Jun '09

Hi, I compressed many files using bzip2, but in some cases it crashes. I believe that it is related to dovecot indexes. How to reproduce: Inside a Maildir folder without any indexes yet, compress a message with bzip2 and tryes to access it. At my server is showed the error: Jun 24 00:18:20 maildev dovecot: IMAP(xxx@xxx): FETCH for mailbox Trash UID 1 failed to read message input: No such file or directory Jun 24 00:18:20 maildev dovecot: IMAP(xxx@xxx): Disconnected: BUG: Unknown internal error bytes=329/1050 When I did the same with gzip compression it works as expected (opening the message and creating dovecot indexes). (version, 1.1.16) Best Regards, Fernando

3 2

[Dovecot] Dovecot v1.2rc6 dict-server socket path problem & pgsql crash
by Steffen Kaiser 28 Jun '09

28 Jun '09

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello, I find this in the logs: 2009-06-25 14:10:37 IMAP(dvtest) [29566]: Error: net_connect_unix(/usr/local/dovecot-1.2.rc6acl-hook2/var/run/dovecot/dict-server) failed: Permission denied 2009-06-25 14:10:37 IMAP(dvtest) [29566]: Error: acl: dict iteration failed, can't update dict although base_dir is just /var/run/dovecot/ . Dovecot v1.2 changeset: 9157:d14e8b8df025 Conf is attached. I am trying to get ACL's shared dictionary running: acl_shared_dict: proxy::acl dict: acl: pgsql:/usr/local/dovecot-1.2.rc6acl-hook2/etc/dovecot-dict-acl-sql.conf ============ I created the symlink to get map /var/run/dovecot under $install_dir, then I get a crash: 2009-06-25 14:26:53 dict: Error: pgsql: Connect failed to dovecot: could not open certificate file "/root/.postgresql/postgresql.crt": No such file or directory ==> /var/log/postgresql/postgresql-8.1-main.log <== 2009-06-25 14:26:53 CEST LOG: could not accept SSL connection: peer did not return a certificate ==> /var/log/dovecot/dovecot-1.2.log <== 2009-06-25 14:26:58 dict: Error: pgsql: Connect failed to dovecot: could not open certificate file "/root/.postgresql/postgresql.crt": No such file or directory ==> /var/log/postgresql/postgresql-8.1-main.log <== 2009-06-25 14:26:58 CEST LOG: could not accept SSL connection: peer did not return a certificate ==> /var/log/dovecot/dovecot-1.2.log <== 2009-06-25 14:27:03 dict: Error: dict sql iterate failed: Not connected to database 2009-06-25 14:27:03 IMAP(dvtest) [29801]: Error: read(/usr/local/dovecot-1.2.rc6acl-hook2/var/run/dovecot/dict-server) failed: Remote disconnected 2009-06-25 14:27:03 IMAP(dvtest) [29801]: Error: acl: dict commit failed 2009-06-25 14:27:03 dovecot: Error: child 29802 (dict) killed with signal 11 (core dumps disabled) My sql-dict.conf is: connect = host=localhost dbname=dovecot user=dovecot # password=pass [CUT samples for quota & expire] # CREATE TABLE user_shares ( # from_user varchar(100) not null, # to_user varchar(100) not null, # primary key (from_user, to_user) # ); map { pattern = shared/shared-boxes/user/$to/$from table = user_shares fields { from_user = $from to_user = $to } } ================== So I changed the connect line into: connect = dbname=dovecot user=dovecot into forcing to use the local socket, which seems to work: 2009-06-25 14:37:24 dict: Info: pgsql: Connected to dovecot but: 2009-06-25 14:37:24 dovecot: Error: child 29986 (dict) killed with signal 11 (core dumped) 2009-06-25 14:37:24 IMAP(dvtest) [29985]: Error: read(/usr/local/dovecot-1.2.rc6acl-hook2/var/run/dovecot/dict-server) failed: Remote disconnected 2009-06-25 14:37:24 IMAP(dvtest) [29985]: Error: acl: dict commit failed ==> /var/log/postgresql/postgresql-8.1-main.log <== 2009-06-25 14:37:24 CEST LOG: unexpected EOF on client connection The core's bt full of this latter crash is: Core was generated by `dict'. Program terminated with signal 11, Segmentation fault. #0 0xb7ebe463 in strlen () from /lib/tls/i686/cmov/libc.so.6 (gdb) bt full #0 0xb7ebe463 in strlen () from /lib/tls/i686/cmov/libc.so.6 No symbol table info available. #1 0x08065072 in str_append (str=0x806c168, cstr=0x0) at str.c:91 No locals. #2 0x080509ef in sql_dict_set_query (build=0xbffe8c34) at dict-sql.c:536 dict = (struct sql_dict *) 0x8076e08 sql_fields = <value optimized out> extra_values = <value optimized out> i = 0 prefix = (string_t *) 0x806c168 suffix = (string_t *) 0x806c1d8 __PRETTY_FUNCTION__ = "sql_dict_set_query" #3 0x080518a4 in sql_dict_set (_ctx=0x8080028, key=0x806c032 "shared/shared-boxes/user/dvtest2/dvtest", value=0x806c05a "1") at dict-sql.c:648 build = {dict = 0x8076e08, fields = {arr = {buffer = 0x806c130, element_size = 8}, v = 0x806c130, v_modifiable = 0x806c130}, extra_values = 0xbffe8c50, key1 = 115 's', inc = false} field = {map = 0x8076ed8, value = 0x806c05a "1"} query = <value optimized out> _data_stack_cur_id = 4 ctx = <value optimized out> dict = <value optimized out> map = <value optimized out> values = {arr = {buffer = 0x806c0f0, element_size = 4}, v = 0x806c0f0, v_modifiable = 0x806c0f0} #4 0x08052460 in dict_set (ctx=0x8080028, key=0x806c032 "shared/shared-boxes/user/dvtest2/dvtest", value=0x806c05a "1") at dict.c:168 __PRETTY_FUNCTION__ = "dict_set" #5 0x0804f355 in cmd_set (conn=0x8075bc8, line=0x8075df8 "2\tshared/shared-boxes/user/dvtest2/dvtest\t1") at dict-server.c:288 trans = (struct dict_server_transaction *) 0x8080118 #6 0x0804fbf9 in dict_client_connection_input (conn=0x8075bc8) at dict-server.c:458 _data_stack_cur_id = 3 line = 0x8075df7 "S2\tshared/shared-boxes/user/dvtest2/dvtest\t1" i = 6 ret = <value optimized out> #7 0x0805e2d0 in io_loop_handler_run (ioloop=0x8074a38) at ioloop-epoll.c:208 ctx = <value optimized out> event = (const struct epoll_event *) 0x8074b80 list = (struct io_list *) 0x8075da8 io = (struct io_file *) 0x8075d80 tv = {tv_sec = 2147483, tv_usec = 0} t_id = 2 msecs = <value optimized out> ret = 1 i = 0 j = 0 call = <value optimized out> #8 0x0805d398 in io_loop_run (ioloop=0x8074a38) at ioloop.c:338 No locals. #9 0x0805002f in main () at main.c:129 No locals. - -- Steffen Kaiser -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.6 (GNU/Linux) iQEVAwUBSkNxwXWSIuGy1ktrAQKuyAgAn8NU8Y59qGV75VStW2MZQH/7HWLF2z9y 2L41g+NzX5LEw9o/B2ZjlAVEsNhVbqbew2A57uuvOAgV5K8iGgx1yPUjmQT9ud6X uthcsBNQIVGu6ymCN2ufeh3XdNEkrOu1pLJaWkiVQjvc8FOczMp432Jhytc9Hpbo jtMbnFuSbZmg0GX6bqJ50kOsjwme7B7ak/ubVeOwGXHU4MQ8PRXl+TXdVTlnFwKw IUZj8xPB+Gi7nRdsJlkQItp//TgeAJ9lm+i/OWzH420qljADDs9NfrfKd/DDOo6i u6W6I+5FUsJ5N7CHDAvHeDnTHPomPC+bnYAWpRyXF/kMVPaccaFxQw== =O2WZ -----END PGP SIGNATURE-----

2 2

[Dovecot] [PATCH] allow disabling libcap support although it's installed
by Daniel Mierswa 28 Jun '09

28 Jun '09

see subject :) patch is in hg export format -- Mierswa, Daniel If you still don't like it, that's ok: that's why I'm boss. I simply know better than you do. --- Linus Torvalds, comp.os.linux.advocacy, 1996/07/22 # HG changeset patch # User Daniel Mierswa <impulze(a)impulze.org> # Date 1245757676 -7200 # Branch HEAD # Node ID 343390a32894c654c8646650eba2cf130ca480d2 # Parent d77225a6412873528b3c94abe8268436df5dbe82 do not automagically depend on libcap if it's installed diff --git a/configure.in b/configure.in --- a/configure.in +++ b/configure.in @@ -196,6 +196,11 @@ TEST_WITH(bzlib, $withval), want_bzlib=auto) +AC_ARG_WITH(libcap, +[ --with-libcap Build with libcap support (Dropping capabilities).], + TEST_WITH(libcap, $withval), + want_libcap=auto) + AC_ARG_WITH(ssl, [ --with-ssl=gnutls|openssl Build with GNUTLS or OpenSSL (default)], if test x$withval = xno; then @@ -358,11 +363,13 @@ AC_DEFINE(HAVE_FDATASYNC,, Define if you have fdatasync()) ]) -AC_CHECK_LIB(cap, cap_init, [ - AC_DEFINE(HAVE_LIBCAP,, libcap is installed for cap_init()) - LIBCAP="-lcap" -]) -AC_SUBST(LIBCAP) +if test $want_libcap != no; then + AC_CHECK_LIB(cap, cap_init, [ + AC_DEFINE(HAVE_LIBCAP,, libcap is installed for cap_init()) + LIBCAP="-lcap" + ]) + AC_SUBST(LIBCAP) +fi AC_DEFINE(PACKAGE_WEBPAGE, "http://www.dovecot.org/", Support URL)

2 2

[Dovecot] strange quota behaviour with dovecot 1.1.7
by listacc＠gmx.de 27 Jun '09

27 Jun '09

Hello! I´m running dovecot 1.1.7 (which is the most recent binary of openSuSE 11.1 repository) with Postfix, MySQL and Postfixadmin. Now I´m trying for some days to get quota working, but I get some strange behaviour and I was not yet able to figure out where the error in my configuration is. Quota information is inserted by postfixadmin into a MySQL database. It seems that dovecot is reading this information correctly - when a mailbox is filled up and gets over-quota, further emails are rejected. But then, if I want to increase the quota for this filled-up mailbox in postfixadmin, postfixadmin correctly changes the quota information in MySQL table. After growing quota, mails to the account are accepted again. But my Thunderbird with Quota plugin continues showing the old quota setting. When more mails are sent to this account, it shows a quota > 100%. If I look into the "mailboxsize" file of this account, it still shows the old quota value before I raised it. If I delete the entry in mailboxsize, dovecot writes the old value in again. Seems that dovecot isn´t looking in the MySQL table (but it did after creating the account). But why are mails accepted again if dovecot is not recognizing the raised quota?? If I try now, as a user, to delete mails from the "overfilled" Inbox, it is denied with a "quota exceeded" message. But I´m able to send further mails to this account. The only way to get the account working properly again is to delete the messages directly on the server´s filesystem. I´m very grateful for every hint! regards, Andreas ------------- dovecot -n: # 1.1.7: /etc/dovecot/dovecot.conf # OS: Linux 2.6.27.23-0.1-default x86_64 openSUSE 11.1 (x86_64) ext3 base_dir: /drbd/mail/var/run/dovecot/ log_path: /var/log/dovecot.err info_log_path: /var/log/dovecot.info protocols: imaps managesieve listen(default): * listen(imap): * listen(managesieve): 192.168.1.8:2000 ssl_listen(default): *:993 ssl_listen(imap): *:993 ssl_listen(managesieve): ssl_cert_file: /etc/ssl/certs/imap.domain.crt ssl_key_file: /etc/ssl/private/imap.domain.key verbose_ssl: yes login_dir: /drbd/mail/var/run/dovecot//login login_executable(default): /usr/lib/dovecot/imap-login login_executable(imap): /usr/lib/dovecot/imap-login login_executable(managesieve): /usr/lib/dovecot/managesieve-login max_mail_processes: 2000 mail_max_userip_connections(default): 30 mail_max_userip_connections(imap): 30 mail_max_userip_connections(managesieve): 10 first_valid_uid: 5001 last_valid_uid: 5001 mail_location: maildir:/drbd/mail/vmail/%d/%n mail_debug: yes mail_executable(default): /usr/lib/dovecot/imap mail_executable(imap): /usr/lib/dovecot/imap mail_executable(managesieve): /usr/lib/dovecot/managesieve mail_plugins(default): quota imap_quota mail_plugins(imap): quota imap_quota mail_plugins(managesieve): mail_plugin_dir(default): /usr/lib64/dovecot/modules/imap mail_plugin_dir(imap): /usr/lib64/dovecot/modules/imap mail_plugin_dir(managesieve): /usr/lib64/dovecot/modules/managesieve managesieve_implementation_string(default): dovecot managesieve_implementation_string(imap): dovecot managesieve_implementation_string(managesieve): Cyrus timsieved v2.2.13 sieve_storage(default): sieve_storage(imap): sieve_storage(managesieve): /drbd/mail/vmail/%d/%n/sieve sieve(default): sieve(imap): sieve(managesieve): /drbd/mail/vmail/%d/%n/dovecot.sieve auth default: mechanisms: plain login cram-md5 user: nobody verbose: yes debug: yes debug_passwords: yes passdb: driver: pam passdb: driver: sql args: /etc/dovecot/dovecot-sql.conf userdb: driver: passwd userdb: driver: sql args: /etc/dovecot/dovecot-sql.conf socket: type: listen client: path: /var/spool/postfix/private/auth mode: 432 user: postfix group: postfix master: path: /var/run/dovecot/auth-master mode: 432 user: vmail group: vmail plugin: sieve: /drbd/mail/vmail/%d/%n/dovecot.sieve quota: maildir --- dovecot-sql.conf: (...) password_query = SELECT username AS user, password, '/drbd/mail/vmail/%d/%n' AS userdb_home, 'maildir:/drbd/mail/vmail/%d/%n' AS userdb_mail, 5001 AS userdb_uid, 5001 AS userdb_gid FROM mailbox WHERE username = '%u' AND active = '1' (...) user_query = SELECT '/drbd/mail/vmail/%d/%n' AS home, 'maildir:/drbd/mail/vmail/%d/%n' AS mail, 5001 AS uid, 5001 AS gid, concat('*:storage=', quota, 'B') AS quota_rule FROM mailbox WHERE username = '%u' AND active = '1' --- mysql> select quota from mailbox; +-----------+ | quota | +-----------+ | 512000000 | | 512000000 | | 512000000 | | 512000000 | | 512000000 | | 512000000 | | 512000000 | | 512000000 | | 512000000 | | 30720000 | | 30720000 | +-----------+ 11 rows in set (0.00 sec) -- GRATIS für alle GMX-Mitglieder: Die maxdome Movie-FLAT! Jetzt freischalten unter http://portal.gmx.net/de/go/maxdome01

2 1

[Dovecot] POP3 flag updates
by Timo Sirainen 27 Jun '09

27 Jun '09

Why does Dovecot add \Seen flag for mails that have been RETRed? Does anyone really want to use this feature? I can't remember why I implemented it originally, perhaps it was just "because other servers do that too". I'm thinking about at least changing pop3_no_flag_updates=yes to be default. There's also of course pop3_enable_last setting to enable LAST command which was removed from POP3 specs. That requires knowing the last RETRed mail, so I guess I should add a check that it can't be enabled without pop3_no_flag_updates=no.

2 2

[Dovecot] Spliting Folders for Efficiency
by Daniel Watts 27 Jun '09

27 Jun '09

Dear Timo, Would there be any sense in giving Dovecot the option to split folders into multiple subfolders when they reached a specified size (probably message count) limit? Dovecot would monitor folders and when they reached, say, 10,000 messages, silently split the folder on the filesystem to ensure that access remains fast. I know that Dovecot scales very well but this would give practically unlimited storage capability and also keep things fast. You could even have it so that the latest 100 messages are kept in their own folder for fast access. .Folder.new .Folder.cur .Folder.tmp could become: .Folder__1.new .Folder__1.cur .Folder__1.tmp and .Folder__2.new .Folder__2.cur .Folder__2.tmp with Dovecot merging them before display as just "Folder" within the mail client. This could be further extended so that Dovecot could be configured to store 'old' message folders in a separate location. We could then have slower+cheaper+larger storage mounted so that 'old mail' does not take up the expensive local SCSI disks on the machine. Mail from 2 years ago is much less likely to be accessed than mail from the last week. This would provide very neat behind-the-scenes archiving functionality. Looking forward to hearing your thoughts. Best, Daniel -- Squirrelmail Stable 1.4.8 (and developing on 1.5.2) PHP 5.x Hardened with Eaccelerator Apache 2.x Mysql 5.0.x Imapproxy over Dovecot 1.0.rc27 with Maildir all running on Gentoo Linux for ~5,000 users.

7 11

[Dovecot] Sieve/ManageSieve integration into pkgsrc
by Edgar Fuß 27 Jun '09

27 Jun '09

I'm integrating Sieve (the new one) and ManageSieve into wip/dovecot. Currently, this works as dovecot options because dovecot must be built before sieve can be configured and sieve must be built before managesieve can be configured/built. Now, the question arose what the long-term solution (in pkgsrc) should be. To my understanding, with dovecot 2.0, ManageSieve will no longer need to patch dovecot. But what about both Sieve and ManageSieve depending on doevcot sources in order to build (or on libraries dovecot only builds internally)? The preferred way (for pkgsrc) would be if both Sieve and ManageSieve could be built as stand-alone packages and not needing a dovecot source tree to build. What's the long-term plan for Sieve/ManageSieve in this respect? The pkgsrc infrastructure (intentionally) doesn't like a package depending on anothers package working directory in order to build. So with these cross-dependencies, the only pkgsrc ways to go would be either to build it all as one package with options (that's what I currently do) or extract, patch, configure and build dovecot inside a sieve package.

3 2

[Dovecot] dovecot and vmailmgr/qmail mailboxes
by Mij 26 Jun '09

26 Jun '09

Hello folks, Time ago I worked on a patch for dovecot to work with vmailmgr http://mij.oltrelinux.com/net/dovecot-qmail-vmailmgr/ The patch was required because, despite vmailmgr complies with the checkpassword interface supported by dovecot, dovecot snips the mailbox directory returned by the authentication module at colon characters ':'. Incidentally, vmailmgr maps any "name.surname@domain" to "~domain/users/name:surname" (a standard practice in the qmail world, see eg http://www.qmail.org/man/man5/dot-qmail.html at "For security") This path dovecot would then parse as "~domain/users/name". An authentication module can't do anything about it, as this is due to dovecot collecting accounting information in one common buffer, tokenized by ':' separators. I soon stopped updating the patch because I didn't see much point in running indefinitely after releases. However, a bunch of people wrote me over the last years asking for details or updates. Partially for having a similar requirement myself, partially drafted by such feedback, I recently wrote a "compromise" wrapper solution (attached). It does not require patching dovecot (external module) and it's thus (supposedly) durable across dovecot releases; however, it cannot help with the colon problem. The wrapper works as follows: 1) compile and install: # cc -O2 -Wall -o checkvpw-dovecot-wrapper checkvpw-dovecot-wrapper.c # install -s -o root checkvpw-dovecot-wrapper /usr/local/bin 2) edit dovecot.conf, setup the auth section as follows: ============ auth default { mechanism = plain passdb checkpassword { args = /usr/local/bin/checkvpw-dovecot-wrapper } userdb prefetch { } user = root } ============ If "name.surname@domain" wants to be created, the administrator shall instead create the user "namesurname@domain" and an alias "name.surname@domain" pointing to it. This may be conceivable for new installations, but it is not for scenarios where dovecot is to replace another server on top of an existing user base. Of course, it's very desirable to support "." users too. I see that it would require several changes in the code, but I'd like to hear your opinion on this. What about - using a different separator than ":", less common and safer. Could '\0' be one? If not, what about '*'? - as a quicker & dirtier solution, what about allowing escaping? One can modify the auth module to replace ":" with "\:", if dovecot is instructed to avoid tokenizing when a "\" precedes a ":". - as an alternative, dovecot may require the module to chdir() to the mailbox directory instead of returning its path as a string, and subsequently operate locally on mailbox-relative paths. I can't guess how compatible this is with the current design. In the next days, I will publish such wrapper to the webpage. For your convenience, I will invite interested users to show up on this thread; this should help you in assessing how this is interesting for people. bye

4 7

Re: [Dovecot] Lots of pop3-logins
by V S Rao 26 Jun '09

26 Jun '09

> > Doing a "ps aux" on my Slackware box, I have approx 100 PID's of "pop3-login's going on. This is a production mail server, but it is getting VERY low traffic. In fact, only 3 people can "pop3" into it. I've check their e-mail clients, and they are not checking mail any more often than every 5 minutes. > > > > This is a new installation and I've had the server up and running since Sunday. If it matters, I'm using Postfix for the MTA and using the Dovecot SASL library to AUTH SMTP. > > > > Is this a cause for concern? Why does Dovecot need this many processes? > > > > >> Because dovecot preforks the *-login processes to speed-up the login. > > >> No need to worry. > > 100 login sessions for just 3 connections? That is not right, no matter what. >> No, login_processes_count matters. How? If my understanding is correct, you have extra 3 login processes created to cater to new connections. So with only 3 POP3 users, why should so many login processes be spawned? I can understand 10-15. But 100 definitely indicates either the processes are not dying or something else happening on the system which is causing such high number of login processes. The system definitely needs to be checked for some kind of attack, a rogue process running on the system or something else. Regards --Rao

7 9

[Dovecot] dovecot-acl-list not honouring owner / permissions that are set on dovecot-shared
by Stuart Rowan 25 Jun '09

25 Jun '09

Hi, I've just upgraded our dovecot installation from 1.0.15 to 1.1.13. This went smoothly and just worked -- thank you very much for writing such a high performance and robust piece of software. However, we have a shared mailbox that people can subscribe to. After upgrading to 1.1.13 ... dovecot tries to create a dovecot-acl-list file in the top level of this ... but it creates it chown'd to the first logged in user with a umask of -rw- --- --- A. -rw------- 1 userA shared 17179 2009-06-25 11:10 /home/imapshared/SharedMaildir/dovecot-acl-list Everyone else who tried to access the shared folder (and hence dovecot tried to read / update the dovecot-acl-list file) caused an error to be logged to the error.log I changed the permissions (once I realised what had gone wrong) to match those on the dovecot-shared file and all was well as everyone can now read/update it. B. -rw-rw---- 1 imapshared shared 17179 2009-06-25 11:19 /home/imapshared/SharedMaildir/dovecot-acl-list -rw-rw---- 1 imapshared shared 0 2008-04-25 13:20 /home/imapshared/SharedMaildir/dovecot-shared Also from time to time the permissions seem to get changed back on dovecot-acl-list inexplicably to those in situation A -- usually following a restart of dovecot but I haven't been able to reproduce this reliably. This seems like a bug to me ... do you agree / is there a sensible work-around? The declaration in dovecot.conf for the shared namespace sets user specific CONTROL and INDEX locations so that users can independently subscribe to folders and mark messages as read on an individual basis. Many thanks, Stu.

2 4