- dovecot - dovecot.org

Re: [Dovecot] SpamAssassin and Maildir with Dovecot
by Gabriel Millerd 15 Aug '08

15 Aug '08

On Fri, Aug 15, 2008 at 11:57 AM, Kenneth Porter <shiva(a)sewingwitch.com> wrote: > A patch has been proposed for SpamAssassin to process Maildir folders of > spam: > Nothing on the disk looks modified by the code change, sa-learn is just reading from the disk fand altering the sa-storage as instructed by the learn rule switch. If you learned and then nuked some headers for example, the file size would change and that would be an issue if you storage that in the filename (they wouldn't match) as well as the dovecot index for imap/pop would be off potentially. Possibly some active imap sessions might be confused as well. This patch only really is sensitive to the Maildir structure, it has been able to handle the mail directories. -- Gabriel Millerd

1 0

[Dovecot] Search for (any of) multiple terms slow
by Patrick Nagel 15 Aug '08

15 Aug '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi, this may be an obvious logical problem I'm not aware of, which cannot be solved any more efficiently... but maybe it's just a bug or there is potential for optimisation in Dovecot (or Thunderbird?). When searching for multiple terms at once ("any of") with Thunderbird/Dovecot (using FTS Squat indexes), it takes much longer (not double the time, or a bit more than that, but really much, much longer) than when I search for only one term. Here are some figures (the IMAP commands are shown as issued by Thunderbird and recorded by Dovecot rawlog). While searching, I can see the 'imap' process using 100% CPU time. Searching for "xyz" in Archive and subfolders 4 secs 32 select "Archive" 33 uid SEARCH UNDELETED BODY "xyz" 34 select "Archive.2004" 35 UID fetch 1:* (FLAGS) 36 uid SEARCH UNDELETED BODY "xyz" 37 select "Archive.2004.2005" 38 UID fetch 1:* (FLAGS) 39 uid SEARCH UNDELETED BODY "xyz" 40 select "Archive.2004.2005.2006" 41 UID fetch 1:* (FLAGS) 42 uid SEARCH UNDELETED BODY "xyz" 43 select "Archive.2004.2005.2006.2007" 44 UID fetch 1:* (FLAGS) 45 uid SEARCH UNDELETED BODY "xyz" 46 select "Archive.2004.2005.2006.2007.2008" 47 UID fetch 1:* (FLAGS) 48 uid SEARCH UNDELETED BODY "xyz" 49 IDLE Searching for "xyz" and "abc" (any of) in Archive and subfolders 123 secs 50 select "Archive" 51 uid SEARCH UNDELETED (OR BODY "xyz" BODY "abc") 52 select "Archive.2004" 53 UID fetch 1:* (FLAGS) 54 uid SEARCH UNDELETED (OR BODY "xyz" BODY "abc") 55 select "Archive.2004.2005" 56 UID fetch 1:* (FLAGS) 57 uid SEARCH UNDELETED (OR BODY "xyz" BODY "abc") 58 select "Archive.2004.2005.2006" 59 UID fetch 1:* (FLAGS) 60 uid SEARCH UNDELETED (OR BODY "xyz" BODY "abc") 61 select "Archive.2004.2005.2006.2007" 62 UID fetch 1:* (FLAGS) 63 uid SEARCH UNDELETED (OR BODY "xyz" BODY "abc") 64 select "Archive.2004.2005.2006.2007.2008" 65 UID fetch 1:* (FLAGS) 66 uid SEARCH UNDELETED (OR BODY "xyz" BODY "abc") 67 IDLE Searching for "xyz", "abc" and "def" in Archive and subfolders 173 secs 68 select "Archive" 69 uid SEARCH UNDELETED (OR (OR BODY "xyz" BODY "abc") BODY "def") 70 select "Archive.2004" 71 UID fetch 1:* (FLAGS) 72 uid SEARCH UNDELETED (OR (OR BODY "xyz" BODY "abc") BODY "def") 73 select "Archive.2004.2005" 74 UID fetch 1:* (FLAGS) 75 uid SEARCH UNDELETED (OR (OR BODY "xyz" BODY "abc") BODY "def") 76 select "Archive.2004.2005.2006" 77 UID fetch 1:* (FLAGS) 78 uid SEARCH UNDELETED (OR (OR BODY "xyz" BODY "abc") BODY "def") 79 select "INBOX" 80 UID fetch 1:* (FLAGS) 81 check 82 select "Archive.2004.2005.2006.2007" 83 UID fetch 1:* (FLAGS) 84 uid SEARCH UNDELETED (OR (OR BODY "xyz" BODY "abc") BODY "def") 85 select "Archive.2004.2005.2006.2007.2008" 86 UID fetch 1:* (FLAGS) 87 uid SEARCH UNDELETED (OR (OR BODY "xyz" BODY "abc") BODY "def") 88 IDLE Searching for "xyz", "abc", "def" and "ghi" in Archive and subfolders 217 secs 89 select "Archive" 90 uid SEARCH UNDELETED (OR (OR (OR BODY "xyz" BODY "abc") BODY "def") BODY "ghi") 91 select "Archive.2004" 92 UID fetch 1:* (FLAGS) 93 uid SEARCH UNDELETED (OR (OR (OR BODY "xyz" BODY "abc") BODY "def") BODY "ghi") 94 select "Archive.2004.2005" 95 UID fetch 1:* (FLAGS) 96 uid SEARCH UNDELETED (OR (OR (OR BODY "xyz" BODY "abc") BODY "def") BODY "ghi") 97 select "Archive.2004.2005.2006" 98 UID fetch 1:* (FLAGS) 99 uid SEARCH UNDELETED (OR (OR (OR BODY "xyz" BODY "abc") BODY "def") BODY "ghi") 100 select "Archive.2004.2005.2006.2007" 101 UID fetch 1:* (FLAGS) 102 uid SEARCH UNDELETED (OR (OR (OR BODY "xyz" BODY "abc") BODY "def") BODY "ghi") 103 select "Archive.2004.2005.2006.2007.2008" 104 UID fetch 1:* (FLAGS) 105 uid SEARCH UNDELETED (OR (OR (OR BODY "xyz" BODY "abc") BODY "def") BODY "ghi") 106 IDLE Patrick. - -- STAR Software (Shanghai) Co., Ltd. http://www.star-group.net/ Phone: +86 (21) 3462 7688 x 826 Fax: +86 (21) 3462 7779 PGP key: https://stshacom1.star-china.net/keys/patrick_nagel.asc Fingerprint: E09A D65E 855F B334 E5C3 5386 EF23 20FC E883 A005 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.7 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org iD8DBQFIooxq7yMg/OiDoAURAhb9AJ4jOaK+eHXcSwJTAER8xEKIlJJt0gCgtZan wJm05V0F03gj+6YxbNOtCew= =jID/ -----END PGP SIGNATURE-----

5 5

[Dovecot] Migrating mbox to maildir
by Mike Hobbs 15 Aug '08

15 Aug '08

Sorry to bother everyone but I was wondering if it is possible for Dovecot to handle mbox AND maildir at the same time? Example: I want to convert from UW Imap using mbox to Dovecot using maildir. Do I need to convert ALL my users mbox mailboxes to maildir right away or can I convert them one at a time? I'd like to use maildir with all my new users, but I'd like to be able to continue using mbox for my old users and slowly convert them as I get time. Is this possible? I know Dovecot supports both formats, I just couldn't find anything in the install notes about using both at the same time. Thank you, mike

3 2

[Dovecot] Webmail app ... again.
by Roderick A. Anderson 15 Aug '08

15 Aug '08

There was a thread several weeks (or months) ago on webmail applications. I didn't like any of the options and only found few that I did but they were either expensive or not maintained. So ... I raised the question on the Catalyst Framework list about Perl based webmail apps and got nothing usable. It came down to what would it take to build a Perl (Cat) webmail app. Several others on the list got interested so we decided to build it. The main issue I run into is my lack of understanding of the ins-and-outs of the IMAP specification and the features that come with using Dovecot. (Oh yeah. Dovecot was the preferred IMAP server!) Another project I'm working on uses IMAP and what I found was there is a great quantity of Perl modules for dealing with IMAP. A great quantity! Unfortunately many of them assume a deeper knowledge of IMAP than I have so are very confusing. What I'm looking for is a good reference, besides the RFC, on IMAP. Anything out there? Electronic or dead-tree is fine. (A book of Dovecot would be neat too.) TIA, Rod --

10 17

Re: [Dovecot] Marking as Read causes Body.Peek on ALL messages - Reasonable?
by Daniel Watts 15 Aug '08

15 Aug '08

>> I've noticed when I select a folder of messages (Thunderbird) and >> mark them all as read (or unread) it produces the following IMAP >> transcript: >> >> Source Destination Info >> c.c.c.c s.s.s.s Request: DONE >> s.s.s.s c.c.c.c Response: 20 OK Idle completed. >> c.c.c.c s.s.s.s Request: 21 uid store 1:20 -Flags (\Seen) >> s.s.s.s c.c.c.c Response: * 1 FETCH (UID 1 FLAGS (\Recent >> NonJunk)) >> c.c.c.c s.s.s.s Request: 22 UID fetch 2 (UID RFC822.SIZE >> BODY.PEEK[]) >> s.s.s.s c.c.c.c Response: * 2 FETCH (UID 2 RFC822.SIZE 1339 >> BODY[] {1339} > .. > > Looks a bit stupid. But I'd guess it's related to Thunderbird being > configured to download mail when reading it and it treats setting > \Seen the same as reading it. Just a guess though. It becomes a bit of a problem when done in a folder of 40,000 messages - locks up the program for ages and hammers the server a bit too. > >> Is this reasonable? I thought it would be possible to just send a >> list of message UIDs and say mark these as /seen /unseen etc. > > Sure, it would be possible. Also if Thunderbird really wants to fetch > these messages' bodies, it could have done it using a single command > instead of 20 separate ones.. > Perhaps it does it one by one incase there are a lot of messages.... but it could chunk them at least. Timo - thanks as always for your help with this, particularly as it is slightly OT. Ever thought about writing your own mail client? =) Perhaps LightningDove! The more I use Thunderbird the more I find it totally insane. Still better than going back to Outlook (thought not tried 2007 yet). Dan

2 2

[Dovecot] Request queue is full
by Raphael Bittencourt S. Costa 14 Aug '08

14 Aug '08

Hello all, Today I had problems on one of the servers. Dovecot stopped working and I got lots of "Request queue is full" on logs. Aug 14 16:49:45 mailserver03 dovecot: auth(default): ldap(xxx(a)xxx.com.br): Request queue is full Aug 14 16:49:45 mailserver03 dovecot: auth(default): ldap(xxxxx(a)xxxx.com.br): Request queue is full Aug 14 16:49:45 mailserver03 dovecot: auth(default): ldap(xxxx(a)xxxxx.com,10.0.3.1): Request queue is full Only after a restart on dovecot daemon the services worked again. Does anyone know how can I fix this problem? The server were with about 900 imap connections and 300 pop3 connections. # 1.1.1: /etc/dovecot//dovecot.conf syslog_facility: local1 protocols: imap pop3 ssl_disable: yes disable_plaintext_auth: no shutdown_clients: no login_dir: /usr//var/run/dovecot/login login_executable(default): /usr//libexec/dovecot/imap-login login_executable(imap): /usr//libexec/dovecot/imap-login login_executable(pop3): /usr//libexec/dovecot/pop3-login login_process_per_connection: no login_greeting_capability(default): yes login_greeting_capability(imap): yes login_greeting_capability(pop3): no login_process_size: 128 login_processes_count: 30 login_max_processes_count: 1024 login_max_connections: 512 max_mail_processes: 10240 mail_max_userip_connections(default): 20 mail_max_userip_connections(imap): 20 mail_max_userip_connections(pop3): 10 mail_uid: 1033 mail_gid: 1033 mail_location: maildir:%h/Maildir mail_executable(default): /usr//libexec/dovecot/imap mail_executable(imap): /usr//libexec/dovecot/imap mail_executable(pop3): /usr//libexec/dovecot/pop3 mail_plugins(default): quota imap_quota autocreate mail_plugins(imap): quota imap_quota autocreate mail_plugins(pop3): quota mail_plugin_dir(default): /usr//lib/dovecot/imap mail_plugin_dir(imap): /usr//lib/dovecot/imap mail_plugin_dir(pop3): /usr//lib/dovecot/pop3 pop3_no_flag_updates(default): no pop3_no_flag_updates(imap): no pop3_no_flag_updates(pop3): yes pop3_uidl_format(default): %08Xu%08Xv pop3_uidl_format(imap): %08Xu%08Xv pop3_uidl_format(pop3): %f pop3_client_workarounds(default): pop3_client_workarounds(imap): pop3_client_workarounds(pop3): outlook-no-nuls namespace: type: private prefix: INBOX. inbox: yes list: yes subscriptions: yes auth default: mechanisms: plain login passdb: driver: ldap args: /etc/dovecot/dovecot-ldap.conf userdb: driver: prefetch userdb: driver: ldap args: /etc/dovecot/dovecot-ldap.conf socket: type: listen master: path: /var/run/dovecot/auth-master mode: 438 plugin: quota: maildir quota_rule: *:bytes=10240 quota_rule2: *:messages=30000 quota_rule3: Trash:bytes=10%% autocreate: SPAM.E Spam autocreate2: SPAM.Marcar Spam autocreate3: SPAM autocreate4: SPAM.Desmarcar Spam []s, Raphael Costa

1 0

[Dovecot] restricting shared folders access
by Andrew Von Cid 14 Aug '08

14 Aug '08

Hi all, I have a dovecot setup with virtual users and a passwd-file passdb. All users have the same uid and gid. Recently I got my public folders working using namespaces and they work great. However, now I'm trying to share a folder between a limited number of users and so far I failed to get it working. Symlinks aren't an option because users need to be able to create subfolders of the shared folder so I'm trying to do it with namespaces but I'm not sure how to restrict access to a limited number of users. I tried doing it with groups. I made sure that the shared folder's group is set to 'staff' and the mode is 070, I also changed the group of a few virtual users to 'staff'. However, when I try accessing the shared folder I get a permission denied error (although the user is in the staff group). Can someone please recommend the best way to do this? Should I look into ACL's? Many thanks, Andrew.

2 4

Re: [Dovecot] Cyrus vs Dovecot
by kbajwa 14 Aug '08

14 Aug '08

Hello: I think you are missing a point which is most important, i.e., what type of support Cyrus vs Dovecot offers. In my experience: Cyrus = 0 Dovecot = 100 My personal experience. Kirt

10 14

[Dovecot] Plugin when downloading mail
by martijn＠youngguns.nl 14 Aug '08

14 Aug '08

Is there a way to modify mail messages when they are downloaded using a special login. eg. my normal login for dovecot is martijn(a)youngguns.nl but when I log in using martijn(a)dosomething.youngguns.nl I would like to download my mail which are processed using a Perl script. The Perl script will modify the content of the message (the message body). So I don't want to change the header or IMAP flags. Martijn

3 2

[Dovecot] Corrupted index cache files
by Mike Abbott 14 Aug '08

14 Aug '08

I see these errors more often than I'd like from Dovecot-1.1.2 on Mac OS X 10.5.4 (names and numbers elided): Corrupted index cache file %s: Corrupted virtual size for uid=%d: %d ! = %d Corrupted index cache file %s: Broken virtual size for mail UID %d Corrupted index cache file %s: used_file_size too large How bad are these? What should I look for to find out why they happen? Other details: File system is HFS+ Mail store is maildir Hardware is Intel (Mac Pro) Thanks.

3 10

[Dovecot] Has anyone ever seen outlook do single sign on with dovecot/etc?
by Jason Gunthorpe 14 Aug '08

14 Aug '08

Hey all, I'm curious, has anyone been able to get outlook to do single sign on with a linux IMAP/SMTP back end? I have it doing NTLM authentication via the dovecot winbind module with Samba 3.2 just fine, but I have yet to see it try to use the cached windows logon credentials.. It appears to do an NTLM exchange with a blank password and then prompt for a password and then do an exchange with the given password. It does the same thing if PLAIN authentication is used. I'm starting to suspect MS deliberately hobbled outlook so that it uses the SSPI to exchange an entered password but not ever the logon credentials.. Does anyone know different? What a topsy-turvy world when thunderbird using SSPI works better on Windows than outlook. :| Thanks, Jason

1 0

[Dovecot] Disabling access for one user
by Kenneth Porter 14 Aug '08

14 Aug '08

I'm converting my system from mbox to Maildir one user at a time, and I'd like to disable access for the user I'm working on. Is there a way to tell Dovecot to lock out a specific user? Perhaps with a control file in the home directory? At the same time, how can I get sendmail+procmail to tempfail incoming messages for one user until I'm done?

5 9

Re: [Dovecot] Search for (any of) multiple terms slow
by Patrick Nagel 14 Aug '08

14 Aug '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On Wed, 13 Aug 2008 17:18:37 -0400, Timo Sirainen <tss(a)iki.fi> wrote: > On Aug 13, 2008, at 3:25 AM, Patrick Nagel wrote: > >> When searching for multiple terms at once ("any of") with >> Thunderbird/Dovecot >> (using FTS Squat indexes), it takes much longer (not double the >> time, or a bit >> more than that, but really much, much longer) than when I search for >> only one term. > > Yea, OR isn't supported by FTS plugin yet.. I had hoped no-one would > notice it ;) I guess I should do something about it. Heh, I see ;) As it is, the FTS plugin is quite useless to us though :( most of the time people are doing a (real world) search, they don't remember the exact word they're looking for. For example they only remember that the mail they're looking for contained "English" and "automobile" - or was it "Englisch" and "Automobil", because the mail was in German? So to get a list of all possible mails, they want to make use of the OR connection of search terms... > Requires a lot > more complexity to the code though.. Couldn't Dovecot just search the index with each single word (as it does now without OR), and then merge the results, filtering out double UIDs? This is probably not the most efficient way to solve this, but it would be definitely *much* faster than not using the indexes at all - and doesn't sound too complex to me. Are there any other not-yet-implemented SEARCH features that don't work with the FTS plugin? Thanks, Patrick. - -- STAR Software (Shanghai) Co., Ltd. http://www.star-group.net/ Phone: +86 (21) 3462 7688 x 826 Fax: +86 (21) 3462 7779 PGP key: https://stshacom1.star-china.net/keys/patrick_nagel.asc Fingerprint: E09A D65E 855F B334 E5C3 5386 EF23 20FC E883 A005 -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.9 (GNU/Linux) Comment: http://getfiregpg.org iEYEARECAAYFAkijga4ACgkQ7yMg/OiDoAUnFwCfXDUDHR+UdlMKkqwn2/nkB61I X3MAn1nK8KVW8RbtzQ6qQGipGb3uMXRa =I8Eh -----END PGP SIGNATURE-----

2 1

[Dovecot] Can't purge folders in Trash with listescape loaded in 1.1.2
by Adam McDougall 14 Aug '08

14 Aug '08

I made sure I didn't have the Trash folder open by restarting dovecot, then going to File -> Empty Trash in thunderbird. rawlog in, listescape loaded: 3 select "Trash" 4 list "" "Trash/*" 5 delete "Trash/test" 6 IDLE rawlog out, listescape loaded: * OK [RAWLOG TIMESTAMP] 2008-08-08 10:54:14 * FLAGS (\Answered \Flagged \Deleted \Seen \Draft Old NonJunk $MDNSent unknown-3 $Forwarded unknown-0 unknown-5 unknown-7 Junk unknown-1 unknown-4 unknown-9 unknown-10 $label1 $label4 $label5) * OK [PERMANENTFLAGS (\Answered \Flagged \Deleted \Seen \Draft Old NonJunk $MDNSent unknown-3 $Forwarded unknown-0 unknown-5 unknown-7 Junk unknown-1 unknown-4 unknown-9 unknown-10 $label1 $label4 $label5 \*)] Flags permitted. * 0 EXISTS * 0 RECENT * OK [UIDVALIDITY 1194838495] UIDs valid * OK [UIDNEXT 55158] Predicted next UID 3 OK [READ-WRITE] Select completed. * LIST (\HasNoChildren) "/" "Trash/test" 4 OK List completed. 5 NO Unknown internal list error + idling rawlog in, listescape loaded: 3 select "Trash" 4 list "" "Trash/*" 5 delete "Trash/test" 6 unsubscribe "Trash/test" 7 IDLE rawlog in, listescape loaded: * OK [RAWLOG TIMESTAMP] 2008-08-08 10:56:34 * FLAGS (\Answered \Flagged \Deleted \Seen \Draft Old NonJunk $MDNSent unknown-3 $Forwarded unknown-0 unknown-5 unknown-7 Junk unknown-1 unknown-4 unknown-9 unknown-10 $label1 $label4 $label5) * OK [PERMANENTFLAGS (\Answered \Flagged \Deleted \Seen \Draft Old NonJunk $MDNSent unknown-3 $Forwarded unknown-0 unknown-5 unknown-7 Junk unknown-1 unknown-4 unknown-9 unknown-10 $label1 $label4 $label5 \*)] Flags permitted. * 0 EXISTS * 0 RECENT * OK [UIDVALIDITY 1194838495] UIDs valid * OK [UIDNEXT 55158] Predicted next UID 3 OK [READ-WRITE] Select completed. * LIST (\HasNoChildren) "/" "Trash/test" 4 OK List completed. 5 OK Delete completed. 6 OK Unsubscribe completed. + idling dovecot -n: # 1.1.2: /usr/local/etc/dovecot.conf ssl_cert_file: /usr/local/etc/apache22/ssl/mail.pem ssl_key_file: /usr/local/etc/apache22/ssl/mail.pem login_dir: /var/run/dovecot/login login_executable: /usr/local/libexec/dovecot/imap-login login_max_processes_count: 512 max_mail_processes: 1024 mail_max_userip_connections: 25 verbose_proctitle: yes first_valid_uid: 1000 first_valid_gid: 1000 mail_access_groups: postlocal mail_location: maildir:%h/Maildir:CONTROL=%h/Maildir/dovecot/private/control:INDEX=%h/Maildir/dovecot/private/indexes mmap_disable: yes mail_nfs_storage: yes mail_nfs_index: yes mail_drop_priv_before_exec: yes mail_process_size: 1024 mail_plugins: acl fts fts_squat listescape quota imap_quota mail_log_max_lines_per_sec: 0 imap_client_workarounds: delay-newmail outlook-idle netscape-eoh tb-extra-mailbox-sep namespace: type: private separator: / inbox: yes list: yes subscriptions: yes namespace: type: private separator: / prefix: mail/ hidden: yes subscriptions: yes namespace: type: private separator: / prefix: Mail/ hidden: yes subscriptions: yes auth default: passdb: driver: pam userdb: driver: passwd args: system_user= socket: type: listen client: path: /var/spool/postfix/private/auth mode: 384 user: postfix group: postfix plugin: quota: fs:noenforcing:inode_per_mail acl: vfile:/usr/local/etc/dovecot-acls:cache_secs=10 fts: squat

2 2

[Dovecot] mbox empty messages in Sent folder
by Diego Liziero 14 Aug '08

14 Aug '08

I'm talking about mbox Sent folder, where some mailers append through imap server a copy of each message they send. Sometimes, just three header lines got appended instead of the whole mail message, such as: >From xxxxxxxx(a)xxxxxx.xxxxxx.xxxxx.xx.xx Fri May 23 12:30:14 2008 X-UID: 2852 Status: RO This happened in the past (dovecot-1.1-beta/rc with Evolution and with Thunderbird), and happened last week with dovecot-1.1-rc5 (+ last week hg patches). Anyone had a similar issue? Regards, Diego.

2 17

[Dovecot] 1.1.x problems
by Andre Hübner 14 Aug '08

14 Aug '08

Hi, since upgrading to 1.1.x i still have this bugs "Next message unexpectedly lost " I read this Maillist some months ago and i believe that im not the only one... The Panics and crashes in 1.1.1 are gone by upgrading to 1.1.2 but these "Next message unexpectedly lost " bugs are really annoying if users can't download complete mails. is there something new to this issue. all recommend changes did not help. The only thing i could do is downgrade to 1.0.15 and all works fine. i can not keep the 1.1.x versions in my repo untill this case is solved. :( Thanks Andre

3 4

[Dovecot] [PATCH] Support GSS-SPNEGO natively
by Jason Gunthorpe 13 Aug '08

13 Aug '08

I cooked this up while trying to figure out why thunderbird on Windows w/ SSPI was not working, but it turned out thunderbird does not use it, so I haven't been able to test it yet. I'm presenting it for discussion only, unless someone else can try it :) Modern versions of MIT kerberos support GSS-SPNEGO natively, but are only willing to negotiate for kerberos tickets and not NTLM messages. This is how the SPNEGO works in libapache-mod-auth-kerb-5.3 which simply passes SPNEGO packets directly to gssapi if the library is new enough. There is even a configure feature test for the gssapi library in that packages configure script. Note that Debian etch's standard kerb libaries (1.4) are not good enough for this. Having this work means the other gssapi policy knobs in dovecot, like auth_gssapi_hostname, work properly. Instead of 'whatever it is that samba does'. I guess it fixes the concerns about winbind accesses blocking (although don't the gssapi calls block??) In light of this it is really only useful to use winbind if you want to support NTLM as kerberos will do the necessary exchanges with the kdc for an Active Directory domain. In truth a proper and complete design would somehow layer the built in NTLM module under the SPNEGO negotiation and only pass NTLM messages off to samba but I doubt anyone cares with NTLM being rather obsolete. --- dovecot-1.0.13/src/auth/mech-gssapi.c 2007-12-11 11:52:08.000000000 -0700 +++ dovecot-1.0.13-jgg/src/auth/mech-gssapi.c 2008-08-11 23:52:15.000000000 -0600 @@ -417,4 +424,21 @@ mech_gssapi_auth_free }; +/* MTI Kerberos > 1.5 supports SPNEGO for Kerberos tickets internally. + Nothing else needs to be done here. Note however that this does not + support SPNEGO when the only available credential is NTLM.. */ +const struct mech_module mech_gssapi_spnego = { + "GSS-SPNEGO", + + MEMBER(flags) 0, + + MEMBER(passdb_need_plain) FALSE, + MEMBER(passdb_need_credentials) FALSE, + + mech_gssapi_auth_new, + mech_gssapi_auth_initial, + mech_gssapi_auth_continue, + mech_gssapi_auth_free +}; + #endif --- dovecot-1.0.13/src/auth/mech.c 2007-12-11 11:52:08.000000000 -0700 +++ dovecot-1.0.13-jgg/src/auth/mech.c 2008-08-11 21:30:56.000000000 -0600 @@ -72,6 +72,7 @@ extern struct mech_module mech_anonymous; #ifdef HAVE_GSSAPI extern struct mech_module mech_gssapi; +extern struct mech_module mech_gssapi_spnego; #endif void mech_init(void) @@ -86,6 +87,7 @@ mech_register_module(&mech_anonymous); #ifdef HAVE_GSSAPI mech_register_module(&mech_gssapi); + mech_register_module(&mech_gssapi_spnego); #endif } @@ -101,5 +103,6 @@ mech_unregister_module(&mech_anonymous); #ifdef HAVE_GSSAPI mech_unregister_module(&mech_gssapi); + mech_unregister_module(&mech_gssapi_spnego); #endif }

3 9

[Dovecot] [PATCH] Allow GSSAPI to work with multihomed hosts
by Jason Gunthorpe 13 Aug '08

13 Aug '08

I saw some past chatter on this in the list archives, but here is another stab and another rational. This patch follows a similar patch to openssh in that it allows any key in the specified keytab to match the incoming host key. This is necessary for multihomed hosts. See: https://bugzilla.mindrot.org/show_bug.cgi?id=928 IMAP/POP seem to be a strong candidate to be multihomed because they are very likely to have an internal to a firewall and external to a firewall name. Due to the way MIT kerberos handles host name resolution via reverse IP lookup this can often result in multiple principle names and there is simply nothing to be done about it. This is my situation.. When you add windows into the mix, which uses a totally different set of rules to determine the principle all hope seems to be lost to have a single service principle name for an imap server :( I was able to make things work for my environment using only the auth_gssapi_hostname feature if only MIT kerberos was used, but as soon as windows SSPI was involved it choose a different hostname. Thus we want to have GSSAPI to match any service principle in the keytab. As far as security concerns go, the admin can configure the keytab for dovecot to be seperate from the system key tab and contain only valid imap SPNs, but in truth it probably doesn't matter. I choose to just use the magic configurable: auth_gssapi_hostname = $ALL rather than introduce more configurables FWIW, after applying this I now am happy to say I have an Active Directory KDC, with dovecot providing gssapi auth to thunderbird on both linux (mit kerb 1.6) and windows (sspi).. --- dovecot-1.0.13/src/auth/mech-gssapi.c 2007-12-11 11:52:08.000000000 -0700 +++ dovecot-1.0.13-jgg/src/auth/mech-gssapi.c 2008-08-11 23:52:15.000000000 -0600 @@ -101,6 +101,13 @@ gss_name_t gss_principal; const char *service_name; + if (strcmp(request->auth->gssapi_hostname,"$ALL") == 0) { + auth_request_log_info(request, "gssapi", + "Using all keytab entires"); + *ret = GSS_C_NO_CREDENTIAL; + return GSS_S_COMPLETE; + } + if (strcasecmp(request->service, "POP3") == 0) { /* The standard POP3 service name with GSSAPI is called just "pop". */

2 2

[Dovecot] dovecot sieve sends vacation messages with null envelope sender
by Josef Liška 13 Aug '08

13 Aug '08

I am using this simple sieve script to do "vacation": require ["fileinto", "vacation"]; if exists "X-Spam-Flag" { stop; } vacation :days 1 :subject "Out of office reply" :addresses ["<email address hidden>", "<email address hidden>" ] "I am on vacation until 2008-08-07. If you have something urgent, please contact: Jan Novak <email address hidden> "; I use sql lookups for users and passwords. For some reason the default location ~/.dovecot-sieve did not work for some reason. However I prefer to put sieve scripts to /var/lib/sieve and when I added additional field to lookup with this location it started to work. But it sends vacation messages with null envelope sender, which is in my opinion undesirable, because many vacation messages are caught in spam filters. I think there could be same sender on envelope. In dovecot-sieve/src/sieve-cmu.c around line 380 is a call to smtp_client_open(src->addr, NULL, &f); NULL could be replaced with src->fromaddr Maybe some more patching may be necesary. I found similar patch for cyrus-imapd at http://oss.digirati.com.br/mail/cyrus.html <http://oss.digirati.com.br/mail/cyrus.html> My current system: 1) Ubuntu 8.04.1 jl@mail:~$ dovecot --version 1.0.15 It is a backported package from ubuntu intrepid ibex. However the same applies for dovecot 1.0.10 which is in ubuntu 8.04. Summary: I expect messages sent by vacation recipe should have envelope from same as user's e-mail address. This is then writen to Return-Path: header by receiving MTA NULL envelope from is used, resulting (in my case) to Return-Path: <> rewriten by postfix to Return-Path: <MAILER-DAEMON> by receiving MTA

7 6

[Dovecot] RfE: use HOSTNAME environment variable in hostpid_init()
by Heiko Schlichting 13 Aug '08

13 Aug '08

Hi, All parts of dovecot except deliver uses the result of hostpid_init() in src/lib/hostpid.c as a hostname which only asks gethostname(). deliver honours environment variable HOSTNAME in src/deliver/deliver.c: getenv("HOSTNAME"); and uses the hostname of hostpid_init() as a fallback. Wouldn't it be consequent to evaluate the environment variable HOSTNAME in hostpid_init() with fallback to gethostname() and remove the special behavior from deliver? The dovecot master process should export $HOSTNAME to all childs in this case. Motivation: Dovecot uses the hostname as part of Maildir file names and gethostname() is not fully qualified on all operating systems (it is on IRIX but not on Linux). But unqualified hostnames are not unique and it is frequent that dovecot hosts are named "mail" oder "imap" as hostname. To distinguish between mail.domain1.com and mail.domain2.net would be easier if dovecot evaluate $HOSTNAME in all case not just deliver as program imap can create Maildir files as well. Heiko Heiko Schlichting Freie Universität Berlin heiko(a)FU-Berlin.DE Zentraleinrichtung für Datenverarbeitung (ZEDAT) Telefon +49 30 838-54327 Fabeckstraße 32 Telefax +49 30 838454327 14195 Berlin

2 1

[Dovecot] syslog with PID
by Heiko Schlichting 13 Aug '08

13 Aug '08

Hi, LOG_NDELAY is the only option for openlog() in dovecot 1.1.2. Wouldn't be LOG_NDELAY|LOG_PID as option parameter much more useful? Without logging the pid, it is impossible to match 'Disconnected' log entries and the corresponding session start/login. Therefore I suggest to use LOG_NDELAY|LOG_PID in the options of i_set_failure_syslog() at all 6 occurrences which passes it to openlog(). I know that it is possible to - use logging to file - patch it myself but I can't see good reasons in not using LOG_PID here. As far as I know, most other programs specify LOG_PID. Without LOG_PID: Jul 31 10:21:08 name dovecot: IMAP(hsg): Disconnected: Logged out bytes=28/242 With LOG_PID: Jul 31 10:21:08 name dovecot[17016]: IMAP(hsg): Disconnected: Logged out bytes=28/242 Heiko Heiko Schlichting Freie Universität Berlin heiko(a)FU-Berlin.DE Zentraleinrichtung für Datenverarbeitung (ZEDAT) Telefon +49 30 838-54327 Fabeckstraße 32 Telefax +49 30 838454327 14195 Berlin

3 5

[Dovecot] sieve - Sendmail process terminated abnormally, exit status 70
by Thomas Harold 13 Aug '08

13 Aug '08

How do we start troubleshooting this? deliver(user(a)example.com): Aug 12 18:27:19 Error: Sendmail process terminated abnormally, exit status 70 deliver(user(a)example.com): Aug 12 18:27:19 Info: sieve runtime error: Vacation: Error sending mail deliver(user(a)example.com): Aug 12 18:27:19 Info: msgid=<48A20E3C.7070307(a)example.com>: saved mail to INBOX deliver(user(a)example.com): Aug 12 18:27:19 Error: sieve_execute_bytecode(/var/vmail/example.com/user//Home/.dovecot.sievec) failed It seems to only choke on the vacation portion. It creates entries in the ".dovecot.lda-dupes" file. But then dies while sending the reply e-mail. The contents of the user's .dovecot.sieve file is: ------------------------------------- require ["fileinto", "include", "vacation"]; # Move spam to spam folder if exists "X-Spam-Flag" { fileinto "spam"; # Stop here so that we do not reply on spams stop; } include :personal "sieve-vacation"; ------------------------------------- And the "" file looks like: ------------------------------------- require ["vacation"]; vacation # Reply at most once a day to a same sender :days 1 :subject "Out of office reply" # List of recipient addresses which are included in the auto replying. # If a mail's recipient is not on this list, no vacation reply is sent for it. :addresses "user(a)example.com" "blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah, user(a)example.com"; ------------------------------------- If I comment out the "include :personal "sieve-vacation";" line, then it works, but obviously not the vacation portion. Deliver does at least not die horribly. I get the same error if I move the content of the vacation include file into the main ".dovecot.sieve" file. # ls -la /usr/local/libexec/dovecot/lda/ -rwsr-xr-x 1 root root 802824 Aug 12 18:12 deliver # ls -la /usr/libexec/dovecot/ total 5728 drwxr-xr-x 2 root root 4096 Jul 31 04:04 . drwxr-xr-x 11 root root 4096 Jul 25 04:39 .. -rwxr-xr-x 1 root root 58416 Jul 24 06:32 checkpassword-reply -rwxr-xr-x 1 root root 666128 Jul 24 06:32 convert-tool -rwxr-xr-x 1 root root 802824 Jul 24 06:32 deliver -rwxr-xr-x 1 root root 164176 Jul 24 06:32 dict -rwxr-xr-x 1 root root 350384 Jul 24 06:32 dovecot-auth -rwxr-xr-x 1 root root 674176 Jul 24 06:32 expire-tool -rwxr-xr-x 1 root root 59200 Jul 24 06:32 gdbhelper -rwxr-xr-x 1 root root 245872 Jul 24 06:32 idxview -rwxr-xr-x 1 root root 854488 Jul 24 06:32 imap -rwxr-xr-x 1 root root 157216 Jul 24 06:32 imap-login -rwxr-xr-x 1 root root 61248 Jul 24 06:32 listview -rwxr-xr-x 1 root root 61800 Jul 24 06:32 logview -rwxr-xr-x 1 root root 74200 Jul 24 06:32 maildirlock -rwxr-xr-x 1 root root 931 Jul 24 06:27 mkcert.sh -rwxr-xr-x 1 root root 787464 Jul 24 06:32 pop3 -rwxr-xr-x 1 root root 149152 Jul 24 06:32 pop3-login -rwxr-xr-x 1 root root 83968 Jul 24 06:32 rawlog -rwxr-xr-x 1 root root 165152 Jun 11 03:21 sievec -rwxr-xr-x 1 root root 157216 Jun 11 03:21 sieved -rwxr-xr-x 1 root root 62584 Jul 24 06:32 ssl-build-param (output of "yum list") dovecot.x86_64 :1.1.2-2_77.el5 installed dovecot-sieve.x86_64 1.1.5-8.el5 installed I'm not finding any AVC errors in the SELinux audit.log file. And I'm not sure what other switches I can turn on to get better error information as to what sendmail/deliver are choking on in this virtual (setuid) environment where we use Dovecot as the LDA.

3 3

[Dovecot] Marking as Read causes Body.Peek on ALL messages - Reasonable?
by Daniel Watts 13 Aug '08

13 Aug '08

I've noticed when I select a folder of messages (Thunderbird) and mark them all as read (or unread) it produces the following IMAP transcript: Source Destination Info c.c.c.c s.s.s.s Request: DONE s.s.s.s c.c.c.c Response: 20 OK Idle completed. c.c.c.c s.s.s.s Request: 21 uid store 1:20 -Flags (\Seen) s.s.s.s c.c.c.c Response: * 1 FETCH (UID 1 FLAGS (\Recent NonJunk)) c.c.c.c s.s.s.s Request: 22 UID fetch 2 (UID RFC822.SIZE BODY.PEEK[]) s.s.s.s c.c.c.c Response: * 2 FETCH (UID 2 RFC822.SIZE 1339 BODY[] {1339} c.c.c.c s.s.s.s Request: 23 UID fetch 3 (UID RFC822.SIZE BODY.PEEK[]) s.s.s.s c.c.c.c Response: * 3 FETCH (UID 3 RFC822.SIZE 1342 BODY[] {1342} c.c.c.c s.s.s.s Request: 24 UID fetch 5 (UID RFC822.SIZE BODY.PEEK[]) s.s.s.s c.c.c.c Response: * 5 FETCH (UID 5 RFC822.SIZE 1344 BODY[] {1344} c.c.c.c s.s.s.s Request: 25 UID fetch 6 (UID RFC822.SIZE BODY.PEEK[]) s.s.s.s c.c.c.c Response: * 6 FETCH (UID 6 RFC822.SIZE 1350 BODY[] {1350} c.c.c.c s.s.s.s Request: 26 UID fetch 7 (UID RFC822.SIZE BODY.PEEK[]) s.s.s.s c.c.c.c Response: * 7 FETCH (UID 7 RFC822.SIZE 1344 BODY[] {1344} c.c.c.c s.s.s.s Request: 27 UID fetch 8 (UID RFC822.SIZE BODY.PEEK[]) s.s.s.s c.c.c.c Response: * 8 FETCH (UID 8 RFC822.SIZE 1325 BODY[] {1325} c.c.c.c s.s.s.s Request: 28 UID fetch 9 (UID RFC822.SIZE BODY.PEEK[]) s.s.s.s c.c.c.c Response: * 9 FETCH (UID 9 RFC822.SIZE 1323 BODY[] {1323} c.c.c.c s.s.s.s Request: 29 UID fetch 10 (UID RFC822.SIZE BODY.PEEK[]) s.s.s.s c.c.c.c Response: * 10 FETCH (UID 10 RFC822.SIZE 1338 BODY[] {1338} c.c.c.c s.s.s.s Request: 30 UID fetch 11 (UID RFC822.SIZE BODY.PEEK[]) s.s.s.s c.c.c.c Response: * 11 FETCH (UID 11 RFC822.SIZE 1333 BODY[] {1333} c.c.c.c s.s.s.s Request: 31 UID fetch 12 (UID RFC822.SIZE BODY.PEEK[]) s.s.s.s c.c.c.c Response: * 12 FETCH (UID 12 RFC822.SIZE 1344 BODY[] {1344} c.c.c.c s.s.s.s Request: 32 UID fetch 13 (UID RFC822.SIZE BODY.PEEK[]) s.s.s.s c.c.c.c Response: * 13 FETCH (UID 13 RFC822.SIZE 1335 BODY[] {1335} c.c.c.c s.s.s.s Request: 33 UID fetch 15 (UID RFC822.SIZE BODY.PEEK[]) s.s.s.s c.c.c.c Response: * 15 FETCH (UID 15 RFC822.SIZE 1323 BODY[] {1323} c.c.c.c s.s.s.s Request: 34 UID fetch 16 (UID RFC822.SIZE BODY.PEEK[]) s.s.s.s c.c.c.c Response: * 16 FETCH (UID 16 RFC822.SIZE 1325 BODY[] {1325} c.c.c.c s.s.s.s Request: 35 UID fetch 17 (UID RFC822.SIZE BODY.PEEK[]) s.s.s.s c.c.c.c Response: * 17 FETCH (UID 17 RFC822.SIZE 1333 BODY[] {1333} c.c.c.c s.s.s.s Request: 36 UID fetch 18 (UID RFC822.SIZE BODY.PEEK[]) s.s.s.s c.c.c.c Response: * 18 FETCH (UID 18 RFC822.SIZE 1327 BODY[] {1327} c.c.c.c s.s.s.s Request: 37 UID fetch 19 (UID RFC822.SIZE BODY.PEEK[]) s.s.s.s c.c.c.c Response: * 19 FETCH (UID 19 RFC822.SIZE 1343 BODY[] {1343} c.c.c.c s.s.s.s Request: 38 UID fetch 20 (UID RFC822.SIZE BODY.PEEK[]) s.s.s.s c.c.c.c Response: * 20 FETCH (UID 20 RFC822.SIZE 1337 BODY[] {1337} c.c.c.c s.s.s.s Request: 39 IDLE s.s.s.s c.c.c.c Response: + idling NOTE: c.c.c.c = client (thunderbird) s.s.s.s = server (dovecot 1.1.2) Is this reasonable? I thought it would be possible to just send a list of message UIDs and say mark these as /seen /unseen etc. Of course this could (is probably) just Thunderbird being braindead but confirmation would be appreciated. Thanks, Daniel

2 1

[Dovecot] IMAP inbox: cannot delete tagged messages or change their tag
by Epimedia 13 Aug '08

13 Aug '08

Hello, a bit of a problem with Dovecot. Version is 1.0.15 and is a default install (no changes to config) from FC8 repository... except that Dovecot is configured to use Maildir I have a user on the system who uses the tags in Thunderbird (Important, Personal etc). When she tags the messages they cannot be deleted and their tags cannot be changed. When deleting a message from the IMAP inbox it momentarily disappears and moves a copy to the Trash but when the IMAP inbox is reloaded the message reappears. The same happens when I try to change a tag: it comes back with the previous tag. Untagged messages can be freely deleted. Also, this problem does not happen if the messages are in a IMAP folder. They can be freely deleted. The problem seems specific to Dovecot, not Thunderbird, as I am able to tag and delete messages in another IMAP account. Also, accessing the same IMAP account using OS X Mail the messages come back after deleting them. Where should I start looking for a solution to this problem?

2 1

[Dovecot] Trying to Hide Namespace - new configuration options?
by Daniel Watts 13 Aug '08

13 Aug '08

Using 1.1.2 We have: # default namespace namespace private { separator = / prefix = inbox = yes #location = maildir:/home/virtual/%h #Maildir } # for backwards compatibility: namespace private { separator = / prefix = mail/ location = maildir:%h/Maildir/ #Maildir hidden = yes list = no } The 'hidden=yes' seemed to do nothing but saw earlier in this list a reply to add 'list=no'. This has worked to hide all folder but we still have /mail/Trash showing and it refuses to go away even after unsubscribing. mail/Trash appears when I set my email client to use folder prefix "mail/". If i set the prefix to blank I only see my Inbox and Deleted folders. Interestingly it shows 'Deleted' not 'Trash'. I guess Thunderbird renames 'Trash'. What other configs are there to try? Is there a list of config changes for 1.1.x anywhere? We were not aware of the list=no config. Thanks, Daniel

2 2