- dovecot - dovecot.org

[Dovecot] Read-only account through INDEX=MEMORY:CONTROL=MEMORY and non-writable Unix-permissions
by Steffen Kaiser 22 Sep '13

22 Sep '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi, my goal is to provide a special mailbox for some mail accounts. The user should get the information, to look somewhere else. The user must not change anything at all. I also don't want to provide a mailbox for each user. I got the setup below, which seems to run with Dovecot v2.2; however, "CONTROL=MEMORY" is not documented. Is the setup stable for next versions of Dovecot or is CONTROL=MEMORY not a feature, but a bug? ====== user settings: home=/home/nomailbox mail=maildir:/home/nomailbox/Maildir:INDEX=MEMORY:CONTROL=MEMORY uid=vmail gid=vmail The structure of the directory: /home/nomailbox/: total 12 drwxr-xr-x 3 root root 4096 Oct 24 2007 ./ drwxr-xr-x 18 root root 4096 Sep 9 10:36 ../ dr-xr-xr-x 5 root root 4096 Oct 24 2007 Maildir/ /home/nomailbox/Maildir: total 20 dr-xr-xr-x 5 root root 4096 Oct 24 2007 ./ drwxr-xr-x 3 root root 4096 Oct 24 2007 ../ dr-xr-xr-x 2 root root 4096 Oct 24 2007 cur/ dr-xr-xr-x 2 root root 4096 Sep 9 08:23 new/ dr-xr-xr-- 2 root root 4096 Oct 24 2007 tmp/ /home/nomailbox/Maildir/cur: total 8 dr-xr-xr-x 2 root root 4096 Oct 24 2007 ./ dr-xr-xr-x 5 root root 4096 Oct 24 2007 ../ - -rw-r--r-- 1 root root 0 Oct 24 2007 .placeholder /home/nomailbox/Maildir/new: total 12 dr-xr-xr-x 2 root root 4096 Sep 9 08:23 ./ dr-xr-xr-x 5 root root 4096 Oct 24 2007 ../ - -r--r--r-- 1 root root 804 Sep 9 08:24 no-mailbox-for-you /home/nomailbox/Maildir/tmp: total 8 dr-xr-xr-- 2 root root 4096 Oct 24 2007 ./ dr-xr-xr-x 5 root root 4096 Oct 24 2007 ../ - -- Steffen Kaiser -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) iQEVAwUBUi22kF3r2wJMiz2NAQLJEAf/WM0jXqVmZ6HtEvoKTB4grE2xFfN4Ylig imhPVf/yufYLzQw+w98fhrozEcm7UK0mUWpiJQzMowYyLNdF8tVwhgTdAfFa6fhK +L0+GxVcCuvRq/YjIivhgQ7gwZlhjLWa43Fo65HAqude4nnuyb5/RuVb0aPBlB73 1V5nMB5f9PSrlAjtK4kLOq1VRNp2SCVfBem/ESqhYSZ+O51gGZ8JRm7skWr82GmZ tdeYDa52h8CWm67S1lzNK42yNoElkLrH5MZJLCBmjg/hLjD99aMCAdgWRL5zyg/h bZzoOZNztQq0CwBHTB+KY9YBkfMmXzFtse3C0a2Eg9m5bmJmNblPGw== =iYWU -----END PGP SIGNATURE-----

2 1

[Dovecot] fdatasync -- Error -- bad file descriptor
by Vijay Rajah 22 Sep '13

22 Sep '13

Hello list, I have a dovecot 2.2.5 instance configured to use mdbox as mailbox format. I configured to use separate storage attachments and use SIS.. (doveconf -n below) I get this error Sep 6 12:29:52 vrajah.mydomain.tld dovecot: lmtp(14258, email(a)mydomain.tld) Error: fdatasync(/apps/mail/mailbox/attachments/23/12/2312039008db057a1c75-2efc2d00687d2952b2370000f89409f1) failed: Bad file descriptor I'm using centos 6.4 on a KVM with ext4 as fs. Can someone tell me why i'm getting this error? and how to fix this? -Thanks in advance Vijay ##########doveconf -n # 2.2.5: /apps/mail/dovecot/2.2.5/etc/dovecot/dovecot.conf # OS: Linux 2.6.32-358.14.1.el6.x86_64 x86_64 CentOS release 6.4 (Final) ext4 auth_mechanisms = plain login digest-md5 cram-md5 auth_socket_path = /apps/mail/var/dovecot/run/auth-userdb base_dir = /apps/mail/var/dovecot/run/ debug_log_path = /var/log/dovecot-debug.log dict { sqlquota = mysql:/apps/mail/dovecot/2.2.5/etc/dovecot/conf.d/sqlquota.dict.ext } hostname = mail1(a)mydomain.tldmydomain.tld mail_attachment_dir = /apps/mail/mailbox/attachments mail_attachment_hash = %{sha256:80} mail_debug = yes mail_location = mdbox:/apps/mail/mailbox/%d/%n/mdbox mail_plugin_dir = /apps/mail/dovecot/2.2.5/lib/dovecot/ mail_plugins = " virtual quota zlib" managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave mbox_write_locks = fcntl dotlock mdbox_rotate_size = 1 M namespace inbox { inbox = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk { auto = subscribe special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Spam { auto = subscribe } mailbox Trash { auto = subscribe special_use = \Trash } prefix = separator = / type = private } passdb { args = /apps/mail/dovecot/2.2.5/etc/dovecot/conf.d/dovecot-sql.conf.ext driver = sql } plugin { mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename mail_log_fields = uid box msgid size quota = dict:User quota::proxy::sqlquota quota_grace = 10%% quota_rule = *:storage=1GB quota_rule2 = Trash:storage=+10%% quota_rule3 = Spam:storage=+20%% quota_status_nouser = DUNNO quota_status_overquota = 450 4.2.2 Mailbox is full. Try again later quota_status_success = DUNNO quota_warning = storage=95%% quota-warning 95 %u quota_warning2 = storage=80%% quota-warning 80 %u quota_warning3 = -storage=100%% quota-warning below %u sieve = ~/.dovecot.sieve sieve_before = /apps/mail/var/dovecot/sieve/ sieve_dir = ~/sieve sieve_global_dir = /apps/mail/var/dovecot/sieve zlib_save = bz2 zlib_save_level = 9 } protocols = imap lmtp sieve service auth { unix_listener /apps/mail/var/postfix/dovecot-auth { group = postfix mode = 0660 user = postfix } } service dict { unix_listener dict { group = vmail mode = 0600 user = vmail } } service imap-login { inet_listener imap { port = 143 } } service lmtp { unix_listener /apps/mail/var/postfix/dovecot-lmtp { group = postfix mode = 0660 user = postfix } } service managesieve-login { inet_listener sieve { port = 4190 } service_count = 10 vsz_limit = 64 M } service managesieve { process_limit = 1024 } service quota-status { client_limit = 1 executable = quota-status -p postfix inet_listener { port = 12340 } } service quota-warning { executable = script /apps/mail/dovecot/2.2.5/etc/dovecot/conf.d/quota-warning.sh unix_listener quota-warning { group = vmail mode = 0660 user = vmail } user = vmail } shutdown_clients = no ssl_ca = </apps/mail/dovecot/2.2.5/etc/dovecot/ssl/mayca.crt.pem ssl_cert = </apps/mail/dovecot/2.2.5/etc/dovecot/ssl/mail1.mydomain.tld.pem ssl_key = </apps/mail/dovecot/2.2.5/etc/dovecot/ssl/mail1.mydomain.tld.key ssl_parameters_regenerate = 30 hours submission_host = 127.0.0.1:587 userdb { driver = prefetch } userdb { args = /apps/mail/dovecot/2.2.5/etc/dovecot/conf.d/dovecot-sql.conf.ext driver = sql } protocol lda { mail_plugins = " virtual quota zlib sieve zlib" } protocol imap { mail_plugins = " virtual quota zlib imap_quota imap_zlib" } protocol lmtp { debug_log_path = /var/log/dovecot-lmtp-debg.log mail_plugins = " virtual quota zlib sieve zlib" }

2 2

[Dovecot] permission problem when using public namespace and "subscription = yes"
by Lars Uhlmann 22 Sep '13

22 Sep '13

I have configured an public namespace "Test" for a group of users: | namespace public { | separator = . | prefix = Test. | location = maildir:/mailroot/public/Test | hidden = no | list = yes | subscriptions = yes | } Using each users own subscription file for a public mailbox doesn't make sense when the mailbox is heavily used. Every directory operation (create/rename) needs to be synced between all subscribers automatically and immediately. So I set "subscriptions = yes". My ACLS look like this: | user=mark lrwstiekx | user=tim lrwstiekx | user=max lr | user=jenny lrwstiekx | user=louis lr Nevertheless _all_ my mail users still have access to the namespace's directory tree. It is my understanding that when a user doesn't has 'lookup' access, he should not be able to subscribe to this mailbox. In my opinion this is a security problem. ACLs must be processed _before_ a shared subscrition file is parsed. regards Lars

2 1

Re: [Dovecot] Logging passwords on auth failure/dealing with botnets
by Joseph Tam 21 Sep '13

21 Sep '13

"Michael Smith (DF)" writes: > Or another option, is there any good DNS based RBLs for botnet IPs, and > is there any way to tie that in to the dovecot auth system? I've been > looking for botnet rbls, but what I've found so far doesn't seem to > work very well. Most of the IPs that I've had to firewall don't exist > in them. /dev/rob0 writes: > The problem with using XBL, anyway, is that you might have legitimate > logins from listed hosts. Example: a traveler using hotel wifi. We > (TINW) really would need a new DNSBL type (or a special result) for > this sort of abuse. > > It's a nice idea, worth building upon, if someone can fund it (or > find the time to develop it, which really amounts to the same thing.) > Imagine also a Dovecot network of reporters, where brute force > attempts worldwide are reported from Dovecots to the DNSBL, not > merely a one-way tie in. > > I'd also suggest listing SSH brute force attacks in the same DNSBL, > possibly with a different result (127.0.0.$port, so IMAP attackers > list as 127.0.0.143, SSH attackers as 127.0.0.22. Yes, we'd have to > incorporate the third quad for ports > 255, but the general idea is > for result codes to be both machine and human readable as much as > possible.) I use bl.blocklist.de as a DNSRBL for ssh BFD, but I think it also detects BFD for other protocols: http://www.blocklist.de/en/index.html The nice thing about this RBL is that you can also contribute by configuring your Fail2Ban/DenyHost to forward logs to the maintainers, to widen the detection network. I get about a 60% hit on ssh BFD attacks. I also found http://openbl.org but they distribute it as a downloadable file rather than as a DNSRBL. Maybe I can introduce the latter to the former. Joseph Tam <jtam.home(a)gmail.com>

3 2

[Dovecot] Solved: startup failures "net_listen_unix(...) failed: Invalid argument"
by C. Mills 21 Sep '13

21 Sep '13

I ran into this and had a bit of trouble tracking a diagnosis down, so here it is for the archives in case anyone else runs into this. A new installation of dovecot was failing to start, with these messages: $ ./sbin/dovecot Error: service(imap-urlauth): net_listen_unix(.../var/run/dovecot/token-login/imap-urlauth) failed: Invalid argument Error: service(auth): net_listen_unix(.../var/run/dovecot/token-login/tokenlogin) failed: Invalid argument Fatal: Failed to start listeners Some of the other processes seemed to be starting up fine, and they created sockets in the expected dir, but the above two wouldn't. stracing the processes didn't show a lot, but eventually I checked the length of the installation path, and found the above two socket paths were exceeding the maximum path length limit for Unix sockets -- 108 chars on my Linux boxen. I haven't checked SuS or Posix to see what the standards say the actual minimum required size for the maximum path length is -- it might be shorter yet on other systems. Moving the installation to a less deeply nested hierarchy fixed the problem. I hope this saves someone else a headache someday. C. C. -- ----------------------------------------------------------------------- C. Mills -----------------------------------------------------------------------

2 1

[Dovecot] dovecot and PFS
by Emmanuel Dreyfus 21 Sep '13

21 Sep '13

Hi Is there known advices on how to favor PFS with dovecot? In Apache, I use the following directives, with cause all modern browsers to adopt 256 bit PFS ciphers, while keeping backward compatibility with older browsers and avoiding BEAST attack: SSLProtocol all -SSLv2 SSLHonorCipherOrder On SSLCipherSuite ECDHE@STRENGTH:ECDH@STRENGTH:DH@STRENGTH:HIGH:-SSLv3-SHA1:-TLSv10 -SHA1:RC4:!MD5:!DES:!aNULL:!eNULL dovecot does not care about BEAST, since attacker cannot inject trafic. Therefore the cipher list get simplier in dovecot.conf: ssl_cipher_list = ECDHE@STRENGTH:ECDH@STRENGTH:DH@STRENGTH:HIGH:!MD5:!DES:!aNULL :!eNULL But that list is good for browsers. I am not aware of documentation about what ciphers are advertised by various mail client. How can I know if that setting has some success pushing PFS? How can I discover which clients fail to negociate PFS ciphers? -- Emmanuel Dreyfus manu(a)netbsd.org

4 4

[Dovecot] mailbox_list_index, stops showing new mails in mailboxes
by Anton Lundin 21 Sep '13

21 Sep '13

Hello. I'm having some weird problem with (probably) mailbox_list_index, that it doesn't see new mail in mailboxes. I'm using 2.2.4 over imap and ssh/imap, and after a while dovecot stops noticing new mail in some folders. Its always the same 2-3 folders of about 30. I read something about list-index corruption in 2.2.2, and i thought it was that i was running into earlier, but this problem still occurs. This is dovecot 2.2.4, running on Solaris 10 x86_64 to homedirs on zfs, where procmail is used to deliver mail to mailboxes in mbox-format. I've tried to purge all indexes and let dovecot rebuild them, but the problem reoccurs after a couple of days. How can i help to debug this issue? Should i grab dovecot.list.index when its out-of-sync for debugging? //Anton -- Anton Lundin +46702-161604

2 1

[Dovecot] verbose_proctitle cuts dsync to proctitle to "dsyn"
by Sven Hartge 21 Sep '13

21 Sep '13

Hi Timo, little cosmetic bug report: using "verbose_proctitle = yes" shortens the proctitle of dsync to just "dsyn". Example: Note the whitespace instead of the 'c' in the proctitle: root@m-st-01:~# ps auwwwx | grep [d]syn virtmail 18141 13.0 0.1 49916 7952 pts/6 R+ 00:49 0:00 dsyn -v -u xxyyzz7 -R backup maildir:/staging/xxyyzz7/Maildir With "verbose_proctitle = no" the output looks like this: root@m-st-01:~# ps auwwwx | grep [d]syn virtmail 18347 78.6 1.6 127356 68884 pts/6 D+ 00:53 0:02 dsync -v -u aabbcc7 -R backup maildir:/staging/aabbcc7/Maildir Version of dovecot is 2.2.5 from the autobuilder (but rebuild locally): root@m-st-01:~# doveadm config -n # 2.2.5 (ec62ea3c940e): /etc/dovecot/dovecot.conf # OS: Linux 3.2.0-4-amd64 x86_64 Debian 7.1 [...] Grüße, Sven. -- Sigmentation fault. Core dumped.

2 1

[Dovecot] Problem with MySQL virtual users and dsync
by Jordan Cook 21 Sep '13

21 Sep '13

Hello, I am using dovecot 2.2.5 on FreeBSD and I am having trouble using dsync with SSH. Everything on the server seems to be working fine (I can login, receive and send emails etc). I am using SQL for both passdb, and userdb and this seems to work fine. The 'doveadm user' command returns all the correct information for the user. I am getting the following errors in my log file: Aug 27 21:34:17 server dovecot: replicator: Error: userdb lookup: Connecting timed out Aug 27 21:34:17 server dovecot: replicator: Error: userdb lookup: Disconnected unexpectedly Aug 27 21:34:20 server last message repeated 173381 times It did seem to do an initial sync, but after that nothing is being synchronised. Has anyone else solved this problem previously or is able to help? Regards, Jordan Cook -- Packet House Limited is a company registered in England and Wales. Registered number: 07602377. Registered office: 40 Preston Avenue, Alfreton, Derbyshire, DE55 7JY This email and any attachments to it may be confidential and are intended solely for the use of the individual to whom it is addressed. Any views or opinions expressed are solely those of the author and do not necessarily represent those of Packet House Limited. If you are not the intended recipient of this email, you must neither take any action based upon its contents, nor copy or show it to anyone. Please contact the sender if you believe you have received this email in error.

2 1

[Dovecot] Error: file_dotlock_open() failed with file + Too many open files
by Kavish Karkera 21 Sep '13

21 Sep '13

Hi All, We are getting these below error on our IMAP server. is this because of open file limits.?? We have set it to 4096. [root@vish conf.d]# ulimit -n 4096 Aug 27 16:08:26 imap(kavish.karkera(a)example.com-24685): Error: file_dotlock_open() failed with file /data/quarantine/index//data/quarantine/mailstore/24685/.INBOX.kavish.karkera/dovecot.index.cache: Too many open files Aug 27 16:08:26 imap(kavish.karkera(a)example.com-24685): Error: open(/data/quarantine/index//data/quarantine/mailstore/24685/.INBOX.kavish.karkera/dovecot.index.cache.lock) failed: Too many open files Below is our dovecot conf file. ====================================================================== # 2.2.5: /usr/local/dovecot-2.2.5/etc/dovecot-imap/dovecot.conf # OS: Linux 2.6.18-194.26.1.el5 x86_64 CentOS release 5.5 (Final) auth_socket_path = /usr/local/var/run/dovecot2.2-imap/auth-userdb base_dir = /usr/local/var/run/dovecot2.2-imap/ default_vsz_limit = 1 G first_valid_gid = 99 first_valid_uid = 99 hostname = log_path = /var/log/dovecot2.2-imap.log mail_location = maildir:~:INDEX=/data/quarantine/index/%h:CONTROL=/data/quarantine/index/%h mail_plugins = " virtual notify" namespace { inbox = no location = prefix = separator = . type = private } namespace { hidden = yes inbox = yes list = yes location = virtual:~/virtual:LAYOUT=maildir++:INDEX=~/virtual:CONTROL=~/virtual prefix = virtual. separator = . subscriptions = no type = private } namespace { hidden = yes inbox = no list = no location = maildir:~:INDEX=/data/quarantine/index/%h:CONTROL=/data/quarantine/index/%h:LAYOUT=maildir++ prefix = boxvirtual. separator = . subscriptions = no type = private } passdb { args = /usr/local/dovecot-2.2.5/etc/dovecot-imap/dovecot-sql.conf.ext driver = sql } protocols = imap service auth { unix_listener auth-userdb { group = nobody mode = 0666 user = nobody } } service imap-login { inet_listener imap { port = 20143 } vsz_limit = 1 G } service imap-postlogin { executable = script-login -d /usr/local/bin/dovecot.virtual.sh unix_listener imap-postlogin { mode = 0666 } } service imap { executable = /usr/local/dovecot-2.2.5/libexec/dovecot/imap imap-postlogin vsz_limit = 1 G } ssl = no userdb { args = /usr/local/dovecot-2.2.5/etc/dovecot-imap/dovecot-sql.conf.ext driver = sql } protocol imap { mail_max_userip_connections = 1000 mail_plugins = " virtual notify" } Regards, Kavish Karkera

2 1