- dovecot - dovecot.org

[Dovecot] Requested xxxx scheme, but we have a NULL password after upgrade
by PhilQ 15 Feb '13

15 Feb '13

I'm having an issue I can't seem to work around after upgrading from Dovecot 1.0.7 to 1.2.17. After getting Dovecot 1.07 working on CentOS 5.9, I decided that it might be wise to upgrade to a later version, so I stuck with 1.x and went with 1.2.17, which I had to compile from source. CentOS was originally using /etc as the starting path for Dovecot files but the source distribution puts most of the stuff under /usr/local/etc. After the usual config>make>make install dance I made the necessary changes to point to the new libraries, modules, etc. and the "imap-login: Fatal: Dovecot version mismatch: Master is v1.2.17, login is v1.0.7...." messages went away. After doing this though I cannot login, I get the following error messages: Feb 13 15:50:40 auth(default): Info: client in: AUTH 7 NTLM service=imap lip=192.168.2.102 rip=192.168.2.100 lport=143 rport=1470 Feb 13 15:50:40 auth(default): Info: client out: CONT 7 Feb 13 15:50:40 auth(default): Info: client in: CONT 7 TlRMTVNTUAABAAAAB4IIogAAAAAAAAAAAAAAAAAAAAAFASgKAAAADw== Feb 13 15:50:40 auth(default): Info: client out: CONT 7 TlRMTVNTUAACAAAAMAAwADAAAAAFAooATj7XW6ve2hwAAAAAAAAAADgAOABgAAAAUwBlAHIAdgBlAHIAMQAuAGgAZQByAHMAYwBoAGwAYQB1AHIAZQBuAC4AYwBvAG0AAwAwAFMAZQByAHYAZQByADEALgBoAGUAcgBzAGMAaABsAGEAdQByAGUAbgAuAGMAbwBtAAAAAAA= Feb 13 15:50:40 auth(default): Info: client in: CONT 7 TlRMTVNTUAADAAAAGAAYAGoAAABoAGgAggAAAAAAAABIAAAAEAAQAEgAAAASABIAWAAAAAAAAADqAAAABQKIAgUBKAoAAAAP*CENSORED*bgBiAFEAUwBFAC0AVwBJAE4AWABQAEXO6p/WuopqQ02x1kzJGW3NoQELKw32N88JqkbMOYOVErhiS492elwBAQAAAAAAA*CENSORED*ysN9jcAAAAAAwAwAFMAZQByAHYAZQByADEALgBoAGUAcgBzAGMAaABsAGEAdQByAGUAbgAuAGMAbwBtAAAAAAAAAAAA Feb 13 15:50:40 auth(default): Info: cache(pquesinb,192.168.2.100): miss Feb 13 15:50:40 auth(default): Info: passwd-file(pquesinb,192.168.2.100): lookup: user=pquesinb file=/etc/dovecot.users Feb 13 15:50:40 auth(default): Info: password(pquesinb,192.168.2.100): Requested NTLM scheme, but we have a NULL password Feb 13 15:50:40 auth(default): Info: cache(pquesinb,192.168.2.100): miss Feb 13 15:50:40 auth(default): Info: password(pquesinb,192.168.2.100): passdb doesn't support credential lookups Feb 13 15:50:40 auth(default): Info: cache(pquesinb,192.168.2.100): miss Feb 13 15:50:40 auth(default): Info: password(pquesinb,192.168.2.100): passdb doesn't support credential lookups Feb 13 15:50:40 auth(default): Info: cache(pquesinb,192.168.2.100): miss Feb 13 15:50:40 auth(default): Info: password(pquesinb,192.168.2.100): passdb doesn't support credential lookups Feb 13 15:50:40 auth(default): Info: cache(pquesinb,192.168.2.100): miss Feb 13 15:50:40 auth(default): Info: password(pquesinb,192.168.2.100): passdb doesn't support credential lookups Feb 13 15:50:42 auth(default): Info: client out: FAIL 7 user=pquesinb Looking at the log from the old version while it was working, I was getting messages like the following: dovecot: Feb 04 14:14:21 Info: imap-login: Login: user=<pquesinb>, method=NTLM, rip=192.168.2.100, lip=192.168.2.102 dovecot: Feb 04 14:14:21 Info: imap-login: Login: user=<pquesinb>, method=NTLM, rip=192.168.2.100, lip=192.168.2.102 dovecot: Feb 04 14:15:03 Info: IMAP(pquesinb): Disconnected: Logged out dovecot: Feb 04 14:15:03 Info: IMAP(pquesinb): Disconnected: Logged out dovecot: Feb 04 14:15:23 Info: imap-login: Login: user=<pquesinb>, method=NTLM, rip=192.168.2.100, lip=192.168.2.102 dovecot: Feb 04 14:15:23 Info: imap-login: Login: user=<pquesinb>, method=NTLM, rip=192.168.2.100, lip=192.168.2.102 dovecot: Feb 04 14:16:05 Info: IMAP(pquesinb): Disconnected: Logged out dovecot: Feb 04 14:16:05 Info: IMAP(pquesinb): Disconnected: Logged out /etc/dovecot.users contains a list of usernames. Is this error the result of additional security which has been incorporated into the later version of Dovecot, or is it because my installation of the later version from source is broken, somehow incompatible, etc? Dovecot was configured to use PAM and it appeared to know the password of my account, failing when it was entered incorrectly so I'm assuming that it was successfully using PAM. I kept the same syntax in the later config file. >From dovecot.conf: passdb pam { # [session=yes] [setcred=yes] [failure_show_msg=yes] [max_requests=<n>] # [cache_key=<key>] [<service name>] # # session=yes makes Dovecot open and immediately close PAM session. Some # PAM plugins need this to work, such as pam_mkhomedir. # # setcred=yes makes Dovecot establish PAM credentials if some PAM plugins # need that. They aren't ever deleted though, so this isn't enabled by # default. # # max_requests specifies how many PAM lookups to do in one process before # recreating the process. The default is 100, because many PAM plugins # leak memory. # # cache_key can be used to enable authentication caching for PAM # (auth_cache_size also needs to be set). It isn't enabled by default # because PAM modules can do all kinds of checks besides checking password, # such as checking IP address. Dovecot can't know about these checks # without some help. cache_key is simply a list of variables (see # doc/wiki/Variables.txt) which must match for the cached data to be used. # Here are some examples: # %u - Username must match. Probably sufficient for most uses. # %u%r - Username and remote IP address must match. # %u%s - Username and service (ie. IMAP, POP3) must match. # # The service name can contain variables, for example %Ls expands to # pop3 or imap. # # Some examples: # args = session=yes %Ls args = cache_key=%u dovecot #args = dovecot } If anyone could give me some ideas on where to go from here, I'd really appreciate it. If there's little chance of getting the newer version to work with CentOS 5 then I'm ready to just drop back to the older version. Thanks a bunch. - Phil Config info follows: [root@Server1 lda]# dovecot -n # 1.2.17: /usr/local/etc/dovecot.conf # OS: Linux 2.6.18-348.el5.centos.plusxen x86_64 CentOS release 5.9 (Final) log_path: /var/log/dovecot.log info_log_path: /var/log/dovecot.log protocols: imap imaps pop3 pop3s ssl_cert_file: /etc/pki/dovecot/certs/dovecot.pem ssl_key_file: /etc/pki/dovecot/private/dovecot.pem disable_plaintext_auth: no login_dir: /usr/local/var/run/dovecot/login login_executable(default): /usr/local/libexec/dovecot/imap-login login_executable(imap): /usr/local/libexec/dovecot/imap-login login_executable(pop3): /usr/local/libexec/dovecot/pop3-login max_mail_processes: 64 mail_location: maildir:~/Maildir maildir_very_dirty_syncs: yes mail_executable(default): /usr/local/libexec/dovecot/imap mail_executable(imap): /usr/local/libexec/dovecot/imap mail_executable(pop3): /usr/local/libexec/dovecot/pop3 mail_plugin_dir(default): /usr/local/lib/dovecot/imap mail_plugin_dir(imap): /usr/local/lib/dovecot/imap mail_plugin_dir(pop3): /usr/local/lib/dovecot/pop3 mail_log_max_lines_per_sec: 100 imap_client_workarounds(default): outlook-idle imap_client_workarounds(imap): outlook-idle imap_client_workarounds(pop3): lda: mail_plugin_dir: /usr/local/lib/dovecot/lda auth default: mechanisms: ntlm plain login digest-md5 cache_size: 16 cache_ttl: 90 verbose: yes debug: yes debug_passwords: yes passdb: driver: passwd-file args: /etc/dovecot.users passdb: driver: pam args: cache_key=%u dovecot passdb: driver: passwd passdb: driver: shadow userdb: driver: passwd -- View this message in context: http://dovecot.2317879.n4.nabble.com/Requested-xxxx-scheme-but-we-have-a-NU… Sent from the Dovecot mailing list archive at Nabble.com.

1 2

Re: [Dovecot] Authentication with many Windows AD
by Antonio Alberola 14 Feb '13

14 Feb '13

Hi, > You can set as many databases as you want. Check this: > > http://wiki2.dovecot.org/PasswordDatabase > http://wiki2.dovecot.org/Authentication/MultipleDatabases This solution is valid if I have only one domain. In case you have more than one domain, you need authenticate in the appropriate LDAP server. Is That correct? I'm going to explain my particular case. I have five Windows domains with some users who belong to those domains. I also have other users who are authenticated with local UNIX accounts. The only thing that I can do (I think) is using a Radius server. But, I'd rather not use it.

2 1

Re: [Dovecot] Imap process crash: assertion failed: (full_fs_access)
by Joseph Tam 14 Feb '13

14 Feb '13

On Wed, 13 Feb 2013, dovecot-request(a)dovecot.org wrote: Timo Sirainen <tss(a)iki.fi> writes: >>>> Any guess at what would cause this? >>>>> Feb 7 21:20:53 server dovecot: imap(user): Panic: file >>>> mailbox-list-fs-iter.c: line 447 (fs_list_get_roots): assertion >>>> failed: (full_fs_access) >>> LIST command that had invalid parameters that somehow got through the >>> first validity check. What namespace config do you have? >> >> namespace { >> alias_for = >> hidden = yes >> list = no >> location = >> prefix = / >> separator = / >> } > > This one causes these crashes. Fixed in v2.2 now: http://hg.dovecot.org/dovecot-2.2/rev/fb367a977077 Thanks for diagnosing this. I'll probably remove this namespace or limp along until 2.2 becomes the latest stable release. I added this namespace alias in an abundance of caution: this was to prevent users from trying to peruse the entire file space e.g. /etc. A poor man's chroot. I didn't test this thoroughly to see if it actually did what it was supposed to. Joseph Tam <jtam.home(a)gmail.com>

1 0

[Dovecot] Authentication with many Windows AD
by Antonio Alberola 14 Feb '13

14 Feb '13

Dear All, I'm a new user of Dovecot and I need support with the authentication process. I use Dovecot 2.0.9 and Postfix 2.6.6 on host x86_64-redhat-linux-gnu 2.6.32-279.14.1.el6.x86_64 CentOS release 6.3 (Final) I need to select the validation method depending on the user. I have users that have to be authenticate with UNIX account, and I have others thats have to be authenticate with Windows AD. For example, some sysadmins and special accounts needs validate with Unix accounts. Other normal users have to authenticate with Windows AD, I have many Windows controllers. Some users authenticate to a specific Windows AD and other users are validated in another one. How I can do this? Thank you very much. Antonio Alberola

3 2

[Dovecot] FreeBSD, Dovecot and ZFS
by Jason Lock 13 Feb '13

13 Feb '13

Mail Issues - FreeBSD Hello, my apologies if this may be the wrong forum but hoping that maybe someone might be able to provide some insight. Have a very sporadic and strange issue with our mail servers running Dovecot on FreeBSD. There are three servers hosting Dovecot with FreeBSD as the underlying operating system. All three connect to a NAS server, again running FreeBSD and ZFS. When the specific issue occurs, clients connecting to check mail via POP3 or IMAP experience long delays and timeouts. To the point where POP3 Logins fail due to the timeouts. The issue is further compounded by clients increasing the number of attempts to check mail. Part of the frustration in attempting to diagnose the issue is not knowing the root cause or symptom that initates the issue. Wondering if anyone has experienced anything similar, or suggestions on ways to help identify the root cause

5 6

[Dovecot] dovecot-uidlist crashing and re retriving messages by pop3 clients
by Piotr Rotter 13 Feb '13

13 Feb '13

Hello, I have issue with dovecot (v. 2.1.13)configuration after implementation dovecot-lda (I used maildrop earlier). Now i have 9 servers with storage by NFS v3. My problem is frequently dovecot-uidlist crashing. 2013-02-13T13:34:02.447969+01:00 k1 dovecot: imap(user(a)domain.com): Error: Broken file /path_to_mailbox/dovecot-uidlist line 3170: Invalid data: 2013-02-13T13:34:34.527715+01:00 k1 dovecot: pop3(user(a)domain.com): Error: Broken file /path_to_mailbox/dovecot-uidlist line 367: Invalid data: It happens few time in minute for diferent users and has effect to re retriving messages by pop3 clients. This my NFS mount options: (rw,tcp,vers=3,actimeo=0) 10-mail.conf options: mmap_disable = yes dotlock_use_excl = yes mail_fsync=always mail_nfs_storage = yes mail_nfs_index = yes lock_method = dotlock I do not know what I did wrong and how solve this issue. Maybe NFS v4 or fcntl locks or migration to pop3_uidl_format = %g will by solution. Please some hint. Please any help for solve this issue and sorry my english.

2 1

[Dovecot] backing up maildir dovecot files
by David Mehler 13 Feb '13

13 Feb '13

Hello, I'm having to migrate servers. Both are dovecot2 systems. I'm wanting to copy over my mail store from one system to the other. I'd like to preserve dates/times of emails. These are maildir setups on both boxes, I'd like to be as transparent to the end user as possible. I currently have the first dovecot system offline and the second dovecot system is offline. Recommendations? Thanks. Dave.

5 9

[Dovecot] dsync 2.1.10 does not correctly handle renames of mailbox subtrees
by Karol Jurak 13 Feb '13

13 Feb '13

Hi, It seems that dsync 2.1.10 does not correctly handle renames of mailbox subtrees. The scenario is as follows. There are two servers, A and B, both running dovecot 2.1.10 and configured to use mdbox. Automatic replication between them is disabled, ie. replication plugin is not active and replicator service has process_min_avail = 0. I perform the following actions: 1. On A: doveadm mailbox create -u test_user a a/b a/b/c d 2. On A: doveadm sync -u test_user -d The result is as expected: on both A and B there are a/b/c and d mailboxes. Now I connect to A via IMAP and rename a/b to d/b. The result is as expected: on A there are a and d/b/c mailboxes. Next I execute on A 'doveadm sync -u mailstoragetest -d' and now the result is not as expected: there are a/b/c and d/b subtrees on both A and B and a/b is just a directory, ie. it does not contain dbox-Mails (the rest are proper mailboxes). dovecot.mailbox.logs have the following records appended to them: A: #2112: rename 33259783092361d18c60ba1c7cfe973c (2013-02-12 10:42:55) - this probably is the rename of a/b to d/b (recursive, ie. including children - in this case a/b/c => d/b/c) by the IMAP client #2136: rename ee2be6da91ae879476b152d7ca041f1b (1970-01-01 01:00:00) - rename of d/b/c to a/b/c by dsync (unexpected/incorrect) B: #1104: rename 33259783092361d18c60ba1c7cfe973c (1970-01-01 01:00:00) - rename of a/b to d/b (non recursive) by dsync What seems to be missing is the record in A's dovecot.mailbox.log describing the rename of a/b/c to d/b/c (or in general case the set of records describing the renames of all the children of a/b). Would appending such records allow dsync to make correct decisions as to which mailboxes and on which servers to rename? Thanks for any help. # 2.1.10: /etc/dovecot/dovecot.conf # OS: Linux 2.6.32-5-amd64 x86_64 Debian 6.0.1 auth_master_user_separator = * auth_username_format = %Ln default_vsz_limit = 2 G dotlock_use_excl = no dsync_remote_cmd = ssh -l%{login} %{host} doveadm dsync-server -u%u -l5 log_path = /var/log/dovecot.log log_timestamp = "%Y-%m-%d %H:%M:%S " mail_access_groups = mail mail_location = mdbox:~/mdbox:ALT=/var/vmail/alt/%n mail_plugins = acl namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = separator = / } passdb { args = /etc/dovecot/dovecot-ldap.conf driver = ldap } plugin { acl = vfile } protocols = imap lmtp pop3 service aggregator { fifo_listener replication-notify-fifo { mode = 0666 } unix_listener replication-notify { mode = 0666 } } service auth { executable = /usr/lib/dovecot/auth unix_listener auth-client { mode = 0660 } unix_listener auth-master { mode = 0600 } unix_listener auth-userdb { mode = 0666 } user = root } service dict { unix_listener dict { mode = 0666 } } service doveadm { process_min_avail = 1 service_count = 1024 } service imap-login { chroot = login executable = /usr/lib/dovecot/imap-login inet_listener imap { address = * port = 143 } service_count = 0 user = dovecot } service imap { executable = /usr/lib/dovecot/imap } service lmtp { inet_listener lmtp { port = 24 } process_limit = 48 } service pop3-login { chroot = login executable = /usr/lib/dovecot/pop3-login inet_listener pop3 { address = * port = 110 } service_count = 0 user = dovecot } service pop3 { executable = /usr/lib/dovecot/pop3 } ssl = no userdb { args = /etc/dovecot/dovecot-ldap.conf driver = ldap } protocol imap { imap_client_workarounds = tb-extra-mailbox-sep mail_plugins = acl } protocol lmtp { mail_plugins = acl } protocol pop3 { pop3_uidl_format = %08Xu%08Xv } protocol lda { mail_plugins = acl } -- Karol Jurak

2 2

Re: [Dovecot] Imap process crash: assertion failed: (full_fs_access)
by Joseph Tam 13 Feb '13

13 Feb '13

Timo Sirainen <tss(a)iki.fi> writes: > > Any guess at what would cause this? > > > > Feb 7 21:20:53 server dovecot: imap(user): Panic: file > > mailbox-list-fs-iter.c: line 447 (fs_list_get_roots): assertion > > failed: (full_fs_access) > > LIST command that had invalid parameters that somehow got through the > first validity check. What namespace config do you have? I got more info from the user that had this problem. He reported that he was was setting up a new Email client (Nexus4 Android) and he sent me a screenshot of his setup. Everything look ordinary except perhaps the IMAP prefix set to "mail". My setup documents inform users to leave it blank, but sometimes they use "mail/", a holdover from the uw-imapd days. I provide some aliases for that, but I don't know what would happen if you leave off the trailing "/". My namespace settings as reported by dovecot -n: namespace { inbox = yes location = prefix = separator = / } (The following are aliases to keep backward compatibility) namespace { alias_for = hidden = yes list = no location = prefix = / separator = / } namespace { alias_for = hidden = yes list = no location = prefix = mail/ separator = / } namespace { alias_for = hidden = yes list = no location = prefix = ~/mail/ separator = / } namespace { alias_for = hidden = yes list = no location = prefix = ~%u/mail/ separator = / } I've asked the user to change his prefix, and he'll probably report back. Joseph Tam <jtam.home(a)gmail.com>

2 2

[Dovecot] Is there any way to mask or hide the INBOX label for Dovecot 1.2.x Shared Mailboxes?
by Jason Discount 13 Feb '13

13 Feb '13

Hello, I'm setting up a new Dovecot sever to replace an old Cyrus server, and need to keep things as consistent as possible. I have a couple local accounts, like junkmail and notjunkmail that users get shared access to, and can drop things in to train sa-update. However, when users share over junkmail's inbox, it's displayed in the hierarchy: • Other Users • junkmail • INBOX Is there any way to get junkmail's INBOX to just show up at Other Users/junkmail and not require that extra depth? • Other Users • junkmail I'm running Debian Squeeze and the standard dovecot package available therein: > # uname -a > Linux internet.digitalquay.com.au 2.6.32-5-xen-amd64 #1 SMP Sun Sep 23 13:49:30 UTC 2012 x86_64 GNU/Linux > #dovecot --version > 1.2.15 I'm running in a configuration where all mail is owned by the vmail user, due to the impression I'm under, that it's a better way if there is to be shared mailboxes. Relevant bits of dovecot -n: > mail_uid: vmail > mail_gid: vmail > mail_location: maildir:/var/spool/dovecot/user/%u > mail_plugins: acl imap_acl > namespace: > type: private > separator: / > inbox: yes > list: yes > subscriptions: yes > namespace: > type: shared > separator: / > prefix: Other Users/%%u/ > location: maildir:/var/spool/dovecot/user/%%u:INDEX="/var/spool/dovecot/user/%u/Other\ Users/%%u" > list: children > auth default: > passdb: > driver: ldap > args: /etc/dovecot/dovecot-ldap.conf > userdb: > driver: passwd > args: uid=vmail gid=vmail blocking=yes mail=maildir:/var/spool/dovecot/user/%u Am I barking up the wrong tree, or is this possible? Thanks, Jay

2 1