- dovecot - dovecot.org

[Dovecot] Dovecot does not update acl_shared_dict file
by Chris Smith 30 Oct '12

30 Oct '12

Hi all, Firstly, thanks for all your effort with this software. Much appreciated. I am having a slight issues trying to enable reading of other users mailboxes. The docs are a little sparse for those that aren't mailadmin heros, I wonder if anyone could please help me see where I am going wrong. I would like to allow some users to list and read the mailboxes of others. E.g: When User1 logs in, they are presented with a list of their own folders, and those of User2, User3, etc to which they have (e.g. read/list) access I followed the instructions on the wiki (for Version 1.X)- there are two concepts here: 1. Grant some [e.g. list/read] access on a mailbox folder to a particular user 2. Enable the acl_shared_dict to allow dovecot to track (and display to IMAP clients) the folders to which they have access. This will take the form of a BDB file: /var/lib/dovecot/shared-mailboxes.db This file can only be updated by using the SETACL command. *This is where I have the problem*. The SETACL command does nothing. No matter how hard I try, I cannot get dovecot to update this file. The only indication I have that the file exists and is readable by dovecot is the disappearance from the logs of the line: No acl_shared_dict setting - shared mailbox listing is disabled So I can see that dovecot knows the file is there because it does not complain any more. The file is there (because I created it myself, although it is empty: size = 0), and in a moment of weakness I made sure it could be updated (this will be changed back!): ls -l /var/lib/dovecot/shared-mailboxes.db -rwxrwxrwx 1 dovecot dovecot 0 2012-10-30 12:27 /var/lib/dovecot/shared-mailboxes.db But if I try to update the ACL, absolutely nothing happens: [ > command ] [ < reply ] > telnet localhost 143 < * OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE STARTTLS AUTH=CRAM-MD5] Email server > a login [User2] [pass] < a OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE SORT SORT=DISPLAY THREAD=REFERENCES THREAD=REFS MULTIAPPEND UNSELECT IDLE CHILDREN NAMESPACE UIDPLUS LIST-EXTENDED I18NLEVEL=1 CONDSTORE QRESYNC ESEARCH ESORT SEARCHRES WITHIN CONTEXT=SEARCH ACL RIGHTS=texk] Logged in > a SETACL Inbox [User 1] rl < a OK Setacl complete. At this time, in the dovecot log (with debug enabled): 2012-10-30 13:55:24 IMAP([User2]): Info: Namespace : Using permissions from /home/mailboxes/[domain]/[User1]: mode=0770 gid=-1 2012-10-30 13:55:24 IMAP([User2]): Info: acl vfile: reading file /home/mailboxes/[domain]/[User1]/dovecot-acl 2012-10-30 13:55:24 IMAP([User2]): Info: acl vfile: reading file /home/mailboxes/[domain]/[USer1]/dovecot-acl Can anyone please help me track down what I'm doing wrong here?! It's driving me mad! Thanks for your time if you've read this far!! As requested: dovecot --version 1.2.9 base_dir: /var/run/dovecot/ log_path: /var/log/dovecot info_log_path: /var/log/dovecot.info log_timestamp: %Y-%m-%d %H:%M:%S protocols: imaps imap listen: 127.0.0.1:143 ssl_listen: 37.235.54.98 ssl_cert_file: /etc/ssl/dovecot.crt ssl_key_file: /etc/ssl/private/dovecot.key login_dir: /var/run/dovecot/login login_executable: /usr/lib/dovecot/imap-login login_greeting: Email server valid_chroot_dirs: /var/spool/vmail mail_location: maildir:/home/mailboxes/%d/%n mail_debug: yes mbox_write_locks: fcntl dotlock mail_plugins: acl imap_acl lda: postmaster_address: [ valid@ddress ] auth default: mechanisms: plain cram-md5 verbose: yes passdb: driver: passwd-file args: /etc/dovecot/passwd userdb: driver: passwd-file args: /etc/dovecot/users socket: type: listen client: path: /var/spool/postfix/private/auth-client mode: 432 user: postfix group: postfix master: path: /var/spool/postfix/private/auth-master mode: 384 user: postfix group: postfix plugin: acl: vfile acl_shared_dict: file:/var/lib/dovecot/shared-mailboxes.db acl: vfile:/etc/dovecot/acls

1 0

[Dovecot] Problem about SSL for Dovecot.
by sheng-wei.lim 30 Oct '12

30 Oct '12

Hi All, With the below setting (cropped), the ssl certificate(signed by godaddy) don’t seems to work. It will still ask me if I want to accept this certificate. I have use the same certificate for apache host and postfix it works without any prompt. dovecot version : 2.0.19 # OS: Linux 3.2.0-32-generic-pae i686 Ubuntu 12.04.1 LTS Dovecot config: ssl = required ssl_cert = </aaa/4/merged5.crt ssl_key = </certs/proximityjobs.key userdb { args = /etc/dovecot/dovecot-mysql.conf driver = sql } verbose_ssl = yes protocol lda { auth_socket_path = /var/run/dovecot/auth-master lda_mailbox_autocreate = yes log_path = /var/log/sieve.log mail_plugins = quota sieve autocreate acl postmaster_address = root } protocol imap { imap_client_workarounds = tb-extra-mailbox-sep mail_plugins = quota imap_quota autocreate acl imap_acl } protocol pop3 { mail_plugins = quota pop3_client_workarounds = outlook-no-nuls oe-ns-eoh pop3_uidl_format = %08Xu%08Xv } Best Regards, Sheng Wei

1 0

[Dovecot] Save/restore IMAP session state
by Timo Sirainen 30 Oct '12

30 Oct '12

Some future Dovecot version will have "imap-idle" processes where IDLEing IMAP connections get moved, so the system wouldn't waste so much memory for all the IDLEing imap processes. A week ago I thought I'd see how easy it would be to implement this. I got a basic proof of concept working as a "X-STATE" command. Save the state: a x-state * STATE AQDLW45QdwAAAAMAAABuAQAAAAAAAFAcffYAPHnpFctbjlDbYQAAcEmzCwAA a OK State exported. Restore the state: b x-state AQDLW45QdwAAAAMAAABuAQAAAAAAAFAcffYAPHnpFctbjlDbYQAAcEmzCwAA b OK State imported. This could also be used to implement quick session state restoring for webmails (as suggested by Michael Slusarz). For getting the imap-idle process there would have to be code that: * triggers the session saving when process is IDLEing * figures out what filesystem paths the imap-idle should be looking at (i.e. paths to selected mailbox's dovecot.index.log file and maybe for e.g. maildir new/) * send the session state string, paths and imap connection fd to imap-idle process via UNIX socket * implement the actual imap-idle process * implement a way for imap-idle process to send back the state and connection fd to restore the imap process The patch is ugly and still missing many things. Anyway I thought I'd include it here just in case someone was really eager to continue implementing it. :) I'm not sure when I'll have time for it. A full patch would probably have to have some session_save()/session_restore() functions in lib-storage API. But a quick and dirty way is possible to implement for v2.1 as well, as long as some IMAP extensions aren't used (most importantly rfc5267).

2 2

Re: [Dovecot] Changing password for users
by Joseph Tam 30 Oct '12

30 Oct '12

Ben Morrow wrote: >> Maybe replace "/usr/bin/passwd" with htpasswd? > > Try pam_pwdfile with poppwd or some other poppassd that supports PAM. That's it! I was trying to remember the name of this PAM module. >>> and is there another way other than poppassd? >> >> Write your own PHP script -- it couldn't be more than a few dozen lines >> of code for a working skeleton. Or Google "php change password htpasswd". > > It's not as simple as you seem to think. Quite apart from getting the > password-changing itself right (have you considered what happens when > two users change their passwords at the same time? when Dovecot tries to > read the password file at the same time as you are changing it? when the > system crashes when you are halfway through rewriting the password > file?), you really shouldn't be running PHP as a user with write access > to a password file (even a virtual password file) in any case. I did consider it, and you're right, it is tricky to get it absolutely right. If robusteness and security was of utmost importance, I would abandon PHP too. I was scaling the solution to the OP's technical ability and apparent size of their operation -- if poppwd passes muster, this wouldn't be too far off. Joseph Tam <jtam.home(a)gmail.com>

1 0

[Dovecot] does dovecot interpret any mail headers specially with maildir?
by Christoph Anton Mitterer 29 Oct '12

29 Oct '12

Hi. For mbox, http://wiki2.dovecot.org/MailboxFormat/mbox#Dovecot.27s_Metadata lists a numer of mail headers: - X-IMAPbase - X-IMAP - X-UID - Status - X-Status - X-Keywords - Content-Length that are treated specially by dovecot. It also suggests, that these should be stripped by the LDA (I guess in order that someone sending you such mail cannot set the status or keywords, or even "attack you" by setting a bogus Content-Length). I wondered, when using maildir, are there any headers that dovecote would treat specially, too? And which I therefore should strip? Thanks, Chris.

2 9

[Dovecot] Problems with Virtual and mail-search.c
by Levent Dane 29 Oct '12

29 Oct '12

First, I don't know why but dovecot gots this error. Oct 15 13:24:02 widder dovecot: imap(limon): Panic: file mail-search.c: line 90 (mail_search_args_init_sub): assertion failed: (arg->value.keywords == NULL) Then, when I tried to run SELECT "INBOX/Code" (UNSEEN) virtual plugin got a segfault. Oct 15 13:24:03 widder kernel: imap[22749]: segfault at 2c ip b757f8ec sp bfa3a160 error 4 in lib20_virtual_plugin.so[b7579000+d000][b74b0000+d000] I'm running gentoo with kernel 2.6.32.12. My dovecot version is 2.1.10. I applied http://hg.dovecot.org/dovecot-2.1/raw-diff/0306792cc843/src/lib-storage/mai… But still, i'm getting this problem. Thanks, Levent Dane

2 6

[Dovecot] No failover from director to backend?
by Patrick Westenberg 29 Oct '12

29 Oct '12

Hi everyone, short version: Is there no built in failover mechanism for the director service to handle a backend failure? Long version: I have a frontend server running the director service and two backends. Due to maintenance I had to shut down one of the backends which caused connection errors for the users being directed to this backend. I was very surprised as I expected the director to redirect these users to the remaining backend. Am I wrong or is the director not working as expected? Regards Patrick # 2.1.6: /usr/local/etc/dovecot/dovecot.conf # OS: Linux 2.6.32-5-amd64 x86_64 Debian 6.0.5 auth_mechanisms = plain login director_mail_servers = 172.17.1.1 172.17.1.2 director_servers = 172.17.1.3 172.17.1.4 lmtp_proxy = yes log_path = /var/log/dovecot.log managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave protocols = imap pop3 lmtp sieve service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0666 user = postfix } unix_listener auth-userdb { user = dovecot } } service director { fifo_listener login/proxy-notify { mode = 0666 } inet_listener { address = 172.17.1.3 port = 9090 } unix_listener director-userdb { mode = 0600 } unix_listener login/director { mode = 0666 } } service imap-login { executable = imap-login director } service lmtp { inet_listener lmtp { address = 172.17.1.3 port = 24 } } service managesieve-login { executable = managesieve-login director inet_listener sieve { port = 4190 } } service pop3-login { executable = pop3-login director } ssl_cert = </etc/ssl/certs/imap.xx.crt ssl_key = </etc/ssl/private/imap.xx.key protocol !smtp { passdb { args = proxy=y nopassword=y starttls=any-cert driver = static } } protocol smtp { passdb { args = /usr/local/etc/dovecot/dovecot-sql.conf.ext driver = sql } userdb { args = /usr/local/etc/dovecot/dovecot-sql.conf.ext driver = sql } } protocol lmtp { auth_socket_path = director-userdb }

4 5

[Dovecot] INBOX permissios woes
by Josep L. Guallar-Esteve 29 Oct '12

29 Oct '12

Hello, I have a dovecot system that uses winbind authentication against Active Directory. I set it up by following the directions in the wiki. That works great. When a new user receives an email, the inbox is created with permissions 600 (rw- --- --) and ownership user:mail , even though I did chmod 02770 /var/spool/mail. And then, when dovecot tries to access the inbox, it throws the error: Oct 29 13:47:59 imap-login: Info: Login: user=<user1>, method=PLAIN, rip=10.0.0.6, lip=10.0.0.26, mpid=29047, secured Oct 29 13:47:59 imap(user1): Error: stat(/var/mail/user1) failed: Permission denied Oct 29 13:47:59 imap(user1): Error: stat(/var/mail/user1) failed: Permission denied Accessing users' Sent, Trash, creating new folders.... all that works fine. I've been looking at the documentation, reading the wiki, searching on google, asking on IRC. If you have any hint or documentation that I've must have overlooked, please let me know. Here's my dovecot information: [josep@testmail ]$ dovecot --version 2.0.9 [josep@testmail ]$ dovecot -n # 2.0.9: /etc/dovecot/dovecot.conf # OS: Linux 2.6.32-279.11.1.el6.x86_64 x86_64 CentOS release 6.3 (Final) auth_mechanisms = plain ntlm login auth_use_winbind = yes auth_username_format = %Lu base_dir = /var/run/dovecot/ debug_log_path = /var/log/dovecot-debug.log listen = * log_path = /var/log/dovecot.log mail_location = mbox:~/mail:INBOX=/var/mail/%u mail_privileged_group = mail mbox_write_locks = fcntl passdb { driver = pam } protocols = imap service auth { unix_listener auth-userdb { mode = 0600 } } ssl_cert = </etc/pki/dovecot/certs/dovecot.pem ssl_key = </etc/pki/dovecot/private/dovecot.pem userdb { args = uid=503 gid=503 home=/home/vmail/%u driver = static } userdb { driver = passwd } [josep@testmail ]$ Thank you in advance, Josep This transmission is intended for the use of the entity or individual to which or whom it is addressed. The transmission or any documents accompanying the transmission may contain confidential information. If you are not the intended recipient, you are hereby notified that any disclosure, copying, distribution, or action taken in reliance on the contents of the transmission or the documents is strictly prohibited. If you have received this confidential transmission in error, please destroy it and any accompanying documents and notify the sender immediately. Thank you.

1 0

[Dovecot] [dovecot} Invalid mailbox name.
by Alexander Weber 29 Oct '12

29 Oct '12

Hi, I've got some trouble here.. i created some sieve rules, but the debug log says that there is a invalid mailbox name error: msgid=<*>: failed to store into mailbox '/home/shared/.automail.Bugtracker/': Invalid mailbox name. ~/.dovecot.sieve if address :is "to" "mantis-admin@<*>" { fileinto "/home/shared/.automail.Bugtracker/"; } here's my doveconf -n output # 2.0.19: /etc/dovecot/dovecot.conf # OS: Linux 3.2.0-32-generic x86_64 Ubuntu 12.04.1 LTS base_dir = /var/run/dovecot/ disable_plaintext_auth = no hostname = * mail_debug = yes mail_location = maildir:~/Maildir managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave namespace { list = yes location = maildir:/home/shared:CONTROL=~/.Maildir/control/Shared:INDEX=~/.Maildir/index/Shared prefix = shared/ separator = / subscriptions = yes type = public } namespace { inbox = yes location = prefix = separator = / type = private } passdb { driver = pam } passdb { args = /etc/dovecot/dovecot-ldap.conf driver = ldap } plugin { sieve = ~/.dovecot.sieve sieve_dir = ~/sieve zlib_save = gz zlib_save_level = 6 } postmaster_address = postmaster@* protocols = imap sieve service auth { unix_listener /var/spool/postfix/private/dovecot-auth { group = postfix mode = 0660 user = postfix } } service imap-login { inet_listener imaps { port = 993 ssl = yes } } ssl_ca = </etc/ssl/* ssl_cert = </etc/ssl/* ssl_cipher_list = HIGH:MEDIUM:+TLSv1:!SSLv2:+SSLv3 ssl_key = </etc/ssl/* userdb { driver = passwd } userdb { args = /etc/dovecot/dovecot-ldap.conf driver = ldap } protocol imaps { imap_client_workarounds = delay-newmail mail_max_userip_connections = 10 } protocol lda { deliver_log_format = msgid=%m: %$ mail_plugins = sieve postmaster_address = postmaster quota_full_tempfail = yes rejection_reason = Your message to <%t> was automatically rejected:%n%r } protocol imap { mail_plugins = " zlib, acl, imap_zlib" } any idea? Mit freundlichen Gruessen / best regards papaya Software GmbH i.A. Alexander Weber -- papaya Software GmbH | Im MediaPark 5 | 50670 Koeln | Germany Tel./Ph.: +49-221-5743-8070 | Fax: +49-221-5743-8099 mailto:weber@papaya-cms.com | http://www.papaya-cms.com/ -- Geschaeftsfuehrer: Andreas Jacobi, André Schnitzler, Daniel Schäfer Sitz& Registergericht: Koeln | HRB 60030 | USt.-Id.-Nr.: DE 255642963 --

2 4

[Dovecot] Overlapping userdb/passdbs
by James Devine 29 Oct '12

29 Oct '12

I have an ldap server for which each entry includes the email address and the username portion of the email address for authentication. Authentication works by username if the username is unique among all the entries. I need to now add some users which must authenticate even if the username is not unique. I figured one way to do this would be to add a second user/pass db which puts further restrictions on the ldap query to make it unique for those users. This doesn't seem to work however as if the user is found in the first ldap query but the password does not match it does not try the second. I would use the password as part of the query but this setup requires me to allow the client to hash the password. Is there a way to do this? Or maybe I am approaching the problem wrong.

2 1