- dovecot - dovecot.org

[Dovecot] LDAP.conf filter issue
by Tony Hlabse 17 Jul '12

17 Jul '12

All, We are trying to use the user_filter options to limit authentication to a single user group. The cusotmer has security rules that they want to only have users belonging to a group to have access. Sample we have tried. auth_bind = yes auth_bind_userdn = EXAMPLE\%n base = / hosts = example.test.com ldap_version = 3 user_filter = (&(sAMAccountName=)(memberOf=CN=LR3BCC-DL,OU=Autonomy,OU=Exchange,OU=Enterprise Administration,DC=example,DC=test,DC=com)) Thanks Tony

2 1

[Dovecot] dovecot 2.1.8 still tries to touch any mountpoint
by Reindl Harald 17 Jul '12

17 Jul '12

why does dovecot touch any ever used fuse-mountpoint and scream at the next start that is no longer mounted? "If this is intentional, remove it with doveadm mount" why if i never called "doveadm" on any setup at all? Jul 10 09:10:56 rh dovecot: master: Dovecot v2.1.8 starting up (core dumps disabled) Jul 10 09:10:56 rh dovecot: master: Warning: /sys/fs/cgroup/cpu is no longer mounted. If this is intentional, remove it with doveadm mount Jul 10 09:10:56 rh dovecot: master: Warning: /sys/fs/cgroup/cpuacct is no longer mounted. If this is intentional, remove it with doveadm mount Jul 10 09:10:56 rh dovecot: master: Warning: /var/run/vmblock-fuse is no longer mounted. If this is intentional, remove it with doveadm mount Jul 10 09:10:56 rh dovecot: master: Warning: /mnt/arrakis is no longer mounted. If this is intentional, remove it with doveadm mount Jul 10 09:10:56 rh dovecot: master: Warning: /mnt/loungebackup is no longer mounted. If this is intentional, remove it with doveadm mount Jul 10 09:10:56 rh dovecot: master: Warning: /mnt/panel is no longer mounted. If this is intentional, remove it with doveadm mount Jul 10 09:10:56 rh dovecot: master: Warning: /mnt/proxy is no longer mounted. If this is intentional, remove it with doveadm mount

3 4

[Dovecot] doveadm director status username != doveadm director status username@mailserver
by Joseba Torre 17 Jul '12

17 Jul '12

Hi, I've almost finished my new director based setup, but in the first test I discovered that imap and lmtp connections were not always being proxied to the same server. After some research now I think that the main problem is that in imap connections users connect as 'username' while lmtp connections are as 'username@mailserver'. In my current setup I receive mail via SMTP in my director servers (which are loadbalanced by a CISCO machine), and then they send them to dovecot running on localhost. I've tried to get rid of the @mailserver in postfix in a generic way with no success. Is there any way to redirect connections based only in the local part of the address? Or there is a way to get rid of the @mailserver in the postfix -> lmtp connection? Both doveadm config -n and postconf -n are attached. Thanks. $ doveadm config -n # 2.1.8: /usr/local/etc/dovecot/dovecot.conf # OS: Linux 2.6.32-220.17.1.el6.x86_64 x86_64 Red Hat Enterprise Linux Server release 6.2 (Santiago) auth_debug = yes auth_master_user_separator = * auth_verbose = yes director_mail_servers = buzones2.ehu.es buzones3.ehu.es director_servers = director1.ehu.es director2.ehu.es doveadm_proxy_port = 4444 lmtp_proxy = yes mail_debug = yes managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave passdb { args = proxy=y nopassword=y starttls=any-cert driver = static } protocols = imap pop3 lmtp sieve service auth { unix_listener auth-userdb { user = dovecot } } service director { fifo_listener login/proxy-notify { mode = 0666 } inet_listener { port = 3333 } unix_listener director-userdb { mode = 0600 } unix_listener login/director { mode = 0666 } } service doveadm { inet_listener { port = 4444 } } service imap-login { executable = imap-login director } service lmtp { inet_listener ltmp { address = director2.ehu.es 127.0.0.1 port = 24 } unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0660 user = postfix } } service managesieve-login { executable = managesieve-login director vsz_limit = 128 M } service pop3-login { executable = pop3-login director } ssl_cert = </etc/ssl/private/dovecot.pem ssl_key = </etc/ssl/private/dovecot.pem syslog_facility = local1 userdb { args = allow_allusers=yes driver = static } protocol lmtp { auth_socket_path = director-userdb mail_plugins = " sieve" syslog_facility = local2 } protocol doveadm { auth_socket_path = director-userdb } $ postconf -n alias_database = hash:/etc/aliases alias_maps = hash:/etc/aliases canonical_maps = hash:/etc/postfix/canonical command_directory = /usr/sbin config_directory = /etc/postfix daemon_directory = /usr/libexec/postfix data_directory = /var/lib/postfix debug_peer_level = 2 html_directory = no inet_interfaces = all inet_protocols = all local_destination_concurrency_limit = 10 local_recipient_maps = ldap:/etc/postfix/ldap-local-recipients.cf proxy:unix:passwd.byname $alias_maps mail_owner = postfix mailbox_transport = lmtp:inet:localhost:24 mailq_path = /usr/bin/mailq.postfix manpage_directory = /usr/share/man message_size_limit = 15000000 mydestination = ehu.es, mailsever.ehu.es, othermailserver.ehu.es mydomain = ehu.es myhostname = director1.ehu.es mynetworks_style = host myorigin = $mydomain newaliases_path = /usr/bin/newaliases.postfix queue_directory = /var/spool/postfix readme_directory = /usr/share/doc/postfix-2.6.6/README_FILES relayhost = [smtp.ehu.es] sample_directory = /usr/share/doc/postfix-2.6.6/samples sendmail_path = /usr/sbin/sendmail.postfix setgid_group = postdrop unknown_local_recipient_reject_code = 550

3 4

Re: [Dovecot] doveadm director status username != doveadm director status username@mailserver
by Joseba Torre 17 Jul '12

17 Jul '12

El 17/07/12 13:34, Lee Standen escribió: > One thing that stands out to me is the lack of passdb. One of the > recommendations I got from the passdb documentation was to override the > user field, so the user is always logged in consistently. Without this, > "BOB", "bob" and "bob(a)mydomain.com <mailto:bob@mydomain.com>" might all > accept auth, but be handled differently! If you configure your passdb, > then you'll get some consistency, which will probably fix your director > problem. We don't use passdb in the directors because incoming mails have already been checked by postfix, and the final mail server need to check our ldap server for other values, so we check there. Actually, I still feel that I can override some ldap connections if I think about it carefully. Thank you. > > At the very least, you probably want to lowercase all your usernames. >

1 0

[Dovecot] different mail_max_userip settings
by Federico Bianchi 17 Jul '12

17 Jul '12

Is it possible to have mail_max_userip set to a value for localhost (webmail) and to another value for everything else? Best regards Federico Bianchi Dipartimento di Storia delle Arti Universita` di Pisa via Trieste, 38 - I-56126 Pisa (Italy) tel.(+39) 050 221 6 024; fax (+39) 050 221 6 001 e-mail: <f.bianchi(a)arte.unipi.it> =================================================== !DISCLAIMER!: my e-mail reflects _my_own_ opinions! ===================================================

3 3

[Dovecot] Seq-range order in sequence-set are matter?
by Lay András 17 Jul '12

17 Jul '12

Hi! I have a mailbox with 12 messages. Theese two commands: x fetch 5,8:12 (UID) * 5 FETCH (UID 10) * 8 FETCH (UID 13) * 9 FETCH (UID 14) * 10 FETCH (UID 15) * 11 FETCH (UID 16) * 12 FETCH (UID 17) x OK Fetch completed. and x fetch 8:12,5 (UID) * 5 FETCH (UID 10) * 8 FETCH (UID 13) * 9 FETCH (UID 14) * 10 FETCH (UID 15) * 11 FETCH (UID 16) * 12 FETCH (UID 17) x OK Fetch completed. outputs are equeal, this clean. But: x fetch 1:*,5 (UID) * 1 FETCH (UID 4) * 2 FETCH (UID 5) * 3 FETCH (UID 6) * 4 FETCH (UID 7) * 5 FETCH (UID 10) * 6 FETCH (UID 11) * 7 FETCH (UID 12) * 8 FETCH (UID 13) * 9 FETCH (UID 14) * 10 FETCH (UID 15) * 11 FETCH (UID 16) * 12 FETCH (UID 17) x OK Fetch completed. and x fetch 5,1:* (UID) * 5 FETCH (UID 10) * 6 FETCH (UID 11) * 7 FETCH (UID 12) * 8 FETCH (UID 13) * 9 FETCH (UID 14) * 10 FETCH (UID 15) * 11 FETCH (UID 16) * 12 FETCH (UID 17) x OK Fetch completed. command outputs are NOT equal? Why? Thank you! Lay

2 1

[Dovecot] Override userdb=passwd gid
by Veiko Kukk 17 Jul '12

17 Jul '12

Hi! I have problem with Dovecot 2.1.1 writing maildir files as users primary group. Tried to override gid value, but probably i'm missing something... doveconf -n # 2.1.1: /etc/dovecot/dovecot.conf # OS: Linux 2.6.18-308.11.1.el5 x86_64 CentOS release 5.8 (Final) auth_verbose = yes info_log_path = /var/log/dovecot/info.log listen = * log_path = /var/log/dovecot/error.log mail_location = maildir:%h/Maildir passdb { args = cache_key=%u dovecot driver = pam } protocols = imap service imap-login { process_min_avail = 40 service_count = 1 } service imap { process_limit = 2048 vsz_limit = 2 G } ssl = required ssl_cert = </etc/pki/dovecot/certs/dovecot.pem ssl_key = </etc/pki/dovecot/private/dovecot.pem userdb { args = blocking=no gid=mail driver = passwd } Also tried using 'override_fields = gid=mail'. Users are from nss and winbind. Any ideas what i might do wrong? -- Veiko

2 1

[Dovecot] Difference between proxy_refresh and proxy_timeout in director
by Angel L. Mateo 17 Jul '12

17 Jul '12

Hello, I know proxy_timeout is the timeout for the director operation. But what is the purpose for proxy_refresh? -- Angel L. Mateo Martínez Sección de Telemática Área de Tecnologías de la Información _o) y las Comunicaciones Aplicadas (ATICA) / \\ http://www.um.es/atica _(___V Tfo: 868887590 Fax: 868888337

2 1

[Dovecot] imapc: Restrict the number of connections
by René Neumann 17 Jul '12

17 Jul '12

Hi, I have managed to get an imapc connection to another server and bind its contents to only one account (via global ACL). The namespace itself is created as public, though it does not seem to make a difference for this use case (i.e., it does not matter, whether its type is 'public', 'shared', or 'private'). namespace { hidden = no list = children location = imapc: prefix = Gemeinsam. separator = . subscriptions = no type = public } One problem remains: Though there is only one account that is allowed to use this imapc-connection, each imap-process opens a connection to the imapc'd server. Is this caused directly by the imapc_*-definitions in the config? Or is there a way of restricting this to only the account which actually uses it. Used dovecot version: 2.1.8 Thanks, René

2 1

[Dovecot] bcypt availability
by Nick Edwards 17 Jul '12

17 Jul '12

Dear Timo, Do you intend to introduce bcrypt into the built in password schemes? In lew of all these hacks lately many larger companies appear moving this way, we are looking at it too, but dovecot will then be the weakest link in the database security. So, are you planning on this and if so what sort of timeframe / version would you expect it to be in beta ? Nik

5 6