- dovecot - dovecot.org

[Dovecot] MySQL dict issues
by list＠airstreamcomm.net 18 Jul '12

18 Jul '12

Testing using the mysql dict for quota storage (dovecot-2.0.12-2_127.el5), and ran into a couple issues. First is a permissions issue: dovecot: lmtp(26786, dude(a)test.tld) Error: net_connect_unix(/var/run/dovecot/dict) failed: Permission denied (euid=5000(<unknown>) egid=5000(<unknown>) missing +r perm: /var/run/dovecot/dict, euid is not dir owner) The file /var/run/dovecot/dict is listed with srw------- perms. I changes the perms to srw----rwx and it works, but I would like to figure out how to configure properly to run with the uid and gid 5000 as this is the user for virtual mail. The second issue is that two identical rows are created in the mysql database for each user quota. The next message delivered updates both rows. Here is my quota config: 90-quota.conf: plugin { quota_rule = *:storage=10G quota_rule2 = Trash:storage=+10% } plugin { quota = dict:user::proxy::userquota } dict { userquota = mysql:/etc/dovecot/dovecot-dict-sql.conf.ext } dovecot-dict-sql.conf.ext: connect = host=a.b.c.d dbname=mail user=user password=derp map { pattern = priv/quota/storage table = domain_user_quotas username_field = username value_field = bytes } map { pattern = priv/quota/messages table = domain_user_quotas username_field = username value_field = message_count } The last issue might be a documentation omission. Dovecot warned me that the mysql user did not have DELETE privileges on the quota table: dovecot: dict: Error: sql dict: commit failed: DELETE command denied to user 'user'@'a.b.c.d' for table 'domain_user_quotas' The quota dict documentation (at http://wiki2.dovecot.org/Quota/Dict) does not mention DELETE being needed: MySQL uses the following queries to update the quota. You need suitable privileges. INSERT INTO table (bytes,username) VALUES ('112497180','foo(a)spam.dom') ON DUPLICATE KEY UPDATE bytes='112497180'; INSERT INTO table (messages,username) VALUES ('1743','foo(a)spam.dom') ON DUPLICATE KEY UPDATE messages='1743'; UPDATE table SET bytes=bytes-14433,messages=messages-2 WHERE username = 'foo(a)spam.dom';

2 2

[Dovecot] Dovecot-2.1.8 process imap crashed
by Marcin Mirosław 18 Jul '12

18 Jul '12

Hello! I've just upgraded dovecot from 2.0.18 to 2.1.8 and configured impac. I notice dovecot/imap throws segfault from time to time. I'm not sure i know what steps are needed to reproduce problem. I'm using gentoo, hardened-kernel-3.4.2. Namespaces (and settings for imapc) are keept in database so i'm not sure doveconf would be useful. If would be needed please let me know. Thanks Marcin Core was generated by `dovecot/imap'. Program terminated with signal 11, Segmentation fault. #0 0x000002d0fbf908a2 in mail_storage_set_internal_error (storage=0x0) at mail-storage.c:466 466 mail-storage.c: No such file or directory. in mail-storage.c (gdb) bt #0 0x000002d0fbf908a2 in mail_storage_set_internal_error (storage=0x0) at mail-storage.c:466 #1 0x000002d0fbf5f025 in imapc_noop_callback (reply=<optimized out>, context=<optimized out>) at imapc-storage.c:691 #2 0x000002d0fbf5f07a in imapc_idle_noop_callback (reply=<optimized out>, context=0x2b466158c0) at imapc-storage.c:713 #3 0x000002d0fbf6208a in imapc_connection_abort_commands (conn=0x2b46579c10, disconnected=<optimized out>, keep_retriable=<optimized out>) at imapc-connection.c:271 #4 0x000002d0fbf624be in imapc_connection_disconnect (conn=0x2b46579c10) at imapc-connection.c:371 #5 0x000002d0fbf636b9 in imapc_connection_deinit (_conn=0x2b46579b20) at imapc-connection.c:178 #6 0x000002d0fbf60113 in imapc_client_deinit (_client=0x2b4655b6e8) at imapc-client.c:111 #7 0x000002d0fbf5ea77 in imapc_storage_destroy (_storage=<optimized out>) at imapc-storage.c:275 #8 0x000002d0fbf90600 in mail_storage_unref (_storage=0x2b46558910) at mail-storage.c:417 #9 0x000002d0fbf8a259 in mail_namespace_free (ns=0x2b465588c0) at mail-namespace.c:37 #10 0x000002d0fbf8a784 in mail_namespaces_deinit (_namespaces=0x2b4654c9e8) at mail-namespace.c:437 #11 0x000002d0fbf95311 in mail_user_deinit_base (user=0x2b4654c970) at mail-user.c:29 #12 0x000002d0f940f658 in stats_user_deinit (user=0x2b4654c970) at stats-plugin.c:506 #13 0x000002d0fa86b619 in quota_user_deinit (user=0x2b4654c970) at quota-storage.c:412 #14 0x000002d0fbf95597 in mail_user_unref (_user=<optimized out>) at mail-user.c:153 #15 0x0000002b4461b58e in client_destroy (client=0x2b465891d0, reason=0x0) at imap-client.c:219 #16 0x0000002b44615552 in idle_client_input (ctx=<optimized out>) at cmd-idle.c:113 #17 0x000002d0fbce3767 in io_loop_call_io (io=0x2b46622ff0) at ioloop.c:379 #18 0x000002d0fbce469a in io_loop_handler_run (ioloop=<optimized out>) at ioloop-epoll.c:213 #19 0x000002d0fbce3054 in io_loop_run (ioloop=0x2b46525aa0) at ioloop.c:398 #20 0x000002d0fbccc446 in master_service_run (service=0x2b46525950, callback=<optimized out>) at master-service.c:543 #21 0x0000002b44624e76 in main (argc=1, argv=0x2b46525790) at main.c:389 (gdb) bt full #0 0x000002d0fbf908a2 in mail_storage_set_internal_error (storage=0x0) at mail-storage.c:466 str = 0x2b4651e840 "Internal error occurred. Refer to server log for more information. [2012-07-17 16:06:09]" #1 0x000002d0fbf5f025 in imapc_noop_callback (reply=<optimized out>, context=<optimized out>) at imapc-storage.c:691 storage = <optimized out> #2 0x000002d0fbf5f07a in imapc_idle_noop_callback (reply=<optimized out>, context=0x2b466158c0) at imapc-storage.c:713 mbox = 0x2b466158c0 #3 0x000002d0fbf6208a in imapc_connection_abort_commands (conn=0x2b46579c10, disconnected=<optimized out>, keep_retriable=<optimized out>) at imapc-connection.c:271 cmdp = 0x2b4651e808 cmd = 0x2b466116a0 tmp_array = {arr = {buffer = 0x2b4651e7c8, element_size = 8}, v = 0x2b4651e7c8, v_modifiable = 0x2b4651e7c8} reply = {state = IMAPC_COMMAND_STATE_DISCONNECTED, resp_text_key = 0x0, resp_text_value = 0x0, text_full = 0x2d0fbfe768e "Disconnected from server", text_without_resp = 0x2d0fbfe768e "Disconnected from server"} #4 0x000002d0fbf624be in imapc_connection_disconnect (conn=0x2b46579c10) at imapc-connection.c:371 reconnecting = false #5 0x000002d0fbf636b9 in imapc_connection_deinit (_conn=0x2b46579b20) at imapc-connection.c:178 No locals. #6 0x000002d0fbf60113 in imapc_client_deinit (_client=0x2b4655b6e8) at imapc-client.c:111 client = 0x2b4655c6e0 connp = 0x2b4655c840 __FUNCTION__ = "imapc_client_deinit" #7 0x000002d0fbf5ea77 in imapc_storage_destroy (_storage=<optimized out>) at imapc-storage.c:275 storage = <optimized out> #8 0x000002d0fbf90600 in mail_storage_unref (_storage=0x2b46558910) at mail-storage.c:417 storage = 0x2b4655b5e0 __FUNCTION__ = "mail_storage_unref" #9 0x000002d0fbf8a259 in mail_namespace_free (ns=0x2b465588c0) at mail-namespace.c:37 No locals. #10 0x000002d0fbf8a784 in mail_namespaces_deinit (_namespaces=0x2b4654c9e8) at mail-namespace.c:437 ns = <optimized out> next = 0x2b46550dd0 #11 0x000002d0fbf95311 in mail_user_deinit_base (user=0x2b4654c970) at mail-user.c:29 No locals. #12 0x000002d0f940f658 in stats_user_deinit (user=0x2b4654c970) at stats-plugin.c:506 suser = 0x2b4654e8c8 stats_conn = 0x2b46552170 __FUNCTION__ = "stats_user_deinit" #13 0x000002d0fa86b619 in quota_user_deinit (user=0x2b4654c970) at quota-storage.c:412 quser = 0x2b4654e890 quota_set = 0x2b46551190 #14 0x000002d0fbf95597 in mail_user_unref (_user=<optimized out>) at mail-user.c:153 user = 0x2b4654c970 __FUNCTION__ = "mail_user_unref" #15 0x0000002b4461b58e in client_destroy (client=0x2b465891d0, reason=0x0) at imap-client.c:219 cmd = <optimized out> __FUNCTION__ = "client_destroy" #16 0x0000002b44615552 in idle_client_input (ctx=<optimized out>) at cmd-idle.c:113 ---Type <return> to continue, or q <return> to quit--- client = 0x2b465891d0 #17 0x000002d0fbce3767 in io_loop_call_io (io=0x2b46622ff0) at ioloop.c:379 ioloop = 0x2b46525aa0 t_id = 2 #18 0x000002d0fbce469a in io_loop_handler_run (ioloop=<optimized out>) at ioloop-epoll.c:213 ctx = 0x2b46525e10 events = <optimized out> event = 0x2b46525e80 list = 0x2b465a80a0 io = <optimized out> tv = {tv_sec = 5, tv_usec = 999824} msecs = <optimized out> ret = 1 i = <optimized out> j = <optimized out> call = <optimized out> #19 0x000002d0fbce3054 in io_loop_run (ioloop=0x2b46525aa0) at ioloop.c:398 No locals. #20 0x000002d0fbccc446 in master_service_run (service=0x2b46525950, callback=<optimized out>) at master-service.c:543 No locals. #21 0x0000002b44624e76 in main (argc=1, argv=0x2b46525790) at main.c:389 set_roots = {0x2b4482ad60, 0x0} login_set = {auth_socket_path = 0x2b4651d498 "/var/run/dovecot/auth-master", postlogin_socket_path = 0x0, postlogin_timeout_secs = 60, callback = 0x2b44624804 <login_client_connected>, failure_callback = 0x2b446244fd <login_client_failed>} service_flags = <optimized out> storage_service_flags = MAIL_STORAGE_SERVICE_FLAG_DISALLOW_ROOT username = 0x0 c = <optimized out>

2 2

[Dovecot] expire-tool stops on first box with nothing to expire in it
by Michael Wessel 18 Jul '12

18 Jul '12

Hi, I'm running dovecot 1.2.11 on Centos and have the expire plugin enabled. I've had this in place for some time but until now never actually ran the expire-tool. I'm now trying to put this to use. The expire plugin as such is working fine and also the tool is working fine - up to a point. When I run it with --test it goes through a bunch of boxes and lists the messages it would expunge and the new date being logged at the end. As soon as it hits the first box that has nothing in it that's expired however, it stops and goes no further. As an example here are the last two lines of the output when I just ran it: Info: user(a)domain.com/Trash: timestamp 1342320464 (Sat Jul 14 19:47:44 2012) -> 1342937319 (Sat Jul 21 23:08:39 2012) Info: nextuser(a)domain.com/Trash: stop, expire time in future: Sat Jul 14 20:41:49 2012 If I run it again after the indicated expire time it will now also go through the nextuser(a)domain.com but then again stop as soon as it encounters another user with nothing to expire. As far as I can tell the same happens when I actually run the tool. Harder to tell of course as there is no output, but I can tell that not all boxes are expunged as they should be. Any ideas why this would be? Any way to get debug logging on this? Michael

2 2

[Dovecot] Compile issue Dovecot 2.1.8, OS X 10.6.x
by Jim 18 Jul '12

18 Jul '12

Hey all. I'm running Mac OS X 10.6.4, and had Dovecot 2.0.7 installed built from source. I'm now wanting to upgrade to Dovecot 2.1.8, but I can't get MAKE to finish without errors: ./configure --with-mysql (snip) Install prefix . : /usr/local File offsets ... : 64bit I/O polling .... : kqueue I/O notifys .... : kqueue SSL ............ : yes (OpenSSL) GSSAPI ......... : no passdbs ........ : static passwd passwd-file pam checkpassword sql : -shadow -bsdauth -sia -ldap -vpopmail userdbs ........ : static prefetch passwd passwd-file checkpassword sql : -ldap -vpopmail -nss SQL drivers .... : mysql : -pgsql -sqlite Full text search : squat : -lucene -solr sudo make (snip) Undefined symbols: "_libiconv_open", referenced from: _charset_to_utf8_begin in libcharset.a(charset-iconv.o) "_libiconv", referenced from: _charset_to_utf8_reset in libcharset.a(charset-iconv.o) _charset_to_utf8 in libcharset.a(charset-iconv.o) "_libiconv_close", referenced from: _charset_to_utf8_end in libcharset.a(charset-iconv.o) ld: symbol(s) not found collect2: ld returned 1 exit status make[3]: *** [libdovecot.la] Error 1 make[2]: *** [all-recursive] Error 1 make[1]: *** [all-recursive] Error 1 make: *** [all] Error 2 The reason for the 'sudo make' was to get around a permissions issue, but I don't think that's related to my issue here. I had build Dovecot 2.0.7 and earlier without issue on this system, but I'm a bit stumped on this particular problem. I also found that the configure parameter --with-sql-drivers no longer seems to work, even though it's still shown in the wiki for 2.x. As far as I can tell, I had used this parameter when compiling 2.0.7.

2 4

[Dovecot] Different LDAP filters for different protocols
by James Devine 18 Jul '12

18 Jul '12

Is it possible to query LDAP differently for different protocols? I am using dovecot for both pop3/imap and lmtp deliveries and there are different enable flags in ldap for them. I tried wrapping user_filter inside the protocols in the file dovecot-ldap.conf.ext as shown below but this didn't seem to work. protocol lmtp { user_filter = (&(objectClass=posixAccount)(cn=%u)(active=1)(msmtp=1)) } protocol imap { user_filter = (&(objectClass=posixAccount)(cn=%u)(active=1)(mpop=1)) } protocol pop3 { user_filter = (&(objectClass=posixAccount)(cn=%u)(active=1)(mpop=1)) }

1 1

[Dovecot] outlook and redirect sieve
by Lazy 18 Jul '12

18 Jul '12

Hi Aall, we are having issues with outlook clients, running exchange or lotus being unable to parse the email messages redirected by dovecot's sieve 0.3.1, the command is plain redirect "email(a)lotusmail.xxx"; redirects from mta also work correctly exchange was fixed by removing this commit http://hg.rename-it.nl/dovecot-2.1-pigeonhole/raw-diff/082216ad12d6/src/lib… are there any other modifications to the email body or headers that can make those mesages not parsable for outlook ? looking at http://hg.rename-it.nl/dovecot-2.1-pigeonhole/raw-diff/082216ad12d6/src/lib… maybe removing HEADER_FILTER_NO_CR fromi_stream_create_header_filter() will make redirected messages more in tact ? what can I do to make redirect more verbatim ? Thanks in advance for any information. Regards, Michal Grzedzicki

2 3

[Dovecot] Selective TLS per local IP
by Robert Blayzor 17 Jul '12

17 Jul '12

We have the requirement to provide SSL on some IP addresses, but not others on our servers. Providing SSL is the easy part and we're able to use multiple SSL certificates now. (thanks Timo!) All is working ok, but we several IP hosts that do not require SSL and do not have valid certificates. While we can limit access via a firewall ACL to TLS connect ports (993/995) we can't do so on port 110/143. The problem is that some clients now are smart enough to look for an offered STARTTLS or STLS, and if it's offered, they try to use it. While not normally a problem if your setup for SSL with valid key/certs, if you have a self signed or no CERT at all, it starts connection warnings and errors on the client side. So is there any way possible to turn off advertising of TLS on port or turn it off/on per IP? Something like: ssl = yes ssl_cert = </etc/ssl/cert/default.pem ssl_key = </etc/ssl/cert/default.pem local 10.1.1.1 { protocol imap { ssl_cert = </etc/ssl/cert/site1.pem ssl_key = </etc/ssl/cert/site1.pem } protocol pop3 { ssl_cert = </etc/ssl/cert/site1.pem ssl_key = </etc/ssl/cert/site1.pem } } local 10.1.1.2 { ssl = no } *or* ssl = no local 10.1.1.1 { ssl = yes protocol imap { ssl_cert = </etc/ssl/cert/site1.pem ssl_key = </etc/ssl/cert/site1.pem } protocol pop3 { ssl_cert = </etc/ssl/cert/site1.pem ssl_key = </etc/ssl/cert/site1.pem } } -- Robert Blayzor INOC, LLC rblayzor(a)inoc.net http://www.inoc.net/~rblayzor/

2 4

[Dovecot] files missed from install
by Tim Dickson 17 Jul '12

17 Jul '12

version: using dovecot 2.1.8 or 2.0.12 bug: installation - some files missed details: dovecot-openssl.cnf and mkcert.sh are not copied from the src/doc folder to the installation doc folder on installation (make install) both are referred to in the documentation and are useful. is there any chance of updating the build scripts to include these files? thanks, Tim

3 3

[Dovecot] [PATCH] Interop problem with Cyrus SASL and GSSAPI
by Ben Morrow 17 Jul '12

17 Jul '12

[I sent this a while ago, but it seems not to have made it to the list. I'm resending it having subscribed first; I apologise if anyone get it twice.] I have been trying to get a Postfix mail server using Dovecot SASL to accept GSSAPI AUTH from another Postfix server using Cyrus SASL, and I believe I have found a couple of bugs in Dovecot's GSSAPI implementation. The first problem is that, because of the way the client invokes libsasl, it sends a GSSAPI request which does not ask for mutual authentication. This means that on the server gss_accept_sec_context returns GSS_S_COMPLETE with a zero-length output token. Dovecot currently sends this to the client as a zero-length continuation response, but this is incorrect according to RFC 4752: what it ought to do instead is proceed straight to the security layer negotiations, and send a gss_wrap packet. The second is that Cyrus sends an empty authz identity; that is, the security layer negotiation packet, when gss_unwrapped, is exactly 4 bytes long. Dovecot objects to this, but in RFC 4422 this is explicitly allowed, and means the authz identity is identical to the authn identity. I believe the attached patches (for the 1.2 and 2.1 branches) fix the problem, though I'm not entirely sure if the difference between the p_strndup in mech_gssapi_unwrap and the t_strndup in get_display_name is important. Ben

2 1

[Dovecot] Timeout (180s) while waiting for lock for transaction log file
by Angel L. Mateo 17 Jul '12

17 Jul '12

Hello, We still have problems with our updated dovecot servers... The problem now is that we are having errors like: Jul 9 10:22:02 myotis31 dovecot: lmtp(15431, <user>): Error: Timeout (180s) while waiting for lock for transaction log file /var/indexes/<user>/.INBOX/dovecot.index.log Jul 9 10:22:02 myotis31 dovecot: lmtp(15431, <user>): Error: +4YfCwKS+k9HPAAAmo+UlA: sieve: msgid=<4FFA8700.2080003(a)um.es>: failed to store into mailbox 'INBOX': Internal error occurred. Refer to server log for more information. [2012-07-09 10:19:02] Jul 9 10:22:02 myotis31 dovecot: lmtp(15431, <user>): Error: +4YfCwKS+k9HPAAAmo+UlA: sieve: script /home/pdi/88/185188/.dovecot.sieve failed with unsuccessful implicit keep (user logfile /home/pdi/88/185188/.dovecot.sieve.log may reveal additional details) in the .dovecot.sieve.log all we have is just: sieve: info: started log at Jul 09 10:22:02. error: msgid=<4FFA8700.2080003(a)um.es>: failed to store into mailbox 'INBOX': Internal error occurred. Refer to server log for more information. [2012-07-09 10:19:02]. maildir are in a nfs storage, but indexes are in local disk. I don't know if the problem could be related with a some "specific" messages or something specific to the user, because we are having this problem only with a few users and the problem repeatedly happens when our mta tries to deliver the queued message. Any idea? -- Angel L. Mateo Martínez Sección de Telemática Área de Tecnologías de la Información y las Comunicaciones Aplicadas (ATICA) http://www.um.es/atica Tfo: 868887590 Fax: 868888337

2 1