- dovecot - dovecot.org

Re: [Dovecot] IMAP STARTTLS Problem
by Patrick Ben Koetter 07 May '12

07 May '12

* markus(a)opsys.de <markus(a)opsys.de>: > Yep, I set the rights for the cert in Thunderbird. With this CERT > SSL is working in Thunderbird but not with STARTTLS. > > 4440[af7d580]: bcde800:mail.opsys.de:NA:CreateNewLineFromSocket: 1 > BAD TLS not available due to temporary reason Your server responds it has a temporary problem. Set the server verbose to get more useful log output. p@rick P.S. And please keep this thread onlist. > That's the message I get from Thunderbird. > > And that's the hole log: > > 4440[af7d580]: ImapThreadMainLoop entering [this=bcde800] > 0[c0f140]: bcde800:mail.opsys.de:NA:SetupWithUrl: clearing > IMAP_CONNECTION_IS_OPEN > 4440[af7d580]: bcde800:mail.opsys.de:NA:ProcessCurrentURL: entering > 4440[af7d580]: bcde800:mail.opsys.de:NA:ProcessCurrentURL:imap://markus%40opsys%2Ede@mail.opsys.de:143/select%3E.INBOX: > = currentUrl > 4440[af7d580]: ReadNextLine [stream=bc59ca8 nb=118 needmore=0] > 4440[af7d580]: bcde800:mail.opsys.de:NA:CreateNewLineFromSocket: * > OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE > STARTTLS AUTH=PLAIN AUTH=LOGIN] Dovecot ready. > > 4440[af7d580]: bcde800:mail.opsys.de:NA:SendData: 1 STARTTLS > > 4440[af7d580]: ReadNextLine [stream=bc59ca8 nb=49 needmore=0] > 4440[af7d580]: bcde800:mail.opsys.de:NA:CreateNewLineFromSocket: 1 > BAD TLS not available due to temporary reason > > 4440[af7d580]: try to log in > 4440[af7d580]: IMAP auth: server caps 0x4405427, pref 0x1006, failed > 0x0, avail caps 0x1006 > 4440[af7d580]: (GSSAPI = 0x1000000, CRAM = 0x20000, NTLM = 0x100000, > MSN = 0x200000, PLAIN = 0x1000, LOGIN = 0x2, old-style IMAP login = > 0x4)auth external IMAP login = 0x20000000 > 4440[af7d580]: trying auth method 0x1000 > 4440[af7d580]: got new password > 4440[af7d580]: IMAP: trying auth method 0x1000 > 4440[af7d580]: PLAIN auth > 4440[af7d580]: bcde800:mail.opsys.de:NA:SendData: 2 authenticate plain > > 4440[af7d580]: ReadNextLine [stream=bc59ca8 nb=4294967295 needmore=0] > 4440[af7d580]: bcde800:mail.opsys.de:NA:CreateNewLineFromSocket: > clearing IMAP_CONNECTION_IS_OPEN - rv = 80470002 > 4440[af7d580]: bcde800:mail.opsys.de:NA:TellThreadToDie: close > socket connection > 4440[af7d580]: bcde800:mail.opsys.de:NA:CreateNewLineFromSocket: (null) > 4440[af7d580]: authlogin failed > 4440[af7d580]: marking auth method 0x1000 failed > 4440[af7d580]: IMAP auth: server caps 0x4405427, pref 0x1006, failed > 0x1000, avail caps 0x6 > 4440[af7d580]: (GSSAPI = 0x1000000, CRAM = 0x20000, NTLM = 0x100000, > MSN = 0x200000, PLAIN = 0x1000, LOGIN = 0x2, old-style IMAP login = > 0x4)auth external IMAP login = 0x20000000 > 4440[af7d580]: trying auth method 0x2 > 4440[af7d580]: login failed entirely -- state of mind () http://www.state-of-mind.de Franziskanerstraße 15 Telefon +49 89 3090 4664 81669 München Telefax +49 89 3090 4666 Amtsgericht München Partnerschaftsregister PR 563

2 5

[Dovecot] v2.1.6 released
by Timo Sirainen 07 May '12

07 May '12

http://dovecot.org/releases/2.1/dovecot-2.1.6.tar.gz http://dovecot.org/releases/2.1/dovecot-2.1.6.tar.gz.sig * Session ID is now included by default in auth and login process log lines. It can be added to mail processes also by adding %{session} to mail_log_prefix. + Added ssl_require_crl setting, which specifies if CRL check must be successful when verifying client certificates. + Added mail_shared_explicit_inbox setting to specify if a shared INBOX should be accessible as "shared/$user" or "shared/$user/INBOX". - v2.1.5: Using "~/" as mail_location or elsewhere failed to actually expand it to home directory. - dbox: Fixed potential assert-crash when reading dbox files. - trash plugin: Fixed behavior when quota is already over limit. - mail_log plugin: Logging "copy" event didn't work. - Proxying to backend server with SSL: Verifying server certificate name always failed, because it was compared to an IP address.

1 0

[Dovecot] Shared namespace
by Daniel L. Miller 07 May '12

07 May '12

I'm not sure what's triggered it - I THINK it has something to do with a force-resync, but not sure. I'm no longer viewing my full list of shared mailboxes. I used to have a number of users shown - they had all had their ACL's set individually and were shown in the list. "doveadm acl debug" shows they SHOULD be shown - at least I think so, as the output for the mailboxes that DO appear is identical for those that don't. Where should I look for breakage? -- Daniel

1 0

Re: [Dovecot] mdbox packing
by Daniel L. Miller 07 May '12

07 May '12

On 5/6/2012 8:09 PM, Daniel L. Miller wrote: > On 4/30/2012 5:23 PM, Timo Sirainen wrote: >> On Mon, 2012-04-30 at 12:43 -0700, Daniel L. Miller wrote: >>> Is there a way to manually force an mdbox storage to be rebuilt into >>> new >>> files? Particularly files of the maximum size? >> You could do it with dsync. >> >> > dsync seems to do a marvelous job - new question.? > > Given a mailbox with a larger number of older mails - assuming any new > mails will have later dates - will the new mail storage files be > identical? I'm probably not saying the right - let me try this: > > 1. "dsync backup mdbox" (with appropriate args) is run for a given user. > 2. "dsync mirror mdbox" is done just to catch up. > 3. Old mailstore moved off. > 4. New mailstore moved to active location. > > I'm sure there's a safer way to do the above - but I've got a > low-traffic site and I can just shut down mail service altogether for > a few minutes if I want during this. > > Now - repeat the above four steps. Will mail files m.1 through > m.(n-1) be identical to the last run? Is this a valid packing > strategy prior to performing an rsync type backup - assuming no > changes are being made to the archived mails between pack runs? Given the above, and SIS - if the backup is performed in the same spool, i.e. original is /var/mail/domain/user, backup is /var/mail/domain/user-new - will this result in any problems with SIS? If after the pack and rename operation, the old mail tree is simply deleted - will that leave SIS files unreferenced if the user later deletes the messages from their active store? -- Daniel

1 0

[Dovecot] mdbox packing
by Daniel L. Miller 07 May '12

07 May '12

Is there a way to manually force an mdbox storage to be rebuilt into new files? Particularly files of the maximum size? -- Daniel

3 3

[Dovecot] Authentication process holding open filehandles
by George Barnett 07 May '12

07 May '12

Hi, We're using dovecot to provide pop3 for a number of mailboxes. The setup is pretty simple: Each user / domain has a mailstore in /data/mailstore/<domain>/<user>/Maildir (backed by NFS). Passwords are in simple passwd-file format in the top level domain directory eg: # cat /data/mailstore/foo.com/.passwd user:{plain}password The passdb setup looks like this. passdb { args = username_format=%n /data/mailstore/%d/.passwd driver = passwd-file } The problem we're having is that when we want to remove a domain from the system and we go to rm -rf /data/mailstore/<domain>/ we are unable to because the auth process is still holding onto the file handles for the password file. Can somebody suggest an alternative pattern that I could use for storing password files? Ideally, we'd avoid one large file to prevent locking issues and would also keep the passwd-file setup since it's simple. It would be possible to have the password files in a separate dir, but over time I'm guessing that would lead to nfs turds? Easy to clean up I suppose, but maybe there's a simpler solution I'm missing? George

2 1

[Dovecot] smtp -auth with using clear text password
by Agnello George 06 May '12

06 May '12

Hi I am setting up a mailserver .. where clients need to authenticate to the mail server . The mta i am using is postfix . It is possible to use a file like this : ---------------------------------- cat /etc/postfix/dovecote_passwd agnello:123456 --------------------------------- where user is agnello and password is 123456 If you can please send me some reference links thanks a ton -- Regards Agnello D'souza

5 9

Re: [Dovecot] IMAP STARTTLS Problem
by Patrick Ben Koetter 06 May '12

06 May '12

* markus(a)opsys.de <markus(a)opsys.de>: > Am 05.05.2012 22:44, schrieb Patrick Ben Koetter: > >* Markus Fritz <markus.fritz(a)opsys.de>: > >>Am 05.05.2012 21:06, schrieb Markus Fritz: > >Assuming your server cert is located in > >/etc/ssl/certs/ca-certificates.crt try > >this on your server: > > > >openssl s_client -starttls imap -CAfile > >/etc/ssl/certs/ca-certificates.crt -connect localhost:143 > > > >Use "2 logout" to get out of the session. > > > >If it works, try the same from your client host. > > > >Does it work both times? > > yes: > > Verify return code: 0 (ok) > --- > . OK Capability completed. > > it works. But I cannot login with Thunderbird. I imported the cert > in Thunderbird, too. IIRC it is not enough to import the cert. You also need to set a policy i.e. allow the cert to be used for e-mail. p@rick -- state of mind () http://www.state-of-mind.de Franziskanerstraße 15 Telefon +49 89 3090 4664 81669 München Telefax +49 89 3090 4666 Amtsgericht München Partnerschaftsregister PR 563

1 0

[Dovecot] HG 3d8a25a4394d Patch breaks UserDB Lookups
by Thomas Leuxner 06 May '12

06 May '12

Patch http://hg.dovecot.org/dovecot-2.1/rev/3d8a25a4394d breaks auth May 5 09:01:52 spectre dovecot: lmtp(24442): Connect from local May 5 09:01:52 spectre dovecot: lmtp(24442): Error: userdb lookup(tlx(a)leuxner.net): Disconnected unexpectedly May 5 09:01:52 spectre dovecot: auth: Fatal: master: service(auth): child 24443 killed with signal 11 (core not dumped) May 5 09:01:52 spectre dovecot: lmtp(24442): Disconnect from local: Client quit (in reset) Regards Thomas

2 2

[Dovecot] IMAP STARTTLS Problem
by Markus Fritz 05 May '12

05 May '12

Hello, I have this problem: May 5 21:02:35 opsys dovecot: imap-login: Disconnected (no auth attempts): rip=84.150.52.31, lip=78.46.216.126 Connecting via Thunderbird to STARTTLS won't work, but with a website from the same server it works for tls://opsys.de. So why is the port closed for external ip's? IPTABLES entry for imap is this: fail2ban-dovecot-pop3imap tcp -- anywhere anywhere multiport dports pop3,pop3s,imap2,imaps Key files are correct TLS is working from localhost. System is Debian squeeze -- Markus Fritz Administration opsys.de

3 4