- dovecot - dovecot.org

[Dovecot] Dovecot rejecting Vpopmail User 89
by hobie＠rumormillnews.com 24 Aug '11

24 Aug '11

I'm working to get Dovecot 2.0.13 working along with qmail, Vpopmail and Squirrelmail on a Debian 6.0.2 system, Dovecot compiled, not from a package. Vpopmail has a widely known assigned user/group ID of 89 and is the owner of all the mail folders. Regardless of value of first_valid_uid (1, 89, other), Dovecot denies Squirrelmail connection, saying it can't allow access to UID 89. "Couldn't drop privileges", it says. I'd be grateful for fixes, suggestions, or a pointer to an existing answer to this problem. Thanks ahead. :) Presently dovecot -n shows: # 2.0.13: /usr/local/etc/dovecot/dovecot.conf # OS: Linux 2.6.32-5-amd64 x86_64 Debian 6.0.2 ext3 auth_debug = yes disable_plaintext_auth = no mail_debug = yes mail_location = maildir:/home/vpopmail/domains/%d/%n/Maildir maildir_very_dirty_syncs = yes passdb { driver = vpopmail } protocols = imap pop3 ssl_cert = </etc/ssl/certs/dovecot.pem ssl_key = </etc/ssl/private/dovecot.pem userdb { driver = passwd } userdb { args = quota_template=quota_rule=*:backend=%q driver = vpopmail } --hobie

3 5

Re: [Dovecot] Dovecot rejecting Vpopmail User 89
by Rick Romero 24 Aug '11

24 Aug '11

Enable auth_verbose and check the logs. But I'm pretty sure that means Dovecot can't change to the Maildir folder. I assume the user's folder is owned by vpopmail:vchkpw? Is the Maildir NFS mounted or local? Rick Quoting hobie(a)rumormillnews.com: > Thanks, Rick. :) Changed first/last uid/gid so all show 89 and restarted > Dovecot, no change. Telnetting from remote or from localhost, Dovecot > closes the connection immediately after password is sent. (?) > > --hobie > >> Quoting hobie(a)rumormillnews.com: >> >>> I'm working to get Dovecot 2.0.13 working along with qmail, Vpopmail and >>> Squirrelmail on a Debian 6.0.2 system, Dovecot compiled, not from a >>> package. >>> >>> Vpopmail has a widely known assigned user/group ID of 89 and is the >>> owner >>> of all the mail folders. >>> >>> Regardless of value of first_valid_uid (1, 89, other), Dovecot denies >>> Squirrelmail connection, saying it can't allow access to UID 89. >>> "Couldn't >>> drop privileges", it says. I'd be grateful for fixes, suggestions, or a >>> pointer to an existing answer to this problem. Thanks ahead. :) >>> >> >> Here's mine - I set first and last uid AND gid. >> Can you telnet to port 110 and test? >> >> USER username >> PASS password >> LIST >> >> >> # 2.0.13: /usr/local/etc/dovecot/dovecot.conf >> # OS: FreeBSD 8.2-RELEASE amd64 >> auth_mechanisms = plain login digest-md5 cram-md5 >> auth_username_translation = %@ >> auth_verbose = yes >> base_dir = /var/run/dovecot/ >> default_login_user = vpopmail >> disable_plaintext_auth = no >> first_valid_gid = 89 >> first_valid_uid = 89 >> last_valid_gid = 89 >> last_valid_uid = 89 >> # run under tcpserver >> log_path = /dev/stderr >> login_greeting = Ready. >> mail_fsync = never >> mail_plugins = " quota zlib" >> mail_privileged_group = mail >> namespace { >> inbox = yes >> location = >> prefix = >> separator = . >> } >> namespace { >> hidden = yes >> inbox = no >> list = no >> location = >> prefix = INBOX. >> separator = . >> } >> passdb { >> driver = vpopmail >> } >> plugin { >> quota = maildir >> } >> protocols = imap pop3 >> service anvil { >> client_limit = 2000 >> } >> service auth { >> unix_listener auth-master { >> mode = 0600 >> } >> } >> service imap-login { >> client_limit = 384 >> process_limit = 512 >> process_min_avail = 25 >> service_count = 0 >> } >> service imap-postlogin { >> executable = script-login rawlog >> /usr/local/etc/dovecot/lastauth-imap.sh >> user = vpopmail >> } >> service imap { >> executable = /usr/local/libexec/dovecot/imap >> } >> service pop-postlogin { >> executable = script-login /usr/local/etc/dovecot/lastauth-pop.sh >> user = vpopmail >> } >> service pop3-login { >> client_limit = 384 >> process_limit = 512 >> process_min_avail = 25 >> service_count = 0 >> } >> service pop3 { >> executable = /usr/local/libexec/dovecot/pop3 >> } >> shutdown_clients = no >> ssl_cert = </etc/ssl/mail.pem >> ssl_key = </etc/ssl/mail.key >> ssl_key_password = password >> userdb { >> driver = vpopmail >> } >> verbose_proctitle = yes >> protocol imap { >> auth_socket_path = /var/run/dovecot/auth-master >> imap_client_workarounds = delay-newmail tb-extra-mailbox-sep >> mail_max_userip_connections = 10 >> mail_plugins = " quota zlib imap_zlib quota imap_quota" >> } >> protocol pop3 { >> auth_socket_path = /var/run/dovecot/auth-master >> mail_max_userip_connections = 10 >> mail_plugins = quota >> pop3_client_workarounds = outlook-no-nuls oe-ns-eoh >> pop3_uidl_format = %08Xu%08Xv >> >> >>

1 0

[Dovecot] BUG - lmtp multiple recipients fail - setuid issue?
by Boris Lordis 24 Aug '11

24 Aug '11

Hello, I am not having much luck on this particular issue so I wanted to make sure that this is registered as a potential bug. The essence of the problem is that for a given message addressed to multiple users, lmtp writes the message correctly to the first addressed user only, then subsequent user writes fail as the lmtp process doesn't run with the proper permissions and tries to link files from different users as part of its message writing. Below you can see that lmtp (running with steve's id, who was the first listed recipient) is trying to link a file in jerry's inbox meeting with failure: Jul 27 11:24:42 testmailserver dovecot: lmtp(12412, steve): Error: link(/spool/mail/j/jerry/mail/INBOX/u.20423, /spool/mail/s/steve/mail/INBOX/.temp.1311791081.P12412Q2M989550.testmailserver.) failed: Permission denied Jul 27 11:24:42 testmailserver dovecot: lmtp(12412, steve): +1IXBeVXME58MAAARoVNxQ: msgid <201107271824.p6RIOPa5020900 at backup.>: save failed to INBOX: Internal error occurred. Refer to server log for more information. [2011-07-27 11:24:41] Best regards, -Boris I am using version 2.0.13. dovecot -n shows this: # 2.0.13: /etc/dovecot/dovecot.conf # OS: Linux 2.6.32-71.29.1.el6.i686 i686 CentOS Linux release 6.0 (Final) ext4 auth_debug = yes auth_master_user_separator = * auth_verbose = yes auth_verbose_passwords = plain lda_mailbox_autocreate = yes mail_debug = yes mail_location = sdbox:/spool/mail/%1Ln/%Ln/mail:INBOX=/spool/mail/%1Ln/%Ln/mail/INBOX mbox_write_locks = fcntl passdb { args = /etc/dovecot/master-users driver = passwd-file master = yes } passdb { args = failure_show_msg=yes driver = pam } plugin { autocreate = INBOX autosubscribe = INBOX } service lmtp { inet_listener ltmp { port = 24 } } ssl_cert = </etc/pki/dovecot/certs/dovecot.pem ssl_key = </etc/pki/dovecot/private/dovecot.pem userdb { args = home=/spool/mail/%1Ln/%Ln driver = passwd } protocol lmtp { mail_plugins = " autocreate" }

2 2

[Dovecot] SiS
by Guy Deleeuw 24 Aug '11

24 Aug '11

Hello, SiS is implemented and stable in the last version ? Best Regards Guy

1 0

[Dovecot] Attachments not removed from single store
by Karsten Becker 24 Aug '11

24 Aug '11

Hi. Well, I've the next problem. I turned on the new attachment de-duplication stuff in the configuration. If I send an attchment between two accounts on my test system, the attment gets saved ion the configured mail_attachment_dir. But... if I delete it from the senders Send folder and the receivers Inbox (and of course empty Trash afterwards in both cases), the hashes and the attachment are not deleted in mail_attachment_dir (as I would expect). Is this a bug, or have I misunderstood the concept of storing attachments? Regards Karsten ------------------------------------------------ > # 2.0.13: /usr/local/dovecot-2.0.13/etc/dovecot/dovecot.conf > # OS: Linux 2.6.32-33-server x86_64 Ubuntu 10.04.3 LTS ext4 > doveconf: Warning: Dovecot was last started using /etc/dovecot/dovecot.conf, but this config is /usr/local/dovecot-2.0.13/etc/dovecot/dovecot.conf > auth_cache_negative_ttl = 0 > auth_cache_size = 10 M > auth_mechanisms = plain login > base_dir = /usr/local/dovecot/var/run/dovecot > dict { > acl = mysql:/etc/dovecot/dovecot-dict-shared-mailboxes-mysql.conf > expire = mysql:/etc/dovecot/dovecot-dict-expire-mysql.conf > quota = mysql:/etc/dovecot/dovecot-dict-quota-mysql.conf > } > log_timestamp = "%Y-%m-%d %H:%M:%S " > login_greeting = Company Institute > mail_attachment_dir = /srv/vmail/attachments > mail_attachment_hash = %{sha256} > mail_cache_min_mail_count = 2 > mail_debug = yes > mail_location = mdbox:/srv/vmail/user-mailboxes/%d/%n > mail_plugins = acl expire quota > mailbox_idle_check_interval = 1 mins > namespace { > inbox = yes > location = > prefix = > separator = / > subscriptions = yes > type = private > } > namespace { > list = children > location = mdbox:/srv/vmail/user-mailboxes/%%d/%%n > prefix = Users/%%d/%%n/ > separator = / > subscriptions = no > type = shared > } > namespace { > list = children > location = maildir:/srv/vmail/public_folders:INDEX=/srv/vmail/user-mailboxes/%d/%n/public_folders-seen:LAYOUT=fs > prefix = Folders/ > separator = / > subscriptions = no > type = public > } > passdb { > args = /etc/dovecot/dovecot-mysql.conf > driver = sql > } > plugin { > acl = vfile:/etc/dovecot/global-acls:cache_secs=300 > acl_shared_dict = proxy::acl > expire = Trash > expire2 = Trash/* > expire3 = Spam > expire4 = Spam/* > expire5 = Junk > expire6 = Junk/* > expire_dict = proxy::expire > quota = dict:User quota::proxy::quota > quota_rule = *:storage=10485760 > quota_rule2 = Trash:storage=+1048576 > quota_warning = storage=95%% quota-warning 95 %u > quota_warning2 = storage=80%% quota-warning 80 %u > } > postmaster_address = postmaster(a)company.eu > protocols = imap pop3 > service auth { > unix_listener /var/spool/postfix/private/auth_dovecot { > group = postfix > mode = 0660 > user = postfix > } > unix_listener auth-master { > mode = 0600 > user = vmail > } > user = root > } > service dict { > unix_listener dict { > mode = 0600 > user = vmail > } > } > service imap-login { > inet_listener imaps { > port = 993 > ssl = yes > } > process_min_avail = 2 > } > service imap { > vsz_limit = 512 M > } > service pop3-login { > inet_listener pop3s { > port = 995 > ssl = yes > } > } > service quota-warning { > executable = script /usr/local/bin/quota-warning.sh > user = vmail > } > ssl = required > ssl_cert = </etc/postfix/ssl/mail01.compdmz.local.crt > ssl_key = </etc/postfix/ssl/mail01.compdmz.local.key > userdb { > args = /etc/dovecot/dovecot-mysql.conf > driver = sql > } > verbose_proctitle = yes > protocol lda { > auth_socket_path = auth-master > postmaster_address = postmaster(a)company.eu > } > protocol imap { > imap_client_workarounds = delay-newmail tb-lsub-flags tb-extra-mailbox-sep > imap_max_line_length = 128 k > mail_plugins = acl expire quota imap_acl imap_quota > } > protocol pop3 { > pop3_client_workarounds = outlook-no-nuls oe-ns-eoh > }

2 2

[Dovecot] Bug report v2.0.13 - CentOS x86_64 - NFS - mbox
by Kostas Zorbadelos 24 Aug '11

24 Aug '11

Greetings to all. It's my first post to the list. We just completed a migration from qpopper to dovecot for our IMAP and POP3 services. We have a rather large mail environment (we are the biggest provider in Greece). So, here are the details: - Keep getting errors like these in our production environment Jul 22 00:18:21 pop01 dovecot: master: Error: service(pop3): child 4078 killed with signal 11 (core dumps disabled) Jul 22 00:19:31 pop03 dovecot: master: Error: service(pop3): child 18849 killed with signal 11 (core dumps disabled) --------------------------------------------------------------------- dovecot -n output --------------------------------------------------------------------- /opt/dovecot/sbin/dovecot -n # 2.0.13: /opt/dovecot/etc/dovecot/dovecot.conf # OS: Linux 2.6.18-92.1.22.el5 x86_64 CentOS release 5.5 (Final) auth_cache_negative_ttl = 10 mins auth_cache_size = 5 M auth_cache_ttl = 10 mins auth_verbose = yes default_client_limit = 5000 default_process_limit = 500 disable_plaintext_auth = no first_valid_uid = 200 listen = * log_timestamp = "%Y-%m-%d %H:%M:%S " login_greeting = <COMPANY> ready mail_access_groups = mail otemail disk root mail_fsync = always mail_location = mbox:INDEX=/var/index/dovecot/%2.16Hn/%2.254Hn/%u mail_nfs_storage = yes mbox_lock_timeout = 2 mins mbox_min_index_size = 200 k mbox_read_locks = dotlock_try fcntl mbox_write_locks = dotlock_try fcntl passdb { args = /opt/dovecot/etc/dovecot/dovecot-ldap.conf.ext driver = ldap } protocols = imap pop3 service auth-worker { user = dovenull } service imap-login { inet_listener imap { port = 143 } inet_listener imaps { port = 993 ssl = yes } } service pop3-login { inet_listener pop3 { port = 110 } inet_listener pop3s { port = 995 ssl = yes } } ssl = no userdb { args = /opt/dovecot/etc/dovecot/dovecot-ldap.conf.ext driver = ldap } verbose_proctitle = yes protocol imap { imap_client_workarounds = delay-newmail tb-extra-mailbox-sep mail_max_userip_connections = 100 } protocol pop3 { mail_max_userip_connections = 100 pop3_client_workarounds = outlook-no-nuls oe-ns-eoh pop3_fast_size_lookups = yes pop3_lock_session = yes pop3_reuse_xuidl = yes pop3_uidl_format = %08Xu%08Xv } I enabled core dumps in one of our backend servers and here is the relevant gdb trace: [root@pop08 ~]# gdb /opt/dovecot/libexec/dovecot/pop3 <path_to_core_file>/core.9273 GNU gdb (GDB) Red Hat Enterprise Linux (7.0.1-32.el5_6.2) Copyright (C) 2009 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html> This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type "show copying" and "show warranty" for details. This GDB was configured as "x86_64-redhat-linux-gnu". For bug reporting instructions, please see: <http://www.gnu.org/software/gdb/bugs/>... Reading symbols from /opt/dovecot/libexec/dovecot/pop3...(no debugging symbols found)...done. Reading symbols from /opt/dovecot/lib/dovecot/libdovecot-storage.so.0...(no debugging symbols found)...done. Loaded symbols for /opt/dovecot/lib/dovecot/libdovecot-storage.so.0 Reading symbols from /opt/dovecot/lib/dovecot/libdovecot.so.0...(no debugging symbols found)...done. Loaded symbols for /opt/dovecot/lib/dovecot/libdovecot.so.0 Reading symbols from /lib64/libdl.so.2...(no debugging symbols found)...done. Loaded symbols for /lib64/libdl.so.2 Reading symbols from /lib64/librt.so.1...(no debugging symbols found)...done. Loaded symbols for /lib64/librt.so.1 Reading symbols from /lib64/libc.so.6...(no debugging symbols found)...done. Loaded symbols for /lib64/libc.so.6 Reading symbols from /lib64/ld-linux-x86-64.so.2...(no debugging symbols found)...done. Loaded symbols for /lib64/ld-linux-x86-64.so.2 Reading symbols from /lib64/libpthread.so.0...(no debugging symbols found)...done. Loaded symbols for /lib64/libpthread.so.0 Core was generated by `dovecot/pop3'. Program terminated with signal 11, Segmentation fault. #0 0x00002b52e1027e54 in istream_raw_mbox_get_start_offset () from /opt/dovecot/lib/dovecot/libdovecot-storage.so.0 (gdb) bt full #0 0x00002b52e1027e54 in istream_raw_mbox_get_start_offset () from /opt/dovecot/lib/dovecot/libdovecot-storage.so.0 No symbol table info available. #1 0x00002b52e102b759 in ?? () from /opt/dovecot/lib/dovecot/libdovecot-storage.so.0 No symbol table info available. #2 0x00002b52e100a2c0 in index_mail_expunge () from /opt/dovecot/lib/dovecot/libdovecot-storage.so.0 No symbol table info available. #3 0x0000000000405e9c in client_update_mails () No symbol table info available. #4 0x00000000004061c1 in client_command_execute () No symbol table info available. #5 0x00000000004045b9 in client_handle_input () No symbol table info available. #6 0x00002b52e12df698 in io_loop_call_io () from /opt/dovecot/lib/dovecot/libdovecot.so.0 No symbol table info available. #7 0x00002b52e12e09d5 in io_loop_handler_run () from /opt/dovecot/lib/dovecot/libdovecot.so.0 No symbol table info available. #8 0x00002b52e12df62d in io_loop_run () from /opt/dovecot/lib/dovecot/libdovecot.so.0 No symbol table info available. #9 0x00002b52e12cdf13 in master_service_run () from /opt/dovecot/lib/dovecot/libdovecot.so.0 No symbol table info available. #10 0x0000000000403994 in main () No symbol table info available. (gdb) All traces of the crashes are identical, that is #0 0x00002b52e1027e54 in istream_raw_mbox_get_start_offset () from /opt/dovecot/lib/dovecot/libdovecot-storage.so.0 #1 0x00002b52e102b759 in ?? () from /opt/dovecot/lib/dovecot/libdovecot-storage.so.0 #2 0x00002b52e100a2c0 in index_mail_expunge () from /opt/dovecot/lib/dovecot/libdovecot-storage.so.0 #3 0x0000000000405e9c in client_update_mails () #4 0x00000000004061c1 in client_command_execute () #5 0x00000000004045b9 in client_handle_input () #6 0x00002b52e12df698 in io_loop_call_io () from /opt/dovecot/lib/dovecot/libdovecot.so.0 #7 0x00002b52e12e09d5 in io_loop_handler_run () from /opt/dovecot/lib/dovecot/libdovecot.so.0 #8 0x00002b52e12df62d in io_loop_run () from /opt/dovecot/lib/dovecot/libdovecot.so.0 #9 0x00002b52e12cdf13 in master_service_run () from /opt/dovecot/lib/dovecot/libdovecot.so.0 #10 0x0000000000403994 in main () We have mboxes over NFS and we also have an ldap user backend. For now, I do not have a scenario that reproduces the problem. Any idea, or input are highly appreciated. Of course I can provide any information requested (without exposing restricted company or client data) to help trace the problem and lead to the solution. Thanks and keep up the good work! Regards, Kostas Zorbadelos

3 8

[Dovecot] Cannot delete subfolder in public folder
by Karsten Becker 24 Aug '11

24 Aug '11

Hi there, I have the problem that I'm unable to delete a subfolder (again) I created within a public folder. I've already read about configuring Thunderbird to delete immediately - which I did. But it still doesn't work. I delete -> the folder is gone -> I get a TB error message saying "The folder doesn't exist" -> after restarting TB the folders appear again. Maybe someone has a hint. My tip is that I may have a wrong understanding of the ACL mechanism... :-( Regards from Berlin/Germany Karsten ------------------------ Log: > Aug 24 00:01:37 mail01 dovecot: imap(karsten.becker(a)company.eu): Debug: acl vfile: file /etc/dovecot/global-acls//.DEFAULT not found > Aug 24 00:01:37 mail01 dovecot: imap(karsten.becker(a)company.eu): Debug: acl vfile: file /srv/vmail/user-mailboxes/company.eu/karsten.becker/mailboxes/dovecot-acl not found > Aug 24 00:01:37 mail01 dovecot: imap(karsten.becker(a)company.eu): Debug: acl vfile: file /etc/dovecot/global-acls/Folders/test01/aaa not found > Aug 24 00:01:37 mail01 dovecot: imap(karsten.becker(a)company.eu): Debug: acl vfile: reading file /srv/vmail/public_folders/test01/aaa/dovecot-acl Here's the filesystem structure in /srv/vmail: > root@mail01.compdmz.local:/srv/vmail# ls -l public_folders/test01/ > total 20 > drwxr-xr-x 5 vmail vmail 4096 2011-08-23 23:50 aaa > drwxr-xr-x 2 vmail vmail 4096 2011-08-23 21:45 cur > -rw-r--r-- 1 vmail vmail 25 2011-08-23 22:19 dovecot-acl > drwxr-xr-x 2 vmail vmail 4096 2011-08-23 21:45 new > drwxr-xr-x 2 vmail vmail 4096 2011-08-23 21:45 tmp > root@mail01.compdmz.local:/srv/vmail# Here's the content of dovecot-acl (there are another ones in subfolder aaa with the same content, inherited during creation): > authenticated lrwstipekx Here's my configuration of Dovecot: > # 2.0.13: /usr/local/dovecot-2.0.13/etc/dovecot/dovecot.conf > # OS: Linux 2.6.32-33-server x86_64 Ubuntu 10.04.3 LTS ext4 > doveconf: Warning: Dovecot was last started using /etc/dovecot/dovecot.conf, but this config is /usr/local/dovecot-2.0.13/etc/dovecot/dovecot.conf > auth_cache_negative_ttl = 0 > auth_cache_size = 10 M > auth_mechanisms = plain login > base_dir = /usr/local/dovecot/var/run/dovecot > dict { > acl = mysql:/etc/dovecot/dovecot-dict-shared-mailboxes-mysql.conf > expire = mysql:/etc/dovecot/dovecot-dict-expire-mysql.conf > quota = mysql:/etc/dovecot/dovecot-dict-quota-mysql.conf > } > log_timestamp = "%Y-%m-%d %H:%M:%S " > login_greeting = Company Institute > mail_attachment_dir = /srv/vmail/attachments > mail_attachment_hash = %{sha256} > mail_cache_min_mail_count = 2 > mail_debug = yes > mail_location = mdbox:/srv/vmail/user-mailboxes/%d/%n > mail_plugins = acl expire quota > mailbox_idle_check_interval = 1 mins > namespace { > inbox = yes > location = > prefix = > separator = / > subscriptions = yes > type = private > } > namespace { > list = children > location = mdbox:/srv/vmail/user-mailboxes/%%d/%%n > prefix = Users/%%d/%%n/ > separator = / > subscriptions = no > type = shared > } > namespace { > list = children > location = maildir:/srv/vmail/public_folders:INDEX=/srv/vmail/user-mailboxes/%d/%n/public_folders-seen:LAYOUT=fs > prefix = Folders/ > separator = / > subscriptions = no > type = public > } > passdb { > args = /etc/dovecot/dovecot-mysql.conf > driver = sql > } > plugin { > acl = vfile:/etc/dovecot/global-acls:cache_secs=300 > acl_shared_dict = proxy::acl > expire = Trash > expire2 = Trash/* > expire3 = Junk > expire4 = Junk/* > expire_dict = proxy::expire > quota = dict:User quota::proxy::quota > quota_rule = *:storage=10485760 > quota_rule2 = Trash:storage=+1048576 > quota_warning = storage=95%% quota-warning 95 %u > quota_warning2 = storage=80%% quota-warning 80 %u > } > postmaster_address = postmaster(a)company.eu > protocols = imap pop3 > service auth { > unix_listener /var/spool/postfix/private/auth_dovecot { > group = postfix > mode = 0660 > user = postfix > } > unix_listener auth-master { > mode = 0600 > user = vmail > } > user = root > } > service dict { > unix_listener dict { > mode = 0600 > user = vmail > } > } > service imap-login { > inet_listener imaps { > port = 993 > ssl = yes > } > process_min_avail = 2 > } > service imap { > vsz_limit = 512 M > } > service pop3-login { > inet_listener pop3s { > port = 995 > ssl = yes > } > } > service quota-warning { > executable = script /usr/local/bin/quota-warning.sh > user = vmail > } > ssl = required > ssl_cert = </etc/postfix/ssl/mail01.compdmz.local.crt > ssl_key = </etc/postfix/ssl/mail01.compdmz.local.key > userdb { > args = /etc/dovecot/dovecot-mysql.conf > driver = sql > } > verbose_proctitle = yes > protocol lda { > auth_socket_path = auth-master > postmaster_address = postmaster(a)company.eu > } > protocol imap { > imap_client_workarounds = delay-newmail > imap_max_line_length = 128 k > mail_plugins = acl expire quota imap_acl imap_quota > } > protocol pop3 { > pop3_client_workarounds = outlook-no-nuls oe-ns-eoh > }

2 3

[Dovecot] acl with hierarchy separators mismatched config
by YAEGASHI Takeshi 24 Aug '11

24 Aug '11

Hi there, I'm testing dovecot 2.0.13 on Debian squeeze (deb from http://xi.rename-it.nl/debian) with the following doveconf -n. -------- # 2.0.13 (1449a2e2c1f5): /etc/dovecot/dovecot.conf # OS: Linux 2.6.26-2-openvz-amd64 i686 Debian 6.0.2 first_valid_uid = 8 mail_debug = yes mail_location = maildir:~/Maildir mail_plugins = listescape mail_log notify acl namespace { inbox = yes location = prefix = separator = / type = private } namespace { list = children location = maildir:/var/mail/public:INDEX=~/Maildir/public prefix = Public/ separator = / subscriptions = no type = public } passdb { driver = pam } plugin { acl = vfile } protocols = " imap" ssl = no userdb { args = uid=mail gid=mail home=/var/mail/private/%u driver = static } protocol imap { mail_plugins = listescape mail_log notify acl imap_acl } -------- My primary interest is acl and listescape enabled folders in the public namespace. I've chosen "/" as the hierarchy separator to support folder names with dots ("."). /var/mail/public is a maildir with the maildir++ layout where the separator is a dot ("."). So I set up intial acls and folders as follows: -------- # mkdir /var/mail/public # echo 'anyone lra' >/var/mail/public/dovecot-acl # maildirmake.dovecot /var/mail/public/.aaa # echo 'anyone lrwstipekxa' >/var/mail/public/.aaa/dovecot-acl # chown -R mail.mail /var/mail/public -------- But my attempt to create a mailbox under Public/aaa fails with "Permission denied". -------- # imtest -a yaegashi localhost S: * OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE AUTH=PLAIN] Dovecot ready. C: C01 CAPABILITY S: * CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE AUTH=PLAIN S: C01 OK Pre-login capabilities listed, post-login capabilities have more. Please enter your password: C: A01 AUTHENTICATE PLAIN ?????????????????/ S: * CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE SORT SORT=DISPLAY THREAD=REFERENCES THREAD=REFS MULTIAPPEND UNSELECT CHILDREN NAMESPACE UIDPLUS LIST-EXTENDED I18NLEVEL=1 CONDSTORE QRESYNC ESEARCH ESORT SEARCHRES WITHIN CONTEXT=SEARCH LIST-STATUS ACL RIGHTS=texk S: A01 OK Logged in Authenticated. Security strength factor: 0 . getacl Public * ACL "Public" "anyone" alr . OK Getacl completed. . getacl Public/aaa * ACL "Public/aaa" "anyone" akxeilprwtscd . OK Getacl completed. . create Public/aaa/bbb . NO [NOPERM] Permission denied -------- If the layout of /var/mail/public switched to "fs" where the separator is "/", mailbox creation succeeds as expected. -------- namespace { list = children location = maildir:/var/mail/public:INDEX=~/Maildir/public:LAYOUT=fs prefix = Public/ separator = / subscriptions = no type = public } -------- -------- # maildirmake.dovecot /var/mail/public/aaa # echo 'anyone lrwstipekxa' >/var/mail/public/aaa/dovecot-acl # chown -R mail.mail /var/mail/public # imtest -a yaegashi localhost .... . getacl Public * ACL "Public" "anyone" alr . OK Getacl completed. . getacl Public/aaa * ACL "Public/aaa" "anyone" akxeilprwtscd . OK Getacl completed. . create Public/aaa/bbb . OK Create completed. . getacl Public/aaa/bbb * ACL "Public/aaa/bbb" "anyone" akxeilprwtscd . OK Getacl completed. . create Public/aaa/1.2.3 . OK Create completed. . create Public/aaa/cur . NO Invalid mailbox name: Public/aaa/cur -------- Is this behavior expected? Misconfiguration or dovecot bug? I prefer the maildir++ layout with listescape as it's reserved-folder-name free (eg. cur new tmp). Regards, -- YAEGASHI Takeshi <yaegashi(a)debian.org>

2 2

[Dovecot] LDA and auth-userdb socket permissions
by a.smith＠ukgrid.net 24 Aug '11

24 Aug '11

Hi, just wanted to check this as the wiki seems to have contradictory information. With respect to running the LDA as multiple UIDs the wiki says: [QUOTE]If you're using more than one UID for users, you're going to have problems running dovecot-lda, as most MTAs won't let you run dovecot-lda as root[/QUOTE] But in the example for the config file the text reads: [QUOTE] service auth { unix_listener auth-userdb { mode = 0600 user = vmail # User running dovecot-lda #group = vmail # Or alternatively mode 0660 + dovecot-lda user in this group } } [/QUOTE] So it says you can stick the LDA user just in the (vmail or whatever) group and that is enough. So you aren't restricted to a single UID for access anymore... I tested this and the later did not work, that is if I put my LDA user in the group for the auth-userdb socket with permissions 0660 I got an error back from dovecot saying that the owner was incorrect. So, as it stands I guess the bit about setting group should be removed from the wiki? Secondly, why doesn't this currently work? Why is the owner all important? thanks Andy.

3 13

[Dovecot] dovecot and tcpwrappers
by Kees Lemmens 23 Aug '11

23 Aug '11

Hi, I used dovecot 1.x for quite a while and it worked fine. However, I used it through inetd and used hosts.allow/deny to restrict access to only certain groups of systems. Since yesterday I have dovecot 2.0.13. But in version 2.0.13 it seems that starting using inetd doesn't work anymore : I only get a strange error message if I try to connect using telnet : telnet localhost imap doveconf: Fatal: execvp(imap-login) failed: No such file or directory I tried a lot of things but couldn't get it going over inetd so I decided to start it directly using an init script, also because you say in the wiki this is (now) the preferred method. That indeed works fine, but I realised today that dovecot is now completely ignoring all my hosts.allow/deny settings and so is worldwide accessible ! Is dovecot indeed ignoring hosts.allow/deny ? And if so, how can I have the same amount of protection as I previously had with dovecot 1.x over inetd ? BTW: I tried to post on the mailinglist but it seems I can't access them it the moment, altough I did subscribe and login. Is there anything wrong ? Thanks for your reply ! -- With best regards, Kees Lemmens. ----------------------------------------------------------------------- Delft Institute of Applied Mathematics (DIAM), Faculty Electrical Engineering, Mathematics and Computer Science, Delft University of Technology, Delft, The Netherlands,

3 5