- dovecot - dovecot.org

[Dovecot] SSL comunication problems with client side.
by Denis Iskandarov 14 Jun '11

14 Jun '11

I can get messages without SSL with no problems. but i need to setup server accept only SSL secured connections. I think my configuration is very proper, but cant find "obvious" problem. Postfix 2.3.3 + dovecot 2.0.13-1_129.el5 + PostfixAdmin 2.3.3 I made own CA. configured postfix and dovecot with same cert key ca. Same public cert i gave for client just converted it to PKCS#12. I cant undestand valid and invalid certs strings in long, they look same. You can check logs and config bellow. Also some other questions regarding SSL: 1. How to make client MUA (thunderbird) automatically retrieve certificate ? My thunderbird cant do it by itself so i'm importing mail cert by myself. 2. If i want to setup Roundcube/Squirrelmail webmail clients with TLS support (https) i have to provide them with same certificates as dovecot and postfix have. Or in this case i can use whatever certificate dedicated for with "virtualhost"? dovecot-deliver.log: Jun 13 13:26:42 imap-login: Info: Invalid certificate: unable to get certificate CRL: /C=GE/ST=Tbilisi/O=Caucasus Digital Network/OU=Mail Server/CN=mx.office.dev/emailAddress=hostmaster(a)office.dev Jun 13 13:26:42 imap-login: Info: Invalid certificate: unable to get certificate CRL: /C=GE/ST=Tbilisi/L=Tbilisi/O=Caucasus Digital Network/OU=Caucasus Digital Network/CN=Caucasus Digital Network/emailAddress=hostmaster(a)office.dev Jun 13 13:26:42 imap-login: Info: Valid certificate: /C=GE/ST=Tbilisi/L=Tbilisi/O=Caucasus Digital Network/OU=Caucasus Digital Network/CN=Caucasus Digital Network/emailAddress=hostmaster(a)office.dev Jun 13 13:26:42 imap-login: Info: Valid certificate: /C=GE/ST=Tbilisi/O=Caucasus Digital Network/OU=Mail Server/CN=mx.office.dev/emailAddress=hostmaster(a)office.dev Jun 13 13:26:42 auth: Info: PLAIN(?,192.168.0.11): Client didn't present valid SSL certificate Jun 13 13:26:42 auth: Info: LOGIN(?,192.168.0.11): Client didn't present valid SSL certificate Jun 13 13:26:42 auth: Info: PLAIN(?,192.168.0.11): Client didn't present valid SSL certificate Jun 13 13:26:42 imap-login: Info: Disconnected (client sent an invalid cert): method=PLAIN, rip=192.168.0.11, lip=192.168.0.31, TLS maillog. Jun 13 13:26:42 cent56dev dovecot: imap-login: Warning: SSL: where=0x10, ret=1: before/accept initialization [192.168.0.11] Jun 13 13:26:42 cent56dev dovecot: imap-login: Warning: SSL: where=0x2001, ret=1: before/accept initialization [192.168.0.11] Jun 13 13:26:42 cent56dev dovecot: imap-login: Warning: SSL: where=0x2001, ret=1: SSLv3 read client hello A [192.168.0.11] Jun 13 13:26:42 cent56dev dovecot: imap-login: Warning: SSL: where=0x2001, ret=1: SSLv3 write server hello A [192.168.0.11] Jun 13 13:26:42 cent56dev dovecot: imap-login: Warning: SSL: where=0x2001, ret=1: SSLv3 write certificate A [192.168.0.11] Jun 13 13:26:42 cent56dev dovecot: imap-login: Warning: SSL: where=0x2001, ret=1: SSLv3 write certificate request A [192.168.0.11] Jun 13 13:26:42 cent56dev dovecot: imap-login: Warning: SSL: where=0x2001, ret=1: SSLv3 flush data [192.168.0.11] Jun 13 13:26:42 cent56dev dovecot: imap-login: Warning: SSL: where=0x2002, ret=-1: SSLv3 read client certificate A [192.168.0.11] Jun 13 13:26:42 cent56dev dovecot: imap-login: Warning: SSL: where=0x2002, ret=-1: SSLv3 read client certificate A [192.168.0.11] Jun 13 13:26:42 cent56dev dovecot: imap-login: Warning: SSL: where=0x2001, ret=1: SSLv3 read client certificate A [192.168.0.11] Jun 13 13:26:42 cent56dev dovecot: imap-login: Warning: SSL: where=0x2001, ret=1: SSLv3 read client key exchange A [192.168.0.11] Jun 13 13:26:42 cent56dev dovecot: imap-login: Warning: SSL: where=0x2001, ret=1: SSLv3 read certificate verify A [192.168.0.11] Jun 13 13:26:42 cent56dev dovecot: imap-login: Warning: SSL: where=0x2001, ret=1: SSLv3 read finished A [192.168.0.11] Jun 13 13:26:42 cent56dev dovecot: imap-login: Warning: SSL: where=0x2001, ret=1: SSLv3 write change cipher spec A [192.168.0.11] Jun 13 13:26:42 cent56dev dovecot: imap-login: Warning: SSL: where=0x2001, ret=1: SSLv3 write finished A [192.168.0.11] Jun 13 13:26:42 cent56dev dovecot: imap-login: Warning: SSL: where=0x2001, ret=1: SSLv3 flush data [192.168.0.11] Jun 13 13:26:42 cent56dev dovecot: imap-login: Warning: SSL: where=0x20, ret=1: SSL negotiation finished successfully [192.168.0.11] Jun 13 13:26:42 cent56dev dovecot: imap-login: Warning: SSL: where=0x2002, ret=1: SSL negotiation finished successfully [192.168.0.11] Jun 13 13:26:42 cent56dev dovecot: imap-login: Warning: SSL alert: where=0x4004, ret=256: warning close notify [192.168.0.11] Jun 13 13:26:42 cent56dev dovecot: imap-login: Warning: SSL alert: where=0x4008, ret=256: warning close notify [192.168.0.11] # doveconf -n # 2.0.13: /etc/dovecot/dovecot.conf # OS: Linux 2.6.18-238.9.1.el5 i686 CentOS release 5.6 (Final) ext3 auth_mechanisms = plain login auth_socket_path = /var/run/dovecot/auth-userdb auth_ssl_require_client_cert = yes auth_verbose = yes base_dir = /var/run/dovecot/ debug_log_path = /var/log/dovecot-deliver.log dict { expire = sqlite:/etc/dovecot/dovecot-dict-sql.conf.ext quota = mysql:/etc/dovecot/dovecot-dict-sql.conf.ext } first_valid_gid = 12 first_valid_uid = 1001 hostname = mx.office.dev info_log_path = /var/log/dovecot-deliver.log last_valid_gid = 12 last_valid_uid = 1001 listen = * mail_debug = yes mail_gid = 12 mail_location = maildir:/home/vmail/%d/%u mail_plugins = quota mail_privileged_group = mail mail_uid = 1001 managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date mbox_write_locks = fcntl passdb { args = /etc/dovecot/conf.d/sql/sql.conf driver = sql } plugin { autocreate = Trash autocreate2 = Spam autosubscribe = Trash autosubscribe2 = Spam } postmaster_address = postmaster(a)office.dev service auth { unix_listener /var/spool/postfix/private/auth { group = mail mode = 0660 user = postfix } unix_listener auth-userdb { group = mail mode = 0660 user = vmail } } service imap-login { inet_listener imap { port = 143 } inet_listener imaps { port = 993 ssl = yes } } service pop3-login { inet_listener pop3 { port = 110 } inet_listener pop3s { port = 995 ssl = yes } } ssl_ca = </etc/pki/CA/cacert.pem ssl_cert = </etc/pki/CA/mail/mx.office.dev.crt ssl_key = </etc/pki/CA/mail/mx.office.dev.key ssl_verify_client_cert = yes userdb { args = /etc/dovecot/conf.d/sql/sql.conf driver = sql } verbose_ssl = yes protocol lda { mail_plugins = quota autocreate } protocol imap { imap_client_workarounds = delay-newmail mail_plugins = quota imap_quota autocreate } protocol pop3 { mail_plugins = quota pop3_client_workarounds = outlook-no-nuls oe-ns-eoh }

2 4

[Dovecot] Sieve question
by Dhaval Patel 14 Jun '11

14 Jun '11

I have successfully setup Postfix -> Dovecot with virtual users and spam filtering with spamassassin. Now the last remaining part is for the user defined rules. Let me describe my environment and what I am trying to achieve. I have Postfix setup to call spamc and deliver to Dovecot according to the master.cf line below. -------------------------------------------------------------- dovecot unix - n n - - pipe flags=DRhu user=vmail:vmail argv=/usr/bin/spamc -u vmail -e /usr/lib/dovecot/deliver -d ${recipient} -------------------------------------------------------------- The emails get checked by Spamassassin and are delivered to the users's mailbox (/home/vmail/username). I use an actual username (dhav) and not email address (dhaval(a)example.com) Things are working fine with that. >From reading http://wiki.dovecot.org/LDA/Sieve I see that Sieve can do global and user specified filtering. So I am planning to put the following rule into the global script so spammy emails go to the user's INBOX.spam folder. -------------------------------------------------------------- require "fileinto"; if header :contains "X-Spam-Flag" "YES" { fileinto "spam"; } -------------------------------------------------------------- My first question is, where is this global script? Do I configure the "sieve_global_dir = /etc/dovecot/sieve/"? What about he filename? Most users will not need any additional rules. There are some users that do and I am having a difficult time figuring out how it would be setup. My second question is the following. Is there a way in the global script to check if there is a file called /etc/dovecot/sieve/username or /home/vmail/username/personal_sieve_script and include it? I was using maildrop before this and procmail before that so I apologies for sounding stupid if this is not how Sieve scripts work. I am by no means tied the methods I describe above. If anyone knows of a better way to achieve what I am trying to do, I would appreciate if you let me know of it. Thanks, Dhaval

2 1

[Dovecot] Version differences, trash, upgrade
by José Antonio Suarez Pinzón 14 Jun '11

14 Jun '11

Hello everybody, I have some basic questions: 1. how can I configure the auto-empty trash plugin for all users after 3 or 4 days (This is very important, regular users do not clean their trash, or are using blackberry and do not have an option to do it or simply, do not care about it) 2. difference between version 1.2.17 and latest 2 version of Dovecot, have the version 2 an automatic option for the trash thing? 3. me as a basic skilled user, how can I made the upgrade to version 2 without major risks, I mean I do not want to leave everybody on my server without mail. I am a novice in all of this stuff, so please excuse me if I am making dumb questions. Thanks in advance for your help. Information about my installation. # 1.2.17: /etc/dovecot.conf # OS: Linux 2.6.18-164.11.1.el5 x86_64 CentOS release 5.6 (Final) protocols: imap imaps pop3 pop3s plugin: quota: maildir quota_rule: Trash:ignore Kind Regards, José Antonio Suárez Pinzón Auge CS (+57 1) 812 7629 (+57) 300 618 0017

1 0

[Dovecot] Admin access to shared mailboxes
by Daniel Miller 13 Jun '11

13 Jun '11

Having enabled shared mailboxes - is there a way to provide access to all users' mailboxes by a given user? Instead of having to manually provide ACL rights to every mailbox of every user? -- Daniel

4 3

[Dovecot] Webmail project : to cache or not to cache emails
by Vincent Richomme 13 Jun '11

13 Jun '11

Hi, I plan to develop a new web service where one of its module is a webmail and I am thinking about some implementation details. From a interface point of view I wanted to adopt the same logic a outlook(desktop) or yahoo webmail and not split emails into pages. I mean I just want a single datatable view where user can scroll to see his old messages and data are updated only when user release the vertical scrollbar. When I look at current webmail (roundcube for instance) I can see that a cache is used to stored emails headers and I was wondering if it was really necessary ? Once a user has passed the login process I would like to retrieve only the emails that will be displayed (actually a bit more, I am thinking of 150) but I am wondering if it's a good idea to not use a cache for headers. For instance if I have thousands of users on the same machine, will it support it ? Will it be fast enough ? Of course I will try by myself the different options but would be curious to have some opinions. Thanks

3 2

[Dovecot] Explain about (mail_get_first_header(mail, "From", &header)
by Alex Baule 13 Jun '11

13 Jun '11

Hi Timo... Inside my plugin, i use the (mail_get_first_header(mail, "From", &header) function, to get the email From to put in some Blacklist. Looking in the header under this mail, we have 2 "From" fields. Using the function above, i get the Second "From", but my MTA (exim) look in to The First From, in the First Line, in that way, my blacklist don't work, because the sender to be blocked is different from the From looked by dovecot. There is a way to get the "From" from First line ? ############################## HEADER ######################################################## >From dma_3783(a)envios.socomdescontos.com.br Tue Jun 07 15:43:04 2011 Return-path: <dma_3783(a)envios.socomdescontos.com.br> Envelope-to: sugestao(a)brc.com.br Delivery-date: Tue, 07 Jun 2011 15:43:04 -0300 Received: from [187.61.43.119] (helo=vt-0007-119.virtualtarget.com.br) by mail.brc.com.br with esmtp (Exim 4.76) (envelope-from <dma_3783(a)envios.socomdescontos.com.br>) id 1QU1Ex-0006II-5o for sugestao(a)brc.com.br; Tue, 07 Jun 2011 15:43:01 -0300 DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; s=k1; d=dkim.vttrack.com.br; h=From:To:Subject:MIME-Version:Content-Type:Reply-To:List-Unsubscribe:Message-ID:Date; bh=Q5G3TQPrYgogLS7aDg1DLYJpLKI=; b=XC+MHH79L6VHTI2OayuFHZGeSRAvNstNz8sHEp+xE5i71GznnYfCVsw7fuq2dIST6bTYY7tto/Rd aIZjc2YfEyqgUi0KKKesnMLSI61Ij/FlmE5ftRgIy9Ra59O9R03S62wAt6WPjkx1f4xCZ9ZAIaox GU957biBsg3B6ryU5Ks= Received: by vt-0007-119.virtualtarget.com.br id htpoj60sh70i for <sugestao(a)brc.com.br>; Tue, 7 Jun 2011 15:42:59 -0300 (envelope-from <dma_3783(a)envios.socomdescontos.com.br>) From: "CompraFacil.com.br" <mkt(a)socomdescontos.com.br> To: "sugestao" <sugestao(a)brc.com.br> Subject: SUPER OFERTA: TV LCD 32” Full HD apenas 10x 129,99 reais com FRETE ZERO. Aproveite. MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="b928815d46126f887c344b7d725aceb1" Reply-To: "CompraFacil.com.br" <res(a)socomdescontos.com.br> List-Unsubscribe: <http://relacionamento.socomdescontos.com.br/index.dma/DmaOptOut?3783,3351,2…> X-DMA: 8448122 X-UID: 8448122-74473 X-CID: 3783 X-TYP: MAIL Message-ID: <0.0.1E.8DF.1CC2542B91E3284.8E34(a)vt-0007-119.virtualtarget.com.br> Date: Tue, 7 Jun 2011 15:42:59 -0300 ############################## HEADER ########################################################

2 2

[Dovecot] Dovecot + qmail-ldap
by Aydın Demirel 13 Jun '11

13 Jun '11

Hi; I installed latest dovecot version (2.0.13) and qmail pathed with qmail-ldap on our systems. We want to use auth_dovecot binary authentication for dovecot. My dovecot config is following: auth_debug = yes auth_debug_passwords = yes auth_verbose = yes base_dir = /var/run/dovecot disable_plaintext_auth = no first_valid_gid = 100 first_valid_uid = 100 last_valid_gid = 65000 last_valid_uid = 65000 listen = * mail_debug = yes mail_location = maildir:~/Maildir mmap_disable = yes protocols = imap pop3 service auth { executable = /opt/surmail/smtp/bin/auth_dovecot ./Maildir unix_listener auth-userdb { group = qmail user = root } } service imap-login { inet_listener imap { port = 143 } } service pop3-login { inet_listener pop3 { port = 110 } } ssl = no verbose_proctitle = yes But, unfortunately I can not connect port 110 via telnet and i'm getting following error: Jun 13 17:11:43 sms dovecot: master: Error: service(auth): child 31580 returned error 111 Jun 13 17:11:43 sms dovecot: master: Error: service(auth): command startup failed, throttling What can be the problem? Regards.. -------------------------------- *Aydin Demirel Endersys Ltd. Sistem Destek Muhendisi / System Support Engineer * Phone : +90 216-4709423 Fax : +90 216-4709508 | Web : http://www.endersys.com.tr <http://www.endersys.com.tr/> Blog : http://blog.endersys.com <http://blog.endersys.com/> Twitter : http://www.twitter.com/endersys LPI : The #1 Linux Certification for IT Professionals LPI (Linux Professional Institute) Turkey http://www.lpi-turkey.com <http://www.lpi-turkey.com/> Endersys is the first Advanced Business partner of Red Hat in Turkey ! http://www.europe.redhat.com/partners/endersys/

1 0

[Dovecot] Dovecot 2.0+LMTP: Legal MAIL FROM rejected?
by Bernhard Schmidt 13 Jun '11

13 Jun '11

Hi, I run Dovecot 2.0.13 fed by Postfix over LMTP. Today it rejected one mail Postfix and Amavis accepted, generating a bounce. It was just a spammail, but I think the sender address is legal according to RFC5321 and should be accepted. I don't like generating bounces, email should be either rejected by postfix/pre-queue-amavis or delivered. Jun 6 12:32:47 mail postfix/qmgr[840]: 991FC240DB: from=<admin <admin(a)kl38000.com>, size=8427, nrcpt=1 (queue active) Jun 6 12:32:47 mail amavis[27046]: (27046-06) FWD via SMTP: <"admin <admin"@kl38000.com> -> <user(a)domain.com>,BODY=7BIT 250 2.0.0 Ok, id=27046-06, from MTA([127.0.0.1]:10025): 250 2.0.0 Ok: queued as 991FC240DB Jun 6 12:32:47 mail postfix/lmtp[4710]: 991FC240DB: to=<user(a)vmail.domain.com>, orig_to=<user(a)domain.com>, relay=pop3.domain.com[::1]:24, delay=0.24, delays=0.09/0.11/0.03/0.01, dsn=5.5.4, status=bounced (host pop3.domain.com[::1] said: 501 5.5.4 Invalid parameters (in reply to MAIL FROM command)) It looks like dovecot/lmtp does not accept an address with quoted localpart that contains a space mail from:<"admin admin"@kl38000.com> 501 5.5.4 Invalid parameters mail from:<"adminadmin"@kl38000.com> 250 2.1.0 OK mail from:<"admin<admin"@kl38000.com> 250 2.1.0 OK Bernhard

2 1

Re: [Dovecot] Using Dovecot new version 2.0.13 facing issues.
by गौरव जोशी 13 Jun '11

13 Jun '11

> Hi, > > I have configured POP-IMAP server with dovecot 2.0.13 with mysql support. > When I am running load test on the same I face issue on IMAP connections. I > get "dovecot: imap-login: Error: fd_send(imap, 15) failed: Interrupted > system call" followed by "dovecot: imap-login: Internal login failure" in > log files. See if these patches help: http://hg.dovecot.org/dovecot-2.0/rev/86e4023d08e4 http://hg.dovecot.org/dovecot-2.0/rev/6fdee880c5dc Hi Timo, Thanks for the response. The first patch is not getting compiled, where the other one got complied cleanly. Please help on this. Have a nice time, Gourav Joshi Have a look at www.linuxquestions.in

2 1

[Dovecot] Regarding Digest-MD5 auth
by kenja heramba 13 Jun '11

13 Jun '11

Hi, I am writing a Pop3Client. I use dovecot server as POP3 server in linux and hMailServer in windows. I was just testing digest-md5 auth with dovecot server. I had an observation. After server side verification, server sends a verification code to client. If this fails, how can client send the negative response or does it not exist? When I see packet capture, dovecot server sends +OK Logged in for anything client sends. I may be wrong. Please let me know your thoughts Regards, Heramba

2 1