- dovecot - dovecot.org

[Dovecot] /etc/pam.d/dovecot missing? during high load
by Douglas Mortensen 04 Mar '11

04 Mar '11

This morning on our newly built server, the following was logged twice: auth: Error: pam(username,127.0.0.1): pam_authenticate() failed: Authentication failure (/etc/pam.d/dovecot missing?) This also happened to be during a time of 100+ imap-login processes, where we were seeing: master: Warning: service(imap-login): process_limit reached, client connections are being dropped The initial error was correct, in that I had not yet created /etc/pam.d/dovecot. I have since created the file. However, we brought this server into production yesterday & there were no complaints, nor was the error logged besides twice this morning within 3.5 minutes of eachother. In looking at pam documentation, it is my understanding that when a service (dovecot) does not have its own file existing under /etc/pam.d, then pam will instead use the settings from /etc/pam.d/others as defaults. This seems logical to me, and would explain why things have been working fairly well with no errors regarding pam (other than the 2 logged this morning). However, what this does not explain, is why dovecot auth logged about the file missing at all. I can only guess that it was related to logins being dropped due to high load, and was incorrectly logged?? For reference, my current /etc/pam.d/dovecot is: auth required pam_unix.so nullok account required pam_unix.so My current /etc/pam.d/other is: @include common-auth @include common-account @include common-password @include common-session Which results in (confirmed via : grep -v ^# common-auth common-account common-password common-session) auth [success=1 default=ignore] pam_unix.so nullok_secure auth requisite pam_deny.so auth required pam_permit.so account [success=1 new_authtok_reqd=done default=ignore] pam_unix.so account requisite pam_deny.so password [success=1 default=ignore] pam_unix.so obscure sha512 password requisite pam_deny.so password required pam_permit.so session [default=1] pam_permit.so session requisite pam_deny.so session required pam_permit.so session required pam_unix.so So there definitely is quite a difference between the dovecot pam file I created (based on the dovecot2 wiki), and the system default (other). I don't know whether this could have been related, so I figured I'd share. Otherwise, I'm running dovecot 2.0.9 compiled from source. dovecot -n at the time of the pam errors was probably: # 2.0.9: /usr/local/etc/dovecot/dovecot.conf # OS: Linux 2.6.32-5-amd64 x86_64 Debian 6.0 auth_debug = yes auth_mechanisms = plain login disable_plaintext_auth = no log_timestamp = "%Y-%m-%d %H:%M:%S " mail_debug = yes mail_location = maildir:~/ mail_privileged_group = mail passdb { driver = pam } protocols = imap pop3 service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } user = root } ssl_cert = </etc/ssl/certs/jlgray.com.cer ssl_key = </etc/ssl/private/jlgray.com.key userdb { driver = passwd } Thanks, - Doug Mortensen Network Consultant Impala Networks Inc CCNA, MCSA, Security+, A+ Linux+, Network+, Server+ . www.impalanetworks.com P: (505) 327-7300 F: (505) 327-7545

2 2

[Dovecot] logging issues w/ login_max_processes_count on 1.x
by Douglas Mortensen 04 Mar '11

04 Mar '11

Today I found our dovecot 2.x gracefully logged: dovecot: master: Warning: service(imap-login): process_limit reached, client connections are being dropped I am confident that we had the very same problem on our previous dovecot 1.x box. Of course with dovecot 1.x, the same relative setting is login_max_processes_count. I believe that I turned up all dovecot logging & debugging to the max (also checked with the 1.x wiki), but nothing was ever logged relating to this. Does anyone know whether there is a way to get dovecot 1.x to log this type of error? Thanks, - Doug Mortensen Network Consultant Impala Networks Inc CCNA, MCSA, Security+, A+ Linux+, Network+, Server+ . www.impalanetworks.com P: (505) 327-7300 F: (505) 327-7545

2 2

[Dovecot] penalty configuration and proxy servers
by Mark Zealey 04 Mar '11

04 Mar '11

Hi there, I've had a look through the wiki and a quick look through the source for penalty configurations (dovecot 2.0.9) but I've not found anything to do with configuration options for this functionality. I'm basically wanting to disable a particular host/subnet from the penalty setup. In our case we have some webmail servers that do get attacked however most of the traffic is legitimate so I'd rather that the user experience was faster (ie not having a few seconds of delay on login) than that we slowed down attacks from them. On a similar note; is it possible to do the per-ip login limit in the auth level rather than the imap/pop level? I ask this as we've just implemented a proxy setup whereby we have two frontend proxy servers that then dispatch to backend servers specified in the database. So, the backend servers do the actual imap/pop sessions however we now don't see the remote ip addresses so it becomes difficult to limit abusive users. The 'doveadm who'/process listing code also doesn't work on the proxy servers even though dovecot knows who logged in and forwards the connection through to the backend servers. None of these features/suggestions are show-stoppers; dovecot is a great program however they're more suggestions of ways it would be useful for us to improve the software. Thanks, Mark

2 1

[Dovecot] strange problem receiving mails
by deconya 04 Mar '11

04 Mar '11

Hi guys Im viewing how to repair a problem using a postfix platform with openldap and dovecot. This is the problem: -When I create a new user inside openldap with mail account appears correctly inside ldap but when I access first time appears inside /var/spool/dovecot/ the folder of account bad. Not appears the name of uid, appears the name of user mail, for ex: drwx------ 5 exemple Domain Users 4,0K 2011-03-04 13:28 exemple drwx------ 9 exemple Domain Users 4,0K 2011-03-04 13:29 exemple.usermail Log filteered: Mar 4 13:28:21 mailserver deliver(exemple): Loading modules from directory: /usr/lib/dovecot/modules/lda Mar 4 13:28:21 mailserver deliver(exemple): Module loaded: /usr/lib/dovecot/modules/lda/ lib10_quota_plugin.so Mar 4 13:28:21 mailserver dovecot: auth(default): master in: USER^I1^Iunesco^Iservice=deliver Mar 4 13:28:21 mailserver dovecot: auth(default): prefetch( exemple(a)mydomain.com) passdb didn't return userdb entries, trying the next userdb Mar 4 13:28:21 mailserver dovecot: auth(default): passwd( exemple(a)mydomain.com) lookup Mar 4 13:28:21 mailserver dovecot: auth(default): passwd( exemple(a)mydomain.com) unknown user Mar 4 13:28:21 mailserver dovecot: auth(default): ldap(exemple(a)mydomain.com): user search: base=ou=Users, dc=ldap, dc=es scope=subtree filter=(&(objectClass=posixAccount)(|(mail=exemple(a)mydomain.com)(uid= exemple(a)mydomain.com)(uid=exemple))) fields=homeDirectory,uidNumber,gidNumber,mailQuota Mar 4 13:28:21 mailserver deliver(exemple): auth input: home=/home/exemple Mar 4 13:28:21 mailserver deliver(exemple): auth input: uid=10017 Mar 4 13:28:21 mailserver deliver(exemple): auth input: gid=513 Mar 4 13:28:21 mailserver deliver(exemple): Home dir not found: /home/exemple Mar 4 13:28:21 mailserver deliver(exemple): Quota root: name=User quota backend=maildir args= Mar 4 13:28:21 mailserver deliver(exemple): Quota rule: root=User quota mailbox=* bytes=52428800 messages=0 Mar 4 13:28:21 mailserver deliver(exemple): Quota rule: root=User quota mailbox=Trash ignored Mar 4 13:28:21 mailserver deliver(exemple): maildir: data=/var/spool/dovecot/exemple/ Mar 4 13:28:21 mailserver deliver(exemple): maildir++: root=/var/spool/dovecot/exemple, index=, control=, inbox=/var/spool/dovecot/exemple Mar 4 13:28:21 mailserver dovecot: auth(default): ldap(exemple(a)mydomain.com): result: homeDirectory(home)=/home/exemple uidNumber(uid)=10017 gidNumber(gid)=513 Mar 4 13:28:21 mailserver dovecot: auth(default): master out: USER^I1^ Iunesco(a)mydomain.com^Ihome=/home/exemple^Iuid=10017^Igid=513 Mar 4 13:28:21 mailserver deliver(exemple): msgid=<1299241700.26848.1.camel@infolinux>: saved mail to INBOX Mar 4 13:28:21 mailserver postfix/pipe[29996]: 6191E26F95B: to=< exemple(a)mydomain.com>, orig_to=<exemplemail(a)admi.mydomain.com>, relay=dovecot, delay=0.09, delays=0.03/0/0/0.06, dsn=2.0.0, status=sent (delivered via dovecot service) Mar 4 13:28:26 mailserver dovecot: auth-worker(default): pam( exemplemail(a)mydomain.com,10.0.0.4) lookup service=dovecot Mar 4 13:28:26 mailserver dovecot: auth-worker(default): pam( exemplemail(a)mydomain.com,10.0.0.4) #1/1 style=1 msg=Password: Mar 4 13:28:28 mailserver dovecot: auth-worker(default): pam( exemplemail(a)mydomain.com,10.0.0.4) pam_authenticate() failed: Authentication failure (password mismatch?) Mar 4 13:28:28 mailserver dovecot: auth(default): ldap( exemplemail(a)mydomain.com,10.0.0.4) bind search: base=ou=Users, dc=ldap, dc=es filter=(&(objectClass=posixAccount)(|(mail=exemplemail(a)mydomain.com )(uid=exemplemail(a)mydomain.com))) Mar 4 13:28:28 mailserver dovecot: auth(default): auth( exemplemail(a)mydomain.com,10.0.0.4) username changed exemplemail(a)mydomain.com -> exemple Mar 4 13:28:28 mailserver dovecot: auth(default): ldap(exemple,10.0.0.4): result: homeDirectory(userdb_home)=/home/exemple uid(user)=exemple uidNumber(userdb_uid)=10017 gidNumber(userdb_gid)=513 Mar 4 13:28:28 mailserver dovecot: auth(default): client out: OK^I1^Iuser=exemple Mar 4 13:28:28 mailserver dovecot: auth(default): prefetch(exemple,10.0.0.4): success Mar 4 13:28:28 mailserver dovecot: auth(default): master out: USER^I411619^ Iunescochair.lccc(a)mydomain.com^Ihome=/home/exemple^Iuid=10017^Igid=513 Mar 4 13:28:28 mailserver dovecot: imap-login: Login: user=<exemple>, method=PLAIN, rip=10.0.0.4, lip=10.0.0.5 Mar 4 13:28:28 mailserver dovecot: IMAP(exemplemail(a)mydomain.com): Loading modules from directory: /usr/lib/dovecot/modules/imap Mar 4 13:28:28 mailserver dovecot: IMAP(exemplemail(a)mydomain.com): Module loaded: /usr/lib/dovecot/modules/imap/lib10_quota_plugin.so Mar 4 13:28:28 mailserver dovecot: IMAP(exemplemail(a)mydomain.com): Module loaded: /usr/lib/dovecot/modules/imap/lib11_imap_quota_plugin.so Mar 4 13:28:28 mailserver dovecot: IMAP(exemplemail(a)mydomain.com): Effective uid=10017, gid=513, home=/home/exemple Mar 4 13:28:28 mailserver dovecot: IMAP(exemplemail(a)mydomain.com): Quota root: name=User quota backend=maildir args= Mar 4 13:28:28 mailserver dovecot: IMAP(exemplemail(a)mydomain.com): Quota rule: root=User quota mailbox=* bytes=52428800 messages=0 Mar 4 13:28:28 mailserver dovecot: IMAP(exemplemail(a)mydomain.com): Quota rule: root=User quota mailbox=Trash ignored Mar 4 13:28:28 mailserver dovecot: IMAP(exemplemail(a)mydomain.com): maildir: data=/var/spool/dovecot/exemplemail/ Mar 4 13:28:28 mailserver dovecot: IMAP(exemplemail(a)mydomain.com): maildir++: root=/var/spool/dovecot/exemplemail, index=, control=, inbox=/var/spool/dovecot/exemplemail Mar 4 13:28:28 mailserver dovecot: IMAP(exemplemail(a)mydomain.com): Disconnected: Logged out bytes=45/375 Any idea? Thanks and Best Regards

1 0

[Dovecot] unsubscribe
by Rob Coward 04 Mar '11

04 Mar '11

Please consider the environment before printing this email. Game Stores Group Limited, registered number 1937170, registered in England

2 1

[Dovecot] Dovecot and ManageSieve crash trace
by Samuel Hassine 04 Mar '11

04 Mar '11

Hi all, I am trying to deploy Dovecot with Sieve support and I choose the easy way: install ManageSieve. But I have a problem here, and I did not find how to deal with. I tested the communication to the server with the telnet command. Here the result: http://pastebin.com/dgvhEwxJ And I do not understand how to link IMAP authentification and Sieve authentification. I just want to allow creation of Sieve filters for any IMAP user (based on LDAP). Thanks for your answer. Best regards. Samuel Hassine

2 1

[Dovecot] sieve issue
by Informatik.hu 04 Mar '11

04 Mar '11

Hi All! I have got some problem with dovecot sieve. (from Debian Squeeze packages). I have already installed dovecot and postfix with mysql(postfix admin) virtual domains and users, configured dovecot deliver for delivery method in postfix. Dovecot sieve IS working, reads the global script, BUT it DOES NOT reads the user scripts from the users virtual home directory. If i place ".dovecot.sieve" in /home/vmail, and configure sieve for this location, it reads the script. If i put the file under /home/vmail/domain.com (/home/vmail/%d) or /home/vmail/domain.com/user(a)domain.com (/home/vmail/%d/%u) the sieve plugin does not read(compile) the script. Deliver log contains that the incoming mail (which has to be filtered) saved to INBOX, and there is no error in the deliver error log, nor dovecot logs. Can anybody help me out what am i doing wrong? Vuki

2 1

[Dovecot] Problem with sieve and namespace
by Patrick Westenberg 03 Mar '11

03 Mar '11

Hi guys, my default sieve script fails due to an unknown mailspace even I told him to use one. What's wrong? Patrick Feb 26 00:39:25 endeavour dovecot: lmtp(6967, mail(a)jasbafliesen.de) Error: 1WYlBCE1aE03GwAA0CSSVw: sieve: msgid=<4D683DA5.7030505(a)gmx.de>: failed to store into mailbox mail(a)jasbafliesen.de': Unknown namespace Feb 26 00:39:25 endeavour dovecot: lmtp(6967, mail(a)jasbafliesen.de) Error: 1WYlBCE1aE03GwAA0CSSVw: sieve: script /usr/local/etc/dovecot/sieve/default.sieve failed with unsuccessful implicit keep This is what my sieve script looks like: require ["fileinto", "mailbox"]; if header :contains "X-Spam-Flag" "YES" { fileinto :create "INBOX.Spam"; } # 2.0.6: /usr/local/etc/dovecot/dovecot.conf # OS: Linux 2.6.26-2-amd64 x86_64 Debian 5.0.8 auth_debug = yes auth_debug_passwords = yes auth_verbose = yes disable_plaintext_auth = no mail_debug = yes mail_gid = vmail mail_location = mdbox:~/mdbox mail_plugins = quota mail_uid = vmail managesieve_notify_capability = mailto managesieve_sieve_capability = comparator-i;octet comparator-i;ascii-casemap fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date namespace { inbox = yes location = prefix = INBOX. separator = . type = private } passdb { args = /usr/local/etc/dovecot/dovecot-sql.conf.ext driver = sql } plugin { quota = dict:User quota::file:%h/mdbox/dovecot-quota quota_warning = storage=90%% quota-warning 90 %u quota_warning2 = storage=75%% quota-warning 75 %u sieve = ~/.dovecot.sieve sieve_global_path = /usr/local/etc/dovecot/sieve/default.sieve } protocols = lmtp service auth { unix_listener /var/spool/postfix/private/auth { mode = 0666 } } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0660 user = postfix } } service quota-warning { executable = script /usr/local/etc/dovecot/quota-warning.sh unix_listener quota-warning { user = vmail } user = vmail } ssl = no userdb { args = /usr/local/etc/dovecot/dovecot-sql.conf.ext driver = sql } protocol lmtp { mail_plugins = quota sieve } protocol lda { mail_plugins = quota sieve } protocol imap { mail_plugins = quota imap_quota }

3 4

[Dovecot] process_min_avail being ignored?
by Douglas Mortensen 03 Mar '11

03 Mar '11

Today I found out we are having users w/ problems because: Mar 3 09:57:33 jlgray dovecot: master: Warning: service(imap-login): process_limit reached, client connections are being dropped Mar 3 09:58:42 jlgray dovecot: master: Warning: service(imap-login): process_limit reached, client connections are being dropped Mar 3 10:02:51 jlgray dovecot: master: Warning: service(imap-login): process_limit reached, client connections are being dropped Mar 3 10:04:29 jlgray dovecot: master: Warning: service(imap-login): process_limit reached, client connections are being dropped Mar 3 10:05:41 jlgray dovecot: master: Warning: service(imap-login): process_limit reached, client connections are being dropped Mar 3 10:06:58 jlgray dovecot: master: Warning: service(imap-login): process_limit reached, client connections are being dropped So, based on the dovecot2 wiki, it would seem that the solution is to follow the recommendations at http://wiki2.dovecot.org/LoginProcess, and use them as a guide for our situation. I have done so. But unless I misunderstand their purpose, I don't think they're working. Maybe I don't have them in the correct place?? I am expecting the imap-login process count to immediately jump up to 200 (based on my config below). But instead, they just slowly gradually increase. But even an hour after changing the config & restarting dovecot, I only have 78 login processes. dovecot -n output is: # 2.0.9: /usr/local/etc/dovecot/dovecot.conf # OS: Linux 2.6.32-5-amd64 x86_64 Debian 6.0 auth_debug = yes auth_mechanisms = plain login disable_plaintext_auth = no log_timestamp = "%Y-%m-%d %H:%M:%S " mail_debug = yes mail_location = maildir:~/ mail_privileged_group = mail passdb { driver = pam } protocols = imap pop3 service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } user = root } ssl_cert = </etc/ssl/certs/jlgray.com.cer ssl_key = </etc/ssl/private/jlgray.com.key userdb { driver = passwd } This configuration was updated from a dovecot 1.x config, by following the instructions at: http://wiki2.dovecot.org/Upgrading/2.0 Namely: doveconf -n -c dovecot-1.conf > dovecot-2.conf Then we renamed dovecot-2.conf to dovecot.conf I'm pretty sure there were no problems with that part. We are running dovecot 2.0.9 compiled from source. OS is 64-bit Debian Squeeze (6.0), as shown by 'cat /proc/version': Linux version 2.6.32-5-amd64 (Debian 2.6.32-30) (ben(a)decadent.org.uk) (gcc version 4.3.5 (Debian 4.3.5-4) ) #1 SMP Wed Jan 12 03:40:32 UTC 2011 I really appreciate anyone helping me figure out why Thanks, - Doug Mortensen Network Consultant Impala Networks Inc CCNA, MCSA, Security+, A+ Linux+, Network+, Server+ . www.impalanetworks.com P: (505) 327-7300 F: (505) 327-7545

1 1

[Dovecot] TB, dovecot & trailing slash - again
by Bruno Tréguier 03 Mar '11

03 Mar '11

Hi there, I have been browsing the mailing list archives in search of a solution to my problem, related to the quite infamous "trailing slash" issue with Thunderbird, but I don't seem to have found any closely related discussion. Please forgive me if this problem has already found a solution. Here I go; We use a lot of TB clients (2.x and 3.x), and we are using Dovecot 1.2.4 on our production server (mbox format). As told in many places, including this list, I added the option "tb-extra-mailbox-sep" in my dovecot.conf file. The checkbox regarding the mix of mailbox/submailbox and mailbox/messages is unchecked in the advanced options of our TB standard config. I snooped the connection with "ngrep" when creating a folder meant for containing subfolders. Here is the trace: > 6 create "ABCDE/".. < 6 OK Create completed... > 7 subscribe "ABCDE/".. < 7 OK Subscribe completed... > 8 list "" "ABCDE/".. < * LIST (\Noselect \HasChildren) "/" "ABCDE/"..8 OK List completed... So far, so good. But when you have a look at the .subscriptions file, you can see that the ABCDE folder has no trailing slash: it has been stripped off, apparently due to an "enhancement" made in 2009: http://hg.dovecot.org/dovecot-1.2/rev/339be408f49a It may be intended, but the drawback is that TB then gets a bit confused, as it has no way, during a "LIST" operation, to distinguish between a "folder/subfolder" scheme and a "folder/message" scheme: consequently, you get an error message from TB whenever you click on the containing folder, stating that "the mailbox isn't selectable". The problem is not just cosmetic, though, as the subfolders of such folders are not synchronized when selected for offline reading. I made a test with another version of Dovecot, of the 1.1 branch, and it behaves a little bit differently: the trailing slash is kept in the .subscriptions file, and everything is ok. TB is able to make the distinction between both kinds of folders. For the moment, I simply erased the "tb-extra-mailbox-sep" from my config file, and this is what happens: > 306 create "ABCDE/".. < 306 OK Create completed... > 307 subscribe "ABCDE/".. < 307 NO Invalid mailbox name: ABCDE/.. > 308 list "" "ABCDE/".. < * LIST (\Noselect \HasChildren) "/" "ABCDE/"..308 OK List completed... In that case, the "subscribe" command fails, so the folder does not appear by itself in the .subscriptions file, but as it is not used (only "terminal" mailboxes, containing messages, which are files in the filesystem), this is not a problem. The directory is created on the disk, and you can then create subfolders without any problem... Sorry for this long message, I just wanted to explain precisely what happens. A last word: switching to maildir would be quite a hassle, as we use quite a lot of procmail-based tools. Rewriting everything using Sieve is not planned for the moment. Does anyone out there have a solution for this ? What am I doing wrong ? Is the "tb-extra-mailbox-sep" really necessary when using TB ? As far as I can tell, it rather got us into trouble here, than solved anything... Thanks for any info/pointer/else ! Best regards, Bruno -- - Service Hydrographique et Oceanographique de la Marine - DO/MGS/INF - 13, rue du Chatellier - CS 92803 - 29228 Brest Cedex 2, FRANCE - Phone: +33 2 98 22 17 49 - Email: Bruno.Treguier(a)shom.fr

1 0