- dovecot - dovecot.org

[Dovecot] "doveadm auth user" requiring a tty
by Axel Luttgens 30 Nov '10

30 Nov '10

Hello, "doveadm auth user password" may be scripted without a glitch. But this comes with the usual problem of a "ps" command showing the password, which may be especially annoying in case of a single-letter typo: the almost correct password is then visible for about two seconds... Clearing the password argument (zeroing it) in doveadm-auth.c, in the hope to reduce the window during which the password may be catched, didn't prove successful. "doveadm auth user" could be an alternative, but it imperatively requires a tty, which may not always easily nor efficiently be available in a scripting environment. I thus ended with this very quick and dirty hack (I guess this should be named that way): --- askpass.original.c 2010-05-31 18:36:52.000000000 +0200 +++ askpass.c 2010-11-27 19:12:03.000000000 +0100 @@ -16,8 +16,24 @@ char ch; int fd; + // A very crude attempt... this supposes that STDIN not being a tty + // may never happen outside of "doveadm auth", and that STDIN will + // always be clean. + //if (!isatty(STDIN_FILENO)) + // i_fatal("stdin isn't a TTY"); if (!isatty(STDIN_FILENO)) - i_fatal("stdin isn't a TTY"); + { + pos = 0; + while (read(STDIN_FILENO, &ch, 1) > 0) { + if (pos >= buf_size-1) + break; + if (ch == '\n' || ch == '\r') + break; + buf[pos++] = ch; + } + buf[pos] = '\0'; + return; + } fputs(prompt, stderr); fflush(stderr); but this for sure must overlook a lot of things. What would be the best way to achieve a scriptable "doveadm auth", say through php's proc_open(), without possibly compromise passwords? TIA, Axel

2 2

[Dovecot] Plan: ACL changes
by Timo Sirainen 30 Nov '10

30 Nov '10

Global ACLs are intended to apply to a few mailboxes for all users. For example you could have a master user called "spam" that would have access to each user's "spam" mailbox, but nothing else. Global ACLs are kind of ugly. A mailbox's ACL is found from exactly the same name as what the mailbox's virtual name is. So for example if you have namespace { separator = / prefix = foo/ } And you have a mailbox called foo/bar, the global ACL is looked up from the <global dir>/foo/bar. The problem there of course is what if you want to set global ACLs for "foo". You can't have both directory and a file called "foo". So if this happens, Dovecot instead looks up the ACLs from <global dir>/foo/.DEFAULT file. The name for this file is slightly confusing, and also of course if there really is a mailbox called ".DEFAULT" it won't really work well. Global acl is currently configured by giving its path to acl setting, such as: plugin { acl = vfile:/etc/dovecot/global-acls } So plan #1: deprecate this usage. If global-acls is a directory, keep using the old method. But the new preferred method would be for it to be a file that contains all of the global ACLs. Typically there should be very few entries, so this should also be more efficient. Also this would allow setting default ACLs for namespaces by using wildcards. For example you could have: * masteruser +lrw spam spamuser +lr test/* testuser +lr etc. The * would match only within a single namespace, so if you had more than one, the * entry would match only the one having prefix="". The * entry would be especially helpful for master users who you intend to have access to user's all mailboxes. Currently there is no good way to implement this. Plan #2: Add support for per-user default namespace ACLs. In the mail root directory if "dovecot-default-acl" file exists, it's used as the default ACLs. I'm not entirely sure what should happen if it conflicts with the global ACLs. Probably they both should be simply merged, since both can only be created by an admin. Probably the per-user ACL should be allowed to override the global ACLs. Any thoughts? Since neither of these would break backwards compatibility, I could add them to v2.0.x.

4 9

[Dovecot] 2.0.7 (0757f4f5b882): LMTP Server refuses queued mail
by Thomas Leuxner 30 Nov '10

30 Nov '10

Hi, not sure what is wrong with the mail, but the Dovecot LMTP won't accept it. This is actually the first ever occurrence, so I'm attaching the evidence for further diagnosis: […] Nov 26 18:01:49 spectre dkim-filter[1723]: A7BEA4086: no signature data Nov 26 18:01:49 spectre postfix/qmgr[6175]: A7BEA4086: from=<bounce-1841919-268661(a)news.juno.co.uk>, size=131577, nrcpt=1 (queue active) […] Nov 26 18:01:49 spectre postfix/lmtp[27788]: 19FB54088: to=<tlx(a)leuxner.net>, relay=spectre.leuxner.net[private/dovecot-lmtp], delay=0.27, delays=0.25/0/0/0.01, dsn=4.3.0, status=deferred (host spectre.leuxner .net[private/dovecot-lmtp] said: 451 4.3.0 Temporary internal failure (in reply to end of DATA command)) $ mailq -Queue ID- --Size-- ----Arrival Time---- -Sender/Recipient------- 19FB54088 131807 Fri Nov 26 18:01:49 bounce-1841919-268661(a)news.juno.co.uk (host spectre.leuxner.net[private/dovecot-lmtp] said: 451 4.3.0 Temporary internal failure (in reply to end of DATA command)) tlx(a)leuxner.net -- 129 Kbytes in 1 Request. Regards Thomas

4 9

[Dovecot] Error from mobile client (Palm Pre)
by Daniel L. Miller 30 Nov '10

30 Nov '10

Where I used to be able to access the server without incident, I can no longer receive mail on the mobile device. I'm seeing this in the server log: Nov 27 23:45:05 bubba dovecot: imap-login: Login: user=<dmiller(a)amfes.com>, method=PLAIN, rip=173.117.196.198, lip=192.168.0.72, mpid=17422, TLS Nov 27 23:45:07 bubba dovecot: imap(dmiller(a)amfes.com): Error: FETCH [1.2] for mailbox INBOX UID 10652 got too little data: 0 vs 23553 Nov 27 23:45:07 bubba dovecot: imap(dmiller(a)amfes.com): Error: Corrupted index cache file /var/mail/amfes.com/dmiller/mdbox/mailboxes/INBOX/dbox-Mails/dovecot.index.cache: Broken MIME parts for mail UID 10652 Nov 27 23:45:07 bubba dovecot: imap(dmiller(a)amfes.com): Disconnected: FETCH failed bytes=88/4202 I HAVE made some tweaks to config - primarily adding plugins I never used before. These now include zlib and imap_zlib (I've tried removing imap_zlib - no change). -- Daniel

2 6

[Dovecot] (vaguely) related to: "doveadm auth user" ...
by Clemens Schrimpe 30 Nov '10

30 Nov '10

While digging through the code I remember having seen something like an (yet undocumented) "update_query" for SQL (and I guess something similar for the LDAP faction as well)?! Can that be used to augment the "doveadm pw" function to actually /set/ the password for a given user instead of just "calculating" the hash, so that an operator can copy&waste it into the respective passdb? Just curious ... I guess it would be nice to have "doveadm" become as central point of administration (yeah, yeah - we would still need a "create user" and "delete user", etc. -- but we would at least be further on our way, wouldn't we? :-) Just 2¢ from Clemens

2 1

[Dovecot] SQL insert?
by Oliver Berse 29 Nov '10

29 Nov '10

Hi, I want to log some informations about a mail in a mysql database when the mail is saved to inbox (for a groupware). I use Dovecot 1.2.16 and the log message "msgid=<xxx>: saved mail to inbox" is generated in deliver.c. I find all the needed data in that file. But I'am not sure how to use the functions in sql-api.h or sql-api-private.h to send a simple SQL insert statement to the database. Can anyone give me a hint how to do this? best regards, Oliver

2 1

[Dovecot] Dovecot and loading OpenSSL libraries
by Paul Griffith 29 Nov '10

29 Nov '10

Hi, I am running into a interesting issue with Dovecot. I compiled Dovecot 2.0.7 with LD_RUN_PATH set to /xsys/lib and it was able to find and link against the correct OpenSSL libraries (/xsys/lib), the generated Makefile look OK. Here is a snippet of the SSL cflags and libs. SSL_CFLAGS = -I/xsys/include SSL_LIBS = -L/xsys/lib -lssl -lcrypto -ldl After I compil, install and run Dovecot I get the following error. ssl-params: Error: dovecot/ssl-params: error while loading shared libraries: libssl.so.0.9.8: cannot open shared object file: No such file or directory It seems that Dovecot can't find the SSL libraries, even if I set the LD_LIBRARY_PATH environment variable. I always assume that the Dynamic Loaded (dl) library would pickup LD_LIBRARY_PATH. If I add /xsys/lib to /etc/ld.so.conf and regenerate my /etc/ld.so.cache file, Dovecot works without any error messages. Any ideas why SSL_CFLAGS, SSL_LIBS and LD_LIBRARY_PATH aren't been honored ? 78 % /xsys/pkg/dovecot/bin/doveconf -n # 2.0.7: /xconf/dovecot/dovecot.conf # OS: Linux 2.6.9-89.0.29.EL.CSE.smp i686 CentOS release 4.6 (Final) ext3 auth_mechanisms = plain login auth_username_format = %Lu doveadm_socket_path = /var/run/dovecot/doveadm-server imap_client_workarounds = tb-extra-mailbox-sep mail_location = mbox:/local/home/%u:INBOX=/local/home/%u/inbox mail_plugin_dir = /xsys/pkg/dovecot/lib/dovecot passdb { driver = pam } pop3_client_workarounds = outlook-no-nuls oe-ns-eoh pop3_uidl_format = %08Xv%08Xu protocols = imap pop3 ssl_cert = </xconf/openssl/certs/imapd.pem ssl_key = </xconf/openssl/certs/imapd.pem userdb { driver = passwd } Thanks Paul

2 1

[Dovecot] maildir-dbox hybrid
by Roland Stuehmer 28 Nov '10

28 Nov '10

Hi! How can I convert old mailboxes in "maildir-dbox hybrid" to a current dbox? I have a Dovecot installation that was upgraded from 1.2.x to 2.0.x. Having used the old convert plugin during the 1.2-times I am now stuck with mailboxes which are partially converted (maildir-dbox hybrid state). On <http://wiki2.dovecot.org/Upgrading/2.0> it just says to contact the mailinglist. :) | If you have any Maildir files in your dbox, you need to convert them | somehow (contact Dovecot mailing list) Regards, Roland. P.S.: I am currently using version: 2.0.5 (b8803a1e2dc2)

3 11

[Dovecot] dovecot genesis v2.0.X
by Jim Pazarena 28 Nov '10

28 Nov '10

V2 of dovecot has had the following releases (to recap) 2.0.0 2010-08-16 2.0.1 2010-08-24 2.0.2 2010-09-08 2.0.3 2010-09-17 2.0.4 2010-09-26 2.0.5 2010-10-01 I am on FreeBSD, and the port committers want to wait till dovecot V2 "stabilizes" prior to adding it to the FreeBSD ports base. So, my question is, respectfully, is dovecot V2.0.5 stable enough for prime-time on a busy ISP mail server? I'll install it myself independent of the FreeBSD ports tree if so. Thanks,

8 9

[Dovecot] (Dis)advantage of using lmtp?
by Christian Schmidt 28 Nov '10

28 Nov '10

Hi all, are there any (dis)advantages in "connecting" dovecot and an MTA (in our case: exim) using LMTP over using other methods (e.g. the exim transports definitions that can be found in the wiki)? Thank you very much! Gruss/Regards, Christian Schmidt

3 2