- dovecot - dovecot.org

[Dovecot] Virtual Users, PAM authentication, MySql backend
by Álvaro Leão 01 Dec '10

01 Dec '10

Hi, I'm sorry if this is a silly question, but i know that is not possible in Courier, so, I need to check if I can do it with Dovecot. Can I use PAM authentication, witch get the users data from a external database (like mysql)? I've found many ways to do this stuff disconnectedly (like pam authentication with passwd ), but i can put all together? I can't use the passwd... Thank's, Álvaro

3 4

[Dovecot] 2.0.7 (a131a498731f): Core Dump on parsing Config
by Thomas Leuxner 30 Nov '10

30 Nov '10

Trying to fix the 'lmtp' temp error, the latest HG core dumps right away: Nov 30 04:15:41 spectre dovecot: master: Dovecot v2.0.7 (a131a498731f) starting up Nov 30 04:15:41 spectre dovecot: master: Error: service(log): child 30087 killed with signal 11 (core dumped) Nov 30 04:15:41 spectre dovecot: master: Error: service(log): command startup failed, throttling Dump seems to be not very useful though. $ gdb /usr/lib/dovecot/imap /var/run/dovecot/core GNU gdb (GDB) 7.0.1-debian Copyright (C) 2009 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html> This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type "show copying" and "show warranty" for details. This GDB was configured as "x86_64-linux-gnu". For bug reporting instructions, please see: <http://www.gnu.org/software/gdb/bugs/>... Reading symbols from /usr/lib/dovecot/imap...Reading symbols from /usr/lib/debug/usr/lib/dovecot/imap...done. (no debugging symbols found)...done. warning: core file may not match specified executable file. Core was generated by `/usr/sbin/dovecot -c /etc/dovecot/dovecot.conf'. Program terminated with signal 11, Segmentation fault. #0 0x0000000000408719 in str_c@plt () #0 0x0000000000408719 in str_c@plt () No locals. #1 0x00000000016711f8 in ?? () No symbol table info available. #2 0x00007f95ccf52b90 in ?? () No symbol table info available. #3 0x0000000000000000 in ?? () No symbol table info available. Current language: auto The current source language is "auto; currently asm". # 2.0.7 (5e82c5b1b4a9): /etc/dovecot/dovecot.conf # OS: Linux 2.6.32-5-amd64 x86_64 Debian squeeze/sid auth_verbose = yes mail_location = mdbox:~/mdbox mail_plugins = acl quota managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date namespace { hidden = no inbox = yes location = prefix = separator = / type = private } namespace { list = yes location = maildir:/var/vmail/public:LAYOUT=fs:INDEX=~/public prefix = Public/ separator = / subscriptions = no type = public } passdb { args = username_format=%u /var/vmail/auth.d/%d/passwd driver = passwd-file } plugin { acl = vfile:/var/vmail/conf.d/%d/acls:cache_secs=300 mail_log_events = expunge mailbox_delete quota = dict:user::file:%h/mdbox/dovecot-quota quota_rule = *:storage=1GB quota_rule2 = Trash:storage=+10%% sieve = ~/.dovecot.sieve sieve_dir = ~/sieve sieve_global_dir = /var/vmail/conf.d/%d/sieve } protocols = imap lmtp service auth-worker { user = doveauth } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } user = doveauth } service imap-login { inet_listener imap { address = 1.2.3.4 port = 143 } inet_listener imaps { port = 0 } } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0660 user = postfix } } ssl_cert = </etc/ssl/certs/host_domain_tld.crt ssl_key = </etc/ssl/private/host_domain_tld.key syslog_facility = local1 userdb { args = username_format=%u /var/vmail/auth.d/%d/passwd driver = passwd-file } verbose_proctitle = yes protocol lmtp { mail_plugins = acl quota sieve } protocol imap { mail_plugins = acl quota imap_acl imap_quota mail_log notify }

2 2

[Dovecot] 2.07 Debian Segfault has gone.....
by Bernd Schmelter 30 Nov '10

30 Nov '10

....since new package available :-) tnx Benn dovecot --version: 2.0.7 (6e6d3a1cf799) ..Upgrade: dovecot-imapd:i386 (2.0.7-0~auto+33, 2.0.7-0~auto+34)...

1 0

[Dovecot] How to know if dovecot director is running OK?
by Antonio Perez-Aranda 30 Nov '10

30 Nov '10

I'm using director on dovecot 2.0 At present, I know that two instances are connected, If I stop of one system, then I can watch how to the connections are closed on port 5000. I defined 5000 as director port. I have one user (user1) connected to kvm1 (192.168.13.100) and kvm2 (192.168.13.101) servers vía telnet telnet kvm1 143 and then login telnet kvm2 143 and then login If try to execute doveadm director status I can watch the two server like that: [root@kvm1 ~]# doveadm director status mail server ip vhosts users 192.168.13.100 100 0 192.168.13.101 100 0 If I try to find if a server has been asigned to user, but I don't know if it is running correctly [root@kvm1 ~]# doveadm director status user1 Current: not assigned Hashed: 192.168.13.101 Initial config: 192.168.13.101 [root@kvm2 ~]# doveadm director status user1 Current: not assigned Hashed: 192.168.13.101 Initial config: 192.168.13.101 Is there any way to test if it really running?

2 9

[Dovecot] 2.0.7 (a131a498731f) segfaults on Debian
by Bernd Schmelter 30 Nov '10

30 Nov '10

after aptitude upgrade it segfaults. syslog: Nov 30 15:42:05 serv dovecot: master: Dovecot v2.0.7 (a131a498731f) starting up (core dumps disabled) Nov 30 15:42:05 serv kernel: [ 50.920530] dovecot[1474]: segfault at 0 ip 0804fa9c sp bf87ba80 error 4 in dovecot[8048000+c000] Nov 30 15:42:05 serv kernel: [ 50.921140] dovecot[1475]: segfault at 0 ip 0804fa9c sp bf87bab0 error 4 in dovecot[8048000+c000] Nov 30 15:42:05 serv kernel: [ 50.921550] dovecot[1476]: segfault at 0 ip 0804fa9c sp bf87bab0 error 4 in dovecot[8048000+c000] Nov 30 15:42:05 serv dovecot: master: Error: service(anvil): child 1474 killed with signal 11 (core dumps disabled) Nov 30 15:42:05 serv dovecot: master: Error: service(anvil): command startup failed, throttling Nov 30 15:42:05 serv dovecot: master: Error: service(log): child 1475 killed with signal 11 (core dumps disabled) Nov 30 15:42:05 serv dovecot: master: Error: service(log): command startup failed, throttling Nov 30 15:42:05 serv dovecot: master: Error: service(ssl-params): child 1476 killed with signal 11 (core dumps disabled) Nov 30 15:42:05 serv dovecot: master: Error: service(ssl-params): command startup failed, throttling apt-history: Start-Date: 2010-11-30 15:33:35 Upgrade: hdparm:i386 (9.27-2.1, 9.32-1), libx11-data:i386 (1.3.3-3, 1.3.3-4), dovecot-imapd:i386 (2.0.7-0~auto+30, 2.0.7-0~auto+33), dovecot-pop3d:i386 (2.0.7-0~auto+30, 2.0.7-0~auto+33), libx11-6:i386 (1.3.3-3, 1.3.3-4), dovecot-common:i386 (2.0.7-0~auto+30, 2.0.7-0~auto+33) End-Date: 2010-11-30 15:34:26 imho the upgraded packages havn`t relations to dovecot Benn -- GRATIS! Movie-FLAT mit über 300 Videos. Jetzt freischalten unter http://portal.gmx.net/de/go/maxdome

2 2

[Dovecot] "doveadm auth user" requiring a tty
by Axel Luttgens 30 Nov '10

30 Nov '10

Hello, "doveadm auth user password" may be scripted without a glitch. But this comes with the usual problem of a "ps" command showing the password, which may be especially annoying in case of a single-letter typo: the almost correct password is then visible for about two seconds... Clearing the password argument (zeroing it) in doveadm-auth.c, in the hope to reduce the window during which the password may be catched, didn't prove successful. "doveadm auth user" could be an alternative, but it imperatively requires a tty, which may not always easily nor efficiently be available in a scripting environment. I thus ended with this very quick and dirty hack (I guess this should be named that way): --- askpass.original.c 2010-05-31 18:36:52.000000000 +0200 +++ askpass.c 2010-11-27 19:12:03.000000000 +0100 @@ -16,8 +16,24 @@ char ch; int fd; + // A very crude attempt... this supposes that STDIN not being a tty + // may never happen outside of "doveadm auth", and that STDIN will + // always be clean. + //if (!isatty(STDIN_FILENO)) + // i_fatal("stdin isn't a TTY"); if (!isatty(STDIN_FILENO)) - i_fatal("stdin isn't a TTY"); + { + pos = 0; + while (read(STDIN_FILENO, &ch, 1) > 0) { + if (pos >= buf_size-1) + break; + if (ch == '\n' || ch == '\r') + break; + buf[pos++] = ch; + } + buf[pos] = '\0'; + return; + } fputs(prompt, stderr); fflush(stderr); but this for sure must overlook a lot of things. What would be the best way to achieve a scriptable "doveadm auth", say through php's proc_open(), without possibly compromise passwords? TIA, Axel

2 2

[Dovecot] Plan: ACL changes
by Timo Sirainen 30 Nov '10

30 Nov '10

Global ACLs are intended to apply to a few mailboxes for all users. For example you could have a master user called "spam" that would have access to each user's "spam" mailbox, but nothing else. Global ACLs are kind of ugly. A mailbox's ACL is found from exactly the same name as what the mailbox's virtual name is. So for example if you have namespace { separator = / prefix = foo/ } And you have a mailbox called foo/bar, the global ACL is looked up from the <global dir>/foo/bar. The problem there of course is what if you want to set global ACLs for "foo". You can't have both directory and a file called "foo". So if this happens, Dovecot instead looks up the ACLs from <global dir>/foo/.DEFAULT file. The name for this file is slightly confusing, and also of course if there really is a mailbox called ".DEFAULT" it won't really work well. Global acl is currently configured by giving its path to acl setting, such as: plugin { acl = vfile:/etc/dovecot/global-acls } So plan #1: deprecate this usage. If global-acls is a directory, keep using the old method. But the new preferred method would be for it to be a file that contains all of the global ACLs. Typically there should be very few entries, so this should also be more efficient. Also this would allow setting default ACLs for namespaces by using wildcards. For example you could have: * masteruser +lrw spam spamuser +lr test/* testuser +lr etc. The * would match only within a single namespace, so if you had more than one, the * entry would match only the one having prefix="". The * entry would be especially helpful for master users who you intend to have access to user's all mailboxes. Currently there is no good way to implement this. Plan #2: Add support for per-user default namespace ACLs. In the mail root directory if "dovecot-default-acl" file exists, it's used as the default ACLs. I'm not entirely sure what should happen if it conflicts with the global ACLs. Probably they both should be simply merged, since both can only be created by an admin. Probably the per-user ACL should be allowed to override the global ACLs. Any thoughts? Since neither of these would break backwards compatibility, I could add them to v2.0.x.

4 9

[Dovecot] 2.0.7 (0757f4f5b882): LMTP Server refuses queued mail
by Thomas Leuxner 30 Nov '10

30 Nov '10

Hi, not sure what is wrong with the mail, but the Dovecot LMTP won't accept it. This is actually the first ever occurrence, so I'm attaching the evidence for further diagnosis: […] Nov 26 18:01:49 spectre dkim-filter[1723]: A7BEA4086: no signature data Nov 26 18:01:49 spectre postfix/qmgr[6175]: A7BEA4086: from=<bounce-1841919-268661(a)news.juno.co.uk>, size=131577, nrcpt=1 (queue active) […] Nov 26 18:01:49 spectre postfix/lmtp[27788]: 19FB54088: to=<tlx(a)leuxner.net>, relay=spectre.leuxner.net[private/dovecot-lmtp], delay=0.27, delays=0.25/0/0/0.01, dsn=4.3.0, status=deferred (host spectre.leuxner .net[private/dovecot-lmtp] said: 451 4.3.0 Temporary internal failure (in reply to end of DATA command)) $ mailq -Queue ID- --Size-- ----Arrival Time---- -Sender/Recipient------- 19FB54088 131807 Fri Nov 26 18:01:49 bounce-1841919-268661(a)news.juno.co.uk (host spectre.leuxner.net[private/dovecot-lmtp] said: 451 4.3.0 Temporary internal failure (in reply to end of DATA command)) tlx(a)leuxner.net -- 129 Kbytes in 1 Request. Regards Thomas

4 9

[Dovecot] Error from mobile client (Palm Pre)
by Daniel L. Miller 30 Nov '10

30 Nov '10

Where I used to be able to access the server without incident, I can no longer receive mail on the mobile device. I'm seeing this in the server log: Nov 27 23:45:05 bubba dovecot: imap-login: Login: user=<dmiller(a)amfes.com>, method=PLAIN, rip=173.117.196.198, lip=192.168.0.72, mpid=17422, TLS Nov 27 23:45:07 bubba dovecot: imap(dmiller(a)amfes.com): Error: FETCH [1.2] for mailbox INBOX UID 10652 got too little data: 0 vs 23553 Nov 27 23:45:07 bubba dovecot: imap(dmiller(a)amfes.com): Error: Corrupted index cache file /var/mail/amfes.com/dmiller/mdbox/mailboxes/INBOX/dbox-Mails/dovecot.index.cache: Broken MIME parts for mail UID 10652 Nov 27 23:45:07 bubba dovecot: imap(dmiller(a)amfes.com): Disconnected: FETCH failed bytes=88/4202 I HAVE made some tweaks to config - primarily adding plugins I never used before. These now include zlib and imap_zlib (I've tried removing imap_zlib - no change). -- Daniel

2 6

[Dovecot] (vaguely) related to: "doveadm auth user" ...
by Clemens Schrimpe 30 Nov '10

30 Nov '10

While digging through the code I remember having seen something like an (yet undocumented) "update_query" for SQL (and I guess something similar for the LDAP faction as well)?! Can that be used to augment the "doveadm pw" function to actually /set/ the password for a given user instead of just "calculating" the hash, so that an operator can copy&waste it into the respective passdb? Just curious ... I guess it would be nice to have "doveadm" become as central point of administration (yeah, yeah - we would still need a "create user" and "delete user", etc. -- but we would at least be further on our way, wouldn't we? :-) Just 2¢ from Clemens

2 1