- dovecot - dovecot.org

[Dovecot] Authentication woes - Couldn't drop privileges: Mail access not allowed for root
by Ralph Seichter 23 Aug '10

23 Aug '10

I'm currently trying to set up a Dovecot 2.0.0 server for backup purposes. There's an existing server which I successfully migrated to Dovecot 2.0.0, and it uses LDAP for authentication. For the backup server, which will not be exposed to users, I tried both PAM and PASSWD authentication, but all I are syslog entries like these: dovecot: imap-login: Login: user=<foo>, method=PLAIN, rip=[...], lip=[...], mpid=20059, TLS dovecot: imap(foo): Error: user foo: Couldn't drop privileges: Mail access not allowed for root dovecot: imap(foo): Error: Internal error occurred. Refer to server log for more information. Here is my current configuration: # doveconf -n # 2.0.0: /usr/local/dovecot-2.0/etc/dovecot/dovecot.conf # OS: Linux 2.6.35-gentoo-r1-v3 x86_64 Gentoo Base System release 2.0.1 auth_mechanisms = plain login base_dir = /var/run/dovecot/ listen = * mail_location = maildir:~/.maildir passdb { args = scheme=crypt /usr/local/dovecot-2.0/etc/dovecot/passwd driver = passwd-file } protocols = imap ssl_cert = </usr/local/dovecot-2.0/etc/dovecot/server.crt ssl_key = </usr/local/dovecot-2.0/etc/dovecot/server.key The password file contents: # cat /usr/local/dovecot-2.0/etc/dovecot/passwd foo:{CRYPT}xxx:1000:1000:Foo Backup:/home/foo:/bin/bash I searched the Dovecot Wiki and also tried MARC and Google, but I can't seem to find a solution for this problem. Could you please point me in the right direction? I have probably missed something. Thanks! -Ralph

2 5

[Dovecot] Dovecot 2.0 and BSDI 4.X
by The Doctor 23 Aug '10

23 Aug '10

All right, I am trying to migrating to 2.0 but running into problems. from my typescript: Script started on Wed Aug 18 23:24:58 2010 doctor.nl2k.ab.ca//usr/home/doctor$ tail -f /var/log/maillog | egrep dovecot Aug 18 23:25:31 doctor dovecot: master: Dovecot v2.0.0 starting up (core dumps disabled) Aug 18 23:25:31 doctor dovecot: log: Error: net_accept() failed: Invalid argument Aug 18 23:25:31 doctor dovecot: master: Warning: service(anvil): process_limit reached, client connections are being dropped quit ^C doctor.nl2k.ab.ca//usr/home/doctor$ /usr/doc veo cot/sbin/dovecot -n # 2.0.0: /usr/dovecot/etc/dovecot/dovecot.conf # OS: BSD/OS 4.3 i386 auth_cache_negative_ttl = 3600 s base_dir = /var/run/dovecot/ disable_plaintext_auth = no first_valid_uid = 100 listen = * login_log_format_elements = user=<%u> method=%m rip=%r lip=%l %c mail_debug = yes mail_location = mbox:~/mail:INBOX=/var/mail/%u mail_log_prefix = %Us(%u): mdbox_rotate_size = 2048 passdb { args = /etc/master.passwd driver = passwd-file } protocols = pop3 imap service auth { executable = /usr/dovecot/libexec/dovecot/auth user = root vsz_limit = 256 } service imap-login { chroot = login client_limit = 256 executable = /usr/dovecot/libexec/dovecot/imap-login inet_listener imaps { address = 204.209.81.1 } process_limit = 128 process_min_avail = 3 service_count = 1 user = dovecot vsz_limit = 64 } service imap { executable = /usr/dovecot/libexec/dovecot/imap process_limit = 512 vsz_limit = 256 } service pop3-login { chroot = login client_limit = 256 executable = /usr/dovecot/libexec/dovecot/pop3-login inet_listener pop3s { address = 204.209.81.1 } process_limit = 128 process_min_avail = 3 service_count = 1 user = dovecot vsz_limit = 64 } service pop3 { executable = /usr/dovecot/libexec/dovecot/pop3 process_limit = 512 vsz_limit = 256 } ssl_cert = </etc/ssl/certs/dovecot.pem ssl_cipher_list = ALL:!LOW:!SSLv2 ssl_key = </etc/ssl/private/dovecot.pem userdb { driver = passwd } userdb { args = /etc/passwd driver = passwd-file } protocol imap { imap_client_workarounds = delay-newmail tb-extra-mailbox-sep imap_idle_notify_interval = 120 s imap_logout_format = bytes=%i/%o imap_max_line_length = 65536 mail_max_userip_connections = 10 mail_plugin_dir = /usr/dovecot/lib/dovecot/imap } protocol pop3 { mail_max_userip_connections = 3 mail_plugin_dir = /usr/dovecot/lib/dovecot/pop3 pop3_enable_last = no pop3_lock_session = no pop3_logout_format = top=%t/%p, retr=%r/%b, del=%d/%m, size=%s pop3_no_flag_updates = no pop3_reuse_xuidl = no pop3_save_uidl = no pop3_uidl_format = %08Xu%08Xv } You have new mail in /var/mail/doctor doctor.nl2k.ab.ca//usr/home/doctor$ exit exit Script done on Wed Aug 18 23:26:07 2010 telneting into the ports work, but the clients seem to stuck in an infinite loop. -- Member - Liberal International This is doctor(a)nl2k.ab.ca Ici doctor(a)nl2k.ab.ca God, Queen and country! Never Satan President Republic! Beware AntiChrist rising! http://twitter.com/rootnl2k http://www.facebook.com/dyadallee Australia!! Vote to throw the REpublicans to the sharks!

5 10

[Dovecot] Over-quota bounces seeming to lack sender
by Dave Brenner 23 Aug '10

23 Aug '10

We're seeing an issue with 1.2.12 where over-quota rejection messages are appearing in the logs with <> as the sender. The sender of the original message sees the appropriate sender (postmaster@) on the rejection, but as the message makes its way through the postfix/amavis chain, I can see that the sender address is missing. Aug 20 10:55:56 inet1 amavis[21822]: [ID 702911 mail.info] (21822-05) Checking: rGDWxOHFPBdY <> -> <xxxx(a)toledotel.com> Aug 20 03:12:39 inet1 amavis[9724]: [ID 702911 mail.info] (09724-37) skip local delivery(3): <> -> <bad-header-quarantine> Aug 19 10:15:47 2010 (1570) xxxxxxxx-users: bounce message w/no discernable addresses: <dovecot-1282238146-79394-0@inet1> (that last one is from Mailman logs) Has anyone else run into this? -- Dave Brenner - david(a)toledotel.com The Toledo Telephone Company, Inc.

2 1

[Dovecot] imap, imaps, ports; config for secure-only service
by Ronald Leach 23 Aug '10

23 Aug '10

Hello, having difficulty setting up a 'secure-only' service on a non-standard port. Objective is to open a secure Dovecot service on an internet-visible port, while also using an insecure service for hosts on an internal network (so that one particular client which is not SSL/TLS-capable can continue to use the service). Checking wiki1 and wiki2, I think that port 143 can be used for a service in both encrypted and unencrypted operations. (Wiki2 describes how port 143 can be used with or without STARTTLS.) I've managed to run both TB/Vista, and KMail/Debian on 143 from local machines, and they seem to work fine. (Though they do only work if the clients are set to use 'unencrypted logins' such as KMail's 'clear text' setting, and TB's 'don't use secure authentication'.) Dovecot's SSL certificate on the server expires in 2028. But I cannot get my 'secure-only service' working at all. I've chosen port 10943 for that service, and have been testing from both KMail on the server, and TB/Vista on another local machine. Here's the config: protocol imap { # inet users, and also users presented from offsite via an SSH tunnel, # will use IMAP (any capability) on 143. listen = *:143 # 143 will not be reachable from outside the internal network (except # via an SSH tunnel) # # External users will be allowed only to use port 10943 (as forwarded # from the gateway), and will have to use SSL ssl_listen = *:10943 } Other settings include: #other settings protocols = imap imaps disable_plaintext_auth = no ssl_disable = no ssl_cert_file = /etc/ssl/certs/dovecot.pem ssl_key_file = /etc/ssl/private/dovecot.pem ssl_verify_client_cert = no ssl_cipher_list = ALL:!LOW ssl_require_client_cert = no ssl_username_from_cert = no mail_location = maildir:~/Maildir #log and debug settings mail_debug = yes auth_debug = yes Log from a successful session on port 143: Logs (using port 143, KMail on the server) 14:43:22 auth(default): client in: AUTH^I1^IPLAIN^Iservice=IMAP^Isecured^Ilip=127.0.0.1^Irip=127.0.0.1^Iresp=<hidden> 14:43:22 auth(default): client out: OK^I1^Iuser=ron 14:43:22 auth(default): master in: REQUEST^I1^I4057^I1 14:43:22 auth(default): master out: USER^I1^Iron^Isystem_user=ron^Iuid=1001^Igid=1001^Ihome=/home/ron 14:43:22 IMAP(ron): Effective uid=1001, gid=1001 14:43:22 IMAP(ron): maildir: data=/home/ron/Maildir 14:43:22 IMAP(ron): maildir: root=/home/ron/Maildir, index=/home/ron/Maildir, control=, inbox= 14:43:22 imap-login: Login: user=<ron>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, TLS Unsuccessful session Logs (using 10943, KMail on the server) - absolutely no sign of any authentication, and the client reports a timeout. 17:03:30 imap-login: Disconnected: Inactivity: rip=127.0.0.1, lip=127.0.0.1, TLS handshake 17:04:06 imap-login: Disconnected: rip=127.0.0.1, lip=127.0.0.1, TLS handshake 17:05:08 imap-login: Disconnected: Inactivity: rip=127.0.0.1, lip=127.0.0.1, TLS handshake 143 works fine, so Dovecot is (of course) perfectly good at managing the auth and service, so I must have something wrong in the config. I cannot see it. Could anyone share a config they've used for *secure-only* IMAP service on an internet-visible port? I'd like to compare the settings. regards, Ron

4 3

[Dovecot] Build failure building dbox and gnutls
by Elisamuel Resto 23 Aug '10

23 Aug '10

Hello! I'm having two issues building dovecot, one is with dbox storage, and another building gnutls as the SSL backend (builds fine with openssl). Software versions are Dovecot v2.0.0, GnuTLS 2.8.6 and OpenSSL 1.0.0a Configure: ./configure --prefix=/usr --sysconfdir=/etc/dovecot --localstatedir=/var --libexecdir=/usr/lib --with-moduledir=/usr/lib/dovecot/modules --with-zlib --with-sqlite --with-ssl=openssl --with-ssldir=/etc/ssl --with-gssapi --with-pam --with-bzlib --with-docs --without-mysql --without-vpopmail --without-sia --without-bsdauth --with-libcap --with-ioloop=epoll --with-storages=maildir,mbox,dbox,mdbox For the dbox build error, the log states: libdovecot-storage.so: undefined reference to `dbox_storage' Configure: http://pastie.org/1106301 - Make: http://pastie.org/private/qtt76kxomhmwqwii20oroq Configure: ./configure --prefix=/usr --sysconfdir=/etc/dovecot --localstatedir=/var --libexecdir=/usr/lib --with-moduledir=/usr/lib/dovecot/modules --with-zlib --with-sqlite --with-ssl=gnutls --with-ssldir=/etc/ssl --with-gssapi --with-pam --with-bzlib --with-docs --without-mysql --without-vpopmail --without-sia --without-bsdauth --with-libcap --with-ioloop=epoll For the gnutls build error, the log states quite a few errors, so see the linked logs. Configure: http://pastie.org/1108356 - Make: http://pastie.org/private/dxmmmopnodptut77o6fx2g -- Elisamuel Resto <ryuji(a)codemages.net> http://www.simplysam.us/ - Simply Sam Blog

3 4

[Dovecot] Mobile phone client detects 'PUSH' server
by Ron Leach 22 Aug '10

22 Aug '10

Does Dovecot really provide a 'PUSH' email service? The mobile phone client (standard with SonyEricsson C510, in this case) reported that the server (our Dovecot installation) offered PUSH email service. I hadn't seen that in the documentation that I'd read and had understood the client-server protocol to be a client-PULL service, in that the clients decide which folders to retrieve, and check what messages there are and fetch any new messages. The clients we've used so far have settings for frequency of these checks. I didn't explore the option further, yet, being unsure whether there was a genuine PUSH service from our server or whether the phone was using a proxy somewhere (not ours) which would provide an intermediate fetch/aggregation/'pull then push' service of some sort - perhaps similar to the public offers from Yahoo etc. regards, Ron

2 2

[Dovecot] sieve rule help
by Piyush Joshi 21 Aug '10

21 Aug '10

Dear All, I am using dovecot-2.0.0 version and all my sieve filters are working perfectly except the following one. I am trying to flag message coming from jagdish(a)example.net mail id. require ["fileinto","envelope","reject","vacation","imap4flags","relational","comparator-i;ascii-numeric","regex","body","date"]; if address :contains "From" "jagdish(a)example.net" { keep :flags ["Flagged"] ; } Is it possible to make it work without using addflag to add a flag ?

2 1

[Dovecot] dsync and active-active fault tolerance mail servers
by Luigi Rosa 21 Aug '10

21 Aug '10

I would like to set up an active-active fault tolerance couple of mail servers. Is the following procedure correct? Let's suppose I want to set up two servers for acme.com, mail1.acme.com and mail2.acme.com I declare both servers as MX in DNS configuration. Mailbox are stored in maildir with a single UID/GID owner for all the maildir files Userbase is MySQL, user tables are replicated using MySQL tools; in this case, the replica is one way, that is mail1.acme.com holds the "master" copy of MySQL tables and mail2.acme.com hold the "copy". The replica is done via dsync with a procedure like this executed on mail1.acme.com server: foreach mailbox { dsync mirror mailbox } Where mailbox is the full mail address, used also as a login name for authentication. My goal is to allow users to connect the mail servers they like and have all their mail (a 10/15 minute of sync delay is acceptable). This is the theory, now some questions. 1) Use Linux user/group owner of the files and directories are the same on both hosts (they are both foobar), but have different numeric ID, in one host foobat has UID 1234 and on the other host foobar has UID 2345. Is this an issue? 2) Mail location path is the same on both hosts, but where does dsync get it? Does dsync get all the information from the userbase defined in dovecot.conf (and other included files)? 3) Have I to scan the entire userbase and execute dsync for each user, or is there a trick to do for every user with a single command? 4) How often is good to run the synchronization? 5 minutes? 10? 15? 5) What is the correct command line to invoke dsync in this scenario? 6) Does anyone else tried this? :) Thank you. Ciao, luigi -- / +--[Luigi Rosa]-- \ (1) Everything depends. (2) Nothing is always. (3) Everything is sometimes.

2 2

[Dovecot] sieve_after scripts with virtual domains
by Ciro Scognamiglio 21 Aug '10

21 Aug '10

Hi all, first of all I am new to the list, so hello everyone :) I recently encountered an annoying problem with sieve, I am using dovecot version 1.2.13 on centos 5.5, the packages installed are the following: dovecot-sieve-0.1.17-5.el5 dovecot-managesieve-0.11.11-0_4.el5 dovecot-1.2.13-1_111.el5 the mail server is configured with virtual hosts (mysql), also the sieve plugin and managesieve are active. Users can create their own filters through roundcube and everything works fine. I also put two script to be executed before all sieve scripts in sieve_before, they just move any SPAM or VIRUS tagged message to a Junk folder. The problem is that while this works for my domain (that is also the server domain) it doesn't for the others domains, it seems the sieve_before scripts get ignored. I made many tests with the domains I am hosting, if I send a spam message (I am using the spamassassin test messages) it gets marked as SPAM, but gets only moved to the junk folder if the recipient is @cslash.net (that is my domain). here is some config extracts: === dovecot.conf === plugin { sieve = ~/.dovecot.sieve sieve_dir = ~/sieve sieve_before = /srv/mail/sieve-before sieve_after = /srv/mail/sieve-after } ======= /srv/mail $ cat sieve-before/spam.sieve require "fileinto"; if header :contains "X-Spam-Flag" "YES" { fileinto "Junk"; } P.S. The sieve scripts are all compiled.

1 0

[Dovecot] pigeonhole sieve imapflags bug
by Tim Traver 21 Aug '10

21 Aug '10

Hi all, ok, I just instealled the dovecot 2.0.0 release, and the latest mercurial pigeonhole source. All is well, except for a particular sieve rule that may not be working right. It is a simple rule that looks like this : require ["fileinto","imap4flags"]; # rule:[Past Due Notices] if allof (header :contains "Subject" "Account Past Due Notice") { fileinto "Billing"; setflag "\\Seen"; stop; } Anyways, what happens is the message that matches that rule does indeed get moved to the "Billing" folder, but it does not get marked as read. BUT! if I change the order of the actions to mark it as read first, then move it to the "Billing" folder, it does both of those actions... Is that the way it is supposed to work? or is that a bug? Thanks, Tim.

3 2