- dovecot - dovecot.org

[Dovecot] Which Authentication Method Best Between FreeBSD and Macintosh?
by Martin McCormick 29 Mar '10

29 Mar '10

I recently discovered that I need to occasionally forward Email from a FreeBSD system to a Macintosh. Imap does look like the best solution to this problem. The mail program on the Mac lists several protocols such as pop (okay with me) and SSL certificates which I want to avoid if at all possible. Which of the several listed methods of authentication should I compile in as I build dovecot on the FreeBSD system? Options for dovecot 1.2.10 [X] KQUEUE kqueue(2) support [ ] SSL SSL support [ ] IPV6 IPv6 support [ ] MANAGESIEVE ManageSieve support [ ] GSSAPI GSSAPI support [ ] VPOPMAIL VPopMail support [ ] BDB BerkleyDB support [ ] LDAP OpenLDAP support [ ] PGSQL PostgreSQL support [ ] MYSQL MySQL support [ ] SQLITE SQLite support � � IPV6 is not used here and my laziness says to avoid creating any new data bases or data base servers to support something I will probably use once every 2 or 3 months for one or 2 messages. I just want to get on the Mac and read messages posted in a certain account on the FreeBSD system. Sorry if this all sounds a bit odd, but I usually read mail on the FreeBSD box. Occasionally, I get a message containing a 20-mile-long URL that works better when using the Mac's safari browser tools. Presently, I have succeeded in compiling dovecot on the freeBSD system which runs and looks like it is ready to work. The Mac contacts the freeBSD box and then both appear to get a death grip on each other and nothing much happens until I force a quit of mail on the Mac. Thanks for any suggestions. Martin McCormick WB5AGZ Stillwater, OK Systems Engineer OSU Information Technology Department Telecommunications Services Group

1 0

Re: [Dovecot] I stream read - stale NFS file handle (reboot of server)
by Damon Atkins 29 Mar '10

29 Mar '10

NFS Security 101 for NFSv2 and v3 (NOT NFSv4 a long time ago I was part of the discussion group for NFSv4 spec the short comings of v2 and v3 have been fixed) SRV: Server Exports File System /abc/123 access only to host=xyz.domain.com XYZ: Client Mount mount's SRV:/abc/123 SRV: "mountd" gets a request from SRV check access list, and if the client is allowed access, returns File Handle for the top of the mount point (I will call this the FileSystemHandle, this changes after every reboot) XYZ: Client talks to the SRV NFS Server "nfsd" using FileSystemHandle (which represents /abc/123), To find a FileHandle for a file the client sends the NFS server the FileSystemHandle, then finds the next File Handle (/mydir) and the next FileHandle (myfile) and the client has found the FileHandle for /abc/123/mydir/myfile NFSD (v2/v3) is stateless other than the information provided by mountd (mount requests) and lockd (file locking). When you share/export a file system, as part of this a FileSystemHandle is generated and stored somewhere for /abc/123 most likely store in the kernel. SRV: Reboots, a new FileSystemHandle is allocated XYZ: Reports Stale File Handle for everything (if not most things) which was mounted from SRV or the mount point on the client does not respond. A long time ago FileSystemHandle would stay the same between reboots and you wouldn't get this problem other than on an individual file. To handle deleted files which are in use by NFS clients some servers rename them to .nfs* because if one client deleted and other clients where accessing the file then they would get Stale NFS handle. Once in a while a NFS server will do find $dir -type f -name .nfs\* -mtime +7 -mount -exec rm -f {} \; to clean up. NFSv4 does not use mountd or lockd. My advice to anyone on old versions of NFS upgrade to NFSv4 as soon as possible and implement KerbV5 for improved authentication and disallow NFSv2/3 access. If you do not get the Stale File Handle error when the server reboots, it most likely means the FileSystemHandle is not changing between reboots, but then you may have more security issues. Software which Clusters NFS Servers ensures that the node which takes over, uses the same FileSystemHandle (which may only change if the whole Cluster is shutdown) Cheers Damon.

2 4

[Dovecot] failed: Too many open files
by Masaharu Kawada 29 Mar '10

29 Mar '10

Dear list, I have questions about content of the following error messages. ---</var/log/secure>--- dovecot-auth:　PAM　unable　todlopen(/lib/security/pam_nologin.so) dovecot-auth:　PAM　[error:/lib/security/pam_nologin.so:　cannot　open　shared　object　file:　Too　many　open　files] dovecot-auth:　PAM　adding　faulty　module:/lib/security/pam_nologin.so dovecot-auth:　PAM　_pam_load_conf_file:　unable　to　open　/etc/pam.d/system-auth dovecot-auth:　PAM　unable　to　dlopen(<*unknown　module　path*>) dovecot-auth:　PAM　[error:　*unknown　module　path*>:　cannot　open　shared　object　file:　Too　many　open　files] dovecot-auth:　PAM　adding　faulty　module:　<*unknown　module　path*> dovecot-auth:　PAM　_pam_load_conf_file:　unable　to　open　/etc/pam.d/system-auth dovecot-auth:　PAM　_pam_load_conf_file:　unable　to　open　/etc/pam.d/system-auth dovecot-auth:　PAM　unable　to　dlopen(/lib/security/pam_deny.so) dovecot-auth:　PAM　[error:/lib/security/pam_deny.so:　cannot　open　shared　object　file:　Too　many　open　files] dovecot-auth:　PAM　adding　faulty　module:/lib/security/pam_deny.so ---</var/log/maillog>--- dovecot: auth(default): pam(xxx(a)xxx.com,127.0.0.1): pipe() failed: Too many open files dovecot: auth(default): pam(xxx(a)xxx.com,127.0.0.1): pipe() failed: Too many open files It seems that this is due to that there are files existed to open beyond its limitation. Other information that could be relevant are as follows. # ulimit -n 1024 # cat /proc/`cat /var/run/dovecot/master.pid`/limits cat: /proc/7273/limits: No such file or directory # lsof -p `cat /var/run/dovecot/master.pid` | wc -l 29 # ls /proc/`pidof dovecot-auth`/fd | wc -l 1024 >From the above result, dovecot-auth proccess opened 10243 files, and that seems to be the limit. So I expect that adding following lines into /etc/init.d/dovecot could be fix this issue. # vi /etc/init.d/dovecot --- . /etc/init.d/functions ulimit -n 4098 <-add test -x /usr/sbin/dovecot || exit 0 <-add if [ -f /etc/sysconfig/dovecot ]; then . /etc/sysconfig/dovecot fi --- Is my understanding right? Even if so, how could I verify what files are opened by dovecot-auth? I would very much appreciate it if someone in this list could provide comments/suggestions. Sincerely,

3 6

[Dovecot] Improper use of IN-USE in case of a failed authentication
by Rainer Weikusat 29 Mar '10

29 Mar '10

RFC2449 defines the IN-USE extended POP3 response code as 8.1.2. The IN-USE response code This occurs on an -ERR response to an AUTH, APOP, or PASS command. It indicates the authentication was successful, but the user's maildrop is currently in use (probably by another POP3 client). http://www.faqs.org/rfcs/rfc2449.html In contrast to this, the POP3 login code in client_authenticate.c will send IN-USE whenever authentication was not successful because of some kind of internal failure[*]. [*] Noticed during experiments with a shell SQL database driver which only ever returns errors as reaction to any query. I happen to know of at least one (partial) client implementation (I happen to have written which is used by an iPhone application for POP3 user credential verification) which actually interprets IN-USE as it is defined by the RFC.

2 2

[Dovecot] dsync multiserver
by Renaud Allard 28 Mar '10

28 Mar '10

Hello, Maybe I am missing something obvious here (I would hope so), but is there any way to use dovecot deliver to spawn dsync to replicate changes. And dovecot to trigger dsync to sync mailboxes when a change has been done. Thanks

2 1

[Dovecot] permanent flags (are very permanent)
by Oliver Eales 28 Mar '10

28 Mar '10

Hello, first of all i am not sure wheter this is a correct behavior according to the RFC or not... Problem is, when i set a new custom permanent flag (e.g. testflag) and remove it afterwards, the flag still stays in the list of the permanent flags of this drawer even if there are no messages left with this flag set. So the keyword list gets "polluted" with unused flags. * OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE STARTTLS AUTH=PLAIN] uc.vodafone.de Mailservices ready. AA login user notmypass AA OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE SORT SORT=DISPLAY THREAD=REFERENCES THREAD=REFS MULTIAPPEND UNSELECT IDLE CHILDREN NAMESPACE UIDPLUS LIST-EXTENDED I18NLEVEL=1 CONDSTORE QRESYNC ESEARCH ESORT SEARCHRES WITHIN CONTEXT=SEARCH QUOTA] Logged in A0 SELECT inbox * FLAGS (\Answered \Flagged \Deleted \Seen \Draft NonJunk Junk) * OK [PERMANENTFLAGS (\Answered \Flagged \Deleted \Seen \Draft NonJunk Junk \*)] Flags permitted. * 3805 EXISTS * 0 RECENT * OK [UNSEEN 1] First unseen. * OK [UIDVALIDITY 1260979519] UIDs valid * OK [UIDNEXT 4465] Predicted next UID * OK [HIGHESTMODSEQ 1] Highest A0 OK [READ-WRITE] Select completed. A1 STORE 1 +FLAGS (testflag) * FLAGS (\Answered \Flagged \Deleted \Seen \Draft NonJunk Junk testflag) * OK [PERMANENTFLAGS (\Answered \Flagged \Deleted \Seen \Draft NonJunk Junk testflag \*)] Flags permitted. * 1 FETCH (FLAGS (Junk testflag)) A1 OK Store completed. A2 SEARCH KEYWORD testflag * SEARCH 1 A2 OK Search completed (0.043 secs). A3 STORE 1 -FLAGS (testflag) * 1 FETCH (FLAGS (Junk)) A3 OK Store completed. A4 select inbox * OK [CLOSED] Previous mailbox closed. * FLAGS (\Answered \Flagged \Deleted \Seen \Draft NonJunk Junk testflag) * OK [PERMANENTFLAGS (\Answered \Flagged \Deleted \Seen \Draft NonJunk Junk testflag \*)] Flags permitted. * 3805 EXISTS * 0 RECENT * OK [UNSEEN 1] First unseen. * OK [UIDVALIDITY 1260979519] UIDs valid * OK [UIDNEXT 4465] Predicted next UID * OK [HIGHESTMODSEQ 1] Highest A4 OK [READ-WRITE] Select completed. So the new testflag keyword is now in the list even across logins. Regards, Oliver Eales

2 3

[Dovecot] Fix for the consume_results leak
by Rainer Weikusat 28 Mar '10

28 Mar '10

I'm not really comfortable with making non-trivial changes to this code but here is at least a fix for the PGresult leak (verified to both apply to 1.2.11 and 2.0.beta4). ----- --- dovecot/src/lib-sql/driver-pgsql.c 15 Mar 2010 18:18:14 -0000 1.1.1.2 +++ dovecot/src/lib-sql/driver-pgsql.c 26 Mar 2010 14:13:18 -0000 1.1.1.2.4.1 @@ -247,6 +247,17 @@ return 0; } +static inline int more_results(PGconn *pg) +{ + PGresult *pgres; + + pgres = PQgetResult(pg); + if (!pgres) return 0; + + PQclear(pgres); + return 1; +} + static void consume_results(struct pgsql_db *db) { do { @@ -255,7 +266,7 @@ if (PQisBusy(db->pg)) return; - } while (PQgetResult(db->pg) != NULL); + } while (more_results(db->pg)); if (PQstatus(db->pg) == CONNECTION_BAD) io_remove_closed(&db->io);

2 2

[Dovecot] convert v1.2 config to v2.0
by Odhiambo Washington 27 Mar '10

27 Mar '10

How do I convert a version 1.2.x config into a v2.0 config? Some command? -- Best regards, Odhiambo WASHINGTON, Nairobi,KE +254733744121/+254722743223 _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ "If you have nothing good to say about someone, just shut up!." -- Lucky Dube

2 1

[Dovecot] INBOX. namespace
by Brian Candler 27 Mar '10

27 Mar '10

I am trying to configure dovecot-1.2.11 to have the same IMAP namespacing as courier-imap as per http://wiki.dovecot.org/Migration/Courier, but failing badly. I have a test maildir with INBOX and folder 'junk'. Without fiddling with namespaces, this works fine: there are 91 msgs in INBOX and 2 in junk. a namespace * NAMESPACE (("" ".")) NIL NIL a OK Namespace completed. a examine INBOX ... * 91 EXISTS ... a OK [READ-ONLY] Select completed. a examine junk ... * 2 EXISTS ... a OK [READ-ONLY] Select completed. Now I make the following addition to dovecot.conf: namespace private { separator = . prefix = INBOX. inbox = yes hidden = no } After this the inbox appears to be empty, and I cannot select the junk folder at all: a namespace * NAMESPACE (("INBOX." ".")) NIL NIL a OK Namespace completed. a examine INBOX * FLAGS (\Answered \Flagged \Deleted \Seen \Draft) * OK [PERMANENTFLAGS ()] Read-only mailbox. * 0 EXISTS * 0 RECENT * OK [UIDVALIDITY 1269605071] UIDs valid * OK [UIDNEXT 1] Predicted next UID * OK [HIGHESTMODSEQ 1] Highest a OK [READ-ONLY] Select completed. a examine INBOX.junk * OK [CLOSED] Previous mailbox closed. a NO Mailbox doesn't exist: junk Furthermore I can select "INBOX.INBOX" (although that's empty as well) a examine INBOX.INBOX * FLAGS (\Answered \Flagged \Deleted \Seen \Draft) * OK [PERMANENTFLAGS ()] Read-only mailbox. * 0 EXISTS * 0 RECENT * OK [UIDVALIDITY 1269605071] UIDs valid * OK [UIDNEXT 1] Predicted next UID * OK [HIGHESTMODSEQ 1] Highest a OK [READ-ONLY] Select completed. a examine INBOX.INBOX.INBOX * OK [CLOSED] Previous mailbox closed. a NO Mailbox doesn't exist: INBOX.INBOX a examine junk a NO Unknown namespace. Have I misunderstood what I'm supposed to be doing here? The other relevant setting is: mail_location: maildir:%h but I've not changed this; as I say, this works just fine without meddling with namespaces. Many thanks, Brian.

2 4

[Dovecot] Dovecot 2.0beta4 changset 11014 dict: Panic: file driver-mysql.c
by e-frog 27 Mar '10

27 Mar '10

Hi, With the latest hg version I see panics with dict process whenever a message is received via lmtp. This didn't happen with the original beta4 release. Mar 27 11:45:51 ubuntu-test dovecot: dict: mysql: Connected to localhost (mails) Mar 27 11:45:51 ubuntu-test postfix/lmtp[5261]: 0F22B27F0D: to=<test(a)ubuntu-test.localdomain>, orig_to=<test(a)ubuntu-test.localdomain>, relay=ubuntu-test.localdomain[dovecot-lmtp], delay=0.41, delays=0.06/0.01 /0.22/0.11, dsn=2.0.0, status=sent (250 2.0.0 <test(a)ubuntu-test.localdomain> WsNlE9/hrUuOFAAA7I0XzQ Saved) Mar 27 11:45:51 ubuntu-test dovecot: master: service(dict): child 5263 killed with signal 6 (core not dumped) Mar 27 11:45:51 ubuntu-test dovecot: master: service(dict): command startup failed, throttling Mar 27 11:45:51 ubuntu-test dovecot: lmtp(5262, test): WsNlE9/hrUuOFAAA7I0XzQ: sieve: msgid=<4BADE1E9.7000709(a)ubuntu-test.localdomain>: from=test(a)ubuntu-test.localdomain: stored mail into mailbox 'INBOX' Mar 27 11:45:51 ubuntu-test dovecot: dict: Panic: file driver-mysql.c: line 633 (transaction_send_query): assertion failed: (rows != (my_ulonglong)-1) Mar 27 11:45:51 ubuntu-test dovecot: dict: Raw backtrace: /usr/lib/dovecot/libdovecot.so.0 [0xb773dd92] -> /usr/lib/dovecot/libdovecot.so.0 [0xb773ddff] -> /usr/lib/dovecot/libdovecot.so.0(i_erro r+0) [0xb77198ee] -> dovecot/dict [0x80506aa] -> dovecot/dict [0x80506e6] -> dovecot/dict(sql_transaction_commit_s+0x20) [0x804f730] -> dovecot/dict [0x804de42] -> /usr/lib/dovecot/libdovecot.so. 0(dict_transaction_commit_async+0x2f) [0xb771e4ff] -> dovecot/dict [0x804c930] -> dovecot/dict [0x804c35d] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run+0xe2) [0xb774a2d2] -> /usr/lib/d ovecot/libdovecot.so.0(io_loop_run+0x30) [0xb7749320] -> /usr/lib/dovecot/libdovecot.so.0(master_service_run+0x2a) [0xb7736dfa] -> dovecot/dict(main+0x19c) [0x804d00c] -> /lib/tls/i686/cmov/libc. so.6(__libc_start_main+0xe6) [0xb72dab56] -> dovecot/dict [0x804c051] Mar 27 11:45:51 ubuntu-test postfix/qmgr[2335]: 0F22B27F0D: removed Mar 27 11:45:51 ubuntu-test dovecot: lmtp(5262): read(/var/run/dovecot/dict) failed: Remote disconnected Mar 27 11:45:51 ubuntu-test dovecot: lmtp(5262): Disconnect from local: Client quit Thanks, e-frog ------------------------------------------------------------------------- # 2.0.beta4: /etc/dovecot/dovecot.conf # OS: Linux 2.6.31-20-generic-pae i686 Ubuntu 9.10 auth_debug = yes auth_socket_path = /var/run/dovecot/auth-userdb auth_username_format = %Ln deliver_log_format = msgid=%m: from=%f: %$ dict { dictionary = mysql:/etc/dovecot/dovecot-dict-sql.conf } disable_plaintext_auth = no lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes mail_debug = yes namespace { hidden = no inbox = yes list = yes location = prefix = separator = / subscriptions = yes type = private } namespace { location = virtual:/etc/dovecot/virtual:INDEX=~/.maildir/control prefix = virtual/ separator = / subscriptions = no type = private } passdb { args = /etc/dovecot/dovecot-sql.conf driver = sql } plugin { fts = squat fts_squat = partial=4 full=10 quota = dict:user::proxy::dictionary sieve = ~/.dovecot.sieve sieve_before = /etc/dovecot/sieve-global/ sieve_dir = ~/.sieve } postmaster_address = postmaster@ubuntu-test protocols = imap lmtp managesieve quota_full_tempfail = yes sendmail_path = /usr/lib/sendmail service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } unix_listener auth-userdb { mode = 0666 } } service dict { unix_listener dict { mode = 0666 } } service lmtp { unix_listener /var/spool/postfix/dovecot-lmtp { group = postfix mode = 0660 user = postfix } } service managesieve-login { inet_listener sieve_deprecated { port = 2000 } } ssl_cert = </etc/ssl/certs/dovecot.pem ssl_key = </etc/ssl/private/dovecot.pem userdb { args = /etc/dovecot/dovecot-sql.conf driver = sql } verbose_proctitle = yes protocol managesieve { mail_plugins = virtual } protocol lmtp { mail_plugins = virtual quota sieve } protocol lda { info_log_path = /var/log/deliver.log log_path = /var/log/deliver.log mail_plugins = virtual quota sieve } protocol imap { mail_plugins = quota imap_quota fts fts_squat virtual }

1 0