- dovecot - dovecot.org

[Dovecot] Dovecot SSL issues
by Spyros Tsiolis 29 Jan '10

29 Jan '10

Hello all, successfully managed to make dovecot work with horde (http://www.horde.org) and another MTA (SMTP/POP3). I have this nagging issue with dovecot though (I suspect - it's dovecot and not the rest of the packages, please read on): There is this special page one goes, that check if everything is ok with all the relevant software running along Horde. It's a php file called "test.php". Now, this file shows almost everything that happens in the box. Here's a transcript of what shows when it comes to dovecot and SSL : --------------------------- * Trying protocol imap/ssl, Port 993: ERROR - The server returned the following error message: SECURITY PROBLEM: insecure server advertised AUTH=PLAINCertificate failure for localhost: self signed certificate: /C=GR/ST=Kerkyra/L=Kerkyra/O=The Company Name/OU=IMAP server/CN=webmail.thecompanyname.gr/emailAddress=postmaster(a)webmail.thecompanyname.gr --------------------------- From what I understand, it doesn't like the certificate. However, I've followed a howto document step-by-step and did what is documented. Does anyone have any pointers on how to make secure imap for dovecot ? E.G. on ThunderBird, the settings are the following : Tools -> Account Settings -> Server Settings : Server Name : (the server or its ip address) Username : (the username) Port : (I've manually entered "993", because by default goes to "143") Security Settings -> Connection Security : SSL/TLS (again manually entered) CHECK_ON : Use secure authentication Now, if I click on "Get Mail" button on top of the TB window, I get a pop-up window with the following message : ------ Server : Location : <Servers' IP Address>:993 Certificate Status : This site attempts to identify itself with invalid information. Wrong Site : Certificate belongs to a different site, which could indicate an identity theft. Unknown Identity : Certificate is not trusted, because it hasn't been verified by a recognized authority. ------ After that, the users accepts the above by pressing ok twice. However, there's a third pop-up window with a message shown below : ------ You cannot log in to <servers' ip address> because you have enabled secure authentication and this serer does not support it. To log in, turn off secure authentication for this account. ------ Any help would be appreciated.. Thank you all for your patience, S. Tsiolis

3 2

Re: [Dovecot] dovecot auth feature request
by Frank Cusack 29 Jan '10

29 Jan '10

On January 29, 2010 7:11:59 PM +0200 Timo Sirainen <tss(a)iki.fi> wrote: > On Fri, 2010-01-29 at 12:01 -0500, Frank Cusack wrote: >> when i try to run dovecot for SASL support only, with literally just >> this configuration: >> >> protocols = none >> ssl = no > > I suppose you didn't mean to include "ssl=no" above? yes, sorry. that is the working config. > I guess the reason I'm telling you this is because I don't really want > to add something to v1.2 that'll just go away in v2.0. pretty trivial to just include that line in the config so no worries. -frank

1 0

[Dovecot] mdbox, dsync
by Timo Sirainen 29 Jan '10

29 Jan '10

I finally migrated my mails from mbox format to mdbox format using dsync: 1. Stop dovecot, wait a few seconds for processes to die 2. dsync convert mdbox:~/mdbox 3. Change mail_location to mdbox:~/mdbox 4. Check that no new mails arrived during conversion (alternatively I could have just run dsync again, but I decided not to test my luck) 5. Start dovecot After fixing a pretty bad bug in dsync and a couple of other unrelated bugs, everything seemed to work correctly and transparently. UIDs and everything was preserved as expected. I think I even feel my mail clients being faster than with mbox :) ~% du --exclude=.imap -bsh mail-old-mbox 707M mail-old-mbox ~% du -bsh mdbox/* 27M mdbox/mailboxes 704M mdbox/storage The reason why I'm giving -b is because without it, mdbox was a lot larger than mbox (734 MB vs. 710 MB). I guess this is because zfs internally decided to waste some space for the files. ~/mdbox/storage% ls -lS -rw------- 1 tss tss 13602413 2010-01-29 18:05 m.68 -rw------- 1 tss tss 10487382 2010-01-29 18:06 m.209 -rw------- 1 tss tss 7749964 2010-01-29 18:06 m.270 -rw------- 1 tss tss 7493010 2010-01-29 18:05 m.69 .. -rw------- 1 tss tss 2097246 2010-01-29 18:06 m.175 -rw------- 1 tss tss 2097213 2010-01-29 18:06 m.151 -rw------- 1 tss tss 2097173 2010-01-29 18:06 m.197 -rw------- 1 tss tss 2097163 2010-01-29 18:05 m.89 -rw------- 1 tss tss 1307164 2010-01-29 18:33 m.296 Total of 296 files. The reason why there are a few large files is because their last mail is huge. I guess in future mdbox should try to avoid doing that if it knows the mail's size beforehand. Actually I thought it already tried to do that.. Anyway, let's hope it doesn't now corrupt all my mails.

3 3

[Dovecot] dovecot auth feature request
by Frank Cusack 29 Jan '10

29 Jan '10

when i try to run dovecot for SASL support only, with literally just this configuration: protocols = none ssl = no auth default { mechanisms = plain login passdb passwd-file { args = /etc/dovecot/passwd } socket listen { client { path = /var/spool/postfix/private/auth mode = 0660 } } } I get this: Error: ssl_cert_file: Can't use /etc/ssl/certs/dovecot.pem: No such file or directory Since, in this configuration, SSL doesn't have meaning, dovecot shouldn't be looking for any cert file. Easily fixed with "ssl = no" but that shouldn't be required. -frank

2 1

[Dovecot] mailbox format w/ separate headers/data
by Frank Cusack 29 Jan '10

29 Jan '10

In the future, it would be cool if there were a mailbox format (dbox2?) where mail headers and each mime part were stored in separate files. This would enable the zfs dedup feature to be used to maximum benefit. In the zfs filesystem, there is a dedup feature which stores only 1 copy of duplicate blocks. In a normal mail file, the headers will be different for each recipient and the chances of the content of the message being able to be dedup'd are close to zero, because the differences in header length changes the block boundaries for the rest of the message. But if each mime part is stored in a separate file, you get massive compression "for free". -frank

5 16

[Dovecot] Master user and proxying
by BaQs 29 Jan '10

29 Jan '10

Hello list, Still need your help configuring proxy infrastructure. Today, I really struggle configuring master passwords forwarding. What I want: master user can connect to any other account, on proxy. Could please somebody help me, I read both articles about this on wiki, but still can't connect :( What I did: on proxy: auth_master_user_separator=* passdb sql { args = /usr/local/dovecot/etc/dovecot-master.conf master = yes pass = yes } -- dovecot-master.conf: (...) default_pass_scheme = CRYPT password_query = SELECT password FROM master_users WHERE username= '%u' AND status = 'ok' -- on destination server: auth_master_user_separator=* passdb sql { args = /usr/local/etc/dovecot-master.conf master = yes pass = yes } default_pass_scheme = CRYPT password_query = SELECT password FROM master_users WHERE username= '%u' AND status = 'ok' I also tried on proxy: password_query = SELECT NULL AS password, host, 'Y' AS nologin, 'Y' AS nodelay, 'Y' AS nopassword, 'Y' AS proxy,'%u' as user ,'%u*pierre' as destuser, '123' as pass FROM proxy WHERE domain = '%d' instead of password_query = SELECT NULL AS password, host, 'Y' AS nologin, 'Y' AS nodelay, 'Y' AS nopassword, 'Y' AS proxy,'%u' as user FROM proxy WHERE domain = '%d' it did not work :( -------- LOGS: -------- on destination server: [ID 583609 mail.info] auth(default): cache(pierre,127.0.0.1,master): expired [ID 583609 mail.info] auth-worker(default): sql(pierre,127.0.0.1): query: SELECT password FROM master_users WHERE username= 'pierre' AND status = 'ok' [ID 583609 mail.info] auth(default): passdb(pierre,127.0.0.1,master): Master user logging in as account(a)test.fr*pierre [ID 583609 mail.info] auth(default): cache(account(a)test.fr*pierre,127.0.0.1): miss [ID 583609 mail.info] auth-worker(default): sql(account(a)test.fr*pierre,127.0.0.1): query: SELECT CONCAT(pw_name, '@', pw_domain) AS user, pw_passwd AS password FROM vpopmail WHERE pw_name = 'julien' AND pw_domain = 'demarey.fr*pierre' [ID 583609 mail.info] auth-worker(default): sql(account(a)test.fr*pierre,127.0.0.1): unknown user [ID 583609 mail.info] auth(default): new auth connection: pid=8162 [ID 583609 mail.info] auth(default): client out: FAIL 1 user=account(a)test.fr*pierre authz on proxy: auth(default): client in: AUTH 2 PLAIN service=imap secured lip=127.0.0.1 rip=127.0.0.1 lport=143 rport=39978 resp= auth(default): cache(pierre,127.0.0.1,master): hit: user=pierre auth(default): passdb(pierre,127.0.0.1,master): Master user logging in as account(a)test.fr auth(default): cache(account(a)test.fr,127.0.0.1): miss auth-worker(default): sql(account(a)test.fr,127.0.0.1): query: SELECT NULL AS password, host, 'Y' AS nologin, 'Y' AS nodelay, 'Y' AS nopassword, 'Y' AS proxy,'account(a)test.fr' as user ,'account(a)test.fr*pierre' as destuser, '123' as pass FROM proxy WHERE domain = 'demarey.fr' auth(default): client out: OK 2 user=account(a)test.fr host=10.0.44.20 nologin proxy destuser=account(a)test.fr*pierre pass= master=pierre imap-login: proxy(account(a)test.fr): Login failed to 10.0.44.20:143/account@test.fr*pierre (master pierre): [AUTHORIZATIONFAILED] Authorization failed [ID 583609 mail.info] imap-login: Disconnected (auth failed, 1 attempts): user=, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, secured both use dovecot version 1.2.9

2 1

Re: [Dovecot] How do I make dovecot not use sslv2 for pop?
by Andreas Schulze 29 Jan '10

29 Jan '10

> From: Timo Sirainen <tss(a)iki.fi> > Subject: Re: [Dovecot] How do I make dovecot not use sslv2 for pop? > Message-ID: <1264724551.22202.139.camel@hurina> > > Anyway.. I guess I should do something about this. Not really sure what, > though. Timo, you can simply stop supporting SSLv2. Nobody really needs security known to be insecure. -- Andreas Schulze Internetdienste | P532 DATEV eG 90329 Nürnberg | Telefon +49 911 319-0 | Telefax +49 911 319-3196 E-Mail info @datev.de | Internet www.datev.de Sitz: 90429 Nürnberg, Paumgartnerstr. 6-14 | Registergericht Nürnberg, GenReg Nr.70 Vorstand Prof. Dieter Kempf (Vorsitzender) Dipl.-Kfm. Wolfgang Stegmann (stellvertretender Vorsitzender) Dipl.-Kfm. Michael Leistenschneider Jörg Rabe v. Pappenheim Dipl.-Vw. Eckhard Schwarzer Vorsitzender des Aufsichtsrates: Reinhard Verholen

3 2

[Dovecot] Courier-to-Dovecot-migration: Outlook downloads all Mails again
by Werner 29 Jan '10

29 Jan '10

Hi everybody, I'm currently playing through the migration from Courier to dovecot. I've converted the User's Maildir with 'courier-dovecot-migrate.pl'. Outlook 2003 is configured to access the Mailbox via POP3, the option "Leave a copy of messages on the server" is activated. But: after the migration Outlook 2000 redownloads all mails again :-( Could it be, that Outlook 2000 "thinks" (after changing the POP3/SMTP-Server in the Outlook configuration pointing to my testsystem) this is a new system and starts to download the messages again? If so, Outlook 2000 won't download all messages again if we do the migration because POP3/SMTP-Server remains the same. Can anybody confirm this? We do not experience this issue with Thunderbird for example. Thank you, Werner

2 2

[Dovecot] virtual users with mysql
by Andre Hübner 28 Jan '10

28 Jan '10

Hello List, we use in our system cryptical Usernames for dovecot etc. and authenticate users against shadow/passwd User abcde is loging in and gets data from /var/spool/mail/abcde and /home/popuser/abcde Now we want to make it possible that users can log in also with emailadresses. I tried dovecot-mysql authentication which works fine but i do not find a way to use 2 different login-formats in my queries. login with abcde and also testname(a)example.com should return ok and lead to /var/spool/mail/abcde. Is this possible or i have to make a decision which format to use? Thanks, Andre

2 2

[Dovecot] assertion mail-transaction-log-view.c
by David Halik 28 Jan '10

28 Jan '10

I'm not sure how useful this is with optimization turned back on, but here it is anyway. This was just a one off that happened last night: Jan 27 20:49:05 gehenna17.rutgers.edu dovecot: IMAP(user): fscking index file /rci/nqu/rci/u2/user/dovecot/.INBOX/dovecot.index Jan 27 20:49:05 gehenna17.rutgers.edu dovecot: IMAP(user): Panic: file mail-transaction-log-view.c: line 108 (mail_transaction_log_view_set): assertion failed: (min_file_seq <= max_file_seq) Jan 27 20:49:05 gehenna17.rutgers.edu dovecot: IMAP(user): Raw backtrace: /usr/libexec/dovecot/imap [0x49ede0] -> /usr/libexec/dovecot/imap [0x49ee43] -> /usr/libexec/dovecot/imap [0x49e4a6] -> /usr/libexec/dovecot/imap(mail_transaction_log_view_set+0x4ac) [0x486e1c] -> /usr/libexec/dovecot/imap(mail_index_sync_have_any+0x8f) [0x47c2bf] -> /usr/libexec/dovecot/imap [0x43cb8a] -> /usr/libexec/dovecot/imap(maildir_storage_sync_init+0x14e) [0x43cf0e] -> /usr/libexec/dovecot/imap(imap_sync_init+0x67) [0x4283e7] -> /usr/libexec/dovecot/imap(cmd_sync_delayed+0x174) [0x428634] -> /usr/libexec/dovecot/imap(client_handle_input+0x19e) [0x420c5e] -> /usr/libexec/dovecot/imap(client_input+0x5f) [0x42164f] -> /usr/libexec/dovecot/imap(io_loop_handler_run+0xf8) [0x4a6c68] -> /usr/libexec/dovecot/imap(io_loop_run+0x1d) [0x4a5d7d] -> /usr/libexec/dovecot/imap(main+0x620) [0x428f30] -> /lib64/libc.so.6(__libc_start_main+0xf4) [0x3ba081d994] -> /usr/libexec/dovecot/imap [0x419ad9] #0 0x0000003ba0830265 in raise (sig=<value optimized out>) at ../nptl/sysdeps/unix/sysv/linux/raise.c:64 pid = <value optimized out> selftid = <value optimized out> #1 0x0000003ba0831d10 in abort () at abort.c:88 act = Could not find the frame base for "abort". sigs = Could not find the frame base for "abort". #2 0x000000000049eded in default_fatal_finish (type=<value optimized out>, status=0) at failures.c:160 backtrace = 0x12be38a8 "/usr/libexec/dovecot/imap [0x49ede0] -> /usr/libexec/dovecot/imap [0x49ee43] -> /usr/libexec/dovecot/imap [0x49e4a6] -> /usr/libexec/dovecot/imap(mail_transaction_log_view_set+0x4ac) [0x486e1c] -> /us"... #3 0x000000000049ee43 in i_internal_fatal_handler (type=LOG_TYPE_PANIC, status=0, fmt=<value optimized out>, args=<value optimized out>) at failures.c:443 No locals. #4 0x000000000049e4a6 in i_panic (format=0x6 <Address 0x6 out of bounds>) at failures.c:207 args = {{gp_offset = 40, fp_offset = 48, overflow_arg_area = 0x7fff2d949840, reg_save_area = 0x7fff2d949780}} #5 0x0000000000486e1c in mail_transaction_log_view_set (view=0x12c56ee0, min_file_seq=<value optimized out>, min_file_offset=9520, max_file_seq=95, max_file_offset=24636, reset_r=0x7fff2d9498cf) at mail-transaction-log-view.c:108 file = <value optimized out> files = <value optimized out> start_offset = <value optimized out> i = <value optimized out> seq = <value optimized out> ret = <value optimized out> __PRETTY_FUNCTION__ = "mail_transaction_log_view_set" #6 0x000000000047c2bf in mail_index_sync_have_any (index=<value optimized out>, flags=<value optimized out>) at mail-index-sync.c:506 view = (struct mail_index_view *) 0x12c56c40 #7 0x000000000043cb8a in maildir_sync_context (ctx=0x12be3728, forced=false, find_uid=0x0, lost_files_r=0x7fff2d949967) at maildir-sync.c:697 sync_flags = <value optimized out> flags = 314502464 new_changed = false cur_changed = false lock_failure = <value optimized out> fname = 0x49d85b "L\211�H\213\\$\bL\213d$\020H\203�\030�\017\037" ret = <value optimized out> __PRETTY_FUNCTION__ = "maildir_sync_context" #8 0x000000000043cf0e in maildir_storage_sync_init (box=0x12bf2a98, flags=0) at maildir-sync.c:924 _data_stack_cur_id = 3 mbox = <value optimized out> ctx = (struct maildir_sync_context *) 0x12be3728 lost_files = <value optimized out> ret = 0 __PRETTY_FUNCTION__ = "maildir_storage_sync_init" #9 0x00000000004283e7 in imap_sync_init (client=0x12beed40, box=0x12bf2a98, imap_flags=IMAP_SYNC_FLAG_SAFE, flags=0) at imap-sync.c:146 ctx = (struct imap_sync_context *) 0x12bf78b0 __PRETTY_FUNCTION__ = "imap_sync_init" #10 0x0000000000428634 in cmd_sync_delayed (client=<value optimized out>) at imap-sync.c:592 cmd = <value optimized out> first_expunge = <value optimized out> first_nonexpunge = (struct client_command_context *) 0x80 __PRETTY_FUNCTION__ = "cmd_sync_delayed" #11 0x0000000000420c5e in client_handle_input (client=0x12beed40) at client.c:729 remove_io = false handled_commands = true __PRETTY_FUNCTION__ = "client_handle_input" #12 0x000000000042164f in client_input (client=0x12beed40) at client.c:753 cmd = <value optimized out> output = (struct ostream *) 0x12bf00e8 bytes = 15 __PRETTY_FUNCTION__ = "client_input" #13 0x00000000004a6c68 in io_loop_handler_run (ioloop=<value optimized out>) at ioloop-epoll.c:208 ctx = <value optimized out> event = (const struct epoll_event *) 0x12bec350 list = (struct io_list *) 0x12bf01c0 io = (struct io_file *) 0x12bfb760 tv = {tv_sec = 1799, tv_usec = 999417} events_count = <value optimized out> t_id = 2 msecs = <value optimized out> ret = 1 i = 0 call = <value optimized out> #14 0x00000000004a5d7d in io_loop_run (ioloop=0x12bec0f0) at ioloop.c:335 No locals. #15 0x0000000000428f30 in main (argc=<value optimized out>, argv=<value optimized out>, envp=0x7fff2d949c18) at main.c:327 No locals. -- ================================ David Halik System Administrator OIT-CSS Rutgers University dhalik(a)jla.rutgers.edu ================================

1 0