- dovecot - dovecot.org

Re: [Dovecot] nosql (it was mogilefs)
by fernando＠dfcom.com.br 12 Mar '10

12 Mar '10

Yes, I´ve read these doc. I was just considering if someone had any experience with Mogile in email environment. Well, actually I´m trying to figure out if one of those nosql systems can store and scale email systems (ie, mailboxes - instead of maildir). I know mysql is always quoted as an option and discussed sometimes in the list. I think it´s an unnecessary overhead and bottleneck. As brainstorm. How about Cassandra, Tokyo-Tirant, Redis, and so on. Have you ever worked or tested one of them at production or even testing environment ? What do you think ? Best Regards, Fernando >---- Original Message ---- >From: Robert Schetterer <robert(a)schetterer.org> >To: dovecot(a)dovecot.org >Sent: Qua, Mar 10, 2010, 4:46 PM >Subject: Re: [Dovecot] mogilefs > >Am 10.03.2010 20:23, schrieb fernando(a)dfcom.com.br: >> Hi list, >> >> Have you ever heard or tried mogilefs? (http://danga.com/mogilefs/) >> >> Do you think suitable for dovecot/mail environments ? >> >> Regards, >> Fernando >> > >sounds not ready for mail > >MogileFS is not: > > * POSIX Compliant -- you don't run regular Unix applications or >databases against MogileFS. It's meant for archiving write-once files >and doing only sequential reads. (though you can modify a file by way of >overwriting it with a new version) Notes: > o Yes, this means your application has to specifically use a >MogileFS client library to store and retrieve files. The steps in >general are 1) talk to a tracker about what you want to put or get, 2) >read/write to one of the places it told you you could (it'll pick >storage node(s) for you as part of its load balancing), using HTTP GET/PUT > o We've prototyped a FUSE binding, so you could use MogileFS >without application support, but it's not production-ready. > > >-- >Best Regards > >MfG Robert Schetterer > >Germany/Munich/Bavaria

2 1

[Dovecot] patch: allow proxy to lookup host by name
by Martin F. Foster 12 Mar '10

12 Mar '10

This patch allows the dovecot proxy processes to lookup the destination host by name instead of IP address. Tested agains 1.2.10, expected to work against 1.2.11. The patch is pretty straightforward, it's making it work within the restrictions of the login process that's more interesting. I have made some changes to the wiki (pending approval) to - enhance the discussion of proxy with LDAP http://wiki.dovecot.org/PasswordDatabase/ExtraFields/Proxy - discuss the implication of this patch w.r.t. the login_chroot configuration parameter: http://wiki.dovecot.org/PasswordDatabase/ExtraFields/Proxy/HostLookup Feedback is appreciated, particulary from a security standpoint. Cheers, -Martin Foster martin_foster(a)netlog.net dump of wiki info, for the lazy. It will look better if viewed from the URL: http://wiki.dovecot.org/PasswordDatabase/ExtraFields/Proxy/HostLookup For all released versions of Dovecot, the "host" referred to in a proxy or proxy_maybe lookup must be an IP address see: the main PasswordDatabase/ExtraFields/Proxy <http://wiki.dovecot.org/PasswordDatabase/ExtraFields/Proxy> page for more info A patch is available to enable lookups, but it has some imporant caveats due to the nature of the LoginProcess <http://wiki.dovecot.org/LoginProcess> that the proxy function is a part of. This page exists to discuss these. The Problem Proxying is done from the dovecot login processes, both pop3-login & imap-login call code in src/login-common/login-proxy.c to handle the proxying to the given host. If the host is not an IP address, name resolution must be done. Two options from dovecot's configuration: 1. Dovecot running with roots Dovecot is started as root and drops privileges later; this is the recommended way of running Dovecot. Set by the config option: login_chroot = yes. In this mode, the login process is chrooted to login_dir, from which the proposed patch adds name resolution. Resolution is done via dovecot's net_gethostbyname() function - a wrapper for getaddrinfo/gethostbyname depending on compile-time platform support. These functions need access to the name service switch configuration, then whatever dependencies are required to consult the host resolution databases stipulated. so, if the /etc/nsswitch.conf hosts entry is: hosts: dns files Then the system will need access to /etc/resolv.conf and the nss_dns libraries for "dns" lookup, and /etc/hosts for "files" lookup. The exact files will vary by platform/operating system, but these all need to be available in the chroot for the lookup to succeed. and, if dovecot.conf has: login_chroot = yes login_dir = /var/run/dovecot/login login_user = dovecotuser Then for the nsswitch.conf entry above, the following files need to be copied (not symbolically linked!) to the chroot. This example is for a 64-bit RHEL5 system, with 64-bit dovecot daemon. Ownership of the new directories must be set to whatever the login_user is set to. mkdir /var/run/dovecot/login/etc mkdir /var/run/dovecot/login/lib64 cp /etc/nsswitch.conf /etc/resolv.conf /etc/hosts /var/run/dovecot/login/etc cp /lib64/libnss_dns.so.2 /var/run/dovecot/login/lib64 chown -R dovecotuser:dovecotuser /var/run/dovecot/login/etc chown -R dovecotuser:dovecotuser /var/run/dovecot/login/lib64 Remember that the ownership of the login_dir itself *must not* be changed. So: # ls -ld /var/run/dovecot/login/ drwxr-x--- 4 root dovecotuser 4096 Mar 12 06:48 /var/run/dovecot/login/ Troubleshooting If the lookup fails because of a perceived lookup-in-chroot issue, an error message of this form will be printed to the logs dovecot: pop3-login: proxy(test(a)domain1.test): cannot resolve mailhost.domain1.test. If name resolution is working outside dovecot, it may be a chroot issue. See LoginProcess on wiki, and login_dir& login_chroot in config. Clients will receive a much less descript general error message, for example with POP3: -ERR [IN-USE] Account is temporarily unavailable. Things to check 1. does name resolution work for normal users? the dovecot user? 2. are all the files required by the Name Service Switch's configuration available? Use a process tracing tool such as strace or truss against the pop3-login or imap-login processes to check. 3. are other security measures interfering? eg: 1. SELinux <http://en.wikipedia.org/wiki/Security-Enhanced_Linux> (RedHat <http://www.redhat.com/rhel/> EL, CentOS, Oracle EL) 2. AppArmor <http://en.wikipedia.org/wiki/AppArmor> (SuSE, Ubuntu?) 3. RBAC (Solaris, OpenSolaris <http://en.wikipedia.org/wiki/Open_Solaris>) Caveats This procedure allows the chroot'ed login to do something, which forms a security risk if the libraries in the chroot are exploitable. It will be up to the operator to ensure that the copy of the files in the chroot get updated whenver the copies in the real filesystem do. On systems where the chroot is on the same filesystem/partition that the original file copies are, hard links (again: no soft links!) could be used to accomplish this. 2. Dovecot running without roots (RootLess) Dovecot is started as whatever user/group is used to start the master daemon. See the discussion on Rootless <http://wiki.dovecot.org/HowTo/Rootless> for reasons why this is not the recommended way of running Dovecot, which includes a discussion on how this is more likely to be less secure. In dovecot.conf, rootless is selected by setting: login_chroot = no In this mode, the login process will have access to the required Name Service Switch configuration files and their dependencies if the user that started dovecot did. No further configuration is required for the proxy process to lookup hostnames.

4 3

[Dovecot] Scalability plans: Abstract out filesystem and make it someone else's problem
by Timo Sirainen 12 Mar '10

12 Mar '10

This is something I figured out a few months ago, mainly because this one guy at work (hi, Stu) kept telling me my multi-master replication plan sucked and we should use some existing scalable database. (I guess it didn't go exactly like that, but that's the result anyway.) So, my current plan is based on a couple of observations: * Index files are really more like memory dumps. They're already in an optimal format for keeping them in memory, so they can be just mmap()ed and used. Doing some kind of translation to another format would just make it more complex and slower. * I can change all indexing and dbox code to not require any locks or overwriting files. I just need very few filesystem operations, primarily the ability to atomically append to a file. * Index and mail data is very different. Index data is accessed constantly and it must be very low latency or performance will be horrible. It practically should be in memory in local machine and there shouldn't normally be any network lookups when accessing it. * Mail data on the other hand is just written once and usually read maybe once or a couple of times. Caching mail data in memory probably doesn't help all that much. Latency isn't such a horrible issue as long as multiple mails can be fetched at once / in parallel, so there's only a single latency wait. So the high level plan is: 1. Change the index/cache/log file formats in a way that allows lockless writes. 2. Abstract out filesystem accessing in index and dbox code and implement a regular POSIX filesystem support. 3. Make lib-storage able to access mails in parallel and send multiple "get mail" requests in advance. (3.5. Implement async I/O filesystem backend.) 4. Implement a multi-master filesystem backend for index files. The idea would be that all servers accessing the same mailbox must be talking to each others via network and every time something is changed, push the change to other servers. This is actually very similar to my previous multi-master plan. One of the servers accessing the mailbox would still act as a master and handle conflict resolution and writing indexes to disk more or less often. 5. Implement filesystem backend for dbox and permanent index storage using some scalable distributed database, such as maybe Cassandra. This is the part I've thought the least about, but it's also the part I hope to (mostly) outsource to someone else. I'm not going to write a distributed database from scratch.. This actually should solve several issues: * Scalability, of course. It'll be as scalable as the distributed database being used to store mails. * NFS reliability! Even if you don't care about any of these alternative databases, this still solves NFS caching problems. You'd keep using the regular POSIX FS API (or async FS api) but with the in-memory index "cache", so only a single server is writing to mailbox indexes at the same time. * Shared mailboxes. The filesystem API is abstracted, so it should be possible to easily add another layer to handle accessing other users' mails from both local and remote servers. This should finally make it possible to easily support shared mailboxes with system users.

17 82

[Dovecot] troubles with expire plugin
by Denis Fateyev 11 Mar '10

11 Mar '10

Hello there, Now I'm using `expire` plugin and getting troubles with cronjob (from user `exim`): /usr/sbin/dovecot --exec-mail ext /usr/libexec/dovecot/expire-tool.sh Fatal: setgid(12(mail)) failed with euid=93(exim), gid=93(exim), egid=93(exim): Operation not permitted (This binary should probably be called with process group set to 12(mail) instead of 93(exim)) The same error occurs when I run this command from `exim` user with sudo. My dovecot v1.2.11 configuration: dovecot.conf ----------------- ... socket listen { master { path = /var/run/dovecot/auth-master mode = 0660 user = exim group = mail } client { path = /var/spool/exim/private-auth mode = 0660 user = exim group = mail } } ... userdb-sql.conf ------------------------ # exim uid: 93, mail gid: 12 user_query = SELECT CONCAT('/var/mail/', maildir) AS home, \ CONCAT('maildir:/var/mail/', maildir) AS mail, 93 AS uid, 12 AS gid, \ CONCAT('*:storage=', quota, 'B') AS quota_rule, \ 'storage=90%% /usr/libexec/dovecot/quota_warning.sh 90' AS quota_warning \ FROM mailbox WHERE username = '%u' AND active = '1' password_query = SELECT username AS user, password, \ CONCAT('/var/mail/', maildir) AS userdb_home, \ CONCAT('maildir:/var/mail/', maildir) AS userdb_mail, \ 93 AS userdb_uid, 12 AS userdb_gid, \ CONCAT('*:storage=', quota, 'B') AS userdb_quota_rule, \ 'storage=90%% /usr/libexec/dovecot/quota_warning.sh 90' AS userdb_quota_warning \ FROM mailbox WHERE username = '%u' AND active = '1' ( maybe, is any additional information required? ) All working fine with dovecot except this issue with `expire` plugin. How to avoid it? As I see, it's working if I run this command from `root` instead of `exim`, but I don't think it will be right to leave it in the root's crontab. Thanks, --- wbr, Denis.

1 0

[Dovecot] uid fetch/store always use the last uid when range is invalid
by Jean-Baptiste Vignaud 11 Mar '10

11 Mar '10

hello all; one colleague found a strange behavior, that can be annoying : -bash-3.1$ telnet 0 143 Trying 0.0.0.0... Connected to 0 (0.0.0.0). Escape character is '^]'. * OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE AUTH=PLAIN AUTH=CRAM-MD5] Dovecot ready. l login login pass l OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE SORT SORT=DISPLAY THREAD=REFERENCES THREAD=REFS MULTIAPPEND UNSELECT IDLE CHILDREN NAMESPACE UIDPLUS LIST-EXTENDED I18NLEVEL=1 CONDSTORE QRESYNC ESEARCH ESORT SEARCHRES WITHIN CONTEXT=SEARCH LIST-STATUS QUOTA] Logged in l select inbox * FLAGS (\Answered \Flagged \Deleted \Seen \Draft) * OK [PERMANENTFLAGS (\Answered \Flagged \Deleted \Seen \Draft \*)] Flags permitted. * 281 EXISTS * 0 RECENT * OK [UNSEEN 7] First unseen. * OK [UIDVALIDITY 1223038537] UIDs valid * OK [UIDNEXT 363] Predicted next UID * OK [HIGHESTMODSEQ 1] Highest l OK [READ-WRITE] Select completed. l uid fetch 363:* rfc822.size * 281 FETCH (UID 362 RFC822.SIZE 1559) l OK Fetch completed. and more annoying: l uid store 1000000:* +flags (\Seen \Deleted) * 281 FETCH (UID 362 FLAGS (\Deleted \Seen)) l OK Store completed. # 1.2.10: /xam/dovecot/etc/dovecot.conf # OS: Linux 2.6.22.14-72.fc6 i686 Fedora Core release 6 (Zod) ext3 base_dir: /opt/dovecot/var/run log_path: /opt/logs/dovecot/dovecot.log info_log_path: /opt/logs/dovecot-info.log protocols: imap pop3 managesieve listen(default): * listen(imap): * listen(pop3): * listen(managesieve): *:2000 ssl: no disable_plaintext_auth: no login_dir: /opt/dovecot/var/run/login login_executable(default): /xam/dovecot/libexec/dovecot/imap-login login_executable(imap): /xam/dovecot/libexec/dovecot/imap-login login_executable(pop3): /xam/dovecot/libexec/dovecot/pop3-login login_executable(managesieve): /xam/dovecot/libexec/dovecot/managesieve-login login_user: dovelog mail_location: maildir:/opt/vmail/%d/%n mail_cache_fields: imap.bodystructure, imap.body, mime.parts, flags, date.sent, date.received, size.virtual, size.physical mail_executable(default): /xam/dovecot/libexec/dovecot/imap mail_executable(imap): /xam/dovecot/libexec/dovecot/imap mail_executable(pop3): /xam/dovecot/libexec/dovecot/pop3 mail_executable(managesieve): /xam/dovecot/libexec/dovecot/managesieve mail_plugins(default): quota imap_quota mail_plugins(imap): quota imap_quota mail_plugins(pop3): quota mail_plugins(managesieve): mail_plugin_dir(default): /xam/dovecot/lib/dovecot/imap mail_plugin_dir(imap): /xam/dovecot/lib/dovecot/imap mail_plugin_dir(pop3): /xam/dovecot/lib/dovecot/pop3 mail_plugin_dir(managesieve): /xam/dovecot/lib/dovecot/managesieve lda: postmaster_address: postmaster(a)linux15.xandmail.com sendmail_path: /opt/postfix/usr/sbin/sendmail auth_socket_path: /opt/dovecot/var/run/dovecot/auth-master sendmail_path: /xam/postfix/usr/sbin/sendmail mail_plugins: quota sieve log_path: /xam/logs/deliver/deliver.log info_log_path: /xam/logs/deliver/deliver.log auth default: mechanisms: plain cram-md5 apop user: dovecot passdb: driver: sql args: /opt/dovecot/etc/dovecot-mysql.conf userdb: driver: sql args: /opt/dovecot/etc/dovecot-mysql.conf socket: type: listen client: path: /opt/dovecot/var/run/dovecot/auth-client mode: 432 user: postfix group: postfix master: path: /opt/dovecot/var/run/dovecot/auth-master mode: 384 user: vmail group: vmail plugin: quota: dict:user::proxy::quotadict quota_rule: *:storage=100M quota_rule2: *:messages=1000000 sieve: %h/sieve/dovecot.sieve sieve_global_path: /xam/dovecot/etc/sieve/default sieve_global_dir: /xam/dovecot/etc/sieve sieve_dir: %h/sieve/ mail_log_max_lines_per_sec: 0 mail_log_group_events: no mail_log_events: delete undelete expunge copy mail_log_fields: uid box msgid size dict: quotadict: mysql:/opt/dovecot/etc/dovecot-dict-quota.conf path: /opt/dovecot/var/run/dict-server

2 3

[Dovecot] Howto disable imap listener in dovecot 2.0
by Erik Logtenberg 11 Mar '10

11 Mar '10

Hi, How do I disable the imap listener in dovecot 2.0-beta-3? I only want to enable the imaps listener. In previous dovecot versions I could specify: prototols = imaps But in dovecot 2.0 this is no longer possible (imap and imaps are now both enabled with "protocols = imap"). I already made ssl a requirement with: ssl = required This is in the global section. I commented out the imap listener in master.conf, but "dovecot -a" still shows the config for the imap listener, so I suppose it's default configuration. Can I explicitly tell dovecot to not open an imap listener, but only an imaps listener? Kind regards, Erik.

3 6

[Dovecot] mogilefs
by fernando＠dfcom.com.br 10 Mar '10

10 Mar '10

Hi list, Have you ever heard or tried mogilefs? (http://danga.com/mogilefs/) Do you think suitable for dovecot/mail environments ? Regards, Fernando

2 1

[Dovecot] Limit login attempts per connection?
by Tony Nelson 10 Mar '10

10 Mar '10

Dovecot allows a large number of login attempts per connection. I'd like to reduce that number to, say, 1, and let my firewall keep the ducks at bay, but I can't find anything in /etc/dovecot.conf or by googling. How do I do it? Do I need to patch the source? dovecot-1.1.10-1.x86_64 on CentOS 5.4 -- ____________________________________________________________________ TonyN.:' <mailto:tonynelson@georgeanelson.com> ' <http://www.georgeanelson.com/>

10 17

[Dovecot] Mailing list's prefix
by Timo Sirainen 10 Mar '10

10 Mar '10

Do you think I'd break a lot of people's filters if I removed the prefix? :) Anyone strongly for/against removing it? It seems kind of annoying to me whenever I happen to think about it.

31 52

[Dovecot] vacation script
by Papp Tamás 10 Mar '10

10 Mar '10

hi All, One of my users created this sieve script via roundcube's avelsieve implementation: # This script has been automatically generated by avelsieve # (Sieve Mail Filters Plugin for Squirrelmail) # Warning: If you edit this manually, then the changes will not # be reflected in the users' front-end! #AVELSIEVE_VERSIONYTo0OntzOjU6Im1ham9yIjtpOjE7czo1OiJtaW5vciI7aTo5O3M6NzoicmVsZWFzZSI7aTo3O3M6Njoic3RyaW5nIjtzOjU6IjEuOS43Ijt9 #AVELSIEVE_CREATED1268148005 #AVELSIEVE_MODIFIED1268148005 require ["fileinto","envelope","reject","vacation","relational","comparator-i;ascii-numeric","regex","body"]; if #START_SIEVE_RULEYTo2OntzOjQ6ImNvbmQiO2E6MTp7aTowO2E6MTp7czo0OiJ0eXBlIjtzOjM6ImFsbCI7fX1zOjQ6InR5cGUiO3M6MToiMSI7czo2OiJhY3Rpb24iO3M6MToiNiI7czoxMzoidmFjX2FkZHJlc3NlcyI7czoyMToic2lrZXQuZ2Fib3JAY2VudGVyLmh1IjtzOjg6InZhY19kYXlzIjtzOjE6IjciO3M6MTE6InZhY19tZXNzYWdlIjtzOjUzNzoiMjAxMC4gbeFyY2l1cyA5IC0gMTkga%2FZ69nR0IHN6YWJhZHPhZ29uIHZhZ3lvaywgDQpsZXZlbGVpbWV0IGxlZ2hhbWFyYWJiIG3hcmNpdXMgMjIt6W4gZm9nb20gb2x2YXNuaS4NCg0KVOF2b2xs6XRlbSBhbGF0dCBr6XJlbSwgaG9neSBz%2FHJn9XMgZXNldGJlbiBrb2xs6WfhaW1hdCBrZXJlc3NlLg0KDQpDc%2BFraSBab2x04W4gLSD8emVtZWx0ZXTpcw0KdGVsOiAwNiAxIDk5OSA0NDYwDQplLW1haWw6IGNzYWtpLnpvbHRhbkBjZW50ZXIuaHUNCg0KS2VyZXNrZWRlbG1pIPxneWVrYmVuIGtvbGzpZ%2BFpbSBhIGtlcmVza2VkZWxlbUBjZW50ZXIuaHUgZW1haWwgY%2B1tZW4sDQppbGxldHZlIGEgMDYgMSA5OTkgNDQ2MCB0ZWxlZm9uc3rhbW9uIOFsbG5hayByZW5kZWxrZXrpc%2BlyZS4gDQoNCg0K3GR29npsZXR0ZWw6DQpTaWtldCBH4WJvcg0KDQpDRU5URVIuSFUgS2Z0Lg0KIA0KSXJvZGE6IDExMzMgQnVkYXBlc3QsIFbhZyB1LiAxMy4NClRlbDogKDM2MSkgOTk5IDQ0NjAsIDk5OSA0NDYxDQpGYXg6ICgzNjEpIDk5OSA0NDYyLCA5OTkgNDQ5OQ0KIjt9END_SIEVE_RULE true { vacation :days 7 :addresses ["user(a)domain.hu"] text: 2010. mA(A;rcius 9 - 19 kA(s'zA(s'tt szabadsA(A;gon vagyok, ^M leveleimet leghamarabb mA(A;rcius 22-A(n fogom olvasni.^M [...some more text...] ^M TA(A;vollA(tem alatt kA(rem, hogy sA(z'rgL's esetben kollA(gA(A;imat keresse.^M ^M ^M .^M ; } The text is in hungarian. The autoreply function is wors fine, but the email address are not saved, so when the sender sents more mail, an autoreply email is received again and again. Dovecot version is 1.2.10-0~auto+106 from http://xi.rename-it.nl/debian/ . Is this a bug or maybe I miss something? Is there any dovecot option about this? Thank you, tamas

4 4