- dovecot - dovecot.org

[Dovecot] Postfix+Dovecot SASL+LDAP(AD)
by Vitaliy Vladimirovich 20 Nov '09

20 Nov '09

I have tried configure Postfix with Dovecot SASL to authenticate remote users in LDAP (Active Directory). Below my dovecot.conf: protocols = none ssl = none auth default { mechanisms = plain login passdb ldap { args = /usr/local/etc/dovecot-ldap.conf } userdb ldap { args = /usr/local/etc/dovecot-ldap-userdb.conf } } dovecot-ldap.conf hosts = 10.55.0.2:389 debug_level = 1 auth_bind = yes auth_bind_userdn = cn=%n,dc=example,dc=gov,dc=ua ldap_version = 3 base = dc=example, dc=gov, dc=ua scope = subtree ## 10.55.0.2 - Domain Controller ## But it does not work:-( Where is mistake? Below log: Nov 18 13:02:59 mx postfix/smtpd[12985]: connect from unknown[190.10.190.3] Nov 18 13:02:59 mx postfix/smtpd[12985]: setting up TLS connection from unknown[190.10.190.3] Nov 18 13:02:59 mx postfix/smtpd[12985]: Anonymous TLS connection established from unknown[190.10.190.3]: TLSv1 with cipher RC4-MD5 (128/128 bits) Nov 18 13:02:59 mx dovecot: auth(default): ldap_bind Nov 18 13:02:59 mx dovecot: auth(default): ldap_simple_bind Nov 18 13:02:59 mx dovecot: auth(default): ldap_sasl_bind Nov 18 13:02:59 mx dovecot: auth(default): ldap_send_initial_request Nov 18 13:02:59 mx dovecot: auth(default): ldap_send_server_request Nov 18 13:02:59 mx dovecot: auth(default): ldap_result ld 0x11847020 msgid -1 Nov 18 13:02:59 mx dovecot: auth(default): wait4msg ld 0x11847020 msgid -1 (timeout 0 usec) Nov 18 13:02:59 mx dovecot: auth(default): wait4msg continue ld 0x11847020 msgid -1 all 1 Nov 18 13:02:59 mx dovecot: auth(default): ** ld 0x11847020 Connections: Nov 18 13:02:59 mx dovecot: auth(default): * host: 10.55.0.2 port: 389 (default) Nov 18 13:02:59 mx dovecot: auth(default): refcnt: 2 status: Connected Nov 18 13:02:59 mx dovecot: auth(default): last used: Wed Nov 18 13:02:59 2009 Nov 18 13:02:59 mx dovecot: auth(default): Nov 18 13:02:59 mx dovecot: auth(default): Nov 18 13:02:59 mx dovecot: auth(default): ** ld 0x11847020 Outstanding Requests: Nov 18 13:02:59 mx dovecot: auth(default): * msgid 3, origid 3, status InProgress Nov 18 13:02:59 mx dovecot: auth(default): outstanding referrals 0, parent count 0 Nov 18 13:02:59 mx dovecot: auth(default): ld 0x11847020 request count 1 (abandoned 0) Nov 18 13:02:59 mx dovecot: auth(default): ** ld 0x11847020 Response Queue: Nov 18 13:02:59 mx dovecot: auth(default): Empty Nov 18 13:02:59 mx dovecot: auth(default): ld 0x11847020 response count 0 Nov 18 13:02:59 mx dovecot: auth(default): ldap_chkResponseList ld 0x11847020 msgid -1 all 1 Nov 18 13:02:59 mx dovecot: auth(default): ldap_chkResponseList returns ld 0x11847020 NULL Nov 18 13:02:59 mx dovecot: auth(default): ldap_int_select Nov 18 13:02:59 mx dovecot: auth(default): read1msg: ld 0x11847020 msgid -1 all 1 Nov 18 13:02:59 mx dovecot: auth(default): read1msg: ld 0x11847020 msgid 3 message type bind Nov 18 13:02:59 mx dovecot: auth(default): ldap_chase_referrals Nov 18 13:02:59 mx dovecot: auth(default): read1msg: V2 referral chased, mark request completed, id = 3 Nov 18 13:02:59 mx dovecot: auth(default): read1msg: ld 0x11847020 0 new referrals Nov 18 13:02:59 mx dovecot: auth(default): read1msg: mark request completed, ld 0x11847020 msgid 3 Nov 18 13:02:59 mx dovecot: auth(default): request done: ld 0x11847020 msgid 3 Nov 18 13:02:59 mx dovecot: auth(default): res_errno: 49, res_error: <80090308: LdapErr: DSID-0C090334, comment: AcceptSecurityContext error, data 525, vece>, res_matched: <> Nov 18 13:02:59 mx dovecot: auth(default): ldap_free_request (origid 3, msgid 3) Nov 18 13:02:59 mx dovecot: auth(default): ldap_parse_result Nov 18 13:02:59 mx dovecot: auth(default): ldap_parse_result Nov 18 13:02:59 mx dovecot: auth(default): ldap(test_user(a)example.org.ua,190.10.190.3): invalid credentials Nov 18 13:02:59 mx dovecot: auth(default): ldap_msgfree Nov 18 13:02:59 mx dovecot: auth(default): ldap_result ld 0x11847020 msgid -1 Nov 18 13:02:59 mx dovecot: auth(default): wait4msg ld 0x11847020 msgid -1 (timeout 0 usec) Nov 18 13:02:59 mx dovecot: auth(default): wait4msg continue ld 0x11847020 msgid -1 all 1 Nov 18 13:02:59 mx dovecot: auth(default): ** ld 0x11847020 Connections: Nov 18 13:02:59 mx dovecot: auth(default): * host: 10.55.0.2 port: 389 (default) Nov 18 13:02:59 mx dovecot: auth(default): refcnt: 1 status: Connected Nov 18 13:02:59 mx dovecot: auth(default): last used: Wed Nov 18 13:02:59 2009 Nov 18 13:02:59 mx dovecot: auth(default): Nov 18 13:02:59 mx dovecot: auth(default): Nov 18 13:02:59 mx dovecot: auth(default): ** ld 0x11847020 Outstanding Requests: Nov 18 13:02:59 mx dovecot: auth(default): Empty Nov 18 13:02:59 mx dovecot: auth(default): ld 0x11847020 request count 0 (abandoned 0) Nov 18 13:02:59 mx dovecot: auth(default): ** ld 0x11847020 Response Queue: Nov 18 13:02:59 mx dovecot: auth(default): Empty Nov 18 13:02:59 mx dovecot: auth(default): ld 0x11847020 response count 0 Nov 18 13:02:59 mx dovecot: auth(default): ldap_chkResponseList ld 0x11847020 msgid -1 all 1 Nov 18 13:02:59 mx dovecot: auth(default): ldap_chkResponseList returns ld 0x11847020 NULL Nov 18 13:02:59 mx dovecot: auth(default): ldap_int_select Nov 18 13:03:01 mx postfix/smtpd[12985]: warning: unknown[190.10.190.3]: SASL LOGIN authentication failed: UGFzc3dvcmQ6 Nov 18 13:03:01 mx postfix/smtpd[12985]: lost connection after AUTH from unknown[190.10.190.3]

2 2

[Dovecot] bug when creating /var/run/dovecot?
by Frank Cusack 20 Nov '09

20 Nov '09

dovecot-1.2.7 If /var/run/dovecot does not exist when dovecot starts up (e.g. required when /var/run is a tmpfs/ramfs), it creates it. But it creates it with the wrong file mode -- the directory is mode 777. Being world writable means any user could change the name of any file within the directory, including the login directory, and then create their own new login directory. Or remove the pid file, or perhaps cause other types of havoc. Comments? -frank

2 1

[Dovecot] Errors in strace
by Jeffrey Nikoletich 20 Nov '09

20 Nov '09

I keep getting the following when I do a strace on login processes in dovecot. Are there any issues with these errors: gettimeofday({1258671134, 941478}, {420, 0}) = 0 accept(4, 0x7fff3279b0d0, [28]) = -1 EAGAIN (Resource temporarily unavailable) epoll_wait(11, {{EPOLLIN, {u32=534434496, u64=534434496}}}, 46, 2147483647) = 1 gettimeofday({1258671135, 70395}, {420, 0}) = 0 accept(4, 0x7fff3279b0d0, [28]) = -1 EAGAIN (Resource temporarily unavailable) epoll_wait(11, {{EPOLLIN, {u32=534434688, u64=534434688}}}, 46, 2147483647) = 1 gettimeofday({1258671135, 167400}, {420, 0}) = 0 accept(6, 0x7fff3279b0d0, [28]) = -1 EAGAIN (Resource temporarily unavailable) epoll_wait(11, {{EPOLLIN, {u32=534434496, u64=534434496}}}, 46, 2147483647) = 1 gettimeofday({1258671135, 388157}, {420, 0}) = 0 accept(4, 0x7fff3279b0d0, [28]) = -1 EAGAIN (Resource temporarily unavailable) epoll_wait(11, {{EPOLLIN, {u32=534434496, u64=534434496}}}, 46, 2147483647) = 1 gettimeofday({1258671135, 570056}, {420, 0}) = 0 accept(4, 0x7fff3279b0d0, [28]) = -1 EAGAIN (Resource temporarily unavailable) epoll_wait(11, {{EPOLLIN, {u32=534434688, u64=534434688}}}, 46, 2147483647) = 1 gettimeofday({1258671135, 572030}, {420, 0}) = 0 Jeffrey N.

2 1

[Dovecot] Sieve compilation error
by Oli Schacher 20 Nov '09

20 Nov '09

Hi list Trying to get sieve for 1.2 running (dovecot sieve, not cmusieve) I'm running on centos 5.4 64bit, dovecot rpms installed from http://atrpms.net/dist/el5/dovecot/ ( dovecot-1.2.7-0_102.el5.x86_64.rpm and dovecot-devel-1.2.7-0_102.el5.x86_64.rpm ) I pulled the sieve sources ( hg clone http://hg.rename-it.nl/dovecot-1.2-sieve ) autogen.sh ./configure --with-dovecot=/usr/include/dovecot/ so far so good but make fails: [...] make[4]: Leaving directory `/work/dovecot-1.2-sieve/src/sieve-tools/debug' make[4]: Entering directory `/work/dovecot-1.2-sieve/src/sieve-tools' if gcc -DHAVE_CONFIG_H -I. -I. -I../.. -I../.. -I../../src/lib-sieve -I../../src/lib-sieve-tool -I./debug -I/usr/include/dovecot -I/usr/include/dovecot/src/lib -I/usr/include/dovecot/src/lib-mail -I/usr/include/dovecot/src/lib-index -I/usr/include/dovecot/src/lib-storage -I/usr/include/dovecot/src/deliver -std=gnu99 -O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector --param=ssp-buffer-size=4 -m64 -mtune=generic -Wall -W -Wmissing-prototypes -Wmissing-declarations -Wpointer-arith -Wchar-subscripts -Wformat=2 -Wbad-function-cast -Wstrict-aliasing=2 -I/usr/kerberos/include -MT sievec.o -MD -MP -MF ".deps/sievec.Tpo" -c -o sievec.o sievec.c; \ then mv -f ".deps/sievec.Tpo" ".deps/sievec.Po"; else rm -f ".deps/sievec.Tpo"; exit 1; fi make[4]: *** No rule to make target `/usr/include/dovecot/src/lib-storage/register/libstorage-register.a', needed by `sievec'. Stop. make[4]: Leaving directory `/work/dovecot-1.2-sieve/src/sieve-tools' make[3]: *** [all-recursive] Error 1 make[3]: Leaving directory `/work/dovecot-1.2-sieve/src/sieve-tools' make[2]: *** [all-recursive] Error 1 make[2]: Leaving directory `/work/dovecot-1.2-sieve/src' make[1]: *** [all-recursive] Error 1 make[1]: Leaving directory `/work/dovecot-1.2-sieve' make: *** [all] Error 2 Any hints? Thanks in advance Oli

3 3

Re: [Dovecot] Dovecot and SATA Backend - filesystems
by John Lyons 19 Nov '09

19 Nov '09

> The "generally don't see any bugs/issues" is the part I'm worried about > (generally isn't comforting). I was covering my **** on that one. Sods law dictates as soon as I say 'never' we'll discover an issue. > If you use a more traditional filesystem like ext2/ext3/ufs/etc then yes. > But you can use a cluster filesystem to get around this, and run > active-active. I've spent a week looking at the likes of PVFS, GFS, Lustre and a whole host of different systems, including pNFS (NFS 4.1) At the risk of diverting the thread away from the SATA backend, is there any recommendation for a fault tolerant file service. I'm really looking for 3 or 4 boxes to store data/metadata to support 10 Apache and Dovecot servers. The things I don't like are having a single metadata server be a single point of failure. Regards John

2 1

[Dovecot] Fwd: Re: Dovecot and SATA Backend
by Joseba Torre 19 Nov '09

19 Nov '09

I suppose this was for the list... -- Joseba Torre. Vicegerencia de TICs, área de Explotación

2 1

[Dovecot] configurable sieve_max_redirects
by Maciej Polewczyński 19 Nov '09

19 Nov '09

Witam Sieve implementation in dovecot 1.2 have hard-coded limit for max redirect: SIEVE_DEFAULT_MAX_REDIRECTS 4. I have to rise this to much higher value, e.g. 64. Is there possibility to do this another way than recompiling source? Maybe adding an option to dovecot.conf in plugin section will be a good idea. -- Pozdrowienia Maciej Polewczynski Registered Linux user #117725 OGICOM Sp. z o.o., 61-131 Poznan, ul. Baraniaka 88 REGON 634407251, NIP 781-17-20-476, KRS 0000140692 kapital zakladowy: 410 000 PLN

3 3

Re: [Dovecot] Combination of default domain and username character translation problem in POP3 server configuration
by Steffen Kaiser 19 Nov '09

19 Nov '09

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On Thu, 19 Nov 2009, Javier Vico Egea wrote: > In that case it works perfect but my problem are all the users using the old > vm-pop3 configuration with XXX!mysecondarydomain.es Yep, I just wanted confirmation :) There is currently no way to change this behaviour by configuration, but src/auth/auth-request.c contains function auth_request_fix_username(): The default domain is appended, before the character translation takes place. ======== if (strchr(username, '@') == NULL && request->auth->default_realm != NULL) { user = p_strconcat(request->pool, username, "@", request->auth->default_realm, NULL); } else { user = p_strdup(request->pool, username); } for (p = (unsigned char *)user; *p != '\0'; p++) { if (request->auth->username_translation[*p & 0xff] != 0) *p = request->auth->username_translation[*p & 0xff]; if (request->auth->username_chars[*p & 0xff] == 0) { *error_r = t_strdup_printf( "Username contains disallowed character: " "0x%02x", *p); return NULL; } } ========= I would change the first if() into: ========= if (strchr(username, '@') == NULL && strchr(username, '!') == NULL && request->auth->default_realm != NULL) { ========= Note the strchr() in the second line. The default domain is not appended, if either an Ad sign or exclamation mark is present in the username. Maybe, you ask Timo to have a way to conditionally let replace a set of characters into '@' before this check. Regards, - -- Steffen Kaiser -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.6 (GNU/Linux) iQEVAwUBSwVYSnWSIuGy1ktrAQI/4gf/TFGCcTnIaxWsZiRFi/P0iSr0uyPdFP8+ dQMgAVkYYt/sP7PH28vZbMHHtiBtIb7T3FTiuNclXXZcLrfj3NX3zf8XfNFknd4j BzcghW+wE+2I9v4O5/WmKRD79herBCGOTnswOMcRk9zPrIL2lEjuDhOFsePQXjTI IYBybQx+EebAYRUwtVgUc1leQtaD02QtFLLM2EbIbIbNhnYLaOr6+YQs2Ghi6LpL MAbfsRh00L/AmY5NNXZUPK2UKpTyppBxVMwwv+K12FqABzs6PAdQz8LpdwqrRDOX 7Raze+KD4U9M9imLVgcD8dgdRnl6wGQJnTFiA0kgb0fyEqk/pL/tpg== =KieQ -----END PGP SIGNATURE-----

1 0

Re: [Dovecot] Combination of default domain and username character translation problem in POP3 server configuration
by Steffen Kaiser 19 Nov '09

19 Nov '09

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On Thu, 19 Nov 2009, Javier Vico Egea wrote: > auth default: > default_realm: myprincipaldomain.es > username_chars: > abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ01234567890.-_@! > username_translation: !@ > passdb: > driver: passwd-file > args: /etc/virtual/%d/passwd Hmm, what happens, if you login with: prueba(a)mysecondarydomain.es ? Note the @ Does it work? > userdb: > driver: static > args: uid=500 gid=500 home=/var/spool/virtual/%d Each use should have an unique home dir, I think. Regards, - -- Steffen Kaiser -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.6 (GNU/Linux) iQEVAwUBSwVMWXWSIuGy1ktrAQIRiggArndG34u+zfOU41LXb8Nj6A5UMQ8o1cMv P8Ax+uKXyo9b7kae5N+ZeMkiVVMiALmMr6e7HJeKbTUdl6CFVc+Wa0TBdlpNVEJ0 d49A4IetnfVSWlfu21VR5hpenpsNE2E8JRHQ5Mb0eBaEFneT/VEk2YB7WfsmsvbF pS2gXhnBl1q8x+VtC/y5fyYB/P8urQU8wwdVTb809fLxUuMVDEUC77bHtXBtRHYT C0mF3ZyRmh3vFLwBb6e7VwhWkttbKlAzO7lsfNujEqA0dpjzeA+qOw+A2JmyH6sl ZTFpDWc/jv12+7m+AJB46CsPeKZ8/cfFVITni6G7aBrmGPseIVF3+w== =il6+ -----END PGP SIGNATURE-----

2 1

Re: [Dovecot] Combination of default domain and username character translation problem in POP3 server configuration
by Charles Marcus 19 Nov '09

19 Nov '09

On 11/19/2009, Javier Vico Egea (j.vico(a)dipualba.es) wrote: > # 1.0.7: /etc/dovecot.conf Not that this is the cause of your problem, but you do need to upgrade...

1 0