- dovecot - dovecot.org

[Dovecot] Disabling users whilst still allowing logins with a 'master password'
by Dominic Hargreaves 05 May '09

05 May '09

Hi, I'm having trouble coming up with an authentication configuration that does what we want with dovecot, and thought it would be worth passing it by the list in case anyone can spot an easy fix, or confirm my suspicions that code changes are required. You should probably be aware that this is to support a migration away from Dovecot to a certain Microsoft-provided mail platform, so if this makes you feel uncomfortable, you may choose not to respond ;) We have the following configuration: - the passdb in use is pam (for pam_krb5) - the userdb in use is passwd (for nss_ldap) - GSSAPI is also supported - We support both IMAP and POP - Dovecot 1.0.9 - users have their own uid/gid and the following requirement, in order to support the migration process: - Access to mailstore should be allowed by means of a master password or user (ideally configurable, so we have a fine degree of control over which users are exposed to the migration process at a given time) - Migration process accesses mailstore via IMAP - During migration, users should not be allowed to log in with their Kerberos password, nor with GSSAPI We've achieved the first requirement with master passwords roughly as described at the bottom of http://wiki.dovecot.org/Authentication/MasterUsers by configuring another passdb with the master password hash in place for the users we want to be enabled to migrate. Our standard auth config looks like: auth default { gssapi_hostname = imap210.herald.ox.ac.uk mechanisms = plain login gssapi passdb pam { } userdb passwd { args = blocking=yes } socket listen { master { path = /var/run/dovecot/auth-master } } } and my first try at satisfying my requirements was: auth default { gssapi_hostname = imap-dev.herald.ox.ac.uk mechanisms = plain login gssapi passdb sql { args = /etc/dovecot/dovecot-sql-master.conf } passdb sql { args = /etc/dovecot/dovecot-sql-deny.conf deny = yes } passdb pam { } userdb passwd { args = blocking=yes } socket listen { master { path = /var/run/dovecot/auth-master } } } where /etc/dovecot/dovecot-sql-master.conf describes a query representing those users accessible by the master password (and a hash of the master password) and /etc/dovecot/dovecot-deny.conf describes a query representing those users who should not be allowed to log in with their normal password (or GSSAPI). This almost works, but unfortunately (as documented) the GSSAPI mechanism does not check any passdbs, so does not get checked against the deny passdb. Normally to disable logins for a user we chmod their mail store to 0 so they can't access it, which has the same effect, but this obviously also prevents the master password from being able to access it. It would seem to be generally useful to be able to check GSSAPI logins against a deny passdb, but is this a valid code change? Alternatively, could the *userdbs* could be extended to cope with the idea of a deny form, since the GSSAPI login process already uses them (although it would have to return USERDB_RESULT_USER_UNKNOWN). Alternatively, does anyone have any other ideas about how I could achieve the same effect? Thanks for listening. Dominic. -- Dominic Hargreaves, Systems Development and Support Team Computing Services, University of Oxford

3 5

Re: [Dovecot] Unexplainable problem with POP3 quotas
by Marco Marongiu 05 May '09

05 May '09

Hello Rick, and thanks for replying First of all, the attached script had an error (I attached the wrong one :-\, the "export" line reads: export PATH="/usr/bin:/bin" 2009/4/30 <dovecot(a)dovecot.org>: > > It's a dumb question, but you are running the script via cron or manually > right? (dovecot doesn't execute it in it's own). >From the documentation, I'd expect it does. In http://wiki.dovecot.org/Quota/1.1 I read: >>>You can configure Dovecot to run an external command when user's quota exceeds a specified limit. so I expect that it will run the script. Am I wrong? Ciao --bronto

2 4

Re: [Dovecot] Problem with BODYSTRUCTURE (wrong charset)
by Craig Craig 05 May '09

05 May '09

From: Timo Sirainen<tss(a)iki.fi> > On Mon, 2009-05-04 at 16:18 +0200, Craig Craig wrote: > > Content-Type: multipart/mixed; > > Message-ID:=<d2788bc14788ff16e67e63941937c1e1(a)foo.de>; > > boundary="000XMAIL000" > > The problem is the Message-ID parameter. It's not legal to have ':' > before '='. I added a workaround to v1.2+, but v1.1's code is different > and I'd rather not change it much anymore. > > http://hg.dovecot.org/dovecot-1.2/rev/05a98aaf0aaf > Thanks, I had already figured out that it somehow depended on the headers and that helped a lot! :) For the archive: another problem was, that the Message-ID was not unique...and putting it between "Content-Type" and "boundary" does not seem to be a good idea at all... Thanks, Craig

1 0

Re: [Dovecot] fts-solr plugin issue (Marked invalid)
by Nikolai Derzhak 05 May '09

05 May '09

Send mail body with wrong Content-Type. If put this in maildir indexing raise 500 error. If fix Content-Type to "application/octet-stream" all OK. Because TEXT/*; content dovecot try to index and solr raise 500, on each search. On Tue, 05/05/2009 at 3:01pm, "Nikolai Derzhak" <nikolai(a)6zap.com> wrote: > On Mon, 05/04/2009 at 6:23pm, "Timo Sirainen" <tss(a)iki.fi> wrote: >> On May 4, 2009, at 10:16 AM, Nikolai Derzhak wrote: >> >>> OK. Concentrating problem in one question. >>> How to ignore "bad" message and index next one in indexing procedure >>> (fts plugin) ?. >>> Now, one "error 500" from solr and dovecot (# 1.1.11: /etc/dovecot/ >>> dovecot.conf >>> # OS: Linux 2.6.21.7-2.fc8xen i686 Ubuntu 8.04.2 ext3 >>> ) stop and each next search query repeat the story. >> >> Maybe simply using 1.1.14 would help? I already fixed one Solr issue: http:/ >> / >> hg.dovecot.org/dovecot-1.1/rev/678c3252a454 >> > I've merge back this commit to 1.1.11 code, cause this is my request about > special chars ;). > >> If that's not the problem, it would help to have one of those mails >> that breaks it. > Yes. Now i have two new issue: > 1. "Content-Type:" header in mail wrong - so it's TEXT/mspowerpoint for > example, but it's binary *.ppt file. > 2. many html from repository change-set(many commit's to html) in text/plain > mail > > In both cases we have "Error 500" from solr (HTMLStripReader class) (in solr > log: "Marked inlalid"). > And in both cases we can not detect this in dovecot code (or it's hard to do) > . > So for now i need some method to ignore "bad" messages. > Because we can not catch all variants, but indexing die on first error like > this. > > > > Powered by the 6zap. Sign up at http://www.6zap.com for an account that > provides advanced e-mail, calendar and contacts capabilities. Powered by the 6zap. Sign up at http://www.6zap.com for an account that provides advanced e-mail, calendar and contacts capabilities.

1 0

Re: [Dovecot] fts-solr plugin issue (Marked invalid)
by Nikolai Derzhak 05 May '09

05 May '09

On Mon, 05/04/2009 at 6:23pm, "Timo Sirainen" <tss(a)iki.fi> wrote: > On May 4, 2009, at 10:16 AM, Nikolai Derzhak wrote: > >> OK. Concentrating problem in one question. >> How to ignore "bad" message and index next one in indexing procedure >> (fts plugin) ?. >> Now, one "error 500" from solr and dovecot (# 1.1.11: /etc/dovecot/ >> dovecot.conf >> # OS: Linux 2.6.21.7-2.fc8xen i686 Ubuntu 8.04.2 ext3 >> ) stop and each next search query repeat the story. > > Maybe simply using 1.1.14 would help? I already fixed one Solr issue: http:// > hg.dovecot.org/dovecot-1.1/rev/678c3252a454 > I've merge back this commit to 1.1.11 code, cause this is my request about special chars ;). > If that's not the problem, it would help to have one of those mails > that breaks it. Yes. Now i have two new issue: 1. "Content-Type:" header in mail wrong - so it's TEXT/mspowerpoint for example, but it's binary *.ppt file. 2. many html from repository change-set(many commit's to html) in text/plain mail In both cases we have "Error 500" from solr (HTMLStripReader class) (in solr log: "Marked inlalid"). And in both cases we can not detect this in dovecot code (or it's hard to do). So for now i need some method to ignore "bad" messages. Because we can not catch all variants, but indexing die on first error like this. Powered by the 6zap. Sign up at http://www.6zap.com for an account that provides advanced e-mail, calendar and contacts capabilities.

1 0

[Dovecot] Maildir bugs
by Timo Sirainen 05 May '09

05 May '09

I just found out that when using deliver or saving mails with IMAP APPEND command there was all kinds of race condition bugs that could cause e.g.: dovecot-uidlist: Duplicate file entry at line 18: 1241457213.M690227P32531.host,W=3359:2,T (uid 170019 -> 170020) And who knows what else. If you've run into those problems, these patches should help: http://hg.dovecot.org/dovecot-1.1/rev/6bbe27c32cb8 http://hg.dovecot.org/dovecot-1.1/rev/003bebac2c76 http://hg.dovecot.org/dovecot-1.1/rev/96c8632775df They are pretty large though, hopefully won't break anything. But at least my stress tests can no longer break it. I'll probably release v1.1.15 RC in a few days so at least some people can try to break it before the final v1.1.15 :)

1 0

[Dovecot] questions about compiling Sieve plugin
by MercuryShadow 04 May '09

04 May '09

I'm using the info on the wiki to try to compile the sieve plugin for dovecot on a server running Debian Etch, but I'm getting nowhere because I'm stuck trying to find the directory to use in the "--with-dovecot=" argument when running the configure script. The wiki says: Compilation is identical among the CMUSieve and the new Sieve plugin. Use --with-dovecot=<path> to point to dovecot-config file's directory. There are two possibilities where this could exist: 1. If you configured Dovecot with --enable-header-install, you'll have dovecot-config installed in $prefix/lib/dovecot/ directory. 2. Compiled Dovecot sources' root directory. The problem is that there is no such file called "dovecot-config" on the server, and dovecot was installed from the Debian repositories, not compiled. There is no /usr/lib/dovecot or /usr/local/lib/dovecot. I figured that, as is the case with many Debian packages, the libraries needed to compile would be included in a "dovecot-dev" package, but I checked and there is no such package in the Debian repos. Does anyone know what I need to do in order to get this plugin compiled? -- View this message in context: http://www.nabble.com/questions-about-compiling-Sieve-plugin-tp23285989p232… Sent from the Dovecot mailing list archive at Nabble.com.

2 8

[Dovecot] Problem with BODYSTRUCTURE (wrong charset)
by Craig Craig 04 May '09

04 May '09

Hi, I've changed a program that fetches mail via IMAP from an Exchange Server to use our Dovecot machine. But now I'm experiencing strange problems with seem to be caused by a wrong BODYSTRUCTURE answer that causes wrong charset handling. When fetchting the BODYSTRUCTURE I see this: Dovecot: 88 UID fetch 32 (BODYSTRUCTURE) * 1 FETCH (UID 32 BODYSTRUCTURE ("text" "plain" ("charset" "us-ascii") NIL NIL "7bit" 725664 9385 NIL NIL NIL NIL)) 88 OK Fetch completed. Exchange: 90 UID fetch 10 (BODYSTRUCTURE) * 2 FETCH (BODYSTRUCTURE (("TEXT" "PLAIN" ("charset" "iso-8859-1") NIL NIL "QUOTED-PRINTABLE" 2784 47 NIL NIL NIL)("IMAGE" "JPEG" ("name" "197254.jpg") NIL NIL "BASE64" 498806 NIL ("attachment" ("filename" "197254.jpg")) NIL)("IMAGE" "JPEG" ("name" "197254_1.jpg") NIL NIL "BASE64" 188424 NIL ("attachment" ("filename" "197254_1.jpg")) NIL)("IMAGE" "JPEG" ("name" "197254_2.jpg") NIL NIL "BASE64" 31878 NIL ("attachment" ("filename" "197254_2.jpg")) NIL)("TEXT" "PLAIN" ("name" "pix.xml") NIL NIL "QUOTED-PRINTABLE" 2934 49 NIL ("attachment" ("filename" "pix.xml")) NIL)("TEXT" "PLAIN" ("CHARSET" "US-ASCII") NIL NIL "7BIT" 0 1 NIL ("attachment" NIL) NIL) "mixed" ("Message-ID:" "<d2788bc14788ff16e67e63941937c1e1(a)foo.de>" "boundary" "000XMAIL000") NIL NIL) UID 10) 90 OK FETCH completed. Mail contents were: [...] To: blah(a)foo.de Subject: Pictures From: blah2(a)foo.de CC: Errors-To: blah2(a)foo.de Sender: foobar(a)foo.de MIME-Version: 1.0 Content-Type: multipart/mixed; Message-ID:=<d2788bc14788ff16e67e63941937c1e1(a)foo.de>; boundary="000XMAIL000" Message-Id: <20090504120233.58AFC346FC(a)foo.de> Date: Mon, 4 May 2009 14:02:33 +0200 (CEST) --000XMAIL000 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: Quoted-Printable <?xml version=3D"1.0" encoding=3D"ISO-8859-1" ?> <foo> [...] --000XMAIL000 Content-Type: image/jpeg; name="197254.jpg" Content-Transfer-Encoding: Base64 Content-Disposition: attachment; filename="197254.jpg" [...] --000XMAIL000 Content-Type: text/plain; name="pix.xml" Content-Transfer-Encoding: Quoted-Printable Content-Disposition: attachment; filename="pix.xml" <?xml version=3D"1.0" encoding=3D"ISO-8859-1" ?>=0D <blah>=0D [...] Here is my dovecot -n output: # 1.1.14: /etc/dovecot/dovecot.conf # OS: Linux 2.6.21-gentoo-r1 i686 Gentoo Base System release 1.12.11.1 ext3 log_path: /var/log/dovecot protocols: imap imaps pop3 pop3s listen: [::] ssl_cert_file: /etc/ssl/dovecot/server.pem ssl_key_file: /etc/ssl/dovecot/server.key disable_plaintext_auth: no login_dir: /var/run/dovecot/login login_executable(default): /usr/libexec/dovecot/imap-login login_executable(imap): /usr/libexec/dovecot/imap-login login_executable(pop3): /usr/libexec/dovecot/pop3-login mail_privileged_group: vmail mail_location: maildir:/var/mail/%d/%n mail_executable(default): /usr/libexec/dovecot/imap mail_executable(imap): /usr/libexec/dovecot/imap mail_executable(pop3): /usr/libexec/dovecot/pop3 mail_plugin_dir(default): /usr/lib/dovecot/imap mail_plugin_dir(imap): /usr/lib/dovecot/imap mail_plugin_dir(pop3): /usr/lib/dovecot/pop3 auth default: mechanisms: plain login digest-md5 cram-md5 rpa apop username_translation: AaBbCcDdEeFfGgHhIiJjKkLlMmNnOoPpQqRrSsTtUuVvWwXxYyZz verbose: yes debug: yes debug_passwords: yes passdb: driver: passwd-file args: /etc/passwd.dovecot userdb: driver: passwd-file args: /etc/passwd.dovecot socket: type: listen client: path: /var/spool/postfix/private/auth mode: 432 user: postfix group: postfix master: path: /var/run/dovecot/auth-master mode: 432 user: root group: vmail So is this a parsing error in dovecot or was the Exchange Server just parsing incorrect MIME-Headers?! Any hint would be appreciated... Thanks in advance, Craig

2 1

Re: [Dovecot] fts-solr plugin issue (Marked invalid)
by Nikolai Derzhak 04 May '09

04 May '09

OK. Concentrating problem in one question. How to ignore "bad" message and index next one in indexing procedure (fts plugin) ?. Now, one "error 500" from solr and dovecot (# 1.1.11: /etc/dovecot/dovecot.conf # OS: Linux 2.6.21.7-2.fc8xen i686 Ubuntu 8.04.2 ext3 ) stop and each next search query repeat the story. I've explored fts, and ftp-solr directories in src, without success for now. Timo, you understand code much bettter, can you help me and point to place in code, or probably create some patch, if possible ?. On Fri, 05/01/2009 at 5:56pm, "Nikolai Derzhak" <nikolai(a)6zap.com> wrote: > Hi. > > We user ftp-solr plugin and have problem with solr-1.3+ > with HTMLStripWhitespaceTokenizerFactory (Solr schema in attachments). > In some maildir's present messages with wrong "Content-Type: " fields in > attachments. > For example: > " > Content-Type: TEXT/mspowerpoint; name="Zapatec_6zap_netvibes_1.ppt" > " > Indexing for this messages is stop with "fts_solr: Indexing failed: 500 > Internal Server Error". > In solr log is: > " > SEVERE: java.io.IOException: Mark invalid > at java.io.BufferedReader.reset(BufferedReader.java:485) > " > (mail list with discussion: http://markmail.org/message/2fnfiwygvehjngyr# > query:SEVERE%3A%20java.io.IOException%3A%20Mark%20invalid%20lucene+page:1+ > mid:2fnfiwygvehjngyr+state:results) > > Look's like dovecot try to index attachments like this. > Also for some messages we have same error. > Dovecot stop indexing of box and each search we have lag and CPU load on > server. > > So we need to make dovecot more "stable" to this error. > For first time , will be good, just ignore problematic messages with error > from solr. > > Let's discuss this issue, because this is general problem. > We ready to explore code where needed , etc. > > Regards, > Nikolai > > Powered by the 6zap. Sign up at http://www.6zap.com for an account that > provides advanced e-mail, calendar and contacts capabilities. Powered by the 6zap. Sign up at http://www.6zap.com for an account that provides advanced e-mail, calendar and contacts capabilities.

3 2

Re: [Dovecot] fts-solr plugin issue (Marked invalid)
by Nikolai Derzhak 04 May '09

04 May '09

On Mon, 05/04/2009 at 5:36pm, "Rui Carneiro" <rui.carneiro(a)portugalmail.net> wrote: > I do not have sure if I understood your problem correctly. > > Are you trying to index attachments from messages? Or Dovecot is indexing > some "bad" parts and you just do not know why? > Read first post, please, with description. But in sum: when dovecot try to index some mail's, that solr tokenizer not eat (error 500, Marked invalid), dovecot stop indexing of box and retry attempts in each next search with same result. > Regards, > Rui Carneiro > -- > Portugalmail, Comunicações S.A. > www.portugalmail.net > > Citando Nikolai Derzhak <nikolai(a)6zap.com>: > >> OK. Concentrating problem in one question. >> How to ignore "bad" message and index next one in indexing procedure (fts >> plugin) ?. >> Now, one "error 500" from solr and dovecot (# 1.1.11: >> /etc/dovecot/dovecot.conf >> # OS: Linux 2.6.21.7-2.fc8xen i686 Ubuntu 8.04.2 ext3 >> ) stop and each next search query repeat the story. >> I've explored fts, and ftp-solr directories in src, without success for now. >> >> Timo, you understand code much bettter, can you help me and point to place >> in >> code, >> or probably create some patch, if possible ?. Powered by the 6zap. Sign up at http://www.6zap.com for an account that provides advanced e-mail, calendar and contacts capabilities.

2 1