- dovecot - dovecot.org

[Dovecot] Moving IMAP folders to NFS volume.
by Frank Bonnet 09 Apr '09

09 Apr '09

Hello Due to lack of disk space on local disks I need to move all our imap folders to a NFS volume ( NetAPP filer ) I have a question about Dovecot indexes , is it better to remove all of them before copying folders to the NFS volume and let Dovecot rebuild all indexes when users restart to access to their imap folders ? Thanks a lot.

2 1

[Dovecot] Strange behavior of header_filter_callback
by Konstantin Lepa 09 Apr '09

09 Apr '09

Hello. I asked about the problem in http://markmail.org/message/zsry62fcig5hqka3 . And I created simple example plug-in for deliver. It is attached (I don't want to paste so much code) For compile in command-line run: # DOVECOT=<path to dovecot> gmake ...send mail... ...view dovecot lda log... # gmake clean # WITH_ONLY_HEADERS=1 DOVECOT=<path to dovecot> gmake ...send mail... ...view dovecot lda log... My log (notice strings start with #): deliver(pitman(a)virtualworld.com): Apr 08 13:52:39 Info: Loading modules from directory: /usr/local/lib/dovecot/lda deliver(pitman(a)virtualworld.com): Apr 08 13:52:39 Info: Module loaded: /usr/local/lib/dovecot/lda/lib90_example_plugin.so deliver(pitman(a)virtualworld.com): Apr 08 13:52:39 Info: auth input: uid=1002 deliver(pitman(a)virtualworld.com): Apr 08 13:52:39 Info: auth input: gid=1002 deliver(pitman(a)virtualworld.com): Apr 08 13:52:39 Info: auth input: home=/var/spool/mail/pitman(a)virtualworld.com deliver(pitman(a)virtualworld.com): Apr 08 13:52:39 Info: example: func example_plugin_init is called deliver(pitman(a)virtualworld.com): Apr 08 13:52:39 Info: mbox: data=/var/spool/mail/pitman(a)virtualworld.com :INDEX=/var/indexes/pitman@virtualworld.com deliver(pitman(a)virtualworld.com): Apr 08 13:52:39 Info: mbox: INBOX defaulted to /var/spool/mail/pitman(a)virtualworld.com/inbox deliver(pitman(a)virtualworld.com): Apr 08 13:52:39 Info: fs: root=/var/spool/mail/pitman(a)virtualworld.com , index=/var/indexes/pitman(a)virtualworld.com, control=, inbox=/var/spool/mail/pitman(a)virtualworld.com /inbox deliver(pitman(a)virtualworld.com): Apr 08 13:52:39 Info: example: func example_deliver_mail is called deliver(pitman(a)virtualworld.com): Apr 08 13:52:39 Info: example: func example_get_stream is called deliver(pitman(a)virtualworld.com): Apr 08 13:52:39 Info: example: func make_header_filter is called deliver(pitman(a)virtualworld.com): Apr 08 13:52:39 Info: example: func create_header_stream is called deliver(pitman(a)virtualworld.com): Apr 08 13:52:39 Info: example: func create_stream_for_msgbody is called deliver(pitman(a)virtualworld.com): Apr 08 13:52:39 Info: example: func example_header_filter_callback is called deliver(pitman(a)virtualworld.com): Apr 08 13:52:39 Info: #Message 1: deliver(pitman(a)virtualworld.com): Apr 08 13:52:39 Info: example: func example_header_filter_callback is called deliver(pitman(a)virtualworld.com): Apr 08 13:52:39 Info: example: func example_get_stream is called deliver(pitman(a)virtualworld.com): Apr 08 13:52:39 Info: example: func make_header_filter is called deliver(pitman(a)virtualworld.com): Apr 08 13:52:39 Info: example: func create_header_stream is called deliver(pitman(a)virtualworld.com): Apr 08 13:52:39 Info: example: func create_stream_for_msgbody is called deliver(pitman(a)virtualworld.com): Apr 08 13:52:39 Info: example: func example_header_filter_callback is called deliver(pitman(a)virtualworld.com): Apr 08 13:52:39 Info: #Message 1: deliver(pitman(a)virtualworld.com): Apr 08 13:52:39 Info: example: func example_header_filter_callback is called deliver(pitman(a)virtualworld.com): Apr 08 13:52:39 Info: msgid=: saved mail to INBOX deliver(pitman(a)virtualworld.com): Apr 08 13:52:39 Info: example: func example_plugin_deinit is called My log (WITH_ONLY_HEADERS=1): deliver(pitman(a)virtualworld.com): Apr 08 13:53:51 Info: Loading modules from directory: /usr/local/lib/dovecot/lda deliver(pitman(a)virtualworld.com): Apr 08 13:53:51 Info: Module loaded: /usr/local/lib/dovecot/lda/lib90_example_plugin.so deliver(pitman(a)virtualworld.com): Apr 08 13:53:51 Info: auth input: uid=1002 deliver(pitman(a)virtualworld.com): Apr 08 13:53:51 Info: auth input: gid=1002 deliver(pitman(a)virtualworld.com): Apr 08 13:53:51 Info: auth input: home=/var/spool/mail/pitman(a)virtualworld.com deliver(pitman(a)virtualworld.com): Apr 08 13:53:51 Info: example: func example_plugin_init is called deliver(pitman(a)virtualworld.com): Apr 08 13:53:51 Info: mbox: data=/var/spool/mail/pitman(a)virtualworld.com :INDEX=/var/indexes/pitman@virtualworld.com deliver(pitman(a)virtualworld.com): Apr 08 13:53:51 Info: mbox: INBOX defaulted to /var/spool/mail/pitman(a)virtualworld.com/inbox deliver(pitman(a)virtualworld.com): Apr 08 13:53:51 Info: fs: root=/var/spool/mail/pitman(a)virtualworld.com , index=/var/indexes/pitman(a)virtualworld.com, control=, inbox=/var/spool/mail/pitman(a)virtualworld.com /inbox deliver(pitman(a)virtualworld.com): Apr 08 13:53:51 Info: example: func example_deliver_mail is called deliver(pitman(a)virtualworld.com): Apr 08 13:53:51 Info: example: func example_get_stream is called deliver(pitman(a)virtualworld.com): Apr 08 13:53:51 Info: example: func make_header_filter is called deliver(pitman(a)virtualworld.com): Apr 08 13:53:51 Info: example: func example_header_filter_callback is called deliver(pitman(a)virtualworld.com): Apr 08 13:53:51 Info: #Return-Path: <pupkin(a)virtualworld.com > deliver(pitman(a)virtualworld.com): Apr 08 13:53:51 Info: example: func example_header_filter_callback is called deliver(pitman(a)virtualworld.com): Apr 08 13:53:51 Info: #Delivered-To: pitman(a)virtualworld.comm > deliver(pitman(a)virtualworld.com): Apr 08 13:53:51 Info: example: func example_header_filter_callback is called deliver(pitman(a)virtualworld.com): Apr 08 13:53:51 Info: #Received: from localhost.virtualworld.com (localhost [127.0.0.1]) deliver(pitman(a)virtualworld.com): Apr 08 13:53:51 Info: example: func example_header_filter_callback is called deliver(pitman(a)virtualworld.com): Apr 08 13:53:51 Info: #Received: by bsdman.virtualworld.com (Postfix) with ESMTP id 3B3E11FE for <pitman(a)virtualworld.com>; Wed, 8 Apr 2009 13:53:51 +0400 (MSD) Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Subject: 2009-04-08T13:53:51.199182+1 From: pupkin(a)virtualworld.com Reply-to: Konstantin(a)bsdman.virtualworld.com, Lepa(a)bsdman.virtualworld.com To: pitman(a)virtualworld.com Message-Id: <20090408095351.3B3E11FE(a)bsdman.virtualworld.com> Date: Wed, 8 Apr 2009 13:53:51 +0400 (MSD) Message 1 deliver(pitman(a)virtualworld.com): Apr 08 13:53:51 Info: example: func example_header_filter_callback is called deliver(pitman(a)virtualworld.com): Apr 08 13:53:51 Info: #Received: for <pitman(a)virtualworld.com>; Wed, 8 Apr 2009 13:53:51 +0400 (MSD) Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Subject: 2009-04-08T13:53:51.199182+1 From: pupkin(a)virtualworld.com Reply-to: Konstantin(a)bsdman.virtualworld.com, Lepa(a)bsdman.virtualworld.com To: pitman(a)virtualworld.com Message-Id: <20090408095351.3B3E11FE(a)bsdman.virtualworld.com> Date: Wed, 8 Apr 2009 13:53:51 +0400 (MSD) Message 1 deliver(pitman(a)virtualworld.com): Apr 08 13:53:51 Info: example: func example_header_filter_callback is called deliver(pitman(a)virtualworld.com): Apr 08 13:53:51 Info: #Content-Type: text/plain; charset="us-ascii"m (localhost [127.0.0.1]) deliver(pitman(a)virtualworld.com): Apr 08 13:53:51 Info: example: func example_header_filter_callback is called deliver(pitman(a)virtualworld.com): Apr 08 13:53:51 Info: #MIME-Version: 1.0t/plain; charset="us-ascii"m (localhost [127.0.0.1]) deliver(pitman(a)virtualworld.com): Apr 08 13:53:51 Info: example: func example_header_filter_callback is called deliver(pitman(a)virtualworld.com): Apr 08 13:53:51 Info: #Content- Transfer-Encoding: 7bit/plain; charset="us-ascii"m (localhost [127.0.0.1]) deliver(pitman(a)virtualworld.com): Apr 08 13:53:51 Info: example: func example_header_filter_callback is called deliver(pitman(a)virtualworld.com): Apr 08 13:53:51 Info: #Subject: 2009-04-08T13:53:51.199182+1i"m (localhost [127.0.0.1]) deliver(pitman(a)virtualworld.com): Apr 08 13:53:51 Info: example: func example_header_filter_callback is called deliver(pitman(a)virtualworld.com): Apr 08 13:53:51 Info: #From: pupkin(a)virtualworld.com182+1i "m (localhost [127.0.0.1]) deliver(pitman(a)virtualworld.com): Apr 08 13:53:51 Info: example: func example_header_filter_callback is called deliver(pitman(a)virtualworld.com): Apr 08 13:53:51 Info: #Reply-to: Konstantin(a)bsdman.virtualworld.com ,calhost [127.0.0.1]) deliver(pitman(a)virtualworld.com): Apr 08 13:53:51 Info: example: func example_header_filter_callback is called deliver(pitman(a)virtualworld.com): Apr 08 13:53:51 Info: #Reply- to: Lepa(a)bsdman.virtualworld.com To: pitman(a)virtualworld.com Message-Id: <20090408095351.3B3E11FE(a)bsdman.virtualworld.com> Date: Wed, 8 Apr 2009 13:53:51 +0400 (MSD) Message 1 deliver(pitman(a)virtualworld.com): Apr 08 13:53:51 Info: example: func example_header_filter_callback is called deliver(pitman(a)virtualworld.com): Apr 08 13:53:51 Info: #To: pitman(a)virtualworld.comalworld.com ,calhost [127.0.0.1]) deliver(pitman(a)virtualworld.com): Apr 08 13:53:51 Info: example: func example_header_filter_callback is called deliver(pitman(a)virtualworld.com): Apr 08 13:53:51 Info: #Message-Id: <20090408095351.3B3E11FE(a)bsdman.virtualworld.com >.0.1]) deliver(pitman(a)virtualworld.com): Apr 08 13:53:51 Info: example: func example_header_filter_callback is called deliver(pitman(a)virtualworld.com): Apr 08 13:53:51 Info: #Date: Wed, 8 Apr 2009 13:53:51 +0400 (MSD)alworld.com>.0.1]) deliver(pitman(a)virtualworld.com): Apr 08 13:53:51 Info: example: func example_header_filter_callback is called deliver(pitman(a)virtualworld.com): Apr 08 13:53:51 Info: #: Wed, 8 Apr 2009 13:53:51 +0400 (MSD)alworld.com>.0.1]) deliver(pitman(a)virtualworld.com): Apr 08 13:53:51 Info: example: func example_header_filter_callback is called deliver(pitman(a)virtualworld.com): Apr 08 13:53:51 Info: example: func example_get_stream is called deliver(pitman(a)virtualworld.com): Apr 08 13:53:51 Info: example: func make_header_filter is called deliver(pitman(a)virtualworld.com): Apr 08 13:53:51 Info: msgid=<20090408095351.3B3E11FE(a)bsdman.virtualworld.com >: saved mail to INBOX deliver(pitman(a)virtualworld.com): Apr 08 13:53:51 Info: example: func example_plugin_deinit is called

2 3

[Dovecot] dovecot 1.2-rc2 doesn't build on Solaris 10
by Laurent Blume 09 Apr '09

09 Apr '09

Hi all, Timo, When trying to build 1.2 rc2 on Solaris 10, with the same options and compiler as what works for 1.1.13, I get the following error: libtool: compile: cc -DHAVE_CONFIG_H -I. -I../../.. -I../../../src/lib -I../../../src/lib-dict -I../../../src/lib-index -I../../../src/lib-mail -I../../../src/lib-storage -I../../../src/lib-storage/index -I../../../src/lib-storage/index/maildir -O -m64 -I/usr/sfw/include -c quota-fs.c -KPIC -DPIC -o .libs/quota-fs.o "quota-fs.c", line 436: undefined symbol: GRPQUOTA cc: acomp failed for quota-fs.c *** Error code 1 make: Fatal error: Command failed for target `quota-fs.lo' Current working directory /export/espace/apps/src/network/dovecot-1.2.rc2/src/plugins/quota *** Error code 1 The compiler is Studio 12 patched, and the options used were: CFLAGS='-O -m64' \ SSL_LIBS="-R/usr/sfw/lib/64 -L/usr/sfw/lib/64 -lssl -lcrypto" \ ./configure --prefix=/opt/dovecot-1.2-rc2 \ --sysconfdir=/etc/opt/dovecot-rc \ --localstatedir=/var/dovecot-rc \ --with-rundir=/var/run/dovecot-rc \ --with-statedir=/var/dovecot-rc/lib \ --with-ioloop=best \ --with-zlib \ --with-bzlib \ --with-ssl=openssl \ --with-ssldir=/etc/certs \ --with-shadow \ --with-pam \ --with-ldap \ --enable-header-install Thanks, Laurent -- / Leader de Projet & Communauté | I'm working, but not speaking for \ G11N http://fr.opensolaris.org | Bull Services http://www.bull.com / FOSUG http://guses.org |

2 2

[Dovecot] Upgrade from 0.99.x to 1.1.x
by Wolfram Schlich 09 Apr '09

09 Apr '09

Hi! I want to upgrade a Dovecot installation from 0.99.14 to 1.1.15, so I had a look at the following wiki article: http://wiki.dovecot.org/Upgrading?action=show&redirect=UpgradingDovecot The article http://wiki.dovecot.org/Upgrading/1.0 says something about .customflags -> dovecot-keywords and .subscriptions -> subscriptions change/conversion: http://wiki.dovecot.org/Upgrading/1.0#Subscriptions http://wiki.dovecot.org/Upgrading/1.0#Keywords Do I understand it correctly that when directly upgrading from 0.99 to 1.1, Dovecot does the subscriptions renaming but not the keywords renaming and conversion, but that when I manually rename all .customflags files to dovecot-keywords, it does the format conversion of that file automatically? Is there anything else what's important to note for such an upgrade? The system is using Maildir as the mailbox format and only local storage (no NFS etc.). -- Regards, Wolfram Schlich <wschlich(a)gentoo.org> Gentoo Linux * http://dev.gentoo.org/~wschlich/

4 5

[Dovecot] crashed with shared namespace
by Xueron Nee 09 Apr '09

09 Apr '09

Hi, I have a shared namespace, which works fine yesterday. Today I have just updated my dovecot to the newest from hg.dovecot.org, and it crashed when list the shared namespace. namespace shared { separator = / prefix = shared/%%u/ location = maildir:%%h/Maildir:INDEX=~/Maildir/shared/%%u list = children subscriptions = no } cmd: # telnet localhost 143 Trying 127.0.0.1... Connected to localhost.localdomain (127.0.0.1). Escape character is '^]'. * OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE STARTTLS AUTH=PLAIN AUTH=LOGIN] AMOS READY a1 login test1(a)xueron.com ****** a1 OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE SORT THREAD=REFERENCES THREAD=REFS MULTIAPPEND UNSELECT IDLE CHILDREN NAMESPACE UIDPLUS LIST-EXTENDED I18NLEVEL=1 CONDSTORE QRESYNC ESEARCH ESORT SEARCHRES WITHIN CONTEXT=SEARCH ACL RIGHTS=texk] Logged in a1 list "" "*" * LIST (\HasNoChildren) "/" "Sent" * LIST (\HasNoChildren) "/" "Spam" * LIST (\HasChildren) "/" "virtual" * LIST (\HasChildren) "/" "aaaaa" * LIST (\HasNoChildren) "/" "aaaaa/aaa" * LIST (\HasNoChildren) "/" "Junk" * LIST (\HasNoChildren) "/" "Draft" * LIST (\HasNoChildren) "/" "Trash" * LIST (\HasNoChildren) "/" "INBOX" * LIST (\Noselect \HasChildren) "/" "shared/xueron(a)xueron.com" * LIST (\HasNoChildren) "/" "public/test2" * LIST (\HasNoChildren) "/" "public/test4" * LIST (\HasNoChildren) "/" "public/test1" * LIST (\HasNoChildren) "/" "public/test3" * LIST (\HasChildren) "/" "shared/xueron(a)xueron.com/mydir" * LIST (\HasNoChildren) "/" "shared/xueron(a)xueron.com/mydir/subdir" * LIST (\HasNoChildren) "/" "shared/xueron(a)xueron.com/newdir" a1 OK List completed. a1 list "shared/" "*" Connection closed by foreign host. maillog: Apr 9 12:31:27 mail dovecot: Panic: IMAP(test1(a)xueron.com): file mail-user.c: line 30 (mail_user_init): assertion failed: (*username != '\0') Apr 9 12:31:27 mail dovecot: IMAP(test1(a)xueron.com): Raw backtrace: imap [0x80e7800] -> imap [0x80e785a] -> imap [0x80e711c] -> imap [0x80af7ab] -> imap(shared_storage_get_namespace+0x298) [0x8072708] -> imap [0x8071eef] -> imap [0x80601ec] -> imap(cmd_list_full+0x4ad) [0x8060bcd] -> imap(cmd_list+0x19) [0x8060ec9] -> imap [0x8063f9c] -> imap [0x806404b] -> imap(client_handle_input+0x2f) [0x8064aff] -> imap(client_input+0x63) [0x8064d33] -> imap(io_loop_handler_run+0x107) [0x80effc7] -> imap(io_loop_run+0x28) [0x80ef0d8] -> imap(main+0x754) [0x806d044] -> /lib/libc.so.6(__libc_start_main+0xdc) [0x901dec] -> imap [0x805cf11] Apr 9 12:31:27 mail dovecot: child 14971 (imap) killed with signal 6 (core dumps disabled btw: yesterday, there was such logs when 'list "shared/" "*"': Apr 8 17:03:37 mail dovecot: IMAP(test1(a)xueron.com): Invalid namespace prefix %u/ vs but no crash. Thanks :) -- Xueron Nee http://www.xueron.com

1 0

[Dovecot] Multiple use of the same LDAP attribute
by Bernhard Schmidt 09 Apr '09

09 Apr '09

Hi, we've found a weird bug (?) in Dovecot 1.1.11. Since day and age we've been running dovecot for our student mailserver, getting the location of the mailbox from a LDAP directory. We allow login and LDA with both full mail address and an internal username, so the mailbox directory is based on a LDAP attribute user_attrs = xxxMailbox=mail=maildir:/home/mailstore/%U$/Maildir:INDEX=/home/mailstore/indexes/%1U$/%U$, uidNumber=vmail, gidNumber=vmail, xxxMailQuota=quota_rule2=*:storage=%$B this worked just fine until we introduced sieve, which made us realize we did not have the home directory set at all. The obvious and easy fix (we thought) was to set the home directory based on the xxxMailbox variable as well: user_attrs = xxxMailbox=mail=maildir:/home/mailstore/%U$/Maildir:INDEX=/home/mailstore/indexes/%1U$/%U$, uidNumber=vmail, gidNumber=vmail, xxxMailQuota=quota_rule2=*:storage=%$B, xxxMailbox=home=/home/mailstore/%U$ unfortunately, after this trivial change hell froze over, because suddenly the mail variable was not set at all anymore, and since we had set mail_location = maildir:/home/mailstore/%Uu/Maildir:INDEX=/home/mailstore/indexes/%1Un/%Un (based on username) it was suddenly delivered into the wrong folder (based on the supplied username, not on the LDAP attribute). Debug from after the change: Apr 8 13:53:39 lxmhs23 dovecot: auth(default): ldap(username(a)xxx.de): user search: base=<deleted> scope=onelevel filter=<deleted> fields=xxxMailbox,uidNumber,gidNumber,xxxMailQuota,xxxMailbox Apr 8 13:53:39 lxmhs23 dovecot: auth(default): ldap(username(a)xxx.de): result: xxxMailQuota(quota_rule2=*:storage=%$B)=*:storage=1073741824B xxxMailbox(home=/home/mailstore/%U$)=/home/mailstore/1636D8B1D7916DEA/ [...] Apr 8 13:53:39 lxmhs23 deliver(username(a)xxx.de): maildir: data=/home/mailstore/USERNAME@XXX.DE/Maildir:INDEX=/home/mailstore/indexes/U/USERNAME As you can see the mail variable wasn't set by LDAP at all. We did some more tests and found a workaround, when using another LDAP (mwnid) attribute that contains the same information it works just fine user_attrs = xxxMailbox=mail=maildir:/home/mailstore/%U$/Maildir:INDEX=/home/mailstore/indexes/%1U$/%U$, uidNumber=vmail, gidNumber=vmail, xxxMailQuota=quota_rule2=*:storage=%$B, mwnid=home=/home/mailstore/%U$ Apr 8 14:18:06 lxmhs23 dovecot: auth(default): ldap(username(a)xxx.de): user search: base=<deleted> scope=onelevel filter=<deleted> fields=xxxMailbox,uidNumber,gidNumber,xxxMailQuota,mwnid Apr 8 14:18:06 lxmhs23 dovecot: auth(default): ldap(username(a)xxx.de): result: xxxMailQuota(quota_rule2=*:storage=%$B)=*:storage=1073741824B xxxMailbox(mail=maildir:/home/mailstore/%U$/Maildir:INDEX=/home/mailstore/indexes/%1U$/%U$)=maildir:/home/mailstore/1636D8B1D7916DEA//Maildir:INDEX=/home/mailstore/indexes/1/1636D8B1D7916DEA/ mwnid(home=/home/mailstore/%U$)=/home/mailstore/1636D8B1D7916DEA Apr 8 14:18:06 lxmhs23 deliver(username(a)xxx.de): maildir: data=/home/mailstore/1636D8B1D7916DEA//Maildir:INDEX=/home/mailstore/indexes/1/1636D8B1D7916DEA/ So, it looks like there is an issue using the same LDAP attribute (xxxMailbox in this case) twice in variable expansion. Is this a known issue? Of course there are several viable workarounds (base mail location on home directory, use the second attribute), but this problem was pretty surprising. Bernhard

4 6

[Dovecot] Trying nonplaintext mech with LDAP password-hash
by dovecotlist＠encambio.com 09 Apr '09

09 Apr '09

Hello List, The only passdb block in /pfx/etc/dovecot/dovecot.conf is: passdb ldap { args = /pfx/etc/dovecot/dovecot-ldap.conf } In /pfx/etc/dovecot/dovecot-ldap.conf: auth_bind = no dn = cn=mymgr,dc=host,dc=tld dnpass = ******** default_pass_scheme = LDAP-MD5 In /pfx/etc/openldap/slapd.conf: password-hash {MD5} If I try: $ /pfx/bin/ldapsearch <...> \ | grep '^userPassword' \ | sed -e 's;.*:: $.*$$;\1;' \ | mimencode -u ...I get the correct password (MD5 hashed.) According to wiki.dovecot.org/AuthDatabase/LDAP/PasswordLookups this should work, and indeed when starting dovecot it does not complain about: 'CRAM-MD5 mechanism can't be supported with given passdbs' Instead it starts right up, but when a thunderbird client connects and tries authenticating with CRAM-MD5 it fails. In the wiki page 'PasswordLookups' it mentions: Supports non-plaintext authentication mechanisms (if returning plaintext/properly hashed passwords). I've already verified that this works correctly with plaintext (CLEARTEXT in slapd.conf), but I really want to store the passwords in LDAP using some hash. Why doesn't LDAP-MD5 work as advertised? What did the author mean by 'properly hashed passwords'? Thanks. -- Eduard

2 2

[Dovecot] Dovecot 1.1.11 failing to accept SSL/TLS connections
by Mike Brudenell 08 Apr '09

08 Apr '09

Greetings - We are running Dovecot 1.1.11 on our servers and have been gradually migrating people off our old (UW-based) systems onto the new (Dovecot-based) ones. As a result the new systems are seeing more connections from more people. We have started seeing problems reported by users of our webmail service that they are getting an error indicating the webmail software (Prayer) has failed to establish an IMAP connection using TLS to Dovecot. Investigations show it is not just the webmail service that is affected but all mail clients: it's just other clients retry the connection, whereas Prayer fails the login and shows the error message: TLS/SSL failure for username.imap.york.ac.uk: SSL negotiation failed It seems to be related to one of Dovecot's imap-login processes getting a lot of file descriptors in use. We initially spawn off 10 imap-login processes and have each handling 256 connections. Full "dovecot -n" at the end of the message, but the relevant settings here are: login_process_size = 64 login_process_per_connection = no login_processes_count = 10 login_max_processes_count = 128 login_max_connections = 256 We have grown to suspect it is to do with one of the imap-login processes having a large number of files open. Killing the process seems to get rid of the problem. For example currently we have 11 imap-login processes running, one of which has 518 open files -- process 12436 in the list below. I suspect that, as in previous times we've encountered the problem, killing this process will alleviate the problem. (I'll be doing this later on this evening.) It is slightly odd that the imap-login processes have a very skewed distribution of open files, almost as if the algorithm for allocating connections to a process favours some over others. For example the current counts of open files are: Pid = Open files count 12430 = 42 26818 = 237 12431 = 90 12433 = 12 12438 = 304 12437 = 106 12435 = 190 12432 = 14 12436 = 518 12434 = 32 12429 = 12 Process 12436 was one of the 10 imap-login processes initially created back on March 3rd. (Process 26818 was the additional imap-login process spawned a little later on March 4th.) I don't believe the problem lies with the available file descriptors on the system: in the script which starts Dovecot I do date >/var/run/dovecot-limits ulimit -Sa >>/var/run/dovecot-limits echo "----------" >>/var/run/dovecot-limits ulimit -Ha >>/var/run/dovecot-limits ulimit -Sn 10128 echo "==========" >>/var/run/dovecot-limits ulimit -Sa >>/var/run/dovecot-limits echo "----------" >>/var/run/dovecot-limits ulimit -Ha >>/var/run/dovecot-limits $DOVECOT >>/var/run/dovecot-limits 2>&1 (The magic 10128 number came from Dovecot 1.1.11 itself, complaining that the number I had originally was too low.) Likewise the output of the pfiles command on process 12436 (which is the one I believe to be problematic) indicates its limit still has some available -- I'm guessing Dovecot has reduced the limit down to 533 from the 10128 set in the startup script: Current rlimit: 533 file descriptors We originally saw this problem with Dovecot 1.0.3 which we were running up until a couple of weeks ago. From there I upgraded first to 1.0.15 and then to 1.1.11. I'd hoped that upgrading would fix the problem: I see it has been mentioned before on the list, but not for a year or two. Can anyone give any help, please? Cheers, Mike Brudenell Configuration info Platform: Solaris 10 dovecot -n output is : # 1.1.11: /usr/local/dovecot-1.1.11/etc/dovecot.conf # OS: SunOS 5.10 i86pc ufs base_dir: /var/run/dovecot/ log_path: /logfiles/mail/live/dovecot listen: *:143 ssl_listen: *:993 ssl_cert_file: /usr/local/dovecot/ssl/certs/imapservice-bundle-2007.pem ssl_key_file: /usr/local/dovecot/ssl/private/imapservice-key-2007.pem disable_plaintext_auth: no shutdown_clients: no login_dir: /var/run/dovecot/login login_executable: /usr/local/dovecot-1.1.11/libexec/dovecot/imap-login login_log_format_elements: user=<%Lu> method=%m rip=%r lip=%l %c login_process_per_connection: no login_greeting_capability: yes login_processes_count: 10 max_mail_processes: 10000 mail_max_userip_connections: 20 mail_location: maildir:/mailstore/messages/%1Ln/%Ln/Maildir:INDEX=/mailstore/index/%1Ln/%Ln:CONTROL=/mailstore/control/%1Ln/%Ln mail_plugins: quota imap_quota fts fts_squat mail_log_prefix: [%p]%Us(%Lu): imap_client_workarounds: delay-newmail namespace: type: private separator: / inbox: yes list: yes subscriptions: yes auth default: mechanisms: plain login cache_size: 1024 cache_ttl: 600 username_chars: abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ01234567890 username_format: %Ln passdb: driver: shadow userdb: driver: passwd plugin: fts: squat fts_squat: partial=4 full=4 quota: fs:user

3 8

[Dovecot] Prohibit removing INBOX
by floss＠pbartels.info 08 Apr '09

08 Apr '09

Hello list, I'm using dovecot 1.1.11 and I'm going to prohibit users to remove their INBOX and some other directories in the mailbox root. I used Access Control Lists (http://wiki.dovecot.org/ACL) to do this: protocol imap { mail_plugins = acl } plugin { # With global ACLs in /etc/dovecot/acls/ directory: acl = vfile:/etc/dovecot/acls } /etc/dovecot/acls/.DEFAULT: owner lrwstie /etc/dovecot/acls/INBOX/.DEFAULT owner lrwstiekxa Actually - its not possible to create/remove directories under the mailbox root - its possible to create directories under INBOX - its NOT possible to remove directories under INBOX (This is my problem.) I tried symlinks like: /var/mail/.../INBOX/dovecot-acl -> /etc/dovecot/acls/INBOX/.DEFAULT /var/mail/.../dovecot-acl -> /etc/dovecot/acls/.DEFAULT But I think the symlink won't help because they doesn't change anything. And even with the symlinks its not possible to remove directories under IBOX. The documentation says: > If a mailbox has both global and per-mailbox ACL file, both of them > are read and the ACLs are merged. If there are any conflicts: > * v1.0 and v1.1: The per-mailbox ACL file overrides global ACL file. As far I can see it the documentation says nothing about merging ACLs of subdirs. But it seems the given behavior is not wanted by the dovecot design, because it seems it should be possible to override ACLs for subdirs, also give more permissions than the upper dirs. Is this a dovecot failure, do I miss something or is it really wanted by dovecot this way? My MUA (Evolution) says: > Cannot delete folder "INBOX/test". > Because "IMAP command failed: Permission denied". It unsubscribes the folder but it not able to remove it. Logs: dovecot: 2009-04-05 13:21:22 Info: IMAP(address1(a)domain1.tld): acl vfile: reading file /etc/dovecot/acls//.DEFAULT dovecot: 2009-04-05 13:21:22 Info: IMAP(address1(a)domain1.tld): acl vfile: reading file /var/mail/domain1.tld/address1/mail/dovecot-acl dovecot: 2009-04-05 13:21:22 Info: IMAP(address1(a)domain1.tld): acl vfile: reading file /etc/dovecot/acls/INBOX/.DEFAULT dovecot: 2009-04-05 13:21:22 Info: IMAP(address1(a)domain1.tld): acl vfile: reading file /var/mail/domain1.tld/address1/mail/INBOX/dovecot-acl dovecot: 2009-04-05 13:21:22 Info: IMAP(address1(a)domain1.tld): acl vfile: reading file /etc/dovecot/acls/INBOX/.DEFAULT dovecot: 2009-04-05 13:21:22 Info: IMAP(address1(a)domain1.tld): acl vfile: reading file /var/mail/domain1.tld/address1/mail/INBOX/dovecot-acl dovecot: 2009-04-05 13:21:22 Info: IMAP(address1(a)domain1.tld): acl vfile: reading file /etc/dovecot/acls/INBOX/.DEFAULT dovecot: 2009-04-05 13:21:22 Info: IMAP(address1(a)domain1.tld): acl vfile: reading file /var/mail/domain1.tld/address1/mail/INBOX/dovecot-acl dovecot: 2009-04-05 13:21:22 Info: IMAP(address1(a)domain1.tld): acl vfile: reading file /etc/dovecot/acls/INBOX/.DEFAULT dovecot: 2009-04-05 13:21:22 Info: IMAP(address1(a)domain1.tld): acl vfile: reading file /var/mail/domain1.tld/address1/mail/INBOX/dovecot-acl dovecot: 2009-04-05 13:21:22 Info: IMAP(address1(a)domain1.tld): acl vfile: reading file /etc/dovecot/acls/INBOX/.DEFAULT dovecot: 2009-04-05 13:21:22 Info: IMAP(address1(a)domain1.tld): acl vfile: reading file /var/mail/domain1.tld/address1/mail/INBOX/dovecot-acl dovecot: 2009-04-05 13:21:22 Info: IMAP(address1(a)domain1.tld): acl vfile: reading file /etc/dovecot/acls//.DEFAULT dovecot: 2009-04-05 13:21:22 Info: IMAP(address1(a)domain1.tld): acl vfile: reading file /var/mail/domain1.tld/address1/mail/dovecot-acl dovecot: 2009-04-05 13:21:22 Info: IMAP(address1(a)domain1.tld): acl vfile: reading file /etc/dovecot/acls//.DEFAULT dovecot: 2009-04-05 13:21:22 Info: IMAP(address1(a)domain1.tld): acl vfile: reading file /var/mail/domain1.tld/address1/mail/dovecot-acl Thanks in advance Philipp Bartels

3 2

[Dovecot] Dovecot, LVS and the issues I have with it.
by neil 08 Apr '09

08 Apr '09

We run around 5 dovecot (debian etch 1.0.rc15) POP/IMAP 'nodes' using the LVS load balancer and an NFS based SAN. it works pretty well. I love the robustness of load balancing POP/IMAP. We do a reasonable amount of throughput through these especially at peak times pushing our SAN to around 1.5k IOP/s We currently have two issues with this setup. One of which is NFS index corruption issues we get due to NFS/dovecot locking. Basically the UUID list or a .index gets corrupt. This causes a full re-indexing of the mailbox / broken mailbox until i delete the indexes. In the UUID lists case the symptom tends to effect use who use POP rather than IMAP and insist on keeping messages on the server. Because it's corrupt it gets rebuilt one way or the other and the users email client proceeds to redownload the entire mailbox again until he remarks them to be saved. This tends to annoy the user a lot. After a bit of testing we do however expect this to be fixed by version 1.1. However if anyone has any comments on this I would certainly be interested. The other issue is a little tricky to describe or even log effectively. Occasionally a node basically receives more connections than it is able to handle. The connection count goes through the roof for that node. It will go up way beyond 150 dovecot authentication threads and 100 or so active POP/IMAP dovecot threads. The IO_wait/cpu and memory usage also tends to be spiking at this point. The server gets to the tipping point where it can no longer serve it's POP/IMAP requests fast enough compared to the number of connections it's getting. I'd be fine with this but this creates some less than desirable symptoms: 1. We obviously reach the auth thread cap eventually so any new auth requests basically get refused by the server. To the user this is a seen as an outlook/mail client re-auth pop-up request. This annoys them. Ideally if the server stops accepting auth requests it should fall off our load balancer until it can consistently accept them again. Since the LVS detects a node fail by whether the tcp port is still open this doesn't happen, since dovecot keeps the port open. This is obviously more an LVS issue and not for this mailing list I expect unless anyone has any config tweaking tips here? 2. Now here's my real gripe. Dovecot does not handle running out resources very gracefully at all in our setup. It does start killing threads after a while. I get multiple *"dovecot: child 17989 (login) killed with signal 9". *I'm not exactly sure what's going on here because after this all I can see is the machine totally out of memory and the kernel starts killing absolutely everything. All services are killed (including ssh etc..) and I plug a monitor into the server and find the last few lines of the console listing init and other rather important things having just been killed. At this point it is a case of power cycling the server and all is back to normal again. I imagine there's not a huge amount of people using dovecot in this way. But anyone got any recommendations here? I really like using dovecot in this setup it handles it pretty well and the redundancy and functionality options it provides have been invaluable. Neil

4 3