- dovecot - dovecot.org

[Dovecot] ACL changes not respected by already loged in clients
by Sascha Wilde 03 Apr '09

03 Apr '09

Hi *, and yet another ACL problem. ;-) User A allows User B to access his mailbox foobar: * OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE AUTH=PLAIN] Dovecot ready. l login userA secret l OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE SORT THREAD=REFERENCES MULTIAPPEND UNSELECT IDLE CHILDREN NAMESPACE UIDPLUS LIST-EXTENDED I18NLEVEL=1 CONDSTORE QRESYNC ESEARCH ESORT SEARCHRES WITHIN CONTEXT=SEARCH ACL RIGHTS=texk ANNOTATEMORE] Logged in s setacl "INBOX/foobar" "B(a)example.com" eilprwtsd s OK Setacl complete. g getacl INBOX/foobar * ACL "INBOX/foobar" "B(a)example.com" eilprwtsd "A(a)example.com" lrwstipekxacd User B logs in to dovecot and sees the newly accessible mailbox: * OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE AUTH=PLAIN] Dovecot ready. l login zwei 2 l OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE SORT THREAD=REFERENCES MULTIAPPEND UNSELECT IDLE CHILDREN NAMESPACE UIDPLUS LIST-EXTENDED I18NLEVEL=1 CONDSTORE QRESYNC ESEARCH ESORT SEARCHRES WITHIN CONTEXT=SEARCH ACL RIGHTS=texk ANNOTATEMORE] Logged in l list "" "*" * LIST (\Noselect \HasChildren) "/" "user" * LIST (\Noselect \HasChildren) "/" "user/A(a)example.com" * LIST (\HasChildren) "/" "INBOX" * LIST (\HasNoChildren) "/" "INBOX/Gesendet" * LIST (\HasChildren) "/" "user/A(a)example.com/foobar" l OK List completed. se select "user/A(a)example.com/foobar" * FLAGS (\Answered \Flagged \Deleted \Seen \Draft) * OK [PERMANENTFLAGS (\Answered \Flagged \Deleted \Seen \Draft \*)] Flags permitted. * 1 EXISTS * 1 RECENT * OK [UIDVALIDITY 1236104897] UIDs valid * OK [UIDNEXT 2] Predicted next UID * OK [HIGHESTMODSEQ 1] Now User A changes his mind: s setacl "INBOX/foobar" "B(a)example.com" "" s OK Setacl complete. g getacl INBOX/foobar * ACL "INBOX/foobar" "A(a)example.com" lrwstipekxacd g OK Getacl completed. but as long as User B stays loged in, he is not affected, in fact he still can read A's mails: se select "user/A(a)example.com/foobar" * OK [CLOSED] * FLAGS (\Answered \Flagged \Deleted \Seen \Draft) * OK [PERMANENTFLAGS (\Answered \Flagged \Deleted \Seen \Draft \*)] Flags permitted. * 1 EXISTS * 0 RECENT * OK [UIDVALIDITY 1236104897] UIDs valid * OK [UIDNEXT 2] Predicted next UID * OK [HIGHESTMODSEQ 1] se OK [READ-WRITE] Select completed. f101 fetch 1 FAST * 1 FETCH (FLAGS (\Seen) INTERNALDATE "04-Mar-2009 13:11:06 +0100" RFC822.SIZE 3652) f101 OK Fetch completed. I think ACL changes should take immediate effect, or at least should be re-checked in reasonable intervals (which imo shouldn't exceed a few seconds). cheers sascha -- Sascha Wilde OpenPGP key: 4BB86568 http://www.intevation.de/~wilde/ http://www.intevation.de/ Intevation GmbH, Neuer Graben 17, 49074 Osnabrück; AG Osnabrück, HR B 18998 Geschäftsführer: Frank Koormann, Bernhard Reiter, Dr. Jan-Oliver Wagner

4 5

[Dovecot] v 1.1.13 / GSSAPI / Timeout waiting for handshake from auth server
by Jahnke-Zumbusch, Dirk 03 Apr '09

03 Apr '09

Dear all, I am trying to setup Dovecot with GSSAPI support. For testing purposes gssapi is the only method allowed for login. As I cannot login to my mailbox, I'vo got two questions about the following log entries: dovecot: Info: auth-worker(default): passwd-file /dovecot/store/db/test-userdb: Read 3 users dovecot: Info: auth(default): new auth connection: pid=3915 dovecot: Info: auth(default): client in: AUTH 1 GSSAPI service=imap lip=131.169.*.* rip=131.169.*.* lport=143 rport=35779 dovecot: Info: auth(default): gssapi(?,131.169.40.218): Obtaining credentials for imap(a)my.host.name dovecot: Error: imap-login: Timeout waiting for handshake from auth server. my pid=3918, input bytes=0 1. I am puzzled about the credentials "imap(a)my.host.name" being obtained; shouldn't this be something like "imap/my.host.name(a)MY.REALM" ? 2. what does "Timeout waiting for handshake from auth server." mean? Who is trying to handshake with whom? Any ideas? Best regards, Dirk -- Dirk Jahnke-Zumbusch Deutsches Elektronen-Synchrotron DESY IT Information Fabrics Member of the Helmholtz Association D-22603 Hamburg Notkestrasse 85 / 22607 Hamburg T: +49-40-899.81760 F: +49-40-899.41760 dirk.jahnke-zumbusch(a)desy.de

3 2

[Dovecot] Time moved backwards errors
by Bloke 03 Apr '09

03 Apr '09

Hello, I am experiencing a number of 'Time moved backwards errors' such as: Mar 27 11:38:20 host-78-129-239-60 dovecot: imap-login: Time just moved backwards by 729 seconds. This might cause a lot of problems, so I'll just kill myself now. http://wiki.dovecot.org/TimeMovedBackwards Mar 27 15:20:10 host-78-129-239-60 dovecot: Time just moved backwards by 4214 seconds. This might cause a lot of problems, so I'll just kill myself now. http://wiki.dovecot.org/TimeMovedBackwards Mar 29 11:08:59 host-78-129-239-60 dovecot: imap-login: Time just moved backwards by 4341 seconds. This might cause a lot of problems, so I'll just kill myself now. http://wiki.dovecot.org/TimeMovedBackwards on my Centos 5.2 openvz - based VPS I have raised the issue with my VPS provider, who are responding that 'the jury is still out' as to whether this is a system, or Dovecot problem. Reading the TimeMovedBackwards article on the Dovecot wiki, and the kernel mailing list thread referred to on it, it would seem quite apparent that this is caused by a failure of the gettimeofday() function to reliably return the correct value. If anyone has any advice as to how I could proceed to fix this (I currently have a watch on the Dovecot service which restarts it after any failures) or how I should best phrase this to get it resolved 'upstream' by the VPS provider, I would be very grateful. Thank you, Patrick Vale

7 12

[Dovecot] dbox benchmarks
by Timo Sirainen 03 Apr '09

03 Apr '09

http://hg.dovecot.org/dovecot-dbox-redesign/ Looks like multi-dbox scales pretty nicely. Even after 100k messages the peak saved msgs/sec is the same as the initial saved msgs/sec, even if the average slows down somewhat. I tested this by first deleting mailbox, then running "imaptest" for a second to get saving to start writing several fields to dovecot.index.cache file. Then ran imaptest for 60 seconds that did nothing but save messages using IMAP APPEND commands. The summary is that multi-dbox is almost 10x as fast as maildir when fsync is disabled and 2,5 faster with fsyncing: fsync_disable=yes: multi-dbox : ~1700 -> ~1500 msgs/sec, 90842 msgs/60 sec single-dbox: ~1700 -> ~1400 msgs/sec, 86149 msgs/60 sec maildir : ~330 -> ~110 msgs/sec, 9789 msgs/60 sec fsync_disable=no: multi-dbox : ~220 -> ~170 msgs/sec, 10113 msgs/60 sec maildir : ~100 -> ~70 msgs/sec, 4123 msgs/60 sec Also I just noticed that saving messages with two clients gets a peak of 2200 msgs/sec, most likely because two CPU cores can be used then. Hmm. I guess if there were no locking it should have reached 3400 msgs/sec, but it's better than no performance increase. And the raw data: multi-dbox, fsync_disable=yes imaptest clients=1 secs=1;imaptest clients=1 msgs=1000000 - logout=0 append=100,0 secs=60 Logi Sele Appe 100% 100% 100% 1 1 1759 1/ 1 0 0 1424 1/ 1 0 0 1734 1/ 1 ... 0 0 1701 1/ 1 0 0 1640 1/ 1 0 0 778 1/ 1 0 0 1305 1/ 1 0 0 1598 1/ 1 Totals: Logi Sele Appe 100% 100% 100% 1 1 90842 multi-dbox, fsync_disable=no imaptest clients=1 secs=1;imaptest clients=1 msgs=1000000 - logout=0 append=100,0 secs=60 Logi Sele Appe 100% 100% 100% 1 1 209 1/ 1 0 0 227 1/ 1 0 0 208 1/ 1 ... 0 0 203 1/ 1 0 0 145 1/ 1 0 0 156 1/ 1 0 0 180 1/ 1 0 0 162 1/ 1 Totals: Logi Sele Appe 100% 100% 100% 1 1 10113 maildir, fsync_disable=yes Logi Sele Appe 100% 100% 100% 1 1 331 1/ 1 0 0 311 1/ 1 0 0 288 1/ 1 ... 0 0 96 1/ 1 0 0 119 1/ 1 0 0 111 1/ 1 Totals: Logi Sele Appe 100% 100% 100% 1 1 9789 maildir, fsync_disable=no Logi Sele Appe 100% 100% 100% 1 1 77 1/ 1 0 0 101 1/ 1 0 0 45 1/ 1 ... 0 0 52 1/ 1 0 0 67 1/ 1 0 0 89 1/ 1 Totals: Logi Sele Appe 100% 100% 100% 1 1 4123 single-dbox, fsync_disable=yes imaptest clients=1 secs=1;imaptest clients=1 msgs=1000000 - logout=0 append=100,0 secs=60 Logi Sele Appe 100% 100% 100% 1 1 1765 1/ 1 0 0 1715 1/ 1 0 0 1764 1/ 1 ... 0 0 1722 1/ 1 0 0 1679 1/ 1 0 0 1678 1/ 1 0 0 828 1/ 1 0 0 1467 1/ 1 0 0 1469 1/ 1 0 0 1149 1/ 1 0 0 1135 1/ 1 Totals: Logi Sele Appe 100% 100% 100% 1 1 86149

3 4

[Dovecot] An issue of I login my mail server from webmail client
by Alan Zheng 03 Apr '09

03 Apr '09

Dear all: I have a really strange issue, that is when I login my mail server from webmail client (I used SquirrelMail, by the way, I have modified squirrelmail's timeout value, that means not since squirrelmail timeout), I will got timeout issue when I login about 5PM ~ 10PM everyday (it works fine on other time, I also check my cron, that looks no problem), and during this time, I also cannot connect my 993 port with openssl like this: openssl s_client -connect myDomainName:993 But when I use mail client (such as outlook) to access dovecot, that works fine, and during 5PM ~ 10PM, my web site also works fine, and once I restart computer if I can not login during 5PM ~ 10PM from webmail client. that will work fine. can you try to help me? below is my configure of dovecot. *dovecot -n # 1.0.7: /etc/dovecot.conf log_path: /var/run/dovecot/maillog info_log_path: /var/run/dovecot/maillog protocols: imaps ssl_parameters_regenerate: 0 verbose_ssl: yes login_dir: /var/run/dovecot/login login_executable: /usr/libexec/dovecot/imap-login mail_location: maildir:~/Maildir mail_debug: yes auth default: mechanisms: plain login passdb: driver: pam userdb: driver: passwd socket: type: listen client: path: /var/spool/postfix/private/auth mode: 432 user: postfix group: postfix plugin: convert_mail: mbox:~/Mail:INBOX=/var/mail/%u* -- Best Regards Alan Zheng

1 0

[Dovecot] Dovecot ACLs
by dovecot＠corwyn.net 03 Apr '09

03 Apr '09

Running Dovecot 1.1.8 using Virtual users, multiple domains. My file structure is /var/spool/mail/<domain>/<user>/Maildir/ (cur, new,tmp,.Spam) What I'd like to do is add an ACL such that all users can read/delete/move mail that's in the spam folder, but not delete it. Am I going to have to create an entry for every single user, or is there a way to do it once, for all .Spam folders? I've read through http://wiki.dovecot.org/ACL and can't quite get this as the last step. Thanks rick Rick Steeves http://www.sinister.net "The journey is the destination"

2 3

[Dovecot] Dovecot SASL Postfix
by kosovo73＠web.de 03 Apr '09

03 Apr '09

Hello, I try to bring Postfix + Dovecot + SASL in the running. Unfortunately, this has not succeeded to me, only the Pop3 daemon runs without problems. /var/log/dovecot.log dovecot: 2009-04-03 01:04:38 Error: auth(default): bind(/var/spool/postifx/private/auth) failed: No such file or directory dovecot: 2009-04-03 01:04:38 Fatal: auth(default): net_listen_unix(/var/spool/postifx/private/auth) failed: No such file or directory dovecot: 2009-04-03 01:04:38 Fatal: Auth process died too early - shutting down /var/log/mail.log Apr 3 01:08:38 server1 postfix/master[14627]: daemon started -- version 2.5.5, configuration /etc/postfix Apr 3 01:09:07 server1 postfix/smtpd[14650]: warning: SASL: Connect to private/auth failed: No such file or directory Apr 3 01:09:07 server1 postfix/smtpd[14650]: fatal: no SASL authentication mechanisms Apr 3 01:09:08 server1 postfix/master[14627]: warning: process /usr/lib/postfix/smtpd pid 14650 exit status 1 Apr 3 01:09:08 server1 postfix/master[14627]: warning: /usr/lib/postfix/smtpd: bad command startup -- throttling --------------------- postconf -n alias_maps = hash:/etc/aliases broken_sasl_auth_clients = yes config_directory = /etc/postfix content_filter = smtp-amavis:[127.0.0.1]:10024 home_mailbox = maildir/ mailbox_size_limit = 0 mydestination = $myhostname, mail.silvio-siefke.de, server1.silviosiefke.de myhostname = server1.silviosiefke.de recipient_delimiter = + smtp_sasl_auth_enable = no smtpd_recipient_restrictions = reject_non_fqdn_sender reject_non_fqdn_recipient reject_invalid_helo_hostname reject_non_fqdn_helo_hostname permit_sasl_authenticated permit_mynetworks reject_unauth_destination reject_unlisted_recipient reject_rbl_client zen.spamhaus.org reject_rbl_client dul.dnsbl.sorbs.net reject_rbl_client bl.spamcop.net check_policy_service inet:127.0.0.1:10031 reject_unknown_sender_domain smtpd_sasl_auth_enable = yes smtpd_sasl_type = dovecot smtpd_sasl_path = private/auth smtpd_sasl_local_domain = smtpd_sasl_security_options = noanonymous transport_maps = hash:/etc/postfix/transport unknown_local_recipient_reject_code = 550 virtual_alias_maps = mysql:/etc/postfix/mysql/mysql_virtual_alias_maps.cf virtual_gid_maps = static:1001 virtual_mailbox_base = /usr/local/virtual virtual_mailbox_domains = mysql:/etc/postfix/mysql/mysql_virtual_domains_maps.cf virtual_mailbox_limit = 51200000 virtual_mailbox_maps = mysql:/etc/postfix/mysql/mysql_virtual_mailbox_maps.cf virtual_minimum_uid = 1001 virtual_transport = virtual virtual_uid_maps = static:1004 --------------------- /usr/local/etc/dovecot.conf base_dir = /var/run/dovecot/ log_path = /var/log/dovecot.log info_log_path = /var/log/dovecot-info.log log_timestamp = "%b %d %H:%M:%S " ssl_disable = yes auth_verbose=yes auth_debug=yes auth_debug_passwords=yes mail_debug=yes protocols = pop3 imap disable_plaintext_auth = no log_timestamp = "%Y-%m-%d %H:%M:%S " mail_location = maildir:/usr/local/virtual/%d/%n mail_access_groups = virtual first_valid_uid = 1004 first_valid_gid = 1005 protocol imap { } protocol pop3 { pop3_uidl_format = %08Xu%08Xv } auth default { mechanisms = plain login digest-md5 passdb sql { args = /usr/local/etc/dovecot-sql.conf } userdb sql { args = /usr/local/etc/dovecot-sql.conf } user = root socket listen { client { path = /var/spool/postifx/private/auth mode = 0660 user = postfix group = postfix } } } Has someone a Idea? Greetings Silvio

2 2

[Dovecot] Fatal: imap-login: io_loop_handle_add: epoll_ctl(1, 4): Operation not permitted
by Jérôme Blanc 03 Apr '09

03 Apr '09

Hello, I'am following the beginning tutorial on the Wiki, but actually, I can't even start the server correctly so far. The imap-login child dies immediately. What I can guess from the log is that it tries some unpermietted operations on some files but I can't find out which files are concerned. Google is not my friend at all either on this matter. How can I know which files are concerned ? Some infos that might help : [root@Aries ~]# dovecot -n # 1.1.6: /etc/dovecot.conf # OS: Linux 2.6.27.14-server-1mnb i686 Mandriva Linux release 2009.0 (Official) for i586 ext3 ssl_cert_file: /etc/pki/tls/certs/dovecot.pem ssl_key_file: /etc/pki/tls/private/dovecot.pem login_dir: /var/run/dovecot/login login_executable: /usr/lib/dovecot/imap-login mail_privileged_group: mail mail_location: maildir:/var/mail/%n auth default: passdb: driver: passwd-file args: /etc/passwd.dovecot userdb: driver: passwd [root@Aries ~]# ls -ld /var/mail drwxrwx--x 3 root mail 4096 2009-03-10 18:06 /var/mail/ [root@Aries ~]# service dovecot start And here is what I get in the /var/log/syslog file : Mar 10 20:00:47 aries dovecot: Dovecot v1.1.6 starting up Mar 10 20:00:48 aries dovecot: Fatal: imap-login: io_loop_handle_add: epoll_ctl(1, 4): Operation not permitted Mar 10 20:00:48 aries dovecot: Temporary failure in creating login processes, slowing down for now Mar 10 20:00:48 aries dovecot: Fatal: imap-login: io_loop_handle_add: epoll_ctl(1, 4): Operation not permitted Mar 10 20:00:48 aries dovecot: Fatal: imap-login: io_loop_handle_add: epoll_ctl(1, 4): Operation not permitted Thanks -- Jérôme Blanc OpenPGP : 1024D/F44DB96C

2 18

[Dovecot] Squat memory usage
by Ryan 02 Apr '09

02 Apr '09

I've been reading about using Squat with Dovecot on large mailboxes. I was wondering if some of the memory usage during searching and indexing could be reduced by using a berkeley db? I've used this in the past for something similar and in BTREE mode it was very fast for millions of keys. I havent had time to look at how squat is implemented, but I thought I'd throw it out there... -Ryan

2 1

[Dovecot] v1.2.beta2: Fatal: io_loop_handle_add: epoll_ctl(1, 10): Bad file descriptor
by Pascal Volk 02 Apr '09

02 Apr '09

Hi Timo, I'm playing with Dovecot v1.2.beta2 currently. When the dict process was started via deliver(?) and Dovecot is killed (kill $PID_OF_DOVECOT) after delivering only one message, it logs: Fatal: io_loop_handle_add: epoll_ctl(1, 10): Bad file descriptor If the dict process was not started or deliver has delivered more than one message, the error doesn't occur. I'm not using SELinux or AppArmor or something similar. # 1.2.beta2: /usr/local/dovecot12/etc/dovecot.conf # OS: Linux 2.6.26-1-amd64 x86_64 Debian squeeze/sid log_path: /usr/local/dovecot12/var/log/dovecot.log protocols: imap listen: 10.11.12.13:10143 ssl: no disable_plaintext_auth: no login_dir: /usr/local/dovecot12/var/run/dovecot/login login_executable: /usr/local/dovecot12/libexec/dovecot/imap-login verbose_proctitle: yes first_valid_uid: 70000 first_valid_gid: 70000 mail_privileged_group: mail mail_location: maildir:~/Maildir mail_plugins: quota imap_quota auth default: mechanisms: digest-md5 cram-md5 login plain user: nobody verbose: yes debug: yes passdb: driver: sql args: /usr/local/dovecot12/etc/dovecot-sql.conf userdb: driver: sql args: /usr/local/dovecot12/etc/dovecot-sql.conf socket: type: listen master: path: /usr/local/dovecot12/var/run/dovecot/auth-master mode: 384 plugin: quota: dict:user::noenforcing:proxy::quotadict quota_rule: *:storage=10M:messages=11 quota_rule2: Trash:storage=50%% mail_debug: yes dict: quotadict: pgsql:/usr/local/dovecot12/etc/dovecot-dict-quota.conf Regards, Pascal -- The trapper recommends today: cafefeed.0907505(a)localdomain.org

2 2