- dovecot - dovecot.org

[Dovecot] More info from mail_log plugin
by Bardur Haskor 19 Dec '08

19 Dec '08

HiWe need to track exactly when our users read messages. Unfortunately, I haven't been able to figure out how we can achieve this with Dovecot. Then I saw the mail_log plugin.Is it possible to extend the plugin to also log system flag changes? This would be great, because then we could see in the log files when the Seen flag has been set. Changes in user defined flags would also be interesting to track.I know this would create a lot of log entries, but for us this wouldn't be a problem. Maybe the plugin would default to not tracking flag changes, but could be configured to do so.RegardsBardur Ha Skor _________________________________________________________________ Connect to the next generation of MSN Messenger http://imagine-msn.com/messenger/launch80/default.aspx?locale=en-us&source=…

2 3

[Dovecot] "nopassword" extra field useless with LDAP passdb
by Zohan 19 Dec '08

19 Dec '08

Hi, We are trying to implement a highly secure mail server with user authentication restricted to SSL certificates only (not using passwords at all). Still, user information is stored in a LDAP directory. In this configuration LDAP is used to check whether the user is registered (and probably supply quota and other info), and actual authentication is done by SSL layer. According to wiki, a "nopassword" extra field should be supplied, together with empty password. But there is no way to return an empty password from LDAP, as LDAP simply does not allow "empty attributes"; if an attribute is present, it is not empty. Supplying empty password as a static field (like this: pass_attrs = uid=user,=password=,nopassword) works an odd way, allowing empty password only, not "any password", and most MUAs (including our target Thunderbird) do not allow empty passwords. Log excerpt follows ("1" was entered as a password during POP3 session; static empty password was configured as above): ==================== Dec 9 02:11:15 localhost dovecot: auth(default): ldap(user1,127.0.0.1): pass search: base=ou=People,dc=example,dc=com scope=subtree filter=(&(objectClass=inetOrgPerson)(uid=user1)) fields=uid,nopassword Dec 9 02:11:15 localhost dovecot: auth(default): ldap(user1,127.0.0.1): result: uid(user)=user1 Dec 9 02:11:15 localhost dovecot: auth(default): ldap(user1,127.0.0.1): Password mismatch Dec 9 02:11:15 localhost dovecot: auth(default): ldap(user1,127.0.0.1): PLAIN(1) != '' Dec 9 02:11:17 localhost dovecot: auth(default): client out: FAIL 1 user=user1 Dec 9 02:11:19 localhost dovecot: pop3-login: Aborted login (auth failed, 1 attempts): user=<user1>, method=PLAIN, rip=127 .0.0.1, lip=127.0.0.1, secured ==================== That's why we now have to maintain a separate passwd-like file with the following contents: user1:::::::nopassword user2:::::::nopassword ... and so on (updating it each time manually as users are added/removed), and use it as passdb. Only this allows true "any password" policy. In fact, the problem seems to be a little bit deeper. In our setup user/password challenge is not needed at all. This is exactly what RFC 4959, "IMAP Extension for Simple Authentication and Security Layer (SASL) Initial Client Response", is about (http://tools.ietf.org/html/rfc4959 , see SASL EXTERNAL example). Are there any plans to implement SASL EXTERNAL mechanism in Dovecot? Thank you! Zohan

3 5

[Dovecot] OT: Looking for a robust IMAP client
by Stewart Dean 18 Dec '08

18 Dec '08

This weekend we had a runaway email endless loop. When it was killed after 18 hours, my inbox had 135,000 messages in it...there were two messages that were being endlessly sent and bounced and I'm on the postmaster alias. Thunderbird was able to do a mass select of one of the two messages, and deleted 65,000, but after that it locked up. I ended up firing up Pine to do the final 65,000...whereas TBird had had mulitple imap sessions (and failed), Pine only had one and did the job. And even after I had done the mass delete of the other 65,000 and the inbox was down to 2000 messages, TBird was still hiding under the covers and telling me there were still 135,000 messages. In the end, I had to kill the TBird profile for that account and recreate it. Is there a simple robust IMAP client to replace Pine (which I *think* is no longer supported)? GUI or TTY session? I'm wondering if there is something we can tell users to use when Things Are Dire. GUI would be better since it removes one of the few remaining reasons for a logon server -- ==== Once upon a time, the Internet was a friendly, neighbors-helping-neighbors small town, and no one locked their doors. Now it's like an apartment in Bed-Stuy: you need three heavy duty pick-proof locks, one of those braces that goes from the lock to the floor, and bars on the windows.... ==== Stewart Dean, Unix System Admin, Bard College, New York 12504 sdean(a)bard.edu voice: 845-758-7475, fax: 845-758-7035

14 19

[Dovecot] [PATCH] drop root privileges on solaris, request for testing
by Andrey Panin 18 Dec '08

18 Dec '08

Hello all, this patch allows master process to drop more root priveleges under Solaris. My limited testing shows that code works, but I'm not sure that defined privilege set is permissive enough for dovecot. Unfortunately I have no root access to our Solaris servers to really test it. So if someone is ready to test this patch please do it :) Best regards.

3 6

[Dovecot] Dovecot imap processes pinning CPU
by David Rosenstrauch 18 Dec '08

18 Dec '08

In recent days, dovecot's "imap" processes keep getting stuck. Each time I check my server (running dovecot 1.1.7) there's a bunch of "imap" processes (sometimes 2 of them, sometimes 4, sometimes 6) that are using all of the box's CPU. And worse, there's no way to kill the processes either (neither kill -15 or kill -9 works), which means that I wind up having to reboot the box every time this happens. REALLY irritating. I don't normally even *see* the imap processes in htop, as I think they're pretty short lived. And I'm not sure what they're looping trying to do. My debugging skills on Linux are a bit weak, and so I don't know how to look at the process and see what it's doing. Also, not sure what's changed on my system to cause this, as this is definitely a recent problem. Maybe the upgrade to Thunderbird 2.0.0.18 (since I usually use T'Bird to access my email). I don't seem to run into this problem when I use Squirrelmail. Anyone have any idea what the problem might be? Or, if not, then suggestions on how I might be able to debug the situation myself? TIA, DR

6 10

[Dovecot] SSL Certificate Authentication
by Anthony Davies 18 Dec '08

18 Dec '08

Hi Guys, I am using the SSL Client Certificate authentication method for my Dovecot instance, however rather then just requiring the client certificate it also prompts me for my user password. My certificate was securely generated on a smart card and is passphrase protected so I would like to stop having to enter my certificate passphrase and my user password to collect my mail. Where abouts in the config file can I resolve this issue? Cheers, Tony Davies

4 5

Re: [Dovecot] Segfault on antispam plugin
by Allan Cassaro 18 Dec '08

18 Dec '08

On Thu, Dec 11, 2008 at 7:49 AM, Allan Cassaro <allan.cassaro(a)gmail.com> wrote: > On Thu, Dec 11, 2008 at 7:17 AM, Steffen Kaiser > <skdovecot(a)smail.inf.fh-brs.de> wrote: >> -----BEGIN PGP SIGNED MESSAGE----- >> Hash: SHA1 >> >> On Thu, 11 Dec 2008, Allan Cassaro wrote: >> >> On Thu, 11 Dec 2008, Allan Cassaro wrote: >> >>> I don´t have SELinux, or any type or hardening... The ulimit (when >>> logged with dovecot user) is "unlimited"... >> >> Yes, but when Dovecot is spawned as service, the user dovecot does not log >> in (through PAM anyway to have pam_limits invoked), therefore I assume >> that limits.conf does not take effect. >> >>> Dovecot ran with a lot of proccess here, something about 800~900 imap >>> proccess and 5~10 login-proccess to 300~400 simultaneous users... >> >> Hmm, I do remember something similiar when the new students arrived and >> the number of simultaneous logins increased above some limit. >> I added the ulimit command to init.d. > > After our conversation, I made some tests: > 1) Adding this line to /etc/pam.d/common-session (Debian system) > > session required pam_limits.so > > # cat /etc/security/limits.conf > dovecot hard nofile 2048 > dovecot soft nofile 2048 > > The limits.conf is respected now. > # su -c 'ulimit -n' dovecot > 2048 (The value of limits.conf) > (no login) > > # /etc/init.d/dovecot restart > Warning: fd limit 1024 is lower than what Dovecot can use under full > load (more than 1456). Either grow the limit or change > login_max_processes_count and max_mail_processes settings > > (Problem persists) > > 2) Change the ulimit for root user (as you saw): > # ulimit -n 2048 > > # /etc/init.d/dovecot restart > (no errors) > > # cat /etc/security/limits.conf > dovecot hard nofile 2048 > dovecot soft nofile 2048 > root hard nofile 2048 > root soft nofile 2048 > > So, I think that dovecot uses the limit from the "root" user, not dovecot... > Now I will wait 20 minutes and see what happens :D > > Hooo.. another (ugly) think: > When imap crashes, the antispam plugin don't erase the > /tmp/antispam-plugin-XXXXX dir (obviously). So this is possibly to > "delay" or avoid creation of temp dirs? > Hi Steffen, after some others tests, I don't have problem with file descriptors any more, but the plugin make the imap proccess dies with segfault yet... How can I help more to find this issue? Regards.

2 3

[Dovecot] panic in mail-index-view.c
by Peter Risdon 17 Dec '08

17 Dec '08

With just one user, on a virtual hosting system with several hundred users spread across a couple of dozen domains, there is the following error, repeated a couple of times a second without variation, when the user tries to connect with Thunderbird to read his mail: dovecot: Panic: IMAP(*******(a)****.co.uk): file mail-index-view.c: line 265 (view_lookup_seq_range): assertion failed: (first_uid <= last_uid) Any help would be appreciated. TIA, Peter Risdon. # dovecot --version 1.1.7 # dovecot -n # 1.1.7: /usr/local/etc/dovecot.conf # OS: FreeBSD 6.2-RELEASE-p7 i386 nullfs protocols: imap imaps pop3 pop3s ssl_cert_file: /etc/ssl/certs/server.crt ssl_key_file: /etc/ssl/private/server.key ssl_key_password: ********** disable_plaintext_auth: no login_dir: /var/run/dovecot/login login_executable(default): /usr/local/libexec/dovecot/imap-login login_executable(imap): /usr/local/libexec/dovecot/imap-login login_executable(pop3): /usr/local/libexec/dovecot/pop3-login verbose_proctitle: yes first_valid_uid: 125 first_valid_gid: 125 mail_access_groups: postfix mail_location: maildir:/var/virtualmail/%d/%u/ mmap_disable: yes lock_method: dotlock mbox_read_locks: dotlock mbox_write_locks: dotlock mail_executable(default): /usr/local/libexec/dovecot/imap mail_executable(imap): /usr/local/libexec/dovecot/imap mail_executable(pop3): /usr/local/libexec/dovecot/pop3 mail_plugin_dir(default): /usr/local/lib/dovecot/imap mail_plugin_dir(imap): /usr/local/lib/dovecot/imap mail_plugin_dir(pop3): /usr/local/lib/dovecot/pop3 imap_client_workarounds(default): delay-newmail outlook-idle netscape-eoh tb-extra-mailbox-sep imap_client_workarounds(imap): delay-newmail outlook-idle netscape-eoh tb-extra-mailbox-sep imap_client_workarounds(pop3): pop3_client_workarounds(default): pop3_client_workarounds(imap): pop3_client_workarounds(pop3): outlook-no-nuls oe-ns-eoh namespace: type: private separator: . prefix: INBOX. inbox: yes list: yes subscriptions: yes auth default: mechanisms: plain login verbose: yes debug: yes passdb: driver: sql args: /usr/local/etc/dovecot-mysql.conf userdb: driver: sql args: /usr/local/etc/dovecot-mysql.conf socket: type: listen client: path: /var/spool/postfix/private/auth mode: 432 user: postfix group: postfix

3 3

[Dovecot] Autocreate wrong version for dovecot's version installed on system.
by Romer Ventura 17 Dec '08

17 Dec '08

Hello, I downloaded the dovecot-autocreate-0.1-4.6.i586.rpm made by Time Sirainen from opensuse.org and I am getting the following messages in my logs: Module is for different version 1.0.15: /usr/lib/dovecot/modules/imap/lib90_autocreate_plugin.so Couldn't load required plugins They appear for every attempt to autocreate a folder. So my question is what can I do to make it work with: # dovecot -n # 1.1.7: /etc/dovecot/dovecot.conf # OS: Linux 2.6.16.60-0.21-xenpae i686 SUSE Linux Enterprise Server 10 (i586) login_dir: /var/run/dovecot/login login_executable: /usr/lib/dovecot/imap-login mail_uid: vmail mail_gid: vmail mail_location: maildir:~/Maildir/ mail_plugins: lazy_expunge autocreate imap_client_workarounds: delay-newmail outlook-idle netscape-eoh namespace: type: private separator: / inbox: yes list: yes subscriptions: yes namespace: type: private separator: / prefix: .EXPUNGED/ location: maildir:/home/vmail/%Ud/%Ln/Maildir/expunged list: yes subscriptions: yes namespace: type: private separator: / prefix: .DELETED/ location: maildir:/home/vmail/%Ud/%Ln/Maildir/deleted list: yes subscriptions: yes namespace: type: private separator: / prefix: .DELETED/.EXPUNGED/ location: maildir:/home/vmail/%Ud/%Ln/Maildir/deleted/expunged list: yes subscriptions: yes auth default: mechanisms: plain login passdb: driver: ldap args: /etc/dovecot/dovecot-ldap.conf userdb: driver: ldap args: /etc/dovecot/dovecot-ldap.conf socket: type: listen client: path: /var/spool/postfix/private/auth mode: 432 user: postfix group: postfix master: path: /var/run/dovecot/auth-master mode: 384 user: vmail group: vmail plugin: lazy_expunge: .EXPUNGED/ .DELETED/ .DELETED/.EXPUNGED/ autocreate: Deleted Items autocreate1: Drafts autocreate2: Junk E-mail autocreate3: Outbox autocreate4: Sent Items autosubscribe: Deleted Items autosubscribe1: Drafts autosubscribe2: Junk E-mail autosubscribe3: Outbox autosubscribe4: Sent Items

1 0

[Dovecot] v1.1.6 released
by Timo Sirainen 17 Dec '08

17 Dec '08

http://dovecot.org/releases/1.1/dovecot-1.1.6.tar.gz http://dovecot.org/releases/1.1/dovecot-1.1.6.tar.gz.sig The invalid message address parsing bug is pretty important since it allows a remote user to send broken mail headers and prevent the recipient from accessing the mailbox afterwards, because the process will always just crash trying to parse the header. This is assuming that the IMAP client uses FETCH ENVELOPE command, not all do. Note that it doesn't affect versions older than v1.1.4. + dovecot -n and -a now prints some system information at the top. + More error/debug message logging improvements. - pop3-login: Fixed assert-crash if a client sent USER+PASS+USER+PASS commands in the same IP packet. - Parsing an invalid message address like "From: (" caused an assert-crash in v1.1.4 and v1.1.5. - Folding whitespace wasn't handled correctly inside quoted-strings, causing some messages to be parsed incorrectly. - mbox: Fixed saving messages that begin with a valid From_-line.

10 25