- dovecot - dovecot.org

[Dovecot] Unkillable imap process?
by Johan Persson 03 Jan '09

03 Jan '09

Hi, Not sure if this is relevant but having been running dovecot 1.1.4 for a long time (without any problem) I recently upgraded to 1.1.7 when I switched to SuSE 11.1 This is just running on my home server and it's a fairly standard fetchmail-procmail-dovecot setup. However I recently had an incident which I cannot quite explain. I suspect it could be a possible disk problem but I did run a SMART check and the disks and HW seems ok. The mail store is mounted on a separate partition using ext3 fs What happened was that I noticed that the load on my server went through the roof and that the imap process was hogging 100% of the CPU and it had been running so for over an hour. Before this happened I had just setup a new laptop with Thunderbird as the mail client and had just done a off-line sync of my whole mail store (~1.5GB). So for a short time the dovecot server would have been under maximum load. I tried to recover by gracefully shutting down dovecot and when that didn't stop the imap process I first tried to be nice by sending it the TERM signal and when that didn't do it, the KILL signal. However, I was not able to stop the imap process. I then decided to recycle the server and initiated a shutdown. However, not even that was able to complete (since the shutdown process seemed to be hanging on not being able to stop the imap process). In the end I was (for the first time in over 6 years) forced to use the hard reset button on the server. I do realize that this is almost impossible to diagnose, but does anyone now in general what could possible cause the imap process to so completely be locked up that it is impossible to even shut it down? The dovecot -n output is 1.1.7: /etc/dovecot/dovecot.conf # OS: Linux 2.6.27.7-9-pae i686 openSUSE 11.1 (i586) ext3 log_path: /var/log/dovecot.err info_log_path: /var/log/dovecot.info login_dir: /var/run/dovecot/login login_executable: /usr/lib/dovecot/imap-login login_processes_count: 2 login_max_processes_count: 2 login_max_connections: 5 max_mail_processes: 32 mail_max_userip_connections: 8 mail_location: maildir:/srv/mail/%u mailbox_idle_check_interval: 15 fsync_disable: yes auth default: passdb: driver: pam userdb: driver: passwd Cheers Johan

3 2

[Dovecot] Possible to log IMAP connections to MySQL Table?
by Corey Shaw 03 Jan '09

03 Jan '09

Is it currently possible to log all IMAP connection attempts to a MySQL table? Thanks. _____________________ Corey

8 13

[Dovecot] NFS, IDLE, and index locking
by Jack Stewart 31 Dec '08

31 Dec '08

Hi, I'll try to keep short. My primary question is what, in people's experience, are the best configuration settings for to avoid potential NFS cache locking issues in an interesting heterogeneous environment? We appear to have a workaround for some locking issues we have seen, which is turning off IDLE. Upgrading our version of dovecot from 1.1.4 is likely to address some core issues, but I want to get the system setup in tune first. There are some things in our setup that seem dumb, and I would like to make sure they are dumb. As far as our environment goes, it isn't unusual for our users to connect with multiple different clients from multiple locations. Some of these clients behave well, and some not so well. In addition we have multiple distributed servers with multiple instances. Generally the connection from one of their clients/desktops goes to the same server but their different desktops may connect to different servers. If anyone has a similar enough environment, do you find it better to have the hard link setting off or is it better for you to turn it on? The attribute cache is the default (60 seconds) which works well enough in a polling setting but may be a problem with IDLE (30 second check). Do you find it better to bump up the IDLE check interval or drop the attribute cache? Our cache and maildir are on separate NFS volumes so we can change one without changing the other. Our tcp timeout setting is too long (it is the default). Do you find 180-300 seconds more reasonable? ---Jack To give some context, we have a handful of users with intermittent caching locking where the dovecot.index.cache file would simply not update. One of our internal people managed to get this problem when he was using pine (non-IDLE) with gnubiff (IDLE) from the same desktop. We haven't had any alarms since taking the brute force approach of turning off IDLE. Unfortunately other projects are inhibiting my capacity for additional debugging at this time. Also, it isn't clear to me that we will learn anything useful since the servers do not appear to be tuned and they are only running dovecot 1.1.4. Just for reference, below is our dovecot configutation. disable_plaintext_auth = yes base_dir = /var/run/dovecot/imap-server-its/ protocols = imap imaps syslog_facility = local4 shutdown_clients = yes ssl_cert_file = xxx.pem ssl_key_file = yyy.key ssl_ca_file = zzz.pem mail_location = maildir:/var/spool/maildir/%1Ln/%Ln:INDEX=/var/spool/dovecot/indexes/%1Ln/%Ln login_greeting_capability = no verbose_proctitle = yes mail_debug = yes imap_capability = "IMAP4rev1 SASL-IR SORT THREAD=REFERENCES MULTIAPPEND UNSELECT LITERAL+ CHILDREN NAMESPACE LOGIN-REFERRALS UIDPLUS LIST-EXTENDED I18NLEVEL=1" # MAILDIR Performance settings maildir_copy_with_hardlinks = yes maildir_copy_preserve_filename = no # Handling web logins & imap traffic login_processes_count = 16 login_max_processes_count = 2048 max_mail_processes = 4096 mail_max_userip_connections = 2000 # NFS settings mmap_disable = yes fsync_disable = no mail_nfs_index = yes mail_nfs_storage = yes dotlock_use_excl = yes lock_method =fcntl protocol imap { listen = *:10143 ssl_listen = *:10993 imap_client_workarounds = delay-newmail outlook-idle netscape-eoh } ## Authentication processes namespace private { separator = . prefix = Mail. inbox = yes } auth_verbose = yes auth default { mechanisms = plain login passdb ldap { args = /etc/dovecot.conf-ldap } userdb static { args = uid=vmail gid=mail home=/var/spool/maildir/%1Ln/%Ln } socket listen { master { path = /var/run/dovecot/imap-server-its/auth-master user = vmail group = mail } user = root }

2 2

Re: [Dovecot] Bug in Dovecot 1.0.5 - CRYPT-MD5 not working
by Timo Sirainen 31 Dec '08

31 Dec '08

On Dec 31, 2008, at 1:50 AM, Jim Salter wrote: > Hrm. OK, not arguing, just curious: where is the MD5-CRYPT standard > defined? I don't think it's a real standard. It's just something that libcs started implementing. I think OpenBSD did it first and then others started copying. > Worth noting that the (Apache?) standard in question is also the one > used in vpopmail vpasswd.cdb files (authdb vpopmail, userdb vpopmail). Would it work if you simply changed $apr1$ to $1$? I can't really see why $apr1$ would otherwise work in glibc. I just checked its sources and also Ubuntu patches. There's no mention of apr1 in them.

2 1

[Dovecot] Bug in Dovecot 1.0.5 - CRYPT-MD5 not working
by Jim Salter 31 Dec '08

31 Dec '08

Problem: Using MySQL storage for the user and password db with MD5-CRYPT hashes, Dovecot fails to successfully authenticate when the MD5-CRYPT or MD5 settings are specified as default_pass_scheme in dovecot-mysql.conf. Dovecot /does/ successfully authenticate against MD5-CRYPT hashes when default_pass_scheme is set to CRYPT, which according to the docs should be DES encryption. (I do not know whether or not CRYPT actually works with DES hashes.) I am positive that I am using MD5-CRYPT hashes, as I have dropped in hashes from a Qmail/Vpopmail vpasswd file and they work with the CRYPT setting in Dovecot, as do hashes generated using htpasswd -nmb. Test system: Ubuntu Server 7.10, amd64 Dovecot 1.0.5 (from Ubuntu repositories) Postfix 2.4.5 (from Ubuntu repositories) Demonstration: # cat /etc/dovecot/dovecot-mysql.conf driver = mysql connect = dbname=redacted user=redacted host=127.0.0.1 password=redacted default_pass_scheme = MD5-CRYPT password_query = SELECT password FROM mailbox WHERE username = '%u' user_query = SELECT maildir, 105 AS uid, 114 AS gid FROM mailbox WHERE username = '%u' # htpasswd -nmb user password user:$apr1$bZQl//..$2IPoOibTBaqpG7pPFigOy/ # mysql -u postfix -p mysql> use redacted; Database changed mysql> update userdb set password='$apr1$bZQl//..$2IPoOibTBaqpG7pPFigOy/' where username='user'; Query OK, 1 rows affected (0.00 sec) mysql>quit Bye # telnet localhost 143 Trying 127.0.0.1... Connected to localhost. Escape character is '^]'. * OK Dovecot ready. a login user password a NO Authentication failed. a logout * BYE Logging out a OK Logout completed. Connection closed by foreign host. # replace MD5-CRYPT CRYPT -- /etc/dovecot/dovecot-mysql.conf # /etc/init.d/dovecot restart * Restarting IMAP/POP3 mail server dovecot [ OK ] # telnet localhost 143 Trying 127.0.0.1... Connected to localhost. Escape character is '^]'. * OK Dovecot ready. a login user password a OK Logged in. a logout * BYE Logging out a OK Logout completed. Connection closed by foreign host.

2 1

[Dovecot] admin tool
by Romer Ventura 30 Dec '08

30 Dec '08

Hello, I havent found anything on the topic, but does dovecot has a admin tool like Cyrus..? Thanks ------ Romer Ventura Network administrator

2 1

[Dovecot] SSL cert problems.
by Geoff Sweet 30 Dec '08

30 Dec '08

I'm really racking my brain trying to figure this one out here. I am running a pop3 server for remote offices on CentOS 5.2. We purchased a SSL cert from Verisign and installed it on our dovecot server, but I continue to get failure problems with the cert and I don't know where to go from here. here is some info about our config: dovecot version: # dovecot --version 1.0.7 hostname: pop.x10.com dovecot.conf: # dovecot -n # 1.0.7: /etc/dovecot.conf base_dir: /var/run/dovecot/ log_path: /var/log/dovecot.log protocols: pop3 pop3s ssl_ca_file: /etc/pki/verisign/intermediate_ca.cer ssl_cert_file: /etc/pki/dovecot/certs/pop.x10.com.cer ssl_key_file: /etc/pki/dovecot/private/pop.x10.com.key ssl_cipher_list: HIGH:MEDIUM:+TLSv1:!SSLv2:+SSLv3 verbose_ssl: yes login_dir: /var/run/dovecot//login login_executable: /usr/libexec/dovecot/pop3-login mail_executable: /usr/libexec/dovecot/pop3 mail_plugin_dir: /usr/lib/dovecot/pop3 pop3_client_workarounds: outlook-no-nuls auth default: passdb: driver: pam userdb: driver: passwd and last but not least, here is my test from openssl. Mind you this fails as a "BAD" ssl cert in Evolution. :~$ openssl s_client -ssl2 -connect pop.x10.com:995 CONNECTED(00000003) depth=0 /C=US/ST=Washington/L=Renton/O=X10 Wireless Technology, Inc./OU=Information Technology/OU=Terms of use at www.verisign.com/rpa (c)05/CN=pop.x10.com verify error:num=20:unable to get local issuer certificate verify return:1 depth=0 /C=US/ST=Washington/L=Renton/O=X10 Wireless Technology, Inc./OU=Information Technology/OU=Terms of use at www.verisign.com/rpa (c)05/CN=pop.x10.com verify error:num=27:certificate not trusted verify return:1 depth=0 /C=US/ST=Washington/L=Renton/O=X10 Wireless Technology, Inc./OU=Information Technology/OU=Terms of use at www.verisign.com/rpa (c)05/CN=pop.x10.com verify error:num=21:unable to verify the first certificate verify return:1 21568:error:1406D0B8:SSL routines:GET_SERVER_HELLO:no cipher list:s2_clnt.c:450: As you can see, the certificate clearly fails. I don't know how to make this work at this point. Any thoughts or advice would be greatly appreciated. -G

4 11

[Dovecot] another assertion failure in dovecot 1.1.7 mbox-sync-rewrite: (mails[idx].from_offset == start_offset)
by Diego Liziero 29 Dec '08

29 Dec '08

Sorry, this time I've no core file, (I forgot to set ulimit -c unlimited before starting dovecot) Regards, Diego. --- dovecot: Dec 09 08:26:52 Panic: IMAP(user): file mbox-sync-rewrite.c: line 590 (mbox_sync_rewrite): assertion failed: (mails[idx].from_offset == start_offset) dovecot: Dec 09 08:26:52 Error: IMAP(user): Raw backtrace: /usr/libexec/dovecot/imap [0x80f739e] -> /usr/libexec/dovecot/imap [0x80f7c5f] -> /usr/libexec/dovecot/imap(i_fatal+0) [0x80f7518] -> /usr/libexec/dovecot/imap(mbox_sync_rewrite+0x6e8) [0x8094e45] -> /usr/libexec/dovecot/imap [0x809105c] -> /usr/libexec/dovecot/imap [0x8091d77] -> /usr/libexec/dovecot/imap [0x809277e] -> /usr/libexec/dovecot/imap(mbox_sync+0x2b) [0x8092a0a] -> /usr/libexec/dovecot/imap [0x8084ff3] -> /usr/libexec/dovecot/imap(mailbox_close+0x47) [0x80b701c] -> /usr/libexec/dovecot/imap(cmd_close+0xc0) [0x805b5d8] -> /usr/libexec/dovecot/imap [0x80625c4] -> /usr/libexec/dovecot/imap [0x80627f9] -> /usr/libexec/dovecot/imap [0x80628f7] -> /usr/libexec/dovecot/imap [0x8062933] -> /usr/libexec/dovecot/imap(client_input+0xb7) [0x8062ac1] -> /usr/libexec/dovecot/imap(io_loop_handler_run+0x17d) [0x8101ecd] -> /usr/libexec/dovecot/imap(io_loop_run+0x35) [0x8101164] -> /usr/libexec/dovecot/imap(main+0xb0) [0x806df19] -> /lib/libc.so.6(__libc_start_main+0xdc) [0x7a5dec] -> /usr/libexec/dovecot/imap [0x805a2b1]

2 3

[Dovecot] Password field limitations
by Tom Sommer 29 Dec '08

29 Dec '08

Hi, I've searched the WIKI for this information but seem unable to find anything about it. What limitations are imposed on the password for IMAP/POP3 users? I've had a customer saying they can't use passwords which contain "." or ":", and some seem to have problems when the password is 8 characters. I use PLAIN authentication, passwords are stored in a MySQL database. Thanks a lot -- Tom Sommer

4 5

[Dovecot] automounting home dirs
by Roger Hale 29 Dec '08

29 Dec '08

Hi, I'm running dovecot-1.0.10 on a Solaris 10 server with home dirs automounted over NFS. I have set the mail_location configuration option so that nothing should be written to a user's home dir over NFS but, as far as I can tell, dovecot still by default tries to chdir to a user's home dir when reading mail, although this is not required. This creates additional unnecessary load on a heavily-loaded fileserver and generally slows everything down and creates an unnecessary dependency. Is there a way to prevent dovecot from causing the home dirs to be mounted? I found this thread: http://markmail.org/message/umywuppl3vvzfe4p#query:dovecot%20mount%20home%2… which discusses the same problem, but it's quite old and there doesn't seem to be a definitive answer other than hacking the passwd file or the code. Is there a more elegant solution? TIA. _________________________________________________________________ Get a bird’s eye view of the world with Multimap http://clk.atdmt.com/GBL/go/115454059/direct/01/

2 3