- dovecot - dovecot.org

[Dovecot] dovecot and postfix with tls and dovecot sasl issues for smtp clients
by Harondel J. Sibble 22 Oct '08

22 Oct '08

This issue is peripherally related to the following thread Re: [Dovecot] client certs with godaddy ssl cert This is running on CentOS 5.2 with latest Atrpms for Dovecot as of this weekend. # rpm -qa | grep dovecot dovecot-sieve-1.1.5-8.el5 dovecot-1.1.4-0_81.el5 With assistance from Rainer Frey (Inxmail GmbH), I am able to successfully use client ssl certs for imap access on both my Nokia e61i and Thunderbird 2.0.0.17, problem now is dovecot sasl and postfix smtp authentication. Using the same self created CA that generates and certifies the ssl client certs in Postfix and using Dovecot SASL, I always get client didn't send proper ssl cert when trying to do a tls based smtp connection from either the e61i or tbird. Cranking up the peer debug level in Postfix, I see the connection is always rejected by Dovecot SASL eg Oct 21 16:39:07 myserver postfix/smtpd[18189]: vstream_buf_get_ready: fd 15 got 45 Oct 21 16:39:07 myserver postfix/smtpd[18189]: < mycomp.myserver.net[10.11.12.5]: AUTH PLAIN ********************************************= Oct 21 16:39:07 myserver postfix/smtpd[18189]: xsasl_dovecot_server_first: sasl_method PLAIN, init_response **************************************== Oct 21 16:39:07 myserver postfix/smtpd[18189]: vstream_fflush_some: fd 16 flush 64 Oct 21 16:39:07 myserver postfix/smtpd[18189]: vstream_buf_get_ready: fd 16 got 58 Oct 21 16:39:07 myserver postfix/smtpd[18189]: xsasl_dovecot_handle_reply: auth reply: FAIL?1?reason=Client didn't present valid SSL certificate Oct 21 16:39:07 myserver postfix/smtpd[18189]: warning: mycomp.myserver.net[10.11.12.5]: SASL PLAIN authentication failed: Client didn't present valid SSL certificate Oct 21 16:39:07 myserver postfix/smtpd[18189]: > mycomp.myserver.net[10.11.12.5]: 535 5.7.0 Error: authentication failed: Client didn't present valid SSL certificate Oct 21 16:39:07 myserver postfix/smtpd[18189]: watchdog_pat: 0x868a570 Oct 21 16:39:07 myserver postfix/smtpd[18189]: vstream_fflush_some: fd 15 flush 85 Oct 21 16:39:07 myserver dovecot: auth(default): client in: AUTH 1 PLAIN service=smtp resp=*********************************************== Oct 21 16:39:07 myserver dovecot: auth(default): PLAIN(?): Client didn't present valid SSL certificate Oct 21 16:39:07 myserver dovecot: auth(default): client out: FAIL 1 reason=Client didn't present valid SSL certificate Oct 21 16:39:07 myserver postfix/smtpd[18189]: vstream_buf_get_ready: fd 15 got 12 Oct 21 16:39:07 myserver postfix/smtpd[18189]: < mycomp.myserver.net[10.11.12.5]: AUTH LOGIN Oct 21 16:39:07 myserver postfix/smtpd[18189]: xsasl_dovecot_server_first: sasl_method LOGIN Oct 21 16:39:07 myserver postfix/smtpd[18189]: vstream_fflush_some: fd 16 flush 26 Oct 21 16:39:07 myserver postfix/smtpd[18189]: vstream_buf_get_ready: fd 16 got 58 Oct 21 16:39:07 myserver postfix/smtpd[18189]: xsasl_dovecot_handle_reply: auth reply: FAIL?2?reason=Client didn't present valid SSL certificate Not sure where to look now, I've configured dovecot and postfix as per their respective wiki's Here are the relevant config entries /etc/postfix/main.cf ### Oct 11/08 - added to allow dovecot sasl for smtp auth smtpd_sasl_type = dovecot # Can be an absolute path, or relative to $queue_directory smtpd_sasl_path = private/auth # and the common settings to enable SASL: smtpd_sasl_auth_enable = yes smtpd_recipient_restrictions = permit_sasl_authenticated, reject_unauth_destination smtpd_sasl_security_options = noanonymous ### Oct 11/08 - added to allow tls smtp authentication with client certs smtpd_tls_auth_only = yes smtp_use_tls = yes smtpd_use_tls = yes smtp_tls_note_starttls_offer = yes smtpd_tls_loglevel = 2 smtpd_tls_received_header = yes smtpd_tls_session_cache_timeout = 3600s tls_random_source = dev:/dev/urandom myhostname = server.myserver.net ### these are the self signed CA based authentication keys, this CA created ### the client certs for the nokia e61i and the Thunderbird 2.0.0.17 smtpd_tls_key_file = /etc/postfix/ssl/server.myserver.net.key smtpd_tls_cert_file = /etc/postfix/ssl/server.myserver.net.crt ### this is the ca cert and crl combined smtpd_tls_CAfile = /etc/postfix/ssl/ca1.crt dovecot -n # 1.1.4: /etc/dovecot.conf protocols: imaps pop3s ssl_listen(default): *:993 ssl_listen(imap): *:993 ssl_listen(pop3): *:995 ssl_ca_file: /etc/openvpn/easy-rsa/keys/combined-ca-and-crl.crt ssl_cert_file: /etc/pki/dovecot/certs/dovecot-chained.cert ssl_key_file: /etc/pki/tls/private/server.myserver.net.key ssl_verify_client_cert: yes ssl_require_client_cert = yes verbose_ssl: yes login_dir: /var/run/dovecot/login login_executable(default): /usr/libexec/dovecot/imap-login login_executable(imap): /usr/libexec/dovecot/imap-login login_executable(pop3): /usr/libexec/dovecot/pop3-login mail_location: mbox:~/mail:INBOX=/var/spool/mail/%u:INDEX=~/mail/.imap/indexes mail_debug: yes mail_executable(default): /usr/libexec/dovecot/imap mail_executable(imap): /usr/libexec/dovecot/imap mail_executable(pop3): /usr/libexec/dovecot/pop3 mail_plugin_dir(default): /usr/lib/dovecot/imap mail_plugin_dir(imap): /usr/lib/dovecot/imap mail_plugin_dir(pop3): /usr/lib/dovecot/pop3 auth default: mechanisms: plain login debug: yes debug_passwords: yes ssl_require_client_cert: yes passdb: driver: pam userdb: driver: passwd socket: type: listen client: path: /var/spool/postfix/private/auth mode: 432 user: postfix group: postfix Interestingly enough the mode line in the dovecot.conf file is set as 0660, not 432 as noted above?!?!? What else should I be looking at to troubleshoot this issue? -- Harondel J. Sibble Sibble Computer Consulting Creating Solutions for the small and medium business computer user. help(a)pdscc.com (use pgp keyid 0x3AD5C11D) http://www.pdscc.com (604) 739-3709 (voice/fax) (604) 686-2253 (pager)

4 7

[Dovecot] dovecot delivery log
by jalal 22 Oct '08

22 Oct '08

Trying to debug a delivery problem recently (with Postfix) and I realized that Dovecot wasn't logging any of the delivery information. I'm using Postfix to recieve mail, which is passing it on to Dovecot's deliver to actually deliver the emails into the mail boxes. In dovecot.conf, I have: protocol lda { log_path = /var/tmp/dovecot-deliver.log } [root]# dir /var/tmp/ total 2 drwxrwxrwt 2 root root 1024 Oct 22 12:30 . drwxr-xr-x 24 root root 1024 Aug 5 08:03 .. -rw------- 1 vmail vmail 0 Oct 22 12:11 dovecot-deliver.log The log file gets created OK, but then stays at zero size. Using: Postfix 2.3.3 Dovecot 1.1.4 (and previously 1.0.9) Any clues as to how I can have a delivery log?

2 2

[Dovecot] displaying IMAP folders that are in ~/mail/ at same level as inbox
by David London 22 Oct '08

22 Oct '08

Hi, We are moving our current IMAP based system to a new one with dovecot All I can get about the current IMAP (imapd) system is: IMAP4rev1 v12.264 dovecot version is: 1.0.rc15 In the existing system I can see IMAP folders that are in ~/mail/ with many mail clients (e.g. Thunderbird, Outlook, Seamonkey and horde). These folders are presented in the client software as being at the same level as the inbox - i.e. not inside the folder "mail" On the new system, horde webmail shows the other folders in ~/mail/ as being at the same level as the inbox. But ... all the other mail clients above now show a folder (directory) called mail with the imap folders inside. Is there some way to set this up so these other mail clients see the imap folders in ~/mail/ as being at the same level as the inbox as we have on the old server? Thanks, David _________________________________________________________________

4 6

[Dovecot] Dovecot+PostfixAdmin+PostgreSQL on FreeBSD 7
by Erdenebat Guntomor 22 Oct '08

22 Oct '08

Hi dear All, Currently I'm configuring Dovecot+PostfixAdmin+PostgreSQL on FreeBSD 7 Stable and using Dovecot v1.1.3. I hope I've configured everything. But when I run /usr/local/etc/rc.d/dovecot start then dovecot doesn't seems to running. /var/log/maillog is only showing following. Oct 22 13:37:10 mail dovecot: Dovecot v1.1.3 starting up Oct 22 13:37:10 mail dovecot: auth(default): pgsql: Connected to postfix Oct 22 13:37:10 mail dovecot: auth-worker(default): pgsql: Connected to postfix Here is my current dovecot configuration. Please someone help me. What did I do wrong and what is the problem is? Thank you. mail# dovecot -n # 1.1.3: /usr/local/etc/dovecot.conf log_path: /var/log/dovecot.log info_log_path: /var/log/dovecot_info.log log_timestamp: %Y-%m-%d %H:%M:%S protocols: imap pop3 listen(default): x.x.x.x:143 listen(imap): x.x.x.x:143 listen(pop3): x.x.x.x:110 ssl_disable: yes disable_plaintext_auth: no login_dir: /var/run/dovecot/login login_executable(default): /usr/local/libexec/dovecot/imap-login login_executable(imap): /usr/local/libexec/dovecot/imap-login login_executable(pop3): /usr/local/libexec/dovecot/pop3-login login_greeting_capability(default): yes login_greeting_capability(imap): yes login_greeting_capability(pop3): no verbose_proctitle: yes first_valid_uid: 1983 first_valid_gid: 1983 mail_privileged_group: vmail mail_location: maildir:/var/vmail/%d/%n maildir_copy_preserve_filename: yes mail_executable(default): /usr/local/libexec/dovecot/imap mail_executable(imap): /usr/local/libexec/dovecot/imap mail_executable(pop3): /usr/local/libexec/dovecot/pop3 mail_plugin_dir(default): /usr/local/lib/dovecot/imap mail_plugin_dir(imap): /usr/local/lib/dovecot/imap mail_plugin_dir(pop3): /usr/local/lib/dovecot/pop3 imap_client_workarounds(default): delay-newmail netscape-eoh tb-extra-mailbox-sep imap_client_workarounds(imap): delay-newmail netscape-eoh tb-extra-mailbox-sep imap_client_workarounds(pop3): pop3_enable_last(default): no pop3_enable_last(imap): no pop3_enable_last(pop3): yes pop3_client_workarounds(default): pop3_client_workarounds(imap): pop3_client_workarounds(pop3): outlook-no-nuls oe-ns-eoh auth default: mechanisms: plain login username_format: %Lu passdb: driver: sql args: /usr/local/etc/dovecot-sql.conf userdb: driver: sql args: /usr/local/etc/dovecot-sql.conf socket: type: listen client: path: /var/run/dovecot/auth-client mode: 432 master: path: /var/run/dovecot/auth-master mode: 384

1 0

[Dovecot] Permission issues with subscriptions
by Eric A. Bonney 22 Oct '08

22 Oct '08

I am having some permission issues with my setup and I can't see where to make the change in the configuration files. My users can not create folders at all from their email clients nor from the web interface. I have noticed that each time I try to create a folder the subscriptions files permissions are set to 000. If I go back and reset the permissions to rw-r--r-- then everything is fine until I try to add another folder. running dovecot -n produces the following: # 1.0.10: /etc/dovecot/dovecot.conf listen: [::] login_dir: /var/run/dovecot/login login_executable: /usr/lib/dovecot/imap-login verbose_proctitle: yes first_valid_uid: 1000 default_mail_env: maildir:/mnt/hd4/MailBoxes/%d/%n mail_location: maildir:/mnt/hd4/MailBoxes/%d/%n umask: 511 auth default: user: nobody passdb: driver: sql args: /etc/dovecot/dovecot-sql.conf userdb: driver: prefetch I am guessing that Dovecot is the actual process that is creating the folders on the IMAP server, so where inside the configuration file do I set the permissions for the new folders along with the user and groups? Thanks, -Eric

2 2

[Dovecot] Proxying pop3 sessions into an imap one.
by Diego Liziero 22 Oct '08

22 Oct '08

I know it seems at least unusual. But I would like to know if someone knows a software that can proxy multiple pop3 and imap connections to the same account and use only imap connections to the real server. I need it because I've to deal with two pieces of software that are out of my control: - 1 - A certified mail provider that states something that I would like to know if it's really true, or if it's worth keeping like a funny signature: "multiple imap sessions are possible. When an imap session is active, no pop3 connections are possible on the same account; when no imap connection is active, only one pop3 connection at a time is possible on the same account. This is a limitation of the pop3 protocol." - 2 - A software written to deal with certified mails that supports only pop3 used by many people on the same account, (and the same account is used also by multiple imap mail readers). Regards, Diego.

2 2

[Dovecot] Too many open files
by Antonio Casado Rodríguez 22 Oct '08

22 Oct '08

Hi, other error in "open files": dovecot: Oct 20 10:52:36 Fatal: execv(/usr/local/sbin/post-login-imap-dovecot) failed: Too many open files dovecot: Oct 20 10:52:36 Error: child 1038 (imap) returned error 84 (exec() failed) dovecot: Oct 20 10:55:51 Fatal: execv(/usr/local/sbin/post-login-imap-dovecot) failed: Too many open files dovecot: Oct 20 10:55:51 Error: child 4853 (imap) returned error 84 (exec() failed) dovecot: Oct 20 10:55:53 Fatal: execv(/usr/local/sbin/post-login-imap-dovecot) failed: Too many open files dovecot: Oct 20 10:55:53 Error: child 4898 (imap) returned error 84 (exec() failed) dovecot: Oct 20 10:55:54 Fatal: execv(/usr/local/sbin/post-login-imap-dovecot) failed: Too many open files dovecot: Oct 20 10:55:54 Error: child 4906 (imap) returned error 84 (exec() failed) # ulimit -a core file size (blocks, -c) 0 data seg size (kbytes, -d) unlimited scheduling priority (-e) 0 file size (blocks, -f) unlimited pending signals (-i) 81919 max locked memory (kbytes, -l) 32 max memory size (kbytes, -m) unlimited open files (-n) 1024 pipe size (512 bytes, -p) 8 POSIX message queues (bytes, -q) 819200 real-time priority (-r) 0 stack size (kbytes, -s) 10240 cpu time (seconds, -t) unlimited max user processes (-u) 81919 virtual memory (kbytes, -v) unlimited file locks (-x) unlimited We work in "High-performance mode" with login_max_processes_count = 256 Our script "post-login-imap-dovecot" is: #!/bin/sh touch ~/.last_login exec /usr/libexec/dovecot/imap Now, we have this: # lsof -p `cat /var/run/dovecot/master.pid` | wc -l 1018 ¿Any idea? Thanks a lot. Bye.

4 6

[Dovecot] ACL plugin: Is CVE-2008-4578 going to be fixed in 1.0 branch?
by Michal Hlavinka 21 Oct '08

21 Oct '08

Hi! I would like to know if there is a plan to fix CVE-2008-4578 bug (ACL vs. "parent/child/child" mailboxes) in 1.0 branch? I've tried to backport patch from 1.1.4 but with no success. Thanks Michal

2 1

[Dovecot] quota-warning.sh mail from
by Proskurin Kirill 21 Oct '08

21 Oct '08

Hello all How Dovecot 1.1.3 quota script understand to who send a mail? In try to do this: In conf: quota_warning = storage=80%% /usr/local/bin/quota-warning.sh 80 %u@%d In logs: IQuota warning: bytes=168611020 (80%) messages=0 (0%) command=/usr/local/bin/quota-warning.sh 80 dump-capability@ *what is dump-capability@ ? OS related user?...* #cat quota-warning.sh #!/bin/sh PERCENT=$1 TO=$2 echo "Your mailbox is $PERCENT% full. If it overfill - you will can not get new email. Please clean up your mailbox. -- Mail Administator" | /usr/bin/mail -s "Email mailbox is $PERCENT% full" $TO -f postmaster(a)domain.off exit 0 --- Im thinking in wrong way? -- Best regards, Proskurin Kirill

3 8

[Dovecot] 1.2: Bug in listing of shared mailboxes with dot in user id
by Sascha Wilde 21 Oct '08

21 Oct '08

In dovecot 1.2 I can create a shared name space like this: namespace shared { separator = / prefix = users/%%u/ location = Maildir:/PATH/TO/spool/%%u/maildir:INDEX=/PATH/TO/spool/%u/maildir/shared_idx subscriptions = no } now, when I subscribe to a shared mailbox of another user with an dot in the users id, like: users/2(a)example.com/INBOX/foo and I list my subscribed mailboxes I get: l001 lsub "" "*" * LSUB () "/" "users/2@example/com/INBOX/foo" as you can see the dot in the user-id got normalized to the hierarchy seperator `/' -- which of cause is wrong. ;-) cheers sascha -- Sascha Wilde OpenPGP key: 4BB86568 http://www.intevation.de/~wilde/ http://www.intevation.de/ Intevation GmbH, Neuer Graben 17, 49074 Osnabrück; AG Osnabrück, HR B 18998 Geschäftsführer: Frank Koormann, Bernhard Reiter, Dr. Jan-Oliver Wagner

3 3