- dovecot - dovecot.org

[Dovecot] Error message in logs since 1.1.6 upgrade
by Guy 21 Nov '08

21 Nov '08

Hi, I've got two imap boxes, one is running 1.1.5 and hasn't exhibited the error below, but the one that's been upgraded to 1.1.6 is showing them. Nov 14 16:06:31 mink dovecot: imap-login: Disconnected (no auth attempts): rip=x.x.x.x, lip=x.x.x.x, TLS handshaking: SSL_accept() failed: error:1408F119:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac If this isn't already a known error, is there any extra data I can collect that would help diagnose what's causing it? I haven't a clue where to start with this sort of debugging I'm afraid. Thanks Guy -- Don't just do something...sit there!

2 1

[Dovecot] sieve-body extension support for deliver LDA's sieve plugin
by BrunoM 21 Nov '08

21 Nov '08

Hello, I just read your message about sieve and body-extension in Dovecot. Do you have news on that topic? I just have to filter mails containing a particular text fragment, and I cannot do without sieve body, I think.. Thank you for any clue you'd be able to give me ! Regards, Bruno --- Hi Timo & Co, Is there any time frame for updating the deliver LDA's sieve plugin code to that from Cyrus IMAPd v2.3.x? I ask as I'm looking for the functionality of the sieve-body extension, as described here: http://www.ietf.org/internet-drafts/draft-ietf-sieve-body-06.txt This requirement has come up as we're upgrading from a Courier-IMAP/maildrop configuration that has some filtering based on message body content. As an aside, if that time frame is undefined or will be long, if I use maildrop instead as my LDA, will I loose the instant delivery notification via IMAP IDLE? Thanks very much, Scott

2 1

[Dovecot] %d in deliver
by Mark Zealey 21 Nov '08

21 Nov '08

Hi there, I run a system that has a lot of virtual users. We invoke deliver from exim and pass the directory to deliver into using the HOME environment variable, so deliver doesn't do any database lookups during the delivery process. The exim pipe environment is described at http://exim.org/exim-html-current/doc/html/spec_html/index.html#toc0239, but basically I'd like to know the domain as well as the user, however deliver doesn't seem to pick this up. Is there any way that you could extend deliver to make it either pick up the domain (or correct username) from the command line, but not do an authdb lookup; or get it to read the domain from an environment variable (or be able to print the contents of an arbitrary environment variable in a formatted string)? Thanks, Mark -- Mark Zealey -- Shared Hosting Team Leader Product Development * Webfusion 123-reg.co.uk, webfusion.co.uk, donhost.co.uk, supanames.co.uk This mail is subject to http://www.gxn.net/disclaimer

2 1

[Dovecot] namespace public / namespace shared - question
by Michal Soltys 21 Nov '08

21 Nov '08

After looking through wiki/config/list I'm still not sure, what exactly is the difference between those two. Even all the examples in dovecot's wiki don't have a single "namespace shared" anywhere. And there's only short mention about the difference in dovecot.conf . Peeking into rfc2342 - would shared namespace relate to "Other Users' Namespace(s)" and public namespace to "Shared Namespace(s)" ? Does perhaps the difference only lie on the client side, depending on the namespace it's asking, while functionally it's the same from the perspective of dovecot ?

2 1

[Dovecot] userdb, Dovecot LDA not using mail_location config properly?
by k bah 21 Nov '08

21 Nov '08

I use Dovecot 1.0.5. I use LDAP for the user database and Dovecot LDA. --- dovecot.conf mail_location = maildir:/var/spool/mail/data/%Lu:INDEX=/var/spool/mail/index/%Lu auth default { mechanisms = plain (Note: TLS is used anyways..) userdb prefetch { } passdb ldap { # Path for LDAP configuration file, see doc/dovecot-ldap-example.conf args = /etc/dovecot/dovecot-ldap.conf_passdb (symlink do dovecot-ldap.conf) } userdb ldap { # Path for LDAP configuration file, see doc/dovecot-ldap-example.conf args = /etc/dovecot/dovecot-ldap.conf_userdb (symlink do dovecot-ldap.conf) } socket listen { master { path = /var/run/dovecot/auth-master mode = 0600 user = maildeliver group = mail } } } --- dovecot-ldap.conf Q1: auth_bind_userdn (commented since it would avoid the use of passdb and userdb, right?) # auth_bind_userdn = ... # userdb user_filter = (&(objectclass=postfixuser)(mail=%u)) user_attrs = uid=user # passdb pass_filter = (&(objectclass=inetlocalmailrecipient)(uid=%u)) pass_attrs = uid=user,userPassword=password,uid=userdb_user --- mail log host postfix/smtpd[8923]: connect from localhost[127.0.0.1] host postfix/smtpd[8923]: 5B449EA2C6: client=localhost[127.0.0.1] host postfix/cleanup[8925]: 5B449EA2C6: message-id=<20081121103114.5B449EA2C6@host> host postfix/smtpd[8923]: disconnect from localhost[127.0.0.1] host postfix/qmgr[8894]: 5B449EA2C6: from=<sender(a)otherdomain.org>, size=368, nrcpt=1 (queue active) host deliver(person(a)mydomain.com): Loading modules from directory: /usr/lib/dovecot/modules/lda host deliver(person(a)mydomain.com): Module loaded: /usr/lib/dovecot/modules/lda/lib10_quota_plugin.so host dovecot: auth(default): master in: USER 1 person(a)mydomain.com service=deliver host dovecot: auth(default): prefetch(person(a)mydomain.com): passdb didn't return userdb entries (#0) host dovecot: auth(default): ldap(person(a)mydomain.com): user search: base=dc=mydomain,dc=com scope=subtree filter=(&(objectclass=postfixuser)(mail=person(a)mydomain.com)) fields=uid host deliver(person(a)mydomain.com): auth input: person(a)mydomain.com (#1) host deliver(person(a)mydomain.com): auth input: user=person~mydomain.com host deliver(person(a)mydomain.com): auth input: uid=501 host deliver(person(a)mydomain.com): auth input: gid=12 (#2) host deliver(person(a)mydomain.com): maildir: data=/var/spool/mail/data/person@mydomain.com:INDEX=/var/spool/mail/index/person@mydomain.com (#3) host deliver(person(a)mydomain.com): maildir: root=/var/spool/mail/data/person(a)mydomain.com, index=/var/spool/mail/index/person(a)mydomain.com, control=, inbox= host dovecot: auth(default): master out: USER 1 person(a)mydomain.com user=person~mydomain.com uid=501 gid=12 host deliver(person(a)mydomain.com): msgid=<20081121103114.5B449EA2C6@host>: saved mail to INBOX host postfix/pipe[8929]: 5B449EA2C6: to=<person(a)mydomain.com>, relay=dovecot, delay=0.69, delays=0.19/0.02/0/0.48, dsn=2.0.0, status=sent (delivered via dovecot service) host postfix/qmgr[8894]: 5B449EA2C6: removed What I don't get is that since I use userdb (read mail log lines marked (#0-3) and the "mail_location" option from dovecot.conf), mail should be saved to "person~mydomain.com" and not "person(a)mydomain.com" on the disk(?). Q2: Did I misunderstood the meaning of userdb/mail_location, is that right (this behavior)? Q3: Is it misconfigured? I want to save mail on the disk to person~mydomain.com, when I get that right (save mail to what line #1 tells is "user"), I'll use mailRoutingAddress (my mailroutingaddress = person~mydomain.com(a)mydomain.com, mail_location would use %Ln). The passdb and userdb prefetch are working ok on the user is checking mail. thanks = PathMaker for Six Sigma Complete low-cost Six Sigma toolset. Equip your black and green belts. http://a8-asy.a8ww.net/a8-ads/adftrclick?redirectid=1198ebf9f950733925452d3… -- Powered by Outblaze

2 1

[Dovecot] CRAM-MD5 and proxy_maybe
by David Jonas 20 Nov '08

20 Nov '08

When using proxy_maybe CRAM-MD5 authentication fails when the connection is proxied. Is this expected behavior? Is proxy_maybe too simplified for this case? We're using SQL so I could rewrite the query with IFs to fake proxy_maybe and return the password as NULL and nologin as Y, but if it works that way couldn't it work with proxy_maybe? This works: password_query = \ SELECT NULL AS password, host, CONCAT(user,'@',domain) AS destuser \ 'Y' AS nologin, 'Y' AS nodelay, 'Y' AS proxy \ FROM accounts WHERE class='pop' AND domain='%d' This doesn't work if proxied and CRAM-MD5 auth: password_query = \ SELECT \ CONCAT(user,'@',domain) AS user, password, \ host, 'Y' AS proxy_maybe, \ target AS userdb_home, uid AS userdb_uid, gid AS userdb_gid \ FROM accounts WHERE \ class='pop' AND domain='%d' AND user='%n' \ LIMIT 1 Thanks, David

2 3

[Dovecot] Sieve RFC5229 support?
by list_dovecot＠bluerosetech.com 20 Nov '08

20 Nov '08

I'd like to take advantage of RFC5229 match variables (it would reduce the number of rules I have by an order of magnitude); however, the required extension isn't supported yet. Am I mistaken? If not, are there plans to support it?

2 1

[Dovecot] Unbreakable NFS locking issues...
by Rod Treweek 20 Nov '08

20 Nov '08

Hello All, We are struggling to find a solution to a problem we are encountering with a load-balanced email setup. Currently, we have a Coyote loadbalancer, and 3 Postfix/Dovecot nodes that then get their information from a mysql database. The problem is that after a couple weeks, we start seeing NFS locking issues occur, which then takes email completely down, requiring a site visit to basically do an interactive mode reboot to shut off NFS so that we can remount the filesystem again. We have our mailstore on an Aberdeen NAS which is accessed over NFS v. 4. Dovecot version 1.1.2 Here's the relevant mysql string: grep -v '^ *$#.*$\?$' dovecot-mysql.conf driver = mysql connect = host=X.X.X.X dbname=Something user=Something password=Something password_query = SELECT username as user, password, concat('/NFS1MAILDIR/mailSysV2/', maildir) as userdb_home, concat('maildir:/NFS1MAILDIR/mailSysV2/', maildir) as userdb_mail, 143 as userdb_uid, 143 as userdb_gid, concat('*:bytes=', floor(quota*1024)) AS quota_rule FROM mailbox WHERE username = '%u' AND active = '1' user_query = SELECT concat('/NFS1MAILDIR/mailSysV2/', maildir) as home, concat('maildir:/NFS1MAILDIR/mailSysV2/', maildir) as mail, concat('maildir:/NFS1MAILDIR/mailSysV2/', maildir) as maildir, 143 AS uid, 143 AS gid, concat('*:bytes=', floor(quota*1024)) AS quota_rule FROM mailbox WHERE username = '%u' AND active = '1' And here's what our configuration is on each of the nodes: dovecot -n # 1.1.2: /usr/local/etc/dovecot.conf protocols: imap pop3 ssl_ca_file: /usr/local/etc/dovecot/certs/tdpserver.crt ssl_cert_file: /usr/local/etc/dovecot/certs/tdpserver.crt ssl_key_file: /usr/local/etc/dovecot/certs/tdpserver.key ssl_parameters_regenerate: 0 ssl_cipher_list: ALL:!LOW:!SSLv2 disable_plaintext_auth: no login_dir: /var/run/dovecot/login login_executable(default): /usr/local/libexec/dovecot/imap-login login_executable(imap): /usr/local/libexec/dovecot/imap-login login_executable(pop3): /usr/local/libexec/dovecot/pop3-login login_user: postfix login_greeting: Something witty here.. login_process_per_connection: no login_max_connections: 512 max_mail_processes: 2048 mail_max_userip_connections: 50 verbose_proctitle: yes first_valid_uid: 69 last_valid_uid: 500 first_valid_gid: 69 last_valid_gid: 500 mail_access_groups: postfix mail_privileged_group: postfix mail_location: mbox:/NFS1MAILDIR/mailSysV2/%d/%u:INDEX=/usr/local/mail/indexes/%d/%1n/%n mmap_disable: yes dotlock_use_excl: no mail_nfs_storage: yes mail_nfs_index: yes mail_executable(default): /usr/local/libexec/dovecot/imap mail_executable(imap): /usr/local/libexec/dovecot/imap mail_executable(pop3): /usr/local/libexec/dovecot/pop3 mail_plugins(default): quota imap_quota mail_plugins(imap): quota imap_quota mail_plugins(pop3): quota mail_plugin_dir(default): /usr/local/lib/dovecot/imap mail_plugin_dir(imap): /usr/local/lib/dovecot/imap mail_plugin_dir(pop3): /usr/local/lib/dovecot/pop3 imap_client_workarounds(default): delay-newmail netscape-eoh tb-extra-mailbox-sep imap_client_workarounds(imap): delay-newmail netscape-eoh tb-extra-mailbox-sep imap_client_workarounds(pop3): pop3_client_workarounds(default): pop3_client_workarounds(imap): pop3_client_workarounds(pop3): outlook-no-nuls oe-ns-eoh auth default: mechanisms: login plain user: dovecot passdb: driver: sql args: /usr/local/etc/dovecot-mysql.conf userdb: driver: sql args: /usr/local/etc/dovecot-mysql.conf socket: type: listen client: path: /var/spool/postfix/private/auth mode: 432 user: postfix group: postfix master: path: /var/run/dovecot/auth-master mode: 384 user: dovecot group: dovecot plugin: quota: dict:user::proxy::quota imap_quota: dict:user::proxy::quota quota_rule: *:storage=528576 dict: quota: mysql:/usr/local/etc/dovecot/dovecot-dict-quota.conf Any help you can offer is greatly, greatly appreciated, as well as opinions on any other 'validated' postfix/dovecot email enterprise design solutions. Thanks Very Much In Advance, R.T

6 13

[Dovecot] New message notification
by Juan Asensio Sánchez 19 Nov '08

19 Nov '08

Hi What is the best option to notify a user that a message has arrived? The intention is to write a script that connects to a jabber server and checks if the user is online, so then a message is sent to user notifying him that he has received a new message. The solution should be compatible with Sieve filtering, so the script should not be executed when the message is moved to the SPAM folder, or pass to the script an argument specifying the folder where the message has been saved. Regards and thanks in advance. Juan Asensio Sánchez - http://www.nutum.es

2 1

[Dovecot] Solving CVE-2008-4870
by Michal Hlavinka 19 Nov '08

19 Nov '08

Hi, we're trying to solve CVE-2008-4870 = rhbz#436287 = dovecot.conf is world readable - possible password exposure. This problem seems to be little more complicated than we thought. dovecot.conf can contain passphrase for ssl key, which is available for everyone since dovecot.conf has world readable permissions. (In CVE's description is note that it RHEL's/Fedora's problem, but it affects all systems imo) We was thinking about few ways how to fix it: 1) 0640 permissions for dovecot.conf - but it can became not readable for dovecot 2) 0640 root:mail and set deliver to group mail with sgid - possible security problem 3) don't store passphrase in dovecot.conf, just ask for it when dovecot's started - can hang boot process, not good As part of investigating, I've found dovecot is storing all variables in environment variables - it means even passphrase? I'm not completely sure, but all variables can be read via /proc/<pid>/environ (I don't know if it becomes readable in some circumstances.) Is there any plan to solve this problem? Cheers, Michal

3 3