- dovecot - dovecot.org

[Dovecot] CRAM-MD5 and proxy_maybe
by David Jonas 20 Nov '08

20 Nov '08

When using proxy_maybe CRAM-MD5 authentication fails when the connection is proxied. Is this expected behavior? Is proxy_maybe too simplified for this case? We're using SQL so I could rewrite the query with IFs to fake proxy_maybe and return the password as NULL and nologin as Y, but if it works that way couldn't it work with proxy_maybe? This works: password_query = \ SELECT NULL AS password, host, CONCAT(user,'@',domain) AS destuser \ 'Y' AS nologin, 'Y' AS nodelay, 'Y' AS proxy \ FROM accounts WHERE class='pop' AND domain='%d' This doesn't work if proxied and CRAM-MD5 auth: password_query = \ SELECT \ CONCAT(user,'@',domain) AS user, password, \ host, 'Y' AS proxy_maybe, \ target AS userdb_home, uid AS userdb_uid, gid AS userdb_gid \ FROM accounts WHERE \ class='pop' AND domain='%d' AND user='%n' \ LIMIT 1 Thanks, David

2 3

[Dovecot] Sieve RFC5229 support?
by list_dovecot＠bluerosetech.com 20 Nov '08

20 Nov '08

I'd like to take advantage of RFC5229 match variables (it would reduce the number of rules I have by an order of magnitude); however, the required extension isn't supported yet. Am I mistaken? If not, are there plans to support it?

2 1

[Dovecot] Unbreakable NFS locking issues...
by Rod Treweek 20 Nov '08

20 Nov '08

Hello All, We are struggling to find a solution to a problem we are encountering with a load-balanced email setup. Currently, we have a Coyote loadbalancer, and 3 Postfix/Dovecot nodes that then get their information from a mysql database. The problem is that after a couple weeks, we start seeing NFS locking issues occur, which then takes email completely down, requiring a site visit to basically do an interactive mode reboot to shut off NFS so that we can remount the filesystem again. We have our mailstore on an Aberdeen NAS which is accessed over NFS v. 4. Dovecot version 1.1.2 Here's the relevant mysql string: grep -v '^ *$#.*$\?$' dovecot-mysql.conf driver = mysql connect = host=X.X.X.X dbname=Something user=Something password=Something password_query = SELECT username as user, password, concat('/NFS1MAILDIR/mailSysV2/', maildir) as userdb_home, concat('maildir:/NFS1MAILDIR/mailSysV2/', maildir) as userdb_mail, 143 as userdb_uid, 143 as userdb_gid, concat('*:bytes=', floor(quota*1024)) AS quota_rule FROM mailbox WHERE username = '%u' AND active = '1' user_query = SELECT concat('/NFS1MAILDIR/mailSysV2/', maildir) as home, concat('maildir:/NFS1MAILDIR/mailSysV2/', maildir) as mail, concat('maildir:/NFS1MAILDIR/mailSysV2/', maildir) as maildir, 143 AS uid, 143 AS gid, concat('*:bytes=', floor(quota*1024)) AS quota_rule FROM mailbox WHERE username = '%u' AND active = '1' And here's what our configuration is on each of the nodes: dovecot -n # 1.1.2: /usr/local/etc/dovecot.conf protocols: imap pop3 ssl_ca_file: /usr/local/etc/dovecot/certs/tdpserver.crt ssl_cert_file: /usr/local/etc/dovecot/certs/tdpserver.crt ssl_key_file: /usr/local/etc/dovecot/certs/tdpserver.key ssl_parameters_regenerate: 0 ssl_cipher_list: ALL:!LOW:!SSLv2 disable_plaintext_auth: no login_dir: /var/run/dovecot/login login_executable(default): /usr/local/libexec/dovecot/imap-login login_executable(imap): /usr/local/libexec/dovecot/imap-login login_executable(pop3): /usr/local/libexec/dovecot/pop3-login login_user: postfix login_greeting: Something witty here.. login_process_per_connection: no login_max_connections: 512 max_mail_processes: 2048 mail_max_userip_connections: 50 verbose_proctitle: yes first_valid_uid: 69 last_valid_uid: 500 first_valid_gid: 69 last_valid_gid: 500 mail_access_groups: postfix mail_privileged_group: postfix mail_location: mbox:/NFS1MAILDIR/mailSysV2/%d/%u:INDEX=/usr/local/mail/indexes/%d/%1n/%n mmap_disable: yes dotlock_use_excl: no mail_nfs_storage: yes mail_nfs_index: yes mail_executable(default): /usr/local/libexec/dovecot/imap mail_executable(imap): /usr/local/libexec/dovecot/imap mail_executable(pop3): /usr/local/libexec/dovecot/pop3 mail_plugins(default): quota imap_quota mail_plugins(imap): quota imap_quota mail_plugins(pop3): quota mail_plugin_dir(default): /usr/local/lib/dovecot/imap mail_plugin_dir(imap): /usr/local/lib/dovecot/imap mail_plugin_dir(pop3): /usr/local/lib/dovecot/pop3 imap_client_workarounds(default): delay-newmail netscape-eoh tb-extra-mailbox-sep imap_client_workarounds(imap): delay-newmail netscape-eoh tb-extra-mailbox-sep imap_client_workarounds(pop3): pop3_client_workarounds(default): pop3_client_workarounds(imap): pop3_client_workarounds(pop3): outlook-no-nuls oe-ns-eoh auth default: mechanisms: login plain user: dovecot passdb: driver: sql args: /usr/local/etc/dovecot-mysql.conf userdb: driver: sql args: /usr/local/etc/dovecot-mysql.conf socket: type: listen client: path: /var/spool/postfix/private/auth mode: 432 user: postfix group: postfix master: path: /var/run/dovecot/auth-master mode: 384 user: dovecot group: dovecot plugin: quota: dict:user::proxy::quota imap_quota: dict:user::proxy::quota quota_rule: *:storage=528576 dict: quota: mysql:/usr/local/etc/dovecot/dovecot-dict-quota.conf Any help you can offer is greatly, greatly appreciated, as well as opinions on any other 'validated' postfix/dovecot email enterprise design solutions. Thanks Very Much In Advance, R.T

6 13

[Dovecot] New message notification
by Juan Asensio Sánchez 19 Nov '08

19 Nov '08

Hi What is the best option to notify a user that a message has arrived? The intention is to write a script that connects to a jabber server and checks if the user is online, so then a message is sent to user notifying him that he has received a new message. The solution should be compatible with Sieve filtering, so the script should not be executed when the message is moved to the SPAM folder, or pass to the script an argument specifying the folder where the message has been saved. Regards and thanks in advance. Juan Asensio Sánchez - http://www.nutum.es

2 1

[Dovecot] Solving CVE-2008-4870
by Michal Hlavinka 19 Nov '08

19 Nov '08

Hi, we're trying to solve CVE-2008-4870 = rhbz#436287 = dovecot.conf is world readable - possible password exposure. This problem seems to be little more complicated than we thought. dovecot.conf can contain passphrase for ssl key, which is available for everyone since dovecot.conf has world readable permissions. (In CVE's description is note that it RHEL's/Fedora's problem, but it affects all systems imo) We was thinking about few ways how to fix it: 1) 0640 permissions for dovecot.conf - but it can became not readable for dovecot 2) 0640 root:mail and set deliver to group mail with sgid - possible security problem 3) don't store passphrase in dovecot.conf, just ask for it when dovecot's started - can hang boot process, not good As part of investigating, I've found dovecot is storing all variables in environment variables - it means even passphrase? I'm not completely sure, but all variables can be read via /proc/<pid>/environ (I don't know if it becomes readable in some circumstances.) Is there any plan to solve this problem? Cheers, Michal

3 3

[Dovecot] patch: list shared namespace
by Bernhard Herzog 19 Nov '08

19 Nov '08

Hi, I've been working on a patch for dovecot 1.2 from the Kolab branch (http://hg.intevation.org/kolab/dovecot-1.2_kolab-branch/) that implements listing of shared namespaces. I've got something that works in some basic way but is still missing some pieces. See the attached patch, which also contains some installation and configuration notes. Implementation notes: One of the main problems the patch addresses is getting a list of all users that have mailboxes the logged in user can see. The patch uses a dict to cache information about which users have at least one mailbox that is visible to other users. The dict doesn't cache which other users, though. The cache entry for a given user is updated whenever the dovecot-acl-list file in the maildir root directory is updated. This ties the implementation to a specific acl backend to an extent, but that shouldn't be a problem at the moment. Another problem is that namespaces for all those users have to be created. The patch does that in shared-storage.c when the shared storage is created. At this stage of development of the patch that works well enough, I think, but it might be better to update the namespaces whenever a list iterator is created. To avoid unnecessary coupling between the shared namespace code and the ACL plugin, the shared namespace code has a hook that it calls when it needs a list of all the users who may have mailboxes visible to the current user. The ACL plugin sets that hook and uses the dict to produce that list. This way, the ACL plugin depends on the shared namespace code but not the other way round and all the dict handling is in the ACL plugin. I'm not sure the new hook is really needed. The patch could perhaps just as well extend the acl_next_hook_mail_storage_created and acl_next_hook_mailbox_list_created functions to do the namespace creation when they're called for a shared storage or mailbox list. Problems: All of my tests so far involved a shared namespace of the form namespace shared { separator = / prefix = users/%%u/ location = maildir:.../var/mail/%%u:... subscriptions = no list = yes hidden = no } Also, let's assume two users, ford and arthur with ford's "INBOX/hhgttg" available to arthur as "users/ford/INBOX/hhgttg". Arthur may not list ford's INBOX, though. In the following the current user is always arthur. I found the following problems: - LIST response includes namespaces the user doesn't really have access to. E.g. if there's another user, zaphod who's made some mailbox available to somebody else, but not arthur, arthur still sees * LIST (\Noselect \HasChildren) "/" "users/zaphod" Not sure it's worth fixing this, though. - List with "%" doesn't list all intermediate mailboxes. On the one hand arthur sees this: x LIST "" "*" ... * LIST (\Noselect \HasChildren) "/" "users/ford" * LIST (\HasNoChildren) "/" "users/ford/INBOX/hhgttg" x OK List completed. OTOH, with "%" only this: x LIST "" "users/ford/%" x OK List completed. cyrus shows x LIST "" "users/ford/%" * LIST (\Noselect \HasChildren) "/" "users/ford/INBOX" x OK List completed. At least Kontact resp. KMail rely on this. - The dovecot-acl-list is not always rebuilt, even when it should have been, AFAICT. In particular, if the file exists but is empty, it's never updated, even when ACL later change. Maybe this is a bug in the Kolab branch. Cheers, Bernhard -- Bernhard Herzog | ++49-541-335 08 30 | http://www.intevation.de/ Intevation GmbH, Neuer Graben 17, 49074 Osnabrück | AG Osnabrück, HR B 18998 Geschäftsführer: Frank Koormann, Bernhard Reiter, Dr. Jan-Oliver Wagner

2 16

[Dovecot] Bug in 1.1.4: New line required in ACL files
by sleeper-＠gmx.net 19 Nov '08

19 Nov '08

Hello, just wanted to notify you about a bug i found in 1.1.4 ACL handling: Global ACLs are ignored, when there is no line break (i.e. "owner lr" is ignored while "owner lr\n" works). I didn't track this down to see if the same happens for per-user ACLs, but it should be quite obvious in the source anyways. Regards -- Sensationsangebot nur bis 30.11: GMX FreeDSL - Telefonanschluss + DSL für nur 16,37 Euro/mtl.!* http://dsl.gmx.de/?ac=OM.AD.PD003K11308T4569a

2 1

[Dovecot] Mail.app & Subscriptions
by Neil 19 Nov '08

19 Nov '08

Client: Mail.app v.3.5 Server: Dovecot 1.1.6 I've noticed that when I go to "Account Info" in Mail.app, and then to the "Subscription List" tab, Mail.app will spin for a bit, and then give up, without showing any folders and all the buttons are grayed out. Does anyone know if this a Mail.app issue or a Dovecot issue, if there're any work-arounds, and/or if this is something I should be concerned about? Thanks, Neil.

2 1

[Dovecot] Password authentication and character set
by Fredrik Grönqvist 19 Nov '08

19 Nov '08

Hi, I've searched in the wiki and in the mailinglist archives but haven't found anything about password character sets within the dovecot authentication deamon. My problem is that we have users with passwords containing scandinavian characters (äöå, umlauts) and the debug log shows that different clients send the password in different charsets. The passwords are stored in a Mysql table, if that makes any difference. Outlook Express with LATIN 1 (ISO-8859-1): Nov 18 16:56:39 resilar dovecot: auth-worker(default): sql(fgr-1,193.64.206.190): Password mismatch Nov 18 16:56:39 resilar dovecot: auth-worker(default): sql(fgr-1,193.64.206.190): MD5(<E4><E4>kk<F6>si<E4>) != '$1$xMPPHRdL$I0mrlPi5FMtwauSf20vjz0' MacMail UTF8: Nov 18 17:23:37 resilar dovecot: auth-worker(default): sql(fgr-1,193.64.206.190): Password mismatch Nov 18 17:23:37 resilar dovecot: auth-worker(default): sql(fgr-1,193.64.206.190): MD5(ääkkösiä12) != '$1$xMPPHRdL$I0mrlPi5FMtwauSf20vjz0' Is there a setting that "forces" the authentication daemon to convert the provided password to a specific charset before the comparison takes place, or how should one handle this? dovecot -n # 1.1.4: /etc/dovecot/dovecot.conf log_timestamp: %Y-%m-%d %H:%M:%S protocols: imap imaps pop3 pop3s managesieve ssl_cert_file: /etc/ssl/certs/mail.crt ssl_key_file: /etc/ssl/private/mail.key ssl_cipher_list: ALL:!LOW disable_plaintext_auth: no login_dir: /var/run/dovecot/login login_executable(default): /usr/lib/dovecot/imap-login login_executable(imap): /usr/lib/dovecot/imap-login login_executable(pop3): /usr/lib/dovecot/pop3-login login_executable(managesieve): /usr/lib/dovecot/managesieve-login login_greeting: mail ready. login_process_per_connection: no mail_privileged_group: mail mail_location: maildir:~/mail mail_debug: yes mail_executable(default): /usr/lib/dovecot/imap mail_executable(imap): /usr/lib/dovecot/imap mail_executable(pop3): /usr/lib/dovecot/pop3 mail_executable(managesieve): /usr/lib/dovecot/managesieve mail_plugins(default): quota imap_quota mail_plugins(imap): quota imap_quota mail_plugins(pop3): quota mail_plugins(managesieve): mail_plugin_dir(default): /usr/lib/dovecot/modules/imap mail_plugin_dir(imap): /usr/lib/dovecot/modules/imap mail_plugin_dir(pop3): /usr/lib/dovecot/modules/pop3 mail_plugin_dir(managesieve): /usr/lib/dovecot/modules/managesieve imap_client_workarounds(default): delay-newmail outlook-idle imap_client_workarounds(imap): delay-newmail outlook-idle imap_client_workarounds(pop3): imap_client_workarounds(managesieve): pop3_client_workarounds(default): pop3_client_workarounds(imap): pop3_client_workarounds(pop3): outlook-no-nuls oe-ns-eoh pop3_client_workarounds(managesieve): sieve_storage(default): sieve_storage(imap): sieve_storage(pop3): sieve_storage(managesieve): ~/ sieve(default): sieve(imap): sieve(pop3): sieve(managesieve): ~/.dovecot.sieve auth default: mechanisms: plain login username_chars: abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ01234567890.-_@+ verbose: yes debug: yes debug_passwords: yes worker_max_count: 50 passdb: driver: sql args: /etc/dovecot/dovecot-sql.conf userdb: driver: prefetch userdb: driver: sql args: /etc/dovecot/dovecot-sql.conf socket: type: listen client: path: /var/spool/postfix/private/auth mode: 432 user: postfix group: postfix master: path: /var/run/dovecot/auth-master mode: 384 user: vmail plugin: quota: maildir Chears Fredrik -- ------------------------------------------------------------------------ Fredrik Grönqvist ------------------------------------------------------------------------

3 13

[Dovecot] pam_start() failed: system error
by Peter Orlowski 18 Nov '08

18 Nov '08

Hi, I'm using dovecot 1.1.3 on FreeBSD 6.3, x86, files are on NFS, except control and index files, which are local, on UFS2. It's moderately loaded, there are usually not more than 30 clients simultaneously. dovecot runs fine for 3-10 days, then people can't connect any more, and dovecot says: Nov 18 13:20:44 dizzy dovecot-auth: pam_ldap: ldap_simple_bind Can't contact LDAP server Nov 18 13:20:44 dizzy dovecot-auth: pam_ldap: reconnecting to LDAP server... Nov 18 13:20:44 dizzy dovecot-auth: pam_ldap: ldap_simple_bind Can't contact LDAP server Nov 18 13:20:44 dizzy dovecot-auth: pam_ldap: ldap_simple_bind Can't contact LDAP server Nov 18 13:20:44 dizzy dovecot-auth: pam_ldap: ldap_simple_bind Can't contact LDAP server Nov 18 13:21:46 dizzy dovecot: auth-worker(default): pam(xxxx,xxx.xxx.xxx.xxx): pam_start() failed: system error Nov 18 13:21:46 dizzy dovecot-auth: in openpam_load_module(): no pam_permit.so found Nov 18 13:22:12 dizzy dovecot-auth: in openpam_load_module(): no pam_login_access.so found Nov 18 13:22:31 dizzy dovecot-auth: in openpam_load_module(): no pam_unix.so found Nov 18 13:22:42 dizzy dovecot-auth: in openpam_load_module(): no /usr/local/lib/pam_ldap.so found After restarting dovecot things are back to normal. I have tried different settings for worker_max_count, and I had blocking=no in the passdb config until a few day ago; changing that didn't help either. Here's my current config: # 1.1.3: /usr/local/etc/dovecot.conf protocols: imaps pop3s ssl_cert_file: /etc/ssl/certs/mailitp-chain.pem ssl_key_file: /etc/ssl/certs/mailkey2.pem login_dir: /var/run/dovecot/login login_executable(default): /usr/local/libexec/dovecot/imap-login login_executable(imap): /usr/local/libexec/dovecot/imap-login login_executable(pop3): /usr/local/libexec/dovecot/pop3-login verbose_proctitle: yes first_valid_gid: 0 mail_privileged_group: mail mail_location: mbox:~/mail/:INDEX=/srv/dovecot/indexes/%u.oldmail:INBOX=/var/mail/%u mail_executable(default): /usr/local/libexec/dovecot/imap mail_executable(imap): /usr/local/libexec/dovecot/imap mail_executable(pop3): /usr/local/libexec/dovecot/pop3 mail_plugins(default): zlib mail_plugins(imap): zlib mail_plugins(pop3): mail_plugin_dir(default): /usr/local/lib/dovecot/imap mail_plugin_dir(imap): /usr/local/lib/dovecot/imap mail_plugin_dir(pop3): /usr/local/lib/dovecot/pop3 imap_client_workarounds(default): delay-newmail outlook-idle netscape-eoh tb-extra-mailbox-sep imap_client_workarounds(imap): delay-newmail outlook-idle netscape-eoh tb-extra-mailbox-sep imap_client_workarounds(pop3): pop3_client_workarounds(default): pop3_client_workarounds(imap): pop3_client_workarounds(pop3): outlook-no-nuls oe-ns-eoh namespace: type: private separator: / prefix: NEWmail/ location: maildir:~/Maildir/:INDEX=/srv/dovecot/indexes/%u:CONTROL=/srv/dovecot/control/%u list: yes subscriptions: yes namespace: type: private separator: / location: mbox:~/mail/:INBOX=/var/mail/%u:INDEX=/srv/dovecot/indexes/%u.oldmail:CONTROL=/srv/dovecot/control/%u.oldmail inbox: yes list: yes subscriptions: yes auth default: worker_max_count: 20 passdb: driver: pam args: blocking=yes userdb: driver: passwd Greetings, -- Peter Orlowski

2 2