- dovecot - dovecot.org

[Dovecot] shared mailbox subfolder permissions
by David Leuschner 09 Sep '07

09 Sep '07

Hi all, when I create a subfolder in a public mailbox the dovecot-shared file is copied for the newly created subfolder and all mails get the owner, group and permissions from the file. Unfortunately the cur, new and tmp folders only get the permissions from the file but owner and group are set according to the creator. This effectivly makes the folder private to the creator. Is this the intended behavior? Is it a bug that has already been fixed in a later version? I am using 1.0.rc29. An example follows. Thanks for your help! David As an example .foobar was created manually (maildirmake) and permissions were setup using the shell: uml public # ls -al . .foobar .: total 24 drwxrwx--- 6 root pub 4096 Aug 18 13:05 . drwxrwxr-x 3 root mail 4096 Aug 18 11:10 .. drwxrwx--- 5 root pub 4096 Aug 18 11:42 .foobar drwxrwx--- 2 root pub 4096 Aug 18 10:50 cur -rw-rw---- 1 root pub 0 Aug 18 11:40 dovecot-shared drwxrwx--- 2 root pub 4096 Aug 18 10:50 new drwxrwx--- 2 root pub 4096 Aug 18 10:50 tmp .foobar: total 20 drwxrwx--- 5 root pub 4096 Aug 18 11:42 . drwxrwx--- 6 root pub 4096 Aug 18 13:05 .. drwxrwx--- 2 root pub 4096 Aug 18 11:42 cur drwxrwx--- 2 root pub 4096 Aug 18 11:42 new drwxrwx--- 2 root pub 4096 Aug 18 11:42 tmp After creating a subfolder 'baz' with Thunderbird the group of .baz is the group from dovecot-shared but the contained new/cur/tmp directories have the users primary group (instead of pub). uml public # ls -al . .baz .: total 28 drwxrwx--- 7 root pub 4096 Aug 18 13:09 . drwxrwxr-x 3 root mail 4096 Aug 18 11:10 .. drwxrwx--- 5 dleuschner pub 4096 Aug 18 13:09 .baz drwxrwx--- 5 root pub 4096 Aug 18 11:42 .foobar drwxrwx--- 2 root pub 4096 Aug 18 10:50 cur -rw-rw---- 1 root pub 0 Aug 18 11:40 dovecot-shared drwxrwx--- 2 root pub 4096 Aug 18 10:50 new drwxrwx--- 2 root pub 4096 Aug 18 10:50 tmp .baz: total 20 drwxrwx--- 5 dleuschner pub 4096 Aug 18 13:09 . drwxrwx--- 7 root pub 4096 Aug 18 13:09 .. drwxrwx--- 2 dleuschner dleuschner 4096 Aug 18 13:09 cur -rw-rw---- 1 dleuschner pub 0 Aug 18 13:09 dovecot-shared drwxrwx--- 2 dleuschner dleuschner 4096 Aug 18 13:09 new drwxrwx--- 2 dleuschner dleuschner 4096 Aug 18 13:09 tmp Here's my configuration: listen: localhost ssl_listen: * ssl_ca_file: /root/ca/ca.crt ssl_cert_file: /root/ca/crt/uml.crt ssl_key_file: /root/ca/keys/uml.key ssl_verify_client_cert: yes verbose_ssl: yes login_dir: /var/run/dovecot/login login_executable: /usr/libexec/dovecot/imap-login namespace: type: private separator: . prefix: Priv. location: maildir:~/.maildir:CONTROL=~/.maildir/ctrl/priv:INDEX=~/.maildir/idx/priv inbox: yes namespace: type: public separator: . prefix: Pub. location: maildir:/var/mail/public:CONTROL=~/.maildir/ctrl/pub:INDEX=~/.maildir/idx/pub auth default: passdb: driver: pam args: * userdb: driver: passwd socket: type: listen client: path: /var/run/dovecot/auth-client mode: 432 master: -- David Leuschner Meisenweg 7 79211 Denzlingen Tel. 07666/912466

2 1

[Dovecot] SSL connections frozen on Dovecot 1.0.0
by Thibault VINCENT 09 Sep '07

09 Sep '07

Hello, We are running Dovecot 1.0.0 (Debian Etch, Backports.org, OpenSSL) in a production environment and we experience sporadic SSL connection problems. At the moment, it's difficult to tell if the server goes back to normal operation after some time or if it can be reproduces at any time because we have to restart it as soon as we get Nagios alerts. Some tests with openssl s_client have shown difficulties to proceed the SSL handshake (hanging at different stages), or no response to IMAP commands. SSL client used: openssl s_client -host imap -port 993 - First case : s_client hangs on the first output "CONNECTED(00000003)" and there is no handshake at all; - Second case : like the first but the handshake starts after a few minutes; - Third case : the handshake goes fine but the "OK" server banner is never sent (no response to commands); - Fourth case : the greeting banner is received but dovecot will never answer. The configuration file is almost identical to the default and SSL certificate is not the autogenerated one. Log files do not show dying process. I've searched the ML archive for SSL issues but not found related bug. Does anyone use the Backport.org package of Dovecot ? Thank you :) -- Thibault VINCENT tibal(a)reloaded.fr thibault.vincent(a)reloaded.fr PGP Key : 0x4BA8A39B

2 3

[Dovecot] postfix + dovecot lda,
by Michael Moritz 09 Sep '07

09 Sep '07

I'm trying to replace procmail with deliver but I'm having problems with the group part of things. I keep getting: Aug 29 16:44:19 dingbat deliver(mimo): open(/var/mail/.temp.dingbat.3969.d1689935a308e0dd) failed: Permission denied Aug 29 16:44:19 dingbat deliver(mimo): file_lock_dotlock() failed with mbox file /var/mail/mimo: Permission denied My primary group is mimo and I think it's trying to use that. I changed it to mail and things work. But I do not want all my users to have a primary group mail. Is there a way I can force deliver to use group mail as group and ignore the per user gid? I tried chmod 6755 /usr/lib/dovecot/deliver but no change. This is on debian/etch, help appreciated.... mimo

3 4

[Dovecot] too many files opened
by Joshua, C.S. Chen 09 Sep '07

09 Sep '07

Hi folks, My institute's mail server was upgraded to RHEL5 with dovecot 1.0-2.1rc5 recently. And it uses PAM authentication which points to LDAP server. Now from time to time it gets Error like dovecot: Aug 29 09:23:59 Error: auth(default): pam(joshua,192.168.177.52): pipe() failed: Too many open files and users can not login. My config is like dovecot -n # /etc/dovecot.conf base_dir: /var/run/dovecot/ log_path: /var/log/dovecot info_log_path: /var/log/dovecot listen: * login_dir: /var/run/dovecot/login login_executable(default): /usr/libexec/dovecot/imap-login login_executable(imap): /usr/libexec/dovecot/imap-login login_executable(pop3): /usr/libexec/dovecot/pop3-login login_greeting: ASIAA Dovecot ready. login_processes_count: 4 mail_location: mbox:/asiaa/home/%u/:/asiaa/home/%u/mail/:INBOX=/var/mail/%u:INDEX=/asiaa/home/%u/mail/dovecot_indexes mail_debug: yes mail_full_filesystem_access: yes mail_drop_priv_before_exec: yes mail_executable(default): /etc/dovecot_postlogin_beforeimap.sh mail_executable(imap): /etc/dovecot_postlogin_beforeimap.sh mail_executable(pop3): /etc/dovecot_postlogin_beforepop3.sh mail_process_size: 512 mail_plugin_dir(default): /usr/lib/dovecot/imap mail_plugin_dir(imap): /usr/lib/dovecot/imap mail_plugin_dir(pop3): /usr/lib/dovecot/pop3 pop3_uidl_format(default): %08Xu%08Xv pop3_uidl_format(imap): %08Xu%08Xv pop3_uidl_format(pop3): %08Xv%08Xu auth default: passdb: driver: pam userdb: driver: passwd Any suggestion or help is appreciated Cheers Joshua

3 3

Re: [Dovecot] Dovecot + Sieve
by Marcin Michal Jessa 09 Sep '07

09 Sep '07

> Steffen Kaiser wrote: >>>> Any idea how to fix that? >>> Second: >>> When you remove the compiled Sieve script, is it re-created by deliver? >>> >> I have the same problem with the same config myself. No evidence that >> the script is being compiled automatically. If I remove the >> "sieve=path" global setting from dovecot.conf, deliver complains about >> not finding a per-user sieve or home path - so I assume the sieve module >> is being activated. Is there a particular format for the global sieve >> parameter? Does the script file HAVE to be named ".dovecot.sieve"? >I've got the global script working. Global setting is there in >dovecot.conf. deliver should have write access to that directory, to save >compiled script. > >It's called .dovecot.sieve, but I don't think it's that important: > >require "fileinto"; > >if header :matches ["X-Spam-Flag"] [ > "YES" >] >{ >fileinto "INBOX.Spam"; >stop; >} > >Calling the folder INBOX.Spam is important, if it is to be delivered to >users' Spam folders. It doesn't work with '+' delimited address+extension >(I reported it in this list, but had no replies). Actually I managed to fix this setting global_script_path = /usr/local/etc/sieve/Junk instead of sieve_global_dir = The emails marked as spam were moved to correct directory which is Junk, as listed in user's subscriptions file and not INBOX.Junk. I also correcred my sieve file to say: require ["fileinto"]; # Move spam to Junk folder if header :contains ["X-DSPAM-Result"] "Spam" { fileinto "Junk"; # Stop here so that we do not reply on spams stop; } But now I can see following logs for some of the accounts. Any idea what that may be? This account is not above quota which is set to 51200000 (just to be sure). deliver(lists(a)yazzy.org): Sep 04 18:04:16 Info: sieve runtime error: Keep: Generic Error deliver(lists(a)yazzy.org): Sep 04 18:04:16 Error: sieve_execute_bytecode(/usr/local/etc/sieve/Junkc) failed deliver(lists(a)yazzy.org): Sep 04 18:04:16 Info: msgid=<200709042006.51319.flash(a)preferance.ru>: Rejected: Quota exceeded Some work fine: deliver(abc(a)def.com): Sep 04 19:08:34 Info: msgid=<s6dd58a7.055(a)xyz.abc.state.ga.us>: saved mail to Junk deliver(abc(a)def.org): Sep 04 19:13:37 Info: msgid=<9B1E9600-42CC-49E0-8CB8-AF826257EE1B(a)abc.no>: saved mail to INBOX Cheers, Marcin P.S Becouse of that error I sent the same message twice yesterday and did not receive any follow ups so I had to copy and paste this thread from the web archive.

8 16

[Dovecot] Don't let deliver create index files
by Martin Strand 09 Sep '07

09 Sep '07

For various reasons I want to use deliver with Postfix and Courier-IMAP, and it seems to work fine except for one thing: deliver creates some dovecot.* index files that Courier never uses (and I assume deliver doesn't need them) Is there a way to prevent that? Thanks, Martin

3 2

[Dovecot] Using NID_x500UniqueIdentifier as ssl_username_from_cert
by S. Wefel 09 Sep '07

09 Sep '07

Hi, please have a look at the attached patch for dovecot-1.0.3 These patch modifies ssl_proxy_get_peer_name() to use the NID_x500UniqueIdentifier as username instead of NID_commonName. The reason is, that the Common Name doesn't have to be unique for the whole mailserver. Example; in germany a lot of people got the first name "Andreas" and the last name "Schulz". Therefore a lot of certificates exists with subjects like this: C=DE,O=ABC,CN=Andreas Schulz/emailAddress=andreas.schulz(a)abc.de C=DE,O=DEF,CN=Andreas Schulz/emailAddress=andreas.schulz(a)def.de ... dovecot couldn't distinguish between these users. So we decide to use certificates with an X509v3 extension NID_x500UniqueIdentifier which allows to extend the subject by an unique ID, e.g. the unix-uid or a database unique key. The new certificates may look like this: C=DE,O=ABC,CN=Andreas Schulz/emailAddress=andreas.schulz(a)abc.de/x500UniqueIdentifier=user1 C=DE,O=DEF,CN=Andreas Schulz/emailAddress=andreas.schulz(a)def.de/x500UniqueIdentifier=user2 With the attached patch the user is taken from this extension and e.g. with userdb=ldap you can use the filter string user_filter = (&(objectClass=posixAccount)(uid=%u)) A good solution to use booth, the common name and the UniqueIdentifier is to extend settings like ssl_username_from_cert = no | yes | cn | uid where "yes" is similar to "cn". Regards, Sandro Wefel

2 1

[Dovecot] Server Timed Out: Outlook Express
by Jackie Hunt 09 Sep '07

09 Sep '07

Hi all, We just started running Dovecot this fall here on campus v 1.0. I've started getting some trouble reports from users. An Outlook Express users reported seeing the "Server has not responded in 60 seconds" messages. Waiting longer doesn't help, he has to stop/start Outlook Express to get connected again. Also have a Thunderbird user who is seeing that type of behavior first thing in the morning after being logged in all night. He has to stop/restart Thunderbird. Also, have had some reports of "disconnected" showing up on the Outlook2007 status bar. I've looked at the Dovecot log, and don't see any errors. I do see lots of "Disconnected", "Disconnected in IDLE" and "Disconnected: Logged Out". These last two seem normal, if I just see "Disconnected" is that a flag that we're losing connections abnormally? I know version 1.0.3 is out. I've looked at the changes, and the only one I can see that might be related to what we are seeing is the IDLE commmand fix. Was hoping for some advice on whether upgrading might resolve these issue. Any insight would be greatly appreciated. Jackie --- Jackie Hunt ACNS Voice: (970) 663-3789 Colorado State University FAX: (970) 491-1958 Fort Collins, CO 80523 Email: jackie.hunt(a)colostate.edu

3 2

[Dovecot] LDA bouncing mails after upgrade -- again
by Milan Holzäpfel 09 Sep '07

09 Sep '07

Hi Timo, some time ago (2007-03-24 and following) I asked whether it was intended that Dovecot deliver bounces mails (by terminating with status 89) if the deliver version is older than the rest of the dovecot installation. You replied that it was a bug, and that it had been fixed in <URL:http://dovecot.org/list/dovecot-cvs/2007-March/008346.html>. When I upgraded from Dovecot 1.0.2 to 1.0.3 a few days ago, I found out that this problem probably still exists: | Aug 28 09:38:03 host.example.org deliver(user(a)example.org): Module is for different version 1.0.3: /usr/lib/dovecot/lda/lib10_quota_plugin.so | Aug 28 09:38:03 host.example.org postfix/pipe[18356]: <ID>: to=<user(a)example.org>, relay=dovecot, delay=0.4, delays=0.13/0.09/0/0.18, dsn=5.3.0, status=bounced (Command died with status 89: "/usr/libexec/dovecot/postfix-deliver/deliver") The error message I posted in march was: | Mar 22 20:29:20 host.example.org deliver(user(a)example.org): Module is for different version 1.0.rc27: /usr/lib/dovecot/lda/lib10_quota_plugin.so | Mar 22 20:29:20 host.example.org postfix/pipe[17344]: <ID>: to=<user(a)example.org>, relay=dovecot, delay=1.9, delays=1.5/0/0/0.35, dsn=5.3.0, status=bounced (Command died with status 89: "/usr/libexec/dovecot/postfix-deliver/deliver") I suppose you still want to fix it. Regards, and thanks for all your work, Milan -- Milan Holzaepfel <mail(a)mjh(d)name> <URL:http://mjh.name/> pub 4096R/C790FC23 EB8E 5E81 81E3 53A9 9B74 B895 5179 54C0 C790 FC23

2 1

[Dovecot] processing Dovecot maildirs with shell scripts
by M. Fioretti 09 Sep '07

09 Sep '07

Hello, I have a postfix server which uses procmail as its delivery agent to deliver incoming messages to several maildirs. For several reasons, not really relevant here, I need to process/refilter/sort again the content of these mailboxes before delivering the messages to the _other_ maildirs which Dovecot sees and serves to local or remote imap users. Basically, I need to write some shell scripts that, from cron jobs, regularly do this: foreach file in some_incoming_mailbox/new/ do #process the file and/or set some variable according to its content delete the file or mv it to some_other_maildir/new/ where the actual action and value of some_other_maildir is set every time by the "process the file" part of the script. The part that I still miss is guidelines to do these things safely, that is without losing or corrupting messages or doing anything else that would confuse dovecot. For example, under which conditions it is sure to move or delete (the Unix way, with mv or rm) a message from mailbox1/new/ to mailbox2/new, when the latter is served via dovecot to remote users? What is advisable and most efficient? Use locks (how?), only work on file which are at least one minute old? Should I move the messages to tmp instead of new? What else? Tips or pointers about this are very welcome. Ciao, Marco

3 5