- dovecot - dovecot.org

[Dovecot] What's the best way to authenticate against Active Directory?
by Chris Johnson 19 Sep '07

19 Sep '07

Hi all, I'm working on a replacement for a legacy linux mail server: courier POP/IMAP, Postfix, OpenLDAP. One of the requirements of the new mail server is to authenticate against our AD infrastructure (I'll still keep a userdb in OpenLDAP). SSO is not required since most of the clients don't log into our domain. The current system has about 1,000 concurrent users on it during the day (almost all are IMAP users). Inbox size varies but is generally very high 1GB+. I'm considering dovecot as a replacement for courier IMAP on the new server mainly for performance reasons. Cyrus was also considered but I'd rather work with maildir format inboxes. I'm in the process of installing a "proof of concept" server with CentOS 5 and dovecot-1.0-1.2.rc15.el5. the production system will most likely run on RHEL Question: What's the best way (most reliable/fastest) to authenticate dovecot to AD? If someone is doing this in a production environment can you offer any hints on configuration for performance or what to expect in general? Thanks, chrisj

2 1

[Dovecot] Add update of configure.in to alpha6
by David Favor 19 Sep '07

19 Sep '07

Put this on the list of updates. Alpha6 seems to be working great. - David -- Love feeling your best ever, all day, every day? Email join(a)RadicalHealth.com for the easy way.

1 0

Re: [Dovecot] v1.1.alpha6 released
by Geert Hendrickx 18 Sep '07

18 Sep '07

On Mon, Sep 17, 2007 at 03:58:03PM +0300, Timo Sirainen wrote: > On Mon, Sep 17, 2007 at 02:00:54PM +0200, Geert Hendrickx wrote: > > > I guess this'll do it: http://hg.dovecot.org/dovecot/rev/92bce6a3fdad > > > > (without testing) No, the filename is wrong. The generated rquota_xdr.c > > has #include "rquota.h". > > Oh, right. :) http://hg.dovecot.org/dovecot/rev/2ab3cb6af745 Seems like dovecot nightly 20070918 fixed the problems I reported except: - I still need to run make rquota_xdr.c manually, but only the first time. If I rm rquota_xdr.c and rquota.h and run make again, the are generated. - doc/wiki now contains a lot more files with brackets in their names. (2f) But these nightly snapshots are from the 2.0 development branch, not 1.1, right? Could you please send me an 1.1 alpha snapshot (or release another alpha) to test? Thanks, Geert

2 3

[Dovecot] Dovecot 1.0.3: mbox problems for newly created users
by Bernd Kuhls 18 Sep '07

18 Sep '07

Hi, I am having problems with Dovecot 1.0.3 and Thunderbird 2.0.0.6 when using a new user account without any mbox files present. Directory /home/$user/.imap_mail/ does not exist when Thunderbird first tries to login using IMAP to the account. On login this directory is created with a zero byte Trash file and .subscriptions containing string "Trash", so far, so good. Now I create a new message in Thunderbird and save it as draft. A zero byte file "Drafts" is created in /home/$user/.imap_mail/ but the message I wanted to save got _lost_, /home/$user/.imap_mail/Drafts stays at zero bytes. The next message I try to save as draft finds its way to the Drafts mbox however. Please note that no /home/$user/.imap_mail/inbox has been created although a inbox is shown in Thunderbird. When I move the saved message from Drafts to the inbox folder shown in Thunderbird, it gets saved in /var/mail/$user instead of /home/$user/.imap_mail/inbox, I guess this is due to the use of the mbox_snarf plugin, right? /home/$user/.imap_mail/inbox is the maildrop for Exim, which handles incoming mails, but in this scenario the user did not receive any emails yet. If I manually create /home/$user/.imap_mail/inbox, then moving a message from Drafts to the Thunderbird-displayed inbox works. How to fix this problem? Especially messages getting lost is really bad because I am in the process of changing our mail server setup from Exim/UW-Imapd to Exim/Dovecot, where I have to move 100+ /var/mail/$user mbox files to /home/$user/.imap_mail/inbox. But when Dovecot can not properly save files to previous non-existing mbox files, like Drafts, this is really a problem. Greetings, Bernd Kuhls PS: Here are the Dovecot settings: # dovecot -n # 1.0.3: /etc/dovecot/dovecot.conf log_path: /var/log/dovecot/dovecot.main log_timestamp: %Y-%m-%d %H:%M:%S protocols: imap imaps pop3 pop3s login_dir: /var/run/dovecot/login login_executable(default): /usr/lib/dovecot/imap-login login_executable(imap): /usr/lib/dovecot/imap-login login_executable(pop3): /usr/lib/dovecot/pop3-login mail_extra_groups: mail mail_location: mbox:~/.imap_mail:INBOX=/var/mail/%u:INDEX=/var/mail/indexes/%u mail_executable(default): /usr/lib/dovecot/imap mail_executable(imap): /usr/lib/dovecot/imap mail_executable(pop3): /usr/lib/dovecot/pop3 mail_plugins(default): quota imap_quota mbox_snarf mail_plugins(imap): quota imap_quota mbox_snarf mail_plugins(pop3): mbox_snarf mail_plugin_dir(default): /usr/lib/dovecot/modules/imap mail_plugin_dir(imap): /usr/lib/dovecot/modules/imap mail_plugin_dir(pop3): /usr/lib/dovecot/modules/pop3 imap_client_workarounds(default): outlook-idle netscape-eoh tb-extra-mailbox-sep delay-newmail imap_client_workarounds(imap): outlook-idle netscape-eoh tb-extra-mailbox-sep delay-newmail imap_client_workarounds(pop3): outlook-idle pop3_uidl_format(default): pop3_uidl_format(imap): pop3_uidl_format(pop3): %08Xu%08Xv auth default: passdb: driver: pam userdb: driver: passwd plugin: quota: fs mbox_snarf: ~/.imap_mail/inbox

3 6

[Dovecot] IP based virtual users: stripping login domain?
by Alan Ferrency 17 Sep '07

17 Sep '07

Hello. I have a likely unusual request regarding IP based virtual dovecot users. When you specify a passdb passwd-file name containing "%d", then the domain portion is stripped from the login username, before the user is checked in the passwd-file. However, if you specify a passwd-file name containing "%l" (the local IP), the domain portion of the login is not stripped off before the username is checked in the passwd-file. This behavior makes sense, and should be considered the right and proper thing to do. But in this case, I want to do something different anyway. In the setup I'm working on, most logins will use domain based virtual usernames. However, if a customer logs in with an unknown domain in their login username, I'd like to fall back to IP-based virtualization, based on the local IP they connect to. I can't use auth_username_format to strip off %d, because that would break the domain based virtualization. What I need is an option to make %l work the way %d already works; or a format inside a passwd-file which allows for partial matches in the "username" column. If I can do this directly using a passwd-file, I'd like to do that. It seems like it'd be easy if I were using an SQL back end, but that's not an option. It's possible with an external authentication script, but I want to explore more direct configuration options, first. Does anyone have any recommendations? If what I want can't already be done, and I patched dovecot to do one of these things, how likely would it be to have that patch merged into the project? Thanks, Alan Ferrency pair Networks, Inc. alan(a)pair.com

2 5

[Dovecot] Sent / Drafts / Trash folders and subscribing ?
by Xavier Beaudouin 17 Sep '07

17 Sep '07

Hello, I am trying to migrate our configuration that use Courier-imap to dovecot, appart some users that have some issues with pop and leave messages on servers that retreive all mails into their mailboes... but this is ok for me :).. One problem that it seems that Sent / Drafts and Trash folder are not automaticaly added as subscribed folder... I really dunno about IMAP rfc or standard, I just want to know if this is considered as normal for dovecot ? Thanks, /Xavier -- Xavier Beaudouin - http://oav.net/

2 1

[Dovecot] v1.1.alpha6 released
by Timo Sirainen 17 Sep '07

17 Sep '07

http://dovecot.org/releases/1.1/alpha/dovecot-1.1.alpha6.tar.gz http://dovecot.org/releases/1.1/alpha/dovecot-1.1.alpha6.tar.gz.sig Most importantly doesn't crash anymore if both pop3 and imap aren't used. :) I'm hoping people won't find anything too bad from this release anymore, so I'll release v1.1.beta1 in a week or so. I also finally did some larger API changes and code cleanups that I had been planning on doing for a long time. I also changed copyright notices in the code to: /* Copyright (c) xxxx-2007 Dovecot authors, see the included COPYING file */ So my name isn't there anymore. It wasn't always correct anyway. I'm planning on updating the -2007 year at the beginning of each year to all the files. It's annoying to try to keep it updated manually.

2 10

[Dovecot] Possible bug in authentication cache in dovecot 1.1.alpha4
by arvids 17 Sep '07

17 Sep '07

Hello, it seems that there is some bug in authentication cache code in dovecot version 1.1.alpha4 - after login attempt with wrong password the correct password also will fail. I can reproduce it very easy: $telnet 10.10.10.30 110 +OK Server. <861.2.46e6c679.jZ8QYpFmU8ZN6XIq7zPhkw==@server2> user testuser +OK pass pass +OK Logged in. quit +OK Logging out. Connection closed by foreign host. $telnet 10.10.10.30 110 +OK Server. <861.4.46e6c68d.CBp+UUDmBlyfxy8yqnu4MQ==@server2> user testuser +OK pass wrongpass -ERR Authentication failed. quit +OK Logging out Connection closed by foreign host. $telnet 10.10.10.30 110 +OK Server. <861.5.46e6c6aa.1SB5iDeA707TlaISooTumg==@server2> user testuser +OK pass pass -ERR [IN-USE] Internal login failure. Refer to server log for more information. Connection closed by foreign host. here is debug log: Sep 11 19:46:39 server2 dovecot: Dovecot v1.1.alpha4 starting up Sep 11 19:46:40 server2 dovecot: auth-worker(default): mysql: Connected to /tmp/mysql.sock (mail) Sep 11 19:47:03 server2 dovecot: auth(default): client in: AUTH^I1^IPLAIN^Iservice=pop3^Ilip=10.10.10.30^Irip=10.10.10.20^Iresp=AHRlc3R1c2VyAHBhc3M= Sep 11 19:47:03 server2 dovecot: auth(default): cache(testuser,10.10.10.20): miss Sep 11 19:47:03 server2 dovecot: auth-worker(default): sql(testuser,10.10.10.20): query: SELECT user, password, home as userdb_home, uid as userdb_uid, gid as userdb_gid FROM users WHERE user = 'testuser' Sep 11 19:47:03 server2 dovecot: auth(default): client out: OK^I1^Iuser=testuser Sep 11 19:47:03 server2 dovecot: auth(default): master in: REQUEST^I1^I2148^I1 Sep 11 19:47:03 server2 dovecot: auth(default): prefetch(testuser,10.10.10.20): success Sep 11 19:47:03 server2 dovecot: auth(default): master out: USER^I1^Itestuser^Itestuser=^Ihome=/vmail/00/testuser^Iuid=95^Igid=95 Sep 11 19:47:03 server2 dovecot: pop3-login: Login: user=<testuser>, method=PLAIN, rip=10.10.10.20, lip=10.10.10.30 Sep 11 19:47:08 server2 dovecot: POP3(testuser): Disconnected: Logged out top=0/0, retr=0/0, del=0/0, size=0 Sep 11 19:47:34 server2 dovecot: auth(default): client in: AUTH^I2^IPLAIN^Iservice=pop3^Ilip=10.10.10.30^Irip=10.10.10.20^Iresp=AHRlc3R1c2VyAHdyb25ncGFzcw== Sep 11 19:47:34 server2 dovecot: auth(default): cache(testuser,10.10.10.20): hit Sep 11 19:47:34 server2 dovecot: auth(default): cache(testuser,10.10.10.20): Password mismatch Sep 11 19:47:34 server2 dovecot: auth(default): cache(testuser,10.10.10.20): PLAIN(wrongpass) != 'pass' Sep 11 19:47:34 server2 dovecot: auth-worker(default): sql(testuser,10.10.10.20): query: SELECT user, password, home as userdb_home, uid as userdb_uid, gid as userdb_gid FROM users WHERE user = 'testuser' Sep 11 19:47:34 server2 dovecot: auth-worker(default): sql(testuser,10.10.10.20): Password mismatch Sep 11 19:47:34 server2 dovecot: auth-worker(default): sql(testuser,10.10.10.20): PLAIN(wrongpass) != 'pass' Sep 11 19:47:35 server2 dovecot: auth(default): client out: FAIL^I2^Iuser=testuser Sep 11 19:47:37 server2 dovecot: pop3-login: Aborted login: user=<testuser>, method=PLAIN, rip=10.10.10.20, lip=10.10.10.30 Sep 11 19:47:46 server2 dovecot: auth(default): client in: AUTH^I3^IPLAIN^Iservice=pop3^Ilip=10.10.10.30^Irip=10.10.10.20^Iresp=AHRlc3R1c2VyAHBhc3M= Sep 11 19:47:46 server2 dovecot: auth(default): cache(testuser,10.10.10.20): hit Sep 11 19:47:46 server2 dovecot: auth(default): client out: OK^I3^Iuser=testuser Sep 11 19:47:46 server2 dovecot: auth(default): master in: REQUEST^I2^I2148^I3 Sep 11 19:47:46 server2 dovecot: auth(default): prefetch(testuser,10.10.10.20): passdb didn't return userdb entries Sep 11 19:47:46 server2 dovecot: auth(default): userdb(testuser,10.10.10.20): user not found from userdb Sep 11 19:47:46 server2 dovecot: auth(default): master out: NOTFOUND^I2 Sep 11 19:47:46 server2 dovecot: pop3-login: Internal login failure: user=<testuser>, method=PLAIN, rip=10.10.10.20, lip=10.10.10.30 dovecot -n output: # 1.1.alpha4: /usr/local/dovecot/etc/dovecot.conf base_dir: /var/run/dovecot/ syslog_facility: local0 protocols: pop3 ssl_disable: yes disable_plaintext_auth: no login_dir: /var/run/dovecot/login login_executable: /usr/local/dovecot/libexec/dovecot/pop3-login login_greeting: Server. login_process_per_connection: no login_process_size: 64 verbose_proctitle: yes first_valid_uid: 95 first_valid_gid: 95 mail_uid: 95 mail_gid: 95 mail_location: maildir:~/Maildir fsync_disable: yes mail_executable: /usr/local/dovecot/libexec/dovecot/pop3 mail_plugin_dir: /usr/local/dovecot/lib/dovecot/pop3 pop3_enable_last: yes pop3_client_workarounds: outlook-no-nuls oe-ns-eoh auth default: mechanisms: plain login digest-md5 cram-md5 apop cache_size: 2048 cache_ttl: 28800 cache_negative_ttl: 60 user: doveauth verbose: yes debug: yes debug_passwords: yes passdb: driver: sql args: /usr/local/dovecot/etc/dovecot-sql.conf userdb: driver: prefetch Regards, Arvids

2 2

[Dovecot] Dovecot stops talking to the auth server.
by Tom Diehl 17 Sep '07

17 Sep '07

Hi, I have an RHEL4 machine running dovecot-1.0.3 + postfix-2.3.2 + postfixadmin + mysql-4.1.20-2.RHEL4.1 + amavisd-new-2.5.2-1. The machine only has a gig of memory in it, I am trying to keep it running until I get new hardware to replace it in a couple of weeks. For the most part it works as advertised but every once in a while it stops talking to the auth server. I think I have tracked this to periods of high auth requests. Today the machine experienced a dictionary attack and I had log entries like the following: Sep 10 13:31:06 rocky dovecot: pop3-login: Disconnected: Shutting down: rip=::ffff:24.0.201.240, lip=::ffff:192.168.0.16 Sep 10 13:31:06 rocky dovecot: pop3-login: Can't connect to auth server at default: Resource temporarily unavailable Sep 10 13:31:07 rocky last message repeated 47 times Sep 10 13:31:08 rocky dovecot: pop3-login: Disconnected: Shutting down: rip=::ffff:24.0.201.240, lip=::ffff:192.168.0.16 Sep 10 13:31:08 rocky dovecot: imap-login: Can't connect to auth server at default: Resource temporarily unavailable Sep 10 13:31:08 rocky dovecot: pop3-login: Can't connect to auth server at default: Resource temporarily unavailable Sep 10 13:31:09 rocky last message repeated 27 times Sep 10 13:31:09 rocky dovecot: imap-login: Can't connect to auth server at default: Resource temporarily unavailable Sep 10 13:31:09 rocky dovecot: pop3-login: Can't connect to auth server at default: Resource temporarily unavailable Sep 10 13:31:09 rocky last message repeated 4 times Sep 10 13:31:09 rocky dovecot: imap-login: Can't connect to auth server at default: Resource temporarily unavailable ... a ps showed numerous defunct processes similar to the following: ... nobody 16647 0.0 0.2 9784 2112 ? S 13:17 0:00 dovecot-auth nobody 16654 0.0 0.2 9784 2088 ? S 13:17 0:00 dovecot-auth nobody 16663 0.0 0.0 0 0 ? Z 13:17 0:00 [dovecot-auth] <defunct> nobody 16668 0.0 0.2 9784 2088 ? S 13:17 0:00 dovecot-auth nobody 16669 0.0 0.0 0 0 ? Z 13:17 0:00 [dovecot-auth] <defunct> nobody 16671 0.0 0.2 9784 2088 ? S 13:17 0:00 dovecot-auth nobody 16672 0.0 0.2 9784 2128 ? S 13:17 0:00 dovecot-auth nobody 16673 0.0 0.2 9784 2088 ? S 13:17 0:00 dovecot-auth nobody 16674 0.0 0.2 9784 2088 ? S 13:17 0:00 dovecot-auth nobody 16675 0.0 0.2 9784 2112 ? S 13:17 0:00 dovecot-auth nobody 16681 0.0 0.0 0 0 ? Z 13:17 0:00 [dovecot-auth] <defunct> ... dovecot -n follows: (rocky pts4) # dovecot -n # 1.0.3: /etc/dovecot.conf login_dir: /var/run/dovecot/login login_executable(default): /usr/libexec/dovecot/imap-login login_executable(imap): /usr/libexec/dovecot/imap-login login_executable(pop3): /usr/libexec/dovecot/pop3-login first_valid_uid: 509 last_valid_uid: 509 first_valid_gid: 509 last_valid_gid: 509 mail_extra_groups: vmail mail_location: maildir:~/ maildir_copy_with_hardlinks: yes mail_executable(default): /usr/libexec/dovecot/imap mail_executable(imap): /usr/libexec/dovecot/imap mail_executable(pop3): /usr/libexec/dovecot/pop3 mail_plugins(default): mail_plugins(imap): mail_plugins(pop3): quota mail_plugin_dir(default): /usr/lib/dovecot/imap mail_plugin_dir(imap): /usr/lib/dovecot/imap mail_plugin_dir(pop3): /usr/lib/dovecot/pop3 imap_client_workarounds(default): outlook-idle delay-newmail imap_client_workarounds(imap): outlook-idle delay-newmail imap_client_workarounds(pop3): outlook-idle pop3_client_workarounds(default): pop3_client_workarounds(imap): pop3_client_workarounds(pop3): outlook-no-nuls oe-ns-eoh auth default: mechanisms: plain login user: nobody worker_max_count: 20 passdb: driver: sql args: /etc/dovecot/sql.conf passdb: driver: pam userdb: driver: passwd userdb: driver: static args: uid=509 gid=509 home=/home/vmail/domains/%d/%n userdb: driver: sql args: /etc/dovecot/sql.conf userdb: driver: prefetch socket: type: listen client: path: /var/spool/postfix/private/auth mode: 432 user: postfix group: vmail master: path: /var/run/dovecot/auth-master mode: 432 user: vmail group: vmail plugin: quota: maildir:storage=10240:messages=1000 acl: vfile:/etc/dovecot/acls trash: /etc/dovecot/trash.conf (rocky pts4) # Is there anything I can do to prevent this? Does this look like simply a resource problem or am I doing something else wrong? Regards, -- Tom Diehl tdiehl(a)rogueind.com Spamtrap address mtd123(a)rogueind.com

2 1

[Dovecot] Dovecot Sieve crash
by Julian Cowley 16 Sep '07

16 Sep '07

I just transferred the files in my home directory from an x86_64 machine to an i686 machine. This included the .dovecot.sieve and .dovecot.sievec files in my home root, and the Dovecot index files in my ~/Maildir directory. Everything seemed to be working until I tried sending an email that triggers a Sieve "redirect" command, then I got the following in the logs. I then tried the same dovecot.sieve file using a separate account which has always been on the i686 machine (and the index files have always been written there too), and the Sieve "redirect" worked fine. There were core files written in my home directory which I can post if necessary. Both the x86_64 and i686 machines are CentOS 4.5 running Dovecot 1.0.5 and Dovecot Sieve plugin 1.0.1. Sep 15 21:44:10 myhost deliver(julian): Trying to allocate 0 bytes Sep 15 21:44:10 myhost deliver(julian): Raw backtrace: /usr/libexec/dovecot/deliver(i_syslog_panic_handler+0x24) [0x80a08b4] -> /usr/libexec/dovecot/deliver [0x80a06a9] -> /usr/libexec/dovecot/deliver [0x80a91bd] -> /usr/libexec/dovecot/deliver [0x80574f8] -> /usr/libexec/dovecot/deliver(duplicate_check+0x51) [0x8057671] -> /usr/lib/dovecot/lda/lib90_cmusieve_plugin.so [0x133f1f] -> /usr/lib/dovecot/lda/lib90_cmusieve_plugin.so(sieve_execute_bytecode+0x549) [0x141b59] -> /usr/lib/dovecot/lda/lib90_cmusieve_plugin.so(cmu_sieve_run+0x3fd) [0x134c4d] -> /usr/lib/dovecot/lda/lib90_cmusieve_plugin.so [0x1339f8] -> /usr/libexec/dovecot/deliver(main+0x10c8) [0x8056e28] -> /lib/tls/libc.so.6(__libc_start_main+0xd3) [0x506de3] -> /usr/libexec/dovecot/deliver [0x80550a1] Sep 15 21:44:10 myhost postfix/local[4924]: E1947344AE: to=<julian(a)lava.net>, relay=local, delay=0.35, delays=0.17/0.01/0/0.17, dsn=5.3.0, status=bounced (Command died with signal 6: "/usr/libexec/dovecot/deliver")

3 6