- dovecot - dovecot.org

[Dovecot] LSUB/SUBSCRIBE under namespaces
by bhayden＠umn.edu 27 Jun '07

27 Jun '07

Hi folks. Here's our situation: Migrating from UW-IMAP. Have lots (as in, tens of thousands) of clients set up using '~/mail' as the IMAP root, and using subscriptions. Dovecot mail_location is using '~' for mbox storage. We've disabled full filesystem access in Dovecot in order to use ACLs for shared folders. Hence we have a hidden namespace for backwards compatibility with those clients using '~/mail' (dovecot -n output is at the end of this message so you can see exact settings). Here's the problem. If the client is not taking advantage of this hidden namespace--say it's configured to use plain old 'mail' as the root directory--LSUB and SUBSCRIBE work as I'd expect. Subscribing to a folder called 'foo' puts this in the user's subscriptions file: mail/foo And this (from Thunderbird's log) is the LSUB exchange: 48203776[ed8ebe0]: 2e03600:server.umn.edu:A:SendData: 6 lsub "" "mail/*" 48203776[ed8ebe0]: ReadNextLine [stream=ed8ef88 nb=26 needmore=0] 48203776[ed8ebe0]: 2e03600:serverl.umn.edu:A:CreateNewLineFromSocket: * LSUB () "/" "mail/foo" 48203776[ed8ebe0]: ReadNextLine [stream=ed8ef88 nb=38 needmore=0] (trimmed...) 48203776[ed8ebe0]: 2e03600:bhayden.email.umn.edu:A:CreateNewLineFromSocket: 6 OK Lsub completed. All is well. However, when the client is configured with '~/mail' as the root and hence triggers the hidden namespace for such, SUBSCRIBE only writes a path relative to that namespace prefix. So as opposed the 'mail/foo' in the first example, we get: foo written to the subs folder. This leads to three problems: 1. Folders subscribed to when using this namespace will either disappear or break in a client using a different IMAP root setting that actually refers to the same place. For example, if this user moves to a client (such as both of the webmail offerings on campus) that use 'mail/' as the prefix, these folders will not be visible. This is a fairly sizeable population of our users, whom we aren't necessarily in the position to say "too bad" to. :) 2. Users moved over from UW-IMAP, who were using '~/mail' for the IMAP root, have a subscriptions file full of: ~/mail/bar Dovecot, with the same client configuration (since it's expecting a bare folder name to which it will prepend the namespace prefix), interprets this as so: 49036288[fa7e740]: 2eabc00:server.umn.edu:A:CreateNewLineFromSocket: * LSUB () "/" "~/mail/~/mail/foobar" Leading to having the folder displayed in the client's list, but giving an error on SELECT. Now, this one we could theoretically "solve" by scrubbing the prefixes out of subs files as we convert; however, that leaves us with #1 above, where the bare folder name in the subs file depends on (to the average user) an obscure client config setting, which in practice in a large heterogeneous environment is unreliable. 3. Users who have been using an IMAP root of 'mail' in some client and subscribed to folders, who then use a client with the root set to '~/mail' see what appears to be "duplicates" of the same folder at the top level and then within a bogus 'mail/' subdirectory. They (quite reasonably, from their perspective), delete one of these, only to find they've deleted the only copy of said folder. Not good. Also, users can't solve some of these problems by unsubbing and re-subbing on their own, as trying to unsubscribe from a folder that doesn't exist (such as ~/mail/~/mail/foobar in the example above) fails. So, I'm wondering if there's any way to address this. I looked through the list archives and code pretty thoroughly. Only thing I noticed was a CVS log mentioning a "subscriptions=yes" setting for namespaces, which sounded like it might address this problem. However, putting that setting into dovecot.conf causes it to fail to start with a "Unrecognized config option" error, and using an imap_executable wrapper that sets the env variable as specified in the code (NAMESPACE_<number>_SUBSCRIPTIONS) sets it, as I can see from the dovecot log output: Namespace: type=private, prefix=~/mail/, sep=/, inbox=no, hidden=yes, subscriptions=yes But doesn't seem to have any effect. These two things combined lead me to believe this option was deprecated at some point? Any thoughts or suggestions? While we're moving away from UW for a reason ;), it does seem to handle this one thing more coherently as it recognizes, for example, that if the server equivalent of mail_location's storage is '~', then subscription file entries: '~/mail/foo' and 'mail/foo' are the same thing, while 'foo' is '~/foo'--regardless of client settings or namespaces. Whereas in the same situation Dovecot handles a client IMAP root of '~/mail' vs 'mail' differently, even though they are in fact the same thing. This is also internally inconsistent, because (as noted above) when a namespace is not in effect Dovecot SUBSCRIBEs using a path relative to the mail_location storage--including the client's IMAP root portion of the path--whereas when a namespace is in effect it SUBSCRIBEs with only the bare mailbox name without the current client's IMAP root to give it context and meaning. Wouldn't it seem better to have these be consistent in this respect? We need to figure this out somehow before going any further with our migration. We'll modify the source if necessary, but are hoping for a solution that doesn't require maintaining local mods to the source code unless we absolutely have to. :) And this seems like a basic enough issue that it'd be good to handle it in the real codebase. Thanks for any help or insight, -Brian Hayden Internet Services University of Minnesota dovecot -n output: (The shell script mail_executable doesn't come into play here--it sets some namespace settings only for special shared accounts using Maildir, and doesn't touch anything for the normal mbox accounts discussed above.) # /etc/opt/dovecot/dovecot.conf syslog_facility: local6 protocols: imap imaps pop3 pop3s ssl_cert_file: /etc/opt/openssl/certs/dovecot.pem ssl_key_file: /etc/opt/openssl/private/dovecot.pem shutdown_clients: no login_dir: /var/opt/dovecot/run/dovecot/login login_executable(default): /opt/dovecot/libexec/dovecot/imap-login login_executable(imap): /opt/dovecot/libexec/dovecot/imap-login login_executable(pop3): /opt/dovecot/libexec/dovecot/pop3-login max_mail_processes: 8192 first_valid_uid: 99 mail_location: mbox:~:INBOX=/var/mail/%u:INDEX=/var/mail/.dovecot-index/%1u/%u/ mail_debug: yes mail_executable(default): /opt/dovecot/libexec/dovecot/mail_path.sh mail_executable(imap): /opt/dovecot/libexec/dovecot/mail_path.sh mail_executable(pop3): /opt/dovecot/libexec/dovecot/pop3 mail_plugins(default): zlib mail_plugins(imap): zlib mail_plugins(pop3): mail_plugin_dir(default): /opt/dovecot/lib/dovecot/imap mail_plugin_dir(imap): /opt/dovecot/lib/dovecot/imap mail_plugin_dir(pop3): /opt/dovecot/lib/dovecot/pop3 imap_client_workarounds(default): delay-newmail outlook-idle tb-extra-mailbox-sep imap_client_workarounds(imap): delay-newmail outlook-idle tb-extra-mailbox-sep imap_client_workarounds(pop3): outlook-idle pop3_uidl_format(default): pop3_uidl_format(imap): pop3_uidl_format(pop3): %08Xu%08Xv namespace: type: private separator: / inbox: yes namespace: type: private separator: / prefix: ~/mail/ location: mbox:%h/mail/:INDEX=/var/mail/.dovecot-index/%1u/%u/ hidden: yes namespace: type: private separator: / prefix: ~%u/mail/ location: mbox:~%u/mail/:INDEX=/var/mail/.dovecot-index/%1u/%u/ hidden: yes namespace: type: private separator: / prefix: Shared/ location: maildir:~/Maildir/Shared:INDEX=/var/mail/.dovecot-index/%1u/u/shared auth default: username_format: %Lu passdb: driver: pam args: session=yes * userdb: driver: passwd plugin: acl: vfile:

2 2

[Dovecot] Dovecot 1.0.01 / Outlook error 0x800CCCD2
by Dave Hatton 27 Jun '07

27 Jun '07

Hi. I'm having a problem with a user running outlook 2003 against dovecot 1.0.1. A second user works fine and I haven't moved on to create a third (or more yet). On a send and receive I get an error from outlook "Task 'Checking for new mail in subscribed folders on server.' reported error (0x800CCCD2) : 'Outlook is unable to download folder (null) from the IMAP e-mail sever for account Server. Error: The server responded: 'Permission denied'....' Now I've check permissions and as a precaution "chown -R" to make sure I got them all. If I cancel the error I seem to be able to continue without a problem. It's just very annoying to get an error I can fix. Can anyone shed on light on this or suggest a plan of attack? Thanks Daveh

2 1

[Dovecot] Dovecot LDA munging INBOX access times?
by Steven F Siirila 27 Jun '07

27 Jun '07

We are running Dovecot 1.0.0 using mbox format (currently in the midst of conversion from UW IMAP). We discovered today that the Dovecot LDA is accessing the user's INBOX at delivery time! Not only do our users rely on this access time being when they last accessed their e-mail, we also rely on it to migrate "inactive" users to cheaper disk. I consider this a major bug for us and wondered if there is some reason why the LDA is doing this. I can understand that in the absence of index files it may choose to build them from scratch and therefore need to access the INBOX, but in normal cases I don't see that being necessary. It seems to me there should be a few options for how the LDA operates: 1) Deliver to INBOX, do not create or update the index. This would avoid accessing the INBOX. 2) Deliver to INBOX, update the index only if it is already current. This would avoid accessing the INBOX. (not sure if this is possible) 3) Deliver to INBOX, update/create the index as necessary to make it current. This obviously may involve accessing the INBOX. We would rather not go with option #1 -- what's the point of using Dovecot LDA in that scenario?? Comments appreciated. -- Steven F. Siirila Office: Lind Hall, Room 130B Internet Services E-mail: sfs(a)umn.edu Office of Information Technology Voice: (612) 626-0244 University of Minnesota Fax: (612) 626-7593

4 12

[Dovecot] User mapping via pam
by Flannery, Andrew 27 Jun '07

27 Jun '07

Hi, I'm trying to change the PAM_USER within a pam module, and observed that dovecot 0.99 does not support this. I then looked at 1.x and found: src/auth/passdb-pam.c:232: /* FIXME: this doesn't actually work since we're in the child process.. */ status = pam_get_item(pamh, PAM_USER, (linux_const void **)&item); if (status != PAM_SUCCESS) { *error = t_strdup_printf("pam_get_item() failed: %s", pam_strerror(pamh, status)); return status; } auth_request_set_field(request, "user", item, NULL); however it appeared to me that the auth process was passing this username to the parent in its response. Is this issue resolved? I compiled and tested mapping the username sso to the user andrew: Jun 27 13:38:45 itsrv dovecot: auth-worker(default): pam(sso,10.x.x.x): lookup service=imap Jun 27 13:38:45 itsrv dovecot: auth(default): auth(sso,10.x.x.x): username changed sso -> andrew Jun 27 13:38:45 itsrv dovecot: auth(default): client out: OK 1 user=andrew Jun 27 13:50:57 itsrv dovecot: auth(default): master in: REQUEST 1 19761 1 Jun 27 13:50:57 itsrv dovecot: auth(default): passwd(andrew,10.x.x.x): lookup Jun 27 13:50:57 itsrv dovecot: auth(default): master out: USER 1 andrew system_user=andrew uid=1001 gid=1001 home=/home/Andrew Also, is this behavior dependant on me setting blocking=yes for "passdb pam" in dovecot.conf? (for this test It was set) Thanks, Andrew Flannery

2 1

[Dovecot] ?? Error: child 1064 (imap) killed with signal 4
by Benton Haynes 27 Jun '07

27 Jun '07

After noticing a commit to the HG repository, http://hg.dovecot.org/dovecot-1.0/rev/f88b1e225be5 about, " We didn't update last_output timestamp with long fetches, causing Dovecot to idle-disconnect the client." I chekced out the latest from the DOVECOT-1.0 repo, and built again. Unfortunately, this problem still exists. Login simply disconnects. Any help, anyone? -- Ben

3 7

[Dovecot] Dovecot and SUSE 10: inotify_init()
by damien chambe - EGS 27 Jun '07

27 Jun '07

Hello all, Since my migration to SUSE SLES 10, I have a new error message : dovecot1 dovecot: IMAP(damien.chambe(a)egs-gestion.fr): inotify_init() failed: Too many open files It seems to occurs when thunderbird is idle, or when I click on sub folders I have a ulimit for open files a bit low, 1024 I have changed to 4096, but same error message. It has no visible consequences. I am on dovecot 1.0.1 I don't think it is related to dovecot config, any idea ? ulimit -a core file size (blocks, -c) 0 data seg size (kbytes, -d) unlimited file size (blocks, -f) unlimited pending signals (-i) 24573 max locked memory (kbytes, -l) 32 max memory size (kbytes, -m) unlimited open files (-n) 4096 pipe size (512 bytes, -p) 8 POSIX message queues (bytes, -q) 819200 stack size (kbytes, -s) 8192 cpu time (seconds, -t) unlimited max user processes (-u) 24573 virtual memory (kbytes, -v) unlimited file locks (-x) unlimited -- Cordialement, Damien Chambe EGS - Groupe Laurent 42 bld jules janin - BP 240 - 42006 Saint Etienne Cedex 1 Tel : 04 77 49 48 16 Fax : 04 77 49 48 45 Site institutionnel : http://www.groupe-laurent.com Site catalogue : http://ecat.groupe-laurent.com

2 1

[Dovecot] LogicMail for Blackberry and Dovecot
by Rick Romero 27 Jun '07

27 Jun '07

FYI - I just had a great interaction with the developer of this software. LogicMail for Blackberry is a true IMAP/POP client for Blackberry, which wasn't working correctly with Dovecot's IMAP. I merely posted in the sourceforge forums and got a VERY fast response with a working fix. http://logicmail.sourceforge.net/ Unfortunately I'm not a Blackberry user, but I know IMAP clients are hard to find. So I can't comment on it's usability or features, but I thought I'd give it a little press for his quick response :) Rick

2 1

[Dovecot] 1.0.rc28 released
by Timo Sirainen 27 Jun '07

27 Jun '07

http://dovecot.org/releases/dovecot-1.0.rc28.tar.gz http://dovecot.org/releases/dovecot-1.0.rc28.tar.gz.sig Still a bit more fixes. My coding TODO list is again empty. Unless something special happens in the next few weeks, I'll still make rc29 with the documentation included and v1.0 will be released April 13. * deliver + userdb static: Verify the user's existence from passdb, unless allow_all_users=yes * dovecot --exec-mail: Log to configured log files instead of stderr * Added "-example" part to doc/dovecot-sql-example.conf and doc/dovecot-ldap-example.conf. They are now also installed to $sysconfdir with "make install". + When copying/syncing a lot of mails, send "* OK Hang in there" replies to client every 15 seconds so it doesn't just timeout the connection. + Added idxview and logview utilities to examine Dovecot's index files + passdb passwd and shadow support blocking=yes setting now also + mbox: If mbox file changes unexpectedly while we're writing to it, log an error. + deliver: Ignore -m "" parameter to make calling it easier. + deliver: Added new -n parameter to disable autocreating mailboxes. It affects both -m parameter and Sieve plugin's fileinto action - mbox: Using ~/ in the mail root directory caused a ~ directory to be created (instead of expanding it to home directory) - auth cache: If unknown user was found from cache, we didn't properly return "unknown user" status, which could have caused problems in deliver. - mbox: Fixed "UID inserted in the middle of mailbox" in some conditions with broken X-UID headers - Index view syncing fixes - rc27 didn't compile with some non-GCC compilers - vpopmail support didn't compile in rc27 - NFS check with chrooting broke home direcotry for the first login - deliver: If user lookup returned "unknown user", it logged "BUG: Unexpected input" - convert plugin didn't convert INBOX

8 18

[Dovecot] Fatal: Login process must not run as root
by santhosh 27 Jun '07

27 Jun '07

Hi all, I am new to dovecot, i had installed dovecot in RH9 machine and when i tried to run( as root) it, i am getting the below message in the log file. dovecot: Jun 11 18:57:16 Fatal: Login process must not run as root I have done the installation as below ( as normal user): ./configure make sude make install When i try to run as a normal user i am getting the error like Error: Can't write to log directory /var/log: Permission denied Can anybody tell me where i am doing mistake ? Thanks in advance Regards, Santhosh

4 4

[Dovecot] Public Namespace and ACLs with pure virtual users
by Marc Delling 27 Jun '07

27 Jun '07

hi! i would appreciate to have some comments on my below scenario: # from the config userdb static { args = uid=vmail gid=mail home=/vmail/%d/%n } namespace public { separator = / prefix = All/ location = maildir:/vmail/%d/all/Maildir:CONTROL=~/Maildir/control/ all:INDEX=~/Maildir/index/all inbox = no hidden = no } namespace private { separator = / prefix = location = maildir:~/Maildir inbox = yes hidden = no } # end config the public namespace is also the maildir of the user "all@mydomain". a sieve skript is dropping mail for all@mydomain to the appropriate maildir within this maildir/namespace (e.g. .Support/) first of all: this works to some point but is such a configuration valid? can a public namespace be the maildir of a user? if a new mail for all@mydomain comes in, all subscribed users (of this domain) can view it and it is marked as /Seen individually. the important feature to me: the /Seen flags are managed per user as configured in the public namespace now the problem: the whole mail system runs with one uid/gid and virtual users, which has the effect that some user can delete mails in the public namespace or drop mails into it, create folders etc. this is not wanted. i wanted a read-only public namespace. so i decided to use acls. as namespace prefixes are ignored i needed to create them globally. my first try was: /etc/dovecot/acls/Support: owner lrwstiekxa authenticated lr which lead to the result that other users than all@mydomain cannot manipulate the public namespace at all, including setting their /Seen flag. that was the first surprise to me as i thought this flag would be managed seperately in the users homes. after a (very short) thought i came to this (allow setting the /Seen flag for others): owner lrwstiekxa authenticated lrs which lead to another unexpected result: the /Seen flag is now set globally. if one user marks a mail /Seen, it is /Seen for all other users too. where is the problem? except for the iso/osi layer 8 problem i am aware of... marc

4 7