- dovecot - dovecot.org

[Dovecot] /etc/passwd authentication anomalies
by Stewart Dean 10 Apr '07

10 Apr '07

I am using the base AIX Unix authentication with NIS. There is a base /etc/password file (though the passwords are in a funny, IBM-peculiar file, /etc/security/passed) of just 18 lines...since NIS is in use, the last line is the standard for-anything-you-don't-find-here-try NIS indicator: +::0:0::: When I start up DC, I get these error massages: Apr 9 14:44:59 mercury mail:err|error dovecot: auth(default): passwd-file /etc/passwd: User root has invalid UID 0 Apr 9 14:44:59 mercury mail:err|error dovecot: auth(default): passwd-file /etc/passwd: User kmem has invalid GID 0 Apr 9 14:44:59 mercury mail:err|error dovecot: auth(default): passwd-file /etc/passwd: User ipsec has invalid GID 0 Apr 9 14:44:59 mercury mail:err|error dovecot: auth(default): passwd-file /etc/passwd: User + has invalid UID 0 This is a niggle, but is there something I should do differently, or is DC just annoyed at what IBM has done with /etc/passwd? -- ==== Stewart Dean, Unix System Admin, Henderson Computer Resources Center of Bard College, Annandale-on-Hudson, New York 12504 sdean(a)bard.edu voice: 845-758-7475, fax: 845-758-7035

3 2

[Dovecot] AFS maildirs & GSSAPI?
by Troy Benjegerdes 10 Apr '07

10 Apr '07

I saw some stuff about AFS maildirs awhile back, and dovecot seems happy being running via ssh from offlineimap with :INDEX=/tmp/dovecot-%u, but what I'd really like to know is has anyone got a functional dovecot installation with AFS and GSSAPI sasl support that gets the correct users's AFS tokens? Thanks -- -------------------------------------------------------------------------- Troy Benjegerdes 'da hozer' hozer(a)hozed.org Somone asked me why I work on this free (http://www.fsf.org/philosophy/) software stuff and not get a real job. Charles Shultz had the best answer: "Why do musicians compose symphonies and poets write poems? They do it because life wouldn't have any meaning for them if they didn't. That's why I draw cartoons. It's my life." -- Charles Shultz

1 0

[Dovecot] Request for additional logging
by Richard Stockton 09 Apr '07

09 Apr '07

Hi Timo, First, thanks very much for dovecot, you are doing a fine thing making it open source, and it is working very well here. It would be helpful to me if there were more logging options available. For example, I would like to see a record of each email deleted, with the filename (if maildir), and size in the log. I haven't been able to find much documentation on logging at all. Have I just not been looking in the right place? If so, I would appreciate any enlightenment offered. Thanks in advance, - Richard

2 4

[Dovecot] PAM question
by Stewart Dean 09 Apr '07

09 Apr '07

I get the errmsg: auth|security:err|error dovecot-auth PAM: load_modules: can not open module /usr/lib/security/pam_prohibit That file is 444 root:security What is wrong here? Also, I'm using plain UINX authentication, but PAM keeps trying to run. How do I turn it off? I'll probably eventually want to use PAM; how do I get it to look in /etc/pam.conf instead /etc/pam.d...or will it find it automatically? -- ==== Stewart Dean, Unix System Admin, Henderson Computer Resources Center of Bard College, Annandale-on-Hudson, New York 12504 sdean(a)bard.edu voice: 845-758-7475, fax: 845-758-7035

2 1

[Dovecot] Lock file issues
by Paul Hamby 09 Apr '07

09 Apr '07

First off, just want to say Dovecot is great! We have been using it for several months now in a fairly large installation with only a few problems. We are running 1.0.rc28 on three servers with 3 Horde/IMP boxes talking to Dovecot. The user's home dirs are located on an NFS server and the indexes are stored in their Maildirs. I have mmap_disable=yes and lock_method=dotlock in dovecot.conf. We have not implemented anything to direct users to the same server as is recommended per the Wiki. I have been trying to avoid this, as the best way I could see to do it would be to put in an IMAP proxy (Perdition?) and I just wanted to keep it as simple as possible if I could. The problems we have been having are due to dovecot.*.lock files not being cleaned up. This issue presents itself as a user not being able to login via the webmail interface. The logfile will contain something similar to the following: Apr 3 08:37:51 app02 dovecot: IMAP(user): Corrupted transaction log file /mail_home3/j/ji/user/Maildir/dovecot.index.log: end_offset (23440) > current sync_offset (23368) Apr 3 08:37:51 app02 dovecot: IMAP(user): file mail-index-sync-update.c: line 40 (mail_index_sync_update_log_offset): assertion failed: (prev_offset >= map->hdr.log_file_int_offset || prev_seq > map->hdr.log_file_seq) Apr 3 08:37:51 app02 dovecot: IMAP(user): Raw backtrace: imap [0x80a8c1a] -> imap [0x80a873f] -> imap [0x8091fcf] -> imap(mail_index_sync_update_index+0x2a1) [0x80935c5] -> imap(mail_index_sync_commit+0xbf) [0x8091c9f] -> imap(maildir_sync_index_finish+0xc4) [0x8065fbc] -> imap [0x8066851] -> imap(maildir_storage_sync_init+0x4a) [0x80669b2] -> imap(mailbox_sync_init+0x15) [0x809c9ed] -> imap(imap_sync_nonselected +0x17) [0x8060ac3] -> imap(_cmd_select_full+0xc3) [0x8059893] -> imap(cmd_select+0x13) [0x80599fb] -> imap [0x805b12e] -> imap [0x805b251] -> imap(_client_input+0xc3) [0x805b323] -> imap(io_loop_handler_run+0x184) [0x80ae1c0] -> imap(io_loop_run+0x1d) [0x80ad73d] -> imap(main+0xa5) [0x80626b1] -> /lib/libc.so.6(__libc_start_main+0xbb) [0x4003414f] -> imap(chroot +0x31) [0x80568d1] Apr 3 08:38:01 app02 dovecot: IMAP(user): Transaction log file /mail_home3/j/ji/user/Maildir/dovecot.index.log: marked corrupted Apr 3 08:38:01 app02 dovecot: IMAP(user): Transaction log file /mail_home3/j/ji/user/Maildir/dovecot.index.log.2: marked corrupted A directory listing of the Maildir shows the dovecot lock files: -rw------- 1 user users 0 Apr 3 2007 dovecot-uidlist.lock -rw------- 1 user users 360 Apr 3 2007 dovecot.index -rw------- 1 user users 32768 Apr 3 2007 dovecot.index.cache -rw------- 1 user users 24 Apr 3 2007 dovecot.index.log -rw------- 1 user users 11 Apr 3 2007 dovecot.index.log.lock -rw------- 1 user users 360 Apr 3 2007 dovecot.index.tmp While I can't login via the IMP web interface as that user, I am able to initiate an IMAP session via telnet. I can login, but as soon as I try a " select INBOX" it just appears to hang. I have attached the output of 'strace -p pid' of this IMAP session, which shows that it appears to be in a loop (statting the lock file?) for 244 seconds (seems to be consistent, tried it three different times) before it continues and gives me the INBOX. This happens for every subsequent command as well (Fetch, etc.) Once I log out, the lock files are not removed. I have to remove the lock files for the user to be able to log in via the web interface. Please let me know if I need to provide more information. Paul Hamby

2 4

[Dovecot] IP Tables block for POP3 attacks with Dovecot
by Pete Dubler 08 Apr '07

08 Apr '07

Has anyone implemented a script to block IPs which are attacking on POP3 ports using dovecot logs to indicate repetitive failed login attempts? sshblack does this nicely for ssh (port 22) attacks by monitoring the /var/log/secure file. I am considering rewriting this to POP3 port (110), but if it has already been done, I sure don't need the practice. Thanks!

4 3

[Dovecot] chdir failed, but requires group permissions
by Brent Nesbitt 08 Apr '07

08 Apr '07

Using Debian Etch package dovecot-common and dovecot-pop3d, based on 1.0.rc15-2 My home directories are set up with 770 permissions as follows: /home/<group name>/<user name> Using this method, users MUST be a member of the appropriate group to access their own home directory. If they are not, they can't chdir past /home. This appears to kill dovecot with a "chdir failed with id xxxx: Permission Denied" error, immediately after authenticating a pop3 user. I was able to make a user the owner of the <group name> directory, and dovecot succeeded But when the <group name> directory is owned by <group name>:<group name> and the user is a member of the group - the process dies. Any suggestions?

2 8

[Dovecot] SQL mail storage
by Timo Sirainen 08 Apr '07

08 Apr '07

I wasted some time yesterday and today implementing a SQL storage plugin. It seems to be working, but: - Saving new messages is done in a regular INSERT statement, which is bad. PostgreSQL has at least this COPY TO command which could be used instead. - It breaks in stress testing - It's not that well optimized. Especially it could support caching some commonly requested fields (same as dovecot.index.cache file). - Currently works only with PostgreSQL. Nothing is committed to CVS yet. I'm not sure if I should even do that. I'm not sure if those lib-sql API changes were that great. Maybe there's a better way.. If you're interested in trying it, you need the latest CVS HEAD sources and these patches: http://dovecot.org/patches/sql-storage-changes.diff http://dovecot.org/patches/sql-storage-plugin.diff The SQL schema is in src/plugins/mail-sql/schema.sql file. It creates a "tss" named user by default, so you might want to modify that. :) Then set: mail_location = sql:pgsql:host=localhost dbname=mails user=mailuser password=foo mail_plugins = mail_sql

11 13

[Dovecot] ssl connections frozen, client times out
by Steve Mulligan 08 Apr '07

08 Apr '07

Hi there, I'm using the latest Thunderbird & Dovecot. I'm trying to setup either pop3s or imaps. The plain versions of the protocols both work fine for me, even with the TLS option selected in Thunderbird. But when I try to use the ssl versions, my client does not negotiate - it just time's out. I have as much logging enabled as possible and the only thing that shows up in my logs is this: dovecot: Apr 03 03:02:47 Info: imap-login: Disconnected: Inactivity: rip=209.226.117.155, lip=10.20.0.13, TLS handshake dovecot: Apr 03 03:04:45 Warning: imap-login: SSL_accept() syscall failed: Connection reset by peer [209.226.117.155] When I trace the execution of the imap-login process, the only thing I notice when I connect is this: 03:55:28.624759 accept(1, 0xbffffaa0, [28]) = -1 EAGAIN (Resource temporarily unavailable) Along with the normal stuff: 03:55:30.682212 gettimeofday({1175586930, 682327}, {300, 0}) = 0 03:55:30.682412 gettimeofday({1175586930, 682483}, NULL) = 0 03:55:30.682525 poll([{fd=5, events=POLLIN|POLLPRI|POLLERR|POLLHUP|POLLNVAL}, {fd=8, events=POLLIN|POLLPRI|POLLERR|POLLHUP|POLLNV AL}, {fd=3, events=POLLIN|POLLPRI|POLLERR|POLLHUP|POLLNVAL}, {fd=1, events=POLLIN|POLLPRI|POLLERR|POLLHUP|POLLNVAL}], 4, 1000) = 0 ssl_cert_file = /home/steve/loft/mail/pop.loftsoftware.ca.crt pop3_uidl_format = %08Xu%08Xv ssl_key_file = /home/steve/loft/mail/pop.loftsoftware.ca.key mail_location = maildir:/home/steve/loft/mail/%d/%u mail_extra_groups = mail protocols = pop3 pop3s ssl_parameters_regenerate = 0 auth_debug = yes mail_debug = yes auth_verbose = yes auth_debug_passwords = yes verbose_ssl = yes first_valid_uid = 1006 last_valid_uid = 1006 maildir_copy_with_hardlinks = yes ssl_disable = no info_log_path = /home/steve/loft/logs/dovecot-pop.log log_path = /home/steve/loft/logs/dovecot-pop.log protocol imap { ssl_disable = no #listen = *:123 #ssl_listen = *:110 verbose_ssl = yes imap_client_workarounds = outlook-idle delay-newmail } protocol pop3 { ssl_disable = no verbose_ssl = yes #listen = *:123 #ssl_listen = *:110 pop3_client_workarounds = outlook-no-nuls oe-ns-eoh } protocol lda { postmaster_address = postmaster(a)loftsoftware.ca log_path = /home/steve/loft/logs/dovecot-deliver.log info_log_path = /home/steve/loft/logs/dovecot-deliver.log auth_socket_path = /var/run/dovecot/auth-master } auth default { mechanisms = login plain apop passdb sql { args = /etc/dovecot/sql.conf } userdb sql { args = /etc/dovecot/sql.conf } userdb prefetch { } user = nobody socket listen { master { path = /var/run/dovecot/auth-master mode = 0660 user = vmail group = mail } client { path = /var/spool/postfix/private/auth mode = 0660 user = postfix group = mail } } }

3 3

[Dovecot] Fully virtualized w/ postfix?
by tquidca＠gmail.com 08 Apr '07

08 Apr '07

Hi folks, I've poked through the archives and google and have not seen how do do this. Is it possible to virtualize ALL emails on a system? That is, I want delivery only to e.g. /var/mail/vmail/domain.tld/user/Maildir/, and for authentication & userdb to: 1) Try /etc/passwd, and if someone is there, automatically append the "default" domain, otherwise, 2) Authenticate off a mysql db or similar. Is this kind of "fallthrough" user lookup and auth. possible with dovecot? I assume the delivery can probably be done by just telling postfix to use dovecot as the local delivery agent. Thanks for your help! --JB

5 4