- dovecot - dovecot.org

[Dovecot] Some users cannot login
by Frank Bonnet 14 Feb '07

14 Feb '07

Hello I am in trouble with certain logins that cannot log in through Dovecot IMAP ... I've tried both with flat passwd or NIS It is possible to login with ssh ou to su - xxxx on the machine but it seems that the dovecot imap refuse to authenticate some users ... the dovecot version is the latest

3 2

[Dovecot] Problems to put dovecot-ldap.conf working
by Venilton Junior 14 Feb '07

14 Feb '07

Hi Folks, I'm having a little trouble to put dovecot authenticating in ldap. My postfix and saslauthd are authenticating fine. Here is what I have in my main.cf: # Accounts accounts_server_host = $ldap_server_host accounts_search_base = $ldap_search_base accounts_query_filter = (&(&(objectClass=VirtualMailAccount)(mail=%s))(forwardActive=FALSE)(acco untActive=TRUE)(delete=FALSE)) accounts_result_attribute = mailbox accounts_cache = no # aliases aliases_server_host = $ldap_server_host aliases_search_base = $ldap_search_base aliases_query_filter = (&(&(objectClass=VirtualMailAlias)(mail=%s))(accountActive=TRUE)) aliases_result_attribute = maildrop aliases_cache = no accountsmap_server_host = $ldap_server_host accountsmap_search_base = $ldap_search_base accountsmap_query_filter = (&(&(objectClass=VirtualMailAccount)(mail=%s))(forwardActive=FALSE)(acco untActive=TRUE)(delete=FALSE)) accountsmap_result_attribute = mail accountsmap_cache = no # VirtualForward virtualforward_server_host = $ldap_server_host virtualforward_search_base = $ldap_search_base virtualforward_query_filter = (&(&(objectClass=VirtualMailAccount)(mail=%s))(forwardActive=TRUE)(accou ntActive=TRUE)(delete=FALSE)) virtualforward_result_attribute = maildrop virtualforward_cache = no My saslauthd.conf follows as: ldap_servers: ldap://myldapserver/ ldap_version: 3 ldap_auth_method: bind ldap_bind_dn: uid=admin,ou=administrators,ou=topologymanagement,o=netscaperoot ldap_bind_pw: xxxx ldap_search_base: dc=domain,dc=com #ldap_filter: (|(mail=%u)(cn=%U)) ldap_filter: (&(|(mail=%u)(cn=%U)(mail=%U@%d))(accountActive=TRUE)(delete=FALSE)) PS: Removed my real server and search_base. Here is the test with saslauthd configuration: testsaslauthd -u novoemail01 -p teste123 0: OK "Success." And here is my dovecot-ldap.conf: hosts = myldapserver dn = uid=admin,ou=administrators,ou=topologymanagement,o=netscaperoot dnpass = xxxx ldap_version = 3 base = dc=domain,dc=com user_attrs = mail,,,,, user_filter = (&(objectClass=VirtualMailAccount)(mail=%u)(accountActive=TRUE)(delete=F ALSE)) pass_attrs = mail,userPassword pass_filter = (&(objectClass=VirtualMailAccount)(mail=%u)(accountActive=TRUE)(delete=F ALSE)) default_pass_scheme = SSHA When I try to authenticate, my mail.info get this: dovecot: auth(default): client in: AUTH 1 PLAIN service=POP3 lip=200.155.34.10 rip=200.155.63.82 resp=AG5vdm9lbWFpbDAxAHRlc3RlMTIz dovecot: auth(default): ldap(novoemail01,200.155.63.82): pass search: base=dc=sercomtel,dc=com,dc=br scope=subtree filter=(&(objectClass=VirtualMailAccount)(mail=novoemail01)(accountActiv e=TRUE)(delete=FALSE)) fields=mail,userPassword dovecot: auth(default): ldap(novoemail01,200.155.63.82): unknown user dovecot: auth(default): client out: FAIL 1 user=novoemail01 Does anyone have an idea where I'm failing to configure this or find a misconfiguration? Tnx for any help. Best Regards, Venilton C. Junior

2 1

[Dovecot] resilience suggestion
by David Lee 14 Feb '07

14 Feb '07

On the whole we are pleased with our trials of dovecot to replace UW-IMAP. But (ah!) we have hit one particular problem, in which we think dovecot could probably benefit from a resilience improvement. We're running dovecot on Fedora Core 5 (FC5), with passwd map details supplied by NIS. We have found that "nscd" sometimes thinks that a username is invalid, even though it is valid. So when "deliver" attempts a delivery to the INBOX of that username, it receives "user unknown" from the name service, and then does a 5xx permanent failure of valid email. >From the user perspective "The System" has incorrectly rejected perfectly valid incoming email. It is rare, but it does occasionally happen on large, busy systems. Clearly it is fundamentally an "nscd" bug. But that bug is nevertheless out there, in the wild, on such systems, potentially affecting dovecot's delivery of valid user email. We have had a source code hack since October (in "deliver.c", simply replacing a "return ret" occurence with "return EX_TEMPFAIL") and it has worked nicely (ported forward from rc8 towards rc22). Mail re-queues and a later delivery attempt then succeeds. So it would be both helpful, and good for resilience against such real OS/nscd bugs (and similar), if there were a configuration option in dovecot to allow a site admin to tell deliver to use a temporary, 4xx, failure instead (if the circumstances were appropriate for the site). Could this be considered please, Timo? -- : David Lee I.T. Service : : Senior Systems Programmer Computer Centre : : UNIX Team Leader Durham University : : South Road : : http://www.dur.ac.uk/t.d.lee/ Durham DH1 3LE : : Phone: +44 191 334 2752 U.K. :

9 15

[Dovecot] Ubuntu, Exim, deliver: permissions/setgid problem
by Sam Hathaway 14 Feb '07

14 Feb '07

Hello all, I have a little problem. I'm trying to set up Dovecot deliver (1.0 beta 3) as the LDA for Exim4 on Ubuntu 6.06 with MBOX, and I'm running into permissions problems. Exim typically wants to run pipes as the user to whom the mail is being delivered (as per the "check_local_user"). deliver needs access to the auth socket and needs to be able to create files in /var/mail. In Ubuntu, /var/mail is writeable by group mail, but not by others. So I thought I'd make deliver run as the user to whom the mail is being delivered (as per default) and with group "mail" (so it can create files in /var/mail). I also set the auth socket to be group-writeable and gave it the group mail. So theoretically, deliver should be able to: - connect to the socket - create dotfiles in /var/mail - write to the user's mailbox The problem I'm running into is that deliver tries to setgid to the primary group of the target user, and dies when it can't. I specifically do NOT want it to do this, because regular users don't have permission to write to /var/mail. I've also tried making deliver SUID root (as recommended on this list) or SGID mail (like procmail is) but I get the same error. If I also disable the "group = mail" line in the dovecot_deliver_user router in exim4.conf, I still get the same error. If I disable the "group = mail" line without making deliver SUID or SGID, then it can no longer connect to the auth socket. In this case it runs with the group of the user for whom the mail is being delivered, i.e. sam-adm (#10000). I've also tried adding "user = mail" to the transport, to no avail. The ONE way I've been able to make it work is to remove "group = mail" from exim4.conf and set the socket's mode to 0666, but I've seen warnings that allowing world-access to the socket is dangerous. I'm actually not sure why this works, since in this case it's running with both the UID and GID of the target user, and therefore shouldn't be able to create files in /var/mail. Can anyone untangle this for me? From what I've read, in Debian delivery agents should run with group "mail" (procmail is SGID mail). It seems to me that the way to go is to spawn it with group mail, allow group mail access to the auth socket, and be done with it. But this is prevented from working since it insists on resetting back to the user's primary group. Thanks, Sam Hathaway The relevent section of my dovecot.conf looks like this: protocol lda { postmaster_address = postmaster(a)uofr.net log_path = /var/log/dovecot-lda.log } auth default { mechanisms = plain socket listen { master { path = /var/run/dovecot-auth-master mode = 0660 group = mail } } # ... (other auth config directives here) } And the relevent parts of my exim4.conf are as follows: # in router section: local_user: debug_print = "R: local_user for $local_part@$domain" driver = accept domains = +local_domains check_local_user local_part_suffix = +* local_part_suffix_optional local_parts = ! root transport = dovecot_deliver_user # in transport section: dovecot_deliver_user: debug_print = "T: pipe for $local_part@$domain" driver = pipe command = /usr/lib/dovecot/deliver -d $local_part message_prefix = message_suffix = log_output delivery_date_add envelope_to_add return_path_add group = mail Here are the permissions on some interesting files/dirs: -rwxr-xr-x 1 root mail 551424 2006-11-22 21:59 /usr/lib/dovecot/deliver drwxrwsr-t 2 root mail 1024 2007-01-25 14:14 /var/mail -rw-rw---- 1 sam-adm mail 544 2007-01-25 15:58 /var/mail/sam-adm srw-rw---- 1 root mail 0 2007-01-25 15:39 /var/run/dovecot-auth-master And here's how I've been testing: echo "test" | mail -s "deliver test" sam-adm When I execute the above command, exim says: 2007-01-25 15:55:01 1HABcb-0006h4-N8 <= sam-adm(a)vps.uofr.net U=sam-adm P=local S=334 2007-01-25 15:55:02 1HABcb-0006h4-N8 ** sam-adm(a)vps.uofr.net R=local_user T=dovecot_deliver_user: Child process of dovecot_deliver_user transport returned 89 from command: /usr/lib/dovecot/deliver 2007-01-25 15:55:02 1HABcb-0006h4-N8 Completed And deliver says: deliver: "2007-01-25 15:55:02 "Fatal: setgid(10000) failed: Operation not permitted

3 6

[Dovecot] http://wiki.dovecot.org/VirtualhostingWithExim
by Marc Haber 14 Feb '07

14 Feb '07

Hi, Here is a new wording for the "Exim4 on Debian" part of the web page on http://wiki.dovecot.org/VirtualhostingWithExim. It's immutable, so I cannot directly change it. I e-mailed Florian, but he cannot log in to the wiki any more. Can somebody with appropriate privileges change the page? --------------------- If you are using the exim4 packages on Debian, you need to pay attention whether you are using the split or non-split configuration method that the packages offer. If you are using split-configuration, you need to apply the configuration changes to the router and transport directories inside /etc/exim4/conf.d; if you are using non-split configuration, you need to edit /etc/exim4/exim4.conf.template. A restart of the exim daemon with /etc/init.d/exim4 reload will activate your changes. You can find more information about the way Debian configures the exim4 packages in /usr/share/doc/exim4-base/README.Debian or at http://pkg-exim4.alioth.debian.org/README/README.Debian.html or at the Debian wiki (http://wiki.debian.org/PkgExim4) --------------------- Additionally, I would appreciate if the instructions for exim 3 could be removed. exim 3 is obsolete five years now, and new users of exim 4 are constantly finding old exim 3 documentation and fail in applying that docs to exim 4. Greetings Marc, Maintainer for Debian exim4 packages -- ----------------------------------------------------------------------------- Marc Haber | "I don't trust Computers. They | Mailadresse im Header Mannheim, Germany | lose things." Winona Ryder | Fon: *49 621 72739834 Nordisch by Nature | How to make an American Quilt | Fax: *49 621 72739835

1 0

[Dovecot] .bz2 plugin?
by David McBride 14 Feb '07

14 Feb '07

Hello all, Is anyone working on a .bz2 plugin similar to the existing zlib plugin? Cheers, David -- David McBride <dwm(a)tastycake.net>

2 1

[Dovecot] dead bodies stacking up in Drafts folder
by Charles Bueche 14 Feb '07

14 Feb '07

Hi, Setup : Apple Mail 2.1.1 (752.3) on Intel MacBook Pro and Dovecot 1.0rc22 on Solaris 9/SPARC. I use IMAP/TLS. Problem : mails are stacking up in the Drafts folder. When I start writing a mail, it appears in the drafts folder, and usually disappear as desired when I hit "Send". It then appear in the "Sent" folder. Sometimes, a draft versions stays in "Drafts", I have 21 of them since 1.1.2007. In this period, I have written about 400 emails, so only about 5 % stick in "Drafts". I can of course periodically select and delete them, but I don't like such glitches. Never sure if emails are really sent. Advice welcome. I'm the Solaris packager and admin so I can test things if needed. Sorry if it's a known Apple Mail issue, I would be the one to beat for using closed-source stuff :-) Charles -- Charles Bueche <charles(a)bueche.ch> sand, snow, wave, wind and net -surfer A-Cat SUI 192

7 9

[Dovecot] [Fwd: Re: Is it 1.0 yet?]
by Gavin Henry 14 Feb '07

14 Feb '07

---------------------------- Original Message ---------------------------- Subject: Re: [Dovecot] Is it 1.0 yet? From: "Raymond Lillard" <ryl(a)plasmaequip.com> Date: Tue, February 13, 2007 11:16 pm To: "Gavin Henry" <ghenry(a)suretecsystems.com> -------------------------------------------------------------------------- -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Gavin Henry wrote: > <quote who="Marc Perkel"> >> OK - my last main bug was fixed a few releases ago. I know that there's >> no end to getting things right but there comes a point when you need to >> call it done. No one trusts a 1.0 to be perfect but Dovecot is already >> better that most 2.0 versions of other software. >> >> I vote (as if my vote counted) to call it done, declare victory, and >> move on to 1.01, 1.02 etc. No one is going to trus it till it gets to >> 1.02 so I say lets bless it and move on. >> >> > > +1 > > +2 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.2.2 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFF0kbLW6j0KQLSyTQRAhbZAJ0SAJDaNES4wV+UajiKJ0ByObbP5gCfXfdv CU2v+W+diqDAnarYRncXj2s= =XTcI -----END PGP SIGNATURE-----

1 0

[Dovecot] Chdir Permission Denied
by Jamie Heinzel 13 Feb '07

13 Feb '07

Here are the error messages I get when anyone tries to login. Feb 13 11:22:17 mail dovecot: chdir(/home/don150) failed with uid 776: Permission denied Feb 13 11:22:17 mail imap-login: Login: don150 [::ffff:192.168.146.10] Feb 13 11:22:17 mail dovecot: child 12101 (imap) returned error 89 I am not running SELinux so I'm not sure what is happening here. All was working fine this morning, then at about 9:30 am nobody could log in. Any help would be great. Thanks!

2 2

Re: [Dovecot] [Fwd: Disable a User's email account]
by Steffen Kaiser 13 Feb '07

13 Feb '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On Tue, 13 Feb 2007, Michael Surette wrote: Hello, I'm not sure why you'd not mail this info the one, who had created the thread. Bye, - -- Steffen Kaiser -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.6 (GNU/Linux) iQEVAwUBRdHa9y9SORjhbDpvAQLFoQf+PZUZZ6bHwhcKIh+8eTK3h4wEuF0lAqjE zuOjOC5D08bOgY86qt84vWqA+MYt9QTCXTPlTFxQYQESf5IgqgwKbPbl0PHxoc/1 GOddQ+Hd7I9lt42iWukqYtd6LGAV6CTIhZIFRm6uVnZYm1Or+3kiyFhiwMwkxSKF NfcsUYVenAhtfNSXOEALaBhvzdD/uUsZX/G/whq6y9A2xPOE25zdVxLPLP+F+mk3 enShwoGa1AMV6snOOEJIRkJ4QwuCacjuQjduyBKpn72rQukZBrHoJes8DOGdIKSx 3BrFz6ck+H+7hHt+vH6ukk2fRO7nkheltrMiCc22Uf97UIychHNrOA== =NWw9 -----END PGP SIGNATURE-----

1 0