- dovecot - dovecot.org

[Dovecot] How to prevent SQL injection
by Jochen Schulz 31 Jan '07

31 Jan '07

Hi, on my way home today I thought a little bit about my setup which involves user and password lookups in an SQL database (Postgres). I asked myself whether I need to do anything to prevent SQL injection via forged user or domainnames. In the wiki I didn't find anything specific, only http://wiki.dovecot.org/Variables which mentions that there is the %E modifier which escapes single quites and backslashes. This appears to be a good idea but I am asking myself whether I need to do this since it is not mentioned anywhere. Is anybody able to comment on this? And BTW, it appears that one can use several modifiers at once. This is only implicitly mentioned in the wiki (You can apply modifier*s*), but it appears to work. J. -- Ultimately, the Millenium Dome is a spectacular monument of the doublethink of our times. [Agree] [Disagree] <http://www.slowlydownward.com/NODATA/data_enter2.html>

6 8

Re: [Dovecot] Performance, dovecot vs tpop3d
by Joseph Tam 31 Jan '07

31 Jan '07

>> 2. logout, log back in immediatly, there is no re-indexing and the >> list is available in < 1 second. >> 3. logout, log back in 12 minutes later. The list is returned in >> apx 15 seconds and again in a lsof I see pop3 accessing files inside >> the cur/ directory. ... > > Of added note, when running a stat on the index files (dovecot.index, > dovecot.index.cache, dovecot.index.log), the Modify and Change > parameters remain static (no changes). So if it's rebuilding > anything it's doing it in memory and not modifying the index files. > > If I deliver a new message to the account, it does rebuild the files > for sure and increments the Modify and Change params. Perhaps what you might be seeing is file system caching. I notice this when performing NFS I/O tests: the first re-read is fast but decays over time as data is rolled out of the cache. Joseph Tam <tam(a)math.ubc.ca>

1 0

[Dovecot] Looking for IMAP maintenance tools
by Jens Knoell 31 Jan '07

31 Jan '07

Hi I'm currently prowling for some IMAP tools to help me maintain our mailboxes. I'd prefer "pure" IMAP, i.e. no messing with file system directly, but would settle for more crude ways if need be. Specifically I am looking for: - Expunge tool: Outlook does not seem to auto-expunge messages in any way shape or form. So I'd like to run a daily cron to expunge all mailboxes. - Quota helper: Some way to send a warning email once a day or so, saying "you're close to your quota limit, please delete some mail" or somesuch Granted, I could write these two from scratch - but why reinvent the wheel? Thanks Jen

5 4

[Dovecot] Dovecot 1.0 on a Mandriva 2007 box
by hackhound 31 Jan '07

31 Jan '07

I installed the RPM, and fought with it for days before realizing the packaged config file is incorrect. So I downloaded the latest tarball and used the sample dovecot.conf file. I was finally able to get dovecot to run as long as I leave the mail_location line commented out. If I uncomment the line dovecot complains that "mail_location" is an "unknown setting". What am I missing? Thanks, JB

2 3

[Dovecot] help a journalist: What do you wish the CIO understood about fighting spam?
by Esther Schindler 30 Jan '07

30 Jan '07

Hi, folks. I'm senior online editor at CIO.com, and I'm working on an article for which I'd very much like your help. There's often a lack of communication between techies and top company management. Maybe they don't want to hear about problems; perhaps you give them technical details that are far more granular than they want to know. But dealing with spam is a topic that every e-mail admin has to cope with -- and I'm not sure that the CIO knows the real issues. I have the ear of the boss, however. Essentially, I'm trying to put together the collected wisdom of e-mail and network admins in a fashion that CIOs will understand. Or at least one teeny corner of it. So I have a very simple question to pose to you: ***If you could get your CIO (or top management) to understand one thing, just ONE thing, about fighting spam, what would it be?*** And the follow-up: why did you pick that one item? Feel free to share anecdotes, horror stories, even success stories. While I hope that every CIO will read this article, I also hope that it becomes the document you bring to a new manager ("Here: this is what's important to me"). I'm sure there are plenty of other things that you wish your CIO grokked, whether about e-mail administration or other topics (not the least of which is "the e-mail admin is underpaid"). But I do have to limit myself somehow, and "what's important about fighting spam" has a lot of leeway. I'll be sure to stop by here (as I expect others want to participate in the conversation), but feel free to cc me with your response or send me a private message. I'm hoping for a rather fast turnaround on this article, so please blurt out your first thoughts rather than plan on writing a nice, leisurely response. If all goes well, I'd like to get this article posted in the next couple of weeks. Please be sure to let me know how to refer to you in the article; the usual format is &name, &title, &company and &location ("Esther Schindler is a senior developer at the Groovy Corporation in Scottsdale Arizona"). If you give me some kind of context I'm willing to work without one. That is, I do need some identifying characteristics to give the article credibility ("Esther works at a large finance company in the Southwest"). Esther Schindler senior online editor, CIO.com http://blogs.cio.com/blog/37

5 7

[Dovecot] ACL problem
by Barry Kwok 30 Jan '07

30 Jan '07

I am using 1.0-rc19 version. I made a global ACL file in /etc/dovecot-acls/Public as: owner lrsi user=manager rl The owner cannot delete/move mail inside his Public folder as I want. But the user "manager" cannot subscribe/view to other's Public folder. What I have missed? Barry

1 0

[Dovecot] mail_plugins = mail_log (pop3) crashing 1.0.rc18 and rc19
by GK 30 Jan '07

30 Jan '07

Hello Thank for adding mail_log plugin in Dovecot POP3/IMAP server. But when I am use "mail_log" in pop3 secction Dovecot getting the following log message: ... Jan 26 15:34:11 rtr dovecot: pop3-login: Login: user=<gk2>, method=PLAIN, rip=8x.xx.xx.xx, lip=8x.xx.xx.xxx Jan 26 15:34:11 rtr dovecot: POP3(gk2): dlopen(/opt/dovecot/v1.0rc19/lib/dovecot/pop3/lib20_mail_log_plugin.so) failed: /op t/dovecot/v1.0rc19/lib/dovecot/pop3/lib20_mail_log_plugin.so: undefined symbol: str_sanitize Jan 26 15:34:11 rtr dovecot: child 29501 (pop3) returned error 89 Jan 26 15:34:19 rtr dovecot: pop3-login: Login: user=<kp>, method=PLAIN, rip=8x.xx.xx.xx, lip=8x.xx.xx.xx Jan 26 15:34:19 rtr dovecot: POP3(kp): dlopen(/opt/dovecot/v1.0rc19/lib/dovecot/pop3/lib20_mail_log_plugin.so) failed: /opt /dovecot/v1.0rc19/lib/dovecot/pop3/lib20_mail_log_plugin.so: undefined symbol: str_sanitize Jan 26 15:34:19 rtr dovecot: child 29507 (pop3) returned error 89 ... Mail_log in IMAP section works fine. OS: CentOS 4.4 / PLD 2

1 0

[Dovecot] Cannot fill the maildir with mails
by Peter Selter 30 Jan '07

30 Jan '07

Hello! I have installed Dovecot yesterday as a simple connection between a local mailbox and Novell Evolution. I have set up a POP3 service that I can succesfully connect to. I chose the Maildir structure but the whole box is empty. When I try "echo ´test´ | mail -s ´test´ user42" it doesn´t reach the mailbox. What can I do? I could also try the mbox format but Evolution has problems connection to an mbox file, it just says "loading..." and nothing happens. Any help would be appreciated :-) regards, Peter ____________ Virus checked by G DATA AntiVirusKit

1 0

[Dovecot] popa3d migration
by FiL ＠ Kpoxa 30 Jan '07

30 Jan '07

Hello, I'm sure there is no good answer to my question, but it doesn't take much to ask, so I will. I am about to migrate my current Dovecot IMAP + Popa3d mailbox server to Maildir. I need to keep both protocols (IMAP and POP3) and will be switching to Dovecot on both. The question is simple - is there any way to keep POP3 UIDs through migration, so people won't get duplicates in their inboxes. Second question is not that important but if somebody has a good answer it will be really nice - is there any way to keep IMAP UIDs? With IMAP it won't create dups, but loosing (changing) UIDs will create extra load on the server. I know, this is more about mailbox->Maildir conversion, not dovecot, but this is the only place I can ask this question P.S. am running dovecot on linux FC5 right now, but will be upgrading to FC6 / dovecot 1.0 release at the time of migration. Won't do it before 1.0 final comes out Thank you, FiL

2 1

[Dovecot] dirsize quotas crashing 1.0.rc19
by Dean Brooks 30 Jan '07

30 Jan '07

Hi, I've been trying to get dirsize quotas to work properly with 1.0rc19 and Dovecot consistently crashes when attempting to do file copies once a user is over quota. Dovecot works fine for us for regular mbox based IMAP, but as soon as I add the following two entries in their respective locations in dovecot.conf: mail_plugins = quota imap_quota (in the imap{} section) quota = dirsize:storage=2000 (in the plugin{} section) If a user goes over quota, and they attempt to copy a file to a folder via IMAP, all I get is this: dovecot: [ID 684838 mail.error] child 20868 (imap) killed with signal 10 Is anyone successfully using dirsize:storage quotas with 1.0rc19? If so, can someone else verify if they see crashes like this? As soon as I remove the quota plugin, the crashes go away and all is good, so there's obviously some sort of problem in the quota plugin. Regards, Dean Brooks dean(a)iglou.com

1 1