- dovecot - dovecot.org

[Dovecot] GSSAPI authentication behind HA servers
by Mustafa A. Hashmi 22 Mar '07

22 Mar '07

Hi all, We have 2 mail servers sitting behind linux-HA machines.The mail servers are currently running dovecot 1.0rc2. Looking to enable GSSAPI authentication, I exported krb keytabs for imap/node01.domain@REALM and imap/node02.domain@REALM for both mail servers. However, clients are connecting to mail.domain.com, which results in a mismatch as far as the keytab is concerned (and rightly so). Connections directly to node01 and node02 work fine for gssapi auth. I proceeded to export a key for mail.domain.com into the same keytab for both the nodes, however, I don't think more than a single key is checked for the imap service, and authentication errors continued. Is anybody running something similar? Could you please explain how you have this working on your end? Appreciate any help. Regards, -- Mustafa A. Hashmi mahashmi(a)gmail.com

1 1

[Dovecot] Preparing for sharing with ACLs
by Mike Brudenell 22 Mar '07

22 Mar '07

Greetings - I'm finalising the layout of our new mailstore ready for a trial service using Dovecot (switching from the UW IMAP server). This is using Maildir mailboxes, changing from our current mix of MBX and traditional Berkeley. One of the things we are often asked for is how someone can grant another access to their mailbox: eg, a Head of Department wants the Departmental Secretary to review and reply to e-mails, but not tell her the password. I understand that Dovecot doesn't provide a user-interface for setting up or manipulating these, nor the IMAP ACL extension at this time, so... Q1. Are there plans to add support for ACLs in the future, along with an end-user accessible means of setting these up and manipulating them? I also understand that it is currently possible for the Mail Admin to set up ACLs (globally and/or per-mailbox) and shared folders (I admit I'm having trouble getting my head around the latter in the Wiki a bit). I' hoping to avoid using the current "has to be done by the Administrator" setup, and instead want to plan for any future end- user interface. We are using filestore quotas for the Maildirs, so at present a user's Maildir directories and files are owned by their username (UNIX uid) and group (UNIX gid). * Naturally for filestore quotas to continue to work items need to continue to be owned by the person's username (UNIX uid). When end-user support for shared mailboxes and ACLs comes along one day (hopefully!) I assume two levels of access control are needed: 1. At the filestore level the other authorised users will need read and/or write access to the directories and files comprising the Maildir, and 2. Suitable ACLs will be needed to grant access via Dovecot to authorised persons, but not to other random people. So looking to the future, I'm therefore thinking that instead of having each user's Maildir directories and files owned by their UNIX uid and gid I should instead have them owned by their UNIX uid and a common-to-everyone UNIX gid. Eg, drwxrwx--- user1:mail directoryname -rw-rw---- user1:mail filename I realise there is an element of risk here, as we would be relying on Dovecot's security to limit access so that only authorised users can access a given person's mailbox. Is this the right approach to adopt? Or is there a better way of (one day) enabling Person A to share their mailbox to Person B but not Person C? (We need a solution that is general and based on ACLs, not one that relies on our creating custom UNIX groups and assigning people's usernames to these.) I've read the Wiki pages on ACLs and Shared Folders, but am having trouble putting the information together in my mind to (one day) solve this particular requirement. Can anyone shed any light, please? Cheers, Mike B-) -- The Computing Service, University of York, Heslington, York Yo10 5DD, UK Tel:+44-1904-433811 FAX:+44-1904-433740 * Unsolicited commercial e-mail is NOT welcome at this e-mail address. *

2 1

[Dovecot] home_location or smth like that
by razor 22 Mar '07

22 Mar '07

hi dovecot list help me please dovecot-1.0.r27 exim lda virtual users in ldap base i decided to start using the sieve pluging so i have to make the homes (now my homeDirectory in ldapbase is /nonexistent). there is a lot of users, so i dont wonna to make changes in every ldap record + imho the hard link to userhome in ldap - its a not good idea. so is there any way to make it easy? may be like home_location = bla-bla-bla/%n/home in dovecot.conf (or in dovecot-ldap.conf ) sorry for my english -- Using Opera's revolutionary e-mail client: http://www.opera.com/mail/

2 3

[Dovecot] corrupted transaction log error resulting in multiple deliveries
by Justin McAleer 22 Mar '07

22 Mar '07

I'm finally picking my dovecot project back up now, and after upgrading rc19 to rc27, I sent a test message to an existing account which resulted in log entries like these: Mar 16 08:45:37 node7 deliver(user(a)example.com): Corrupted transaction log file /var/indexes/example/com/u/us/user/.INBOX/dovecot.index.log: Append with UID 3, but next_uid = 15368 Mar 16 08:45:37 node7 deliver(user(a)example.com): msgid=<20070316124031.8F089D39A5(a)node7.neonova.net>: save failed to INBOX Mar 16 08:45:37 node7 postfix/pipe[29267]: 8F089D39A5: to=<user(a)example.com>, relay=dovecot, delay=306, delays=306/0.01/0/0.02, dsn=4.3.0, status=deferred (temporary failure) So, as you can see deliver has the problem and defers delivery. Is dovecot supposed to be able to recover from a corrupted log file on its own? It repeated this until I manually wiped out the index directory (didn't try just removing the log files first, sorry). The kicker is that deliver actually did save the message to the inbox every time, so multiple copies were delivered (every time I flushed the queue until it was actually fixed, a copy was delivered). I have my mail directories on an NFS mount, and indexes on localdisk, FYI.

2 10

[Dovecot] Throttling Logins
by Sean Kamath 22 Mar '07

22 Mar '07

Hi. Earlier today I was hit with 612 login attempts in 7 minutes. They ramped up slowly, too. :-) They quickly hit the file descriptor limit. And then a login server spawned and died so quickly that dovecot just died. My question is, is there a way to throttle the number of login connections? I'm doing it in my firewall now, but it would be nice to be able to say something like "max-login-attempts: X" before we blacklist the IP (for some configurable time). yeah, I know V4.2 :-) By the way, I *really* appreciate all the effort that's gone into Dovecot. Great work, everyone. Sean

2 2

[Dovecot] mail looping
by Steven F Siirila 22 Mar '07

22 Mar '07

We are running Postfix 2.3.3 and Dovecot 1.0-RC27 on a Solaris 10 server. We use the Dovecot LDA for local delivery. Problems arise with looping mail whenever a user's .forward contains a reference to themselves. This most frequently occurs when a user sets up a vacation since it then puts this in their .forward file: \username, "|/usr/bin/vacation username" The vacation program runs fine, and sends a notice back to the message originator, but when an attempt is made to deliver the message locally, it fails with: Mar 21 13:02:16 myhost.mydomain postfix/local[13373]: 3DF5A2C63: to=<systest(a)myhost.mydomain>, relay=local, delay=0.15, delays=0.12/0/0/0.03, dsn=5.4.6, status=bounced (mail forwarding loop for systest(a)myhost.mydomain) Any ideas? I hope it's something stupid I've overlooked... Noteworthy line in postfix/main.cf: mailbox_command = /opt/dovecot/libexec/dovecot/deliver -f "$SENDER" and finally, dovecot -n: # /etc/opt/dovecot/dovecot.conf syslog_facility: local6 protocols: imap imaps pop3 pop3s listen(default): *:143 listen(imap): *:143 listen(pop3): *:110 ssl_listen(default): *:993 ssl_listen(imap): *:993 ssl_listen(pop3): *:995 ssl_cert_file: /etc/opt/openssl/certs/dovecot.pem ssl_key_file: /etc/opt/openssl/private/dovecot.pem shutdown_clients: no login_dir: /var/opt/dovecot/run/dovecot/login login_executable(default): /opt/dovecot/libexec/dovecot/imap-login login_executable(imap): /opt/dovecot/libexec/dovecot/imap-login login_executable(pop3): /opt/dovecot/libexec/dovecot/pop3-login login_processes_count: 32 login_max_processes_count: 4096 max_mail_processes: 8192 first_valid_uid: 100 default_mail_env: mbox:~/:INBOX=/var/mail/%u mail_location: mbox:~/:INBOX=/var/mail/%u mail_full_filesystem_access: yes mbox_lazy_writes: no mail_executable(default): /opt/dovecot/libexec/dovecot/imap mail_executable(imap): /opt/dovecot/libexec/dovecot/imap mail_executable(pop3): /opt/dovecot/libexec/dovecot/pop3 mail_plugin_dir(default): /opt/dovecot/lib/dovecot/imap mail_plugin_dir(imap): /opt/dovecot/lib/dovecot/imap mail_plugin_dir(pop3): /opt/dovecot/lib/dovecot/pop3 imap_client_workarounds(default): delay-newmail outlook-idle tb-extra-mailbox-sep imap_client_workarounds(imap): delay-newmail outlook-idle tb-extra-mailbox-sep imap_client_workarounds(pop3): outlook-idle pop3_uidl_format(default): pop3_uidl_format(imap): pop3_uidl_format(pop3): %08Xu%08Xv namespace: type: private separator: / location: mbox:~/:INBOX=/var/mail/%u inbox: yes hidden: yes auth default: username_format: %Lu verbose: yes debug: yes passdb: driver: pam args: session=yes * userdb: driver: passwd -- Steven F. Siirila Office: Lind Hall, Room 130B Internet Services E-mail: sfs(a)umn.edu Office of Information Technology Voice: (612) 626-0244 University of Minnesota Fax: (612) 626-7593

1 1

[Dovecot] Timeouts connecting via POP3
by Don O'Neil 22 Mar '07

22 Mar '07

I'm experiencing timeouts from time to time from both Mac Mail and Outlook when connecting to my server. I originally suspected that it might be process # related, so I increased the auth & login process counts but that hasn't seemed to make a difference. I'm running 1.0rc10 which came with my DirectAdmin control panel. I'm wondering if this problem is known and was fixed in a later release? I'm waiting for instructions from the DirectAdmin folks on building a new version in case they do something special. Any ideas? Thanks!

2 6

[Dovecot] Solaris Dovecot dovecot dovecot-1.0.rc27
by Randall Svancara 22 Mar '07

22 Mar '07

To all, I am using Dovecot on solaris 10. Home directories are mounted using NFS. However, they are not readable by root. I compiled Dovecot from the source. I set the following environment variables: export LDFLAGS='-L/local/software/openssl/lib -R/local/software/openssl/lib' export CPPFLAGS=-I/local/software/openssl/include Then I ran gmake and the gmake install. In the server logs, when I attempt to connect to port 993 using imap over SSL, i receive the following error: dovecot: Mar 21 15:34:25 Info: imap-login: Login: user=<someusername>, method=PLAIN, rip=134.121.92.228, lip=134.121.5.141, TLS dovecot: Mar 21 15:34:25 Error: IMAP(someusername): ld.so.1: imap: fatal: libgcc_s.so.1: open failed: No such file or directory dovecot: Mar 21 15:34:25 Error: child 13085 (imap) killed with signal 9 Has anyone seen similar issues? Randall

6 6

[Dovecot] Comments about LDA wiki page
by Magnus Holmgren 22 Mar '07

22 Mar '07

I've just tried out Dovecot LDA. The reason I didn't want to use it before was that I found it unnecessary together with Exim, plus I wanted to use Exim's filtering. But now I wanted to see if can notice any improvement when the indexes are updated on delivery, and I saw that it's possible to use Exim filters and pass the resulting folder with -m. Now, correct me if I'm wrong, but IIUC some corrections, improvements, and comments could be made on http://wiki.dovecot.org/LDA. In the "Site-wide setup" section (and in dovecot.conf) it's suggested that access be restricted to the master socket somehow. The first Exim example ("System-users"), however, requires a world-writable socket. Uncomment "group = mail" and deliver will complain that setgid() fails. In this situation, the "-d $local_part@$domain" is unnecessary because then deliver will use the name of the user it's running as (it should probably have been just "-d $local_part" anyway). However, if deliver is run by root (which is by default impossible under Exim) or setuid root, then a destination user is mandatory. Oh wait, without -d the auth socket isn't used at all, only the HOME environment variable and default_mail_env are. Well, it shouldn't matter much if you're running a standard pam/passwd setup, but with a more complicated non-virtual setup I see only four solutions: Make deliver setuid root, remove root from the compiled-in FIXED_NEVER_USERS list, run deliver as a user/group that has write access to all mailboxes, or make the master socket world-writable. -- Magnus Holmgren holmgren(a)lysator.liu.se (No Cc of list mail needed, thanks)

2 1

[Dovecot] How does vpopmail support works?
by Oliver Schulze L. 22 Mar '07

22 Mar '07

Hi, I'm still trying to migrate a running qmail + vpopmail to sendmail + dovecot. I need the milter stuff from sendmail. I got sendmail + dovecot running using the migrated tables from the vpopmail DB, but I'm facing the UID problem in pop3. So, now I'm following the vpopmail authdb path. My questions are: - what do I need, a running vpopmail server (lib + binary, etc)? - or only the DB? This is on Centos 4.4 Many thanks Oliver -- Oliver Schulze L. | Get my e-mail after a captcha in: Asuncion - Paraguay | http://tinymailto.com/oliver

1 0