- dovecot - dovecot.org

[Dovecot] Updated SHA256 patch
by Jasper Slits 25 Feb '07

25 Feb '07

Hi, This is the updated version of the SHA256 password hashing patch I submitted earlier to this list. I changed it, based on the suggestions by Andrey Panin (AP). Also some other parts have been changed, summary as follows: [sha2.h] - typedef of context dropped for consistency (AP) - removed ifndef SHA2_TYPES part (AP) - removed sha256() prototype [sha2.c] - added lib.h and safe_memset.h includes - added static const to sha256_h0[8] and sha256_k[64] (AP) - replaced memset with safe_memset - used standard types from stdint.h: (AP) - uint32 -> uint32_t - uint8 -> uint8_t - removed strings.h include - removed PACK64 and UNPACK64 (defined but not used) The updated patch can also be found at http://www.malochia.nl/dovecot/sha256.patch Kind regards, Jasper diff -r -u -N --exclude=Makefile.in --exclude=.deps --exclude=Makefile --exclude=CVS dv_bas/src/auth/password-scheme.c src/auth/password-scheme.c --- dv_bas/src/auth/password-scheme.c 2007-02-25 02:13:29.697424750 +0100 +++ src/auth/password-scheme.c 2007-02-23 14:34:23.940550315 +0100 @@ -10,6 +10,7 @@ #include "mycrypt.h" #include "randgen.h" #include "sha1.h" +#include "sha2.h" #include "str.h" #include "password-scheme.h" @@ -153,6 +154,17 @@ return str_c(str); } +static const char *sha256_generate(const char *plaintext, + const char *user __attr_unused__) +{ + unsigned char digest[SHA256_RESULTLEN]; + string_t *str; + sha256_get_digest(plaintext, strlen(plaintext), digest); + str = t_str_new(MAX_BASE64_ENCODED_SIZE(sizeof(digest)+1)); + base64_encode(digest, sizeof(digest), str); + return str_c(str); +} + static const void * password_decode(const char *password, unsigned int result_len) { @@ -196,6 +208,23 @@ return memcmp(sha1_digest, data, SHA1_RESULTLEN) == 0; } +static bool sha256_verify(const char *plaintext, const char *password, + const char *user) +{ + unsigned char sha256_digest[SHA256_RESULTLEN]; + const char *data; + + sha256_get_digest(plaintext, strlen(plaintext), sha256_digest); + + data = password_decode(password, SHA256_RESULTLEN); + if (data == NULL) { + i_error("sha256_verify(%s): Invalid password encoding", user); + return 0; + } + + return memcmp(sha256_digest, data, SHA256_RESULTLEN) == 0; +} + static const char *ssha_generate(const char *plaintext, const char *user __attr_unused__) { @@ -466,6 +495,7 @@ { "MD5-CRYPT", md5_crypt_verify, md5_crypt_generate }, { "SHA", sha1_verify, sha1_generate }, { "SHA1", sha1_verify, sha1_generate }, + { "SHA256", sha256_verify, sha256_generate }, { "SMD5", smd5_verify, smd5_generate }, { "SSHA", ssha_verify, ssha_generate }, { "PLAIN", plain_verify, plain_generate }, diff -r -u -N --exclude=Makefile.in --exclude=.deps --exclude=Makefile --exclude=CVS dv_bas/src/lib/sha2.c src/lib/sha2.c --- dv_bas/src/lib/sha2.c 1970-01-01 01:00:00.000000000 +0100 +++ src/lib/sha2.c 2007-02-25 01:53:03.876815750 +0100 @@ -0,0 +1,226 @@ +/* + * FIPS 180-2 SHA-224/256/384/512 implementation + * Last update: 02/02/2007 + * Issue date: 04/30/2005 + * + * Copyright (C) 2005, 2007 Olivier Gay <olivier.gay(a)a3.epfl.ch> + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * 3. Neither the name of the project nor the names of its contributors + * may be used to endorse or promote products derived from this software + * without specific prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND + * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE + * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL + * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS + * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT + * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY + * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF + * SUCH DAMAGE. + */ + +#include "lib.h" + +#include "sha2.h" +#include "safe-memset.h" + +#define SHFR(x, n) (x >> n) +#define ROTR(x, n) ((x >> n) | (x << ((sizeof(x) << 3) - n))) +#define ROTL(x, n) ((x << n) | (x >> ((sizeof(x) << 3) - n))) +#define CH(x, y, z) ((x & y) ^ (~x & z)) +#define MAJ(x, y, z) ((x & y) ^ (x & z) ^ (y & z)) + +#define SHA256_F1(x) (ROTR(x, 2) ^ ROTR(x, 13) ^ ROTR(x, 22)) +#define SHA256_F2(x) (ROTR(x, 6) ^ ROTR(x, 11) ^ ROTR(x, 25)) +#define SHA256_F3(x) (ROTR(x, 7) ^ ROTR(x, 18) ^ SHFR(x, 3)) +#define SHA256_F4(x) (ROTR(x, 17) ^ ROTR(x, 19) ^ SHFR(x, 10)) + +#define UNPACK32(x, str) \ +{ \ + *((str) + 3) = (uint8_t) ((x) ); \ + *((str) + 2) = (uint8_t) ((x) >> 8); \ + *((str) + 1) = (uint8_t) ((x) >> 16); \ + *((str) + 0) = (uint8_t) ((x) >> 24); \ +} + +#define PACK32(str, x) \ +{ \ + *(x) = ((uint32_t) *((str) + 3) ) \ + | ((uint32_t) *((str) + 2) << 8) \ + | ((uint32_t) *((str) + 1) << 16) \ + | ((uint32_t) *((str) + 0) << 24); \ +} + + + +#define SHA256_SCR(i) \ +{ \ + w[i] = SHA256_F4(w[i - 2]) + w[i - 7] \ + + SHA256_F3(w[i - 15]) + w[i - 16]; \ +} + + + +static const uint32_t sha256_h0[8] = + {0x6a09e667, 0xbb67ae85, 0x3c6ef372, 0xa54ff53a, + 0x510e527f, 0x9b05688c, 0x1f83d9ab, 0x5be0cd19}; + + +static const uint32_t sha256_k[64] = + {0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, + 0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5, + 0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3, + 0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174, + 0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc, + 0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da, + 0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7, + 0xc6e00bf3, 0xd5a79147, 0x06ca6351, 0x14292967, + 0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13, + 0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85, + 0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3, + 0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070, + 0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5, + 0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, 0x682e6ff3, + 0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208, + 0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2}; + + +/* SHA-256 functions */ + +void sha256_transf(struct sha256_ctx *ctx, const unsigned char *message, + unsigned int block_nb) +{ + uint32_t w[64]; + uint32_t wv[8]; + uint32_t t1, t2; + const unsigned char *sub_block; + int i,j; + + + for (i = 0; i < (int) block_nb; i++) { + sub_block = message + (i << 6); + + for (j = 0; j < 16; j++) { + PACK32(&sub_block[j << 2], &w[j]); + } + + for (j = 16; j < 64; j++) { + SHA256_SCR(j); + } + + for (j = 0; j < 8; j++) { + wv[j] = ctx->h[j]; + } + + for (j = 0; j < 64; j++) { + t1 = wv[7] + SHA256_F2(wv[4]) + CH(wv[4], wv[5], wv[6]) + + sha256_k[j] + w[j]; + t2 = SHA256_F1(wv[0]) + MAJ(wv[0], wv[1], wv[2]); + wv[7] = wv[6]; + wv[6] = wv[5]; + wv[5] = wv[4]; + wv[4] = wv[3] + t1; + wv[3] = wv[2]; + wv[2] = wv[1]; + wv[1] = wv[0]; + wv[0] = t1 + t2; + } + + for (j = 0; j < 8; j++) { + ctx->h[j] += wv[j]; + } + } +} + + +void sha256_init(struct sha256_ctx *ctx) +{ + int i; + for (i = 0; i < 8; i++) { + ctx->h[i] = sha256_h0[i]; + } + + ctx->len = 0; + ctx->tot_len = 0; +} + +void sha256_loop(struct sha256_ctx *ctx, const unsigned char *message, + unsigned int len) +{ + unsigned int block_nb; + unsigned int new_len, rem_len, tmp_len; + const unsigned char *shifted_message; + + tmp_len = SHA256_BLOCK_SIZE - ctx->len; + rem_len = len < tmp_len ? len : tmp_len; + + memcpy(&ctx->block[ctx->len], message, rem_len); + + if (ctx->len + len < SHA256_BLOCK_SIZE) { + ctx->len += len; + return; + } + + new_len = len - rem_len; + block_nb = new_len / SHA256_BLOCK_SIZE; + + shifted_message = message + rem_len; + + sha256_transf(ctx, ctx->block, 1); + sha256_transf(ctx, shifted_message, block_nb); + + rem_len = new_len % SHA256_BLOCK_SIZE; + + memcpy(ctx->block, &shifted_message[block_nb << 6], + rem_len); + + ctx->len = rem_len; + ctx->tot_len += (block_nb + 1) << 6; +} + +void sha256_result(struct sha256_ctx *ctx, unsigned char *digest) +{ + unsigned int block_nb; + unsigned int pm_len; + unsigned int len_b; + int i; + + block_nb = (1 + ((SHA256_BLOCK_SIZE - 9) + < (ctx->len % SHA256_BLOCK_SIZE))); + + len_b = (ctx->tot_len + ctx->len) << 3; + pm_len = block_nb << 6; + + safe_memset(ctx->block + ctx->len, 0, pm_len - ctx->len); + ctx->block[ctx->len] = 0x80; + UNPACK32(len_b, ctx->block + pm_len - 4); + + sha256_transf(ctx, ctx->block, block_nb); + + for (i = 0 ; i < 8; i++) { + UNPACK32(ctx->h[i], &digest[i << 2]); + } +} + +void sha256_get_digest(const void *data, size_t size, + unsigned char result[SHA256_RESULTLEN]) +{ + struct sha256_ctx ctx; + + sha256_init(&ctx); + sha256_loop(&ctx, data, size); + sha256_result(&ctx, result); +} + diff -r -u -N --exclude=Makefile.in --exclude=.deps --exclude=Makefile --exclude=CVS dv_bas/src/lib/sha2.h src/lib/sha2.h --- dv_bas/src/lib/sha2.h 1970-01-01 01:00:00.000000000 +0100 +++ src/lib/sha2.h 2007-02-24 19:45:48.447687500 +0100 @@ -0,0 +1,71 @@ +/* + * FIPS 180-2 SHA-224/256/384/512 implementation + * Last update: 02/02/2007 + * Issue date: 04/30/2005 + * + * Copyright (C) 2005, 2007 Olivier Gay <olivier.gay(a)a3.epfl.ch> + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * 3. Neither the name of the project nor the names of its contributors + * may be used to endorse or promote products derived from this software + * without specific prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND + * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE + * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL + * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS + * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT + * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY + * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF + * SUCH DAMAGE. + */ + +#ifndef SHA2_H +#define SHA2_H + +#define SHA256_RESULTLEN ( 256 / 8) + +#define SHA256_BLOCK_SIZE ( 512 / 8) + +/* +#ifndef SHA2_TYPES +#define SHA2_TYPES +typedef unsigned char uint8; +typedef unsigned int uint32; +typedef unsigned long long uint64; +#endif +*/ + +struct sha256_ctx { + unsigned int tot_len; + unsigned int len; + unsigned char block[2 * SHA256_BLOCK_SIZE]; + uint32_t h[8]; +}; + +void sha256_transf(struct sha256_ctx *ctx, const unsigned char *message, + unsigned int block_nb); + + +void sha256_init(struct sha256_ctx * ctx); +void sha256_loop(struct sha256_ctx *ctx, const unsigned char *message, + unsigned int len); +void sha256_result(struct sha256_ctx *ctx, unsigned char *digest); +void sha256_get_digest(const void *data, size_t size, + unsigned char result[SHA256_RESULTLEN]); + + + +#endif /* !SHA2_H */ +

1 0

[Dovecot] openssl mkcert problem
by Zbigniew Szalbot 24 Feb '07

24 Feb '07

Hello, Can someone point me to what I should do to install the missing files? I am trying to generate self-signed certificates using mkcert.sh but I get the following error: $ /usr/local/share/dovecot/mkcert.sh error on line -1 of ./dovecot-openssl.cnf} 6213:error:02001002:system library:fopen:No such file or directory:/usr/src/secure/lib/libcrypto/../../../crypto/openssl/crypto/bio/bss_file.c:104:fopen('./dovecot-openssl.cnf}','rb') 6213:error:2006D080:BIO routines:BIO_new_file:no such file:/usr/src/secure/lib/libcrypto/../../../crypto/openssl/crypto/bio/bss_file.c:107: 6213:error:0E064072:configuration file routines:CONF_load:no such file:/usr/src/secure/lib/libcrypto/../../../crypto/openssl/crypto/conf/conf_def.c:197: I am using OpenSSL 0.9.7e-p1 25 Oct 2004. Many thanks for your help in advance! -- Zbigniew Szalbot

2 1

[Dovecot] Dovecot on Solaris x86?
by Tim Skirvin 24 Feb '07

24 Feb '07

I'm trying to get dovecot working on Solaris x86. I've got it working just fine on RH Desktop 4; and while I have a built, limping version on solx86, it's not actually usable except from other solx86 systems. Basic details: Version 1.0rc23 OS Solaris x86 (64 bit) CPU Opteron Filesystem NFS (but it's not getting that far) The general problem is apparently SSL-related. I can connect properly from another Solaris x86 machine, using either mutt or straight openssl; but when I try mutt from a Solaris or Linux machine, I get the error "SSL failed: I/O error" and it fails, and when I use openssl from a Linux machine, I get something like this: victor ~> stelnet xxxxxxxx.ks.uiuc.edu 993 + openssl s_client -connect xxxxxxxx.ks.uiuc.edu:993 -verify -debug verify depth is 0 CONNECTED(00000003) depth=0 /C=US/ST=Illinois/L=Urbana/O=UIUC/OU=[...] verify error:num=18:self signed certificate verify return:1 depth=0 /C=US/ST=Illinois/L=Urbana/O=UIUC/OU=[...] verify return:1 24748:error:140790E5:SSL routines:SSL23_WRITE:ssl handshake failure:s23_lib.c:226: Annoyingly, the same command run from a Solaris machine connects, even though mutt doesn't. (I'm using 'mutt -f imaps://xxxx/', which I know works elsewhere; and the Linux mutt is the system default one, so I don't suspect that it is the source of the problem.) The logs have been remarkably un-useful: dovecot: Feb 21 09:41:21 Info: imap-login: Disconnected: rip=[...], lip=[...] TLS handshake The software was built in all cases with: ./configure --prefix=/usr/local/encap/dovecot-1.0rc23.1 I've tried with both Sun's native cc and gcc compilers. I have also tried building on SPARC Solaris with the native cc compiler, to the same (negative) effect. (I used to have v0.99.14 running just fine on this SPARC machine, so this worries me... but I only checked it just now as an after-thought.) Any suggestions? - Tim Skirvin (tskirvin(a)ks.uiuc.edu) -- Theoretical and Computational http://www.ks.uiuc.edu/~tskirvin/ Biophysics, Beckman Institute, UIUC Senior Systems Administrator

4 9

[Dovecot] POP Problem
by Marc Perkel 24 Feb '07

24 Feb '07

Getting an error on POP only - "Authentication Server Isn't Connected" IMAP works fine. This used to work. not sure what changed.

1 1

[Dovecot] Setting up an email server
by Matt Penfold 24 Feb '07

24 Feb '07

I am sure this is a really stupid question but I could do with some advice. I am setting an old PC as an email/file server using Gentoo Linux. So far I have configured getting emails from a couple of a pop3 accounts I have with ISPs/Mail Service providers using getmail and dovecot. I can access those emails from a variety of clients using IMAP without problem. The next stage I want to implement is to have a central location available to the clients of sent emails as well as received emails. It is this part I am a bit confused about. I know I will need some kind of agent to transfer the email from the client to the appropriate ISP/Mail provider but I am overwhelmed by the choice. Sendmail seems a bit OTT for me needs! And how do I ensure that I can see what emails I have send using IMAP ? Thanks in advance Matt Penfold -- No virus found in this outgoing message. Checked by AVG Free Edition. Version: 7.5.441 / Virus Database: 268.18.3/698 - Release Date: 23/02/2007 04:39

2 1

[Dovecot] Simple patch
by David 23 Feb '07

23 Feb '07

Inline below is a simple patch that drops the root capabilities that aren't needed (inspired by a similar patch against the mpm_itk project!). Possibly it is a little too restrictive, extras can be added to suidcaps, but on platforms that support capabilities this will prevent things such as kernel module loading. Needed on linux is libcap, available in most distros. Note that this patch doesn't require libcap, or add an option, but if it is installed then it will take advantage of it. I don't have any other platforms to test on. The patch compiles fine but I haven't managed to test it yet. My autoconf experience is zero, so I hope that HAVE_LIBCAP is actually getting defined. Comments appreciated, I'll test it thoroughly later when I get some free time (and, if it works, remove the test message!). David --- configure.in 2007-02-22 21:50:07.000000000 +0000 +++ configure.in 2007-02-23 17:52:16.000000000 +0000 @@ -382,6 +382,17 @@ ]) ]) +AC_CHECK_FUNC(cap_init, [], [ + AC_CHECK_LIB(cap, cap_init, [ + have_libcap=yes + LIBS="$LIBS -lcap" + ]) +]) + +if test "$have_libcap" = "yes"; then + AC_DEFINE(HAVE_LIBCAP,, libcap is installed for cap_init()) +fi + AC_CHECK_FUNC(fdatasync, [ have_fdatasync=yes ], [ --- src/master/main.c 2007-01-27 01:44:25.000000000 +0000 +++ src/master/main.c 2007-02-23 16:13:39.000000000 +0000 @@ -24,6 +24,9 @@ #include <syslog.h> #include <sys/stat.h> #include <sys/wait.h> +#ifdef HAVE_LIBCAP +#include <sys/capability.h> +#endif const char *process_names[PROCESS_TYPE_MAX] = { "unknown", @@ -36,6 +39,15 @@ "dict" }; +/* the capabilities that we *need* in order to operate */ +#ifdef HAVE_LIBCAP +cap_t caps; +cap_value_t suidcaps[] = { + CAP_SETUID, + CAP_NET_BIND_SERVICE +}; +#endif + static const char *configfile = SYSCONFDIR "/" PACKAGE ".conf"; static const char *env_tz; @@ -583,6 +595,18 @@ if (log_error) i_fatal("This is Dovecot's error log"); + i_info("test message, monkeys"); + /* drop capabilities that we don't need, be very restrictive */ +#ifdef HAVE_LIBCAP + i_info("Found capability support, dropping unnecessary root priviledges"); + caps = cap_init(); + cap_clear(caps); + cap_set_flag(caps, CAP_PERMITTED, sizeof(suidcaps)/sizeof(cap_value_t), suidcaps, CAP_SET); + cap_set_flag(caps, CAP_EFFECTIVE, sizeof(suidcaps)/sizeof(cap_value_t), suidcaps, CAP_SET); + cap_set_proc(caps); + cap_free(caps); +#endif + lib_signals_init(); lib_signals_set_handler(SIGINT, TRUE, sig_die, NULL); lib_signals_set_handler(SIGTERM, TRUE, sig_die, NULL);

1 0

[Dovecot] Migration from courierpop3d (younger versions)
by Christian Skarby 23 Feb '07

23 Feb '07

Dear list, I am looking for a way to set up dovecot as a successor for courier pop3d, however I am looking for a way to preserve the UIDLs. Any progress on this? I can help out writing a converter if I know where the appropriate specs are. References: [1] http://www.dovecot.org/list/dovecot/2006-April/012727.html [2] http://wiki.dovecot.org/Migration#head-a43de1ba365baeb73f6c83702e4f14788041… -- Yours, Christian Skarby Interhost ANS

1 0

[Dovecot] quota warning
by Nicolas Boullis 23 Feb '07

23 Feb '07

Hi, Is there a way with dovecot to warn users who are close to reach their quota? Although I never used it, I think cyrus supports something like that by droping a warning message into the INBOX when delivering a message that brings the total size over a certain percentage. Would it be feasible to implement something like that with an extra plugin or by changing the quota plugin? Cheers, Nicolas

11 22

[Dovecot] rc19 - (_view_lookup_uid_range): assertion failed
by Dean Manners 23 Feb '07

23 Feb '07

Apologies if this is an <=rc19 thing, but am waiting for rc24 to come into Debian unstable/testing before upgrading. After purging ~10 messages from INBOX the index's appeared to go into a broken state. Mail client (Outlook express) reported "unable to read message flags". Logged messages: Feb 23 17:34:58 mailget01 dovecot: IMAP(drawkcab(a)drawkcab.com): file mail-index-view.c: line 386 (_view_lookup_ui d_range): assertion failed: (*last_seq_r >= *first_seq_r) Feb 23 17:34:58 mailget01 dovecot: IMAP(drawkcab(a)drawkcab.com): Raw backtrace: imap [0x80b46eb] -> imap [0x80b413 9] -> imap [0x809c6c8] -> imap(mail_index_lookup_uid_range+0x2b) [0x809cd5b] -> imap(index_storage_get_uids+0x36) [0x8086936] -> imap(mailbox_get_uids+0x2b) [0x80a674b] -> imap [0x805f9b8] -> imap(imap_search_get_arg+0x76) [0x 8060786] -> imap(cmd_fetch+0xa5) [0x8057ed5] -> imap(cmd_uid+0x52) [0x805ad02] -> imap [0x805b8c5] -> imap [0x805 b83b] -> imap(_client_input+0x6d) [0x805b9ad] -> imap(io_loop_handler_run+0x118) [0x80baa88] -> imap(io_loop_run+ 0x28) [0x80b9f08] -> imap(main+0x69) [0x8063e89] -> /lib/tls/libc.so.6(__libc_start_main+0xf4) [0xb7e53974] -> im ap [0x8056731] Feb 23 17:34:59 mailget01 dovecot: child 24629 (imap) killed with signal 6 Feb 23 17:35:10 mailget01 dovecot: IMAP(drawkcab(a)drawkcab.com): file mail-index-view.c: line 386 (_view_lookup_ui d_range): assertion failed: (*last_seq_r >= *first_seq_r) Feb 23 17:35:10 mailget01 dovecot: IMAP(drawkcab(a)drawkcab.com): Raw backtrace: imap [0x80b46eb] -> imap [0x80b413 9] -> imap [0x809c6c8] -> imap(mail_index_lookup_uid_range+0x2b) [0x809cd5b] -> imap(index_storage_get_uids+0x36) [0x8086936] -> imap(mailbox_get_uids+0x2b) [0x80a674b] -> imap [0x805f9b8] -> imap(imap_search_get_arg+0x76) [0x 8060786] -> imap(cmd_fetch+0xa5) [0x8057ed5] -> imap(cmd_uid+0x52) [0x805ad02] -> imap [0x805b8c5] -> imap [0x805 b83b] -> imap(_client_input+0x6d) [0x805b9ad] -> imap(io_loop_handler_run+0x118) [0x80baa88] -> imap(io_loop_run+ 0x28) [0x80b9f08] -> imap(main+0x69) [0x8063e89] -> /lib/tls/libc.so.6(__libc_start_main+0xf4) [0xb7e88974] -> im ap [0x8056731] Feb 23 17:35:10 mailget01 dovecot: child 24662 (imap) killed with signal 6 rm /userdirectory/dovecot* resolved it. If its worth investigating the dovecot* files copied to: http://www.drawkcab.com/dumpyard/dovecot-files.tar Regards __________________________________________ Dean Manners

2 1

[Dovecot] Final LDAP issues
by Joseba Torre 23 Feb '07

23 Feb '07

Hi all, I'm in my final steps with my testing server using rc23 in a x86 RHEL4 machine. Everything is working quite well, but still are some LDAP related issues I'd like to clarify: - I'm using auth_bind and auth_bind_userdn. So pass_filter isn't used, and pass_attrs are never searched. Is this true or am I missing something? - Is there a choice for the userdb bind/queries to be done using the user supplied dn -the one used for passdb-? I would like to access some non-public attributes, but I've had no luck until now. If I use the same dovecot-ldap.conf for userdb and passdb, i have a single connection to the LDAP server, but once the auth bind is successful, an anonymous bind occurs. If I use two separate files for userdb and passdb, i have two connections to the LDAP server, the second one being always anonimous. For me, the perfect state would be: - bind using the user supplied dn - if successfull, search for pass_attrs, where some user_attrs may be prefetched - unbind - userdb only binds if some needed attrs haven't been already fetched. If so, there's a choice to use the user supplied dn for the bind/search. Is this possible now? Would it be in the future? Thanks in advance. -- Joseba Torre. CIDIR Bizkaia.

3 5