- dovecot - dovecot.org

[Dovecot] Unable to authenticate with Pam
by Patrick Begou 20 Dec '06

20 Dec '06

Hi, I'm trying to solve this problem for several weeks and this is a SOS! I've 2 Debian server runing heartbeat and drbd for high availability. I'm using LDAP for user database, PAM for authentication and Dovecot for Pop3s access. On the master server all is fine. If dovecot is started on the slave server (instead of the master) it does not accept to authenticate with the pam/ldap. Between the 2 servers there is just a release level of some filesets wich is different, but it do not concern dovecot, nor pam, nor ldap! I can provide a diff file. The problem occur if the ldap server is on the same node _and_ if it is on the other node. These are the messages : Dec 20 15:39:18 dean pop3-login: unable to dlopen /usr/lib/sasl2/libanonymous.so.2: /usr/lib/sasl2/libanonymous.so.2: failed to map segment from shared object: Cannot allocate memory Dec 20 15:39:18 dean pop3-login: unable to dlopen /usr/lib/sasl2/libplain.so.2: /usr/lib/sasl2/libplain.so.2: failed to map segment from shared object: Cannot allocate memory Dec 20 15:39:18 dean pop3-login: unable to dlopen /usr/lib/sasl2/liblogin.so.2: /usr/lib/sasl2/liblogin.so.2: failed to map segment from shared object: Cannot allocate memory Dec 20 15:39:18 dean pop3-login: unable to dlopen /usr/lib/sasl2/libntlm.so.2: /usr/lib/sasl2/libntlm.so.2: failed to map segment from shared object: Cannot allocate memory Dec 20 15:39:28 dean dovecot-auth: (pam_unix) check pass; user unknown Dec 20 15:39:28 dean dovecot-auth: (pam_unix) authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=194.254.67.78 The library error messages occurs on the 2 servers wich have the same libsasl packages.libsaslA2, libsasl2-modules and sasl2-bin are at level 2.1.19-1.5sarge1 The tests I've ran: => The ldap server in runing (all computers of my network use it) => ldapsearch -x \ -D "uid=begou,ou=People,........." \ -W '(uid=begou)' userPassword works fine on this host whith my password. => I'm runing sendmail on the same host with sasl to authenticate on the ldap server and: testsaslauthd -u begou -p my-password works fine and sendmail authenticate. => I'm using PLAIN passwords with ssl. ssl is working with the test: openssl s_client -connect mostha2.hmg.inpg.fr:pop3s: CONNECTED(00000003) depth=0 /C=FR/ST=RA/L=Grenoble/O=LEGI/OU=MoST/CN=Dovecot/emailAddress=Patrick.Begou(a)hmg.inpg.fr verify error:num=18:self signed certificate verify return:1 depth=0 /C=FR/ST=RA/L=Grenoble/O=LEGI/OU=MoST/CN=Dovecot/emailAddress=Patrick.Begou(a)hmg.inpg.fr verify return:1 --- Certificate chain 0 s:/C=FR/ST=RA/L=Grenoble/O=LEGI/OU=MoST/CN=Dovecot/emailAddress=Patrick.Begou@hmg.inpg.fr i:/C=FR/ST=RA/L=Grenoble/O=LEGI/OU=MoST/CN=Dovecot/emailAddress=Patrick.Begou@hmg.inpg.fr --- Server certificate -----BEGIN CERTIFICATE----- MIIEgzCCA2ugAwIBAgIJAP3u4iOMcvbhMA0GCSqGSIb3DQEBBAUAMIGHMQswCQYD ..... cut ..... 5XFFP1f0AQ== -----END CERTIFICATE----- subject=/C=FR/ST=RA/L=Grenoble/O=LEGI/OU=MoST/CN=Dovecot/emailAddress=Patrick.Begou(a)hmg.inpg.fr issuer=/C=FR/ST=RA/L=Grenoble/O=LEGI/OU=MoST/CN=Dovecot/emailAddress=Patrick.Begou(a)hmg.inpg.fr --- No client certificate CA names sent --- SSL handshake has read 1321 bytes and written 468 bytes --- New, TLSv1/SSLv3, Cipher is AES256-SHA Server public key is 2048 bit SSL-Session: Protocol : TLSv1 Cipher : AES256-SHA Session-ID: C2F2FFA0..... cut ......456C194EE3D5F Session-ID-ctx: Master-Key: 31D764620903C00A..... cut ......4B7101909B3A84F Key-Arg : None Krb5 Principal: None Start Time: 1166628727 Timeout : 300 (sec) Verify return code: 18 (self signed certificate) --- +OK dovecot ready. If I use: USER begou PASS my-password dovecot answer: -ERR Authentication failed. If a use a local user (from /etc/passwd), ex: root , it works and dovecot connect the session. ------------------------------------------------ /etc/dovecot.conf ------------------------------------------------ protocols = imaps pop3s imaps_listen = xxx.xxx.xxx.xxx pop3s_listen = xxx.xxx.xxx.xxx login = imap login = pop3 first_valid_uid = 100 mail_extra_groups = mail default_mail_env = mbox:/services/_POP-IMAP/%d/%n/:INBOX=/var/mail/%u:INDEX=/services/_POP-IMAP/%d/%n/indexes/ auth = default auth_mechanisms = plain auth_userdb = passwd auth_passdb = pam dovecot auth_user = root auth_verbose = yes auth_debug = yes ------------------------------------------------ /etc/pam.d/dovecot ------------------------------------------------ auth required pam_ldap.so account required pam_ldap.so session required pam_ldap.so ------------------------------------------------ dpkg -l \*dovecot\* ------------------------------------------------ ii dovecot-common 0.99.14-1sarge0 ii dovecot-imapd 0.99.14-1sarge0 ii dovecot-pop3d 0.99.14-1sarge0 Thanks for your help Patrick -- =============================================================== | Equipe M.O.S.T. | http://most.hmg.inpg.fr | | Patrick BEGOU | ------------ | | LEGI | mailto:Patrick.Begou@hmg.inpg.fr | | BP 53 X | Tel 04 76 82 51 35 | | 38041 GRENOBLE CEDEX | Fax 04 76 82 52 71 | ===============================================================

1 0

Re: [Dovecot] Odd Error: Expecting '='
by Patrick Rutkowski 20 Dec '06

20 Dec '06

Ok, so now I have 1.0 running. That error I had before went away, but now I have a new error. When I do "USER user(a)foo.org" over a telnet to dovecot on my test server I get "-ERR Plaintext authentication disabled." as a response. This is puzzling because in dovecot- sql.conf I have "default_pass_scheme = PLAIN" and in dovecot.conf in the auth default {} section I have "mechanisms = plain" I wrote the configs from scratch this time, so they are very short; there they are in their entirety: === dovecot.conf === ssl_disable = yes protocols = pop3 pop3s default_mail_env = maildir:~/ auth default { mechanisms = plain login passdb sql { args = /opt/dovecot/etc/dovecot-sql.conf } userdb sql { args = /opt/dovecot/etc/dovecot-sql.conf } } === dovecot-sql.conf === driver = pgsql connect = host=localhost dbname=mails user=mailreader password=secret default_pass_scheme = PLAIN password_query = SELECT password FROM users WHERE userid = '%u' user_query = SELECT '/home/'||home AS home, uid, gid FROM users WHERE userid = '%u' On Dec 19, 2006, at 10:48 PM, Patrick Rutkowski wrote: > Shoot, I'm using 0.99.14. I should have known Debian was a version > behind (it always is). I'll compile 1.0 by hand and give it a shot, > I hear the configs go by different rules in 1.0. Thanks for > alerting me about the version. > > I'll let you know how it goes with 1.0, > Patrick > > On Dec 19, 2006, at 10:11 PM, Curtis Maloney wrote: > >> Patrick Rutkowski wrote: >>> Any clues would be much appreciated, >> >> A clue to which version of Dovecot you're using would also be >> welcomed... >> >> -- >> Curtis Maloney >> cmaloney(a)cardgate.net >> >

1 1

[Dovecot] Odd Error: Expecting '='
by Patrick Rutkowski 20 Dec '06

20 Dec '06

Hi all, I'm working on setting up dovecot on a test system. When I try to start dovecot I get this error: Fatal: Error in configuration file /etc/dovecot/dovecot.conf line 504: Expecting '=' Line 504 in my config is this: auth default { passdb sql { args = /usr/local/etc/dovecot-sql.conf } userdb sql { args = /usr/local/etc/dovecot-sql.conf } } I don't see how that can be wrong because the dovecot docs mention exactly such a structure and I used the same syntax: http:// wiki.dovecot.org/BasicConfiguration Any clues would be much appreciated, Patrick P.S. My entire config can be found here: http://www.rutski89.com: 31597/upload/dovecot.txt

1 0

[Dovecot] dovecot with pam -> nss_ldap seems to work fine
by Jorge Salamero Sanz 19 Dec '06

19 Dec '06

hi all, some time ago i remember have had read (on the wiki) that dovecot couldn't work with pam against nss_ldap but i've build a setup using etch's dovecot rc15 and seems to work fine until now thru the server has a low usage (50 users). congratulations for such a nice imap server :)

3 2

[Dovecot] mbox somewhere else?
by Tolga 19 Dec '06

19 Dec '06

Hi, I want to store my folders somewhere else, it used be in ~/mail. Is this as easy as moving everything in ~/mail to /var/mail/ and editing /etc/dovecot/dovecot.conf to read mail_location=mbox:~/mail:INBOX=/var/mail/%u ? Also, is the syntax mail_location=mbox:/var/mail/%u-folders:INBOX=/var/mail/%u correct? Regards, -- Whatever it is, I fear Greeks even when they bring gifts. -- Publius Vergilius Maro (Virgil)

1 0

[Dovecot] rc15 in FC6
by Axel Thimm 19 Dec '06

19 Dec '06

Hi, just a note that FC6 now has the very latest of dovecot as an official update. :) It will upgrade the atrpms packages automatically to the official vendor version, there is nothing you need to take care of. -- Axel.Thimm at ATrpms.net

2 1

[Dovecot] Solaris NFS woes
by John Harper 18 Dec '06

18 Dec '06

I am using dovecot 1.0.rc15 (a similar problem occurred in rc10) on Solaris 9 (sparc). When working with a user who's home dir is on a local disk everything seems fine. But when that home is on an NFS-mounted disk things are very badly awry. Both the indices and the subscriptions file are being destroyed and what is left behind are files with names of the form .nfs72C034 etc. These files are described in the shell script nfsfind - every Solaris system ships with a root cron to run nfsfind and delete stale files: # These files are created by NFS clients when an open file # is removed. To preserve some semblance of Unix semantics # the client renames the file to a unique name so that the # file appears to have been removed from the directory, but # is still usable by the process that has the file open. I dont't see why dovecot would be unlink'ing it's active files while running - but I actually managed to see the dovecot.index.log appear briefly and then change to a .nfsXXXX file during the test user login. dovecot.index always seems to exist correctly but from local tests I know there should be a dovecot-uidlist, dovecot.index.cache, dovecot.index.log too, and these all appear to be .nfsXXXX files I can't seem to find anything relating to this specific problem in the archives, although these files have been mentioned a few times. And yes I do have mmap_disable = yes (but that is only relevant to the indexes, and the same thing is happening to the subscriptions file - ie some common library code for dealing with files has an issue) I should also note that these NFS mounts have been in existence for years and lots of things are running through them, so there shouldn't be anything wrong there. Suggestions, please? Thanks, John Harper ------------------------------------------------- Senior Systems Administrator Information and Instructional Technology Services University of Toronto Scarborough harper(a)utsc.utoronto.ca

4 4

[Dovecot] [PATCH] don't force read bit on base_dir
by Max Kellermann 18 Dec '06

18 Dec '06

Hi, I would like to disallow dovecot to read its base_dir (mode 0310). This is currently not possible, because settings_verify() in src/master/master-settings.c will "fix" the directory mode to 0750. The following patch for 1.0rc15 ignores the read bit (0444) when checking the directory permissions. Max

2 1

Re: [Dovecot] Problems with Mailstorage path.
by Raja T Nair 17 Dec '06

17 Dec '06

Hi, I have created symlinks to all the mail folders with caps in their name. but that does not solve the issue. If a user types in mixed case username( e.g. RtNaiR for rtnair ), dovecot creates a new mailfolder for that username; Is there a way to instruct dovecot not to create a mailbox and throw an error if the folder does not exist? raja. On 12/12/06, Kenny Dail <kend(a)amigo.net> wrote: > > > > Currently I've configured dovecote to find user's mail folder like this: > > > > dovecot.conf > > > > mail_location = maildir:/var/vmail/%d/%u/Maildir > > > > > > Thats a good setup. For simplicity's sake, why not use it? > > > > :) yes i agree. but the problem is that some of the existing ldap > > entries need to be changed. there are more than 15,000 mailboxes and > > problem users are randomly distributed. currently i'm using > > courier-imap and it perfectly lands each user in his/her own mailbox. > > the only problem i find with courier is that it becomes sluggish at > > peak hours. > I'll admit I'm ignorant in matters of ldap, is it really very hard to > pull a list of all aberrant entries? With only 15000 total accounts, > even if they all needed correcting, it wouldn't take very long to > symlink them all. > > -- > Kenny Dail <kend(a)amigo.net> > > -- +91 944 715 5548(Cell)

2 1

[Dovecot] On vacation message
by arto.saraniva＠artio.net 17 Dec '06

17 Dec '06

Hello, I am away from office and will read my emails again on sunday 17th December. Regarding urgent issues, please contact info(a)artio.net. Best Regards, Arto Saraniva Artio Oy

1 0