- dovecot - dovecot.org

[Dovecot] LDAP Memory Leak
by Daniel 16 Oct '06

16 Oct '06

Hi Timo I use LDAP auth on a system with around 2000 email account. I use dual OpenLDAP servers. I haven't noticed a leak of memory. Is there any more information and I will have a look to see if I can see anything that might help. Is it only affecting certain machines or all? Regards Daniel Rowe Date: Mon, 16 Oct 2006 02:39:26 +0300 From: Timo Sirainen <tss(a)iki.fi> Subject: [Dovecot] 1.0.rc10 released To: dovecot-news(a)dovecot.org, dovecot(a)dovecot.org Message-ID: <1160955566.5448.126.camel@hurina> Content-Type: text/plain; charset="us-ascii" http://dovecot.org/releases/dovecot-1.0.rc10.tar.gz http://dovecot.org/releases/dovecot-1.0.rc10.tar.gz.sig I've finally read all the mails in the mailing list and in my INBOX. If I haven't replied to some of your mail, please resend it. Remember that since 1.0.rc9 release dovecot.index.cache files will get rebuilt in 64bit systems, and it's probably better to delete them manually so you don't get errors in log files. There are only a couple of issues left in my v1.0-TODO list: - Master process appears to be leaking log fds with kqueue. Could someone again give me access to a system where this happens? - Login process problems. How well does it work now? Hopefully well enough that v1.0 could be released. - LDAP authentication is leaking memory? Can anyone confirm this? Even better, can someone figure out what exactly is leaking? :) Not a v1.0 blocker though. I think v1.0 will be released once no-one has reported any major problems for a Dovecot release in 2-4 weeks. I think login process handling is the only potentially major problem left. There are a few patches from people that I haven't forgotten, but I've decided not to put them into v1.0 anymore: - Filesystem quota group. I don't think it's that important feature, and it might break something. - HFS+ hardlink avoiding - Managesieve - vmailmgr support And finally the changes in this release: * When matching allowed_nets IPs, convert IPv6-mapped-IPv4 addresses to actual IPv4 addresses first. + IMAP: Try to avoid sending duplicate/useless message flag updates + Added support for non-plaintext authentication for vpopmail if it returns plaintext passwords. Based on patch by Remi Gacogne. + Added %D modified to return "sub.domain.org" as "sub,dc=domain,dc=org" (for LDAP queries). Patch by Andrey Panin. - rc9 broke cache files in 64bit systems - deliver works now with mail_chroot - auth cache didn't work properly with multiple passdbs - Fixes to handling CRLF linefeeds in mboxes.

2 1

[Dovecot] Dovecot and CRAM-MD5 authentication (brief) HOWTO
by James Turnbull 16 Oct '06

16 Oct '06

Hi all, I just finished configuring CRAM-MD5 for Dovecot and noted there were not a lot of resources out there that described the process. I've written up a rough and brief HOWTO at: http://www.kartar.net/weblog/cram-md5-authentication-with-dovecot/ Comments welcome and hope it helps someone. Regards James Turnbull -- James Turnbull <james(a)lovedthanlost.net> --- Author of Pro Nagios 2.0 (http://www.amazon.com/gp/product/1590596099/) Hardening Linux (http://www.amazon.com/gp/product/1590594444/) --- PGP Key (http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x0C42DF40)

1 0

[Dovecot] LDAP Memory Leak
by Daniel 16 Oct '06

16 Oct '06

Hi Timo I use LDAP auth on a system with around 2000 email account. I use dual OpenLDAP servers. I haven't noticed a leak of memory. Is there any more information and I will have a look to see if I can see anything that might help. Is it only affecting certain machines or all? Regards Daniel Rowe Date: Mon, 16 Oct 2006 02:39:26 +0300 From: Timo Sirainen <tss(a)iki.fi> Subject: [Dovecot] 1.0.rc10 released To: dovecot-news(a)dovecot.org, dovecot(a)dovecot.org Message-ID: <1160955566.5448.126.camel@hurina> Content-Type: text/plain; charset="us-ascii" http://dovecot.org/releases/dovecot-1.0.rc10.tar.gz http://dovecot.org/releases/dovecot-1.0.rc10.tar.gz.sig I've finally read all the mails in the mailing list and in my INBOX. If I haven't replied to some of your mail, please resend it. Remember that since 1.0.rc9 release dovecot.index.cache files will get rebuilt in 64bit systems, and it's probably better to delete them manually so you don't get errors in log files. There are only a couple of issues left in my v1.0-TODO list: - Master process appears to be leaking log fds with kqueue. Could someone again give me access to a system where this happens? - Login process problems. How well does it work now? Hopefully well enough that v1.0 could be released. - LDAP authentication is leaking memory? Can anyone confirm this? Even better, can someone figure out what exactly is leaking? :) Not a v1.0 blocker though. I think v1.0 will be released once no-one has reported any major problems for a Dovecot release in 2-4 weeks. I think login process handling is the only potentially major problem left. There are a few patches from people that I haven't forgotten, but I've decided not to put them into v1.0 anymore: - Filesystem quota group. I don't think it's that important feature, and it might break something. - HFS+ hardlink avoiding - Managesieve - vmailmgr support And finally the changes in this release: * When matching allowed_nets IPs, convert IPv6-mapped-IPv4 addresses to actual IPv4 addresses first. + IMAP: Try to avoid sending duplicate/useless message flag updates + Added support for non-plaintext authentication for vpopmail if it returns plaintext passwords. Based on patch by Remi Gacogne. + Added %D modified to return "sub.domain.org" as "sub,dc=domain,dc=org" (for LDAP queries). Patch by Andrey Panin. - rc9 broke cache files in 64bit systems - deliver works now with mail_chroot - auth cache didn't work properly with multiple passdbs - Fixes to handling CRLF linefeeds in mboxes.

1 0

[Dovecot] Apple Mail quota display
by Timothy Martin 16 Oct '06

16 Oct '06

I know this isn't necessarily a dovecot issue, but I was wondering if anyone has the quota displaying correctly in Apple Mail? I have it set up and working and displaying properly in thunderbird, roundcube (webmail), and squirrelmail. But for some reason Apple's Mail doesn't show the values or its nice thermometer bar. Are there additional configuration options for quota not documented on the wiki? .tim

2 3

[Dovecot] Duplicate mails
by Vegar Nilsen 16 Oct '06

16 Oct '06

Hi, one of our customers reported a problem after we moved her maildir to another disk. (Jail in FreeBSD 6, moved to another disk with rsync.) For some reason she's seeing duplicates of almost every message from November, 2005 until June, 2006 (the move happened in September, 2006.) It seems like these mails have been respooled somehow and been inserted into the maildir with the same date and time as the original: root#loc [</var/gopostal/maildirs/wow/lina/cur>] diff 1158863410.P19488Q34M511758.locusts.copyleft.no:2,STbf 1132869216.H332479P92237.mail9.copyleft.no,S=7755:2,STac root#loc [</var/gopostal/maildirs/wow/lina/cur>] ls -l 1158863410.P19488Q34M511758.locusts.copyleft.no:2,STbf -rw------- 1 mailnull mail 7755 Nov 24 2005 1158863410.P19488Q34M511758.locusts.copyleft.no:2,STbf root#loc [</var/gopostal/maildirs/wow/lina/cur>] ls -l 1132869216.H332479P92237.mail9.copyleft.no,S=7755:2,STac -rw------- 1 mailnull mail 7755 Nov 24 2005 1132869216.H332479P92237.mail9.copyleft.no,S=7755:2,STac As the diff command shows these mails are identical, except that one was created about 10 months after the other. 1132869216.H332479P92237.mail9.copyleft.no,S=7755:2,STac was written by Exim in November (we've configured Exim to add the size (",S=7755") to the file name), but I have no idea where the other file comes from. Could this be Dovecot that has recreated these mails for some reason? (Since the file names are different I doubt that this happened during the rsync, instead it must come from some program that conforms to the maildir standard of naming files. The mailserver had a different name back in November, mail9 was the old name, locusts is the new one.) Originally this file 1158863410.P19488Q34M511758.locusts.copyleft.no:2,STbf was named 1158863410.P19488Q34M511758.locusts.copyleft.no:2,bf which, if I understand it correctly, means it's unread. (The customer has deleted it since reporting this problem.) root#loc [</var/gopostal/maildirs/wow/lina/cur>] uname -r ; dovecot --version ; exim -bV 6.1-RELEASE 1.0.beta3 Exim version 4.60 #0 (FreeBSD 6.0) built 22-Feb-2006 13:01:52 If anybody has an idea as to what caused this I would really appreciate any pointers or info. Thanks in advance, Vegar Nilsen -- Copyleft Software AS < http://www.copyleft.no/ >

2 1

[Dovecot] Authenticating dovecot against Active Directory using bsdauth and login_ldap
by Martin Croker 16 Oct '06

16 Oct '06

All, I'm working in a multi-platform environment where user accounts are already held in Active Directory. I'm been trying to setup dovecot to perform user authentication against Active Directory using ldap. My Environment is: Platform OpenBSD 3.9 Dovecot Version 1.0.rc7 Active Directory Windows 2003 The approach I've taken (being the only one I was able to make work) is to use login_ldap to perform bind authentication against Active Directory/LDAP and authenticate dovecot using bsdauth. As far as I can tell the dovecot ldap authentication module requires access to the encrypted password field to which Active Directory does not permit access. Simulated LDAP login fails and when debug is enabled writes the following to /var/log/maillog ==== /var/log/maillog ================ Oct 15 20:12:27 server dovecot: auth(default): client in: AUTH 1 PLAIN service=IMAP secured lip=127.0.0.1 rip=127.0.0.1 resp=***********************== Oct 15 20:12:27 server dovecot: auth(default): bsdauth(mcrokerx,127.0.0.1): invalid password field Oct 15 20:12:28 server dovecot: auth(default): client out: FAIL 1 user=mcrokerx Oct 15 20:12:38 server dovecot: imap-login: Aborted login: user=<mcrokerx>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, secured ======================================= It appears that the cause of these log messages are the following lines of code in src/auth/passdb-bsdauth.c ==== src/auth/passdb-bsdauth.c ======== 29 if (!IS_VALID_PASSWD(pw->pw_passwd)) { 30 auth_request_log_info(request, "bsdauth", 31 "invalid password field"); 32 callback(PASSDB_RESULT_USER_DISABLED, request); 33 return; 34 } ======================================= These lines seem to require that the pw structure contains the encrypted password in pw->pw_passwd. Where login_ldap is used against Active Directory the encrypted password is not available to bsdauth and instead pw->pw_passwd contains '*'. If auth_userokay is called independently it is however able to authenticate the user correctly, as such I wonder if the IS_VALID_PASSWD check is actually necessary. It could be that my entire approach is wrong in which case I'm happy to be put right; however it seems that lines 29-34 need modification to correctly support this behaviour of bsdauth. This is beyond my limited ability in c but temporarily removing these lines of code from passdb-bsdauth.c has enabled me to authenticate dovecot against login_ldap (and thereby against Active Directory). My config files are: ==== /etc/dovecot.conf ================ base_dir = /var/dovecot/ ssl_cert_file = /etc/ssl/certs/server.crt ssl_key_file = /etc/ssl/private/server.key disable_plaintext_auth = no login_dir = /var/dovecot/login login_user = _dovecot mmap_no_write = yes protocol imap { imap_client_workarounds = delay-newmail outlook-idle netscape-eoh tb-extra-mailbox-sep } protocol pop3 { pop3_uidl_format = %08Xu%08Xv pop3_client_workarounds = outlook-no-nuls oe-ns-eoh } auth default { mechanisms = plain passdb bsdauth { } userdb passwd-file { args = /etc/passwd } user = root } plugin { } ======================================= ==== /etc/login.conf (exert) ========== staff:\ :auth=-ldap:\ :x-ldap-server=10.0.0.23:\ :x-ldap-port=389:\ :x-ldap-noreferrals:\ :x-ldap-uscope=subtree:\ :x-ldap-basedn=dc=my,dc=domain,dc=co,dc=uk:\ :x-ldap-binddn=cn=UnixUser,cn=Users,dc=my,dc=domain,dc=co,dc=uk:\ :x-ldap-bindpw=mypassword:\ :x-ldap-filter=(&(objectClass=user)(mail=%u)):\ :datasize-cur=512M:\ :datasize-max=infinity:\ :maxproc-max=256:\ :maxproc-cur=128:\ :requirehome@:\ :tc=default: ======================================= Note: for login_ldap to work it is necessary that the user information (minus password) is replicated on the localhost. I've done this using a relatively inelegant script which for completeness is below. I guess adding some error checking would be a good idea. ==== ldapsync.ksh ===================== #!/bin/ksh ldapsearch -h 10.0.0.23 \ -D cn=UnixUser,cn=Users,dc=my,dc=domain,dc=co,dc=uk \ -b cn=Users,dc=my,dc=domain,dc=co,dc=uk \ -w mypassword \ -v \ -x "(objectClass=user)" | while read key value ; do if [ "$key" == name: ]; then ldap_name="$value" fi # User Mail field as Unix name - remove @my.domain.co.uk if necessary if [ "$key" == mail: ]; then ldap_mail=$( echo "$value" | sed 's/@.*//g' ) if ( id 2>/dev/null >/dev/null $ldap_mail ); then usermod -c "$ldap_name" -s osbin/nologin -g staff -L staff $ldap_mail else useradd -d /home/$ldap_mail -c "$ldap_name" -s /sbin/nologin -m -g staff -L staff $ldap_mail fi ldap_name="" ldap_mail="" fi done ======================================= Martin

2 1

[Dovecot] unknown dovecot error. imap or logging rate?
by OpenMacNews 16 Oct '06

16 Oct '06

hi, i've dovecot cvs 10branch installed on OSX 10.4.7. when i login from my MUA (in this example, Mulberry), functionally all looks OK. BUT, i *do* see one error in the log output, dovecot: Aug 27 20:43:25 Error: IMAP(testuser(a)mydomain.com): Sending log messages too fast, throttling.. Is this an imap error? or is it 'just' the error of logging too fast? if the latter, what to do about it? or, is the throttling normal behavior? the complete context follows: dovecot: Aug 27 20:43:25 Info: auth(default): client in: AUTH 1 PLAIN service=IMAP secured lip=10.0.0.6 rip=10.0.0.6 dovecot: Aug 27 20:43:25 Info: auth(default): client out: CONT 1 dovecot: Aug 27 20:43:25 Info: auth(default): client in: CONT<hidden> dovecot: Aug 27 20:43:25 Info: auth(default): client out: OK 1 user=testuser(a)mydomain.com quota=maildir:storage=4096 dovecot: Aug 27 20:43:25 Info: auth(default): master in: REQUEST 27335 1 dovecot: Aug 27 20:43:25 Info: auth(default): master out: USER 2 testuser(a)mydomain.com static uid=301 gid=301 home=/var/Mail/Dovecot/Domains/mydomain.com/Accounts/testuser nice=10 dovecot: Aug 27 20:43:25 Info: imap-login: Login: user=<testuser(a)mydomain.com>, method=PLAIN, rip=10.0.0.6, lip=10.0.0.6, TLS dovecot: Aug 27 20:43:25 Info: IMAP(testuser(a)mydomain.com): Effective uid=301, gid=301 dovecot: Aug 27 20:43:25 Info: IMAP(testuser(a)mydomain.com): Loading modules from directory: /usr/local/dovecot-plugins/imap dovecot: Aug 27 20:43:25 Info: IMAP(testuser(a)mydomain.com): Module loaded: /usr/local/dovecot-plugins/imap/lib01_quota_plugin.so dovecot: Aug 27 20:43:25 Info: IMAP(testuser(a)mydomain.com): Module loaded: /usr/local/dovecot-plugins/imap/lib02_imap_quota_plugin.so dovecot: Aug 27 20:43:25 Info: IMAP(testuser(a)mydomain.com): Namespace: type=private, prefix=Private/, sep=/, inbox=yes, hidden=no, subscriptions=no dovecot: Aug 27 20:43:25 Info: IMAP(testuser(a)mydomain.com): maildir: data=/var/Mail/Dovecot/Domains/mydomain.com/Accounts/testuser/Maildir:INDEX… dovecot: Aug 27 20:43:25 Info: IMAP(testuser(a)mydomain.com): maildir: root=/var/Mail/Dovecot/Domains/mydomain.com/Accounts/testuser/Maildir, index=/var/Mail/Dovecot/Indexes/mydomain.com/testuser, control=, inbox= dovecot: Aug 27 20:43:25 Info: IMAP(testuser(a)mydomain.com): Namespace: type=public, prefix=Public/, sep=/, inbox=no, hidden=no, subscriptions=no dovecot: Aug 27 20:43:25 Info: IMAP(testuser(a)mydomain.com): maildir: data=/var/Mail/Dovecot/Domains/mydomain.com/Public dovecot: Aug 27 20:43:25 Info: IMAP(testuser(a)mydomain.com): maildir: root=/var/Mail/Dovecot/Domains/mydomain.com/Public, index=/var/Mail/Dovecot/Domains/mydomain.com/Public, control=, inbox= dovecot: Aug 27 20:43:25 Info: IMAP(testuser(a)mydomain.com): Namespace: type=shared, prefix=Shared/, sep=/, inbox=no, hidden=no, subscriptions=no dovecot: Aug 27 20:43:25 Error: IMAP(testuser(a)mydomain.com): Sending log messages too fast, throttling.. dovecot: Aug 27 20:43:25 Info: IMAP(testuser(a)mydomain.com): maildir: data=/var/Mail/Dovecot/Domains/mydomain.com/Shared dovecot: Aug 27 20:43:26 Info: IMAP(testuser(a)mydomain.com): maildir: root=/var/Mail/Dovecot/Domains/mydomain.com/Shared, index=/var/Mail/Dovecot/Domains/mydomain.com/Shared, control=, inbox= thanks, richard -- /"\ \ / ASCII Ribbon Campaign X against HTML email, vCards / \ & micro$oft attachments [GPG] OpenMacNews at gmail dot com fingerprint: 50C9 1C46 2F8F DE42 2EDB D460 95F7 DDBD 3671 08C6

2 1

[Dovecot] Messages not expunged
by Jackie Hunt 16 Oct '06

16 Oct '06

Hi all, I'm doing some testing between U of Washington IMAP server (which we currently run) and Dovecot on a IBM AIX system. I created a 50M mailbox, made up of 262 msgs. I'm using a Perl Script with the imap::client module to fetch each message and then flag it for deletion. At the end of the test, I run an expunge to delete all the messages. UofW imap server ran fine, messages gone. With dovecot I found the messages were not being expunged. The log indicated they were, but then said 262 messages existed at the end. After more checking, I found the file system I was using was low on disk space (<50M). As soon as I added more disk space, and reran the test with dovecot the messages were indeed expunged. Is this normal imap protocol behavior? I thought I would see an error message or something in the dovecot log. Does dovecot duplicate the mailbox before expunge? There wasn't room on our system to do that. Thanks much for any insights/info. Jackie --- Jackie Hunt ACNS Voice: (970) 663-3789 Colorado State University FAX: (970) 491-1958 Fort Collins, CO 80523 Email: jackie.hunt(a)colostate.edu

2 3

[Dovecot] Make user name CaSe Insensitive
by FlashWebHost.com 15 Oct '06

15 Oct '06

Hi, I have mail box info(a)mydomain.com stored in MySQL db. But dovecot is allowing me to login as both INFO(a)MYDOMAIN.COM info(a)mydomain.com Shows two mail boxes. The small letter account is the one mail server really deliver all mails. Is there any way i can specify all login names are small letters, so that user always access real mail box ? Regards, Yujin ------------------------------------ http://www.flashwebhost.com

4 6

[Dovecot] Restricting Services (POP or IMAP)
by Odhiambo WASHINGTON 15 Oct '06

15 Oct '06

It would be great to have a HOWTO in the wiki, on how to restrict services by username in dovecot, so some users are allowed IMAP and others not allowed. As concerns restricting users by IP, I believe that is a bad idea. It's almost a useless idea, imnsho, because they can connect from another IP. It's easy to restrict services by IP using a firewall or by using inetd. -Wash http://www.netmeister.org/news/learn2quote.html DISCLAIMER: See http://www.wananchi.com/bms/terms.php -- +======================================================================+ |\ _,,,---,,_ | Odhiambo Washington <wash(a)wananchi.com> Zzz /,`.-'`' -. ;-;;,_ | Wananchi Online Ltd. www.wananchi.com |,4- ) )-,_. ,\ ( `'-'| Tel: +254 20 313985-9 +254 20 313922 '---''(_/--' `-'\_) | GSM: +254 722 743223 +254 733 744121 +======================================================================+ Don't take life too seriously -- you'll never get out of it alive.

5 8