- dovecot - dovecot.org

[Dovecot] LDAP Authorising users from Active Directory
by Rob Coward 16 Aug '06

16 Aug '06

Hi, I am having stability problems setting up dovecot to authenticate virtual users against Active Directory on Win2k3. If the correct userid and password are used, everything works fine, see first logfile snippet below. If an unknown userid is used, again everything works fine. If I try logging in with a valid userid but get the password wrong, that connection is rejected (see second logfile snippet), and all subsequent connection even with correct userid/password are rejected with thunderbird getting a temporary auth failure (see third logfile snippet below). I am using auth_bind = yes and it seems as though after the failed login with an incorrect password, dovecot is loosing the dn & dnpass settings for the initial user lookup. I have found numerous references to PHP and ActiveDirectory on Win2k3 getting a similar "ldap_search() failed: Operations error" error and they suggested ensuring LDAP Version 3 is used and the Deref is set to 'never'. I am already using these setting to no avail. Has anyone else experience these problems, or have any suggestions on how to overcome it ? Many thanks, Rob Coward Normal Login with correct password Aug 16 10:08:52 gm-ho-lin-05 dovecot: auth(default): client in: AUTH 1 PLAIN service=IMAP secured lip=127.0.0.1 rip=127.0.0.1 resp=ADA5OTlAc3RvcmVzLmdhbWUuY28udWsAOTk5MA== Aug 16 10:08:52 gm-ho-lin-05 dovecot: auth(default): ldap(0999(a)stores.game.co.uk,127.0.0.1): bind search: base=OU=Stores,OU=UK,DC=group,DC=game,DC=net filter=(&(objectClass=user)(mail=0999(a)stores.game.co.uk)) Aug 16 10:08:52 gm-ho-lin-05 dovecot: auth(default): client out: OK 1 user=0999(a)stores.game.co.uk Aug 16 10:08:52 gm-ho-lin-05 dovecot: auth(default): master in: REQUEST 6 20765 1 Aug 16 10:08:52 gm-ho-lin-05 dovecot: auth(default): ldap(0999(a)stores.game.co.uk,127.0.0.1): base=OU=Stores,OU=UK,DC=group,DC=game,DC=net scope=subtree filter=(&(objectClass=user)(mail=0999(a)stores.game.co.uk)) fields=uid,,,uid,, Aug 16 10:08:52 gm-ho-lin-05 dovecot: auth(default): master out: USER 6 0999(a)stores.game.co.uk uid=12367 gid=12367 Aug 16 10:08:52 gm-ho-lin-05 dovecot: imap-login: Login: user=<0999(a)stores.game.co.uk>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, secured Aug 16 10:08:52 gm-ho-lin-05 dovecot: IMAP(0999(a)stores.game.co.uk): Effective uid=12367, gid=12367 Aug 16 10:08:52 gm-ho-lin-05 dovecot: IMAP(0999(a)stores.game.co.uk): maildir: data=/data/mailstore/stores.game.co.uk/0999 Aug 16 10:08:52 gm-ho-lin-05 dovecot: IMAP(0999(a)stores.game.co.uk): maildir: root=/data/mailstore/stores.game.co.uk/0999, index=/data/mailstore/stores.game.co.uk/0999, control=, inbox= Aug 16 10:08:52 gm-ho-lin-05 dovecot: IMAP(0999(a)stores.game.co.uk): Disconnected: Logged out Login with incorrect password Aug 16 10:09:37 gm-ho-lin-05 dovecot: auth(default): client in: AUTH 1 PLAIN service=IMAP secured lip=127.0.0.1 rip=127.0.0.1 resp=ADA5OTlAc3RvcmVzLmdhbWUuY28udWsAMTIzNA== Aug 16 10:09:37 gm-ho-lin-05 dovecot: auth(default): ldap(0999(a)stores.game.co.uk,127.0.0.1): bind search: base=OU=Stores,OU=UK,DC=group,DC=game,DC=net filter=(&(objectClass=user)(mail=0999(a)stores.game.co.uk)) Aug 16 10:09:39 gm-ho-lin-05 dovecot: auth(default): client out: FAIL 1 user=0999(a)stores.game.co.uk Aug 16 10:09:39 gm-ho-lin-05 dovecot: imap-login: Aborted login: user=<0999(a)stores.game.co.uk>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, secured Subsequent logins with correct password Aug 16 10:09:48 gm-ho-lin-05 dovecot: auth(default): client in: AUTH 1 PLAIN service=IMAP secured lip=127.0.0.1 rip=127.0.0.1 resp=ADA5OTlAc3RvcmVzLmdhbWUuY28udWsAOTk5MA== Aug 16 10:09:48 gm-ho-lin-05 dovecot: auth(default): ldap(0999(a)stores.game.co.uk,127.0.0.1): bind search: base=OU=Stores,OU=UK,DC=group,DC=game,DC=net filter=(&(objectClass=user)(mail=0999(a)stores.game.co.uk)) Aug 16 10:09:48 gm-ho-lin-05 dovecot: auth(default): ldap(0999(a)stores.game.co.uk,127.0.0.1): ldap_search() failed: Operations error Aug 16 10:09:49 gm-ho-lin-05 dovecot: auth(default): client out: FAIL 1 user=0999(a)stores.game.co.uk temp Aug 16 10:09:49 gm-ho-lin-05 dovecot: imap-login: Aborted login: user=<0999(a)stores.game.co.uk>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, secured This e-mail and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this e-mail in error please notify the system manager at: mailto:postmaster@game.net The recipient acknowledges that the transmissions made via the Internet can be corrupted and therefore THE GAME GROUP PLC and any of its subsidiaries do not give any warranty as to the quality or accuracy of any information contained in the message or assume any liability for it or for its transmission, reception or storage. This footnote also confirms that this e-mail message has been swept by anti-virus software for the presence of computer viruses. http://www.game.co.uk http://www.gamegroup.plc.uk

1 0

[Dovecot] imap+ssl feedback
by Herr Nagengast 15 Aug '06

15 Aug '06

I've been using 1.0rc5 since August 2nd. Thunderbird users on multiple platforms haven't had any problems saving messages to the Sent mailbox. I know from reading release notes that the SSL proxy code in rc5 is different from rc6, but I have to admit to being leery about upgrading since it works for me. Here's my configure command: ./configure --without-shadow --localstatedir=/var --with-notify=kqueue --with-cyrus-sasl2 --without-gssapi --without-vpopmail --prefix=/usr/local --build=i386-portbld-freebsd5.3 Thanks for your hard work! Todd

1 0

[Dovecot] Possible to alias ("ln") a folder?
by scianos＠speakeasy.net 15 Aug '06

15 Aug '06

Greetings - I've got an interesting issue that has cropped up due to some brain-dead "functionality" in mobile Windows Mobile clients... Our mail infrastructure traditionally uses "Sent" as our sent items folder. This is the default. However, WM puts it's sent messages in a folder called "Sent Items", and does not let you change it. Is there any proper and/or elegant way to alias the Sent folder to Sent Items (and allow both to coexist as the same message store) in an automated fashion without needing to set this up for each user? Thank you in advance for you help and patience! - Stu

2 1

[Dovecot] dovecot tring to load sql modules
by Dean Gibson (Mail Administrator) 15 Aug '06

15 Aug '06

Dovecot is issuing: Aug 12 17:09:27 athlon1 dovecot: Dovecot v1.0.rc6 starting up Aug 12 17:09:27 athlon1 dovecot: Generating Diffie-Hellman parameters for the first time. This may take a while.. Aug 12 17:09:28 athlon1 dovecot: Auth process died too early - shutting down Aug 12 17:09:28 athlon1 dovecot: auth(default): dovecot-auth: error while loading shared libraries: libmysqlclient.so.10: cannot open shared object file: No such file or directory Aug 12 17:09:28 athlon1 dovecot: child 28705 (auth) returned error 127 That's because I installed the RPM from atrpms.net using "--nodeps". The RPM requires the above SQL library module, among others (inc. postgresql and sqlite). However: 1. Why do I need ANY SQL library??? I want PAM to do the authorization. 2. If I have to use SQL, I want Dovecot to use PostgreSQL (which I have installed and am using in another application). I hope the above is a dumb question, because that means the fix is easy. No, I'd rather not build my own; that's why I picked an RPM. Running Fedora Core 1. -- Dean

7 16

[Dovecot] dovecot-lda, sieve, maildir
by Frank Cusack 14 Aug '06

14 Aug '06

I'm unable to get dovecot-lda with sieve filtering to deliver into maildir folders. The examples on the wiki explicitly say "mbox", so I'm wondering, does the dovecot-lda sieve implementation not support filtering into maildir folders? -frank

5 13

[Dovecot] forbid dots in folder names
by nitbix 14 Aug '06

14 Aug '06

Is it possible to disallow creation of maildir subfolders with dots in their name? Thanks --- Alan Mosca

2 1

[Dovecot] duplicate uids in Outlook
by Faisal Shaikh 14 Aug '06

14 Aug '06

Hi, I run a Postfix/Dovecot server with Outlook 2002, Thunderbird clients as well as a Squirrelmail setup. All use IMAP to query the server. I recently converted our mail spool from mbox to maildir. After the conversion, one of the users is receiving two types of error messages which appear in a popup window. 1. The first popup says the following The UI D of a message changed unexpectedly. This typically indicates a server bug. Your program may not function properly after this. It then gives details of the MsgSeqNum, old UID and the new UID. 2. The second popup says Your server has reported a UID which does not comply with the IMAP standard. This typically indicates a server bug. Your program may not function properly after this. Ive searched for this on google and it has been reported before, but there are no reports of a solution or workaround. I would really appreciate any pointers or suggestions. Many Thanks, Faisal Shaikh

3 5

[Dovecot] POP to IMAP Transition
by Yudhvir Singh Sidhu 14 Aug '06

14 Aug '06

I am using Dovecot IMAP and added an IMAP folder to an Outlook client which is also popping another account. Both account folders exist in the same client. I am wondering if I can drag the pop-ed mail to the IMAP folder, thereby transferring old mail to the IMAP folder? Outlook allows me to click and drag folders into the IMAP folder. You see where I am going with this, I wnat to transition from the old POP accounts to the new IMAP accounts and delete the old folders. Is this possible? I'd love to hear from someone who has done this. ======== Yudhvir Singh Sidhu Systems Administrator Industry-University Cooperative Research Program www.ucdiscoverygrant.org 2087 Addison Street, 2nd Floor Berkeley, CA 94720-3340 510 643 4039 fax 510 643 7839

3 2

[Dovecot] Dovecot fails to come up when using ACLs (1.0.b5)
by Jeff Turner 13 Aug '06

13 Aug '06

Hi, I just had a go at enabling ACLs with 1.0b5. As per the docs I've done the configuration bit: protocol imap { .. mail_plugins = acl } ... plugin { acl = vfile:/usr/local/etc/dovecot-acls } and created the dovecot-acls file. When I start dovecot, it hangs for a few seconds and dies with this: [root@redback root]# /etc/init.d/dovecot restart Shutting down IMAP daemon (/usr/local/sbin/dovecot1.0rc5): [ OK ] Starting IMAP daemon (/usr/local/sbin/dovecot1.0rc5): IEffective uid=65534, gid=65534 INamespace: type=private, prefix=, sep=/, inbox=yes, hidden=no, subscriptions=no Imaildir: data=/imap/mailboxes/dump-capability Imaildir: root=/imap/mailboxes/dump-capability, index=/imap/mailboxes/dump-capability, control=, inbox= INamespace: type=public, prefix=JiraSupport/, sep=/, inbox=no, hidden=no, subscriptions=no Imaildir: data=/imap/mailboxes/jira-support:CONTROL=/imap/mailboxes/dump-capability/shared-settings/jira-support/control:INDEX=/imap/mailboxes/dump-capability/shared-settings/jira-support/index Imaildir: root=/imap/mailboxes/jira-support, index=/imap/mailboxes/dump-capability/shared-settings/jira-support/index, control=/imap/mailboxes/dump-capability/shared-settings/jira-support/control, inbox= Elstat(/imap/mailboxes/jira-support/cur) failed: Permission denied [FAILED] there's a strange dump-capability mailbox created: [root@redback root]# ls -la /imap/mailboxes/dump-capability/ total 20 drwxrwx--- 5 nfsnobody nfsnobody 4096 Aug 4 19:59 . drwxr-xrwx 28 root mail 4096 Aug 4 19:59 .. drwxrwx--- 2 nfsnobody nfsnobody 4096 Aug 4 19:59 cur drwxrwx--- 2 nfsnobody nfsnobody 4096 Aug 4 19:59 new drwxrwx--- 2 nfsnobody nfsnobody 4096 Aug 4 19:59 tmp [root@redback root]# First I tried making /imap/mailboxes/jira-support/* world-readable, which fixes the 'Permisison denied' error. Dovecot still fails to come up. When I strace the process on startup, this is what it looks like: ...... open("/etc/passwd", O_RDONLY) = 3 fcntl64(3, F_GETFD) = 0 fcntl64(3, F_SETFD, FD_CLOEXEC) = 0 fstat64(3, {st_mode=S_IFREG|0644, st_size=3091, ...}) = 0 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x40016000 read(3, "root:x:0:0:root:/root:/bin/bash\n"..., 4096) = 3091 close(3) = 0 munmap(0x40016000, 4096) = 0 access("/usr/local/libexec/dovecot/imap", X_OK) = 0 access("/usr/local/lib/dovecot/imap", R_OK|X_OK) = 0 geteuid32() = 0 pipe([3, 4]) = 0 fcntl64(3, F_GETFD) = 0 fcntl64(3, F_SETFD, FD_CLOEXEC) = 0 fcntl64(4, F_GETFD) = 0 fcntl64(4, F_SETFD, FD_CLOEXEC) = 0 dup(2) = 5 fcntl64(5, F_GETFD) = 0 fcntl64(5, F_SETFD, FD_CLOEXEC) = 0 fork() = 16282 close(5) = 0 close(4) = 0 alarm(5) = 0 wait4(-1, IEffective uid=65534, gid=65534 INamespace: type=private, prefix=, sep=/, inbox=yes, hidden=no, subscriptions=no Imaildir: data=/imap/mailboxes/dump-capability Imaildir: root=/imap/mailboxes/dump-capability, index=/imap/mailboxes/dump-capability, control=, inbox= INamespace: type=public, prefix=JiraSupport/, sep=/, inbox=no, hidden=no, subscriptions=no Imaildir: data=/imap/mailboxes/jira-support:CONTROL=/imap/mailboxes/dump-capability/shared-settings/jira-support/control:INDEX=/imap/mailboxes/dump-capability/shared-settings/jira-support/index Imaildir: root=/imap/mailboxes/jira-support, index=/imap/mailboxes/dump-capability/shared-settings/jira-support/index, control=/imap/mailboxes/dump-capability/shared-settings/jira-support/control, inbox= 0xbfffcb7c, 0, NULL) = ? ERESTARTSYS (To be restarted) --- SIGALRM (Alarm clock) @ 0 (0) --- +++ killed by SIGALRM +++ I tried chmod ugo+r'ing the /imap/dump-capability/ directory tree and it made no difference. I've attached my dovecot.conf, stripped of comments. Cheers, Jeff

2 2

Re: [Dovecot] dovecot tring to load sql modules
by Axel Thimm 13 Aug '06

13 Aug '06

On Sun, Aug 13, 2006 at 10:15:43AM -0700, Dean Gibson (Mail Administrator) wrote: > On 2006-08-13 02:50, Axel Thimm wrote: > >The fix is to _never_ use --nodeps in rpm and other package managers, and > >to simply add the mysql libs and ignore their presence. > > > >Unless you are setting up an embedded system and are running out of space > >there is no reason not to allow mysql libs to install. > > OT gripe: > > Well, if that's what I have to do, that's what I'll do. It's > getting to the state where, when you install Linux, you just have to > install everything, or administration becomes a treasure hunt. > Otherwise, every time you want to install a package, you have to go > on a treasure hunt. It's also why I search for RPMS rather than > doing a build from source; that's also a treasure hunt for more > files. Do you know that you can't run the printer command-line > configuration tools on Linux unless you have the GUI installed? You > can't set the time zone with the tools provided unless you have some > other giant package installed (I forget which) that I don't need. I > run several Linux servers, and I don't need that GUI crap on each > server. I thought one of the fundamental security concepts was, if > you don't need it, don't install it. Installing support for mysql client libs does not imply you have to run a mysql server (or even access one). That's what security is about when discussing minimal systems in a security context. > I first started with RH Linux 5.2 and it was a joy. However, > starting with about RH Linux 7.0, Linux developers have lost sight > of the original goal, in my opinion, which is to have a small, > easily managed server system. > > I don't have any problem with the dovecot RPM having support for God > knows what, built in. What would be nice is that if I don't reference > it in dovecot.conf, then it doesn't get called. Do you need hyperbole and elliptic functions? Or maybe not even sqrt? Should then glibc allow riping them out? Of course not. And what shoudl any packaging system do when you suddenly do reference mysql support in dovecot.conf? Should it automatically install the missing libs the moment you leave the editor? > End of gripe. I'll go find the required (but unused) packages and > install them, and hope that they don't drag in stall more (unused) crap. If you use --nodeps you'll end up with a broken system. -- Axel.Thimm at ATrpms.net

3 3