- dovecot - dovecot.org

[Dovecot] LDAP Auth problems with auth_bind=yes
by Rob Coward 18 Aug '06

18 Aug '06

Hi, I first posted this problem a day or two ago and have not seen any responses yet. To clarify my problem, I am authenticating virtual users against Active Directory on Win2k3, where their login id is their email address. I am using an almost identical setup to Suranga's below, however my initial bind user doesn't have access to the userPassword attribute, so I am using: auth_bind = yes This is working fine when users enter their correct email address & password, or if the email address is not found, however if a valid email address is given but the password is incorrect, it seems to kill something in the ldap_auth code as all further connections get a temporary authentication error at the client, and the following in /var/log/maillog: Aug 18 13:04:31 gm-ho-lin-06 dovecot: auth(default): client in: AUTH 1 PLAIN service=IMAP secured lip=::ffff:127.0.0.1 rip=::ffff:127.0.0.1 resp=ADA5OTlAc3RvcmVzLmdhbWUuY28udWsAOTk5MA== Aug 18 13:04:31 gm-ho-lin-06 dovecot: auth(default): ldap(0999@stores.game.co.uk,::ffff:127.0.0.1): bind search: base=OU=Stores,OU=UK,DC=group,DC=game,DC=net filter=(&(objectClass=user)(mail=0999(a)stores.game.co.uk)) Aug 18 13:04:31 gm-ho-lin-06 dovecot: auth(default): ldap(0999@stores.game.co.uk,::ffff:127.0.0.1): ldap_search() failed: Operations error Aug 18 13:04:31 gm-ho-lin-06 dovecot: auth(default): client out: FAIL 1 user=0999(a)stores.game.co.uk temp Aug 18 13:04:31 gm-ho-lin-06 dovecot: imap-login: Aborted login: user=<0999(a)stores.game.co.uk>, method=PLAIN, rip=::ffff:127.0.0.1, lip=::ffff:127.0.0.1, secured Is the auth_ldap code not resetting the ldap connection bind details to the dn/dnpass values for each login ? You help would be greatly appreciated as I hope to make this a production server within the next week. Regards, Rob Coward Unix Developer GAME STORES GROUP LTD Tel: 01256 784476 Email: Rob.Coward(a)game.net -----Original Message----- From: dovecot-bounces(a)dovecot.org [mailto:dovecot-bounces@dovecot.org] On Behalf Of suranga de silva Sent: 18 August 2006 19:14 To: dovecot(a)dovecot.org Subject: Re: [Dovecot] dovecot Digest, Vol 40, Issue 65 Dear Tim Schafer, Take a look at my sample dovecot-ldap.conf hosts = localhost dn = cn=root,dc=ceylonlinux,dc=com dnpass = secret ldap_version = 3 base = dc=ceylonlinux,dc=com deref = never scope = subtree user_attrs = mail,homeDirectory=mailMessageStore,uidNumber=1003,gidNumber=1003 user_filter = (&(objectClass=user)(mail=%u)) pass_attrs = mail=user,userPassword=password pass_filter = (&(objectClass=user)(mail=%u)) default_pass_scheme = CRYPT user_global_uid = 1003 user_global_gid = 1003 Here I am using my own schema called "user", but in your case change it to inetOrgPerson or the schema name you are using. I think the most common problem in this process is the ldap filter. Above in my configuration user_filter and pass_filter are used as ldap filters for querying user name and password. There I am using mail attribute. gid and uid are belong to the user vmail. May be this explanation will help you to figure out your problem You can refer my article in the following link for further reference http://www.ceylonlinux.com/pdf/openldap_backsql_postfix_maildir_cl.pdf Cheers!!! Suranga De Silva. CTO CEYLON LINUX This e-mail and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this e-mail in error please notify the system manager at: mailto:postmaster@game.net The recipient acknowledges that the transmissions made via the Internet can be corrupted and therefore THE GAME GROUP PLC and any of its subsidiaries do not give any warranty as to the quality or accuracy of any information contained in the message or assume any liability for it or for its transmission, reception or storage. This footnote also confirms that this e-mail message has been swept by anti-virus software for the presence of computer viruses. http://www.game.co.uk http://www.gamegroup.plc.uk

1 0

[Dovecot] How to change passwords on LDAP Server?
by Luis Motta Campos 18 Aug '06

18 Aug '06

Dear List People Someone here could please send me some advice on changin' LDAP passwords? It seems that everything is working nice, except by dovecot: I can send emails using my new LDAP password trought postfix smtp authentication, I can login to my Intranet website and to the Mod-LDAP protected pages on my company. I just can't POP my mail messages, because Dovecot says "dovecot-auth: ldap(user(a)company.net): password mismatch". I guess this is because I'm incorrectly coding the password. Please help me to figure out the right way to crypt the password so Dovecot can read this from the LDAP. *Extra* *Information:* I made a simpler and smaller test version of the program that I use to change passwords, its attached to the email. The essentials are there. *Versions:* My dovecot is a Debian/Sarge (Stable) 3.1 package. I'm also using Perl, Net::LDAP, Apache with Mod_Perl and OpenLDAP. Everything on linux, of course. Package Version ---- ---- dovecot-common 0.99.14-1sarge0 dovecot-imapd 0.99.14-1sarge0 dovecot-pop3d 0.99.14-1sarge0 perl 5.8.4-8sarge4 libnet-ldap-perl 0.3202-3 apache-perl 1.3.33-6sarge2 slapd 2.2.23-8 kernel-image-2.4.2 2.4.27-10sarge1 Any help, suggestion or comment are welcome. Thank you all in advance. -- Luis Motta Campos Segula Technologies Portugal http://www.segula.pt/ #!/usr/bin/perl use strict; use warnings; use Net::LDAP; use Carp qw( croak ); # Connects to server my $ldap = new Net::LDAP( 'localhost' ) or croak $@; my $message = $ldap->bind( 'uid=user,ou=People,dc=company,dc=com', password => 'secret' ); croak $message->error if $message->is_error; # Locate user $message = $ldap->search( base => 'ou=People, dc=company, dc=com', filter => 'uid=user', scope => 'one' ); croak $message->error if $message->is_error; my $entry = $message->entry(0); croak 'Nobody found!?!' unless $entry; # Replace password. $entry->replace( userPassword => '{CRYPT}'. crypt( 'secret', join( '', ('.', '/', 0..9, 'A'..'Z', 'a'..'z')[rand 64, rand 64] ) ) ); $message = $entry->update( $ldap ); croak $message->error if $message->is_error; # Report results. print q{User password changed to: "}.$entry->get_value( 'userPassword' ).qq{".\n};

1 0

[Dovecot] OT: best way to move maildirs to another host ?
by Brice Figureau 18 Aug '06

18 Aug '06

Hi, I'm sorry because this mail is a little bit off-topic, but Timo's email titled "1.0RC7 Released" made me think about a possible issue for me. I have to move an old dovecot installation (1.0b2) from an i386 server to a new x86_64 server running latest available dovecot. My concern is about moving all my users' mail stored as maildir onto this new server. What would be the best way to do that ? >From Timo's comment on 32bits->64bits migration, I guess I'll have to move only the maildirs (and get rid of dovecot cache files), right ? Next, from what I remember about maildir, the message names usually contain the inode so that the file name is unique. If I strictly move the files, I can be sure that the moved files won't have the same inodes number as what is in the name. Should I care ? Or should I use something different than scp/rsync to perform the migration ? Thanks for your answers, Regards, -- Brice Figureau <brice+dovecot(a)daysofwonder.com>

3 3

[Dovecot] Dovecot 1.0RC7 on FreeBSD 6.1/i386
by Martin Jackson 18 Aug '06

18 Aug '06

Everything looks good here, with kqueue support. Thanks for all the hard work, Timo! Marty

1 0

Re: [Dovecot] 1.0 RC7 released
by Bill Boebel 18 Aug '06

18 Aug '06

On Thu, August 17, 2006 6:28 pm, Timo Sirainen <tss(a)iki.fi> said: > I think my v1.0 TODO list is: > > - avoid duplicate flag change notifications, or in case the message is > also expunged don't bother notifying its flag changes at all > (shouldn't be hard) > - HFS+ avoid-hardlinks patch? > - 32bit -> 64bit upgrade still doesn't work without assert-crashing: > mail-cache-transaction.c: line 709 (mail_cache_add): assertion failed: > (fixed_size == (unsigned int)-1 || fixed_size == data_size) > - Courier-compatible INBOX. namespace gives "invalid namespace" errors What about this one? The "Connection queue full" issue doesn't appear to be entirely fixed. In fact the fix was disconnecting so frequently that I reverted to the non-fixed version: http://www.dovecot.org/list/dovecot/2006-August/015401.html Bill

1 0

[Dovecot] dovecot mbox to dovecot maildir migration
by Michael Blancas 18 Aug '06

18 Aug '06

Hi, I'm migrating accounts from one server with dovecot mbox and pam nss-ldap authentication to a new server with dovecot maildir and mysql auth (no posix accounts). My problem is the pop3 uidl format on the two servers are different, even though I'm using pop3_uidl_format = %08Xu%08Xv in both configs, I'm always re-downloading left messages on my test runs. Is there a way I could reuse the X-UID and X-IMAPbase headers on the converted mails. Issuing the UIDL command via pop3 always give a different result for the mbox and maildir spools. The X-UID and X-IMAPbase headers are present in the converted mails. The first number of X-IMAPbase maps to the mail UIDVALIDITY and the second is the same as X-UID, the mail uid. Thanks.

2 2

[Dovecot] Supporting local and virtual LDAP users, with seperate mail_env
by Tim Schafer 17 Aug '06

17 Aug '06

Is it possible to have local users with mail in maildir:%h/.maildir and virutal users with mail in maildir:/home/exim/%u/.maildir I seem to have authentication working for both local users and LDAP users. But I'm getting this error trying to access a virtual users mail. Aug 17 08:12:08 hostname dovecot: IMAP(Firstname Lastname): maildir: data=/HOME_DIRECTORY_USED_BUT_NOT_GIVEN_BY_USERDB/.maildir Aug 17 08:12:08 hostname dovecot: IMAP(Firstname Lastname): maildir: root=/HOME_DIRECTORY_USED_BUT_NOT_GIVEN_BY_USERDB/.maildir, index=/HOME_DIRECTORY_USED_BUT_NOT_GIVEN_B Y_USERDB/.maildir, control=, inbox= Aug 17 08:12:08 hostname dovecot: IMAP(Firstname Lastname): mkdir(/HOME_DIRECTORY_USED_BUT_NOT_GIVEN_BY_USERDB/.maildir/cur) failed: Permission denied -- Regards, Tim Schafer Information Technology Logistics Easier with Technology Freight Solution Providers direct 916-376-6190 10453 Old Placerville Road fax 916-376-6156 Sacramento, CA 95827 tim_schafer(a)shipfsp.com

4 7

[Dovecot] kqueue rewrite testing, try #3
by Timo Sirainen 17 Aug '06

17 Aug '06

So, apparently the original kqueue code was working fine after all, although it was much more complex than it really needed to be. So, this time there's a really simple and pretty kqueue implementation: http://dovecot.org/nightly/dovecot-latest.tar.gz Tested that it seems to work with FreeBSD.

3 2

[Dovecot] 1.0rc7 getting near
by Timo Sirainen 17 Aug '06

17 Aug '06

To avoid having some stupid new problems with 1.0rc7, could you test this night's snapshot once it arrives in a couple of hours: http://dovecot.org/nightly/dovecot-20060811.tar.gz Especially people who had compiling problems with 1.0rc6. Also everyone who are still experiencing hangs could you try the suggestions in this mail and tell me what happened: http://dovecot.org/list/dovecot/2006-August/015377.html

8 16

[Dovecot] BSD people, please test kqueue changes
by Timo Sirainen 17 Aug '06

17 Aug '06

I rewrote much of the kqueue code since the old code didn't handle properly the case when both input and output I/O handlers were added to the same file descriptor with different callbacks. This is done commonly in Dovecot, so I'm wondering why more people didn't complain about problems with it.. :) I don't anyway have access to any BSDs so the code is completely untested. Please test how it works before 1.0rc7 :) http://dovecot.org/nightly/dovecot-latest.tar.gz I'd guess the hangs caused by recent RC versions were because the default was to use notify=kqueue instead of notify=none. I changed this back to none unless --with-ioloop=kqueue is used. There are a couple of things in the code that I'm not completely sure of. The kqueue() manual page says that EV_ADD "modifies" the event if it already exists. What exactly does that mean? Does it mean that the filter is replaced, or that it's ORed into the existing one? The same question for the EV_DELETE, does it delete everything or only those filters given in parameters? The code currently assumes ORing and EV_DELETE deleting only the given filters, since this is what the original code also did. I suppose the data and udata parameters don't matter in EV_DELETE since they weren't given originally in ioloop-notify-kqueue.c either, so I left them that way.

9 20