- dovecot - dovecot.org

[Dovecot] Dovecot Authentication to Windows Domain Controller
by Jagga Soorma 26 May '06

26 May '06

Hey Guys, I am trying to convince my co-workers to move from Exchange 2003 to a unix implementation of sendmai/dovecot. They have a couple of concerns that I am sure can be resolved. First, is there a way for dovecot running on a linux server to authenticate a user to a windows 2003 domain controller? If so, then where can I get information on how to implement and test this feature? Also, do you guys know of any calender software that can be used with this implementation as well? Where users can maybe share their meetings? Any comments or suggestions would be grately appreciated. Thanks in advance, -Jagga

4 3

[Dovecot] Missing Mailboxes
by Jim 25 May '06

25 May '06

I upgraded from Fedora 4 to 5, which took me from dovecot .99 to 1.x. When I started up Thunderbird, I could not see any mailboxes other than Inbox. I am using Maildir with postfix. I re-installed .99, and all the mailboxes are back. I looked at the wiki on Missing Mailboxes, but I am not sure what I have to fix, and I do not really want to re-install the 1.x version and mess around, as I will mess up a number of other people. Clearly, I am not an expert, so if anyone can can help, I will be most appreciative! Jim

3 2

[Dovecot] Bug / Problem - Dovecot and Thunderbird
by wc_fbsd＠xxiii.com 25 May '06

25 May '06

Greetings, I've been running Dovecot for a couple years now. Currently 1.0.b8 on FreeBSD i386. I just switched to Mozilla Thunderbird 1.5.0.2 (windows) for an IMAP client, and am having some problems that appear to be at least partially attributable to Dovecot. After configuring the IMAP account, TB fetched the list of folders on the server, but was displaying several folders that had been deleted from the server months ago. When I tried to access or delete the folders from TB, it produced an error message (imap command failed, or something similar.) Some other folders had been moved from the root to sub-folders -- they still showed in the root, but not the sub-folder, thus were inaccessible. I looked all through the client's config files, but couldn't find any reference to them. From a shell on the server, I also verified they did not exist. I discovered they were still referenced in the .subscribe file, and had index files in .imap on the server. I deleted those, restarted the server processes, and refreshed the folders in TB, and the problem was resolved. But required manual intervention on the server. Not sure if this is a bug or just client issue, but since those files are maintained by Dovecot, I'm inclined to say "bug". Disclaimer: I know next to nothing about the internals of IMAP! -Thanks, Wayne

2 1

[Dovecot] LDAP, sieve, and virtual users
by Tracy R Reed 25 May '06

25 May '06

This seems to be a common topic but I haven't seen anyone ask this exact question and get a decent answer: I use virtual mailboxes with all of the db's in LDAP. Last night I upgraded to the latest CVS version of dovecot and dovecot-lda and got global sieve filtering working by setting the global_script_path to a sieve like /home/vmail/mydomain/sieve and it works great. Now I need to figure out how to get per-user sieve filtering to work. I googled on this and found: http://www.dovecot.org/list/dovecot/2005-August/008568.html How do I tell dovecot where the "virtual home directory" is? Yes, I could use /home/vmail/mydomain/user as my virtual home directory (that is where I originally tried to put .dovecot.sieve but it did not seem to work) but I don't see how I can tell dovecot about it. I see that in deliver.c #define SIEVE_SCRIPT_PATH "~/.dovecot.sieve" we hard code SIEVE_SCRIPT_PATH with the home dir location. Am I going to have to replace this with some code that generates an appropriate path for my system or is there a better way? And while I am here: Has any thought been given to being able to pull sieve scripts from LDAP? At the moment sieve really does not buy me much because the end users still do not have any way to edit their sieve files on the server (no shells and can't code sieve's language) but it would be nice if I could create a web interface somewhere which could generate basic filters from templates and store their sieve filters in LDAP so I didn't have to deal with somehow writing to files in their virtual home dirs on the mail server. I have found old conversations such as: http://www.mhonarc.org/archive/html/ietf-mta-filters/1999-06/msg00000.html but do not see where any standard way of doing this has come about. Or really even any implementations at all of sieve stored in LDAP. Thanks! -- Tracy R Reed http://ultraviolet.org A: Because we read from top to bottom, left to right Q: Why should I start my reply below the quoted text

3 2

[Dovecot] LDA Problem
by Alexander Dreweke 25 May '06

25 May '06

Hi I'm having a problem with dovecot deliver. I'm using a dovecot version 1.0.beta8. As I am using a chrooted (/var/spool/postfix) postfix (version: 2.2.10) with cyrus-sasl authentification (all working). Postfix config is changed according to the http://wiki.dovecot.org/LDA: main.cf: mailbox_command = dovecot master.cf: dovecot unix - n n - - pipe flags=DRhu user=vmail:vmail argv=/usr/lib/dovecot/deliver -d ${recipient} I have adopted the dovecot.conf also according to http://wiki.dovecot.org/LDA but changed the auth_socket_path to point into the chroot of postfix. I have attached my dovecot.conf at the end of this email. The mails that are sent to the machine are not delivered at all. In the mail-logfile I can see the following error message for each mail that can't be deliverd: postfix/pipe[21344]: BC254154E5BD: to=<root>, orig_to=<root>, relay=dovecot, delay=0, status=bounced (user unknown) I've already search the net but could not find any clue how to solve this. Can anyone give me a hint what to do? cu Alexander dovecot.conf: =========================================================== protocols = imap imaps listen = localhost ssl_listen = * first_valid_uid = 1000 first_valid_gid = 1000 mail_extra_groups = mail mail_save_crlf = no default_mail_env = maildir:/var/mail/%u protocol imap { } protocol lda { postmaster_address = postmaster(a)domain.com auth_socket_path = /var/spool/postfix/var/run/dovecot-auth-master } log_timestamp = "%Y-%m-%d %H:%M:%S " ssl_disable = no ssl_cert_file = /etc/ssl/certs/executor.pem ssl_key_file = /etc/ssl/private/executor.key ssl_cipher_list = HIGH:MEDIUM auth default { mechanisms = plain passdb pam { } userdb passwd { } user = root socket listen { master { path = /var/spool/postfix/var/run/dovecot-auth-master mode = 0660 user = dovecot group = mail } client { path = /var/spool/postfix/var/run/dovecot-auth-client mode = 0660 user = dovecot group = mail } } } } ===========================================================

3 8

[Dovecot] Client workaround?
by David King 24 May '06

24 May '06

I have a phone (LG CU320) with a built-in IMAP client. However, it has some issues. For one, the phone crashes if there are greater than some-as-of-yet-determined-number-of folders. That can't be worked around at the server, but this one can: After a long session of staring at tcpdump, it appears that when it logs in it does so like this: a001 LOGIN "username" myPassword This works unless one has funny characters in their password (which is usually the case). Why on earth it would put quotes around the username and NOT the password is beyond me (which is more likely to have special characters?) It does seem to check the CAPABILITY line to see what authentication is supported, because if I try it with a different (cyrus) server, instead of using LOGIN to authenticate, it uses AUTHENTICATE Dovecot presents that it supports AUTH=PLAIN, whereas Cyrus presents that it supports AUTH=PLAIN AUTH=LOGIN AUTH=CRAM-MD5 AUTH=GSSAPI. This is presumably because Dovecot prefers STARTTLS or simple IMAPS for authentication. So as I see it, getting this phone work with Dovecot and a password with special characters can take one of two forms (either of which I'll be happy to code): 1. Somehow getting Dovecot to look at the second token as if it *were* quoted. 2. Getting Dovecot to present and interpret AUTH=LOGIN (i. e. AUTHENTICATE), which appears to cause the phone to properly escape the password The first one really only fixes certain special characters, and leaves others still broken (like quotes themselves), and in fact violates IMAP4rev1. So I'd just make and run a local patch The second one fixes the problem more cleanly, and my code can be reused and submitted to the Dovecot commiters. So my question to anyone familiar with the codebase is, which of these options is more likely to work, and would the Dovecot team be interested in patches for either one?

2 2

[Dovecot] Re: Apple Mail and too many open files?
by Roger Weeks 24 May '06

24 May '06

On May 24, 2006, at 10:29 AM, Les Mikesell wrote: > On Wed, 2006-05-24 at 11:51, Roger Weeks wrote: > >> If you're running filesharing of ANY kind on your mail server, you >> should stop it. Mail servers should run mail, not run AFP and Samba >> and other things. > > Why? A robust OS can do many things at once up to its resource > limits. Sure it can. But in my experience, it's bad practice, both in the enterprise and in the service provider world. When your box gets hit with a denial of service attack, or 500 users decide to copy the latest cool video to their home dir, and it's also your mail and web server, all of your services go to hell. When you have a box dedicated to specific services, you can upgrade that box without affecting all of your services. If the box dies, not all of your services die. -- Roger J. Weeks Systems & Network Administrator Mendocino Community Network

1 0

[Dovecot] Re: Apple Mail and too many open files?
by Roger Weeks 24 May '06

24 May '06

> Date: Wed, 24 May 2006 19:55:41 +1000 > From: Rob Middleton <robm-dovecot(a)centenary.org.au> > Subject: Re: [Dovecot] Apple Mail and too many open files? > To: Alan Schmitt <alan.schmitt(a)polytechnique.org> > Cc: Dovecot List Mailing <dovecot(a)dovecot.org> > > OS X is configured by default with these numbers way too low. OS X has > some really dumb processes like AFP that will chew through all of your > open files and not cope cleanly with running out of allowable/ > available > filehandles. If you're running filesharing of ANY kind on your mail server, you should stop it. Mail servers should run mail, not run AFP and Samba and other things. > OS X has a DoS vulnerability in the way ssh processes are spawned and > the ssh interaction with their PAM modules (it exhibits with the > symptoms you have described). Have you really got port 22 blocked from > the outside world?? Have you tested that? Consider running ssh on an > alternate port if running OS X server (as Apple's GUI config tools for > the firewall don't always allow you to block port 22). This is a very simple problem to fix, and doesn't require blocking port 22. Set up /etc/hosts.allow: sshd : 192.169.1.0/255.255.255.0 sshd-keygen-wrapper : 192.168.1.0/255.255.255.0 Set up /etc/hosts.deny: ALL: ALL:deny Tcpwrappers will now take care of you, and any DOS attacks you get will simply be dropped. > Do consider running your mail services off a machine that is not a Mac > OS X server. OS X server is merely OS X client/workstation with a > pretty > management utility for some 'nix services. It is not stable under high > load -- and it is not even stable under moderate load without numerous > performance tweaks (it doesn't cope at all well if the disk queue goes > up a touch or loadavg is at all interesting - ie it degrades poorly > under load). While some of this statement may be accurate, there's a lot of FUD here too. Both OS X and OS X server use the same kernel, it is true. However, these operating systems are fast and reliable. We ran our mail server for a couple of years on OS X with exim and courier-imap, and the only reason we did stop and move to Linux is because we needed a bigger solution and intel-based hardware was cheaper than a bunch of XServes. And I will challenge your statement about high load. We have two web servers that average betwen 5 and 10 mbits of constant web load, running on OS X Server and XServes. The average load on these boxes is something like 0.20. Roger Weeks

2 1

Fwd: Re[4]: [Dovecot] dovecot can't start!
by Oleg D. 24 May '06

24 May '06

Hello Chris, Wednesday, May 24, 2006, 8:36:00 PM, you wrote: CH> Quoting "Oleg D." <dzoleg(a)rsute.ru>: >> MB> Hmmm... I was seeing a problem rather like this with 1.0beta8 >> under Solaris >> MB> with Sun's compiler: only it was with the IMAP protocol rather than POP. >> >> MB> The problem there was an assumption Tio had made that everyone >> was using a >> MB> C99-compatible compiler. Apparently this handles some aspects of >> variable >> MB> initialisation differently from earlier C compilers. >> >> MB> In my case adding a command-line option to the C compiler to flip it into >> MB> C99 mode seemed to solve the problem. The option for our compiler was >> MB> "-xc99" -- however if your compiler has such an option it may have a >> MB> different name. If you check the manual page for your C compiler you may >> MB> find an equivalent option to try. >> >> MB> However another solution was provided by Timo in the form of a >> simple patch >> MB> that made changes to a couple of source files. I hope Timo doesn't mind: >> MB> I'm re-sending his patch as an attachment to this message as it is tiny. >> MB> You could try applying it and rebuilding Dovecot. >> >> MB> Cheers, >> MB> Mike Brudenell >> >> But I use FreeBSD 4.11-RELEASE-p15 with native compiler. >> Really nobody has this problem on freebsd? >> >> And the main - Why I can't start dovecot without SSL :) >> Why I see in log "pop3-login: BUG: SSL initialization parameters not >> given while they should have been" >> even if I have "ssl_disable = yes" in dovecot.conf >> 1.0b3 works fine. >> This problem is main for me >> because I don't want to use SSL. CH> I run FreeBSD here, and my hunch is that SSL (or some form) was CH> compiled it. Which would help explain the errors you describe. CH> What "knobs" did you use when you built it? Did you simply take CH> the default without examining the Makefile? My hunch is that if CH> you take a closer look at how it was built and installed; you'll CH> find some form of SSL/ encryption was built into it, and you'll CH> either have to: cd /usr/ports/mail/dovecot; make deinstall; CH> tweak the Makefile to your needs; make reinstall. Or figure out CH> how to utilize the security method that was built in by default. CH> Perhaps SASL2, or GSSAPI, as I see they're options in the Makefile. CH> Best wishes. I hope this helps. CH> --Chris H. I tried to add --without-ssl in port's Makefile and compile dovecot without ssl. But I have all the same seen "pop3-login: BUG: SSL initialization parameters not given while they should have been" When I have set "ssl_disable = no" I saw another error: "Error: SSL support not compiled in but ssl_disable=no" WITHOUT_KQUEUE=true WITHOUT_SASL2=true WITHOUT_GSSAPI=true WITHOUT_VPOPMAIL=true WITHOUT_LDAP=true WITHOUT_PGSQL=true WITH_MYSQL=true WITHOUT_SQLITE=true only mysql is enable -- Best regards, Oleg mailto:dzoleg@rsute.ru

1 0

Re[2]: Fwd: Re[2]: [Dovecot] dovecot can't start!
by Oleg D. 24 May '06

24 May '06

Hello Chris, Tuesday, May 23, 2006, 2:13:24 PM, you wrote: CW> Oleg D. wrote: >> >> >> BTW >> If I have enable SSL and set "protocols = pop3s" only >> I see "Fatal: Protocol pop3s given more than once" >> >> CW> That's odd. It looks like it's deducing you want POP3 from somewhere CW> else. Can you send us your dovecot.conf file, or output of "dovecot -n"? CW> Chris I set "protocols = pop3s" for testing vpn# dovecot -n protocols: pop3s disable_plaintext_auth: no verbose_ssl: yes login_dir: /var/run/dovecot/login login_executable: /usr/local/libexec/dovecot/pop3-login login_process_size: 64 verbose_proctitle: yes first_valid_gid: 0 mail_extra_groups: mail default_mail_env: mbox:/var/mail/%u mail_executable: /usr/local/libexec/dovecot/pop3 mail_plugin_dir: /usr/local/lib/dovecot/pop3 pop3_uidl_format: %08Xu%08Xv pop3_client_workarounds: outlook-no-nuls oe-ns-eoh auth default: mechanisms: plain login digest-md5 cram-md5 apop default_realm: xxxxx.xx verbose: yes debug: yes debug_passwords: yes passdb: driver: pam passdb: driver: sql args: /usr/local/etc/dovecot-sql.conf userdb: driver: passwd userdb: driver: sql args: /usr/local/etc/dovecot-sql.conf But I see "Fatal: Protocol pop3s given more than once" -- Best regards, Oleg mailto:dzoleg@rsute.ru

2 2