- dovecot - dovecot.org

[Dovecot] SSL and certificate authorities.
by James Tyson 20 Nov '03

20 Nov '03

Hi all. Usually for in-house use and SSL I would just generate a self-signed certificate because most clients either ignore it or only ask the first time the account is configured. In terms of offering the service to our customers is there any value of getting someone like thawte or instantssl to sign a certificate for imaps/pop3s/smtp? Also, is there a configuration directive for dovecot to add the issuers ca bundle similar to apache's SSLCACertificateFile? And thanks for writing such a kick-arse imap server. It blows courier out of the water! --- James Tyson Director, Giant Robot Ltd http://www.giantrobot.co.nz/

4 6

[Dovecot] patch and bug report (from an other in fact)
by DINH Viet Hoa 20 Nov '03

20 Nov '03

When messages marked \Recent are deleted and expunged, the patch now sends the new message count and the new recent messages count (although the message count is not really necessary). >From RFC 3501 errata (ftp://ftp.cac.washington.edu/imap/rfc3501-errata) << Section 6.4.3, page 49: old: The EXPUNGE command permanently removes all messages that have the \Deleted flag set from the currently selected mailbox. Before returning an OK to the client, an untagged EXPUNGE response is sent for each message that is removed. new: The EXPUNGE command permanently removes all messages that have the \Deleted flag set from the currently selected mailbox. Before returning an OK to the client, an untagged EXPUNGE response is sent for each message that is removed. Note that if any messages with the \Recent flag set are expunged, an untagged RECENT response is sent after the untagged EXPUNGE(s) to update the client's count of RECENT messages. >> The bug is that when we connect to the IMAP server through a command (ssh /usr/libexec/imap for example). \Recent flags are not removed when we have finish the access to the mailbox. (I have not yet investigated about that) Besides that, did you found a solution for the message parser ? (the bug in FETCH ENVELOPE that I noticed personnaly to Timo) -- DINH V. Hoa, "s/^\(\(\\.\|[^\[]\|\[\(\^.\|[^^]\)[^]]*\]\)*\)\(\\[^\*[]\)/\1\\\4/" -- Stéphane CHAZELAS

2 1

[Dovecot] run POP3S + IMAPS simultaneously?
by darren david 19 Nov '03

19 Nov '03

a quick one: is it possible to run POP3S and IMAPS services through dovecot at the same time? would i just uncomment both "login = imap" and "login = pop3" in /etc/dovecot.conf? or can i only run one at a time? apologies if the answer is obvious, i'm just still trying to wrap my head around all of this. thanks, darren david

2 2

[Dovecot] error msgs about missing ssl/tls support
by Kai Vehmanen 18 Nov '03

18 Nov '03

Hi, I've been just testing 0.99.10.2 and had a really hard time getting the new Dovecot to start properly. First I thought it was an error in my old dovecot.conf, but the actual problem turned out to be simply that Dovecot was compiled without SSL/TLS support (I hadn't noticed this), but dovecot.conf on the other hand specified SSL/TLS ports. The error messages might be a bit more informative in this case. Currently I only got this to my logs: --cut-- Nov 18 18:17:00 dovecot: Dovecot starting up Nov 18 18:17:01 imap-login: BUG: SSL initialization parameters not given while they should have been Nov 18 18:17:01 imap-login: BUG: SSL initialization parameters not given while they should have been Nov 18 18:17:01 pop3-login: BUG: SSL initialization parameters not given while they should have been Nov 18 18:17:01 imap-login: BUG: SSL initialization parameters not given while they should have been Nov 18 18:17:01 dovecot: Login process died too early - shutting down Nov 18 18:17:01 dovecot: child 18482 (login) returned error 89 Nov 18 18:17:01 dovecot: child 18481 (login) returned error 89 Nov 18 18:17:01 dovecot: child 18480 (login) returned error 89 Nov 18 18:17:01 dovecot: child 18479 (login) returned error 89 --cut-- ... and Dovecot would exit. Running Dovecot under gdb would just exit (even with -F), and segfault if ran under strace. So it took a while before I realized that configure had not even detected SSL/TLS... Oh well, not a big thing, but still something to keep in mind. -- http://www.eca.cx Audio software for Linux!

1 0

Re: [Dovecot] Problem with DIGEST-MD5 authentication and plainte xt passwords
by Matthew Reimer 18 Nov '03

18 Nov '03

Maikel Verheijen wrote: > For what it's worth: > > We use postgres userlookups, and use an older version of dovecot (an old > cvs version of around 0.99.9.1), and we DO use digest-md5 password > encryption in the database and realms. It seems to work flawlessly in > our situation, I used kmail, evolution, apple-mail, entourage, outlook, > outlook-express and mutt. > > > Have there been changes in the digest-md5 code since 0.99.9.1 ? > > > Kind regards, > > > Maikel Verheijen > Ladot Nederland BV. The problem is not with passwords that are stored in the db in digest-md5 format (i.e., as an md5 hash of user:realm:password), but with dovecot's password_generate() that takes the username and password and hashes it on the fly. Matt

2 1

Re: [Dovecot] Problem with DIGEST-MD5 authentication and plaintext passwords
by Matthew Reimer 18 Nov '03

18 Nov '03

Timo Sirainen wrote: > On Wed, 2003-11-12 at 03:09, Matthew Reimer wrote: > >>I wasn't able to get DIGEST-MD5 authentication working with passwords >>stored as plaintext until I tweaked password_generate() to make it not >>use the domain portion of user(a)domain.com as the realm. Both evolution >>and kmail send the email address as the username with no realm; when >>dovecot tries to convert the username to user + realm, the hash is >>different and so DIGEST-MD5 authentication fails. Having >>password_generate() hash user@domain.com::password instead of >>user:domain.com:password fixes it. I need this to work because I need to >>support all of PLAIN, CRAM-MD5, and DIGEST-MD5 at the same time. >> >>Timo, do you think this is a proper fix, or are kmail and evolution broken? > > > Well .. Looks like most clients don't actually use realms, but I rather > wouldn't completely drop support for them which your change would do. > > Correct fix would be to separate realm and "@domain" handling in code, > that should work with both cases. I'll see if I can get that done. Thanks Timo. Send me a patch when you're done and I'll test it. Matt

1 0

[Dovecot] Children, HasChildren
by Miquel van Smoorenburg 17 Nov '03

17 Nov '03

Hello, I'm using dovecot 0.99.10.2 on a debian box. Mailstore is maildir. If I list the IMAP hierarchy in mutt (debian, 1.5.4+20031024-1) it shows all my plain mailboxes as having subfolders - while none of them have. I straced mutt and this is the IMAP exchange (a bit reformatted for readability): write(6, "a0001 LSUB \"\" \"%\"\r\n", 19) = 19 read(3, " * LSUB () \".\" \"Drafts\" * LSUB () \".\" \"INBOX\" * LSUB () \".\" \"Sent\" * LSUB () \".\" \"Trash\" * LSUB (\\Noselect \\Children) \".\" \"broadband\" * LSUB (\\Noselect \\Children) \".\" \"cistron\" * LSUB (\\Noselect \\Children) \".\" \"debian\" * LSUB (\\Noselect \\Children) \".\" \"ip\" * LSUB (\\Noselect \\Children) \".\" \"lists\" * LSUB (\\Noselect \\Children) \".\" \"prive\" a0001 OK Lsub completed. ", 1024) = 374 Now this is strange - I read RFC3348 and shouldn't \\Children be \\HasChildren, also shouldn't the plain mailboxes (first four) be listed with \\HasNoChildren ? Mike.

2 3

[Dovecot] Corrupted index files
by Tomi Hakala 17 Nov '03

17 Nov '03

Hi, I'm playing with Dovecot in a lab environment and got it in state where it crashes on every incoming connection. I moved mail spool from ext2 file system to a ReiserFS on a another disk, mount point changed from /var/vmail to /spool/vmail. After that I managed to open mailbox and I moved about 2000 messages from INBOX to a subfolder. Then I tried to open mailbox with POP3 and it didn't succeed, from that point pop3d and imapd died every time I logged in until I removed all index files by hand. This is what I have in logs. imap-login: Nov 17 13:30:53 Info: Login: tomi.hakala(a)xx.fi [xx.xx.xx.xx] pop3-login: Nov 17 13:32:04 Info: Login: tomi.hakala(a)xx.fi [xx.xx.xx.xx] pop3(tomi.hakala(a)xx.fi): Nov 17 13:32:04 Error: Corrupted index file /spool/vmail/xx.fi/tomi.hakala(a)xx.fi/Maildir/.INBOX/.imap.index: Sequence 1848 not found from binary tree (5398 msgs says header) pop3-login: Nov 17 13:32:12 Info: Login: tomi.hakala(a)xx.fi [xx.xx.xx.xx] pop3(tomi.hakala(a)xx.fi): Nov 17 13:32:21 Error: Couldn't lock created modify log file /spool/vmail/xx.fi/tomi.hakala(a)xx.fi/Maildir/.INBOX/.imap.index.log imap(tomi.hakala(a)xx.fi): Nov 17 14:09:32 Error: IndexID mismatch for modify log file /spool/vmail/xx.fi/tomi.hakala(a)xx.fi/Maildir/.INBOX/.imap.index.log imap(tomi.hakala(a)xx.fi): Nov 17 14:09:33 Panic: file mail-tree-redblack.c: line 187 (rb_left_rotate): assertion failed: (node[x].right != RBNULL) dovecot: Nov 17 14:09:33 Error: child 19984 (imap) killed with signal 6 imap-login: Nov 17 14:27:24 Info: Login: tomi.hakala(a)xx.fi [xx.xx.xx.xx] imap(tomi.hakala(a)xx.fi): Nov 17 14:27:24 Panic: file mail-tree-redblack.c: line 232 (rb_right_rotate): assertion failed: (node[y].left != RBNULL) dovecot: Nov 17 14:27:24 Error: child 10478 (imap) killed with signal 6 -- Tomi Hakala

1 0

[Dovecot] Problem with DIGEST-MD5 authentication and plaintext passwords
by Matthew Reimer 17 Nov '03

17 Nov '03

I wasn't able to get DIGEST-MD5 authentication working with passwords stored as plaintext until I tweaked password_generate() to make it not use the domain portion of user(a)domain.com as the realm. Both evolution and kmail send the email address as the username with no realm; when dovecot tries to convert the username to user + realm, the hash is different and so DIGEST-MD5 authentication fails. Having password_generate() hash user@domain.com::password instead of user:domain.com:password fixes it. I need this to work because I need to support all of PLAIN, CRAM-MD5, and DIGEST-MD5 at the same time. Timo, do you think this is a proper fix, or are kmail and evolution broken? Matt

3 2

[Dovecot] MySQL patch + Debian
by James Tyson 17 Nov '03

17 Nov '03

Hi folks. Sorry to post here about a patch that hasn't been officially integrated into Dovecot, however I am trying to get it going and seem to have hit a dead end. I downloaded the Debianised source for Dovecot (0.99.10-9) from sarge: > wedge:/usr/local/src# apt-get -t testing source dovecot then applied the latest MySQL patch that I could find on the list: > wedge:/usr/local/src/dovecot-0.99.10# cat ../dovecot-mysql.patch | > patch -p 2 and manually fixed a merge issue with src/auth/master-connection.c, fiddled with the debian changelog to indicate the patch and then used dpkg-buildpackage -b to compile the package. Everything looked to build alright and I grepped the output to make sure that it compiled userdb-mysql.o and passdb-mysql.o into dovecot-auth. Problem is that dovecot-auth says "Unknown userdb type 'mysql'" and an ldd of /src/auth/dovecot-auth shows no libmysqlclient10: > wedge:/usr/local/src/dovecot-0.99.10# ldd src/auth/dovecot-auth > libpam.so.0 => /lib/libpam.so.0 (0x4001a000) > libldap.so.2 => /usr/lib/libldap.so.2 (0x40022000) > libpq.so.3 => /usr/lib/libpq.so.3 (0x4005a000) > libcrypt.so.1 => /lib/libcrypt.so.1 (0x4006e000) > libdl.so.2 => /lib/libdl.so.2 (0x4009c000) > libc.so.6 => /lib/libc.so.6 (0x4009f000) > liblber.so.2 => /usr/lib/liblber.so.2 (0x401cd000) > libresolv.so.2 => /lib/libresolv.so.2 (0x401da000) > libsasl2.so.2 => /usr/lib/libsasl2.so.2 (0x401ec000) > libgnutls.so.7 => /usr/lib/libgnutls.so.7 (0x401fe000) > libssl.so.0.9.7 => /usr/lib/i686/cmov/libssl.so.0.9.7 > (0x40231000) > libcrypto.so.0.9.7 => /usr/lib/i686/cmov/libcrypto.so.0.9.7 > (0x40260000) > libkrb5.so.17 => /usr/lib/libkrb5.so.17 (0x40351000) > libnsl.so.1 => /lib/libnsl.so.1 (0x40387000) > /lib/ld-linux.so.2 => /lib/ld-linux.so.2 (0x40000000) > libtasn1.so.0 => /usr/lib/libtasn1.so.0 (0x4039c000) > libgcrypt.so.1 => /usr/lib/libgcrypt.so.1 (0x403aa000) > libz.so.1 => /usr/lib/libz.so.1 (0x403e8000) > libcom_err.so.1 => /usr/lib/libcom_err.so.1 (0x403f7000) > libkrb.so.1 => /usr/lib/libkrb.so.1 (0x403f9000) > libasn1.so.6 => /usr/lib/libasn1.so.6 (0x40415000) > libroken.so.16 => /usr/lib/libroken.so.16 (0x40435000) > libdb3.so.3 => /usr/lib/libdb3.so.3 (0x40445000) Anyone know what I'm missing? --- James Tyson Director, Giant Robot Ltd http://www.giantrobot.co.nz/

2 2