- dovecot - dovecot.org

iPhone no longer authenticating
by Mark Foley 11 Dec '17

11 Dec '17

I've switched a user to being an active directory user. That user's email client authorizes just fine with dovecot using GSSAPI. However, now his iPhone won't authorize. In the dovecot log file I get: Dec 01 14:27:28 auth: Debug: client in: AUTH 1 PLAIN service=imap secured session=q4n3W0xfggBiZj9s lip=98.102.63.107 rip=98.102.63.108 lport=993 rport=49538 resp=AG1wcmVzcwBEaW5va3JvbndhbGw0NQ== (previous base64 data may contain sensitive data) Dec 01 14:27:32 auth-worker(5988): Debug: shadow(mpress,98.102.xx.yyy): lookup Dec 01 14:27:32 auth-worker(5988): Info: shadow(mpress,98.102.xx.yyy): unknown user (given password: *******) Dec 01 14:27:34 auth: Debug: client passdb out: FAIL 1 user=mpress Dec 01 14:27:34 imap-login: Info: Aborted login (auth failed, 1 attempts in 6 secs): user=<mpress>, method=PLAIN, rip=98.102.xx.yyy, lip=98.102.63.107, TLS, session=<q4n3W0xfggBiZj9s> Dec 01 14:27:34 imap-login: Debug: SSL alert: close notify [98.102.xx.yyy] This same user will authenticate OK from his local domain workstation: Dec 01 14:28:52 auth: Debug: master userdb out: USER 1948516353 mpress system_groups_user=HPRS\mpress uid=10005gid=10000 home=/home/HPRS/mpress auth_token=ce3050035718ed0996af698400c4de1be453ec06 auth_user=mpress(a)HPRS.LOCAL Dec 01 14:28:52 imap-login: Info: Login: user=<mpress>, method=GSSAPI, rip=192.168.0.54, lip=192.168.0.2, mpid=9755, TLS, session=<6MT1YExftwDAqAA2> I'm pretty sure the reason has to do with Active Directory authenication locally, but of course his iPhone is not a member of the domain, and he is no longer in /etc/passwd/shadow. So, what is the best way to get the iPhone to authenticate? Here's my current config: > doveconf -n # 2.2.15: /usr/local/etc/dovecot/dovecot.conf # OS: Linux 4.4.88 x86_64 Slackware 14.2 auth_debug = yes auth_debug_passwords = yes auth_gssapi_hostname = $ALL auth_krb5_keytab = /etc/dovecot/dovecot.keytab auth_mechanisms = plain login gssapi auth_use_winbind = yes auth_username_format = %n auth_verbose = yes auth_verbose_passwords = plain disable_plaintext_auth = no info_log_path = /var/log/dovecot_info mail_location = maildir:~/Maildir passdb { driver = shadow } protocols = imap ssl_cert = </etc/ssl/certs/OHPRS/GoDaddy/Apache/2016-08-10/54e789087d419b6e.crt ssl_key = </etc/ssl/certs/OHPRS/GoDaddy/mail.ohprs.org.key userdb { driver = passwd } verbose_ssl = yes Thanks, --Mark

2 2

Doveadm backup error.
by Dovecot list 10 Dec '17

10 Dec '17

Hello. I try to migrate dovecot 1 to dovecot 2 with doveadm backup. But when i try to set doveadm backup i get : mx3:/root/dsync@[23:11] # doveadm -v -c ah.temp backup -R -u ah(a)test.pl <ahuryn(a)i-pi.pl> imapc: doveadm(ah(a)test.pl <ahuryn(a)i-pi.pl>): Error: Mail access for users with UID 145 not permitted (see first_valid_uid in config file, uid from userdb lookup). doveadm(ah(a)test.pl <ahuryn(a)i-pi.pl>): Error: User init failed mx3:/root/dsync@[22:13] # ls -la /home/mail/vhosts/test.pl/ah(a)test.pl/ <http://i-pi.pl/ahuryn@i-pi.pl/> total 1 drwxr-xr-x 2 vmail vmail 2 Nov 12 23:59 . mx3:/root/dsync@[22:14] # doveadm user ah(a)test.pl <ahuryn(a)i-pi.pl> field value uid 145 gid 145 home /home/mail/vhosts/test.pl/ah(a)test.pl <http://i-pi.pl/ahuryn@i-pi.pl> mail mdbox:~/mdbox quota_rule *:storage=50000M mx3:/root/dsync@[22:14] # id 145 uid=145(vmail) gid=145(vmail) groups=145(vmail) mx3:/root/dsync@[1:14] # doveconf -n | grep 145 first_valid_uid = 145 last_valid_uid = 145 I dont have any idea whats is the problem. Best regards.

2 3

Mail-crypt plugin clarification
by rje 10 Dec '17

10 Dec '17

I'm looking into ways to encrypt the stored email on my server. The idea is to make it impossible for my hosting provider (who has access to my VPS) to read the mail from the disk. So I'm looking into ways to do this, and I found the mail-crypt plugin for dovecot. Unfortunately I find the documentation very hard to understand. There is no clear description of what the goal and purpose of the plugin is, or how it works. Most of the documentation is very short and provides no explanation. So here are some questions - I will gladly help to update the documentation when some of these questions are answered :) If you cannot answer them all, please tell me what you know.. - It seems mail-cypt will transparently encrypt/decrypt mail - so it stores it on the server in encrypted form, but dovecot serves it unencrypted over IMAP. Is this correct? - It seems that mail-crypt needs both a private and a public key to work. Is this correct? - If mail-crypt has both private and public key in its configuration, does that not defeat the purpose of the whole thing? Anyone with access to the disk will be able to read everything? Regarding the settings: mail_crypt_global_private_key(_n) - Private key to decrypt files, you can specify many mail_crypt_global_public_key - Public key to use to encrypt files, you can specify one - How does this work? What does mail-crypt do when multiple private keys are specified? mail_crypt_private_key - Private key to decrypt user's master key, can be base64 encoded mail_crypt_private_password - Password to decrypt user's master key or environment private key - What is the relation between a users master key, and the private/public global keys above? What is an environment private key? TIA, and as I said above, I will help with updating the docs! -- Sent from: http://dovecot.2317879.n4.nabble.com/

1 0

Re: Use multiple mbox locations
by Joseph Tam 09 Dec '17

09 Dec '17

Steffen Kaiser > Hmm, this is a job for: > > https://wiki2.dovecot.org/Plugins/Snarf Cool! Can this be used with the imapc: driver to consolidate mail from separate IMAP accounts into one? (Sort of like how you can configure Gmail to slurp up mail into the Gmail account.) Joseph Tam <jtam.home(a)gmail.com>

1 0

Use multiple mbox locations
by bapt x 08 Dec '17

08 Dec '17

Hello, With GNU mailutils on Debian 9, we receive mails in /var/mail/<username> but when we read mails with the "mail" command, they are moved in a file ~/mbox: "Saved 1 message in /home/<username>/mbox". I use Roundcube webmail with Dovecot but if I also use use the "mail" command to read emails, Roundcube will not display old messages anymore since they were moved to ~/mbox. So is their a way to tell Dovecot that we want to lookup for emails both in /var/mail/<username> and ~/mbox? I saw https://wiki.dovecot.org/Namespaces#Mixed_mbox_and_Maildir but I it did not work if when I tried to add 2 times a mbox location. Thanks for your help.

2 1

Errors and dovecot crashing...
by SH Development 06 Dec '17

06 Dec '17

Our production dovecot/postfix server has been stable for a number of years. In the last month or so, we are seeing increasing errors such as these: Dec 6 15:51:20 mail dovecot: imap(redacted(a)lilythicket.com): Warning: Transaction log file /home/vmail/lilythicket.com/diana/Maildir/dovecot.index.log was locked for 322 seconds Dec 6 15:50:54 mail dovecot: imap(redacted(a)theormans.com): Warning: Maildir /home/vmail/theormans.com/connieorman/Maildir/.Junk: Synchronization took 66 seconds (1 new msgs, 0 flag change attempts, 0 expunge attempts) Dec 6 15:51:43 mail dovecot: master: Error: service(pop3-login): Initial status notification not received in 30 seconds, killing the process Dec 6 15:51:43 mail dovecot: master: Error: service(pop3-login): command startup failed, throttling Dec 6 15:51:43 mail dovecot: master: Error: service(imap-login): child 5868 killed with signal 9 Dec 6 15:51:43 mail dovecot: master: Error: service(imap-login): command startup failed, throttling Dec 6 15:55:31 mail dovecot: imap-login: Fatal: Corrupted SSL ssl-parameters.dat in state_dir: Truncated file Dec 6 15:55:32 mail dovecot: pop3-login: Fatal: Error reading configuration: Timeout reading config from /var/run/dovecot/config And so forth. Seems to be all over the place. The server slows down to a crawl. Restarting dovecot or postfix has no effect on the problem. Only a server reboot solves it, temporarily. Sometimes for weeks, sometimes for hours. The hard drive SMART status reads okay. During this time, of course, users cannot connect to check their email. Thoughts on where to go to troubleshoot this and why it’s happening? Ethon

1 0

Re: Howto authenticate smartPhone via Active Directory
by Mark Foley 06 Dec '17

06 Dec '17

On Tue, 5 Dec 2017 16:42:15 +0100 mj <lists(a)merit.unu.edu> wrote: > Hi, > > Not much time to reply now. > > On 12/05/2017 05:21 AM, Mark Foley wrote: > > mj - thanks! That the first useful example I've received from any forum/list. I'm getting ready > > to try my config (have to do so after hours), but I have some probably simple-minded questions: > > Well, that looks as if you are testing/trying out on your production > machine. Why not setup a seperate (virtual?) test server to play with..? > Use the same os version, with the same dovecot version. > Or clone your production machine, so you can test as much as you like, > without time pressure, at any given time. I've been playing with this ldap authentication for a couple of years off and on. Time isn't a problem. The issue with setting up a test environment is that I really need the domain workstations and external smartphone attempting to connect when I make a change so I can follow what's going on in the Dovecot log and maillog. It's rather simple to test a change, then put things back. I'll likely not go the test platform route for now, but thanks for the input. > > Your example is not the complete dovecot-ldap.conf.ext file, right? Have you just given me > > differences in your config from the "original"? You've kept the hosts, base, ldap_version, > > scope, deref, debug_level, and auth_bind_userdn settings in your config, right? > Not the complete file, no. I just provided the essentials. > [deleted] Ok, here's what I've come up with for dovecot-ldap.conf.ext hosts = mail.hprs.local base = dc=mail, dc=hprs, dc=local ldap_version = 3 scope = subtree deref = never debug_level = -1 auth_bind = yes auth_bind_userdn = %n@dom dn = cn=Administrator,cn=users,dc=hprs,dc=local dnpass = ******* user_filter = (&(objectclass=person)(sAMAccountName=%n)(!(userAccountControl=514))) pass_filter = (&(objectclass=person)(sAMAccountName=%n)(!(userAccountControl=514))) I've enabled auth-ldap.conf.ext in 10-auth.conf. My doveconf is listed at bottom. Unfortuntately, this doesn't work. My remote devices are not even showing as trying to connect. For internal domain LAN users I get: Dec 06 01:08:10 imap-login: Info: Disconnected: Auth process broken (disconnected before auth was ready, waited 30 secs): user=<>, rip=192.168.0.52, lip=192.168.0.2, session=<3/ZyxaVfE8PAqAA0> I do see ldap listening on 389, imap[s] (Dovecot) listening on 143 and 993, these last two are opened externally through the firewall. > For the rest: my advise is that you *really* need to pay around with > this much more. Get yourself a test environment, and play and test. > > Plus: read some dovecot/ad howto's, and try things in your own environment. > > Quick google returns: > https://www.howtoforge.com/postfix-dovecot-authentication-against-active-di… > I know my level of sophistication on this must sound like I've glibly posted a question hoping someone will do the work for me without my having to do any thinking myself, but believe me, I've been reading and experimenting with this for a very long time. I've got internal AD authentication working with GSSAPI and I've got a rather complex checkpassword program able to do authentication, so I don't think I'm a complete moron, although this project makes me feel that way. Now, I just want smartphones to authenticate with their owners' domain credentials and get them out of /etc/passwd. I believe I've read all the Dovecot wikis on ldap plus things from many other sites. I've been to that howtoforge site before. It mostly deals with setting up Postfix, which I'm not using. The dovecot bits make more sense in light of your feedback. I've tried that ldapsearch example: ldapsearch -x -h ad.example.com -D 'vmail' -W -b 'cn=users,dc=example,dc=com' with the domain user I specified in my dovecot-ldap.conf.ext with my host and dc info and I get the error ldap_bind: Strong(er) authentication required (8) additional info: BindSimple: Transport encryption required. I've seen confusing postings on this error having to do with port 636 and LDAPS -- no idea what they're talking about. My user is the Samba/domain administrator and has a pretty complex password. None of the sites I've visited on this error indicate it has anything to do with the actual password's complexity. Perhaps I'm just thick-skulled with all this. If you or anyone can see something obviously wrong with my conf, or have any suggestion at all on a baby step I can take to incm me forward, please let me know. Thanks, --Mark doveconf -n: # 2.2.33.2 (d6601f4ec): /usr/local/etc/dovecot/dovecot.conf # OS: Linux 4.4.88 x86_64 Slackware 14.2 auth_debug = yes auth_debug_passwords = yes auth_gssapi_hostname = $ALL auth_krb5_keytab = /etc/dovecot/dovecot.keytab auth_mechanisms = plain login gssapi auth_use_winbind = yes auth_username_format = %n auth_verbose = yes auth_verbose_passwords = plain disable_plaintext_auth = no info_log_path = /var/log/dovecot_info mail_location = maildir:~/Maildir passdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } passdb { driver = shadow } protocols = imap ssl_cert = </etc/ssl/certs/OHPRS/GoDaddy/Apache/2016-08-10/54e789087d419b6e.crt ssl_key = # hidden, use -P to show it userdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } userdb { driver = passwd } verbose_ssl = yes

2 1

Re: Disabling index files?
by Stroller 06 Dec '17

06 Dec '17

> On 5 Dec 2017, at 15:32, Gregory Finch <gfinch(a)ldmltd.ca> wrote: >> >> How do I disable the index files, please? >> … >> > > from https://wiki2.dovecot.org/MailLocation#Index_files > > add :INDEX=MEMORY to your mail_location line, ie: > > mail_location = maildir:~/Maildir:INDEX=MEMORY Many thanks! That works perfectly. Stroller.

1 0

Do we really need Solr commit as cronjob?
by Gao 06 Dec '17

06 Dec '17

I am testing Solr FTS on dovecot. Read online that some suggested to run cronjob commit every minute, and optimize once a day. I am using Solr 7.1.0 and I see some configurations: In /etc/default/solr.in.sh: #SOLR_OPTS="$SOLR_OPTS -Dsolr.autoSoftCommit.maxTime=3000" #SOLR_OPTS="$SOLR_OPTS -Dsolr.autoCommit.maxTime=60000" Also in solrconfig.xml: <autoCommit> <maxTime>${solr.autoCommit.maxTime:15000}</maxTime> <openSearcher>false</openSearcher> </autoCommit> <autoSoftCommit> <maxTime>${solr.autoSoftCommit.maxTime:-1}</maxTime> </autoSoftCommit> So my question is do I still need run cronjob for commit? Do I need uncomment these lines in the solr.in.sh? Does my solrconfig.xml overwrite the setting in solr.in.sh? Thanks for help.

2 1

Re: Howto authenticate smartPhone via Active Directory
by Aki Tuomi 05 Dec '17

05 Dec '17

with passdb ldap i guess. ---Aki TuomiDovecot oy -------- Original message --------From: Mark Foley <mfoley(a)ohprs.org> Date: 03/12/2017 21:18 (GMT+02:00) To: dovecot(a)dovecot.org Subject: Re: Howto authenticate smartPhone via Active Directory Yes, you are right. This link: https://www.redips.net/linux/android-email-postfix-auth/#section2 shows: passdb pam { } used for authenticating Android. Problem #1 is that Slackware does not ship with PAM and the AD/DC Samba4 does not use it. It is used on Slackware for a domain member, but I'm not sure I should try configuring PAM on the AD/DC. Is there some otherway I can get authentication using domain credentials besides pam? the phone can send user and password. --Mark -----Original Message----- > Date: Sun, 03 Dec 2017 15:22:56 +0200 > Subject: Re: Howto authenticate smartPhone via Active Directory > From: Aki Tuomi <aki.tuomi(a)dovecot.fi> > To: Mark Foley <mfoley(a)ohprs.org>, dovecot(a)dovecot.org > > Actually you are authenticating gssapi clients from ad and everyone else from shadow. maybe you need to configure pam module? > ---Aki TuomiDovecot oy > > -------- Original message -------- > From: Mark Foley <mfoley(a)ohprs.org> > Date: 03/12/2017 06:03 (GMT+02:00) > To: dovecot(a)dovecot.org > Subject: Howto authenticate smartPhone via Active Directory > I have a Samba4 Active Directory server. Dovecot authenticates AD Users with domain credentials > using GSSAPI (Thunderbird client). I believe I have Dovecot set to attempt authentication via > shadow first and. failing that, it does authenticate via GSSAPI. > > Smartphones connect to Dovecot via port 143 and SSL. They are not domain members so if the > shadow authentication fails, no other methods are tried and no connection is made. > > What can I do with my dovecot config to fix this? > > > doveconf -n > # 2.2.15: /usr/local/etc/dovecot/dovecot.conf > # OS: Linux 4.4.88 x86_64 Slackware 14.2 > auth_debug = yes > auth_debug_passwords = yes > auth_gssapi_hostname = $ALL > auth_krb5_keytab = /etc/dovecot/dovecot.keytab > auth_mechanisms = plain login gssapi > auth_use_winbind = yes > auth_username_format = %n > auth_verbose = yes > auth_verbose_passwords = plain > disable_plaintext_auth = no > info_log_path = /var/log/dovecot_info > mail_location = maildir:~/Maildir > passdb { > driver = shadow > } > protocols = imap > ssl_cert = </etc/ssl/certs/OHPRS/GoDaddy/Apache/2016-08-10/54e789087d419b6e.crt > ssl_key = </etc/ssl/certs/OHPRS/GoDaddy/mail.ohprs.org.key > userdb { > driver = passwd > } > verbose_ssl = yes > > Thanks, Mark

3 6