- dovecot - dovecot.org

Disabling index files?
by Stroller 05 Dec '17

05 Dec '17

The wiki says: > Each mailbox has its own separate index files. **If the index files are disabled**, the same structures are still kept in the memory, except cache file is disabled completely (because the client probably won't fetch the same data twice within a connection). [1] I tend to grep my maildirs quite often, and use the output to cp emails to other folders, so it's annoying when the dovecot.index.cache files show up in the results. How do I disable the index files, please? My mail server is hardly loaded, so I don't think it'll be a problem to keep the caching in memory. I can find `mailbox_list_index = no` in /etc/dovecot/conf.d/10-mail.conf but this seems to be enabled by default, and it makes no difference when I enable it explicitly - deleted dovecot.index.cache are recreated when Dovecot is restarted. The setting `mbox_min_index_size` tends to suggests it's only for mbox files, not maildirs? Thanks in advance for any help you can offer, Stroller. [1] https://wiki.dovecot.org/IndexFiles

4 3

Re: Recommended tool for migrating IMAP servers
by Joseph Tam 05 Dec '17

05 Dec '17

"Davide Marchi" <danjde(a)msw.it> writes: >> UW-IMAP's mailutil, imapsync, YippieMove and Larch. Whatever you use, *don't* use UW-IMAP's mailutil unless you got lots of time to kill. It is dreadfully slow -- I used it to export some of my users' mailboxes to Gmail or other remote mail servers, and I could almost cut&paste the messages faster. Like Aki said, if you have the same mailbox format and FS access on both sides, rsync is much simpler. You can also try exporting the old mailboxes via NFS, and with some artful symlinks, march through your user mailboxes replacing the symlinks with the instantiated local copies and have almost zero downtime. Joseph Tam <jtam.home(a)gmail.com>

4 3

Can passdb be bypassed for non-plaintext authentication mechanisms
by Mark Foley 05 Dec '17

05 Dec '17

I am using Active directory authentication via gssapi for most users. In dovecot.conf I have: auth_mechanisms = plain login gssapi auth_use_winbind = yes I also have passdb { driver = shadow } userdb { driver = passwd } for those few users who are NOT AD users. Even though the AD users do not exist in /etc/passwd or /etc/shadow, Dovecot ALWAYS first looks them up in shadow, which ALWAYS fails. The https://wiki2.dovecot.org/PasswordDatabase wiki says, "these databases can't be used with non-plaintext authentication mechanisms." Is there a way to bypass checking passdb (and userdb?) for these mechanism? --Mark

2 1

Re: Recommended tool for migrating IMAP servers
by Davide Marchi 05 Dec '17

05 Dec '17

[..] > Hi, > > I vouch for imapsync. Have used it in the past with quite a big amount > of > emails. > > cheers. > > x0p Ah, thanks x0! > Also if you have fs access on both servers, and you are using maildir, > plain rsync works just as well. > > Aki no, I've not fs access on both servers! :-/ > If you want to preserve IMAP UID:s and possibly also POP3 UIDL:s then > dovecot internal > dsync is the only tool that can do it. > > With every other tool you will face end users needing to invalidate > their local caches and > redownloading all headers if not also all mail bodies. > > Sami > Can I use this tool even if I do not know the other remote server typology? Many thanks to all!! Davide -- firma cosmogoniA <https://www.cosmogonia.org/> n o p r o v a r e n o f a r e o n o n f a r e n o n c e p r o v a r e

5 5

Re: Dovecot lmtp doesn't log
by Tomislav Perisic 04 Dec '17

04 Dec '17

Does anyone have any idea regarding this? On 17 Nov 2017 11:36, "Tomislav Perisic" <tomiperisic(a)gmail.com> wrote: Hi, We have 2 servers, server A and server B. Server A has: Postfix dovecot-2.2.33.2-1.el6.x86_64 Server B has: dovecot-2.2.33.2-1.el6.x86_64 dovecot-pigeonhole-2.2.33.2-1.el6.x86_64 Server A receives email on postfix, dovecot then takes that email from postfix and proxies it to Server B Dovecot. Dovecot on Server B takes the proxied email and delivers it with lmtp to the user inboxes. The problem is that the dovecot on server B Doesn't log anything regarding the emails that are being delivered to the mailbox via lmtp. Dovecot on server A logs everything perfectly regarding the proxy, so my assumption is that there is an issue with Dovecot lmtp logging. We changed the logging from syslog directly to a file and we noticed the same problem, missing log entries. We also tried turning on verbose logging and it didn't help. Server B: Red Hat 6.7 x86_64 rpm -qa | grep dove dovecot-2.2.33.2-1.el6.x86_64 dovecot-pigeonhole-2.2.33.2-1.el6.x86_64 doveconf -n # 2.2.33.2: /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.21 auth_cache_negative_ttl = 0 auth_debug = yes auth_debug_passwords = yes auth_verbose = yes listen = * mail_debug = yes mail_gid = mail mail_location = maildir:~/Maildir mail_plugins = " quota zlib" mail_uid = vmail managesieve_notify_capability = mailto namespace inbox { inbox = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Sent { auto = subscribe special_use = \Sent } mailbox Spam { auto = subscribe special_use = \Junk } mailbox Trash { auto = subscribe special_use = \Trash } mailbox Virus { auto = subscribe } plugin { quota = maildir:User quota sieve_extensions = +editheader sieve_max_actions = 32 sieve_max_redirects = 4 sieve_max_script_size = 1M sieve_quota_max_scripts = 0 sieve_trace_debug = yes sieve_trace_level = matching sieve_vacation_dont_check_recipient = yes sieve_vacation_send_from_recipient = yes sieve_vacation_use_original_recipient = yes zlib_save = gz zlib_save_level = 6 } protocols = imap pop3 lmtp sieve service auth { unix_listener auth-userdb { group = mail mode = 0666 user = vmail } } service lmtp { inet_listener lmtp { port = xx } } service managesieve-login { inet_listener sieve { port = xx } service_count = 1 } protocol lmtp { mail_plugins = " quota zlib sieve mail_log notify" } protocol imap { mail_plugins = " quota zlib imap_quota imap_zlib" } protocol sieve { managesieve_implementation_string = dovecot managesieve_logout_format = bytes ( in=%i : out=%o ) managesieve_max_line_length = 65536 managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave }

3 6

Re: Howto authenticate smartPhone via Active Directory
by Mark Foley 04 Dec '17

04 Dec '17

Yes, you are right. This link: https://www.redips.net/linux/android-email-postfix-auth/#section2 shows: passdb pam { } used for authenticating Android. Problem #1 is that Slackware does not ship with PAM and the AD/DC Samba4 does not use it. It is used on Slackware for a domain member, but I'm not sure I should try configuring PAM on the AD/DC. Is there some otherway I can get authentication using domain credentials besides pam? the phone can send user and password. --Mark -----Original Message----- > Date: Sun, 03 Dec 2017 15:22:56 +0200 > Subject: Re: Howto authenticate smartPhone via Active Directory > From: Aki Tuomi <aki.tuomi(a)dovecot.fi> > To: Mark Foley <mfoley(a)ohprs.org>, dovecot(a)dovecot.org > > Actually you are authenticating gssapi clients from ad and everyone else from shadow. maybe you need to configure pam module? > ---Aki TuomiDovecot oy > > -------- Original message -------- > From: Mark Foley <mfoley(a)ohprs.org> > Date: 03/12/2017 06:03 (GMT+02:00) > To: dovecot(a)dovecot.org > Subject: Howto authenticate smartPhone via Active Directory > I have a Samba4 Active Directory server. Dovecot authenticates AD Users with domain credentials > using GSSAPI (Thunderbird client). I believe I have Dovecot set to attempt authentication via > shadow first and. failing that, it does authenticate via GSSAPI. > > Smartphones connect to Dovecot via port 143 and SSL. They are not domain members so if the > shadow authentication fails, no other methods are tried and no connection is made. > > What can I do with my dovecot config to fix this? > > > doveconf -n > # 2.2.15: /usr/local/etc/dovecot/dovecot.conf > # OS: Linux 4.4.88 x86_64 Slackware 14.2 > auth_debug = yes > auth_debug_passwords = yes > auth_gssapi_hostname = $ALL > auth_krb5_keytab = /etc/dovecot/dovecot.keytab > auth_mechanisms = plain login gssapi > auth_use_winbind = yes > auth_username_format = %n > auth_verbose = yes > auth_verbose_passwords = plain > disable_plaintext_auth = no > info_log_path = /var/log/dovecot_info > mail_location = maildir:~/Maildir > passdb { > driver = shadow > } > protocols = imap > ssl_cert = </etc/ssl/certs/OHPRS/GoDaddy/Apache/2016-08-10/54e789087d419b6e.crt > ssl_key = </etc/ssl/certs/OHPRS/GoDaddy/mail.ohprs.org.key > userdb { > driver = passwd > } > verbose_ssl = yes > > Thanks, Mark

1 0

Upgrade to 2.2.32 from 2.2.15 failed
by Mark Foley 04 Dec '17

04 Dec '17

I have a problem. I have been running Dovecot 2.2.15 and I'd like to upgrade. My distro (Slackware) has dovecot 2.2.32 available. I downloaded and installed that, but it didn't work. No one was able to get messages from the dovecot server on their workstations. The following is the entire dovecot log file from startup to the last message generated. No more messages went into the logfile after line 76, even with clients trying to connect. The 174.233.134.88 IP is from an external user connecting from his iPhone. The normal successful message from this user are shown at bottom. I'm suspecting something to do with line 18 where is says "Auth process broken." If anyone has any insight I'd deeply appreciate it as I'd love to upgrade. THX -- Mark 1 Nov 24 19:22:24 master: Info: Dovecot v2.2.32 (dfbe293d4) starting up for imap (core dumps disabled) 2 Nov 24 19:22:24 ssl-params: Info: Generating SSL parameters 3 Nov 24 19:22:26 ssl-params: Info: SSL parameters regeneration completed 4 Nov 24 19:23:02 imap-login: Debug: SSL: where=0x10, ret=1: before/accept initialization [174.233.134.88] 5 Nov 24 19:23:02 imap-login: Debug: SSL: where=0x2001, ret=1: before/accept initialization [174.233.134.88] 6 Nov 24 19:23:02 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 read client hello A [174.233.134.88] 7 Nov 24 19:23:02 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write server hello A [174.233.134.88] 8 Nov 24 19:23:02 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write certificate A [174.233.134.88] 9 Nov 24 19:23:02 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write key exchange A [174.233.134.88] 10 Nov 24 19:23:02 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write server done A [174.233.134.88] 11 Nov 24 19:23:02 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 flush data [174.233.134.88] 12 Nov 24 19:23:02 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 read client certificate A [174.233.134.88] 13 Nov 24 19:23:02 imap-login: Debug: SSL: where=0x2002, ret=-1: SSLv3 read client key exchange A [174.233.134.88] 14 Nov 24 19:23:02 imap-login: Debug: SSL: where=0x2002, ret=-1: SSLv3 read client key exchange A [174.233.134.88] 15 Nov 24 19:23:02 auth: Debug: Loading modules from directory: /usr/lib64/dovecot/auth 16 Nov 24 19:23:02 auth: Debug: Module loaded: /usr/lib64/dovecot/auth/lib20_auth_var_expand_crypt.so 17 Nov 24 19:23:02 auth: Debug: Loading modules from directory: /usr/lib64/dovecot/auth 18 Nov 24 19:23:02 imap-login: Info: Disconnected: Auth process broken (disconnected before auth was ready, waited 0 secs): user=<>, rip=174.233.134.88, lip=98.102.63.107, TLS handshaking, session=<idAcrMNe8xqu6YZY> 19 Nov 24 19:23:02 imap-login: Debug: SSL: where=0x10, ret=1: before/accept initialization [174.233.134.88] 20 Nov 24 19:23:02 imap-login: Debug: SSL: where=0x2001, ret=1: before/accept initialization [174.233.134.88] 21 Nov 24 19:23:02 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 read client hello A [174.233.134.88] 22 Nov 24 19:23:02 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write server hello A [174.233.134.88] 23 Nov 24 19:23:02 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write certificate A [174.233.134.88] 24 Nov 24 19:23:02 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write key exchange A [174.233.134.88] 25 Nov 24 19:23:02 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write server done A [174.233.134.88] 26 Nov 24 19:23:02 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 flush data [174.233.134.88] 27 Nov 24 19:23:02 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 read client certificate A [174.233.134.88] 28 Nov 24 19:23:02 imap-login: Debug: SSL: where=0x2002, ret=-1: SSLv3 read client key exchange A [174.233.134.88] 29 Nov 24 19:23:02 imap-login: Debug: SSL: where=0x2002, ret=-1: SSLv3 read client key exchange A [174.233.134.88] 30 Nov 24 19:23:02 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 read client key exchange A [174.233.134.88] 31 Nov 24 19:23:02 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 read certificate verify A [174.233.134.88] 32 Nov 24 19:23:02 imap-login: Debug: SSL: where=0x2002, ret=-1: SSLv3 read finished A [174.233.134.88] 33 Nov 24 19:23:03 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 read finished A [174.233.134.88] 34 Nov 24 19:23:03 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write change cipher spec A [174.233.134.88] 35 Nov 24 19:23:03 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write finished A [174.233.134.88] 36 Nov 24 19:23:03 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 flush data [174.233.134.88] 37 Nov 24 19:23:03 imap-login: Debug: SSL: where=0x20, ret=1: SSL negotiation finished successfully [174.233.134.88] 38 Nov 24 19:23:03 imap-login: Debug: SSL: where=0x2002, ret=1: SSL negotiation finished successfully [174.233.134.88] 39 Nov 24 19:23:04 auth: Debug: Loading modules from directory: /usr/lib64/dovecot/auth 40 Nov 24 19:23:04 auth: Debug: Module loaded: /usr/lib64/dovecot/auth/lib20_auth_var_expand_crypt.so 41 Nov 24 19:23:04 auth: Debug: Loading modules from directory: /usr/lib64/dovecot/auth 42 Nov 24 19:23:04 imap-login: Info: Disconnected: Auth process broken (disconnected before auth was ready, waited 2 secs): user=<>, rip=174.233.134.88, lip=98.102.63.107, TLS, session=<YGw7rMNe+Rqu6YZY> 43 Nov 24 19:23:04 imap-login: Debug: SSL alert: close notify [174.233.134.88] 44 Nov 24 19:23:05 imap-login: Debug: SSL: where=0x10, ret=1: before/accept initialization [174.233.134.88] 45 Nov 24 19:23:05 imap-login: Debug: SSL: where=0x2001, ret=1: before/accept initialization [174.233.134.88] 46 Nov 24 19:23:05 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 read client hello A [174.233.134.88] 47 Nov 24 19:23:05 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write server hello A [174.233.134.88] 48 Nov 24 19:23:05 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write certificate A [174.233.134.88] 49 Nov 24 19:23:05 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write key exchange A [174.233.134.88] 50 Nov 24 19:23:05 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write server done A [174.233.134.88] 51 Nov 24 19:23:05 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 flush data [174.233.134.88] 52 Nov 24 19:23:05 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 read client certificate A [174.233.134.88] 53 Nov 24 19:23:05 imap-login: Debug: SSL: where=0x2002, ret=-1: SSLv3 read client key exchange A [174.233.134.88] 54 Nov 24 19:23:05 imap-login: Debug: SSL: where=0x2002, ret=-1: SSLv3 read client key exchange A [174.233.134.88] 55 Nov 24 19:23:05 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 read client key exchange A [174.233.134.88] 56 Nov 24 19:23:05 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 read certificate verify A [174.233.134.88] 57 Nov 24 19:23:05 imap-login: Debug: SSL: where=0x2002, ret=-1: SSLv3 read finished A [174.233.134.88] 58 Nov 24 19:23:05 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 read finished A [174.233.134.88] 59 Nov 24 19:23:05 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write change cipher spec A [174.233.134.88] 60 Nov 24 19:23:05 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write finished A [174.233.134.88] 61 Nov 24 19:23:05 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 flush data [174.233.134.88] 62 Nov 24 19:23:05 imap-login: Debug: SSL: where=0x20, ret=1: SSL negotiation finished successfully [174.233.134.88] 63 Nov 24 19:23:05 imap-login: Debug: SSL: where=0x2002, ret=1: SSL negotiation finished successfully [174.233.134.88] 64 Nov 24 19:23:08 auth: Debug: Loading modules from directory: /usr/lib64/dovecot/auth 65 Nov 24 19:23:08 auth: Debug: Module loaded: /usr/lib64/dovecot/auth/lib20_auth_var_expand_crypt.so 66 Nov 24 19:23:08 auth: Debug: Loading modules from directory: /usr/lib64/dovecot/auth 67 Nov 24 19:23:08 imap-login: Info: Disconnected: Auth process broken (disconnected before auth was ready, waited 3 secs): user=<>, rip=174.233.134.88, lip=98.102.63.107, TLS, session=<7ZF4rMNe8hqu6YZY> 68 Nov 24 19:23:08 imap-login: Debug: SSL alert: close notify [174.233.134.88] 69 Nov 24 19:23:16 auth: Debug: Loading modules from directory: /usr/lib64/dovecot/auth 70 Nov 24 19:23:16 auth: Debug: Module loaded: /usr/lib64/dovecot/auth/lib20_auth_var_expand_crypt.so 71 Nov 24 19:23:16 auth: Debug: Loading modules from directory: /usr/lib64/dovecot/auth 72 Nov 24 19:23:16 imap-login: Info: Disconnected: Auth process broken (disconnected before auth was ready, waited 0 secs): user=<>, rip=192.168.0.54, lip=192.168.0.2, session=<6bbyrMNeGM/AqAA2> 73 Nov 24 19:24:13 auth: Debug: Loading modules from directory: /usr/lib64/dovecot/auth 74 Nov 24 19:24:13 auth: Debug: Module loaded: /usr/lib64/dovecot/auth/lib20_auth_var_expand_crypt.so 75 Nov 24 19:24:13 auth: Debug: Loading modules from directory: /usr/lib64/dovecot/auth 76 Nov 24 19:24:13 imap-login: Info: Disconnected: Auth process broken (disconnected before auth was ready, waited 0 secs): user=<>, rip=192.168.0.52, lip=192.168.0.2, session=<b75YsMNeb9nAqAA0> Normal OK messages from dovecot 2.2.15: Nov 24 23:50:49 imap-login: Debug: SSL: where=0x20, ret=1: SSL negotiation finished successfully [174.233.134.88] Nov 24 23:50:49 imap-login: Debug: SSL: where=0x2002, ret=1: SSL negotiation finished successfully [174.233.134.88] Nov 24 23:50:49 auth: Debug: client in: AUTH 1 PLAIN service=imap secured session=vQnEacde6QCu6YZY lip=98.102.63.107 rip=174.233.134.88 lport=993 rport=6889 resp=AG0udGhlbQAhbXRfMTAxOQ== (previous base64 data may contain sensitive data) Nov 24 23:50:49 auth-worker(17650): Debug: shadow(m.them,174.233.134.88): lookup Nov 24 23:50:49 auth: Debug: client passdb out: OK 1 user=m.them Finally, the 2.2.15 doveconf, which I used the same for 2.2.32: > doveconf -n # 2.2.15: /usr/local/etc/dovecot/dovecot.conf # OS: Linux 4.4.88 x86_64 Slackware 14.2 auth_debug = yes auth_debug_passwords = yes auth_gssapi_hostname = $ALL auth_krb5_keytab = /etc/dovecot/dovecot.keytab auth_mechanisms = plain login gssapi auth_use_winbind = yes auth_username_format = %n auth_verbose = yes auth_verbose_passwords = plain disable_plaintext_auth = no info_log_path = /var/log/dovecot_info mail_location = maildir:~/Maildir passdb { driver = shadow } protocols = imap ssl_cert = </etc/ssl/certs/OHPRS/GoDaddy/Apache/2016-08-10/54e789087d419b6e.crt ssl_key = </etc/ssl/certs/OHPRS/GoDaddy/mail.ohprs.org.key userdb { driver = passwd } verbose_ssl = yes

3 4

Dovecot (doveadm, ssl, sync) - SSL error
by Arkadiusz Majewski 04 Dec '17

04 Dec '17

Hello! I've got a problem to run syncing between both dovecot services on the separate servers. The error indicates to the problem with SSL. Directly using openssl command to connect from one server to other and vice versa is passed without any errors. OS: FreeBSD 11.1-RELEASE-p4 Dovecot: 2.2.33.2_2 and the older one dovecot-2.2.32.1_1 (or similar) - build by ports. OpenSSL: 1.0.2k-freebsd 26 Jan 2017 dovecot: doveadm(10.18.1.15): Error: doveadm client disconnected before handshake: SSL_accept() failed: error:140760FC:SSL routines:SSL23_GET_CLIENT_HELLO:unknown protocol dovecot.conf (on both servers): mail_plugins = $mail_plugins notify replication service replicator { process_min_avail = 1 } service aggregator { fifo_listener replication-notify-fifo { user = dovecot } unix_listener replication-notify { user = dovecot } } service replicator { unix_listener replicator-doveadm { mode = 0600 } } replication_max_conns = 10 service doveadm { inet_listener { port = 12130 ssl = yes } } ssl = required ssl_protocols = SSLv3 TLSv1 TLSv1.1 TLSv1.2 ssl_cert = </usr/local/etc/dovecot/ssl/cert.crt ssl_key = </usr/local/etc/dovecot/ssl/cert.key ssl_client_ca_file = </usr/local/etc/dovecot/ssl/ca.pem ssl_client_ca_dir = /usr/local/etc/dovecot/ssl Thank you in advance for any help. Kind Regards, Arkadiusz Majewski

1 0

doveadm with 2-level user/domain quotas scheme
by Max Kostikov 04 Dec '17

04 Dec '17

Hi! I believe now it a right time to return to previous discussion about Dovecot's in 2-level user/domain quotas scheme wich was finished here https://dovecot.org/pipermail/dovecot/2015-October/102346.html Here is configuration. 1. Dictionary storage placed in MySQL table "quota2" root@localhost [(none)]> SHOW COLUMNS FROM quota2 FROM exim; +----------+--------------+------+-----+---------+-------+ | Field | Type | Null | Key | Default | Extra | +----------+--------------+------+-----+---------+-------+ | username | varchar(100) | NO | PRI | NULL | | | bytes | bigint(20) | NO | | 0 | | | messages | int(11) | NO | | 0 | | +----------+--------------+------+-----+---------+-------+ 3 rows in set (0,00 sec) 2. Two types of quota - for domains with index "2" and for users without index. ... plugin { quota = dict:user_quota::proxy::sqluserquota quota_rule2 = Trash:storage=+10%% quota_rule3 = Junk:storage=+10%% quota_warning = storage=100%% quota-exceeded 100 %u quota_warning2 = storage=95%% quota-warning 95 %u quota_warning3 = storage=90%% quota-warning 90 %u quota_warning4 = storage=75%% quota-warning 75 %u quota2 = dict:domain_quota:%d:proxy::sqldomainquota } dict { sqluserquota = mysql:/usr/local/etc/dovecot/dovecot-dict-sql-user.conf sqldomainquota = mysql:/usr/local/etc/dovecot/dovecot-dict-sql-domain.conf } service dict { unix_listener dict { user = mailnull mode = 0660 } } ... 3. Both stored in the same table and files "dovecot-dict-sql-user.conf" and "dovecot-dict-sql-domain.conf" are identical. connect = host=localhost dbname=exim user=user password=password map { pattern = priv/quota/storage table = quota2 username_field = username value_field = bytes } map { pattern = priv/quota/messages table = quota2 username_field = username value_field = messages } All quotas for users and domains are calculates correctly until "doveadm quota recalc" use. root@beta:~ # doveadm quota recalc -u foo(a)my.domain root@beta:~ # doveadm quota get -u foo(a)my.domain Quota name Type Value Limit % user_quota STORAGE 7850978 - 0 user_quota MESSAGE 32474 - 0 domain_quota STORAGE 7850978 - 0 domain_quota MESSAGE 32474 - , 0 If we look at MySQL table directly foo(a)my.domain quota was counted right but last users data was copied into domains values. ... root@localhost [exim]> SELECT * FROM quota2 WHERE username LIKE '%my.domain'; +-------------------+-------------+----------+ | username | bytes | messages | +-------------------+-------------+----------+ | foo(a)my.domain | 8039401321 | 32474 | | my.domain | 8039401321 | 32474 | | john(a)my.domain | 3455382803 | 11142 | | mary(a)my.domain | 544637146 | 1965 | +-------------------+-------------+----------+ 4 rows in set (0.00 sec) ... Also you may see that "doveadm quota get" above gave wrong values. For domain its produces empty output root@beta:~ # doveadm quota get -u my.domain doveadm(my.domain): Error: User doesn't exist Quota name Type Value Limit % Than if we are trying to calculate quota for domain or for all users (-A) it produces an error. root@beta:~ # doveadm quota recalc -u my.domain doveadm(my.domain): Error: User doesn't exist root@beta:~ # doveadm quota recalc -A Error: User listing returned failure doveadm: Error: Failed to iterate through some users So "doveadm quota" almost useless for such quotas scheme except single user. I wrote small shell-script "dovequota.sh" to resolve this issue but I believe that doveadm need to be fixed too. (script may be found here https://kostikov.co/problemy-uchyota-domennoj-kvoty-v-dovecot-2) -- With best regards, Max Kostikov BBM: 24CA5DF8 | W: https://kostikov.co

1 0

Re: Howto authenticate smartPhone via Active Directory
by Aki Tuomi 03 Dec '17

03 Dec '17

Actually you are authenticating gssapi clients from ad and everyone else from shadow. maybe you need to configure pam module? ---Aki TuomiDovecot oy -------- Original message --------From: Mark Foley <mfoley(a)ohprs.org> Date: 03/12/2017 06:03 (GMT+02:00) To: dovecot(a)dovecot.org Subject: Howto authenticate smartPhone via Active Directory I have a Samba4 Active Directory server. Dovecot authenticates AD Users with domain credentials using GSSAPI (Thunderbird client). I believe I have Dovecot set to attempt authentication via shadow first and. failing that, it does authenticate via GSSAPI. Smartphones connect to Dovecot via port 143 and SSL. They are not domain members so if the shadow authentication fails, no other methods are tried and no connection is made. What can I do with my dovecot config to fix this? > doveconf -n # 2.2.15: /usr/local/etc/dovecot/dovecot.conf # OS: Linux 4.4.88 x86_64 Slackware 14.2 auth_debug = yes auth_debug_passwords = yes auth_gssapi_hostname = $ALL auth_krb5_keytab = /etc/dovecot/dovecot.keytab auth_mechanisms = plain login gssapi auth_use_winbind = yes auth_username_format = %n auth_verbose = yes auth_verbose_passwords = plain disable_plaintext_auth = no info_log_path = /var/log/dovecot_info mail_location = maildir:~/Maildir passdb { driver = shadow } protocols = imap ssl_cert = </etc/ssl/certs/OHPRS/GoDaddy/Apache/2016-08-10/54e789087d419b6e.crt ssl_key = </etc/ssl/certs/OHPRS/GoDaddy/mail.ohprs.org.key userdb { driver = passwd } verbose_ssl = yes Thanks, Mark

1 0