- dovecot - dovecot.org

Problem to configure dovecot-ldap.conf.ext
by Günther J. Niederwimmer 26 Oct '16

26 Oct '16

Hello, Dovecot 2.2.25 CentOS 7 I setup ldap (FreeIPA) to have a user for dovecot that can (read search compare) all attributes that I need for dovecot. I must also have mailAlternateAddress When I make a ldapsearch with this user, I found all I need to configure dovecot. But for me it is not possible to configure this correct ? I can make for user doveadm auth test office and doveadm auth test office(a)examle.com with success authentication but when I make a doveadm auth test info(a)example.co (mailAlternateAddress) I have a broken authentication Can any give me a hint what is wrong, or is this not possible ? # Space separated list of LDAP hosts to use. host:port is allowed too. #hosts = 192.168.100.204 192.168.100.214 #hosts = 192.168.100.204 hosts = ipa.example.com # LDAP URIs to use. You can use this instead of hosts list. Note that this # setting isn't supported by all LDAP libraries. #uris = ldap://ipa.example.com ldap://ipa1.example.com # Distinguished Name - the username used to login to the LDAP server. # Leave it commented out to bind anonymously (useful with auth_bind=yes). dn = uid=system,cn=sysaccounts,cn=etc,dc=example,dc=com # Password for LDAP server, if dn is specified. dnpass = 'XXXXXXXXXXXXXX' # Use SASL binding instead of the simple binding. Note that this changes # ldap_version automatically to be 3 if it's lower. Also note that SASL binds # and auth_bind=yes don't work together. sasl_bind = yes # SASL mechanism name to use. sasl_mech = gssapi # SASL realm to use. sasl_realm = EXAMPLE.COM # SASL authorization ID, ie. the dnpass is for this "master user", but the # dn is still the logged in user. Normally you want to keep this empty. sasl_authz_id = imap/mx01.example.com(a)EXAMPLE.COM # Use TLS to connect to the LDAP server. #tls = yes # TLS options, currently supported only with OpenLDAP: tls_ca_cert_file = /etc/ipa/ca.crt #tls_ca_cert_dir = #tls_cipher_suite = # TLS cert/key is used only if LDAP server requires a client certificate. #tls_cert_file = #tls_key_file = # Valid values: never, hard, demand, allow, try tls_require_cert = demand # Use the given ldaprc path. #ldaprc_path = # LDAP library debug level as specified by LDAP_DEBUG_* in ldap_log.h. # -1 = everything. You may need to recompile OpenLDAP with debugging enabled # to get enough output. #debug_level = 0 # Use authentication binding for verifying password's validity. This works by # logging into LDAP server using the username and password given by client. # The pass_filter is used to find the DN for the user. Note that the pass_attrs # is still used, only the password field is ignored in it. Before doing any # search, the binding is switched back to the default DN. auth_bind = yes # If authentication binding is used, you can save one LDAP request per login # if users' DN can be specified with a common template. The template can use # the standard %variables (see user_filter). Note that you can't # use any pass_attrs if you use this setting. # # If you use this setting, it's a good idea to use a different # dovecot-ldap.conf.ext for userdb (it can even be a symlink, just as long as # the filename is different in userdb's args). That way one connection is used # only for LDAP binds and another connection is used for user lookups. # Otherwise the binding is changed to the default DN before each user lookup. # # For example: # auth_bind_userdn = cn=%u,ou=people,o=org # auth_bind_userdn = uid=%n,cn=users,cn=accounts,dc=example,dc=com # LDAP protocol version to use. Likely 2 or 3. ldap_version = 3 # LDAP base. %variables can be used here. # For example: dc=mail, dc=example, dc=org base = cn=users,cn=accounts,dc=example,dc=com # Dereference: never, searching, finding, always #deref = never # Search scope: base, onelevel, subtree scope = subtree #scope = onelevel # User attributes are given in LDAP-name=dovecot-internal-name list. The # internal names are: # uid - System UID # gid - System GID # home - Home directory # mail - Mail location # # There are also other special fields which can be returned, see # http://wiki2.dovecot.org/UserDatabase/ExtraFields #user_attrs = homeDirectory=home,uidNumber=uid,gidNumber=gid user_attrs = uid=user,uid=home=/srv/vmail/%$,=uid=10000,=gid=10000 # Filter for user lookup. Some variables can be used (see # http://wiki2.dovecot.org/Variables for full list): # %u - username # %n - user part in user@domain, same as %u if there's no domain # %d - domain part in user@domain, empty if user there's no domain user_filter = (&(objectClass=mailrecipient)(|(uid=%Ln)(mail=%Lu) (mailAlternateAddress=%Lu))) # Password checking attributes: # user: Virtual user name (user@domain), if you wish to change the # user-given username to something else # password: Password, may optionally start with {type}, eg. {crypt} # There are also other special fields which can be returned, see # http://wiki2.dovecot.org/PasswordDatabase/ExtraFields pass_attrs = uid=user,userPassword=password,mailAlternateAddress=user # If you wish to avoid two LDAP lookups (passdb + userdb), you can use # userdb prefetch instead of userdb ldap in dovecot.conf. In that case you'll # also have to include user_attrs in pass_attrs field prefixed with "userdb_" # string. For example: #pass_attrs = uid=user,userPassword=password,\ # homeDirectory=userdb_home,uidNumber=userdb_uid,gidNumber=userdb_gid # Filter for password lookups #pass_filter = (&(objectClass=posixAccount)(uid=%u)) pass_filter = (&(objectClass=mailrecipient)(|(uid=%Ln)(mail=%Lu) (mailAlternateAddress=%Lu))) # Attributes and filter to get a list of all users iterate_attrs = uid=user, mailAlternateAddress=user iterate_filter = (objectClass=posixAccount) # Default password scheme. "{scheme}" before password overrides this. # List of supported schemes is in: http://wiki2.dovecot.org/Authentication #default_pass_scheme = CRYPT -- mit freundlichen Grüßen / best regards, Günther J. Niederwimmer

2 3

Re: keent() from Tika - with doveadm
by Aki Tuomi 25 Oct '16

25 Oct '16

Hi, can you run doveadm in gdb, wait for it to crash, and then go to frame 6 ( io_loop_handler_run_internal) and run p errno p ret p *ioloop p *ctx p *events Sorry but the crash doesn't make enough sense yet to me, we need to determine what the invalid parameter is. > Larry Rosenman http://www.lerctr.org/~ler > Phone: +1 214-642-9640 (c) E-Mail: larryrtx(a)gmail.com > US Mail: 17716 Limpia Crk, Round Rock, TX 78664-7281

2 9

Break up massive INBOX?
by mrobti＠insiberia.net 25 Oct '16

25 Oct '16

I have inherited a 10+ GB mailbox which dsync converted to maildir very nicely. But 15GB in tens of thousands of messages is too much in one INBOX when used in webmail. I guess it's best to divide the messages into subfolders for date. Is there a server-side way to safely move messages into new subfolders so that Dovecot indexes and UIDs won't break? If I write a shell script to move maildir files based on date of the files, I think Dovecot would not like this? Also, is there any way to automatically create delivery or archive folders by date eg., on the 1st of each month? And deliver mails to the subfolder for the current month? I know I can create Sieve rules for such by hand, but prefer if there is a plugin or something to do this automatically.

2 3

ssl_options missing no_ticket documentation in example config
by Christopher Head 25 Oct '16

25 Oct '16

Hello! I have a very minor bug to report. The ssl_options configuration directive takes a space-separated list of options, each of which must be in the set {“no_compression”, “no_ticket”}, according to the 2.2.25 source code. However, the file doc/example-config/conf.d/10-ssl.conf shipped in the tarball only mentions the “no_compression” option; it makes no mention of the “no_ticket” option. Oh, and by the way, the changelog <http://dovecot.org/doc/NEWS> linked from the download page is missing information for anything newer than 2.2.21. Please include me in replies; I am not subscribed to the list. -- Christopher Head

1 0

Hierarchy separator and LAYOUT=FS change
by Simeon Ott 25 Oct '16

25 Oct '16

Hello, I stumbled across a 5-year-old post on the dovecot list about changing the dovecot hierarchy separator to enable shared mailboxes (http://www.dovecot.org/list/dovecot/2011-January/056201.html <http://www.dovecot.org/list/dovecot/2011-January/056201.html>). At the moment I’m stuck in a pretty similar situation. Migrated from courier to dovecot 2 years ago and preserved the dot-separator. Because I’m using the e-mail adress as a username, the dots for folder separation and the dots in the email adresses getting messed up - I do have a pretty small mailserver with about 150 accounts. The Maildir filestructur of a typical mail account looks like this: drwx------ 2 vmail vmail 4096 Oct 10 20:02 cur drwx------ 5 vmail vmail 4096 Oct 3 07:48 .Daten.Administration drwx------ 5 vmail vmail 4096 Oct 3 09:51 .Daten.Anfragen, Werbung drwx------ 5 vmail vmail 4096 Oct 3 08:02 .Daten drwx------ 5 vmail vmail 4096 Oct 6 09:57 .Daten.Intern drwx------ 5 vmail vmail 4096 Oct 3 08:03 .Daten.Intern.Fahrzeuge drwx------ 5 vmail vmail 4096 Oct 6 12:57 .Daten.Intern.Infos, FileMaker etc drwx------ 5 vmail vmail 4096 Oct 3 09:19 .Daten.Intern.Sonstiges drwx------ 5 vmail vmail 4096 Oct 3 07:47 .Daten.Kunden drwx------ 5 vmail vmail 4096 Sep 16 08:29 .Daten.Lieferanten drwx------ 5 vmail vmail 4096 Oct 3 08:28 .Daten.Marketing drwx------ 2 vmail vmail 4096 Oct 10 20:02 new drwx------ 5 vmail vmail 4096 Oct 10 18:00 .Sent drwx------ 5 vmail vmail 4096 Oct 10 18:00 .Spam drwx------ 5 vmail vmail 4096 Oct 10 18:00 .Trash When changing the separator in my inbox namespace the documentation mentions that the filestructur doesn’t change. This means I will get the same problems when using shared boxes with email adresses as usernames. I definitly need to change to maildir:~/Maildir:LAYOUT=fs When changing to LAYOUT=fs i need to convert all the mailboxes manually, is that correct? Is dsync is the way to go? Or is it better to leave the separator and change to a different username schema (without dots in it) and advise the clients to change their credentials? I know there are people out there who successfully converted this - but I can’f find that many information about this subject. doveconf -n: # 2.1.7: /etc/dovecot/dovecot.conf # OS: Linux 3.2.0-4-amd64 x86_64 Debian 7.11 auth_mechanisms = plain login auth_verbose = yes lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes listen = * login_log_format_elements = user=<%u> method=%m rip=%r lip=%l mpid=%e %c mail_gid = 5000 mail_location = maildir:~/Maildir mail_plugins = zlib quota acl mail_uid = 5000 managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave namespace inbox { inbox = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Spam { auto = subscribe special_use = \Junk } mailbox Trash { auto = subscribe special_use = \Trash } prefix = INBOX. separator = . } passdb { args = /etc/dovecot/dovecot-ldap.conf driver = ldap } plugin { acl = vfile acl_shared_dict = file:/var/spool/postfix/virtual/shared-mailboxes quota = maildir:User quota quota_exceeded_message = 4.2.2 Mailbox full quota_rule = *:storage=1G quota_rule2 = INBOX.Trash:storage=+100M quota_rule3 = INBOX.Spam:ignore quota_warning = storage=95%% quota-warning 95 %u sieve = ~/.dovecot.sieve sieve_before = /var/lib/dovecot/sieve/default.sieve sieve_dir = ~/sieve sieve_max_actions = 32 sieve_max_redirects = 4 sieve_max_script_size = 1M sieve_quota_max_scripts = 0 sieve_quota_max_storage = 0 } protocols = " imap lmtp sieve pop3" service auth { group = dovecot unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } unix_listener auth-master { group = vmail mode = 0660 user = vmail } user = dovecot } service lmtp { unix_listener lmtp { mode = 0666 } } service managesieve-login { inet_listener sieve { port = 4190 } inet_listener sieve_deprecated { port = 2000 } process_min_avail = 1 service_count = 1 vsz_limit = 64 M } ssl_cert = </etc/ssl/private/startssl-onnet.ch <http://startssl-onnet.ch/>-chain.crt ssl_cipher_list = ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA:AES256-SHA:DHE-RSA-CAMELLIA128-SHA:DHE-RSA-CAMELLIA256-SHA:CAMELLIA128-SHA:CAMELLIA256-SHA:ECDHE-RSA-DES-CBC3-SHA:DES-CBC3-SHA:!SSLv2 ssl_key = </etc/ssl/private/startssl-onnet.ch.key userdb { args = /etc/dovecot/dovecot-ldap.conf driver = ldap } protocol lmtp { mail_plugins = zlib quota acl sieve } protocol lda { auth_socket_path = /var/run/dovecot/auth-master deliver_log_format = msgid=%m: %$ mail_plugins = zlib quota acl sieve postmaster_address = postmaster(a)onnet.ch <mailto:postmaster@onnet.ch> } protocol imap { mail_plugins = zlib quota acl imap_quota imap_acl } protocol sieve { info_log_path = /var/log/sieve.log log_path = /var/log/sieve.log mail_max_userip_connections = 10 managesieve_implementation_string = Dovecot Pigeonhole managesieve_logout_format = bytes=%i/%o managesieve_max_compile_errors = 5 managesieve_max_line_length = 65536 } … parts of the ldap config user_attrs = homeDirectory=home=/var/spool/postfix/virtual/%$,uidNumber=uid,gidNumber=gid,quota=quota_rule=*:bytes=%$ user_filter = (&(objectClass=CourierMailAccount)(mail=%u)) … my shared configuration is currently commented out. # namespace { # type = shared # separator = . # prefix = shared.%%u. # location = maildir:%h/Maildir:INDEX=~/Maildir/shared/%%u # subscriptions = yes # list = children #} thanks in advance for any help Sincerely, Simeon - onnet.ch <http://onnet.ch/>

1 1

Re: keent() from Tika - with doveadm
by larryrtx 23 Oct '16

23 Oct '16

Any news Ali? Sent from my Sprint Samsung Galaxy S7. -------- Original message --------From: Larry Rosenman <larryrtx(a)gmail.com> Date: 10/21/16 12:27 PM (GMT-06:00) To: Aki Tuomi <aki.tuomi(a)dovecot.fi> Cc: Dovecot Mailing List <dovecot(a)dovecot.org> Subject: Re: keent() from Tika - with doveadm Unfortuantely it doesn't seem to log that, and it's not 100% consistent. I did catch one, but the log file is huge so it's at: http://www.lerctr.org/~ler/Dovecot/doveadm0-tika On Fri, Oct 21, 2016 at 12:17 PM, Aki Tuomi <aki.tuomi(a)dovecot.fi> wrote: > On October 21, 2016 at 8:06 PM Larry Rosenman <larryrtx(a)gmail.com> wrote: > > > getting the following: > > Oct 21, 2016 12:04:25 PM org.apache.tika.server.resource.TikaResource > logRequest > INFO: tika/ > (application/vnd.openxmlformats-officedocument.wordprocessingml.document) > doveadm(ctr): Debug: http-client: conn 127.0.0.1:9998 [1]: Got 200 response > for request [Req69: PUT http://localhost:9998/tika/] (took 91 ms + 210 ms > in queue) > doveadm(ctr): Panic: kevent(): Invalid argument > Abort trap (core dumped) > > if I turn off tika, I do NOt get it. > > 2.2.26-RC1 > > what else do you need? > > > -- > Larry Rosenman http://www.lerctr.org/~ler > Phone: +1 214-642-9640 (c) E-Mail: larryrtx(a)gmail.com > US Mail: 17716 Limpia Crk, Round Rock, TX 78664-7281 Any hope for exact request? Aki Tuomi Dovecot oy -- Larry Rosenman http://www.lerctr.org/~ler Phone: +1 214-642-9640 (c) E-Mail: larryrtx(a)gmail.com US Mail: 17716 Limpia Crk, Round Rock, TX 78664-7281

3 6

Messed up dovecot mail store, need some repair advice
by Gerben Wierda 22 Oct '16

22 Oct '16

Hello folks, I have an older dovecot 2.0 (which I will migrate to a 2.2 asap, but at this point in time I need a fix). This is a dovecot 2.0 that came with Mac OS X 10.8.5 Server 2.2.5. Today, my spam/virus filtering (clamav) on the Server broke down. As a result, all my meesages got the ***UNCHECKED*** tag added to each subject. That was clearly unacceptable. SO, for the tim ebeing I have set that tag to undef so the tag is no longer added. But I also wanted to repair the messages that already ended up in dovecot 2.0 So, I did something simple: stopped all mail services on the server, went into the dovecot mail store and edited the messages. I first tried with one small ccount and it seemed OK. But now my mail client is experiencing problems with the messages (cannot display) and I think I've been to simplistic. I have for instance notedthat th esizeof the message is part of the filename. So, I can change these of course, but probably I need to change more. Can someone enlighten me how I can repair the broken data store? Thanks, (Foolish) Gerben

2 3

More informations in doveadm proxy ring status
by Peer Heinlein 22 Oct '16

22 Oct '16

I would love to have a) the number of active users b) the number of active TCP sessions (pop3, imap, lmtp, sieve, doveadm) included in the output of "doveadm director ring status". This would be helpful to get a good overview over load and usage of the whole director ring and would help to plan downtimes and maintenance work. Peer -- Heinlein Support GmbH Schwedter Str. 8/9b, 10119 Berlin http://www.heinlein-support.de Tel: 030 / 405051-42 Fax: 030 / 405051-19 Zwangsangaben lt. §35a GmbHG: HRB 93818 B / Amtsgericht Berlin-Charlottenburg, Geschäftsführer: Peer Heinlein -- Sitz: Berlin

2 1

MFA 2FA TOTP razz-ma-tazz!
by WJCarpenter 22 Oct '16

22 Oct '16

I'd like to start offering my server's users multi-factor authentication. Right now, I funnel all authentication through dovecot. Before I get too far down the fantasy design path, I'm wondering if anyone else has already done this and could share some details or code. (I loaded up the subject line with acronyms to show how serious I am. :-)) I am specifically thinking of two-factor authentication using TOTP (time-based one-time passwords) as described in RFC-6238. Those are the ones compatible with Google Authenticator and compatible apps. I already am a user of those at several sites. Some of them don't have a separate opportunity to enter the 6-digit code. Instead, you append the 6-digit code to your normal password. If your config on the site shows you as a user of TOTP, they peel those trailing 6 digits off your password and then validate the rest of the password in the normal way. That is what I think I would do for dovecot authentication. So, who's already done this or something like it?

1 0

Dovecot does not close connections
by Benedikt Carda 22 Oct '16

22 Oct '16

Hello, I am running into this error: /Maximum number of connections from user+IP exceeded (mail_max_userip_connections=10)/ The suggested solution in hundreds of support requests on this mailing list and throughout the internet is to increase the number of maximum userip connections. But this is not curing the problem, it is just postponing it to the moment when the new limit is reached. When i type: /doveadm who// / I can see that some accounts have several pids running: /someaccount 10 imap (25396 25391 25386 25381 25374 7822 7817 5559 5543 5531) (xxx.xxx.xxx.xxx)/ Now when I check these pids with /ps aux/ I find out that the oldest pid (5531) has a lifetime of already over 12 hours. Anyway I know that the clients that initiated the connections are not connected anymore, so there is no way that there is a valid reason why this connection should still be open. Also I never had this problem before, it appeared some months ago. Does anybody know how to solve this? Thanks in advance, Benedikt.

3 4