- dovecot - dovecot.org

Password database extra fields and SQL
by Dave 29 Apr '16

29 Apr '16

Hi everyone, first post to the list, be gentle with me! Perhaps I'm missing something here, but it appears to me that many password database extra fields currently aren't much use inside SQL queries? All boolean fields like nologin/nodelay/nopassword are set if the column is present in the returned query, regardless of value (including NULL) For example, say you have a query like: password_query = SELECT hash AS password, NULLIF(active = 1, 'y') AS nologin FROM users WHERE name = '%u' Then nologin will always be set for this account, there's no realistic way to toggle the flag. Has anyone come across any workarounds for this problem that don't sacrifice efficiency by performing multiple lookups? I was considering what would happen if dovecot treated NULL fields as not present, but that immediately conflicts with advice to set password to NULL to satisfy the field requirement on nopassword. Any thoughts? -- Dave

3 3

Backtrace:dovecot/imap
by Ralf Hildebrandt 29 Apr '16

29 Apr '16

Config: # 2.2.devel (2dc8e2d): /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.devel (850d80b) # OS: Linux 3.13.0-77-generic x86_64 Ubuntu 16.04 LTS auth_mechanisms = plain login default_vsz_limit = 1 G imapc_host = email.charite.de imapc_port = 993 imapc_ssl = imaps imapc_ssl_verify = no listen = *,:: mail_gid = imapproxy mail_home = /home/imapproxy/%u mail_location = imapc:~/imapc mail_plugins = mail_log notify mail_uid = imapproxy passdb { args = host=email.charite.de port=993 ssl=imaps default_fields = userdb_imapc_user=%u userdb_imapc_password=%w userdb_imapc_host=email.charite.de userdb_imapc_ssl=imaps userdb_imapc_port=993 driver = imap } plugin { sieve = file:~/sieve;active=~/.dovecot.sieve } protocols = imap service auth { inet_listener { address = 127.0.0.1 port = 12345 } } ssl = required ssl_ca = </etc/ssl/certs/ca-certificates.crt ssl_cert = </etc/dovecot/dovecot.pem ssl_cipher_list = DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:ALL:!LOW:!SSLv2:!EXP:!aNULL ssl_key = </etc/dovecot/private/dovecot.pem userdb { driver = prefetch } verbose_proctitle = yes Reading symbols from /usr/lib/dovecot/imap...Reading symbols from /usr/lib/debug/.build-id/5a/15dc6951744d026af424747e7b72a4fb550c6b.debug...done. done. [New LWP 21869] Core was generated by `dovecot/imap'. Program terminated with signal SIGSEGV, Segmentation fault. #0 buffer_delete (_buf=0x0, pos=0, size=0) at buffer.c:213 #0 buffer_delete (_buf=0x0, pos=0, size=0) at buffer.c:213 buf = 0x0 end_size = <optimized out> #1 0x00007f5729a7507e in array_delete_i (count=1, idx=125, array=0x7f572c12bbb8) at ../../../../src/lib/array.h:200 No locals. #2 imapc_untagged_expunge (reply=<optimized out>, mbox=0x7f572c12b840) at imapc-mailbox.c:473 msgmap = 0x7f572c146ed0 lseq = 739349904 uid = 51497 rseq = 126 #3 0x00007f5729a77632 in imapc_storage_client_untagged_cb ( reply=0x7ffdc857e400, context=0x7f572c0f7080) at imapc-storage.c:204 mcb__foreach_end = 0x7f572c12bf98 client = 0x7f572c0f7080 mbox = 0x7f572c12b840 cb = <optimized out> mcb = 0x7f572c12bf78 #4 0x00007f5729a7d90a in imapc_connection_input_untagged ( conn=conn@entry=0x7f572c119590) at imapc-connection.c:1144 imap_args = 0x7f572c11db38 data = <optimized out> size = 140012378250296 name = 0x7f572c11dc38 "EXPUNGE" value = <optimized out> parser = 0x7f572c119710 reply = {name = 0x7f572c11dc38 "EXPUNGE", num = 126, args = 0x7f572c11db38, file_args = 0x7f572c11b4c0, file_args_count = 0, resp_text_key = 0x0, resp_text_value = 0x0, untagged_box_context = 0x7f572c12b840} ret = <optimized out> #5 0x00007f5729a7f7d9 in imapc_connection_input_one (conn=0x7f572c119590) at imapc-connection.c:1398 tag = 0x7f572c11dc28 "*" ret = -1 #6 imapc_connection_input_pending (conn=0x7f572c119590) at imapc-connection.c:1766 _data_stack_cur_id = 6 ret = 1 conn = 0x7f572c119590 #7 0x00007f5729a7f82a in imapc_connection_input (conn=0x7f572c119590) at imapc-connection.c:1438 errstr = <optimized out> str = <optimized out> ret = <optimized out> #8 0x00007f572977a05c in io_loop_call_io (io=0x7f572c132740) at ioloop.c:564 ioloop = 0x7f572c136c10 t_id = 5 __FUNCTION__ = "io_loop_call_io" #9 0x00007f572977b4c1 in io_loop_handler_run_internal ( ioloop=ioloop@entry=0x7f572c136c10) at ioloop-epoll.c:220 ctx = 0x7f572c138dd0 io = <optimized out> tv = {tv_sec = 299, tv_usec = 999778} events_count = <optimized out> msecs = <optimized out> ret = 1 i = 0 j = <optimized out> call = <optimized out> __FUNCTION__ = "io_loop_handler_run_internal" #10 0x00007f572977a0e5 in io_loop_handler_run ( ioloop=ioloop@entry=0x7f572c136c10) at ioloop.c:612 No locals. #11 0x00007f572977a288 in io_loop_run (ioloop=0x7f572c136c10) at ioloop.c:588 __FUNCTION__ = "io_loop_run" #12 0x00007f5729a7ab7a in imapc_client_run_pre (client=0x7f572c0f7250, client=0x7f572c0f7250) at imapc-client.c:173 connp = 0x7f572c0f73e8 prev_ioloop = 0x7f572c0db740 #13 imapc_client_run (client=0x7f572c0f7250) at imapc-client.c:192 No locals. #14 0x00007f5729a785e0 in imapc_mailbox_run_nofetch ( mbox=mbox@entry=0x7f572c12b840) at imapc-storage.c:143 No locals. #15 0x00007f5729a78612 in imapc_mailbox_run (mbox=mbox@entry=0x7f572c12b840) at imapc-storage.c:137 No locals. #16 0x00007f5729a7a178 in imapc_sync_index (ctx=0x7f572c132140) at imapc-sync.c:405 mbox = 0x7f572c12b840 sync_rec = {uid1 = 51497, uid2 = 51497, type = MAIL_INDEX_SYNC_TYPE_EXPUNGE, add_flags = 4 '\004', remove_flags = 0 '\000', keyword_idx = 6315, guid_128 = "^kK\r2U\277\357\225`\030\220\257\330\a\t"} seq1 = 126 seq2 = 126 #17 imapc_sync_begin (force=<optimized out>, ctx_r=<synthetic pointer>, mbox=0x7f572c12b840) at imapc-sync.c:481 ctx = <optimized out> sync_flags = <optimized out> ret = <optimized out> #18 imapc_sync (mbox=0x7f572c12b840) at imapc-sync.c:537 sync_ctx = <optimized out> force = <optimized out> #19 imapc_mailbox_sync_init (box=0x7f572c12b840, flags=MAILBOX_SYNC_FLAG_EXPUNGE) at imapc-sync.c:590 mbox = 0x7f572c12b840 list = <optimized out> changes = false ret = <optimized out> #20 0x00007f5729a2ea7b in mailbox_sync_init (box=box@entry=0x7f572c12b840, flags=flags@entry=MAILBOX_SYNC_FLAG_EXPUNGE) at mail-storage.c:1672 _data_stack_cur_id = 4 ctx = <optimized out> #21 0x00007f572a17e102 in imap_sync_init (client=client@entry=0x7f572c11be50, box=<optimized out>, imap_flags=IMAP_SYNC_FLAG_SAFE, flags=MAILBOX_SYNC_FLAG_EXPUNGE) at imap-sync.c:229 __FUNCTION__ = "imap_sync_init" #22 0x00007f572a17ef97 in cmd_sync_client (sync_cmd=0x7f572c127a90) at imap-sync.c:737 ctx = <optimized out> flags = <optimized out> client = 0x7f572c11be50 imap_flags = <optimized out> no_newmail = <optimized out> #23 cmd_sync_delayed_real (client=0x7f572c11be50) at imap-sync.c:856 cmd = <optimized out> first_expunge = <optimized out> first_nonexpunge = <optimized out> #24 cmd_sync_delayed (client=client@entry=0x7f572c11be50) at imap-sync.c:864 _data_stack_cur_id = 3 #25 0x00007f572a1726d8 in client_handle_input (client=0x7f572c11be50) at imap-client.c:1088 remove_io = <optimized out> handled_commands = <optimized out> client = 0x7f572c11be50 #26 0x00007f572a172b65 in client_input (client=0x7f572c11be50) at imap-client.c:1119 cmd = 0x27284 output = 0x7f572c11d080 bytes = 153 __FUNCTION__ = "client_input" #27 0x00007f572977a05c in io_loop_call_io (io=0x7f572c1198c0) at ioloop.c:564 ioloop = 0x7f572c0db740 t_id = 2 __FUNCTION__ = "io_loop_call_io" #28 0x00007f572977b4c1 in io_loop_handler_run_internal ( ioloop=ioloop@entry=0x7f572c0db740) at ioloop-epoll.c:220 ctx = 0x7f572c0dd250 io = <optimized out> tv = {tv_sec = 1739, tv_usec = 992115} events_count = <optimized out> msecs = <optimized out> ret = 1 i = 0 j = <optimized out> call = <optimized out> __FUNCTION__ = "io_loop_handler_run_internal" #29 0x00007f572977a0e5 in io_loop_handler_run ( ioloop=ioloop@entry=0x7f572c0db740) at ioloop.c:612 No locals. #30 0x00007f572977a288 in io_loop_run (ioloop=0x7f572c0db740) at ioloop.c:588 __FUNCTION__ = "io_loop_run" #31 0x00007f572970fe63 in master_service_run (service=0x7f572c0db5e0, callback=<optimized out>) at master-service.c:640 No locals. #32 0x00007f572a165b32 in main (argc=1, argv=0x7f572c0db390) at main.c:460 set_roots = {0x7f572a38f700 <imap_setting_parser_info>, 0x7f5729f2e400 <lda_setting_parser_info>, 0x0} login_set = {auth_socket_path = 0x7f572c0d3048 "\001", postlogin_socket_path = 0x0, postlogin_timeout_secs = 60, callback = 0x7f572a17f9d0 <login_client_connected>, failure_callback = 0x7f572a17f2e0 <login_client_failed>, request_auth_token = 1} service_flags = <optimized out> storage_service_flags = <optimized out> username = 0x0 auth_socket_path = 0x7f572a18834e "auth-master" c = <optimized out> ----- End forwarded message ----- -- Ralf Hildebrandt Geschäftsbereich IT | Abteilung Netzwerk Charité - Universitätsmedizin Berlin Campus Benjamin Franklin Hindenburgdamm 30 | D-12203 Berlin Tel. +49 30 450 570 155 | Fax: +49 30 450 570 962 ralf.hildebrandt(a)charite.de | http://www.charite.de

2 2

Re: WP8/Windows 10 mail app can't login, tries double auth
by Joseph Tam 29 Apr '16

29 Apr '16

Attila Nagy writes: > Are there anybody who could make WP8 (and W10 desktop clients it seems) > devices working with Dovecot's POP3 server? > > The conversation looks like this: > S +OK ready > C CAPA > S +OK > S CAPA > S TOP > S UIDL > S RESP-CODES > S PIPELINING > S AUTH-RESP-CODE > S USER > S SASL PLAIN > S . > C AUTH > S +OK > S PLAIN > S . > C AUTH PLAIN > S + > C <base64 auth string) > S +OK[space] > C USER username > S -ERR unimplemented > > First I thought the extra space after that OK causes this, but removing > it changed nothing. > > So these devices try to log in with AUTH PLAIN, then even after a > successful login they want to log in again with USER, which gets rejected. I dimly remember some Windows clients preferring either "LOGIN" or "PLAIN" style mechanism. Have you tried allowing "LOGIN" style authentication? auth_mechanisms = plain login Joseph Tam <jtam.home(a)gmail.com>

2 1

Doveadm Replicator problem with PAM passdb
by Adam Joesbury 28 Apr '16

28 Apr '16

Hi Everyone, We are running two CentOS 7.2 servers with Sendmail 8.14.7 V10 and Dovecot 2.2.10 installed on both and are trying to configure Master-Master Replication using doveadm replicator. We are using system users with PAM authentication but are receiving the following fatal error when dsync tries to run: doveadm(user): Fatal: /var/run/dovecot/auth-userdb: Configured passdbs don't support crentials lookups (to see if user is proxied, because doveadm_port is set). Please could someone confirm whether it is possible to configure replication using PAM passdb as the above error seems to suggest it isn't but we have come across various people online who seem to have it working. I don't know whether we need to create a master user or whether we need to create a separate password file with a directory of all of our user's passwords? We do have all the user passwords as they are only internal accounts that we are servicing. Thanks in advance Output of dovecot -n: # 2.2.10: /etc/dovecot/dovecot.conf # OS: Linux 3.10.0-327.13.1.el7.x86_64 x86_64 CentOS Linux release 7.2.1511 (Core) auth_mechanisms = plain login auth_socket_path = /var/run/dovecot/auth-userdb doveadm_password = secret doveadm_port = 12345 login_greeting = POP3-IMAP server ready. mail_location = maildir:~/Maildir mail_plugins = " notify replication" mbox_write_locks = fcntl namespace inbox { inbox = yes location = mailbox "Deleted Items" { auto = subscribe special_use = \Trash } mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox "Junk E-mail" { auto = subscribe special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } prefix = } passdb { args = session=yes setcred=yes failure_show_msg=yes dovecot driver = pam } plugin { mail_replica = tcp:VMAILSERVER1:12345 } pop3_client_workarounds = outlook-no-nuls oe-ns-eoh service aggregator { fifo_listener replication-notify-fifo { mode = 0666 } unix_listener replication-notify { mode = 0666 } } service auth { unix_listener auth-userdb { mode = 0777 } } service doveadm { inet_listener { port = 12345 } } service replicator { process_min_avail = 1 unix_listener replicator-doveadm { mode = 0600 } } ssl_ca = </etc/pki/tls/certs/chain.crt ssl_cert = </etc/pki/tls/certs/ca.crt ssl_key = </etc/pki/dovecot/private/dovecot.pem ssl_verify_client_cert = yes userdb { driver = passwd } verbose_ssl = yes

1 0

managesieve proxying not working
by Hawk Chen 28 Apr '16

28 Apr '16

Hi, I'm setting up the directors for proxying pop3/imap/lmtp/sieve. pop3/imap/lmtp proxying work fine, but sieve not working. The error messages in maillog look not using proxying but local passdb. Error message: Apr 03 12:09:25 managesieve-login: Info: Aborted login (no auth attempts in 0 secs): user=<>, rip=10.1.1.4, lip=10.1.1.201, session=<+SIcx4wvRQAKAQEE> sql in /etc/dovecot/dovecot-sql.conf.ext: password_query = SELECT NULL as password, host, 'Y' as nopassword, 'Y' as proxy FROM mailbox WHERE username = '%u' AND active='1' doveconf -n output is as follows, # 2.2.10: /etc/dovecot/dovecot.conf # OS: Linux 3.10.0-327.10.1.el7.x86_64 x86_64 CentOS Linux release 7.2.1511 (Core) director_mail_servers = 10.1.4.5 10.1.4.6 director_servers = 10.1.1.1 10.1.1.2 lmtp_proxy = yes log_path = /var/log/dovecot.log login_greeting = DNT Mail Server managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave mbox_write_locks = fcntl namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } passdb { driver = pam } plugin { sieve = ~/.dovecot.sieve sieve_dir = ~/sieve } protocols = imap pop3 lmtp sieve service director { fifo_listener login/proxy-notify { mode = 0666 } inet_listener { port = 9090 } unix_listener director-userdb { mode = 0600 } unix_listener login/director { mode = 0666 } } service imap-login { executable = imap-login director service_count = 0 } service lmtp { inet_listener lmtp { port = 24 } } service managesieve-login { executable = managesieve-login director service_count = 0 } service pop3-login { executable = pop3-login director service_count = 0 } ssl = required ssl_cert = </etc/postfix/itsnow.crt ssl_key = </etc/postfix/itsnow.key userdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } userdb { driver = passwd } protocol lmtp { auth_socket_path = director-userdb } Regards, Hawk

3 6

WP8/Windows 10 mail app can't login, tries double auth
by Nagy, Attila 27 Apr '16

27 Apr '16

Hi, Are there anybody who could make WP8 (and W10 desktop clients it seems) devices working with Dovecot's POP3 server? The conversation looks like this: S +OK ready C CAPA S +OK S CAPA S TOP S UIDL S RESP-CODES S PIPELINING S AUTH-RESP-CODE S USER S SASL PLAIN S . C AUTH S +OK S PLAIN S . C AUTH PLAIN S + C <base64 auth string) S +OK[space] C USER username S -ERR unimplemented First I thought the extra space after that OK causes this, but removing it changed nothing. So these devices try to log in with AUTH PLAIN, then even after a successful login they want to log in again with USER, which gets rejected. The only solution here seems to be giving back -ERR to the client's AUTH command, which makes it try USER instead. I'm not aware of any configuration options which makes this possible. Any other ideas? Thanks,

1 1

Creating Dovecot Master user throws "Username character disallowed by auth_username_chars : 0x2a " error
by David Okwii 27 Apr '16

27 Apr '16

Hello, Am trying to create a master user on dovecot. However, it throws dovecot: auth: plain(?,127.0.0.1): Username character disallowed by auth_username_chars: 0x2a (username: loginuser*master) ". #telnet localhost 143 Trying 127.0.0.1... Connected to localhost. Escape character is '^]'. * OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE STARTTLS AUTH=PLAIN 1 login loginuser*master mypassword 1 NO [AUTHENTICATIONFAILED] Authentication failed. # log output dovecot: auth: plain(?,127.0.0.1): Username character disallowed by auth_username_chars: 0x64 (username: master) # cat passwd.master master:{SHA}LORtG60Uqg2bPSlOB8PW2cLI0TE= #And here's the output of my dovecot -n # 2.0.16: /usr/local/etc/dovecot/dovecot.conf # OS: FreeBSD 8.2-RELEASE amd64 auth_master_user_separator = * disable_plaintext_auth = no mail_location = maildir:~/Maildir namespace { inbox = yes location = prefix = INBOX. separator = . type = private } passdb { args = /usr/local/etc/dovecot/dovecot-sql.conf driver = sql } passdb { args = /usr/local/etc/dovecot/passwd.master driver = passwd-file master = yes } protocols = imap pop3 service auth { client_limit = 6000 } service imap { process_limit = 2048 vsz_limit = 1256 M } service pop3 { process_limit = 2048 } userdb { args = /usr/local/etc/dovecot/dovecot-sql.conf driver = sql } protocol pop3 { pop3_uidl_format = UID%u-%v } I don't know what am doing wrong. Any help would be welcome. Thanks -- Thanks & regards, David Okwii, Mobile(default): +256-791-040-262 Christ in me the Hope of Glory(Col.1:27)

1 0

Option to not add "Received" header ?
by Florent B 27 Apr '16

27 Apr '16

Hi everyone, I use Dovecot in lmtp mode to receive mails. I would like an option to tell Dovecot to not add a "Reveived" header on each server (I use a director, so Director also adds this header). Is it possible to do this ? Or could it be a future feature ? Thank you. Florent

5 6

Crash: setannotation Trash "/vendor/cmu/cyrus-imapd/expire" ("value.shared" NIL)
by Heiko Schlittermann 27 Apr '16

27 Apr '16

Hi, Using 2.2.9 (ubuntu 14.04 LTS) and sending the following command, the server crashes when I try to delete an annotation: … login … C: 2 setannotation Trash "/vendor/cmu/cyrus-imapd/expire" ("value.shared" NIL) Apr 27 09:29:16 backend1 dovecot: imap-login: Login: user=<heiko>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, mpid=6651, secured Apr 27 09:29:16 backend1 dovecot: imap(heiko): Fatal: master: service(imap): child 6651 killed with signal 11 (core dumped) Sending a real value it works: … login … C: 2 setannotation Trash "/vendor/cmu/cyrus-imapd/expire" ("value.shared" "27") S: 2 OK Completed. Is this a known bug that is fixed in later releases? Best regards from Dresden/Germany Viele Grüße aus Dresden Heiko Schlittermann -- SCHLITTERMANN.de ---------------------------- internet & unix support - Heiko Schlittermann, Dipl.-Ing. (TU) - {fon,fax}: +49.351.802998{1,3} - gnupg encrypted messages are welcome --------------- key ID: F69376CE - ! key id 7CBF764A and 972EAC9F are revoked since 2015-01 ------------ -

3 6

apt pinning specific dovecot version
by Regan Jelčić 27 Apr '16

27 Apr '16

I currently have the dovecot-core package from wheezy-backports pinned on one of my servers to version '2.2.9', which has been working great. I now want to upgrade that to the newest version under wheezy-backports which is: dovecot-core (1:2.2.13-11~bpo70+1) but I can't figure out how to get do it. I've tried a few different formats of the name but apt-get update then apt-get dost-upgrade doesn't pick up the new version - it ignores it when trying to do an update. This is what I've got in my apt preferences and pin files... /etc/apt/preferences Explanation: Stop ALL wheezy-backports updating system. Package: * Pin: release a=wheezy-backports,n=wheezy-backports Pin-Priority: 100 /etc/apt/preferences.d/dovecot.pref Explanation: Promote wheezy-backports version of Dovecot only Package: dovecot-core /2\.2\.9/ Pin: release a=wheezy-backports Pin-Priority: 500 Can anyone advise how I get it to pull the newer version?? Thanks,

3 2