- dovecot - dovecot.org

doveadm search -A problem with dropped privileges
by Sebastian Kricner 14 Jul '15

14 Jul '15

Hello, if you want to answer to this mail, please send it directly to me. I have found a big issue with the following command "doveadm -search -A". It whatsoever works by setting doveadm_worker_count = 0 in the dovecot.conf configuration file. The problem is that doveadm-server or something similar uses privileges of "nobody" and so it fails searching e-mails. Instead also the process tries to create a maildir for "nobody": Debug: Namespace : /var/mail/nobody doesn't exist yet, using default permissions Debug: Namespace : Using permissions from /var/mail/nobody: mode=0700 gid=default Error: User initialization failed: Namespace '': mkdir(/var/mail/nobody) failed: Permission denied (euid=65534(nobody) egid=65534(nobody) missing +w perm: /var/mail, we're not in group 12(mail), dir owned by 0:12 mode=0775) Error: search: User init failed Error: userdb lookup: connect(/var/run/dovecot//auth-userdb) failed: Permission denied (euid=65534(nobody) egid=65534(nobody) missing +r perm: /var/run/dovecot//auth-userdb, we're not in group 12(mail), dir owned by 0:0 mode=0755) Error: search: User lookup failed: Internal error occurred. Refer to server log for more information. Even after setting permissions, so that the process can create a maildir for "nobody" in the /var/mail location, it fails to "setresgid" to the particular user to be scanned. It can´t work because it is not possible to gain other user privileges from another user. # 2.2.16: /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.7 # OS: Linux Gentoo Base System release 2.2 auth_cache_negative_ttl = xx mins auth_cache_size = xx M auth_cache_ttl = xx mins auth_mechanisms = xx xx auth_worker_max_count = xx base_dir = /var/run/dovecot/ default_process_limit = xx dict { expire = sqlite:/xx } doveadm_worker_count = 1 first_valid_gid = xx first_valid_uid = xx login_greeting = xx.xx mail_location = maildir:/xx/xx/%u mail_privileged_group = xx managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate passdb { args = scheme=SHA512 /xx/xx/xx.xx driver = passwd-file } plugin { expire = xx expire2 = xx expire_dict = proxy::expire sieve = ~/.xx.xx sieve_dir = ~/.xx } protocols = imap sieve service auth { unix_listener auth-client { group = xx mode = 0660 } unix_listener auth-userdb { group = xx mode = 0660 } } service dict { unix_listener dict { mode = 0666 } } service imap-login { inet_listener imap { port = 0 } process_limit = 6 service_count = 1 } ssl_cert = </xx/xx/xx/xx.xx.xx ssl_key = </xx/xx/xx/xx.xx.xx ssl_parameters_regenerate = xx days userdb { driver = passwd } protocol lda { mail_plugins = sieve expire } protocol imap { imap_idle_notify_interval = xx mins mail_max_userip_connections = xx mail_plugins = expire } Regards Sebastian Kricner -- http://tuxwave.net -- the difference to think makes it real!

1 0

does dovecot support aio(asynchronous IO)
by boyd 13 Jul '15

13 Jul '15

Dear, Does dovecot support aio(asynchronous IO)? Or do we have a plan/need to support it? Thanks!

1 0

doveadm save message ...
by Hardy Flor 11 Jul '15

11 Jul '15

How can I set the flags for a saved message without search?

2 1

Error while executing dovecot
by Sachin Kulkarni1 10 Jul '15

10 Jul '15

Hello All, I am trying to execute dovecot by below command /opt/app/dovecot/latest/sbin/dovecot -c /opt/app/dovecot/latest/etc/dovecot/dovecot.conf I am getting below error doveconf: Fatal: Error in configuration file /opt/app/dovecot/latest/etc/dovecot/dovecot.conf: default_login_user doesn't exist: dovenull please guide me to resolve this. Thanks and Regards, Sachin ============================================================================================================================ Disclaimer: This message and the information contained herein is proprietary and confidential and subject to the Tech Mahindra policy statement, you may review the policy at http://www.techmahindra.com/Disclaimer.html externally http://tim.techmahindra.com/tim/disclaimer.html internally within TechMahindra. ============================================================================================================================

2 1

Re: Systemd and listen restriction to localhost not enforced
by Joseph Tam 08 Jul '15

08 Jul '15

Sven Strickroth <sven(a)cs-ware.de> writes: > in /etc/dovecot/conf.d/10-master.conf I have restricted IMAP to > localhost only: > > service imap-login { > inet_listener imap { > address = 127.0.0.1 > #port = 143 > } > inet_listener imaps { > #port = 993 > #ssl = yes > } > } > > However, /lib/systemd/system/dovecot.socket make it listen on > 0.0.0.0:143 and [::]:143 causing the service being available to > the public which it should not. - IMHO this is a security issue. I don't know much about systemd, but you'll probably need dovecot configuration listen = 127.0.0.1 Joseph Tam <jtam.home(a)gmail.com>

1 0

Systemd and listen restriction to localhost not enforced
by Sven Strickroth 08 Jul '15

08 Jul '15

Hi, in /etc/dovecot/conf.d/10-master.conf I have restricted IMAP to localhost only: service imap-login { inet_listener imap { address = 127.0.0.1 #port = 143 } inet_listener imaps { #port = 993 #ssl = yes } } However, /lib/systemd/system/dovecot.socket make it listen on 0.0.0.0:143 and [::]:143 causing the service being available to the public which it should not. - IMHO this is a security issue. PS: When starting dovecot I got: Jul 6 22:52:14 srv1 dovecot[19921]: Error: systemd listens on port 143, but it's not configured in Dovecot. Closing. Jul 6 22:52:14 srv1 dovecot: master: Error: systemd listens on port 143, but it's not configured in Dovecot. Closing. -- Best regards, Sven Strickroth PGP key id F5A9D4C4 @ any key-server

1 0

vsz_limit of service doveadm "ignored"?
by Philipp 08 Jul '15

08 Jul '15

Hello, dovecot 2.2.18 on CentOS6.5 Jul 08 11:53:44 dsync-server(system): Fatal: master: service(doveadm): child 32554 returned error 83 (Out of memory (service doveadm { vsz_limit=521 MB }, you may need to increase it) - set CORE_OUTOFMEM=1 environment to get core dump) I tried increasing to 1 G, 1024 M or even disabling via value of zero -- to no change. Every other service has the famous 18446744073709551615 B limit. default_vsz_limit = 2 G The second node with the same setup/config is happily accepting a higher value, since both come from the same provisioning I cannot see (or expect) differences around ulimit and thelike. The configuration comes from a single file, so no include drama or such. Any pointers why the setting is being ignored?

1 0

ESEARCH multiple folders
by Peter Chiochetti 08 Jul '15

08 Jul '15

FTS-Solr is blazingly fast; yet searching e.g. an archive with subfolders still is slow; I learned, that this is a feature/bug of the imap protocol. So I'd like to ask: Does or will dovecot support the "IMAP4 Multimailbox SEARCH Extension" specified in RFC 7377? -- Kind regards Peter

2 2

Scalability with high density servers and proxies, TCP port limits
by Christian Balzer 08 Jul '15

08 Jul '15

Hello, first post in 3 years, kinda shows how painless Dovecot is. ^o^ Also this isn't really a dovecot issue, alas it's involved and since there are some large scale implementations of it I hope somebody here has some insights I might have missed. Currently we're running this setup: 1. LVS (DR mode) in a HA configuration (2 node cluster) 2. Dovecot in proxy mode on a 2 node cluster 3. Dovecot on actual mailbox servers (dual node DRBD clusters) There are about 500k users, but most of them use POP3, so there are usually less than 6k IMAP sesions at any given time. This is about to change, I'm looking at potentially millions of users who will have all semi-permanent IMAP sessions. We already have a pure SSD based mailbox cluster and based on the experiences with that another one is on order that will be able to easily handle about 500k users with regards to IOPS and other needs. However there's the issue of having all these concurrent IMAP sessions. Namely, running out of ephemeral ports. Lets assume 2 million users and 50k ports per IP and revisit the setup above. 1. LVS should have no problem, from experience and tests I expect a well tuned and spec'ed machine to handle millions of connections. This is in DR mode, in NAT mode I assume things would run into a wall a lot quicker. But even if LVS should run out of steam, there's a wide selection of high capacity load balancers available. 2. Here is where the fun starts. Each IMAP session that gets proxied to the real mailbox server needs a port for the outgoing connection. So to support 2 million sessions we need 40 IP addresses here. Ouch. And from a brief test having multiple IP addresses per server won't help either (Dovecot unsurprisingly picks the main IP when establishing a proxy session to the real mailbox), at least not with just one default GW. 3. All of this gets repeated on the actual mailbox servers, by either having a lot of low density servers or (preferably) high density servers with multiple IP addresses. Am I on track so far or missing something obvious? How many concurrent connections do you (hello Timo) think dovecot in proxy mode can handle? High performance mode of course in this case. I'm interested in internal limitations, assume that CPU and RAM are amply supplied. Any and all feedback is appreciated. Regards, Christian -- Christian Balzer Network/Systems Engineer chibi(a)gol.com Global OnLine Japan/Fusion Communications http://www.gol.com/

2 3

HELP: wrinting dovecot-sql.conf to authenticate to an existing database
by Filippo Zeus 08 Jul '15

08 Jul '15

hi all, can anyone help me with dovecot-sql.conf please ? I'm not a mysql expert and I'am trying to authenticate dovecot2 to an existing database. I have a database "egroupware" with table "egw_accounts". The field "account_lid" is the full email address and "account_pwd" is the password in Blowfish format. Here is my dovecot-sql.conf driver = mysql connect = host=localhost dbname=egroupware user=egroupware password=********* default_pass_scheme = BLF-CRYPT password_query = SELECT account_pwd AS password FROM egw_accounts WHERE account_lid = '%u' when I try to login to POP or IMAP I got this error in mail.log/mail.info Error: sql(hidden@mydomain.com,::1): Invalid password in passdb: crypt() failed: Invalid argument auth: Debug: client passdb out: FAIL#0111#011user=hidden(a)mydomain.com dovecot: pop3-login: Debug: Ignoring unknown passdb extra field: I think I'm having trouble with the password value that is stored in the account_pwd as: {crypt}$2a$12$XTAolzXgwMC211MuZELQUedPv9tjZNs7Osh97PnZ50pAKuk3WPGmS Reading at http://wiki2.dovecot.org/Authentication/PasswordSchemes I suppose that the heading "{crypt}$2a$" instead of a simple "$2a$" (witch identifies a Blowfish password) is my problem. How can I fix this ? Here is my dovecot -n output: # 2.2.13: /etc/dovecot/dovecot.conf # OS: Linux 3.16.0-4-amd64 x86_64 Debian 8.1 xfs auth_cache_size = 64 M auth_debug = yes auth_mechanisms = plain login lda_mailbox_autocreate = yes log_timestamp = "%Y-%m-%d %H:%M:%S " login_log_format_elements = USER=<%u> METHOD=%m FROM=%r TO=%l %c mail_location = maildir:/var/mail/%d/%n/Maildir mail_plugins = quota mail_privileged_group = vmail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave spamtest spamtestplus imapflags notify namespace inbox { inbox = yes location = mailbox Archive { auto = no special_use = \Archive } mailbox "Deleted Messages" { auto = no special_use = \Trash } mailbox Drafts { special_use = \Drafts } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Spam { auto = no special_use = \Junk } mailbox Trash { auto = no special_use = \Trash } prefix = separator = . } passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } plugin { quota = maildir:User quota quota_exceeded_message = Storage quota for this account has been exceeded, please try again later. quota_grace = 10%% quota_rule = *:storage=6G quota_rule2 = Trash:storage=+100M quota_rule3 = spam:ignore quota_warning = storage=95%% quota-warning 95 %u sieve = ~/dovecot.sieve sieve_before = /var/mail/sieve/before.sieve sieve_default = /var/mail/sieve/default.sieve sieve_dir = ~/sieve.d sieve_extensions = +notify +imapflags +spamtest +spamtestplus +relational +comparator-i;ascii-numeric sieve_global_dir = /var/mail/sieve/global.d sieve_max_script_size = 1M } postmaster_address = postmaster@%d protocols = " imap sieve pop3 sieve" service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0666 user = postfix } } service imap-login { inet_listener imap { port = 143 } inet_listener imaps { port = 993 ssl = yes } } service managesieve-login { inet_listener sieve { port = 4190 } service_count = 1 vsz_limit = 64 M } service managesieve { process_limit = 15 } service quota-warning { executable = script /usr/local/bin/quota-warning.sh unix_listener quota-warning { user = vmail } user = dovecot } ssl = required ssl_cert = </etc/ssl/dharma/mail/mail_antonica_it.crt ssl_key = </etc/ssl/dharma/mail/mail_antonica_it.key userdb { args = uid=vmail gid=vmail home=/var/mail/%d/%n driver = static } protocol lda { mail_plugins = quota sieve } protocol imap { mail_plugins = quota imap_quota } protocol sieve { mail_max_userip_connections = 10 managesieve_logout_format = bytes=%i/%o managesieve_max_line_length = 65536 }

2 1