- dovecot - dovecot.org

Re: [Dovecot] Help connecting from remote client (no auth attempts
by Joseph Tam 28 Mar '14

28 Mar '14

Blake McBride writes: > Thanks. The current version of Thunderbird auto-detects connection > parameters - presumably by trying every combination. All I give is an > email address and a password. They also have a manual configuration that I > spent a lot of time with. I was never able to do any better than their > auto-config. That's usually the cause of many problems I see with log entries like yours. It could happen when client and server disagree on using STARTTLS or SSL, so hardwiring your client to use whatever your server supports stops the client from fumbling around (and getting it wrong). > Given my experience with all this, I feel confident that Thunderbird is not > a factor in the problem. A network trace could clear that up, but auto-configure is problematic. > In terms of the config, I really don't know what I am doing. I think what > I want is clear text passwords sent over an SSL connection. Isn't that > secure? I don't know the difference between SSL and that TTSL thing. I > really don't care how it is setup. I just want it to be reasonably secure > and simple. You'll need to know these things in order to understand the problem. The essential difference, as far as your concerned, is that TLS (or STARTTLS or SSLv(some-number-I-forget)) starts out in plain text, then the client issues a command (STARTTLS) to commence the secure (encrypted) communication handshake, whereas SSL dives right in and expects the client to negotiate SSL parameters immediately. These two variations of SSL listen on two distinct ports. If you get these cross up, you'll get the above error log. In my experiments: SSL client -> TLS server port: Aborted login (no auth attempts) TLS client -> SSL server port: client hangs, Disconnected: Inactivity (no auth attempts in 180 secs) SSL/TLS + clear-text password is secure. If you do not use SSL/TLS, you'll have to use CRAM-MD5 or some challenge-response authentication to defeat password snooping. You could use both, but that's overkill. Joseph Tam <jtam.home(a)gmail.com>

2 1

[Dovecot] Authentication woes, passwd standard install
by medicineme 28 Mar '14

28 Mar '14

I have two users working fine. Tried to add a third and it refuses to accept log on details. I've stripped everything back to default config, and still only the first two users are accepted! Can't understand it and it's driving me crazy. I've deleted and created the user a thousand times, and opened the config up as wide as possible. I'm obviously doing something stupid but what! # OS: Linux 3.2.0-4-686-pae i686 Debian 7.2 auth_mechanisms = plain login digest-md5 rpa base_dir = /var/run/dovecot/ disable_plaintext_auth = no login_trusted_networks = 10.0.0.0/8 passdb { driver = pam } protocols = imap service auth { user = root } ssl_cert = </etc/ssl/certs/server.pem ssl_key = </etc/ssl/private/mail.key userdb { driver = passwd } -- View this message in context: http://dovecot.2317879.n4.nabble.com/Authentication-woes-passwd-standard-in… Sent from the Dovecot mailing list archive at Nabble.com.

2 1

[Dovecot] Dovecot replication, no updates on message deposit
by Milan Cvetkovic 27 Mar '14

27 Mar '14

Hi, I am trying to setup dovecot replication based on: http://wiki2.dovecot.org/Replication All mailboxes share the same UNIX userid ('vmail'), and I setup ssh-key based login for this account in both directions. As LDA exim4 is configured to use dovecot deliver LDA. Here is the relevant config from exim: /usr/lib/dovecot/deliver -d $local_part -f $sender_address -a $original_local_part@$original_domain When a message is deposited to a mailbox, it does not get replicated. The log is silent: Mar 25 15:00:20 mx02 dovecot: master: Dovecot v2.2.9 starting up (core dumps disabled) Mar 25 15:01:05 mx02 dovecot: lda(user.name): msgid=unspecified: saved mail to INBOX The output from doveconf -n is attached. Any help is appreciated, Thanks, Milan.

1 1

[Dovecot] Help connecting from remote client (no auth attempts)
by Blake McBride 27 Mar '14

27 Mar '14

Greetings, I am running 64 bit Ubuntu server 10.04.04, postfix 2.7.0, and dovecot 1.2.9. I installed the dovecot-postfix package so the two would be configured to work together. >From localhost I can send and receive email to/from arbitrary remote sites without any problems. I wish to send & receive email from my (remote) desktop via Thunderbird through that sever. When I attempt to configure Thunderbird I get the following on mail.log: Mar 26 15:04:51 booklion dovecot: imap-login: Aborted login (no auth attempts): rip=74.179.230.177, lip=192.168.168.53 Mar 26 15:04:51 booklion dovecot: last message repeated 2 times Mar 26 15:04:51 booklion dovecot: pop3-login: Aborted login (no auth attempts): rip=74.179.230.177, lip=192.168.168.53 Mar 26 15:04:51 booklion dovecot: last message repeated 3 times Mar 26 15:04:51 booklion dovecot: imap-login: Aborted login (no auth attempts): rip=74.179.230.177, lip=192.168.168.53 ... For now, I just want to control access through the normal passwd/shadow mechanism. I set in dovecot.conf: disable_plaintext_auth = no ssl = yes passdb shadow { } userdb passwd { } I don't know what else to try. Help would really be appreciated. Blake McBride

2 8

[Dovecot] lmtpd configuration
by paolo.brocchi12 27 Mar '14

27 Mar '14

Hi all, i have my home.conf : mydatabase XXXX myuser XXXX mypasswd XXXX myhosts be1XX be2XX [lmtpd] where mail conditions status = 0 user name passwd 'passwd' home home quota quota_limit_bytes uid 497 gid 497 table UTENTI on mysql database the home is home: /data/mail/BE01/........ i would like to have home:/data/mail/DRBE01 How can i change my home.conf? Thanks you Paolo -- View this message in context: http://dovecot.2317879.n4.nabble.com/lmtpd-configuration-tp47284.html Sent from the Dovecot mailing list archive at Nabble.com.

1 0

[Dovecot] %{orig_user} missing in checkpassword-Script
by dovecot.pkoch＠dfgh.net 27 Mar '14

27 Mar '14

Hi everybody, I'm using SSL client certificates or checkpassword scripts to authenticate our users. If a user sent a client certificate from his smartcard my checkpasswort will ignore the password, if he does not sent a client certificate but uses his OTP-token then my checkwassword script will check wether the password is a correct one time password. My problem is: the AUTH_USER variable will either contain the username that was configured in the mailclient (if auth_ssl_username_from_cert=false) or the username from the certificate (if auth_ssl_username_from_cert=true). I would like to compare both values, i.e. the %{user} Dovecot-variable and the %{orig_user} Dovecot-variable. But the environment of a checkpassword-script has only one of them. Any ideas? I tried to change the source and found the routine where all the AUTH_xxx environment variables are created. But the %{orig_user] variable was empty at that point, so no AUTH_ORIG_USER variable is created. I'm afraight that whenever the %{user}-Variable is replaced by the UID from the client certificate (due to auth_ssl_username_from_cert=true), the original value of %{user} is NOT copied into %{orig_user} Can someone more familiar with the dovecot source check this please or give me a hint where to look further Kind regards Peter Koch

1 0

Re: [Dovecot] Trying to get Centos5 set up with dovecot
by Joseph Tam 27 Mar '14

27 Mar '14

DCA <dovecotadmin(a)silverservers.com> writes: > I am trying to set up dovecot to replace an older POP3 server in an existing set up. > Currently the server uses sendmail to handle incoming mail. users are in /etc/mail and their incoming eMail lands in the /var/mail/username > in /var/mail the username file is owned by username:mail > > I have dovecot configured to create the imap folders in /home/username/mail/ > on existing accounts login attempts fail with errors such as: > chown /home/username/mail/.imap/INBOX failed: Operation not permitted egid=500(username), group based on /var/mail/username > mkdir /home/username/mail/imap/INBOX failed: Operation not permitted. > > Everything seems to work as expected but only if I add "username" into the "mail" group OR if I have all mailboxes chowned to username:username > Is there any way to tell dovecot to ignore the group ownership of /var/mail/username and focus instead on using username:username for everything in /home/username ? > > If I have to add every user to the mail group I can but this seems messy. Geez, I must have answered the same query 3 or 4 times. I need to write an entry in wiki somewhere: http://www.dovecot.org/list/dovecot/2013-August/092299.html Joseph Tam <jtam.home(a)gmail.com>

2 2

[Dovecot] Auth service panic
by Piotr Rotter 26 Mar '14

26 Mar '14

Hello, I have dovecot director on one server and today I notice 146 times the same problem. Log below. I try restart dovecot and mysql (auth-db backend) but with no effect. Please help. If any other information is needed I send it. My dovecot version is 2.1.15. 2014-03-26T16:15:28+01:00 r1 dovecot: auth: Fatal: master: service(auth): child 9883 killed with signal 6 (core dumps disabled) 2014-03-26T16:15:43+01:00 r1 dovecot: auth: Panic: file passdb-blocking.c: line 124 (passdb_blocking_lookup_credentials): assertion failed: (auth_stream_is_empty(request->extra_fields) || request->master_user != NULL) 2014-03-26T16:15:43+01:00 r1 dovecot: auth: Error: Raw backtrace: /usr/lib64/dovecot/libdovecot.so.0(+0x4469a) [0x7fdb06e1469a] -> /usr/lib64/dovecot/libdovecot.so.0(+0x446de) [0x7fdb06e146de] -> /usr/lib64/dovecot/libdovecot.so.0(+0x1c0ea) [0x7fdb06dec0ea] -> dovecot/auth [34 wait, 1 passdb, 0 userdb](passdb_blocking_verify_plain+0) [0x41f593] -> dovecot/auth [34 wait, 1 passdb, 0 userdb](auth_request_lookup_credentials+0x104) [0x413c41] -> dovecot/auth [34 wait, 1 passdb, 0 userdb]() [0x41c202] -> dovecot/auth [34 wait, 1 passdb, 0 userdb]() [0x4139e6] -> dovecot/auth [34 wait, 1 passdb, 0 userdb](auth_request_lookup_credentials_callback+0x6a) [0x413abb] -> dovecot/auth [34 wait, 1 passdb, 0 userdb](passdb_handle_credentials+0x50) [0x41f389] -> dovecot/auth [34 wait, 1 passdb, 0 userdb]() [0x41f82e] -> dovecot/auth [34 wait, 1 passdb, 0 userdb]() [0x41798f] -> /usr/lib64/dovecot/libdovecot.so.0(io_loop_call_io+0x27) [0x7fdb06e1f68c] -> /usr/lib64/dovecot/libdovecot.so.0(io_loop_handler_run+0x9e) [0x7fdb06e204ee] -> /usr/lib64/dovecot/libdovecot.so.0(io_loop_run+0x27) [0x7fdb06e1f645] -> /usr/lib64/dovecot/libdovecot.so.0(master_service_run+0x13) [0x7fdb06e0d348] -> dovecot/auth [34 wait, 1 passdb, 0 userdb](main+0x380) [0x41a396] -> /lib64/libc.so.6(__libc_start_main+0xfd) [0x7fdb062ced2d] -> dovecot/auth [34 wait, 1 passdb, 0 userdb]() [0x40ced9] 2014-03-26T16:15:43+01:00 r1 dovecot: auth: Fatal: master: service(auth): child 18546 killed with signal 6 (core dumps disabled)

1 0

Re: [Dovecot] IMAP proxy with master user and CRAM-MD5 auth mechanism
by ML mail 26 Mar '14

26 Mar '14

Hi Trent, Thanks for your exhaustive explanation now it is clear. What was unclear to me was the fact that the IMAP proxy server has to take care of the authentication in this case of using a master user and therefore it needs access to the passwords (in my case stored in the mailbox table in PostgreSQL). I still have two open questions: 1) Do I really need the userdb on my IMAP proxy config as you mention in your mail? In my understanding the passdb should be enough (which in my case will use a SQL query joining the result of my proxy and mailbox tables). 2) Is this correct that the IMAP backend (the mailbox server) in this case scenario has to use PLAIN authentication and can NOT use CRAM-MD5? Regards,ML

1 0

[Dovecot] IMAP proxy with master user and CRAM-MD5 auth mechanism
by ML mail 26 Mar '14

26 Mar '14

Hello, I would like to know if it possible to have a dovecot IMAP proxy frontend where CRAM-MD5 can be used as auth mechanism (assuming I would be using a master user/password on the dovecot IMAP backend/mailbox)? I have read a few times the following http://wiki2.dovecot.org/PasswordDatabase/ExtraFields/Proxy page but somehow it is still unclear to me if the IMAP proxy then needs to have all the users and passwords in its proxy table in the database? Unfortunately there are no examples for that case. Also with this case scenario is it possible to store the users' passwords in CRAM-MD5 format? Any pointers or documentation to such a scenario would be great. Thanks and regards M.L.

1 0