- dovecot - dovecot.org

[Dovecot] Windows 8 issues (using Live/Outlook)
by Eriberto 04 Mar '14

04 Mar '14

Hi! I am trying to make Windows 8 using Live 2012 and Outlook 2010 login in Dovecot POP3s. However, I receive this message in log: Feb 28 07:32:05 ipanema dovecot: pop3-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=10.0.0.10, lip=10.0.0.1, TLS handshaking: Disconnected, session=<joP78nTz9ACsFQAF> Note that user is sent as blank and this is the only log line. I used debug mode too: Feb 28 09:07:07 ipanema dovecot: pop3-login: Debug: SSL: elliptic curve secp384r1 will be used for ECDH and ECDHE key exchanges Feb 28 09:07:07 ipanema dovecot: pop3-login: Debug: SSL: elliptic curve secp384r1 will be used for ECDH and ECDHE key exchanges Feb 28 09:07:07 ipanema dovecot: pop3-login: Debug: SSL: where=0x10, ret=1: before/accept initialization [10.0.0.10] Feb 28 09:07:07 ipanema dovecot: pop3-login: Debug: SSL: where=0x2001, ret=1: before/accept initialization [10.0.0.10] Feb 28 09:07:07 ipanema dovecot: pop3-login: Debug: SSL: where=0x2001, ret=1: SSLv3 read client hello A [10.0.0.10] Feb 28 09:07:07 ipanema dovecot: pop3-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write server hello A [10.0.0.10] Feb 28 09:07:07 ipanema dovecot: pop3-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write certificate A [10.0.0.10] Feb 28 09:07:07 ipanema dovecot: pop3-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write server done A [10.0.0.10] Feb 28 09:07:07 ipanema dovecot: pop3-login: Debug: SSL: where=0x2001, ret=1: SSLv3 flush data [10.0.0.10] Feb 28 09:07:07 ipanema dovecot: pop3-login: Debug: SSL: where=0x2002, ret=-1: SSLv3 read client certificate A [10.0.0.10] Feb 28 09:07:07 ipanema dovecot: pop3-login: Debug: SSL: where=0x2002, ret=-1: SSLv3 read client certificate A [10.0.0.10] Feb 28 09:07:07 ipanema dovecot: pop3-login: Warning: SSL failed: where=0x2002: SSLv3 read client certificate A [10.0.0.10] Feb 28 09:07:07 ipanema dovecot: auth: Debug: Loading modules from directory: /usr/lib/dovecot/modules/auth Feb 28 09:07:07 ipanema dovecot: auth: Debug: Read auth token secret from /var/run/dovecot/auth-token-secret.dat Feb 28 09:07:07 ipanema dovecot: auth: Debug: auth client connected (pid=8138) Feb 28 09:07:07 ipanema dovecot: pop3-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=10.0.0.10, lip=10.0.0.1, TLS handshaking: Disconnected, session=<QDraRnbzMwCsFQAF> Analysing the traffic with tshark, I can see: 0.007163 10.0.0.10 -> 10.0.0.1 TLSv1.2 331 Certificate, Server Hello Done I am using Dovecot 2.2.9 and I think it is TLS compatible. External (non-MS) clients, as Mozilla Thunderbird and Sylpheed, are working fine. Can someone point me a light? # 2.2.9: /etc/dovecot/dovecot.conf # OS: Linux 3.2.0-4-amd64 x86_64 Debian 7.4 ext4 Thanks in advanced. Regards, Eriberto

2 1

[Dovecot] Dovecot, AD and authenticated binds...
by Jeroen Scheerder 03 Mar '14

03 Mar '14

I posted earlier with reports of less than stellar success in using Active Directory for dovecot authentication. My approach is to using the two-step approach of - obtaining the user DN by a search using an authenticated bind (using a service account) - then binding as that DN, and returning the relevant user attributes This hasn't been succesful. Dovecot's authentication process does perform the (first) authenticated bind successfully, it does obtain the right DN, than just sits there doing nothing as far as I can tell, and after a long delay concludes authentication failure - shortly before deciding to perform the bind with the user-supplied credentials, successfully. Source inspection has not resulted in a glorious eureka yet. So I thought, why not handle it myself? And I wrote a little script, using the checkpassword interface. I've enclosed it. The script is based on <http://wiki2.dovecot.org/AuthDatabase/CheckPassword>, but somehow the userdb_uid and userdb_gid I've passed back in the "EXTRA" environment variable get lost along the way. It syslogs, and the syslogs show that the LDAP parts working as expected: Mar 3 14:49:09 <mail.info> ponyboy checkpassword: successful authenticated bind and DN(js) lookup Mar 3 14:49:09 <mail.info> ponyboy checkpassword: DN(js) is CN=Jeroen Scheerder,OU=Users,OU=Netherlands,OU=ON2IT,DC=office,DC=on2it,DC=net Mar 3 14:49:09 <mail.info> ponyboy checkpassword: js authenticated In dovecot's log, simultaneously, I see basically a successful login, except that the (user_)uid and (userdb_)gid work - unless I disable prefetch, and use a static userdb: Mar 03 14:49:04 auth: Debug: Loading modules from directory: /usr/local/lib/dovecot/auth Mar 03 14:49:04 auth: Debug: Read auth token secret from /var/run/dovecot/auth-token-secret.dat Mar 03 14:49:04 auth: Debug: auth client connected (pid=90856) Mar 03 14:49:09 auth: Debug: client in: AUTH 1 PLAIN service=imap secured session=+qFODbTzDgB/AAAB lip=127.0.0.1 rip=127.0.0.1 lport=143 rport=63246 resp=<hidden> Mar 03 14:49:09 auth: Debug: checkpassword(js,127.0.0.1,<+qFODbTzDgB/AAAB>): execute: /usr/local/etc/dovecot/checkpassword-on2it /usr/local/libexec/dovecot/checkpassword-reply Mar 03 14:49:09 auth: Debug: checkpassword(js,127.0.0.1,<+qFODbTzDgB/AAAB>): Received input: userdb_uid=143 userdb_gid=143 Mar 03 14:49:09 auth: Debug: checkpassword(js,127.0.0.1,<+qFODbTzDgB/AAAB>): exit_status=0 Mar 03 14:49:09 auth: Debug: client passdb out: OK 1 user=js Mar 03 14:49:09 auth: Debug: master in: REQUEST 4007395329 90856 1 29571963894e557ab643d2e51872ba55 session_pid=90899 request_auth_token Mar 03 14:49:09 auth: Debug: prefetch(js,127.0.0.1,<+qFODbTzDgB/AAAB>): success Mar 03 14:49:09 auth: Debug: master userdb out: USER 4007395329 js uid=143 gid=143 auth_token=e2d7c2463dd4c039010e904afb4ea45214cb7de5 Mar 03 14:49:09 imap-login: Info: Login: user=<js>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, mpid=90899, secured, session=<+qFODbTzDgB/AAAB> Mar 03 14:49:09 imap: Error: user js: Mail access for users with UID 143 not permitted (see first_valid_uid in config file, uid from userdb lookup). Mar 03 14:49:09 imap: Error: Invalid user settings. Refer to server log for more information. With a static userdb (as shown in the config below): behold, everything works: Mar 03 14:52:49 auth: Debug: client in: AUTH 1 PLAIN service=imap secured session=R0plGrTzGAB/AAAB lip=127.0.0.1 rip=127.0.0.1 lport=143 rport=40984 resp=<hidden> Mar 03 14:52:49 auth: Debug: checkpassword(js,127.0.0.1,<R0plGrTzGAB/AAAB>): execute: /usr/local/etc/dovecot/checkpassword-on2it /usr/local/libexec/dovecot/checkpassword-reply Mar 03 14:52:49 auth: Debug: checkpassword(js,127.0.0.1,<R0plGrTzGAB/AAAB>): Received input: userdb_uid=143 userdb_gid=143 Mar 03 14:52:49 auth: Debug: checkpassword(js,127.0.0.1,<R0plGrTzGAB/AAAB>): exit_status=0 Mar 03 14:52:49 auth: Debug: client passdb out: OK 1 user=js Mar 03 14:52:49 auth: Debug: master in: REQUEST 2818310145 90960 1 1b6ea6c4e6b90fd49a87195c35fa34ef session_pid=91002 request_auth_token Mar 03 14:52:49 auth: Debug: master userdb out: USER 2818310145 js uid=1000 gid=1000 home=/var/mail/on2it/js auth_token=21609f5f149bf80dec701dce9f288824cdf52c60 Mar 03 14:52:49 imap-login: Info: Login: user=<js>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, mpid=91002, secured, session=<R0plGrTzGAB/AAAB> Mar 03 14:53:04 imap(js): Info: Connection closed in=0 out=352 So it's working for me now. This is clearly not the way things ought to work... but the stock LDAP interaction seems broken to my limited mind. So who would be so friendly as to point out the fallacies I've been pursuing? Regards, Jeroen. $ dovecot -n # 2.2.10: /usr/local/etc/dovecot/dovecot.conf # OS: FreeBSD 10.0-RELEASE amd64 ufs auth_debug = yes auth_mechanisms = plain login auth_username_format = %Ln auth_verbose = yes first_valid_gid = 1000 first_valid_uid = 1000 imap_client_workarounds = delay-newmail last_valid_gid = 1000 last_valid_uid = 1000 log_path = /tmp/dovecot mail_gid = 1000 mail_location = maildir:/var/mail/on2it/%Ln mail_uid = 1000 maildir_very_dirty_syncs = yes namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = /usr/local/etc/dovecot/checkpassword-on2it driver = checkpassword } protocols = imap service auth-worker { user = root } service auth { unix_listener /var/spool/postfix/private/auth { mode = 0666 } unix_listener auth-userdb { group = postfix mode = 0666 user = postfix } } service imap-login { inet_listener imap { port = 143 } } shutdown_clients = no ssl = no userdb { args = uid=1000 gid=1000 home=/var/mail/on2it/%Ln driver = static } valid_chroot_dirs = /var/mail/on2itn2it

1 1

[Dovecot] Tracking logins
by Alex 03 Mar '14

03 Mar '14

Hi, I'm using dovecot-2.1.17 on fc18 and wondered if there is some mechanism, perhaps a database, that can store the logins/logouts for each user? I realize there's something already logged to syslog, but I'd like more of a history. While lastlog is great for users that actually login, my dovecot users don't login, just check email via pop and imap. Any ideas greatly appreciated. Thanks, Alex

3 5

[Dovecot] maildir quota divergence
by Juan Carlos Sanchez 03 Mar '14

03 Mar '14

Hello; We are using maildir quotas and have found differences in many users in respect to what system command are showing and doveadm quotas. For example, four user test, we have: doveadm quota get -u test Quota name Type Value Limit % STORAGE 98066 102400 95 MESSAGE 883 - 0 But if we check user mail_location with "du" system command we get he is using 70458 Kb. We are running dovecot 2.1.17 ¿any clue? Thanks in advance.

3 5

[Dovecot] running postlogin script result in libgcc_s.so.1 must be installed for pthread_cancel to work
by Kim Johansen 02 Mar '14

02 Mar '14

Hey, I try to run a postlogin script with: service pop3 { executable = pop3 postlogin } service postlogin { executable = script-login /etc/dovecot/popafter.sh user = $default_internal_user unix_listener postlogin { } } In my popafter.sh I call a php script, and that result in: dovecot: postlogin: Error: libgcc_s.so.1 must be installed for pthread_cancel to work dovecot: postlogin: Error: Aborted (core dumped) I have tried google it, but cannot find a solution there works for me, anybody who can help me? mail dovecot $ sudo dovecot -n # 2.0.19: /etc/dovecot/dovecot.conf # OS: Linux 3.2.0-59-generic x86_64 Ubuntu 12.04.4 LTS ext4 disable_plaintext_auth = no mail_location = maildir:/var/mail/vmail/%d/%n:INDEX=/var/mail/vmail/%d/%n/indexes mail_plugins = quota passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } plugin { quota = maildir:User quota quota_exceeded_message = The user you are trying to reach is over quota. quota_rule = *:bytes=100M quota_rule2 = INBOX.Trash:storage=+20%% } protocols = " imap lmtp pop3" service imap { executable = imap postlogin } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } service pop3 { executable = pop3 postlogin } service postlogin { executable = script-login /etc/dovecot/popafter.sh user = $default_internal_user } ssl_cert = </etc/ssl/certs/dovecot.pem ssl_key = </etc/ssl/private/dovecot.pem userdb { driver = prefetch } protocol imap { mail_plugins = quota imap_quota } Thanks, Kim

4 6

[Dovecot] No speed improvement with FTS for iOS 7?
by Nicholas Riley 02 Mar '14

02 Mar '14

Hi, I recompiled Dovecot with Lucene FTS to try to improve iOS 7 IMAP search speed. Unfortunately this does not seem to help. I have 60 mailboxes, totaling 300 MB; lucene-indexes is 30 MB in size. % doveadm mailbox status -t all '*' messages=16335 recent=0 unseen=1736 vsize=280049586 Searching for a single word which is present in two messages of one mailbox takes 40 seconds to return. This is true whether or not fts is enabled. doveadm search takes much less than 1 second to do the same search. % time doveadm search BODY cython d8f09230c97af952b60c0000c1443b93 1 d8f09230c97af952b60c0000c1443b93 2 doveadm search BODY cython 0.18s user 0.05s system 99% cpu 0.230 total With fts disabled, it takes about 6.5 seconds. This is still a long way from 40 seconds. Is there any way I can make dovecot perform better here? Thanks, -- Nicholas Riley <njriley(a)illinois.edu>

3 3

[Dovecot] Dsync replication with LDAP and auth_bind=yes
by Michał Franczak 02 Mar '14

02 Mar '14

Hello, I have working dovecot configuration with LDAP based authentication in Active Directory. I'd like to use dsync replication but dovecot can't do user lookups. Is it possible to configure replication in such architecture? doveadm user '*' Returns only one local dovecot user. dovecot --version 2.2.10 My dovecot-ldap.conf look as follows: hosts = ad.domain.com:389 ldap_version = 3 auth_bind = yes dn = src_mail_ldap dnpass = somePass base = OU=users,DC=domain,DC=com scope = subtree deref = never user_filter = (&(userPrincipalName=%u)(objectClass=person)(!(userAccountControl:1.2.840.113556.1.4.803:=2))) pass_filter = (&(userPrincipalName=%u)(objectClass=person)(!(userAccountControl:1.2.840.113556.1.4.803:=2))) pass_attrs = userPassword=password default_pass_scheme = CRYPT user_attrs = =home=/var/vmail/vmail1/%Ld/%Ln/Maildir/,=mail=maildir:/var/vmail/vmail1/%Ld/%Ln/Maildir/ Best Regards -- Michal

1 0

[Dovecot] Pluggable mailstore
by Jesus Cea 02 Mar '14

02 Mar '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Reading the archives I see messages from a long (years) time ago discussing pluggable mailstores. No recent news, though. Any progress?. Current status? Regards - -- Jesús Cea Avión _/_/ _/_/_/ _/_/_/ jcea(a)jcea.es - http://www.jcea.es/ _/_/ _/_/ _/_/ _/_/ _/_/ Twitter: @jcea _/_/ _/_/ _/_/_/_/_/ jabber / xmpp:jcea@jabber.org _/_/ _/_/ _/_/ _/_/ _/_/ "Things are not so easy" _/_/ _/_/ _/_/ _/_/ _/_/ _/_/ "My name is Dump, Core Dump" _/_/_/ _/_/_/ _/_/ _/_/ "El amor es poner tu felicidad en la felicidad de otro" - Leibniz -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQEcBAEBCAAGBQJTEruXAAoJEGjgN61Khv5D0hMIAK8fH6Qu+fvliQXjpTFutJ9r nw86mVM5OjPtNKw3O4/0/SfiM+/36rrT53rThbb/guDAIkNwt05NgfIbjdd74jRw 8U+CzoG/fVDe9jV2tzy5UThogVALKSxj1+EQrTk3PwepF68NZYb+s1ZDrfga7LKG F0+wt+XGTga4hIIkPGHoEDCQHX5Z2VpZwItsPXIta1Dv+ObeJtVcv11xL6raf3R2 0FFF1fj0OcKuGFBNH9cKiFTq5jvHb3QzK2205VDpsv5rnNnYZT9pbFHrtZ3Qk6O9 nxKSQVjRjf2pGMo9mjD/qxq/LUQFUVkJFdeueN/Z9KWeqm6MC/n16GCYBYgWpXU= =LrP4 -----END PGP SIGNATURE-----

1 0

[Dovecot] + prefix in dovecot-virtual
by Nicholas Riley 01 Mar '14

01 Mar '14

Hi, The "+" prefix in dovecot-virtual does not seem to be documented. only discovered it because I tried to include a mailbox whose name began with + and Dovecot gave me an error when I tried to copy to it. I see it was added here: http://hg.dovecot.org/dovecot-2.2/rev/be0f0de75e34 My dovecot-virtual file looked like this: !+/2014-03 +/2014-02 all I just added another + to the second line and it seems to work. I don't care about \Recent thankfully but is there a better way to specify a mailbox whose name begins with +? Thanks. -- Nicholas Riley <njriley(a)illinois.edu>

1 0

[Dovecot] Force SSL authentication per user basis
by Urban Loesch 28 Feb '14

28 Feb '14

Hi, I'm searching a way to force encrypted connections for POP3/IMAP on a per user basis. To not break clients which still connect in plaintext (there are still many of it) I must implement a mechanism to force encrypted connections on a per user basis. The users and passwords are stored in a mysql database. So there would be no problem to expand the database with a column like "ssl_tls" -> yes/no. The problem now: how can I get dovecot to process this field in the right way? I searched the list and googled about such a way, but I can't find any solution. My Dovecot version is 2.2.12. Many thanks and regards Urban Loesch

1 1