[Dovecot] inetd & corrupt environment

[Benjamin R. Haskell]

On Sun, 25 May 2008, Gelu G. Lupas wrote:

> Hello. I'm having the following problem with dovecot 1.0.12 and above, on a 
> FreeBSD 7.0 system - I'm trying to run pop3-login from inetd and I keep 
> getting this error after authentication:
>
> May 25 09:46:19 charlie dovecot: POP3(gelu): /libexec/ld-elf.so.1: 
> environment corrupt; missing value for no-nuls oe-ns-eoh
>
> The problem persists if I uncomment the lines with no-nuls oe-ns-eoh in 
> dovecot.conf. I've also tried running pop3-login from tcpserver/ucspi-tcp and 
> I still get the same error.  Version 1.0.1 works fine on a similar setup. 
> Please reply if you have any idea regarding a fix for this error. I need to 
> run dovecot under a tcp wrapper of some kind (preferably inetd) as the 
> standalone daemon doesn't allow any method to restrict access by IP. The 
> allow_nets extra field doesn't help much as I'm using PAM and do not want to 
> maintain yet another passdb. Restricting access via firewall rules is not an 
> option. Until I find a way to restrict access by IP address, dovecot will 
> only listen on the private IP address (192.168.100.1).

Dovecot does quite a bit of setup for child processes via environment 
variables. Maybe you could use the standalone server to run a test login, 
see what environment variables get set through a script, and set up an 
envdir (part of daemontools). Then turn off the standalone server.

e.g. (partially tested)

in /root/testing.pl (chmod +x)

#!/usr/bin/perl
$dir = "/root/dovecot-env";
mkdir $dir unless -d $dir;
while (my ($k, $v) = each %ENV) {
     open my $f, '>', "$dir/$k" or next;
     $v =~ tr/\n/\0/;
     print $f "$v\n";
}
exec "/usr/libexec/dovecot/pop3-login";

and, in dovecot.conf:

protocol pop3 {
#...
login_executable=/root/testing.pl


Then, attempt to login.

then, via ucspi-tcp:

instead of tcpserver [options] pop3-login
use        tcpserver [options] envdir /root/dovecot-env pop3-login

I don't use inetd, but I'm sure a similar change could be made.


Alternatively, and far easier, would be to do something with a static db 
in dovecot that only has allow_nets={whatever you want}. I'm pretty sure 
you can have portions of user info returned via different mechanisms. (So, 
you'd also specify an auth db of 'PAM'.) If you don't need different 
allow_nets for different users, that'd be pretty simple. [I don't recall 
specifics on how to do this, though, so I might be off base.]

Best,
Ben