February 2011 - dovecot

[Dovecot] Error message with static userdb
by Carsten Laun-De Lellis 10 Feb '11

10 Feb '11

Hi all I am trying to migrate to dovecot 2.0.9 Dovecot starts without warnings but when I try to connect with a client I always got this error message in the log file: Feb 10 12:57:36 v37143 dovecot: master: Dovecot v2.0.9 starting up (core dumps disabled) Feb 10 12:57:56 v37143 dovecot: auth: Fatal: static userdb: Empty key (=) Feb 10 12:57:56 v37143 dovecot: master: Error: service(auth): command startup failed, throttling Feb 10 12:58:31 v37143 dovecot: imap-login: Error: Timeout waiting for handshake from auth server. my pid=17537, input bytes=0 Feb 10 12:58:56 v37143 dovecot: auth: Fatal: static userdb: Empty key (=) Feb 10 12:58:56 v37143 dovecot: master: Error: service(auth): command startup failed, throttling Feb 10 12:59:26 v37143 dovecot: imap-login: Error: Timeout waiting for handshake from auth server. my pid=17537, input bytes=0 Feb 10 12:59:26 v37143 dovecot: imap-login: Disconnected (no auth attempts): rip=217.91.177.10, lip=89.202.2.143 This is the output of dovecot n: # 2.0.9: /usr/local/etc/dovecot/dovecot.conf # OS: Linux 2.6.18-028stab070.14 x86_64 Ubuntu 10.04.1 LTS reiserfs auth_mechanisms = plain login disable_plaintext_auth = no hostname = v37143.1blu.de mail_location = maildir:/vmail/%d/%n managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date namespace { inbox = yes location = maildir:/vmail/%d/%n prefix = separator = / type = private } passdb { args = /scripts/sql/dovecot/user_auth.sql driver = sql } plugin { sieve = ~/.dovecot.sieve sieve_dir = ~/sieve sieve_global_dir = /var/lib/dovecot/sieve/global sieve_global_path = /var/lib/dovecot/sieve/default.sieve } postmaster_address = root(a)delellis.net protocols = imap service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } unix_listener auth-userdb { mode = 0660 user = vmail } } ssl_cert = </certs/mail/mailpublic.pem ssl_key = </certs/mail/mailkey.pem userdb { args = uid=vmail gid=vmail home=/var/vmail/%d/%n allow_all_users = yes driver = static } protocol lda { mail_plugins = " sieve" } Any ideas ? Mit freundlichem Gruß Carsten Laun-De Lellis Dipl.-Ing. Elektrotechnik Certified Information Systems Auditor (CISA) Hauptstrasse 13 D-67705 Trippstadt Phone: +49 (6306) 992140 Mobile: +49 (151) 27530865 email: <mailto:carsten.laun-delellis@delellis.net> carsten.laun-delellis(a)delellis.net

2 1

[Dovecot] IMAP subfolders and MDBOX
by Frank Bonnet 10 Feb '11

10 Feb '11

Hello We actually use MBOX format on our mailhub but this does not permit to create IMAP subfolders. Many users are asking me fot this feature and I agree with them of course. My problem is to choose the format that will permit imap subfolders creation. Maildir is not my favorite format and I wonder about MDBOX. Does it permit imap subfolders creation ? It is possible to convert from MBOX to MDBOX in one shot ? Is it stable / mature enoug for a production server ( 4000 users ) ? Thank you

3 5

[Dovecot] /var/mail/<user> and mail group privileges
by Michal Hlavinka 10 Feb '11

10 Feb '11

Hi Timo, I'm facing problem with mail group privileges (again), because I've heard a few complains. I was looking at old emails and list archives, but still does not know the answer. In default (fedora/rhel) setup mail group and 0660 privileges are used. This means that when mail_location = mbox:~/mail:INBOX=/var/mail/%u is used, dovecot fails with first (and only first) attempt to select inbox (imap) or login (pop3). Shouldn't mkdir and chown make together a transaction? When it fails just for first time, it confuses some admins (this is the reason why I'm getting complains (bug reports) just because missing/wrong configuration). I think it a) should work even for first connection (ignore chown failure) or b)it should not work for following connection, so the behavior should be more consistent. Also it seems unclear what configuration option is required for making this work in new dovecot versions where configuration is split to mail_privileged_group and mail_access_groups. I see that after reading documentation in 10-mail.conf, some admins expects mail_privileged_group to be enough while mail_access_group is required to prevent fchown failure. Would it be possible to explicitly mention in the config file what option is required? I can add patch with this to our rpm, but we always prefer to be as close to the upstream as possible. Thanks Michal

2 4

[Dovecot] LDAP quota groups
by ian+dovecot＠comtek.co.uk 10 Feb '11

10 Feb '11

Is there any way to have a per-LDAP-group quota? The OpenLDAP folk's suggestions are to hack the source for an overlay (ideal, but it looks somewhat involved) or to do it at the application (Dovecot). I've added an LDAP userattr 'quotaMegaBytes' which is great for allowing me to override the server's default quota on a per-user basis, but ideally I'd be able to override the quota only for people who are member of a certain LDAP group. Perhaps I could override it for IMAP sessions with a postlogin script, but I can't see any way to apply it to deliver. Thanks for any suggestions, Ian

1 0

[Dovecot] Access rights after dsync
by Joan Moreau 10 Feb '11

10 Feb '11

Hi, It looks like the access rights are not correctly preserved after a dsync I have rwXr-X-- from my original folder (which is right) I have rwXrwXrwX in the "mirrored" fodler (which is very wrong) Not sure what cause this, but it looks like a bug Best, jm

2 1

[Dovecot] Dovecot 2.0.7 doesn't disassociate STDERR when it daemonizes.
by Virgil Champlin 10 Feb '11

10 Feb '11

At least it appears that way on my FreeBSD 8.1 system. This is probably unnoticeable in regular use but I happen to use CFengine(v2) for system configuration & monitoring. If it notices dovecot not running it tries to start it and hangs. I believe cfengine (cfagent) has created a pipe to monitor the start commmand's stderr and is waiting for this pipe to close. This never happens because the pipe has been inherited by dovecot which, in version 2, doesn't release stderr as part of its daemonization. Although cfengine could be more defensive, I believe dovecot should be disassociating from the inherited stderr. Looking at master/main.c, I see stdin, stdout & stderr being set to /dev/null in main() if they are inherited unassigned: do { null_fd = open("/dev/null", O_WRONLY); if (null_fd == -1) i_fatal("Can't open /dev/null: %m"); fd_close_on_exec(null_fd, TRUE); } while (null_fd <= STDERR_FILENO); But stderr is missing when a later dup2() is used to release any inherited values not covered by the above: if (dup2(null_fd, STDIN_FILENO) < 0 || dup2(null_fd, STDOUT_FILENO) < 0) i_fatal("dup2(null_fd) failed: %m"); Adding a dup2 for stderr to the above statement works in my simple test case but I'm unsure if there are other issues which may require delaying it. Dovecot 1.2.16 approaches this a little differently & does slightly delay the stderr dup2. The appended diff (v2.0.7) works for me but a more informed opinion might have a better suggestion. Thank you very much for your time. I just started using Dovecot and really like it. -virgil --- main.c.orig 2010-11-04 11:58:48.000000000 -0700 +++ main.c 2011-01-05 18:11:45.000000000 -0800 @@ -717,7 +717,8 @@ } if (dup2(null_fd, STDIN_FILENO) < 0 || - dup2(null_fd, STDOUT_FILENO) < 0) + dup2(null_fd, STDOUT_FILENO) < 0 || + dup2(null_fd, STDERR_FILENO) < 0) i_fatal("dup2(null_fd) failed: %m"); pidfile_path = -=-=-=-=-=-=-=-=-=-=-

2 1

[Dovecot] login_trusted_networks (v2.0.8)
by Don Buchholz 10 Feb '11

10 Feb '11

I just spent a bit puzzling over "login_trusted_networks". My problem was using "10.1.2/24" instead of "10.1.2.0/24". Here are some things I looked for during troubleshooting that didn't pan out: (1) No messages printed to syslog. (2) Search for "login_trusted_networks" on the Wiki (wiki2) failed. (3) Comments in example config file didn't specify expected format. Anyway, it works now. <shrug> - Don =================== 'doveconf -n' (redacted): > *[root@postal ~]# **doveconf -n* > # 2.0.8: /etc/dovecot/dovecot.conf > # OS: Linux 2.6.9-67.0.1.ELsmp i686 Red Hat Enterprise Linux WS > release 4 (Nahant Update 6) ext3 > auth_username_format = %Lu > auth_verbose = yes > auth_verbose_passwords = sha1 > login_log_format_elements = user=<%u> service=%Us method=%m rip=%r > lip=%l mpid=%e %c > login_trusted_networks = xx.xx.x.0/24 xx.xx.xx.0/23 > mail_location = maildir:/Virtual_Users/%u/Mail > passdb { > driver = pam > } > passdb { > args = scheme=CRYPT username_format=%u /etc/dovecot/users > driver = passwd-file > } > ssl_ca = </etc/dovecot/ssl/iMove_2011_CAcert.pem > ssl_cert = </etc/dovecot/ssl/postal_cert.pem > ssl_key = </etc/dovecot/ssl/postal_key+req.pem > ssl_key_password = ******** > ssl_parameters_regenerate = 12 > userdb { > driver = passwd > } > userdb { > args = username_format=%u /etc/dovecot/users > driver = passwd-file > } > verbose_proctitle = yes > protocol imap { > ssl_cert = </etc/dovecot/ssl/imap_cert.pem > ssl_key = </etc/dovecot/ssl/imap_key+req.pem > ssl_key_password = </etc/dovecot/ssl/imap.pw > } > protocol pop3 { > ssl_cert = </etc/dovecot/ssl/pop3_cert.pem > ssl_key = </etc/dovecot/ssl/pop3_key+req.pem > ssl_key_password = </etc/dovecot/ssl/pop3.pw > } > *[root@postal ~]#*

2 1

[Dovecot] Error: FETCH [1] for mailbox badbox UID 1 got too little data: 2 vs 4
by Chris Wilson 10 Feb '11

10 Feb '11

Hi all, I can send myself a test message that causes Dovecot to crash when I open it in Alpine, with the following error: Jan 12 14:52:52 one-mail dovecot: imap(chris): Error: FETCH [1] for mailbox badbox UID 1 got too little data: 2 vs 4 Jan 12 14:52:52 one-mail dovecot: imap(chris): Error: Corrupted index cache file /home/chris/mail/.imap/badbox/dovecot.index.cache: Broken MIME parts for mail UID 1 Jan 12 14:52:52 one-mail dovecot: imap(chris): Disconnected: FETCH failed bytes=485/1394 I can do this as follows: $ touch ~/mail/badbox $ echo test | /usr/libexec/dovecot/dovecot-lda -m badbox $ cat ~/mail/badbox >From MAILER-DAEMON Wed Jan 12 14:52:29 2011 test X-IMAPbase: 1294843949 0000000001 X-UID: 1 Status: X-Keywords: Content-Length: 1 And then when I try to open badbox in Alpine (over IMAP), and then open this email, I get the error above, and the connection is aborted. I expect that the "test" line is not a valid header, but dovecot should not crash when opening it. Cheers, Chris. -- Aptivate | http://www.aptivate.org | Phone: +44 1223 760887 The Humanitarian Centre, Fenner's, Gresham Road, Cambridge CB1 2ES Aptivate is a not-for-profit company registered in England and Wales with company number 04980791.

2 1

[Dovecot] Panic: file mailbox-list-maildir.c: line 133: unreached
by Holger Mauermann 10 Feb '11

10 Feb '11

I converted personal mailboxes from maildir to sdbox. Public mailboxes are still in maildir format, because I need per-user seen flags. However, if the user is subscribed to public mailboxes and the client sends 'LIST (SUBSCRIBED) "" *', dovecot crashes with: imap(holger(a)mauermann.org): Panic: file mailbox-list-maildir.c: line 133: unreached imap(holger(a)mauermann.org): Error: Raw backtrace: /usr/lib/dovecot/libdovecot.so.0(+0x3756a) [0x7f25f7b1456a] -> /usr/lib/dovecot/libdovecot.so.0(+0x375b6) [0x7f25f7b145b6] -> /usr/lib/dovecot/libdovecot.so.0(+0x118ca) [0x7f25f7aee8ca] -> /usr/lib/dovecot/libdovecot-storage.so.0(+0x35cce) [0x7f25f7d8acce] -> /usr/lib/dovecot/libdovecot-storage.so.0(mailbox_list_is_valid_pattern+0x26) [0x7f25f7d80146] -> /usr/lib/dovecot/libdovecot-storage.so.0(+0x33a31) [0x7f25f7d88a31] -> /usr/lib/dovecot/libdovecot-storage.so.0(fs_list_iter_next+0x2f) [0x7f25f7d885cf] -> /usr/lib/dovecot/modules/lib01_acl_plugin.so(+0xb658) [0x7f25f6f2c658] -> /usr/lib/dovecot/libdovecot-storage.so.0(mailbox_list_iter_next+0xa) [0x7f25f7d7faba] -> dovecot/imap(+0xc529) [0x7f25f824d529] -> dovecot/imap(cmd_list_full+0x43e) [0x7f25f824e48e] -> dovecot/imap(+0x10dad) [0x7f25f8251dad] -> dovecot/imap(+0x10e8d) [0x7f25f8251e8d] -> dovecot/imap(client_handle_input+0x135) [0x7f25f82520c5] -> dovecot/imap(client_in put+0x62) [0x7f25f8252a22] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_call_io+0x48) [0x7f25f7b1f898] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run+0x9f) [0x7f25f7b2080f] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_run+0x28) [0x7f25f7b1f828] -> /usr/lib/dovecot/libdovecot.so.0(master_service_run+0x13) [0x7f25f7b0dcf3] -> dovecot/imap(main+0x30f) [0x7f25f825b07f] -> /lib/libc.so.6(__libc_start_main+0xfe) [0x7f25f736cd8e] -> dovecot/imap(+0x9279) [0x7f25f824a279] master: Error: service(imap): child 32285 killed with signal 6 (core dumped) This does not happen with 'LSUB "" *' or with personal mailboxes in maildir format. Below is the gdb and doveconf -n output: (gdb) bt full #0 0x00007f25f7381ba5 in raise () from /lib/libc.so.6 No symbol table info available. #1 0x00007f25f73856b0 in abort () from /lib/libc.so.6 No symbol table info available. #2 0x00007f25f7b1457d in default_fatal_finish (type=<value optimized out>, status=0) at failures.c:187 backtrace = 0x7f25f980d468 "/usr/lib/dovecot/libdovecot.so.0(+0x3756a) [0x7f25f7b1456a] -> /usr/lib/dovecot/libdovecot.so.0(+0x375b6) [0x7f25f7b145b6] -> /usr/lib/dovecot/libdovecot.so.0(+0x118ca) [0x7f25f7aee8ca] -> /usr/lib/do"... #3 0x00007f25f7b145b6 in i_internal_fatal_handler (ctx=0x7fff36a6acc0, format=<value optimized out>, args=<value optimized out>) at failures.c:645 status = 0 #4 0x00007f25f7aee8ca in i_panic (format=0x7e1d <Address 0x7e1d out of bounds>) at failures.c:259 ctx = {type = LOG_TYPE_PANIC, exit_status = 0, timestamp = 0x0} args = {{gp_offset = 24, fp_offset = 48, overflow_arg_area = 0x7fff36a6ad90, reg_save_area = 0x7fff36a6acd0}} #5 0x00007f25f7d8acce in maildir_is_valid_pattern (list=<value optimized out>, pattern=<value optimized out>) at mailbox-list-maildir.c:133 No locals. #6 0x00007f25f7d80146 in mailbox_list_is_valid_pattern (list=0x7f25f98422d0, pattern=0x7f25f980d410 "public") at mailbox-list.c:651 _data_stack_cur_id = 0 ret = <value optimized out> #7 0x00007f25f7d88a31 in fs_list_subs (ctx=0x7f25f9818b70) at mailbox-list-fs-iter.c:683 node = <value optimized out> flags = MAILBOX_SUBSCRIBED ns = <value optimized out> path = <value optimized out> dir = <value optimized out> fname = <value optimized out> storage_name = 0x7f25f980d410 "public" len = 0 st = {st_dev = 139801076486872, st_ino = 19, st_nlink = 139801053739543, st_mode = 128, st_uid = 0, st_gid = 1, __pad0 = 0, st_rdev = 139801046211004, st_size = 206158430224, st_blksize = 140734110281536, st_blocks = 140734110281344, st_atim = {tv_sec = 579820584960, tv_nsec = 139801076651024}, st_mtim = {tv_sec = 139801076728920, tv_nsec = 139801076766928}, st_ctim = {tv_sec = 139801076486872, tv_nsec = 536871048}, __unused = {128, 139801076731466, 139801046189669}} #8 0x00007f25f7d885cf in fs_list_iter_next (_ctx=0x7f25f9818b70) at mailbox-list-fs-iter.c:356 _data_stack_cur_id = 0 info = <value optimized out> __FUNCTION__ = "fs_list_iter_next" #9 0x00007f25f6f2c658 in acl_mailbox_list_iter_next_info (_ctx=<value optimized out>) at acl-mailbox-list.c:205 alist = 0x7f25f9835410 #10 acl_mailbox_list_iter_next (_ctx=<value optimized out>) at acl-mailbox-list.c:372 ctx = 0x7f25f98163f0 info = 0x7f25f98518d0 ret = <value optimized out> #11 0x00007f25f7d7faba in mailbox_list_iter_next (ctx=0x7e1d) at mailbox-list.c:1029 info = <value optimized out> #12 0x00007f25f824d529 in list_namespace_mailboxes (cmd=<value optimized out>) at cmd-list.c:377 info = 0x80 flags = 536871048 str = 0x7f25f980d2d8 ret = 1 ns = 0x0 name = 0x7f25f98518d0 "Public/public" #13 cmd_list_continue (cmd=<value optimized out>) at cmd-list.c:792 _data_stack_cur_id = 4 ctx = 0x7f25f9848458 #14 0x00007f25f824e48e in cmd_list_full (cmd=0x7f25f9848350, lsub=false) at cmd-list.c:957 client = 0x7f25f9847be0 args = 0x7f25f984ac08 list_args = 0x7f25f984acd0 arg_count = <value optimized out> ctx = 0x7f25f9848458 patterns = {arr = {buffer = 0x7f25f98484a8, element_size = 8}, v = 0x7f25f98484a8, v_modifiable = 0x7f25f98484a8} pattern = 0x7f25f984adc8 "*" patterns_strarr = <value optimized out> #15 0x00007f25f8251dad in client_command_input (cmd=0x7f25f9848350) at imap-client.c:661 client = 0x7f25f9847be0 command = <value optimized out> __FUNCTION__ = "client_command_input" #16 0x00007f25f8251e8d in client_command_input (cmd=0x7f25f9848350) at imap-client.c:711 client = 0x7f25f9847be0 command = 0x0 __FUNCTION__ = "client_command_input" #17 0x00007f25f82520c5 in client_handle_next_command (client=0x7f25f9847be0) at imap-client.c:752 size = 26 #18 client_handle_input (client=0x7f25f9847be0) at imap-client.c:764 _data_stack_cur_id = 3 ret = false remove_io = <value optimized out> handled_commands = false __FUNCTION__ = "client_handle_input" #19 0x00007f25f8252a22 in client_input (client=0x7f25f9847be0) at imap-client.c:803 cmd = <value optimized out> output = 0x7f25f98481c8 bytes = <value optimized out> __FUNCTION__ = "client_input" #20 0x00007f25f7b1f898 in io_loop_call_io (io=0x7f25f9848260) at ioloop.c:383 ioloop = 0x7f25f98155e0 t_id = 2 #21 0x00007f25f7b2080f in io_loop_handler_run (ioloop=<value optimized out>) at ioloop-epoll.c:213 ctx = 0x7f25f9815810 event = 0x7f25f9815880 list = 0x7f25f98482b0 io = 0x7e1d tv = {tv_sec = 1782, tv_usec = 549357} msecs = <value optimized out> ret = <value optimized out> i = 0 call = false #22 0x00007f25f7b1f828 in io_loop_run (ioloop=0x7f25f98155e0) at ioloop.c:404 No locals. #23 0x00007f25f7b0dcf3 in master_service_run (service=0x7f25f98154b0, callback=0x7e1d) at master-service.c:484 No locals. #24 0x00007f25f825b07f in main (argc=1, argv=0x7f25f9815370) at main.c:375 set_roots = {0x7f25f8460da0, 0x0} service_flags = <value optimized out> storage_service_flags = <value optimized out> postlogin_socket_path = 0x0 username = 0x0 c = <value optimized out> # 2.0.9: /etc/dovecot/dovecot.conf # OS: Linux 2.6.35-23-virtual x86_64 Ubuntu 10.10 auth_debug = yes auth_mechanisms = plain login digest-md5 cram-md5 apop disable_plaintext_auth = no lmtp_save_to_detail_mailbox = yes mail_debug = yes mail_location = sdbox:~/dbox:DIRNAME=.dbox-mails mail_plugins = " quota acl zlib lazy_expunge" managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date namespace backup { hidden = yes list = no location = sdbox:~/expunged:DIRNAME=.dbox-mails prefix = .EXPUNGED/ separator = / type = private } namespace other { list = children location = sdbox:%%h/dbox:DIRNAME=.dbox-mails prefix = Shared/%%u/ separator = / subscriptions = no type = shared } namespace pub { list = children location = maildir:/var/spool/imap/public:INDEX=~/public prefix = Public/ separator = / subscriptions = no type = public } namespace user { inbox = yes location = prefix = separator = / type = private } passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } plugin { acl = vfile acl_shared_dict = file:/var/spool/imap/shared-mailboxes.dict lazy_expunge = .EXPUNGED/ quota = dict:::file:%h/dbox/dovecot-quota quota_rule = *:storage=1G quota_rule2 = Trash:storage=+50M sieve = ~/.dovecot.sieve sieve_dir = ~/sieve } protocols = imap pop3 sieve rejection_subject = Mail delivery failed: %s service auth { unix_listener auth-exim { user = Debian-exim } unix_listener auth-userdb { user = vmail } } service lmtp { inet_listener lmtp { port = 24 } } service managesieve-login { inet_listener sieve { port = 4190 } inet_listener sieve_deprecated { port = 2000 } } ssl_cert = </etc/ssl/certs/dovecot.pem ssl_key = </etc/ssl/private/dovecot.pem userdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } protocol lmtp { mail_plugins = " quota acl zlib lazy_expunge sieve" } protocol lda { mail_plugins = " quota acl zlib lazy_expunge sieve" } protocol imap { mail_plugins = " quota acl zlib lazy_expunge imap_quota imap_acl imap_zlib" } protocol pop3 { pop3_client_workarounds = outlook-no-nuls oe-ns-eoh }

2 1

[Dovecot] courier-imap to dovecot-imap migration: missing TLS_TRUSTCERTS feature
by Uffe Jakobsen 10 Feb '11

10 Feb '11

Hi, I'm attempting an one-to-one migration from courier-imap to dovecot-imap. current state: Imap-server has a self signed certificate Every client/user has a self signed client certificate that is used for SSL/TLS client authentication. All certificates are self signed "standalone" cerfificates - no CA hierarchy/structure is made. With courier-imap we could just put every client certificate into a trusted cert file (or hashed directory for a larger number of clients) and courier-imap would check that through TLS_TRUSTCERTS. I would like to keep the current appproach and avoid the whole mini CA setup - that way I can also avoid reissuing new certs to all existing users. Question: can a similar setup be achieved with dovecot-imap ? I've already made numerous attempts with no luck. As far as I can see dovecot-imap does not seem to implement the concept of checking trusted (self signed standalone client) certs - even though it is based on openssl like courier-imap is - but I may be wrong here. I'm using dovecot-2.0.7 (from ports) on FreeBSD Thanks in advance. Kind regards Uffe Jakobsen

2 1