August 2011 - dovecot

[Dovecot] mail delivery location wrong
by Firma Averlon 08 Aug '11

08 Aug '11

Hi, thanks for offering the oportunity to place a question here. I am now already working since a week to get postfix and dovecot working on a ubuntu 11.04 server. Hard task. First step was naturally to get familiar with the idea behind the archtitecture. I have come very far, but the "last dirty mile" is probably the hardest. My architecture: Postfix Dovecot OpenLDAP Thunderbird as client with pop3 I can meanwhile send e-mails and open my mailbox in thunderbird (not receiving mails so far). The reason why not receiving e-Mails is simply: When sending the mails they are stored in a different directory as where dovecot will look for them !!!! Error message from log: Aug 8 14:09:01 server dovecot: deliver(vmail): maildir: data=/home/vmail//vmail/Maildir Aug 8 14:09:01 server dovecot: deliver(vmail): maildir: data=/home/vmail//vmail/Maildir Aug 8 14:09:01 server dovecot: deliver(vmail): maildir++: root=/home/vmail//vmail/Maildir, index=, control=, inbox=/home/vmail//vmail/Maildir Aug 8 14:09:01 server dovecot: deliver(vmail): maildir++: root=/home/vmail//vmail/Maildir, index=, control=, inbox=/home/vmail//vmail/Maildir What you immediatly see: "vmail//vmail" Although, when authenticating, the result is: Aug 8 14:06:30 server dovecot: auth(default): master out: USER#0113#011userxxx@av.loc#011gid=5000#011home=/home/userxxx#011uid=5000#011mail=/home/vmail/av.loc/userxxx/Maildir/ The following settings are in place: main.cf of postfix: virtual_mailbox_domains = /etc/postfix/vhosts virtual_mailbox_base = /home/vmail virtual_mailbox_maps = ldap:/etc/postfix/ldap-virtual.cf virtual_minimum_uid = 1000 virtual_uid_maps = static:5000 virtual_gid_maps = static:5000 virtual_transport = dovecot mailbox_command = /usr/lib/dovecot/deliver beside others. master.cf of postfix dovecot unix - n n - - pipe flags=DRhu user=vmail:vmail argv=/usr/lib/dovecot/deliver -f ${sender} -a ${recipient} dovecot.conf sendmail_path = /usr/sbin/sendmail mail_location = maildir:/home/vmail/%d/%n/Maildir beside others. I guess, these are the ones influencing where to store the mail and pick it up. A list of the related filesystem: /home/vmail/ drwx-w--w- 4 vmail vmail 4096 2011-08-08 08:56 av.loc/ drwx------ 3 vmail vmail 4096 2011-08-08 09:42 vmail/ Wher you can see, the structure according "mail_location" parameter of dovecot.conf does show effect, but the mails are stored in /home/vmail//vmail.....". The whole bunch of documentation I have read meanwhile makes my head circle around. You could hopefully give me some help. -- Mit freundlichen Grüßen / Kind Regards Hr. Karl-Heinz Fischbach

4 5

[Dovecot] How to make dovecot-lda/deliver mark a message as seen
by Stefan Piegsa 08 Aug '11

08 Aug '11

Hello everybody, I am using dovecot 2.0.13 and have a special case here in which I want a mail that is delivered locally with dovecot-lda to be marked as "seen". In dovecot 1.1.7 I succeeded to achive this, by modifing deliver.c so that upon adding a -S switch to the command arguments, the flag MAIL_SEEN was added to the call of mailbox_copy(). This seemed to work pretty good. With the new version, i tried to do something similar by selectively adding mail_update_flags(ctx.src_mail, MODIFY_ADD, MAIL_SEEN); just before the call of mail_deliver(), whenever the -S argument is given. But this does not work. What is wrong? Is there a better way to set MAIL_SEEN for a locally delivered mail? I would prefer a method that does not require to mess around in the dovecot sources. :-) Thanks in advance & Best Regards, Stefan

2 2

[Dovecot] Dovecot + LDAP login issues
by ml lists 07 Aug '11

07 Aug '11

Morning all, I've managed to work my self into a corner and hoping someone can help me out I have OpenLDAP and Dovecot installed based on the following documents: https://help.ubuntu.com/community/DovecotLDAP https://help.ubuntu.com/community/OpenLDAPServer When Dovecot is set up to log in without using LDAP, connections work fine. However as soon as I change the dovecot.conf to use ldap I get the following error when trying to log in: error in syslog: dovecot: auth(default): ldap(myuser,10.10.10.10): invalid credentials (given password: myuserpasswd) dovecot: auth(default): client out: FAIL#0112#011user=myuser I have checked via phpLDAPadmin that the password I am entering matches what is in the database, so from what I can see the issue lies in how Dovecot is passing the password to openLDAP, though I may be way off base here. No special characters in the passphrase other than spaces. Would anyone be able to shed some light on this? Server Setup and Dovecot Config Ubuntu Server 11.04 # uname -a Linux base 2.6.38-10-server #46-Ubuntu SMP Tue Jun 28 16:31:00 UTC 2011 x86_64 x86_64 x86_64 GNU/Linux[ # slapd -V @(#) $OpenLDAP: slapd 2.4.23 (Apr 7 2011 18:00:55) $[/CODE][CODE] # dovecot --version 1.2.15 # cat dovecot.conf base_dir = /var/run/dovecot/ protocols = imaps imap listen = * disable_plaintext_auth = no shutdown_clients = yes log_timestamp = "%Y-%m-%d %H:%M:%S " ###ssl_disable = no ssl_cert_file = /etc/ssl/private/mail_mydomain_com.crt ssl_key_file = /etc/ssl/private/mail_mydomain_com.key ssl_ca_file = /etc/ssl/private/comodo-bundle.crt mail_location = maildir:/home/MAIL/%n mail_privileged_group = mail mail_debug = yes protocol imap { ### login_greeting_capability = yes imap_client_workarounds = tb-extra-mailbox-sep } protocol lda { postmaster_address = postmaster(a)mydomain.com hostname = base auth_socket_path = /var/run/dovecot/auth-master mail_plugins = cmusieve } auth_verbose = no auth_debug = yes auth_debug_passwords = yes auth default { mechanisms = plain passdb ldap { args = /etc/dovecot/dovecot-ldap.conf } # passdb passwd-file { # args = /etc/dovecot/passwd # } userdb static { args = uid=vmail gid=vmail home=/home/MAIL/%n allow_all_users=yes } user = vmail socket listen { master { path = /var/run/dovecot/auth-master mode = 0600 user = vmail # User running Dovecot LDA group = vmail # Or alternatively mode 0660 + LDA user in this group } } } dict { } plugin { #cat dovecot-ldap.conf (with a number of commented out lines removed) # Space separated list of LDAP hosts to use. host:port is allowed too. hosts= localhost # Distinguished Name - the username used to login to the LDAP server dn= cn=admin,dc=mydomain # Password for LDAP server dnpass = alongpasswd auth_bind = yes auth_bind_userdn = uid=%u,ou=Users,dc=mydomain # LDAP protocol version to use. Likely 2 or 3. ldap_version = 3 # LDAP base. %variables can be used here. base = ou=Users,dc=mydomain # Dereference: never, searching, finding, always deref = never # Search scope: base, onelevel, subtree scope = subtree user_attrs = mail=uid user_filter = (&(objectClass=posixAccount)(uid=%n)) # Password checking attributes: pass_attrs = uid=user,userPassword=password ###,homeDirectory=userdb_home,uidNumber=userdb_uid,gidNumber=userdb_gid # Filter for password lookups pass_filter = (&(objectClass=posixAccount)(uid=%n)) # Default password scheme. "{scheme}" before password overrides this. # List of supported schemes is in: http://wiki.dovecot.org/Authentication default_pass_scheme = MD5

1 0

[Dovecot] Dovecot 2.x configuration
by Vincent Richomme 07 Aug '11

07 Aug '11

Hi, sorry to post about that but I have some issues to migrate my dovecot 1.x to 2.x. I have installed dovecot 2.x package on ubuntu natty(package were generated from sources found in debian testing), and I have modified config files like that : dovecot.conf: ------------- !include_try /usr/share/dovecot/protocols.d/*.protocol listen = *, :: !include conf.d/*.conf !include_try local.conf conf.d/10-auth.conf: --------------------- !include auth-sql.conf.ext so I have uncommented the auth-sql.conf.ext because I want a sql auth but these file is not available so I copied the file ../dovecot-sql.conf.ext and rename it into auth-sql.conf.ext. conf.d/auth-sql.conf.ext: --------------------- driver = mysql connect = host=127.0.0.1 dbname=foobarserver user=foo password=bar default_pass_scheme = PLAIN-MD5 password_query = SELECT email as user, password FROM view_users WHERE email='%u'; When I try to load the config I get the following error : root@sd-30635:/etc/dovecot/conf.d# dovecot -n # 2.0.13 (ba03935cc599): /etc/dovecot/dovecot.conf doveconf: Fatal: Error in configuration file /etc/dovecot/conf.d/auth-sql.conf.ext line 29: Unknown setting: driver doveconf: Error: managesieve-login: dump-capability process returned 89 doveconf: Fatal: Error in configuration file /etc/dovecot/conf.d/auth-sql.conf.ext line 29: Unknown setting: driver I searched on the mailing list and I found an answer but I am still not sure how to solve it. UPDATE : after trying to use my brain I found the solution to my issue but I am still posting to help people that may have the same problem and to make you notice that the current configuration files are not logical. I mean in conf.d/10-auth.conf you can uncomment auth-sql.conf.ext but the file is not available (maybe it's a packaging problem). So I did the following steps : cp conf.d/auth-system.conf.ext conf.d/auth-sql.conf.ext Then I have edited conf.d/auth-sql.conf.ext: passdb { driver = mysql args = /etc/dovecot/dovecot-sql.conf.ext } OK so far so good, next problem is about the old configuration lines : # It's possible to export the authentication interface to other programs: socket listen { master { # Master socket provides access to userdb information. It's typically # used to give Dovecot's local delivery agent access to userdb so it # can find mailbox locations. path = /var/run/dovecot/auth-master mode = 0600 # Default user/group is the one who started dovecot-auth (root) user = vmail #group = } client { # The client socket is generally safe to export to everyone. Typical use # is to export it to your SMTP server so it can do SMTP AUTH lookups # using it. path = /var/run/dovecot/auth-client mode = 0660 } } Where should I put them in the new config file hierarchy ? And do I still need them ? Just for information I have based my mail setup on the following guide : http://workaround.org/ispmail/etch Thanks

2 3

[Dovecot] Blackberries
by The Doctor 06 Aug '11

06 Aug '11

Wonder if anyone knows how to tell a blackberry portable phone how not to get pick up a message it already got in IMAP. -- Member - Liberal International This is doctor(a)nl2k.ab.ca Ici doctor(a)nl2k.ab.ca God, Queen and country! Never Satan President Republic! Beware AntiChrist rising! http://twitter.com/rootnl2k http://www.facebook.com/dyadallee IT is done! http://groups.google.com/group/rec.arts.drwho/about

3 2

[Dovecot] DoveCot LDA prefetch fails with LDA, works with POP client
by Zhou, Yan 05 Aug '11

05 Aug '11

Hi there, I am using DoveCot 1.0.7. I know it is real old, but we have to work with it. I have configured LDAP lookup with password prefetch in DoveCot. I can successfully receive emails through DoveCot, thus proving my password prefetch and user authentication are good. The problem is when I use Postfix to deliver message to DoveCot via LDA. My postfix master.cf looks like this: dovecot unix - n n - - pipe flags=Rhu user=hubdirect null_sender= argv=/usr/libexec/dovecot/deliver -e -f ${sender} -d ${user} Given a message, Postfix looks up LDAP and find the user associated with the recipient address and delivers the message using LDA. LDAP logs indicates that Postfix is returning the right user. The problem is that DoveCot complains "passdb did not return userdb entries", but I do not know which entries passdb failed to return. Here is what I have in dovecot-ldap.conf. I have tried different things in "user_attrs", DoveCot keeps complaining the same thing. user_attrs = username=user user_filter = (&(objectClass=DirectUser)(username=%u)(roles=*ROLE_EDGE_EMAIL*)) pass_attrs = username=user,password=password,username=userdb_user,usermaildirectory=u serdb_mail,userhomedirectory=userdb_home,825=userdb_uid,825=userdb_gid pass_filter = (&(objectClass=DirectUser)(username=%u)(roles=*ROLE_EDGE_EMAIL*)) The documentation says LDA does not use prefetch, but the log seems to indicate otherwise. I clearly see the "service=deliver" is authenticating the user first, thus using password prefetch. Can someone clarify this? Aug 5 15:12:25 dir-dev-pop01 deliver(emailspool): Loading modules from directory: /usr/lib64/dovecot/lda Aug 5 15:12:25 dir-dev-pop01 deliver(emailspool): Module loaded: /usr/lib64/dovecot/lda/lib10_quota_plugin.so Aug 5 15:12:25 dir-dev-pop01 dovecot: auth(default): master in: USER 1 emailspool service=deliver Aug 5 15:12:25 dir-dev-pop01 dovecot: auth(default): prefetch(emailspool): passdb didn't return userdb entries Aug 5 15:12:25 dir-dev-pop01 dovecot: auth(default): ldap(emailspool): user search: base=dc=hubdirect,dc=dev,dc=medplus,dc=com scope=subtree filter=(&(objectClass=DirectUser)(username=emailspool)(roles=*ROLE_EDGE_ EMAIL*)) fields=username Aug 5 15:12:25 dir-dev-pop01 dovecot: auth(default): master out: USER 1 emailspool user=emailspool uid=825 gid=825 Aug 5 15:12:25 dir-dev-pop01 deliver(emailspool): auth input: emailspool Aug 5 15:12:25 dir-dev-pop01 deliver(emailspool): auth input: user=emailspool Aug 5 15:12:25 dir-dev-pop01 deliver(emailspool): auth input: uid=825 Aug 5 15:12:25 dir-dev-pop01 deliver(emailspool): auth input: gid=825 Aug 5 15:12:25 dir-dev-pop01 deliver(emailspool): maildir: data=/home/hubdirect/emailspool/Maildir Aug 5 15:12:25 dir-dev-pop01 deliver(emailspool): maildir: root=/home/hubdirect/emailspool/Maildir, index=/home/hubdirect/emailspool/Maildir, control=, inbox= Aug 5 15:12:25 dir-dev-pop01 deliver(emailspool): msgid=<12097075.28.1312571545112.JavaMail.zhou_y@yzhou-lp2>: saved mail to INBOX Thanks, Yan Confidentiality Notice: The information contained in this electronic transmission is confidential and may be legally privileged. It is intended only for the addressee(s) named above. If you are not an intended recipient, be aware that any disclosure, copying, distribution or use of the information contained in this transmission is prohibited and may be unlawful. If you have received this transmission in error, please notify us by telephone (513) 229-5500 or by email (postmaster(a)MedPlus.com) After replying, please erase it from your computer system.

1 1

[Dovecot] director monitoring?
by Kelsey Cummings 05 Aug '11

05 Aug '11

I'm working the kinks of a new director based setup for the eventual migration away from courier. At this point, with everything basically working I'm trying to ensure that things are properly monitored and I've run into an issue. There doesn't appear to be a way to get dovecot to tell if it is (or is not) connected and properly synced with the other director servers in the ring apart from the logs. It seems like this is an important piece of information -- without it, it isn't apparent how you would be able to tell if your director servers have lost track of each other. I'm also curious what people are doing to health check their director servers when they are running load balancing upstream of them as well. It doesn't seem like it is a good idea to let the load balancers check all the way through to the real servers since a failure on the target real server could end up leading to a director being dropped from the pool (if so, it is most likely that the other directors would be dropped as well.) Otherwise, the health check failure tolerance at the load balancer must be greater than the tolerance for failure of the real servers on the director- a dead director could end up in the pool for longer than desired, or anyway, long enough to be sure that it isn't a transient failure on the real server behind it. A better method would seem to be for the load balancers to query the director for the number of active back-end servers and, so long as it was over a given threshold, to assume that the director is otherwise able to do its job and rely on external monitoring to pickup internal failures where dovecot isn't able to successfully proxy the connection to one of the real servers. So, how are people doing this in the real world? -- Kelsey Cummings - kgc(a)corp.sonic.net sonic.net, inc. System Architect 2260 Apollo Way 707.522.1000 Santa Rosa, CA 95407

3 5

[Dovecot] Question about memory management in plugins
by Peter Mogensen 04 Aug '11

04 Aug '11

Hi, I've writing an passdb/userdb plugin (see my previous question about a plugin authenticating via a UNIX socket protocol). Now... the protocol spoken over this socket is JSON-based and I'm using a SAX-like event based parser which maintains a parse context between callbacks. Now... I'm a little bit in doubt about which dovecot memory management method would be best for data in this parser context. Alloc-only pools seems wrong cause the parser object is used as long as the connection is open and there might run many auth requests over the connection before it's freed making the pool grow for long time. Data stack allocation won't work either, since with all this async network and callbacks, there's really no where to place the stack frame. So I end up using i_* and i_free for all data during the lifetime of the connection. Is there a better way? If I could only free my pool-allocated data, but I can't since it's almost never the last allocated data I want to free. /Peter

1 1

[Dovecot] [BUG?] LDAP authentication with aliases issues
by Paweł Lęcznar 04 Aug '11

04 Aug '11

Hello, I am trying to configure Dovecot with LDAP authentication. My LDAP tree structure is as following: dc=root,dc=pl \_ ou=Users \_ uid=test \_ ou=Mail \_ ou=domain.pl \_ uid=alias_to_test I cannot authenticate using 'uid=alias_to_test,ou=domain.pl,ou=Mail,dc=root,dc=pl'. If I try to authenticate using 'uid=alias_to_test,ou=domain.pl,ou=Mail,dc=root,dc=pl', following entry appears in the Dovecot's log file: #v+ auth: Debug: client in: AUTH 1 PLAIN service=imap secured lip=127.0.0.1 rip=127.0.0.1 lport=993 rport=59818 resp=YWxpYXMxQGFsaWFzeS5wbABhbGlhczFAYWxpYXN5LnBsAGFzZHF3ZWFzZA== auth: Debug: ldap(alias_to_test(a)domain.pl,127.0.0.1): pass search: base=uid=alias_to_test,ou=domain.pl,ou=Mail,dc=root,dc=pl scope=base filter=(&(objectClass=posixAccount)) fields=uid,userPassword auth: Debug: auth(alias_to_test(a)domain.pl,127.0.0.1): username changed alias_to_test(a)domain.pl -> test auth: Debug: ldap(test,127.0.0.1): result: uid(user)=test userPassword(password)={CRYPT}ACnZvF4.K46UI auth: Debug: client out: OK 1 user=test auth: Debug: ldap(test,127.0.0.1): user search: base=uid=test,ou=,ou=Mail,dc=root,dc=pl scope=base filter=(&(objectClass=posixAccount)(uid=test)) fields=homeDirectory,uidNumber,gidNumber auth: Debug: master out: FAIL 2551840769 #v- In the LDAP server log file, following entries appear during authentication attempt #v+ ldap slapd[11729]: conn=1125 op=0 BIND dn="cn=Manager,dc=root,dc=pl" method=128 ldap slapd[11729]: conn=1125 op=0 BIND dn="cn=Manager,dc=root,dc=pl" mech=SIMPLE ssf=0 ldap slapd[11729]: conn=1125 op=0 RESULT tag=97 err=0 text= ldap slapd[11729]: conn=1125 op=1 SRCH base="uid=alias_to_test,ou=domain.pl,ou=Mail,dc=root,dc=pl" scope=0 deref=3 filter="(&(objectClass=posixAccount))" ldap slapd[11729]: conn=1125 op=1 SRCH attr=uid userPassword ldap slapd[11729]: conn=1125 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text= ldap slapd[11729]: conn=1125 op=2 do_search: invalid dn: "uid=test,ou=,ou=Mail,dc=root,dc=pl" ldap slapd[11729]: conn=1125 op=2 SEARCH RESULT tag=101 err=34 nentries=0 text=invalid DN #v- It seems that LDAP AuthDatabase doesn't change the context when looking up for the target object, to which the alias points. Futhermore, the filter for the target object '(&(objectClass=posixAccount)(uid=test))' was not defined by me anywhere in the configuration file 'dovecot-ldap.ext'. I have tried both authentication ways: 'password lookups' and 'authentication binding' with the same result. However, There is no problem to authenticate as 'uid=test,ou=Users,dc=root,dc=pl' (of cource after modifying the configuration file listed at the end). I suppose that it can be a bug in LDAP AuthDatabase, so I am writing this post as a potential bug report. Below are my configuration data: *************** # dovecot -n # 2.0.13: /etc/dovecot/dovecot.conf # OS: Linux 2.6.38.8-1 x86_64 auth_debug = yes auth_debug_passwords = yes auth_mechanisms = plain login auth_socket_path = /var/run/dovecot/auth-userdb auth_verbose = yes auth_verbose_passwords = plain listen = * mail_debug = yes mail_gid = 2000 mail_uid = 2000 managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date passdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } plugin { sieve = ~/.dovecot.sieve sieve_dir = ~/sieve } postmaster_address = postmaster(a)domain.pl protocols = imap pop3 sieve service auth { unix_listener /var/spool/postfix/private/auth { mode = 0666 } unix_listener auth-userdb { group = vmail mode = 0600 user = vmail } } service imap-login { inet_listener imap { port = 143 } inet_listener imaps { port = 993 ssl = yes } } service pop3-login { inet_listener pop3 { port = 110 } inet_listener pop3s { port = 995 ssl = yes } } ssl = required ssl_cert = </etc/openssl/certs/vmail.pem ssl_key = </etc/openssl/private/vmail.key userdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } verbose_ssl = yes *************** # cat /etc/dovecot/dovecot-ldap.ext uris = ldap://X.Y.Z.V/ dn = cn=Manager,dc=root,dc=pl dnpass = password auth_bind = no ldap_version = 3 base = uid=%n,ou=%d,ou=Mail,dc=root,dc=pl deref = always scope = base pass_attrs = uid=user,userPassword=password pass_filter = (&(objectClass=posixAccount)) default_pass_scheme = CRYPT

1 1

[Dovecot] questions about ldap auth
by Gerardo Herzig 04 Aug '11

04 Aug '11

Hi all. I have a couple of questions. ANY of those will solve mi situation. 1) 'Complex' LDAP validation: I need to validate a user in the 2 step authentication / authorizacion mech. The 'users' (with the password) are in ou=Person,o=Work the group which contains the mail users is in cn=MailUsers,ou=Groups,o=Work Can dovecot make such a thing? Cause im not shure if i can make this in a single ldap filter. 2) If not... 2.1) Does dovecot accept more than 1 ldap filter for authenticating? 2.2) Does dovecot accept an arbitrary program for authentication? Well, that's all for now. Thanks! Gerardo

1 0