February 2015 - dovecot

Require certificate for external clients
by Karol Babioch 02 Mar '15

02 Mar '15

Hi list, I'm currently looking into ways of making use of client certificates. I want to force external clients (i.e. anything outside the local subnet) to use client certificates. It is my understanding that this in itself can be achieved with the "ssl_require_client_cert" setting. However, I also want local clients (i.e. anything from a specific subnet) to be able to authenticate by the usual means (i.e. password-based). As far as I know dovecot is not able to operate on multiple ports, as stated in the FAQ [1]. The redirect approach, which is also mentioned there, is of no help to me, because in my case I would need a different setup on both ports. Other suggestions [2] won't work in my case either. I probably could get away with using "imaps" for external clients, while using "imap" (without SSL) for internal ones. Having said this, I don't quite like the idea, especially since the traffic might pass through some potentially unsecure networks and I don't want to bother with VPN/SSH tunnels for that purpose. A native SSL/TLS solution would be very much appreciated. Is there a (recommended) way to do this? Thanks in advance. Best regards, Karol Babioch [1]: http://wiki.dovecot.org/QuestionsAndAnswers#Is_it_possible_to_have_Dovecot_… [2]: http://www.dovecot.org/list/dovecot/2010-November/054804.html

3 2

Re: Require certificate for external clients
by Joseph Tam 01 Mar '15

01 Mar '15

Karol Babioch <karol(a)babioch.de> writes: > As far as I know dovecot is not able to operate on multiple ports, as > stated in the FAQ [1]. > > [1]: > http://wiki.dovecot.org/QuestionsAndAnswers#Is_it_possible_to_have_Dovecot_… That should be qualified as "Is it possible to have Dovecot imap/pop daemons listening on multiple ports for a single running instance." You can run two instances of dovecot, each on a different port or multi-homed listening address. You can share libraries, binaries, log files, but use separate configuration files, specifying different ports/addresses/ssl-configs/auth/access parameters. Then you can fire them both up dovecot -c /dovecot/etc/dovecot-1.conf dovecot -c /dovecot/etc/dovecot-2.conf That's the rough sketch of how to do it. Joseph Tam <jtam.home(a)gmail.com>

2 1

users of dbox format
by Andreas Kasenides 28 Feb '15

28 Feb '15

I am interested in finding out your experiences with using the dbox format (especially mdbox) if you use this format. I am contemplating changing my maildir setup to mdbox but I still need to make a case for it against maildir which has become a de-facto standard and provides sort of a secure basis in case of software changes. Your input will be appreciated. -- Andreas Kasenides Senior IT Officer Dept. of Computer Science, University of Cyprus Tel: 22892714, Fax: 22892701 (5B4ANK)

4 4

ACL Error
by Bobber 28 Feb '15

28 Feb '15

I'm trying to set up global ACLs. I have the following in the config file: > # acl > mail_plugins = acl > > protocol imap { > mail_plugins = $mail_plugins imap_acl > } > > plugin { > # Without global ACLs: > #acl = vfile > > # With global ACL files in /etc/dovecot/dovecot-acls file (v2.2.11+): > #acl = vfile:/etc/dovecot/dovecot-acl > acl = vfile:/usr/local/etc/dovecot/dovecot-acl > } And here is my dovecot-acl: > user=bobber lrwstipekxa > authenticated lr But when I restart dovecot and try to access folders, I get the following errors in the log file: > Error: Global ACL file /usr/local/etc/dovecot/dovecot-acl line 1: > Unknown ID 'lrwstipekxa' Any ideas what's causing this? -- *Bob Wooldridge* Blog: http://kc0dxf.net/blog/

2 1

userdb passwd-file default_fields uid not expanding %variable
by Tim Jones 27 Feb '15

27 Feb '15

Hi all, I'm trying to set up a very simple shared mail server, where each 'domain' is a system user, i.e. 'example.com' is a real user with /home/example.com/, a uid of 5001 (and gid 'example.com' of 5001). Each domain\user has their own maildir inside their home, and a plain passwd-file with the virtual mail users associated with that domain. Version & config info: > # dovecot -n > # 2.2.13: /etc/dovecot/dovecot.conf > # OS: Linux 3.2.0-4-amd64 x86_64 Debian 7.8 > auth_mechanisms = plain login > auth_verbose = yes > disable_plaintext_auth = no > mail_location = mbox:~/mail:INBOX=/var/mail/%u > namespace inbox { > inbox = yes > location = > mailbox Drafts { > special_use = \Drafts > } > mailbox Junk { > special_use = \Junk > } > mailbox Sent { > special_use = \Sent > } > mailbox "Sent Messages" { > special_use = \Sent > } > mailbox Trash { > special_use = \Trash > } > prefix = > } > passdb { > args = username_format=%n /home/%d/mail_users > driver = passwd-file > } > protocols = " imap lmtp pop3" > ssl = no > userdb { > args = username_format=%n /home/%d/mail_users > default_fields = uid=%d gid=%d home=/home/%d/mail/%n > mail=maildir:/home/%d/mail/%n > driver = passwd-file > } Every time I try to authenticate via imap, I get the error > <timestamp> <host> dovecot: auth: Fatal: passwd-file userdb: Invalid uid: > %d > If I put fixed a uid and gid in the userdb default_fields line: > default_fields = uid=example.com gid=example.com home=/home/%d/mail/%n > mail=maildir:/home/%d/mail/%n authentication passes without a problem, but of course, only for users of example.com. Checking the wiki (http://wiki2.dovecot.org/UserDatabase#Userdb_settings) clearly states that the default_fields values support %variables, so I'm not sure if I'm missing some other config required for this to work. Many thanks in advance, [image: Fon] <http://www.fon.com/>Tim JonesSoftware Development+34 612345678 C/ Quintanavides 15, Edificio 2, Planta 1ª Parque Empresarial Vía Norte de Metrovacesa Las Tablas 28050 MadridSkype: tim.jones.fonAll information in this email is confidential <http://corp.fon.com/legal/email-disclaimer>

1 0

Dovecot & LDAP Take #2: Authentication failed and logging
by David Scheele 27 Feb '15

27 Feb '15

Hi there, after banging my head against a wall for a bit I got more indepth with dovecot and am now much more knowledgeable about the system than before. But I still have two problems: 1.) For some reason my dovecot doesnt log correctly. I put debug_log to -1 and expected to see logs flooding in in my syslog. When I try to log in via telnet over imap and the login succeeds it loggs correctly. But when it fails there is no log entry. Any clue what might cause this? And now the big fish: 2.) Still hanging to log a user in over telnet via imap. I'm pretty sure i have misconfigured something. first of all: 2a.) Is the *passdb* and *userdb* ind the dovecot.conf still needed in the newest version? It appears to me that all authing runs over the *10-auth.conf*, *auth-ldap.conf.ext* and *dovecot-ldap.conf.ext *and the passdb and userdb settings might just be remnants of the past? or am i wrong here? 2b.) This is my config: *# 2.1.7: /etc/dovecot/dovecot.conf# OS: Linux 3.2.0-4-amd64 x86_64 Debian 7.8 ext4auth_mechanisms = plain logindefault_login_user = vmaildisable_plaintext_auth = nofirst_valid_gid = 2222first_valid_uid = 2222listen = *mail_access_groups = vmailmail_debug = yesmail_location = maildir:/var/vmail/%d/%npassdb { args = scheme=SHA1 /etc/dovecot/passwd driver = passwd-file}protocols = imapservice auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } user = root}service imap-login { process_min_avail = 1 user = vmail}ssl = nouserdb { args = uid=2222 gid=2222 home=/var/vmail/%d/%n allow_all_users=yes driver = static}* *hosts = [ <http://mailserver.realsecure.de/>hostname].[domainname].dedebug_level = -1auth_bind = yesauth_bind_userdn = cn=%u,ou=People,dc=**[domainname]* *,dc=debase = ou=People,dc=[domainname],dc=deuser_attrs = uidNumber=uiduser_filter = (&(objectClass=inetOrgPerson)(uid=%u))pass_attrs = uid=user,userPassword=passwordpass_filter = (&(objectClass=inetOrgPerson)(uid=%u))iterate_attrs = uid=useriterate_filter = (objectClass=inetOrgPerson)* The user I try to log in with is: *cn=Klara Fall,ou=People,dc=[domainname],dc=de* *objectclasses: inetOrgPerson, organizationalPerson, person, simpleSecurityObject,top* *sn=Fall* *userPassword is set* *mail: klara.fall(a)[domainname].de* *uid: klarafall* I want to try with auth bind because I think i understood whats going on with that. When i try to a login klarafall [password] it gives me a NO [AUTHENTICATIONFAILED] Authentication failed. Any clues? This would be much easier with logging... but see 1.) :) I feel I'm not far from the finish line. Best, David

2 2

postfix ldap unknown user
by Jean-François Sénéchal 27 Feb '15

27 Feb '15

Hi, My config dovecot 2.2.13 Postfix 2.9.6 Debian wheezy When I send a message to my user test (siroco) postfix said unknown user But the user exist : doveadm user siroco : field value uid 3002 gid 2000 home /var/spool/dovecot/mail/s/siroco mail maildir:~/Maildir:LAYOUT=fs postmap -vq siroco ldap:/etc/postfix/ldap_virtual_aliases.cf return siroco 2 questions : postfix search with siroco or with siroco(a)citoyens2015.marche.be ? postmap must return siroco or siroco(a)citoyen2015.marche.be ? And I don't know if I set for alias_maps, virtual_mailbox_maps, virtual_alias_maps ? My postconf alias_database = hash:/etc/aliases alias_maps = hash:/etc/aliases, ldap:/etc/postfix/ldap-citoyen.cf append_dot_mydomain = no biff = no config_directory = /etc/postfix inet_interfaces = 172.17.1.232, 127.0.0.1 mailbox_command = procmail -a "$EXTENSION" mailbox_size_limit = 0 mydestination = $myhostname, localhost.$mydomain, localhost mydomain = marche.be myhostname = citoyen2015.marche.be mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128 myorigin = /etc/mailname readme_directory = no recipient_delimiter = + relayhost = gatekeeper.marche.be smtpd_banner = $myhostname ESMTP $mail_name (Debian/GNU) virtual_alias_maps = proxy:ldap:/etc/postfix/ldap_virtual_aliases.cf virtual_mailbox_domains = hash:/etc/postfix/virtual_domains virtual_mailbox_maps = proxy:ldap:/etc/postfix/ldap_virtual_recipients.cf virtual_transport = dovecot My ldap_virtual_recipients.cf (same in ldap-citoyen.cf and in ldap_virtual_aliases.cf) server_host = ldap.marche.be search_base = ou=Users,ou=Citoyens,dc=marche,dc=be scope = sub bind = no version = 3 #query_filter = (&(|(mail=%s)(gosaMailAlternateAddress=%s))(objectClass=gosaMailAccount)) query_filter = (|(gosaMailAlternateAddress=%s)(mail=%s)(uid=%s)) #result_attribute = uid result_attribute = gosaMailForwardingAddress *Error log * Feb 27 14:16:13 citoyen2015 postfix/trivial-rewrite[4917]: warning: do not list domain citoyen2015.marche.be in BOTH mydestination and virtual_mailbox_domains Feb 27 14:16:13 citoyen2015 postfix/local[4919]: E8C3920A: to=<siroco(a)citoyen2015.marche.be>, relay=local, delay=0.23, delays=0.13/0.01/0/0.1, dsn=5.1.1, status=bounced (unknown user: "siroco") Feb 27 14:16:13 citoyen2015 postfix/cleanup[4918]: 2C28A20C: message-id=<20150227131613.2C28A20C(a)citoyen2015.marche.be> Thanks

2 1

postfix ldap unknown user
by Jean-François Sénéchal 27 Feb '15

27 Feb '15

Hi, My config dovecot 2.2.13 Postfix 2.9.6 Debian wheezy When I send a message to my user test (siroco) postfix said unknown user But the user exist : doveadm user siroco : field value uid 3002 gid 2000 home /var/spool/dovecot/mail/s/siroco mail maildir:~/Maildir:LAYOUT=fs postmap -vq siroco ldap:/etc/postfix/ldap_virtual_aliases.cf return siroco 2 questions : postfix search with siroco or with siroco(a)citoyens2015.marche.be ? postmap must return siroco or siroco(a)citoyen2015.marche.be ? And I don't know if I set for alias_maps, virtual_mailbox_maps, virtual_alias_maps ? My postconf alias_database = hash:/etc/aliases alias_maps = hash:/etc/aliases, ldap:/etc/postfix/ldap-citoyen.cf append_dot_mydomain = no biff = no config_directory = /etc/postfix inet_interfaces = 172.17.1.232, 127.0.0.1 mailbox_command = procmail -a "$EXTENSION" mailbox_size_limit = 0 mydestination = $myhostname, localhost.$mydomain, localhost mydomain = marche.be myhostname = citoyen2015.marche.be mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128 myorigin = /etc/mailname readme_directory = no recipient_delimiter = + relayhost = gatekeeper.marche.be smtpd_banner = $myhostname ESMTP $mail_name (Debian/GNU) virtual_alias_maps = proxy:ldap:/etc/postfix/ldap_virtual_aliases.cf virtual_mailbox_domains = hash:/etc/postfix/virtual_domains virtual_mailbox_maps = proxy:ldap:/etc/postfix/ldap_virtual_recipients.cf virtual_transport = dovecot My ldap_virtual_recipients.cf (same in ldap-citoyen.cf and in ldap_virtual_aliases.cf) server_host = ldap.marche.be search_base = ou=Users,ou=Citoyens,dc=marche,dc=be scope = sub bind = no version = 3 #query_filter = (&(|(mail=%s)(gosaMailAlternateAddress=%s))(objectClass=gosaMailAccount)) query_filter = (|(gosaMailAlternateAddress=%s)(mail=%s)(uid=%s)) #result_attribute = uid result_attribute = gosaMailForwardingAddress *Error log * Feb 27 14:16:13 citoyen2015 postfix/trivial-rewrite[4917]: warning: do not list domain citoyen2015.marche.be in BOTH mydestination and virtual_mailbox_domains Feb 27 14:16:13 citoyen2015 postfix/local[4919]: E8C3920A: to=<siroco(a)citoyen2015.marche.be>, relay=local, delay=0.23, delays=0.13/0.01/0/0.1, dsn=5.1.1, status=bounced (unknown user: "siroco") Feb 27 14:16:13 citoyen2015 postfix/cleanup[4918]: 2C28A20C: message-id=<20150227131613.2C28A20C(a)citoyen2015.marche.be> Thanks -- logomarche Jean-François Sénéchal Centre de Support Télématique Webmaster Rue des Carmes, 22 6900 Marche-en-Famenne Tél: 084/32 70 55 - Fax: 084/32 70 72 jean-francois.senechal(a)ac.marche.be <mailto:jean-francois.senechal@ac.marche.be> Retrouvez-nous sur www.marche.be <http://www.marche.be> et sur logofacebook <https://www.facebook.com/pages/Ville-de-Marche-en-Famenne/152999594777489> Disclaimer <https://www.marche.be/disclaimer/> | SVP, pensez à notre environnement avant d'imprimer ce mail

1 0

mdbox + sis + altstorage: error in attachments-connector (file not found)
by Paolo Cravero 26 Feb '15

26 Feb '15

Hello, first time here. I am playing with Dovecot because of its mdbox storage, SIS feature and altstorage ability. I authenticate against LDAP (passdb), but I don't fetch operational data from LDAP (mail_locations are static from config files and "user_attrs = =uid=500, =gid=500, =home=/maildata1/home/%d/%1n/%n"). On a daily basis I run "doveadm altmove -A savedbefore 5d" Thunderbird apparently works 100%, but only apparently. When accessing one of those mailboxes through Open-Xchange IMAP I got an error for the first time. Then I could reproduce it with Thunderbird as well, I simply had to open the message mentioned in the log: Feb 26 14:06:02 tst-msg03 dovecot: imap(paolo.cravero(a)csi.it): Error: read(attachments-connector(/maildata1/altstorage/csi.it/p/paolo.cravero/storage/m.35)) failed: read(/maildata1/attachments/40/68/40683f07fcbf1f95f09b273e472b3c7067f43210641baf6e3cce333a27b36e11-4a235a29fd05db54fd6800001117ea21[base64:19 b/l]) failed: open(/maildata1/attachments/40/68/40683f07fcbf1f95f09b273e472b3c7067f43210641baf6e3cce333a27b36e11-4a235a29fd05db54fd6800001117ea21) failed: No such file or directory (uid=5940, box=INBOX) Feb 26 14:06:02 tst-msg03 dovecot: imap(paolo.cravero(a)csi.it): Error: read(attachments-connector(/maildata1/altstorage/csi.it/p/paolo.cravero/storage/m.35)) failed: read(/maildata1/attachments/40/68/40683f07fcbf1f95f09b273e472b3c7067f43210641baf6e3cce333a27b36e11-4a235a29fd05db54fd6800001117ea21[base64:19 b/l]) failed: open(/maildata1/attachments/40/68/40683f07fcbf1f95f09b273e472b3c7067f43210641baf6e3cce333a27b36e11-4a235a29fd05db54fd6800001117ea21) failed: No such file or directory (uid=5940, box=INBOX) Feb 26 14:06:02 tst-msg03 dovecot: imap(paolo.cravero(a)csi.it): Disconnected: Internal error occurred. Refer to server log for more information. [2015-02-26 14:06:02] in=182 out=1266 This happens on many messages sitting in the altstorage that had an attachment. The detached attachment file does not exist. Sometimes not even the path is there (anymore?). At some point in time I have run "doveadm purge" on the mailbox in error, but I am not sure that is the culprit. Have I hit a bug or done something wrong? Please suggest tests to verify where I stand. Config dump follows. Paolo # 2.2.15: /etc/dovecot/dovecot.conf # OS: Linux 2.6.32-431.el6.x86_64 x86_64 Red Hat Enterprise Linux Server release 6.5 (Santiago) ext3 auth_mechanisms = plain login disable_plaintext_auth = no imap_client_workarounds = tb-extra-mailbox-sep lmtp_save_to_detail_mailbox = yes mail_attachment_dir = /maildata1/attachments mail_attachment_hash = %{sha256} mail_debug = yes mail_gid = 500 mail_location = mdbox:/maildata1/main/%d/%1n/%n:ALT=/maildata1/altstorage/%d/%1n/%n:INDEX=/maildata1/indexes/%d/%1n/%n mail_plugins = quota mail_log notify lazy_expunge mail_uid = 500 managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave duplicate mbox_write_locks = fcntl mdbox_rotate_size = 50 M namespace { hidden = no list = yes location = mdbox:/maildata1/main/%d/%1n/%n:INDEX=/maildata1/indexes/%d/%1n/%n:MAILBOXDIR=expunged prefix = .EXPUNGED/ subscriptions = no } namespace inbox { inbox = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk { auto = subscribe special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { auto = subscribe special_use = \Trash } prefix = } passdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } plugin { lazy_expunge = .EXPUNGED/ mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename flag_change append mail_log_fields = uid box msgid size flags vsize quota = dict:User quota::file:%h/dovecot-quota quota_grace = 10%% quota_rule = *:storage=10G quota_rule2 = Trash:storage=+100M quota_warning = storage=95%% quota-warning 95 %u quota_warning2 = storage=80%% quota-warning 80 %u } protocols = imap pop3 lmtp sieve service auth { unix_listener auth-userdb { group = vmail user = vmail } } service lmtp { inet_listener lmtp { address = 10.102.42.114 port = 24 } process_min_avail = 2 user = vmail } ssl_cert = </etc/pki/dovecot/certs/dovecot.pem ssl_key = </etc/pki/dovecot/private/dovecot.pem userdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } protocol lmtp { mail_plugins = quota mail_log notify lazy_expunge sieve } protocol lda { mail_plugins = quota mail_log notify lazy_expunge sieve } protocol imap { mail_plugins = quota mail_log notify lazy_expunge imap_quota }

1 0

dsync backup touch source index files.
by Anton Chevychalov 26 Feb '15

26 Feb '15

Hi everyone, Can someone explain me why dsync need read-write access to source box when pulling data (dsync -R backup)? I am working on migration from Dovecot 1.x with maildir to latest Dovecot 2.2.15 with mdbox and found that there is no way to do this from ro filesystem (got "failed: Read-only file system" on access to /dovecot.index.log). I am wondering is it bug or feature? I am not sure that this is save to allow dsync v2.2.15 to have write access to v1.x indexes. -- Anton Chevychalov

3 2