November 2016 - dovecot

LDAP auth problems "unknown user"
by Nikolai Lusan 22 Nov '16

22 Nov '16

Hi, I am setting up a dovecot instance to host a bunch of virtual domains, with ldap backing for auth. I am using a single hostname for test purposes, with a couple of entries in the diectory. If I use auth binds I get a result, but this does not suit the end purpose of the server. If I use ldapsearch with the same base, search filter, and credentials as the ldap auth config I get the correct attributes returned, and I have bit of perl that verifies the password hash matches the password provided. I am running out of ideas here, I had thought of putting in a custom bit of perl and using the checkpassword method, but this is sub optimal. If anyone can help with this I'd be grateful. # dovecot --version 2.2.26.0 (23d1de6) # dovecot -n # 2.2.26.0 (23d1de6): /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.16 (fed8554) # OS: Linux 4.8.0-1-amd64 x86_64 Debian stretch/sid ext3 auth_cache_size = 2 M auth_debug = yes auth_debug_passwords = yes auth_default_realm = maliuta.org auth_master_user_separator = * auth_mechanisms = plain login auth_realms = maliuta.org auth_verbose = yes auth_verbose_passwords = yes first_valid_uid = 117 last_valid_uid = 117 lda_mailbox_autocreate = yes login_log_format_elements = user=<%u> method=%m rip=%r lip=%l mpid=%e %c mail_gid = vmail mail_location = maildir:/var/spool/vmail/%d/%n/Maildir mail_uid = vmail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded- character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext namespace inbox { inbox = yes list = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = /etc/dovecot/ldap/maliuta.org-ldap.conf.ext driver = ldap } plugin { sieve = file:~/sieve;active=~/.dovecot.sieve } protocols = " imap lmtp sieve" service auth-worker { user = $default_internal_user } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } unix_listener auth-userdb { group = vmail mode = 0660 user = vmail } user = $default_internal_user } service dict { unix_listener dict { group = vmail mode = 0660 user = vmail } } service imap-login { inet_listener imap { port = 143 } inet_listener imaps { port = 0 } } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0660 user = postfix } } ssl_cert = # grep -v '^ *$#.*$\?$' /etc/dovecot/ldap/maliuta.org-ldap.conf.ext uris = ldap://localhost dn = cn=admin,dc=maliuta,dc=org dnpass = <secret> tls = yes tls_ca_cert_dir = /etc/ssl/certs auth_bind = no ldap_version = 3 base = ou=mail,dc=mailuta,dc=org scope = subtree default_pass_scheme = SSHA deref = never user_attrs = postfixDeliveryAddress=user user_filter = (&(postfixDeliveryEnabled=TRUE)(objectClass=postfixMailPerson)) pass_attrs = postfixDeliveryAddress=user,userPassword=password pass_filter = (&(postfixDeliveryEnabled=TRUE)(objectClass=postfixMailPerson)(postfixD eliveryAddress=%u)) iterate_attrs = uid=user iterate_filter = (objectClass=postfixMailPerson) # ldapsearch -H ldap://localhost:389 -x -D 'cn=admin,dc=maliuta,dc=org' -W -b "ou=mail,dc=maliuta,dc=org" -s sub -LLL -ZZ '(&(postfixDeliveryEnabled=TRUE)(objectClass=postfixMailPerson)(postfixDeliveryAddress=nikolai(a)test.maliuta.org))' uid userPassword Enter LDAP Password: dn: mail=nikolai(a)test.maliuta.org,ou=mail,dc=maliuta,dc=org uid: nikolai userPassword:: e1NTSEF9QVBZMTlaeGw1cWd0a25XeGxURXdqM2g5Yk5YL3BxOGY= ## From /var/log/mail.log Nov 20 07:24:20 kiliya dovecot: auth: Debug: auth client connected (pid=27086) Nov 20 07:24:20 kiliya dovecot: auth: Debug: client in: AUTH#0111#011PLAIN#011service=imap#011secured#011session=1kW2C65BFI2WZbl8#011lip=<local_ip>#011rip=<remote_ip>#011lport=143#011rport=36116#011local_name=<hostname>#011resp=AG5pa29sYWlAdGVzdC5tYWxpdXRhLm9yZwBmb29iYXIzMzQ0 (previous base64 data may contain sensitive data) Nov 20 07:24:20 kiliya dovecot: auth: Debug: ldap(nikolai(a)test.maliuta.org,<remote_ip>,<1kW2C65BFI2WZbl8>): cache miss Nov 20 07:24:20 kiliya dovecot: auth: Debug: ldap(nikolai(a)test.maliuta.org,<remote_ip,<1kW2C65BFI2WZbl8>): pass search: base=ou=mail,dc=mailuta,dc=org scope=subtree filter=(&(postfixDeliveryEnabled=TRUE)(objectClass=postfixMailPerson)(postfixDeliveryAddress=nikolai(a)test.maliuta.org)) fields=postfixDeliveryAddress,userPassword Nov 20 07:24:20 kiliya dovecot: auth: ldap(nikolai(a)test.maliuta.org,<remote_ip>,<1kW2C65BFI2WZbl8>): unknown user (given password: <correct_password>) Nov 20 07:24:22 kiliya dovecot: auth: Debug: client passdb out: FAIL#0111#011user=nikolai(a)test.maliuta.org -- Nikolai Lusan <nikolai(a)lusan.id.au>

2 2

Maildir migration from Dovecot to Dovecot
by Marco Hofmann (XenAdmin) 22 Nov '16

22 Nov '16

Hello everbody, I'm a proud user of Dovecot 2.2.9 on Ubuntu 14.04 LTS. I currently migrate all my Linux services to a new Debian 8 Jessie Server. On this server I installed and configured Dovecot 2.2.24. Now I search a way to migrate the two IMAP users I have on this server preserving all timestamps, folders and flags. Yes, only two ;-) I read the following two articles: http://wiki2.dovecot.org/Tools/Doveadm/Sync http://wiki2.dovecot.org/Migration/Dsync But I must say, that either these articles are not so good, or I act quite dumb. I understand that I have to use "doveadm backup" against my old server to make a one sync with all properties of each mail. What I miss are proper examples and that there are so many options, I could set. But what confuses me most is the the configuration file in (http://wiki2.dovecot.org/Migration/Dsync) which I don't know how to reference? Am I using the wrong guides, are the article someway misleading or is there anything else I'm overlooking? Thank you so much! -- Marco Hofmann https://www.meinekleinefarm.net/ Twitter: @ZomboBrain

2 1

nologin + reason -> logging reason
by Arkadiusz Miśkiewicz 22 Nov '16

22 Nov '16

Hi. I'm using nologin with own reason [1]. That works fine. For example pop3 client gets nice message like "-ERR [AUTH] Account is locked. Please contact support." Unfortunately maillog lacks information details about why user was not allowed to log in. pop3-login: Disconnected (auth failed, 1 attempts in 2 secs): user=<testuser>, method=LOGIN, rip=1.1.1.1, lip=2.2.2.2, session=<yIsRftBBmsrB7y2h> Is it possible to log "reason" there, too? (whether it is default/internal dovecot reason or my custom one). reason is the only thing in maillog that allows to distinguish why user was not allowed to log in. 1. http://wiki2.dovecot.org/PasswordDatabase/ExtraFields -- Arkadiusz Miśkiewicz, arekm / ( maven.pl | pld-linux.org )

3 5

Clients creating folders in root when using shared namespace
by Jon Cutting 21 Nov '16

21 Nov '16

We have set up dovecot to use a shared namespace, and it works well. However, when a client attempts to create a folder in the namespace, although dovecot responds with permission denied, it still goes on to create a folder, but in the root of our virtual mailbox folder (more confusingly, even issuing a LIST command for a non-existent subfolder creates the folder in the root). I've checked through the documentation for a misconfiguration but so far to no avail. Our steps to reproduce are as follows: * Create shared namespace (in our case we've used prefix Users/%%u/) * Share folder from one user to another so that the shared folder displays in LIST * Create a folder as a subfolder of the shared folder (i.e. . CREATE Users/testfolder) Expected behaviour: permission is denied and no folder is created Actual behaviour: permission is denied, but folder is created at the root of our vmail store (in the above example a folder /mnt/storage/vmail/testfolder would be created) Thanks, Jon Output from doveconf -n # 2.2.13: /etc/dovecot/dovecot.conf # OS: Linux 3.16.0-4-amd64 x86_64 Debian 8.6 ext4 mail_location = maildir:/mnt/storage/vmail/%d/%n/Maildir mail_plugins = " quota zlib acl" managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave namespace Users { list = children location = maildir:/mnt/storage/vmail/%%d/%%n/Maildir:INDEX=/mnt/storage/vmail/%d/%n/sharedindex/%%d/%%n/ prefix = Users/%%u/ separator = / subscriptions = no type = shared } namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = separator = / type = private } passdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } plugin { acl = vfile acl_shared_dict = file:/mnt/storage/vmail/%d/shared-mailboxes.db quota = maildir:User quota quota_rule = *:storage=50GB sieve = /mnt/storage/vmail/%d/%n/.dovecot.sieve sieve_before = /mnt/storage/vmail/dovecot.sieve sieve_dir = /mnt/storage/vmail/%d/%n/sieve zlib_save = gz zlib_save_level = 6 } protocols = imap lmtp sieve service imap-login { inet_listener imaps { port = 993 ssl = yes } } service lmtp { inet_listener lmtp { address = 0.0.0.0 port = 2003 } user = vmail } service managesieve-login { inet_listener sieve { port = 4190 } service_count = 1 vsz_limit = 64 M } ssl = required ssl_ca = </etc/dovecot/dovecotca.pem ssl_cert = </etc/dovecot/dovecot.pem ssl_key = </etc/dovecot/private/dovecot.pem userdb { args = uid=5000 gid=5000 home=/mnt/storage/vmail/%d/%n allow_all_users=yes driver = static } protocol imap { imap_client_workarounds = tb-extra-mailbox-sep mail_plugins = " quota zlib acl imap_quota" } protocol lmtp { mail_plugins = " quota zlib acl sieve" }

1 0

[PATCH] Manually cleanup OpenSSL from dovecot_openssl_common_global_unref()
by Apollon Oikonomopoulos 21 Nov '16

21 Nov '16

OpenSSL 1.1 features a cleanup function that is automatically run on shutdown using atexit(3). This function frees all OpenSSL-allocated resources. In dovecot, OpenSSL is loaded indirectly using dlopen(3) against the relevant dovecot crypto module and is finally unloaded using dlclose(3). Until OpenSSL 1.0.1c this worked fine, however OpenSSL 1.0.1c makes sure[1] that the library stays loaded after the initial dlclose() so that the atexit(3) handlers can run on shutdown. This, together with the fact that dovecot uses custom allocation functions for OpenSSL and has already partially free()'d some of OpenSSL's resources in module_free(), leads to a segfault at process shutdown[2]. We fix this by explicitly calling OPENSSL_cleanup() during module unload. This is safe to do, as long as we will never want to subsequently re-initialize OpenSSL. [1] https://github.com/openssl/openssl/commit/4af9f7fe79ff82b90c16969b7e5871435… [2] https://buildd.debian.org/status/fetch.php?pkg=dovecot&arch=amd64&ver=1:2.2… Signed-off-by: Apollon Oikonomopoulos <apoikos(a)debian.org> --- src/lib-ssl-iostream/dovecot-openssl-common.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/src/lib-ssl-iostream/dovecot-openssl-common.c b/src/lib-ssl-iostream/dovecot-openssl-common.c index 51ea3ad..2bf6307 100644 --- a/src/lib-ssl-iostream/dovecot-openssl-common.c +++ b/src/lib-ssl-iostream/dovecot-openssl-common.c @@ -101,6 +101,9 @@ bool dovecot_openssl_common_global_unref(void) ERR_remove_thread_state(NULL); #endif ERR_free_strings(); +#if OPENSSL_VERSION_NUMBER >= 0x10100000L + OPENSSL_cleanup(); +#endif return FALSE; } -- 2.10.1

4 4

Index-cache sizes
by Tom Sommer 21 Nov '16

21 Nov '16

I had a customer with an INBOX cache of 400MB+ (5.5GB maildir) which gave me "Error: mmap_anon(474165248) failed: Cannot allocate memory" errors, then I deleted the cache files and ran 'doveadm index -u xxx(a)example.com "*"', now the INBOX cache is 7MB What is up with that? Is the cache now missing something or does it make sense to wipe cache files and reindex cache every-so-often? -- Tom

1 0

Feedback on first, i.e. novice-level, experiences with dovecot
by Michael Felt 21 Nov '16

21 Nov '16

a) google: "dovecot imap configuration" brought an article from 2005 as the first item: while I like debian and a bit of history you may want to ask yourself how to improve your site as the primary hit from google. FYI: years ago I had great results in the top of google searches - and then I made a major error - I moved my site to a new url and google forgot me. b) using your http://wiki.dovecot.org/QuickConfiguration as a guide: I built dovecot using --prefix=/opt (I abhor /usr/local these days - that is so 1984ish). The applications got installed in /opt/bin root@x066:/data/prj/aixtools/dovecot/core# ls -ltr /opt total 36 drwxr-xr-x 3 root root 4096 Nov 20 14:33 lib drwxr-xr-x 3 root root 4096 Nov 20 14:33 include drwxr-xr-x 6 root root 4096 Nov 20 14:33 share drwxr-xr-x 3 root root 4096 Nov 20 14:33 libexec drwxr-xr-x 2 root root 4096 Nov 20 14:33 sbin drwxr-xr-x 2 root root 4096 Nov 20 14:33 bin Are the directories 'make install' touched or made. root@x066:/data/prj/aixtools/dovecot/core# /opt/bin/doveconf -n # 2.3.devel (92c8109): /opt/etc/dovecot/dovecot.conf doveconf: Fatal: open(/opt/etc/dovecot/dovecot.conf) failed: No such file or directory where are example configs? root@x066:/data/prj/aixtools/dovecot/core# find /opt -name example-config root@x066:/data/prj/aixtools/dovecot/core# Not in /opt How about a default config? root@x066:/data/prj/aixtools/dovecot/core# find / -name dovecot /etc/init.d/dovecot /etc/pam.d/dovecot /etc/default/dovecot /etc/dovecot /var/lib/dovecot ^C Seems to be /etc/dovecot root@x066:/data/prj/aixtools/dovecot/core# ls -l /etc/dovecot total 40 drwxr-xr-x 2 root root 4096 Apr 30 2015 conf.d -rw-r--r-- 1 root root 4180 Jun 8 2014 dovecot.conf -rw-r----- 1 root dovecot 410 Jun 8 2014 dovecot-db.conf.ext -rw-r----- 1 root dovecot 782 Jun 8 2014 dovecot-dict-sql.conf.ext -rw-r--r-- 1 root dovecot 1363 Apr 30 2015 dovecot.pem -rw-r----- 1 root dovecot 5348 Jun 8 2014 dovecot-sql.conf.ext drwx------ 2 root root 4096 Apr 30 2015 private -rw-r--r-- 1 root root 121 Jun 8 2014 README and finally - read README to find the examples: root@x066:/data/prj/aixtools/dovecot/core# cat /etc/dovecot/README Configuration files go to this directory. See example configuration files in /usr/share/doc/dovecot-core/example-config/ Conclusion: --prefix=/opt is not applied everywhere. * More first impressions as I come to them - if you want them - as I hope this helps make dovecot better! Michael

2 4

doveadm service: verify client cert
by Matwey V. Kornilov 20 Nov '16

20 Nov '16

Hello, I want to open a socket for connecting doveadm using tcps. I do the following: service doveadm { inet_listener { port = 5001 ssl = yes } } At the same time, I would like to verify client certificates for connections goes to port 5001. I am trying to do the following, but it doesn't work: protocol doveadm { ssl_require_crl = yes ssl_verify_client_cert = yes } How could I achieve required behavior?

1 0

Compound Literal - xlc and gcc differences can be patched
by Michael Felt 19 Nov '16

19 Nov '16

Since I so miserably misspelled packaging - a new thread specific to the issue at hand. I found a "workaround". In short, xlc does not accept arrays of nested array - the bottom line (best message) is: 1506-995 (S) An aggregate containing a flexible array member cannot be used as a member of a structure or as an array element. At the core - all the other messages come because this (I shall call it nesting). For the test-http-auth.c file I have a patch (attached). make ran for while with no issue, then it started running into several files with this same style of specification - doveadm-dict.c being the first one. I ran "make -i" and I notice several files with this - for xlc - "unaccepted" syntax. Please look at the patch - what it basically is - and let me know whether you would consider accepting patches in this form (e.g., verify gcc (I assume) will accept it as well). If your answer is yes, I shall proceed with the additional files (learn how your MACROS work!) and send them to you. Again, initially I would just send one, e.g., doveadm-dict.c - to be sure your regular compiler also builds this alternate specification. Thank you for your consideration! Michael

2 5

Re: Good email client to use with Dovecot?
by Joseph Tam 19 Nov '16

19 Nov '16

Steve Litt asks > * And most important, where can I find the best, most unambiguous > Alpine documentation, that doesn't assume I know anything about > Alpine? The ~/.pinerc config file is well documented. There is a bewildering number of options, and you can tweak it just about anyway you like. Choice of mail readers tend to a religious issue. Users of a particular reader will only change when you pry their cold dead fingers off of it. Alpine is not a bad choice (I've been using it and it's predeccesor for decades), and I go through mail faster than most people I know as I can type faster than they can click buttons, scroll, and drag windows around. However, it sort of sucks when you read formatted mail HTML with lots of graphics). Joseph Tam <jtam.home(a)gmail.com>

1 0