July 2017 - dovecot - dovecot.org

Dovecot Statistics
by Doug Hardie 15 Jul '17

15 Jul '17

I tried to setup statistics as shown on the Statistics wiki page. I encountered a problem with the mail_plugins for imap. in the protocol imap configuration the wiki shows adding imap_stats to mail_plugins. When I do that, dovecot stops authenticating and throwing error messages: Jul 15 12:47:46 mail dovecot: imap(doug)[10.0.1.251]<osGhcGBUmsgKAAH7>: Error: Couldn't load required plugin /usr/local/lib/dovecot/lib95_imap_stats_plugin.so: Plugin stats must be loaded also (you must set: mail_plugins=$mail_plugins stats) Jul 15 12:47:46 mail dovecot: imap(doug): Error: Internal error occurred. Refer to server log for more information. Changing that line to just add stats to mail_plugins resolves the problem. Hopefully that is an error in the wiki... However, in looking at the stats, I don't ever see any values for any of the auth_ values. They all show zero even though there have been numerous authentications by dovecot and postfix. I also notice that there is a new statistics output about every 3 minutes. It appears that the numbers are only for that 3 minute window. Is there a way to set the statistics so that I can see the last 24 hours, or the previous day? -- Doug

2 1

Post-login script on proxy side
by azurit＠pobox.sk 15 Jul '17

15 Jul '17

Hi, is it possible to run a post-login script on proxy side? When a user is 'proxied' away, the standard post-login script seems to be skipped. I want to update last login datetime but only proxy has access to user database (so i cannot run it on backends). azur

3 8

Re: SQLite user database
by Joseph Tam 15 Jul '17

15 Jul '17

Levente Kovacs writes: > I continuously get user authentication errors. I suspect that the problem is > with a password hashing. I used > > # doveadm pw -s SHA512-CRYPT > Enter new password: > Retype new password: > {SHA512-CRYPT}$6$1cCNWIMCTpuqmexO$cCq7nDEga1xza3967nZ.BFZaGWNoYwjnNfSCvZE/jGzYAY1hLWE1iHR1KYaO.mvVE4WVdDSrvPNtfwAUn/yk3/ Looks OK. > I have this at the database: > > sqlite> SELECT * from users; > lev|logonex.eu|$6$1cCNWIMCTpuqmexO$cCq7nDEga1xza3967nZ.BFZaGWNoYwjnNfSCvZE/jGzYAY1hLWE1iHR1KYaO.mvVE4WVdDSrvPNtfwAUn/yk3/|/home/lev|1001|1001 I'm not too hip about SQLite and schemas so I don't know about all the other fields you have and whether you're parsing it correctly. Need doveconf -n to see your SQL query. > I've tried adding this to the database, but still no luck. :-( > {SHA512-CRYPT}$6$kbUEfz/Mcgpctv/s$uNQGOL/2F01Br.vx0twozVi6v.KJAHZV0OQ7yOFwD9YCloh7UJmeFe7WrgUez9Q5xXdrNOU5q9H8fE3FU2ok9. How does it relate to the previous hash? Same password but another salt and prepended with {SHA512-CRYPT}? > The other thing I want to avoid is the home directory and UID and GID. Is > there any way for dovecot to use logical, non UNIX users so there's no need to > have a user database and an sqlite database? Yes, you want a virtual user setup. https://wiki.dovecot.org/VirtualUsers You still need a user/password database of some sort unless you're contemtemplating some wild free-for-all access with a single shared password. Joseph Tam <jtam.home(a)gmail.com>

2 1

Re: Cannot Authenticate user with Kerberos/GSSAPI
by Joseph Tam 14 Jul '17

14 Jul '17

mark(a)ohprs.org > My last message probably contained too much information. This one is more succient. "Succint" may not be the right adjective, because I think this is the third copy I've seen. > Here is the dovecot log when user dsmith attempts to connect to dovecot > from the Tbird client: What I see is ... > Jul 11 19:29:46 imap-login: Info: Disconnected (no auth attempts in 3 secs): user=<>, rip=192.168.0.57, lip=192.168.0.2, TLS, session=<jR0sExNUTADAqAA5> ... a failed authentication with no real mention of Kerberos stuff, followed soon after with SSL/Kerberos yackety-yack, and ... > Jul 11 19:30:18 imap-login: Info: Login: user=<dsmith>, method=GSSAPI, rip=192.168.0.57, lip=192.168.0.2, mpid=3150, TLS, session=<iDUNFRNUUgDAqAA5> ... successful authentication via GSSAPI! From the log files you've shown, you were able to authenticate "dsmith". Your mail reader tells you otherwise? Joseph Tam <jtam.home(a)gmail.com>

1 1

SQLite user database
by Levente Kovacs 14 Jul '17

14 Jul '17

Dear Dovecot users/developers, I installed dovecot, and want to use a sqlite database for users, and passwords. I continuously get user authentication errors. I suspect that the problem is with a password hashing. I used # doveadm pw -s SHA512-CRYPT Enter new password: Retype new password: {SHA512-CRYPT}$6$1cCNWIMCTpuqmexO$cCq7nDEga1xza3967nZ.BFZaGWNoYwjnNfSCvZE/jGzYAY1hLWE1iHR1KYaO.mvVE4WVdDSrvPNtfwAUn/yk3/ to get a password hash. I have this at the database: sqlite> SELECT * from users; lev|logonex.eu|$6$1cCNWIMCTpuqmexO$cCq7nDEga1xza3967nZ.BFZaGWNoYwjnNfSCvZE/jGzYAY1hLWE1iHR1KYaO.mvVE4WVdDSrvPNtfwAUn/yk3/|/home/lev|1001|1001 I've tried adding this to the database, but still no luck. :-( {SHA512-CRYPT}$6$kbUEfz/Mcgpctv/s$uNQGOL/2F01Br.vx0twozVi6v.KJAHZV0OQ7yOFwD9YCloh7UJmeFe7WrgUez9Q5xXdrNOU5q9H8fE3FU2ok9. Could you please help me out what I'm doing wrong? I'm using dovecot version: 2.2.13 The other thing I want to avoid is the home directory and UID and GID. Is there any way for dovecot to use logical, non UNIX users so there's no need to have a user database and an sqlite database? Thank you for your help. Levente

1 0

Can Dovecot replace fetchmail?
by Kenneth Porter 14 Jul '17

14 Jul '17

I'm using fetchmail to grab mail for multiple accounts from an external IMAP server and drop it into local mailboxes via SMTP. It polls the remote server every two minutes. Can Dovecot replace this functionality more elegantly, using IDLE to avoid the polling necessary with fetchmail? I'd like to designate that mail for specific accounts on the external server be moved to specific local mailboxes. --- This email has been checked for viruses by Avast antivirus software. https://www.avast.com/antivirus

3 2

Re: System users lookup via PAM: strip the domain name?
by Larry Rosenman 13 Jul '17

13 Jul '17

Ok,, I was half awake when I typed that 😀 Sent from my Sprint Samsung Galaxy S8+. -------- Original message --------From: Aki Tuomi <aki.tuomi(a)dovecot.fi> Date: 7/13/17 6:19 AM (GMT-06:00) To: Dovecot List <dovecot(a)dovecot.org>, Larry Rosenman <larryrtx(a)gmail.com> Subject: Re: System users lookup via PAM: strip the domain name? No it's intentionally %Ln to convert user1@domain into user1 for PAM. Aki > On July 13, 2017 at 2:03 PM Larry Rosenman <larryrtx(a)gmail.com> wrote: > > > Is the %Ln on the 2nd passdb supposed to be a %Lu? > > > Sent from my Sprint Samsung Galaxy S8+. > -------- Original message --------From: Aki Tuomi <aki.tuomi(a)dovecot.fi> Date: 7/13/17 4:43 AM (GMT-06:00) To: Dovecot List <dovecot(a)dovecot.org>, Larry Rosenman <larryrtx(a)gmail.com> Subject: Re: System users lookup via PAM: strip the domain name? > No. > > It's just a placeholder, like %u or %d. > > Aki > > > On July 13, 2017 at 10:57 AM Larry Rosenman <larryrtx(a)gmail.com> wrote: > > > > > > Will %{original_username} set %d as well? > > > > > > Sent from my Sprint Samsung Galaxy S8+. > > -------- Original message --------From: Aki Tuomi <aki.tuomi(a)dovecot.fi> Date: 7/13/17 12:34 AM (GMT-06:00) To: Dovecot List <dovecot(a)dovecot.org>, Larry Rosenman <larryrtx(a)gmail.com> Subject: Re: System users lookup via PAM: strip the domain name? > > > > > On July 13, 2017 at 4:27 AM Larry Rosenman <larryrtx(a)gmail.com> wrote: > > > > > > > > > I have a need for the following: > > > > > > Real system users in /etc/{passwd,shadow} (actually PAM on FreeBSD) wirhOUT @domain in /etc/passwd > > > > > > Virtual Users in SQL (with full user@domain in the DB) > > > > > > > > > > > > When I have auth_username_format = %Ln I can’t auth the Virtual Users, and if I have auth_username_format = %Lu I can’t auth System users. > > > > > > > > > > > > Is there a compromise somewhere? > > > > > > > > > > You could try using %{original_username} in SQL. > > > > Or you can try removing the auth_username_format and instead > > > > passdb { > > driver = sql > > args = ... > > } > > passdb { > > driver = static > > args = user=%Ln noauthenticate > > # you can remove next line if you want to always normalize your usernames > > skip = authenticated > > } > > passdb { > > driver = pam > > args = ... > > skip = authenticated > > } > > > > Aki

1 1

passwd-file unknown user even if known
by Ricardo Branco 13 Jul '17

13 Jul '17

I am seeing lots of passwd-file unknown user messages even when they are known and they can login. I have several passwd files that are looked up with a deny file first, could the first check on the deny.%Ls file be generating this message then when it checks the next passdb driver it is found? If so is there a way to suppress the error message until all drivers have been checked?

1 0

Re: System users lookup via PAM: strip the domain name?
by Larry Rosenman 13 Jul '17

13 Jul '17

Is the %Ln on the 2nd passdb supposed to be a %Lu? Sent from my Sprint Samsung Galaxy S8+. -------- Original message --------From: Aki Tuomi <aki.tuomi(a)dovecot.fi> Date: 7/13/17 4:43 AM (GMT-06:00) To: Dovecot List <dovecot(a)dovecot.org>, Larry Rosenman <larryrtx(a)gmail.com> Subject: Re: System users lookup via PAM: strip the domain name? No. It's just a placeholder, like %u or %d. Aki > On July 13, 2017 at 10:57 AM Larry Rosenman <larryrtx(a)gmail.com> wrote: > > > Will %{original_username} set %d as well? > > > Sent from my Sprint Samsung Galaxy S8+. > -------- Original message --------From: Aki Tuomi <aki.tuomi(a)dovecot.fi> Date: 7/13/17 12:34 AM (GMT-06:00) To: Dovecot List <dovecot(a)dovecot.org>, Larry Rosenman <larryrtx(a)gmail.com> Subject: Re: System users lookup via PAM: strip the domain name? > > > On July 13, 2017 at 4:27 AM Larry Rosenman <larryrtx(a)gmail.com> wrote: > > > > > > I have a need for the following: > > > > Real system users in /etc/{passwd,shadow} (actually PAM on FreeBSD) wirhOUT @domain in /etc/passwd > > > > Virtual Users in SQL (with full user@domain in the DB) > > > > > > > > When I have auth_username_format = %Ln I can’t auth the Virtual Users, and if I have auth_username_format = %Lu I can’t auth System users. > > > > > > > > Is there a compromise somewhere? > > > > > > You could try using %{original_username} in SQL. > > Or you can try removing the auth_username_format and instead > > passdb { > driver = sql > args = ... > } > passdb { > driver = static > args = user=%Ln noauthenticate > # you can remove next line if you want to always normalize your usernames > skip = authenticated > } > passdb { > driver = pam > args = ... > skip = authenticated > } > > Aki

2 1

Re: System users lookup via PAM: strip the domain name?
by Larry Rosenman 13 Jul '17

13 Jul '17

Will %{original_username} set %d as well? Sent from my Sprint Samsung Galaxy S8+. -------- Original message --------From: Aki Tuomi <aki.tuomi(a)dovecot.fi> Date: 7/13/17 12:34 AM (GMT-06:00) To: Dovecot List <dovecot(a)dovecot.org>, Larry Rosenman <larryrtx(a)gmail.com> Subject: Re: System users lookup via PAM: strip the domain name? > On July 13, 2017 at 4:27 AM Larry Rosenman <larryrtx(a)gmail.com> wrote: > > > I have a need for the following: > > Real system users in /etc/{passwd,shadow} (actually PAM on FreeBSD) wirhOUT @domain in /etc/passwd > > Virtual Users in SQL (with full user@domain in the DB) > > > > When I have auth_username_format = %Ln I can’t auth the Virtual Users, and if I have auth_username_format = %Lu I can’t auth System users. > > > > Is there a compromise somewhere? > > You could try using %{original_username} in SQL. Or you can try removing the auth_username_format and instead passdb { driver = sql args = ... } passdb { driver = static args = user=%Ln noauthenticate # you can remove next line if you want to always normalize your usernames skip = authenticated } passdb { driver = pam args = ... skip = authenticated } Aki

2 1