- dovecot - dovecot.org

Re: [Dovecot] Major CPU spike for SSL parameters?
by Peter Chiu 23 Jan '06

23 Jan '06

I tried your patch again b2 and I am still having the same problem. Jan 22 17:57:30 foxmulder dovecot: Dovecot v1.0.beta2 starting up Jan 22 17:57:30 foxmulder dovecot: ssl_parameters_regenerate = 48 Jan 22 17:58:30 foxmulder dovecot: SSL parameters regeneration completed Jan 22 18:07:31 foxmulder dovecot: ssl_parameters_regenerate = 48 Jan 22 18:07:43 foxmulder dovecot: SSL parameters regeneration completed Btw, my machine is only i386, not 64bits. Let me know if you need anything else. Timo Sirainen wrote: > On Sun, 2006-01-22 at 23:26 +0800, John Wong wrote: >> i upgrade 1.0-beta1 to cvs version, i use openbsd/i386 >> i tried this 3 settings >> ----------------------------------------------------------------- >> ssl_parameters_regenerate = 0 >> ssl_parameters_regenerate = 68 >> #ssl_parameters_regenerate = 168 (default) >> ----------------------------------------------------------------- >> all setting have this problem too (every 10mins regen SSL) > > Could you try what it writes to logs with this patch: > > diff -u -r1.21 ssl-init.c > --- src/master/ssl-init.c 22 Jan 2006 10:50:54 -0000 1.21 > +++ src/master/ssl-init.c 22 Jan 2006 16:16:14 -0000 > @@ -98,6 +98,7 @@ > are correct */ > regen_time = set->ssl_parameters_regenerate == 0 ? ioloop_time : > st.st_mtime + (time_t)(set->ssl_parameters_regenerate*3600); > + i_info("ssl_parameters_regenerate = %d", set->ssl_parameters_regenerate); > if (regen_time < ioloop_time || st.st_size == 0 || > st.st_uid != master_uid || st.st_gid != getegid()) { > if (foreground) { >

2 1

[Dovecot] Thanks
by ohp＠pyrenet.fr 22 Jan '06

22 Jan '06

Many thanks for helping me solving my problems After a few conf tweakings, dovecot works so well that I may put it on prod tomorrow. Many thanks to Timo!!! A few questions though: I had to raise the number of auth_process to 10 to avoid tons of messages "can't connect to socket 'default' is that ok? After tweaking my postgresql database to authenticate virtual users I notices that SQL userdb MUST have home AND mbox file. Not wanting virtual users to have anything but INBOX, I've set home dir in query to /tmp/%u. is that ok too? Best regards to all and many thanks again. -- Olivier PRENANT Tel: +33-5-61-50-97-00 (Work) 15, Chemin des Monges +33-5-61-50-97-01 (Fax) 31190 AUTERIVE +33-6-07-63-80-64 (GSM) FRANCE Email: ohp(a)pyrenet.fr ------------------------------------------------------------------------------ Make your life a dream, make your dream a reality. (St Exupery)

1 0

Re: [Dovecot] plain text auth
by Timo Sirainen 22 Jan '06

22 Jan '06

On Sun, 2006-01-22 at 12:18 +0100, ohp(a)pyrenet.fr wrote: > Hi Timo, > > Attached is my conf file. > > I spent hours running dovecot through the debugger, and I know for sure > that client->auth_mechs is empty. What client->auth_mechs? There's no such variable anywhere :) > I could'nt find where it is set the first time. Looking at the code, it should always complain in every possible situation where something might go wrong. So, first it should be figured out if the problem is in dovecot-auth or imap-login. Try adding some debugging first: diff -u -r1.16 auth-server-connection.c --- src/lib-auth/auth-server-connection.c 14 Jan 2006 18:47:23 -0000 1.16 +++ src/lib-auth/auth-server-connection.c 22 Jan 2006 13:08:19 -0000 @@ -164,6 +164,8 @@ conn->refcount++; while ((line = i_stream_next_line(conn->input)) != NULL) { + i_info("auth server: %s", line); + if (strncmp(line, "OK\t", 3) == 0) ret = auth_client_input_ok(conn, line + 3); else if (strncmp(line, "CONT\t", 5) == 0) It should be sending a MECH line with PLAIN parameter.

2 5

[Dovecot] dovecot-lda and vpopmail
by John Peacock 22 Jan '06

22 Jan '06

I'm setting up a new box with Dovecot 1.0 beta1 and vpopmail. Normal operations works like a charm, i.e. vpopmail virtual can log in sucessfully using TLS. However, when trying to test dovecot-lda out of CVS, it is not locating the user: > *** Starting dovecot-imapd service... > dovecot: Info: Dovecot v1.0.beta1 starting up > dovecot: Info: auth(default): master in: USER 1 postmaster(a)example.com service=deliver > dovecot: Info: auth(default): master out: USER 1 postmaster uid=89 gid=89 home=/home/vpopmail/domains/example.com/postmaster > dovecot: Error: auth(default): except that the "master out" line *has* the correct information, though I don't know what that "Error" line is trying to tell me. However, I am getting the mail bounced back with: > deliver: Fatal: mail setting not given which is this error in the src/deliver.c:607 /* MAIL comes from userdb, DEFAULT_MAIL_ENV from dovecot.conf */ mail_env = getenv("MAIL"); if (mail_env == NULL) mail_env = getenv("DEFAULT_MAIL_ENV"); if (mail_env == NULL) i_fatal_status(EX_CONFIG, "mail setting not given"); which would certainly suggest that the userdb access failed in deliver (though the log would see to seem to suggest otherwise). I even tried setting the DEFAULT_MAIL_ENV in dovecot.conf, but that didn't work either. Anyone have any ideas about what I am missing? John -- John Peacock Director of Information Research and Technology Rowman & Littlefield Publishing Group 4501 Forbes Boulevard Suite H Lanham, MD 20706 301-459-3366 x.5010 fax 301-429-5748

2 4

[Dovecot] 1.0 beta1 released
by Timo Sirainen 22 Jan '06

22 Jan '06

As promised, here it is finally. v1.0 is getting nearer and I want people to start looking at Dovecot's sources. Getting some more help with development would be nice, but I'd also like to hear if there are any hidden bugs in the code. So, one week from now I'll start offering 1000 EUR for the first person to point out a remotely exploitable security hole in Dovecot. See http://dovecot.org/security.html for more information. Changes since 1.0alpha5: UPGRADE WARNING: Unlike earlier Dovecot versions, 1.0 beta1 now requires Diffie-Hellman parameters to have been generated before SSL/TLS is used. These are generated when Dovecot is started for the first time and it may take several minutes. During this time SSL/TLS connections aren't working. (I decided to leave it this way at least for now. I don't think any new Dovecot admins will try to log in with SSL within the first 5 minutes of the installation?) Features: - DSA SSL connections provide now forward secrecy (which causes the DH parameter issue mentioned above) - Support for password protected SSL private keys - LDAP: Added authentication bind support. Patch by J.M. Maurer - LDAP: Added fast authentication binding. Patch by Geff <boing(a)boing.com> - PAM: Changed -session parameter to session=yes - kqueue support. Patch by Vaclav Haisman - dbox updates. Kind of works now, but not recommended for more than testing yet. There still are known bugs. - maildir_copy_with_hardlinks=yes works again - Sometimes Dovecot kept telling about keyword changes over and over again even if there weren't any. - Beginnings of fallbacking to in-memory indexes when write fails with "out of disk space" error. Not perfect yet, but helps in some cases. - When IDLEing, send a small notification every 2 minutes so that NATs/firewalls don't close the connection. - Added gdbhelper binary to help debugging Performance improvements: - Don't fdatasync() cache file. Not that important and gives better performance. - mmap_disable=yes mode doesn't keep rewriting index file now constantly, so it uses much less disk I/O. - Some other minor index file improvements Bugfixes: - UID STORE command wasn't returning UIDs in replies - Fixes for various problems with IDLE command. - THREAD command crashed if no search matches were found - Some fixes to handling LIST command with namespaces. Helps Pine. - Fixed a situation in mbox when it could get the process to infinite loop - Fixed one mbox assert crash - Use long line wrapping for X-IMAPbase, X-IMAP and X-Keywords headers for UW-IMAP compatibility - dovecot --exec-mail wasn't cleaning existing environment variables properly

16 26

[Dovecot] sqlite patch
by Jakob Hirsch 22 Jan '06

22 Jan '06

Hi, http://plonk.de/sw/dovecot/dovecot.sqlite.4.diff It uses sqlite3 and is not heavily tested, but it works quite fine here. Have fun!

2 2

[Dovecot] Dovecot-LDA & sieve
by Björn Ketelaars 22 Jan '06

22 Jan '06

I’m trying to make use of sieve by means of the Dovecot LDA Wiki - http://wiki.dovecot.org/LDA. Looking at maillog, mail is being delivered by means of deliver to the right user: Jan 22 16:05:31 gateway sm-mta[17258]: STARTTLS=server, relay=[10.0.0.100], version=TLSv1/SSLv3, verify=NO, cipher=DHE-RSA-AES256-SHA, bits=256/256 Jan 22 16:05:32 gateway sm-mta[17258]: k0MF5VJ2017258: from=<bjorn(a)hydroxide.nl>, size=354, class=0, nrcpts=1, msgid=<43D39F31.3080502(a)hydroxide.nl>, proto=ESMTP, daemon=MTA, relay=[10.0.0.100] Jan 22 16:05:32 gateway sm-mta[32229]: k0MF5VJ2017258: to=| "/usr/local/libexec/dovecot/deliver", ctladdr=<test(a)hydroxide.nl> (1000/1000), delay=00:00:00, xdelay=00:00:00, mailer=prog, pri=30633, dsn=2.0.0, stat=Sent Unfortunately .dovecot.sieve is left alone and thus nothing is being sorted. Any suggestions maybe?

1 0

[Dovecot] Resync dovecot index after manual moving mails in maildir
by Danilo Reinhardt 22 Jan '06

22 Jan '06

Hello, i'm new to dovecot and this list. Dovecot works very well after all! I now have a small problem, maybe there is a solution. For automatically spam learning i've created a maildir folder called "spam learn". Every hour spamassassin scans this folder and learn from the mails or files at this folder. After this learn i move the files to trash. If at this moment a client is connected via imap to this account, the mua (in my case thunderbird) doesnt update its folder view after reselecting the folder. Is this a mua problem or is this a index "problem" in dovecot (i know, it isnt a real problem or bug). If the second is the truth, is there any possibility to tell dovecot to rescan the maildir? Thanks in advance. Bye from Germay Danilo

2 4

[Dovecot] %d interpolation problem fixed
by William Ross 22 Jan '06

22 Jan '06

On 6 Dec 2005, at 17:21, Timo Sirainen wrote: > On Tue, 2005-12-06 at 17:11 +0000, William Ross wrote: >> On 6 Dec 2005, at 16:51, Timo Sirainen wrote: >> >>> On Fri, 2005-10-28 at 17:52 +0200, Riccardo Bini wrote: >>>>> I just wrote this: http://wiki.dovecot.org/Quota >>>> Well... but you have to correct %n with vpopmail backend. %u in the >>>> default_mail_env (like in the log) is always the user name without >>>> the >>>> domain.... >>> >>> That's a bug in Dovecot's vpopmail code. I don't know why it doesn't >>> work. Would be nice if someone using vpopmail fixed that.. >> >> point me in the right direction and I'll have a go. > > src/auth/passdb-vpopmail.c > > If user logs in as user@domain, then they both should be in > request->user string. %d is taken from there. I don't see request- > >user > being modified in that file either, so I think it should have worked.. I finally got round to working on this. I'm a perl programmer, and it has all been very educational, so please bear with me :) I was stuck because the domain name was not interpolated into the Maildir path[0], when using the configuration recommended here: http://wiki.dovecot.org/ QuestionsAndAnswers#head-153aa253aff40951a05cf238da4245b1cc1a4665 It turns out that the answer is really simple. You don't need to supply a default_mail_env parameter with vpopmail and dovecot v1.x. Indeed, you shouldn't: the path to the maildir is retrieved from vpopmail and if you specify default_mail_env then it will be used in place of that correct value. Also, it will be used wrongly, as there is also an interpolation bug, and %d isn't replaced correctly. The code in passdb-vpopmail and userdb-vpopmail works perfectly, by the way: the login email address[1] is parsed correctly, the vpopmail hookup is correct, and the vqpasswd struct that is returned by vpopmail_lookup_vqp contains all the right values. eg (these are debugging-for-dummies lines that I've scattered everywhere): > dovecot: Jan 17 22:51:42 Info: auth(default): * > vpopmail_verify_plain: now vpop_user = sysadmin, vpop_domain = > spanner.org, request->user = sysadmin(a)spanner.org, vpw->pw_dir = / > home/vpopmail/domains/spanner.org/sysadmin in the callback method I got this tab-separated auth_reply_stream: > dovecot: Jan 18 00:30:01 Info: auth(default): userdb_callback str: > USER 2 sysadmin uid=7797 gid=2109 home=/home/ > vpopmail/domains/spanner.org/sysadmin but I still saw these lines later: > dovecot: Jan 18 01:31:46 Info: imap(sysadmin): maildir: root=/home/ > vpopmail/domains//sysadmin/Maildir, index=/home/vpopmail/domains// > sysadmin/Maildir, control=, inbox= I became suspicious, and tested with nonsense values in default_mail_env: sure enough i got the same thing. During the userdb stage we have the correct path to the maildir, but later on we see a different value derived from the nonsense configuration I've just entered. I guess that we're getting the initial value from vpopmail and try the same thing but with no default_mail_env entry at all. It works perfectly. I say some new words I have learned from my wife. I don't know where the failure lies, but I can tell you that the 'user' value passed to get_var_expand_table (which comes from getenv ("USER")) contains only the first part of the email address. That's probably not the intention, because get_var_expand_table then tries to split it on @. As it happens the home-directory value is passed to get_var_expand_table as the expansion for %h, so this works too, in a completely redundant way: default_mail_env = maildir:%h I've tested this with an new tarball of 1.0.beta1 and it works fine - with the configuration change - so if this all sounds sane to you then I'll update the wiki. best, will [0] under vpopmail the maildir for the address brian(a)domain.com usually lives somewhere like: /home/vpopmail/domains/domain.com/brian/, [1] in order to disambiguate usernames, vpopmail has you log in with your full email address as the user id. dovecot would therefore need to split the email address and interpolate the fragments into the maildir path to get to the right place. however, the vpopmail password file also specifies the maildir for each user, which i guess is what dovecot is using now.

2 5

[Dovecot] new configure-option --disable-index
by Marten Lehmann 22 Jan '06

22 Jan '06

Hello, I experimented with dovecot the whole evening yesterday and the mailserver worked fine since there haven't been that much users connecting to it. I'm using dovecot 1.0.alpha5 as pop3 and pop3s server. The maildirs are mounted through NFS and since there is no nfslockd running I disabled mmap in the config and told dovecot to use dotlock. Also I experienced, that dovecot was much faster when using one login-process per connection instead of sharing them throughout several connections. Sharings seems to be a greater performance problem (bottleneck) than additional fork()s. However, under normal load at business time the server load increased to a value that made it impossible to download emails without timeouts, so we switched back to tcpserver/qmail-pop3d for pop3 and only kept dovecot for doing the pop3s part. Dovecot is really fine, but it still isn't NFS ready. Especially when using dovecot as pop3 only this index-stuff must be disengageable. What is the use of generating a complex index file for hundreds of messages, that will be deleted in the next step after downloading them? But the index is also a problem when using IMAP over NFS. Access to the files is too slow, so the connections keep hanging around and the i/o waiting value is raised to a maximum which slows down the whole machine. It simply doesn't make sense to build and update an index every time the maildir is accessed (which is very cpu and timeconsuming), while search operations (the only moment when the index is actually used and not just heavily updated) don't affect even 1% of all IMAP calls (and such a command doesn't even exist for pop3). I would be much obliged if you could create an option called "--disable-index" in the configure-script or something like "disable-index = yes" in dovecot.conf that makes dovecot ignoring existing index files and doesn't care for related operations, so NFS should work much faster and IMAP search would simply parse the files directly instead of looking in the index. I would really appriciate this very much and I'm absolutely sure, that a lot of people beside me are waiting for this. Regards Marten

7 22