- dovecot - dovecot.org

[Dovecot] Concerned about Dovecot's new NTLM code
by Andrew Bartlett 26 Sep '04

26 Sep '04

I'm pleased to see another project increasing compatibility with windows clients, by the addition of NTLM login support, but I'm a bit worried about a few implementation details, and hope to offer an alternate approach. I mean no disrespect to those who have implemented to the code so far, but I feel that the idea of 'everybody re-implement NTLM' is prone to failure. Firstly, to bugs I've noticed by casual inspection of your implementation: - Unicode support is by 'null padding' - there is no real support for non-ascii characters. - NTLM2 (a negotiated scheme to avoid sending the LM response) is unsupported - NTLMSSP is NDR, not 'C struct pushed to the wire', it needs to be correctly marshaled and unmarshaled. There are other missing features, some of which are rumoured to become mandatory flags in future, but more importantly, because the implementation is standalone, it has no ability to integrate into an NT/Win2k/Samba domain. As part of the Samba team, I have worked with other projects - Squid in particular, to deliver server-side (and client-side) NTLMSSP authentication, without the need to re-implement the NTLMSSP protocol. This is done by a callout to 'ntlm_auth', a Samba 3.0 utility designed for this purpose, which in turn can contact domain controllers, allowing for seamless single sign on. http://samba.org/samba/docs/man/ntlm_auth.1.html I have recently completed reworking mod_ntlm_winbind for a similar purpose, and have patches for cyrus-sasl in my 'lorikeet' subversion repository. These should serve as good examples for the simple fork()/exec() modal that is used, and also show the support for GSS-SPNEGO (aka HTTP Negotiate) that ntlm_auth also provides. http://download.samba.org/ftp/unpacked/lorikeet/trunk/ My hope is that I can tempt a Dovecot developer to take on the challenge of modifying the dovecot to use ntlm_auth, and am most willing to answer any questions (here, by private mail or on the samba-technical list) that you may have on the issue. Thanks, Andrew Bartlett -- Andrew Bartlett abartlet(a)samba.org Authentication Developer, Samba Team http://samba.org Student Network Administrator, Hawker College abartlet(a)hawkerc.net

2 1

[Dovecot] help on config the dovecot
by zhou mendy 24 Sep '04

24 Sep '04

I just installed the Fedora Core 2 and want to set up the mailserver. Could you please give me a step by step instruction to configure the dovecot? I want a IMAP & POP3 service and use mbox format. thanks __________________________________ Do you Yahoo!? New and Improved Yahoo! Mail - 100MB free storage! http://promotions.yahoo.com/new_mail

2 1

[Dovecot] problems with cvs version and vpopmail
by Kristoffer Ek 24 Sep '04

24 Sep '04

Hi, I have tried compiling the latest cvs version of dovecot on my FreeBSD 5.2.1-release box with the ports version of vpopmail: 5.4.3_1. In the configuration file I have two auth paragraphs, one for passwd authentication and one for vpopmail-auth: auth vpopmail { mechanisms = plain userdb = vpopmail passdb = vpopmail user = vpopmail } But the vpopmail dosn'nt work. I got the folowing in the log: Info: auth(vpopmail): vpopmail(stoffer(a)test.ek.dk): unknown user (stoffer(a)test.ek.dk) When I ktrace the dovecot process, it seams that it is trying to access the mysql db, but it ignores the settings in ~vpopmail/etc/vpopmail.mysql If I use the ports version of dovecot it works, but of course without the multiple auth capability since it is version 0.99... Any hints on debugging? - kristoffer -- 1st graffitiist: QUESTION AUTHORITY! 2nd graffitiist: Why? Kristoffer Ek http://ek.dk/ +45 20 40 00 05

2 3

[Dovecot] Help!
by zhou mendy 24 Sep '04

24 Sep '04

I need a step by step procedure to: Configure a Fedora Core 2 server as a Mail server with following: Postfix LDAP for authentication Dovecot for IMAP & POP3 server Squirrelmail for webmail SpamAssassin for spam protection ClamAV for anti-virus Must use maildir mailbox format We need a secure IMAP server with web interface, the 2 critical items are: 1. Postfix 2. LDAP I don't want to compile anything, just want to do a yum install or yum update so the system maintains itself. _______________________________ Do you Yahoo!? Declare Yourself - Register online to vote today! http://vote.yahoo.com

1 0

[Dovecot] more verbose debugging with test45
by Kim Culhan 24 Sep '04

24 Sep '04

Greetings- Is there any way to increase the logging output of dovecot ? I've set auth_verbose and auth_debug = yes The only output is a single line to syslog mail.info: Sep 23 09:01:54 server dovecot: pop3-login: Login: me [ip.is.here.00] test45 doesn't appear to have the --rawlog configuration option There is nothing written to ~/dovecot.rawlog Tried setting ~/dovecot.rawlog mode to 777 Running FreeBSD-5.3 and dovecot-1.0-test45 dovecot is using passwd auth and pop3s for test purposes and appears to be working correctly otherwise The reason I think I need this is that I don't feel comfortable putting this into production as it is a 'black box' at this point, without a little more testing.. Any help here would be very greatly appreciated -kim __________________________________ Do you Yahoo!? Yahoo! Mail Address AutoComplete - You start. We finish. http://promotions.yahoo.com/new_mail

2 1

[Dovecot] 1.0-test46
by Timo Sirainen 24 Sep '04

24 Sep '04

http://dovecot.org/test/ Most importantly added mbox_lazy_writes option, enabled by default. This makes Dovecot do writes to mbox only with EXPUNGE and CHECK commands and when mailbox is being closed. This is the same behaviour as with UW-IMAP. Especially useful for POP3 where most users just download the mails and delete everything - with this enabled Dovecot doesn't anymore go writing X-UID headers and whatever. Be careful anyway with this release, it seems to be working with me but mbox can get corrupted from simple mistakes. Other important fixes include: - handle UIDVALIDITY changes in mbox correctly - we might have overridden others dotlock files if they were being rapidly recreated with different processes - should fix syncing read-only mboxes (maybe dovecot.org finally stops giving internal errors :) - fixed several other mbox syncing issues which were quite rare without lazy writing - when sending lots of non-mail data to IMAP clients, Dovecot might have lost some of it causing weird problems. With pop3 it crashed with assert instead of losing data.

1 0

[Dovecot] Postfix-TLS/SASL-rimap
by Daniel L. Miller 23 Sep '04

23 Sep '04

Will Dovecot support the Cyrus SASL library rimap mechanism? If so, is there anything I need to enable/verify for it to work? And is there another tool to verify proper behaviour besides trying to log in with a client? Daniel

3 6

[Dovecot] Questions about mail process chroots
by Brett Smith 22 Sep '04

22 Sep '04

Greetings, I am configuring a new Dovecot installation, and the way the valid_chroot_dirs and mail_chroot variables affect the mail processes are a bit unclear to me. I was wondering if anyone could provide me with more specific details than the comments in the configuration file do, or maybe even recommend some values given my configuration. We have a Debian GNU/Linux system and a mix of users with shell accounts and users with disabled logins. Both these groups should be handled the same way by Dovecot: auth_userdb is passwd and auth_passdb is pam. The dovecot PAM service will use pam_mysql.so, if that matters. Mail is in mbox format (we have too many sticklers who are set in their ways, unfortunately); I'm thinking default_mail_env should be mbox:~/Mail/:INBOX=/var/mail/%u. So, if I understand correctly, (a) I should set chroots on the mail processes, since some of our users don't have real shell accounts, and (b) those processes will need access to /var/mail and home directories under /home. So my best guess is that I should set the chroot variables like this: valid_chroot_dirs = /var/mail:/home mail_chroot = /var/mail I'm not sure about this though, for a number of reasons. Do I need to even chroot at all, or do I misunderstand the comments? If I do need to chroot, the comments about valid_chroot_dirs warn very strongly that the chroot dirs should not be writeable by users. /home itself isn't writeable by users, but obviously their home directories are. Is listing /home also vulnerable to exploits? If it is, what would a good solution be? What's the meaning of /./ in mail_chroot? The comments about it, unfortunately, make no sense at all to me. It says that /home/./user is the same as /home, but if that's completely true, why wouldn't I just say mail_chroot = /home? I even looked into the source and it still wasn't really clear to me. Thanks in advance for any help you can offer, -- -- Brett Smith

2 1

[Dovecot] Lost messages with Mozilla and dovecot 0.99.x
by John Peacock 22 Sep '04

22 Sep '04

I have just moved our corporate e-mail over to qmail/dovecot and am very happy with the performance. However, I have had two reports of messages going missing which may or may not be directly related to Dovecot. I was able to observe this in action this morning: 1) I got the user out of their e-mail client (Mozilla 1.7.2) and forced an email to be delivered. It showed up in Maildir/new. 2) I had the user log in using our webmail (Squirrelmail) and the message was visible to the client (and correctly moved to Maildir/cur). 3) The user then logged in using the Mozilla mail client and not only was the message not visible in the client, it was no longer on the disk! 4) This was completely repeatable, even if I deleted the .INBOX/index files and forced dovecot to rebuild. For the moment I am thinking this is a client problem, but I thought I'd mention it just in case it rang a bell with someone. I wound up installing 0.99.11 just for grins (I just moved these people to the new server and don't want to risk 1.00-test yet). I'm also going to look at whatever debugging messages are available in dovecot; it would be useful to see a log of all imap transactions, not just login, so I could confirm that it is the client process requesting that the files be deleted and not somethink with dovecot itself (or some hardware failure). Thanks John -- John Peacock Director of Information Research and Technology Rowman & Littlefield Publishing Group 4501 Forbes Boulevard Suite H Lanham, MD 20706 301-459-3366 x.5010 fax 301-429-5748

2 3

[Dovecot] 1.0-test45
by Timo Sirainen 22 Sep '04

22 Sep '04

http://dovecot.org/test/ So, the last release was a stupid one. Here's a working one.

3 3