I would appreciate this feature as well. Because i am using postfix relaying with permit_tls_clientcerts and it just checks the fingerprints of the certs. It find it far more convenient than using something like pam and authorising with user accounts. Postfix can use this features also in combination with normal sasl methods. < Using OpenSSL for authentication brings

in tons of more code that has to be relied on. Your port 22 is closed or does not rely on the the OpenSSL lib ? I took a short look at the sources from postfix but i am not too sure if it´s easy to include in dovecot. Just a idea.

Regards Jan

Timo Sirainen wrote:

Personally I'd really like to get the current CVS code fully working as intended. Then there's some long standing bugs/features (eg. recent counters). Then some NFS safety problems. All those should have been fixed long ago. yes, it's better to get dovecot stable first.

Also currently there's only dovecot-auth and master processes in Dovecot which have to be free of security holes to avoid pre-login security holes. That's not a lot of code. Using OpenSSL for authentication brings in tons of more code that has to be relied on.

I understand. But please, keep it in mind for later versions of dovecot!

On 10.5.2004, at 03:09, Timo Sirainen wrote:

I've been thinking about doing this lately as well. Shouldn't really be much of a job. Just tell OpenSSL library to require a valid client certificate. Optionally also force the cert's common name to be client's login name.

Current CVS version has ssl_verify_client_cert option. It doesn't do anything else - if client doesn't send valid certificate the SSL handshake fails.

On 18.10.2004, at 19:21, Johannes Berg wrote:

On Sat, 2004-05-08 at 13:08 +0300, Timo Sirainen wrote:

...

IDLE extension itself doesn't really support this feature. I have thought about making Dovecot send client STATUS notifications for mailboxes which have changed, but I don't know if clients would actually use it.

I know I'd put support for using that that into offlineimap, since continually syncing with it is really killing performance.

Well, I don't think Dovecot is ready yet to have that feature. Currently you'd have to do some ugly things to figure out what mailboxes to keep checking, and the checking itself might not be pretty. You could write such plugin to do that of course. Shouldn't be too difficult.

In my not-so-near-future plans I've been thinking about creating some kind of mailbox list index which would be updated every time mailboxes change. Checking changes from a single file should be pretty fast (and it would make STATUS faster as well).

Anyway .. How is that feature useful with offlineimap? And why couldn't you implement it by just making it send STATUS for each mailbox every few minutes? Without the mailbox index that's pretty much the way it would have to be done in Dovecot internally (unless you use dnotify with maildir).

On 22.10.2004, at 18:40, Johannes Berg wrote:

On Tue, 2004-10-19 at 02:22 +0300, Timo Sirainen wrote:

...

Anyway .. How is that feature useful with offlineimap? And why couldn't you implement it by just making it send STATUS for each mailbox every few minutes? Without the mailbox index that's pretty much the way it would have to be done in Dovecot internally (unless you use dnotify with maildir).

Actually, I misunderstood what you were saying. What I'm looking for is a notification when dovecot detects a new email. For some reason I thought it might be RFC-conforming to send an untagged STATUS on changes, even if the client didn't explicitly ask for it. But that probably just shows my ignorance of the IMAP RFC.

It is allowed, it's just not very easy to implement.

The point is that offlineimap is nice for the first sync, but all syncs after that are horribly slow because it keeps rescanning all (big) folders. Since I am sync'ing between two dovecots (one local, one on the mail server) I figured it'd be far more efficient if offlineimap just waited to see if any of them reported any changes somewhere and then propagated those to the other side.

You could do the "waiting" by polling all the available mailboxes with eg. STATUS (MESSAGES NEXTUID) every few minutes. If either of those values changed since last check, it would indicate something happened to the mailbox. Dovecot should reply to the STATUS commands fast if nothing has changed.

Requires no modifications to Dovecot and works with all IMAP servers :)