Re: [Dovecot] LDA vs. LMTP
Am 29.07.2013 22:38, schrieb Martin Burgraf: Well, the background process is hogging CPU why should it do that if it is idle? and RAM while it basically does nothing. guess what takes more RAM one long-running prcoess or 5 LDA processes because you get 5 messages at the same time and guess what takes more CPU - a idle process waiting on a new connection or fireup a whole new process all day long signature.asc Description: OpenPGP digital signature
Re: [Dovecot] constant Log synchronization error's
On 14.7.2013, at 13.18, Kim Bisgaard kim+dove...@alleroedderne.adsl.dk wrote: 11:45:57 Y dovecot: imap(X): Error: Log synchronization error at seq=6,offset=156 for /var/mail/X/mdbox/mailboxes/Junk/dbox-Mails/dovecot.index: Extension header update points outside header size .. # 2.2.4: /etc/dovecot/dovecot.conf This is actually a bug that is fixed already in hg.. I really should have released v2.2.5 already. I guess I'll do that this week after reading this mailing list and fixing any other new issues.
Re: [Dovecot] Dovecot v2.2.4 (ebbe00999da8) doveadm crash
On 16.7.2013, at 20.07, e-frog e-f...@gmx.de wrote: Current Dovecot v2.2 HG crashes using the following command: $ doveadm mailbox status -A -t unseen 'virtual/unread' #0 i_stream_next_line (stream=0x0) at istream.c:382 382 istream.c: No such file or directory. (gdb) bt full #0 i_stream_next_line (stream=0x0) at istream.c:382 _stream = optimized out pos = optimized out #1 0xb754656b in auth_master_user_list_next (ctx=0xb91bfbd8) at auth-master.c:689 line = optimized out Fixed the crash: http://hg.dovecot.org/dovecot-2.2/rev/0cab916b28c6 Although the real problem I think is that you didn't have permissions to connect to the auth-userdb socket.
Re: [Dovecot] dovecot-lda not logging if dovecot runs under daemontools
On Fri Jul 26 12:49:08 2013, Roberto Puzzanghera wrote: I have dovecot running under daemontools and I can't see dovecot-lda in action when I read the logs. I've set the logs to /dev/stderr because daemontools redirects /dev/stderr to /var/log/dovecot/current. Dovecot-lda runs under qmail, so you'll find the output in qmail's logs. If you run, say, doveadm manually, the output will be on your terminal. Yours Jost Krieger -- | jost.krieger+...@ruhr-uni-bochum.de Please help stamp out spam! | | Postmaster, JAPH, resident answer machineat RUB Comp. Center | | Sincere words are not sweet, sweet words are not sincere.| | Lao Tse, Tao Te King 81 |
Re: [Dovecot] 2.2.4 - quota-status changing the user it is running as
On 14.7.2013, at 19.54, Axel Luttgens axelluttg...@swing.be wrote:
and messages for that user are correctly rejected by lmtp:
dovecot[4989]: lmtp(5069, john@example.com):
QWSWLgrP4lF7FAAA5Q0ykw: msgid=20130714161643.9085DF176F2@ALMba.local: save
failed to INBOX: Quota exceeded (mailbox for user is full)
Going on with our telnet session:
recipient=john@example.com
size=1
action=OK
Hmmm... OK, this may be a config problem of mine which may require further
investigation.
Did you solve this?
and a look at the log indeed reveals that quota-status doesn't have
sufficient privileges anymore:
dovecot[4989]: quota-status(john@example.com): Error: user
john@example.com: Error reading configuration:
net_connect_unix(/_ROOT/var/run/dovecot/config) failed: Permission denied
Is this the expected behavior, to have quota-status switch to another user?
Either one of these fixes would be sufficient:
http://hg.dovecot.org/dovecot-2.2/rev/2470bb9106b0
http://hg.dovecot.org/dovecot-2.2/rev/51b8020b29f6
Yet another possibility would be to use service { service_count=1 } to recreate
the process every time.
Re: [Dovecot] dovecot-lda not logging if dovecot runs under daemontools
On Fri Jul 26 14:51:30 2013, Roberto Puzzanghera wrote: Hi Jost, thanks for your reply. Il 26.07.2013 13:11 Jost Krieger ha scritto: Dovecot-lda runs under qmail, so you'll find the output in qmail's logs. If you run, say, doveadm manually, the output will be on your terminal. I didn't explain myself very well. The qmail's log /var/log/dovecot/current doesn't show the lda output as expected. I That's dovecot's log, not qmail's. see onlythe output of imap and pop3. Anyway, running dovecot manually or as daemon in the normal way (without daemontools) show the lda output in the log. You are logging to stderr, in the delivery case that means qmail-local's output. This is somewhere in a place like /var/qmal/logs/qmail/current and looks similar to @400051f793e218f78c54 delivery 847552: success: lda():_Info:_msgid=20130730102215.ecb4880...@carlos.noc.ruhr-uni-bochum.de:_saved_mail_to_NOC-Order/did_0+0+1/ Yours Jost Krieger -- | jost.krieger+...@ruhr-uni-bochum.de Please help stamp out spam! | | Postmaster, JAPH, resident answer machineat RUB Comp. Center | | Sincere words are not sweet, sweet words are not sincere.| | Lao Tse, Tao Te King 81 |
Re: [Dovecot] Dovecot v2.2.4 (ebbe00999da8) doveadm crash
On 30.07.2013 12:10, wrote Timo Sirainen: On 16.7.2013, at 20.07, e-frog e-f...@gmx.de wrote: Current Dovecot v2.2 HG crashes using the following command: $ doveadm mailbox status -A -t unseen 'virtual/unread' #0 i_stream_next_line (stream=0x0) at istream.c:382 382 istream.c: No such file or directory. (gdb) bt full #0 i_stream_next_line (stream=0x0) at istream.c:382 _stream = optimized out pos = optimized out #1 0xb754656b in auth_master_user_list_next (ctx=0xb91bfbd8) at auth-master.c:689 line = optimized out Fixed the crash: http://hg.dovecot.org/dovecot-2.2/rev/0cab916b28c6 Thanks, with this change I get an error message instead of the crash: doveadm(te...@local.lan): Fatal: seteuid(0) failed: Operation not permitted Although the real problem I think is that you didn't have permissions to connect to the auth-userdb socket. Hmm, doveadm is running as user 'vmail' and auth-userdb socket has the following permissions: srw--- 1 vmail root 0 Jul 30 13:12 auth-userdb Which I think should work and actually has worked with all v2.2.x versions so far...
Re: [Dovecot] dovecot-lda not logging if dovecot runs under daemontools
Thank you, Jost. The lda output is actually logged on qmail-send's log regards, Roberto Puzzanghera Il 30.07.2013 12:35 Jost Krieger ha scritto: On Fri Jul 26 14:51:30 2013, Roberto Puzzanghera wrote: Hi Jost, thanks for your reply. Il 26.07.2013 13:11 Jost Krieger ha scritto: Dovecot-lda runs under qmail, so you'll find the output in qmail's logs. If you run, say, doveadm manually, the output will be on your terminal. I didn't explain myself very well. The qmail's log /var/log/dovecot/current doesn't show the lda output as expected. I That's dovecot's log, not qmail's. see onlythe output of imap and pop3. Anyway, running dovecot manually or as daemon in the normal way (without daemontools) show the lda output in the log. You are logging to stderr, in the delivery case that means qmail-local's output. This is somewhere in a place like /var/qmal/logs/qmail/current and looks similar to @400051f793e218f78c54 delivery 847552: success: lda():_Info:_msgid=20130730102215.ecb4880...@carlos.noc.ruhr-uni-bochum.de:_saved_mail_to_NOC-Order/did_0+0+1/ Yours Jost Krieger
[Dovecot] Calling dovecot-lda correctly from exim for virtual user setup
Hi, I'm running Dovecot 2.1.7 on Debian. Exim is the MTA. I was recently made aware of the fact that the way in which Exim invokes dovecot-lda is prone to code injection: dovecot_virtual_delivery: driver = pipe command = HOME=/home/vmail/\$local_part /usr/lib/dovecot/dovecot-lda -f \$sender_address use_shell .. I.e. a command is executed via the shell, and Exim uses non-sanitized user input (mail header fields) to construct the command. Now, the reason I invoked dovecot like that is to pass a plausible value for the HOME environment variable, so that dovecot-lda can determine where the Maildir directory of the recipient is. Is there any way to achieve this without requiring HOME to be set correctly? I looked at the -m switch but as far as I can see that merely defines the destination mailbox, but not the path to the Maildir directory, correct? -- Frerich Raabe - ra...@froglogic.com www.froglogic.com - Multi-Platform GUI Testing
Re: [Dovecot] Calling dovecot-lda correctly from exim for virtual user setup
On 2013-07-30 14:55, Frerich Raabe wrote: Now, the reason I invoked dovecot like that is to pass a plausible value for the HOME environment variable, so that dovecot-lda can determine where the Maildir directory of the recipient is. ...for the sake of completeness: this stems from the fact that I use mail_location = maildir:~/Maildir in my dovecot.conf -- Frerich Raabe - ra...@froglogic.com www.froglogic.com - Multi-Platform GUI Testing
[Dovecot] Postfix aliases with quota-status service
The latest HG commits seem to have fixed some underlying problems with the 'quota-status' service. Now doing some quick tests I wonder if this can be used with aliases on the Postfix side. Appears the 'check_policy_service' used in the example below will query existing users via Dovecot's Auth Backend: http://sys4.de/en/blog/2013/04/05/dovecot-quota-mit-postfix-abfragen/ http://www.postfix.org/SMTPD_POLICY_README.html This works fine for Dovecot user 'philo' where the mail is rejected upfront before it enters the queue: == /var/log/mail.log == Jul 30 13:41:18 spectre postfix/smtpd[31072]: NOQUEUE: reject: RCPT from host.example.com[1.2.3.4]: 554 5.2.2 ph...@trashheap.net: Recipient address rejected: Quota exceeded (mailbox for use r is full); from=u...@example.com to=ph...@trashheap.net proto=ESMTP helo=host.example.com Now user 'gunge' is an alias for 'philo' in Postfix, thus the quota check will not recognize the user, will queue the message and reject it at the MDA stage: == /var/log/mail.log == Jul 30 14:41:02 spectre postfix/lmtp[31460]: 3c4HSD5ZkBzBP: to=ph...@trashheap.net, orig_to=gu...@trashheap.net, relay=spectre.leuxner.net[private/dovecot-lmtp], delay=1.2, delays=1.1/0.01/0/0.13, dsn=4.2.2, status=deferred (host spectre.leuxner.net[private/dovecot-lmtp] said: 452 4.2.2 ph...@trashheap.net Quota exceeded (mailbox for user is full) (in reply to end of DATA command)) This is probably intended behaviour, just want to make sure that I'm not missing a point here. For now the only fix that comes to my mind to create quota aware aliases - is creating 'dummy' users in Dovecot which point to the same mailbox rather than performing aliasing on the Postfix end. Open to suggestions... Regards Thomas signature.asc Description: Digital signature
Re: [Dovecot] 2.2.4 - quota-status changing the user it is running as
Le 30 juil. 2013 à 12:28, Timo Sirainen a écrit :
On 14.7.2013, at 19.54, Axel Luttgens wrote:
[...]
Going on with our telnet session:
recipient=john@example.com
size=1
action=OK
Hmmm... OK, this may be a config problem of mine which may require further
investigation.
Did you solve this?
Hello Timo,
Nice to read from you.
Unfortunately, no; I'm still stuck with that problem, as described in:
http://www.dovecot.org/list/dovecot/2013-July/091462.html
[...]
Is this the expected behavior, to have quota-status switch to another user?
Either one of these fixes would be sufficient:
http://hg.dovecot.org/dovecot-2.2/rev/2470bb9106b0
http://hg.dovecot.org/dovecot-2.2/rev/51b8020b29f6
Thanks!
Do you really mean either, not both? I ask, because those patches seem to
intervene at quite different levels (but I guess I'll have, one day or another,
to get more acquainted with Dovecot's coding, so as not to come with such silly
questions...).
Yet another possibility would be to use service { service_count=1 } to
recreate the process every time.
Yes, but I fear some inefficiencies with such an extreme setting; in fact, I
hoped to rely on Postfix for managing the service's life cycle.
Best Regards,
Axel
Re: [Dovecot] Unable to use dovecot-antispam plugin
Le lundi 29 juillet 2013 08:51:17 Steffen Kaiser a écrit :
On Sat, 27 Jul 2013, Xavier Claude wrote:
2.1.7), but it's not working, each time I put a mail in the Spam
Turn on logging and the mail_log plugin:
http://wiki2.dovecot.org/Logging
http://wiki2.dovecot.org/Plugins/MailLog
Thank you it shows that there is no action when I try to move the mail to the
Spam directory. Here is the results when I move the mail from the Inbox to the
Draft directory and back to the Inbox :
Jul 30 22:01:46 twoflowers dovecot: imap(xavier): copy from INBOX: box=Drafts,
uid=7, msgid=20130717220057.586dd...@linux-s4x4.site, size=753
Jul 30 22:01:46 twoflowers dovecot: imap(xavier): delete: box=INBOX, uid=9,
msgid=20130717220057.586dd...@linux-s4x4.site, size=753
Jul 30 22:01:47 twoflowers dovecot: imap(xavier): expunge: box=Drafts, uid=6,
msgid=20130717220057.586dd...@linux-s4x4.site, size=753
Jul 30 22:01:51 twoflowers dovecot: imap(xavier): copy from Drafts: box=INBOX,
uid=11, msgid=20130717220057.586dd...@linux-s4x4.site, size=753
Jul 30 22:01:51 twoflowers dovecot: imap(xavier): delete: box=Drafts, uid=7,
msgid=20130717220057.586dd...@linux-s4x4.site, size=75
But when I move the mail to the spam directory, there is nothing in the log.
folder, it is send in its original folder. What bother me the most is
What was the original folder? Maybe Junk? try to turn off Junk filtering
by the mail client. With mail_log enabled you'll see many actions of your
client.
The original folder was the Inbox. It's a dedicated mail account to test the
antispam plugin, so there is no filtering by the client.
Here is my config with the logging enabled :
# 2.1.7: /etc/dovecot/dovecot.conf
# OS: Linux 3.2.14-std-ipv6-64 x86_64 Debian 7.1
mail_debug = yes
mail_location = maildir:~/Maildir
mail_plugins = mail_log notify
managesieve_notify_capability = mailto
managesieve_sieve_capability = fileinto reject envelope encoded-character
vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy
include variables body enotify environment mailbox date ihave
namespace inbox {
inbox = yes
location =
mailbox Drafts {
special_use = \Drafts
}
mailbox Junk {
special_use = \Junk
}
mailbox Sent {
special_use = \Sent
}
mailbox Sent Messages {
special_use = \Sent
}
mailbox Trash {
special_use = \Trash
}
prefix =
}
passdb {
driver = pam
}
plugin {
antispam_allow_append_to_spam = yes
antispam_backend = dspam
antispam_debug_target = syslog
antispam_dspam_args =
--user;%Lu;--deliver=spam,innocent;--source=error;--signature=%%s
antispam_dspam_binary = /usr/bin/dspam
antispam_dspam_notspam = --class=innocent
antispam_dspam_result_header = X-DSPAM-Result
antispam_dspam_spam = --class=spam
antispam_signature = X-DSPAM-Signature
antispam_signature_missing = error
antispam_spam = SPAM;Spam
antispam_trash = trash;Trash;Deleted Items; Deleted Messages
mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename
mail_log_fields = uid box msgid size
sieve = ~/.dovecot.sieve
sieve_dir = ~/sieve
}
protocols = imap sieve
service auth {
unix_listener /var/spool/postfix/private/auth {
mode = 0666
}
}
ssl_cert = /etc/dovecot/dovecot.pem
ssl_key = /etc/dovecot/private/dovecot.pem
userdb {
driver = passwd
}
protocol imap {
mail_plugins = mail_log notify antispam
}
Thank you for your answers.
--
Xavier Claude
claude.xav...@gmail.com
Re: [Dovecot] LDA vs. LMTP
Martin Burgraf writes: I don't know why you would consider a background process inferior to a run-on-demand executable. Well, the background process is hogging CPU and RAM while it basically does nothing. Hogging CPU and memory is putting it strongly, as it is basically suspended while blocked on waiting for a connection, and if left for a long time in an idle state, might be swapped out to disk and not consuming (real) memory, or consuming real memory that isn't in use otherwise. As I stated before, the resource usage is small compared with all the other stuff going on, so if you don't have a busy mail server, I don't think you should sweat the difference. The benefits of LMTP should increase with load, as having LMTP resident will save you the overhead of repeatedly loading/unloading LDA, and I'm sure the CPU and memory usage of servicing that overhead will be non-trivial. If you have oodles of memory, then it's no problem keeping a LMTP resident. If you don't have enough memory and are VM disk thrashing, you'll have other problems and LDA/LMTP is the least of your worries. And when it's running as root there is always the danger of privilege escalation. LDA only runs when it's needed and since it uses only user rights it shoudbe more harmless. I didn't contest the privilege separation aspect, as it a necessary design trade-off that one daemon doing things for all user will need overriding access. However, if this is a concern, you can virtualize all your users. LMTP can theoretically be subverted, but at least won't be as root. (I'm assuming LMTP stays as root, and not spawning off user processes to do the real work.) Joseph Tam jtam.h...@gmail.com
Re: [Dovecot] LDA vs. LMTP
At 3PM -0700 on 30/07/13 you (Joseph Tam) wrote: Martin Burgraf writes: And when it's running as root there is always the danger of privilege escalation. LDA only runs when it's needed and since it uses only user rights it shoudbe more harmless. I didn't contest the privilege separation aspect, as it a necessary design trade-off that one daemon doing things for all user will need overriding access. However, if this is a concern, you can virtualize all your users. LMTP can theoretically be subverted, but at least won't be as root. (I'm assuming LMTP stays as root, and not spawning off user processes to do the real work.) It doesn't stay as root; Dovecot's LMTP switches down to the user's uid to perform delivery, including sieve scripts. The security concerns are in fact very similar to LDA: for LDA delivery with (say) Postfix, you have local(8) running as root and switching down to the user to invoke the LDA, while for LMTP the Postfix lmtp(8) process runs as an unprivileged Postfix user and the LMTP server runs as root and switches down. AFAICS the LMTP conversation itself happens as root, though, which is a shame; I might think twice about exposing it directly over the network. Ben
