Re: self signed certs and dovecot imaps : howto? tlsv1 alert unknown ca
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Sat, 30 Jul 2016, hanas...@gmail.com wrote: How do you setup dovecot to use a self signed cert? One server will be connected to the internet. One will be totally internal and have no runtime access to the internet. Getting the below error msg. Also, I think I have a TLS 1.0 and need a 1.2 cert?... Thank you. Jul 28 20:09:27 host dovecot: imap-login:: user=<>, rip=10, lip=10, TLS: SSL_read() failed: error:14094418:SSL routines:ssl3_read_bytes:tlsv1 alert unknown ca: SSL alert number 48, session= have you imported the certificate into the client? - -- Steffen Kaiser -BEGIN PGP SIGNATURE- Version: GnuPG v1 iQEVAwUBV57spnz1H7kL/d9rAQKurgf/WFtVim8mnPSpEr8fSUpfxssLw3yOYoLm Hsc0TzoeU43BPJtIbtgNk9GcvXmpUVkYj6jDY1QcEx5UGWTn0TU3uO1LVPVCfBs7 nscBZPgEoEK6V52BGtzwTKlTPQAJKdoiJDgW8Djkzwwaum1nFBf+7l33YRQv2/yZ b0qiTH5UeXm9KggEHX5FNseHITF98mq8X/qbgn3bvpbxoItF5cZzKUppV+6xyZAb 7mvvl3tzdB6+fKSStW7UZ+Xm++2K+dLac8vshhszspKHM9mQO51/FyeiT4rj1JOI 2dJRTf3j28mLLqzBw1JB4LIi/ODHy8aanTz1+IvbNzzbwbBxEgE7GA== =8S0y -END PGP SIGNATURE-
RE: POP3 & IMAP inbox setting for virtual
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
On Fri, 29 Jul 2016, Michael Fox wrote:
you can select the passwd-file by %u , e.g. see the first example of
passdb's on http://wiki2.dovecot.org/AuthDatabase/PasswdFile
I think you mean by %s. Correct?
yes, %s = %{service}
So, generate a passwd-file with namespace/inbox/inbox, make a script to
strip this settings from it and dump into another file. This script is to
run each time, the main file changes (or by cron), in order to keep both
files in sync.
Then:
userdb {
driver = passwd-file
args = username_format=%n /etc/passwd.%s
# default_fields = uid=vmail gid=vmail home=/home/vmail/%u
}
Then symlink /etc/passwd.POP3 to the file with and /etc/passwd.IMAP (and
any other that generates not-found errors) to the file without the virtual
namespace.
Hmm. But the goal is for both POP3 and IMAP to see both namespaces. POP3
would see both via the virtual namespace. So, following the idea of
passwd-file per %s, it seems like I should do something like:
.../passwd.pop3:
Set the "extra fields" = userdb_namespace/virtual/inbox=yes
.../passwd.imap:
Set the "extra fields" = userdb_namespace/inbox/inbox=yes
Does that make sense?
yes :-)
- --
Steffen Kaiser
-BEGIN PGP SIGNATURE-
Version: GnuPG v1
iQEVAwUBV57qe3z1H7kL/d9rAQKX0Qf+KN9L0mgDLJTB27yrtJc9XmOifXqyzUGS
D49BALfSOv5aRXUoIW0Y7cRVYbcPPyeJPN5jdWeg93Hbljk8VryLh0kGGuU+y8YC
fToNd/rIyBVyX0nv4a4mxhbnxdwt5isSRzpr5aXANjJsUtJaCNqg7rs3l5vnvd7q
gWDiM9XkbKkxWVmwpVR5vXio8EMNNCdtNQWsdBxqqNvpHvnnOGu1NWyO20IHiK/b
NdPBxBImML8oxEmEGbIsbDs8wRefjXNak5RTAfIMpuQyb/31zwSIeOHWkLCGU9EQ
kLVQbl/lnbMxLcxVK37B3Q9TlbyFAWzCGf00FCZnyv0loGw2OVAV9w==
=QrF6
-END PGP SIGNATURE-
Re: IMAP flags and dovecot-keywords not working as expected
I think I've partially sorted out my issues. First off, as the wiki: http://wiki2.dovecot.org/MailboxFormat/Maildir points out: "The file [dovecot-keywords] must not be directly modified ...", which is what I tried. So the dovecot-keywords file I manually created (entries 0-6): 0 Board_and_Committee 1 Completed 2 Health_Care_meetings 3 Notifications 4 OSHP-DAS 5 personal_or_To_Do 6 Retirement_exits 7 $label5 8 Junk 9 $Forwarded 10 $MDNSent 11 $label2 Was not used by Thunderbird. So, I removed that file, went into Thunderbird, and manually set a random message to tag 1 which I had renamed as "Board and Committee". And behold! a new dovecot-keyword file was created with the single entry: 0 $label1 As you (Peter) point out, Thunderbird retrieves the text for these from prefs.js. The reason, therefore, I have e.g. "11 $label2" in my original hand-edited file is that Thunderbird caused what I had designated as "Health Care Meeting" to be added to #11 since the previous slots were already used by other things which it did not recognize. Hence, they ended up with a IMAP flag of 'l'. I repeated this for a total of 4 more tags, resulting in dovecot-keyword entries: 0 $label1 1 $label2 2 $label3 3 $label4 4 $label5 Now, setting the tag in Tbird results in the correct text and color being shown for the message and the resulting IMAP tag being set correspondingly to 'a' thru 'e'. Flush with victory, I then foolish violated the "don't modify directly principle" by adding: 5 $label6 6 $label7 Which I thought would correspond to my remaining TB tags. Of course, wrong. When I then set a message to the 6th tag (keyword entry 5, $label6), it did not do it. Instead, for my last 2 tags it created 2 new entries: 7 personal_or_to_do 8 retirement_exits So, IMAP flags 'f' and 'g' are skipped and "Personal or To Do" tags get an 'h' flag and "Retirement Exits" get an 'i' flag. What was I thinking! Not worth starting over as this user had no Outlook categories set to these values, so so-what if that user's files get flagged with 'h', 'i'. Also interesting to note that the actual text of these last 2 tags is stored in the dovecot-keywords file. I supposed this means that Thunderbird has a limit of 5 (or 7?) $label's and any added beyond that get stored differently. But, I'm not finished. Of course, Thunderbird expects to set tags/IMAPflas on virgin messages in the user's mail folders. However, my need is to import Outlook categories and have Thunderbird interpret the IMAP flags correctly having never set them directly. So, I repeated the same procedure in other folders with messages having Outlook categories. The problem here is that setting a message to "Board and Committee" (Tbird tag 1) did not necessarily resulting in an IMAP flag of 'a'. In some folders it was 'b', some 'c' and some 'd'. I think my problem here was that I had manually set the IMAP flags on these message beforehand. So (I think) when Thunderbird, coordinating with Dovecot, went to set Tag 1, it saw that flag 'a' was already used and it picked the next free flag. Some folders had IMAP files with 2 and 3 flags set, hence Tag 1 getting set to 'c' or 'd' in those folders. I believe if I had not initially pre-set the IMAP flags on these files I would have seen the correct correspondance: Tag 1 = flag 'a', Tag 2 = flag 'b', etc. What I then did in these cases was first, find out what IMAP flag a Tbird tagged file would be set to (e.g. 'c'), then renamed all my *a files to e.g. *c. That worked. Suddenly, folders with 100 flags thusly set showed up with correct tags and colors in Thunderbird. To summarize, and this what I will do next time: 1. DO NOT pre-add IMAP flags to mail files. 2. For each folder in which there are Outlook categorized message, set an arbitrary message in that folder to each of the Thunderbird flags corresponding to Outlook categories to determine the correct flag letter -- which also causes Thunderbird and dovecot to save their respective settings. 3. Then, rename each mail file to have the correct IMAP flag(s). That can be quicky done using a script and the list of message having Outlook categories. I believe this procedure will work correctly and I will confirm that when I process my 2nd Outlook user (who is, btw, the organization Director and who is a super user of Outlook categories! Failure is not an option!). For anyone needing to do the same thing (migrate Outlook categories), I've included below a VB script to run in Outlook which will output a list of all messages having categories. The IMAP mail file's Message ID can be used to locate the categorized message file in the IMAP folder hierarchy and the category name (following the "~") indicates which Thunderbird tag to map it to. I'll not include the bash script to mass-append IMAP flags to these files as that script will need some revising based on my recent experimentation, but should be a rather simple
Re: Sieve Script Replication Gliches (Report #2)
On 1/08/2016 10:01 AM, Stephan Bosch wrote: Op 7/31/2016 om 4:27 AM schreef Reuben Farrelly: Hi, I've observed some odd behaviour with dsync replication between two hosts, specifically to do with sieve script replication. Has anyone else experienced the replication problem? Are sieve scripts actually replicating in live time for other 2.2.24/2.2.25 users as well? For me I didn't notice this till I went looking so I wonder if other people are experiencing this but just not aware of it yet...? I will look at this more soon. Regards, Stephan. Some further information. On the primary host: thunderstorm home # ls -al */sieve/rules.sieve -rw--- 1 user1 user1 3570 Jul 31 11:45 user1/sieve/rules.sieve -rw--- 1 user2 user2 175 Mar 15 2014 user2/sieve/rules.sieve -rw--- 1 user3 user3 725 Jul 31 09:32 user3/sieve/rules.sieve -rw--- 1 user4 user4 0 Jan 1 1970 user4/sieve/rules.sieve -rw--- 1 user5 user5 0 Jan 1 1970 user5/sieve/rules.sieve -rw-r--r-- 1 user6 user6 3719 Jul 31 11:24 user6/sieve/rules.sieve thunderstorm home # On the secondary host: lightning home # ls -al */sieve/rules.sieve -rw--- 1 user1 user1 3570 Jan 1 1970 user1/sieve/rules.sieve -rw--- 1 user2 user2 175 Mar 14 2014 user2/sieve/rules.sieve -rw--- 1 user3 user3 725 Jul 31 07:32 user3/sieve/rules.sieve -rw--- 1 user4 user4 0 Jan 1 1970 user4/sieve/rules.sieve -rw-r--r-- 1 user5 user5 0 Jan 1 1970 user5/sieve/rules.sieve -rw-r--r-- 1 user6 user6 3719 Jan 1 1970 user6/sieve/rules.sieve lightning home # In other words, the rules did eventually get propagated across, and based on the file sizes they are complete. But there is obviously something amiss with handling of dates (which in turn may relate to how the system determines that the file on each server is up to date or not, I guess). In this case the two systems are in different timezones - the primary is GMT+10 and the secondary GMT+8. Also the status of active users is not always replicated either. On one host the output of 'doveadm sieve list -A' shows my own account as ACTIVE but the other host shows all users - except for my account - as being active, and the sieve script for my account is not being replicated. The other interesting thing is the output of: dovecot sieve list -A While (as I said above) the output of this command is doubled up on the main host, it is not doubled up on the secondary host. Reuben
Re: Sieve Script Replication Gliches (Report #2)
Op 7/31/2016 om 4:27 AM schreef Reuben Farrelly: > Hi, > > I've observed some odd behaviour with dsync replication between two > hosts, specifically to do with sieve script replication. > > In short, I have two hosts which replicate in a master-master type > setup where almost all of the reads and writes happen to just one of > the two hosts. > > They are both running 2.2.devel (9dc6403), which is close to the > latest 2.2 -git . Pigeonhole is running master-0.4 . This is on > x86_64 Gentoo. > > Normal mail replication between Maildir's for all users works fine, > however it appears that something recently committed to the code has > broken sieve script replication between the two. I am sure this did > once work. Replication is via tcps: . > > Sieve scripts on the lesser-used host are not up to date by an order > of days/weeks with the main host and they don't seem to re-replicate - > even if the rules don't exist at all on the replica. > > The symptoms and effects look to be the same as this (unanswered) post > from December: > > http://dovecot.org/list/dovecot/2015-December/102690.html > > I am not sure how to view the transaction log files, but I am seeing > the same symptoms, ie no live replication, and on the lesser-used host > almost all the scripts were old and some had the 1970 date on them. > > Even after forcing a [dsync replication replicate '*'] the scripts are > not replicated. As it stands now there are no sieve scripts on one of > the two members and the system seems unable to replicate by itself. > > Secondly, I am also seeing some doubled up outputs if I run 'doveadm > sieve list -A': > > thunderstorm reuben # doveadm sieve list -A > reuben rules ACTIVE > liam rules ACTIVE > kaylene rules ACTIVE > reuben rules ACTIVE > liam rules ACTIVE > kaylene rules ACTIVE > ... > > Has anyone else experienced the replication problem? Are sieve > scripts actually replicating in live time for other 2.2.24/2.2.25 > users as well? For me I didn't notice this till I went looking so I > wonder if other people are experiencing this but just not aware of it > yet...? I will look at this more soon. Regards, Stephan.
Re: any news Enterprise Repository Access?
> On July 31, 2016 at 9:18 PM mj wrote: > > > > > On 07/31/2016 07:04 PM, mj wrote: > > What exactly is a "ce repository"? > > Guessing now: Community Edition... > > Such a repo would be very much welcomed by us! (currently running wheezy > with it's original dovecot, 2.1.7) > > MJ Yes. Similar to xi.dovecot.net but officially maintained by dovecot oy. Hopefully we are able to provide one. Aki
Re: any news Enterprise Repository Access?
On 07/31/2016 07:04 PM, mj wrote: What exactly is a "ce repository"? Guessing now: Community Edition... Such a repo would be very much welcomed by us! (currently running wheezy with it's original dovecot, 2.1.7) MJ
Re: any news Enterprise Repository Access?
Hi, On 07/31/2016 04:36 PM, aki.tu...@dovecot.fi wrote: We are discussing about making ce repos at some point. This would probably help some people. Aki We're following this thread with interest. What exactly is a "ce repository"? (google doesn't help) MJ
Re: dovecot runs on a pbl listed ip ?
> On July 31, 2016 at 4:04 PM Benny Pedersen wrote: > > > X-Spam-Report: > * 3.3 RCVD_IN_PBL RBL: Received via a relay in Spamhaus PBL > * [52.178.156.48 listed in zen.spamhaus.org] > * 3.6 FS_REPLICA Subject says "replica" > * -1.9 BAYES_00 BODY: Bayes spam probability is 0 to 1% > * [score: 0.] > * -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from > author's > * domain > * 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily > * valid > * -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature > * 0.8 RDNS_NONE Delivered to internal network by a host with no rDNS > Received: from talvi.dovecot.org (unknown [52.178.156.48]) > by wursti.dovecot.fi (Postfix) with ESMTP; > Sun, 31 Jul 2016 04:27:22 +0200 (CEST) > > sorry if its not just me :( > > make sure all wan ips is in trusted-networks / internal-networks atleast > in spamassassin > > who will make a bug for replica ? :=) We'll have a look. Aki
Re: New password hashing scheme as plugin
> On July 27, 2016 at 2:08 AM Andreas Meyer wrote: > > > Hi, > > > I want to add a new password hashing scheme as plugin and provide it for > the dovecot project, so that it will be included as optional plugin in > future releases. > > Yet the plugin compiles fine and the .so file gets created. > > My approach is to call the functions password_scheme_register() and > password_scheme_unregister() (src/auth/password-scheme.c) inside the > plugin's _init() and _deinit() functions. > > When a client tries to login via imap the log shows an error message: > > Error: Couldn't load required plugin > /usr/local/lib/dovecot/lib20_newauth_plugin.so: dlopen() failed: > /usr/local/lib/dovecot/lib20_newauth_plugin.so: undefined symbol: > password_scheme_unregister > > That error obviously occurs, because the required lib is not linked into > the plugin. > > > Now my problem is to understand, whether this approach (via .so file) can > be successful at all and if so, how? > Do I need to link libs into it? Which would that be and how do I specify > them in the Makefile.am? > > I assume, I don't need to link a lib, but need to use a hook to register > the new hashing scheme, since the plugin is loaded into an already existing > process, which needs to get extended. If this is true, which hook would > that be and how do I register the new scheme? > > Or is there no way to accomplish this via a separated .so plugin? Should I > extend the sources in /src/auth instead? (separat file for the hashing > scheme with preprocessor instructions to include it only on demand) > > > > Thank you very much, > > Andreas Can you publish your code in, say, github.com and provide link to it? New password scheme is doable as plugin but it needs to placed in different place and it will be autoloaded. Aki
Re: any news Enterprise Repository Access?
We are discussing about making ce repos at some point. This would probably help some people. Aki > On July 27, 2016 at 6:03 PM KT Walrus wrote: > > > > That dovecot offers still EE build for free is great, but a road map on > > what the future subscription plans are would be nice; e.g low cost fee > > for just the repos, higher fees for support etc. That's what I missed. > > I’d like to see Dovecot distributed in the Docker Store (coming soon) or the > Docker Hub. Most enterprises are moving to deploying their apps in containers > and these containers can run on your laptop the same as they run in > production. Most modern Linux distributions support Docker these days. > > I build and run Dovecot in Docker now (built from latest released sources > against Ubuntu 16.04), and while I am still in development, I’m sure Docker > is the way to run my apps and will run great for deployment and maintenance. > > Kevin > > > On Jul 27, 2016, at 2:31 AM, Götz Reinicke - IT Koordinator > > wrote: > > > > Am 26.07.16 um 21:12 schrieb Alexander Dalloz: > >> Am 26.07.2016 um 14:41 schrieb Sami Ketola: > >>> > On 26 Jul 2016, at 09:18, Götz Reinicke - IT Koordinator > wrote: > > Hi, > we had access to the repository and it was working fine. But as we cant > get the 2.2.25 update I was looking into the repofolders and there are > RPMs "just" for RHEL 6// but not 5 any more. > > My be I missed the latest discussions or announcements? Could you give > me an update on information and may be the RHEL 5 RPMs too? > > Thanks a lot and regards . Götz > >>> > >>> > >>> Dovecot EE build support for RHEL 5 / CentOS 5 is going away soon > >>> even if we still made one more build for CentOS 5. Please upgrade > >>> your system. > >>> > >>> Sami > >> > >> Not only because of dovecot > >> > >> [21:09:27 CEST] CentOS 5 will go EOL on 31 March, 2017 -- in > >> 35 weeks, 2 days, 4 hours, 50 minutes, and 47 seconds but be aware > >> that it is now in production phase 3 and only receives critical updates > >> > >> Alexander > > Thx for your both feedback, and yes, it is EOL but as you mentioned in > > 35+ weeks. O.K. Redhat never did a dovecot update to the current version > > and as a lot of customers we think the update policy for some software > > should be changed too to support more modern versions of "core" server > > services. But that's not a dovecot topic ;) > > > > That dovecot offers still EE build for free is great, but a road map on > > what the future subscription plans are would be nice; e.g low cost fee > > for just the repos, higher fees for support etc. That's what I missed. > > > >Regards . Götz > > > > > > > > > >
Re: Sieve Script Replication Gliches (Report #2)
Reuben Farrelly wrote: > I've observed some odd behaviour with dsync replication between two hosts, > specifically to do with sieve script replication. […] > Has anyone else experienced the replication problem? Are sieve scripts > actually replicating in live time for other 2.2.24/2.2.25 users as well? For > me I didn't notice this till I went looking so I wonder if other people are > experiencing this but just not aware of it yet...? Welcome to the club: http://dovecot.org/list/dovecot/2016-July/105014.html If I am not mistaken you are the fourth now reporting this issue. No solution yet. Regards, Michael
dovecot runs on a pbl listed ip ?
X-Spam-Report: * 3.3 RCVD_IN_PBL RBL: Received via a relay in Spamhaus PBL * [52.178.156.48 listed in zen.spamhaus.org] * 3.6 FS_REPLICA Subject says "replica" * -1.9 BAYES_00 BODY: Bayes spam probability is 0 to 1% * [score: 0.] * -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's * domain * 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily * valid * -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature * 0.8 RDNS_NONE Delivered to internal network by a host with no rDNS Received: from talvi.dovecot.org (unknown [52.178.156.48]) by wursti.dovecot.fi (Postfix) with ESMTP; Sun, 31 Jul 2016 04:27:22 +0200 (CEST) sorry if its not just me :( make sure all wan ips is in trusted-networks / internal-networks atleast in spamassassin who will make a bug for replica ? :=)
migration from cyrus; seg fault at mail_namespaces_get_root_sep
Hi all,
I am currently trying to migrate from cyrus to dovecot on a new system.
Though only few accounts, I decided to use the mdbox format.
To convert I use cyrus2dovecot first, then I use dsync to import the
mailboxes.
For compatibility I set the namespace of inbox to prefix = INBOX. and
separator = . (as described here:
http://wiki2.dovecot.org/Migration/Cyrus
http://wiki.dovecot.org/Namespaces).
This works except that the clients (mutt and Thunderbird) show an
additional folder/mailbox "INBOX" below the inbox. How can I fix that?
Should I add a prefix during conversion and not change the namespace
config? On disk, the subfolders are next to INBOX.
Well, I then tried to set list = children instead of "yes" for namespace
inbox. On login a segfault occurs with this setting. See the information
and backtrace below.
Regards,
Vincent
###
linux-server2:~ # dovecot --version
2.2.25 (7be1766)
linux-server2:~ # dovecot -n
# 2.2.25 (7be1766): /etc/dovecot/dovecot.conf
# Pigeonhole version 0.4.15 (97b3da0)
# OS: Linux 4.1.21-14-default x86_64 openSUSE 42.1 (x86_64) btrfs
base_dir = /data/mail/dovecot/
disable_plaintext_auth = no
mail_debug = yes
mail_gid = dovecot
mail_location = mdbox:/data/mail/dovecot/maildat/%u
mail_privileged_group = dovecot
mail_uid = dovecot
managesieve_notify_capability = mailto
managesieve_sieve_capability = fileinto reject envelope encoded-character
vacation subaddress comparator-i;ascii-numeric relational regex imap4flags
copy include variables body enotify environment mailbox date index ihave
duplicate mime foreverypart extracttext
namespace inbox {
inbox = yes
list = children
location =
mailbox Drafts {
special_use = \Drafts
}
mailbox Junk {
special_use = \Junk
}
mailbox Sent {
special_use = \Sent
}
mailbox "Sent Messages" {
special_use = \Sent
}
mailbox Trash {
special_use = \Trash
}
prefix = INBOX.
separator = .
}
passdb {
driver = pam
}
plugin {
sieve = file:~/sieve;active=~/.dovecot.sieve
}
protocols = imap lmtp
ssl = no
ssl_dh_parameters_length = 2048
ssl_options = no_compression
ssl_prefer_server_ciphers = yes
userdb {
driver = passwd
}
GNU gdb (GDB; openSUSE Leap 42.1) 7.9.1
Copyright (C) 2015 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law. Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-suse-linux".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
