Re: [Dovecot] Leaky dovecot-auth ?

2007-07-02 Thread Timo Sirainen
On Tue, 2007-07-03 at 11:08 +0900, Christian Balzer wrote: > On Mon, 02 Jul 2007 17:37:05 +0300 Timo Sirainen <[EMAIL PROTECTED]> wrote: > > > > Hmm. Does this help: http://hg.dovecot.org/dovecot-1.0/rev/50c79521e8f5 > > > We have a winner! > Auth process grows to the same size as with a local DB

Re: [Dovecot] Leaky dovecot-auth ?

2007-07-02 Thread Christian Balzer
On Mon, 02 Jul 2007 17:37:05 +0300 Timo Sirainen <[EMAIL PROTECTED]> wrote: > > Hmm. Does this help: http://hg.dovecot.org/dovecot-1.0/rev/50c79521e8f5 > We have a winner! Auth process grows to the same size as with a local DB and stays there. Now I just have to get this into a security maintaine

Re: [Dovecot] Semi-static userdb...?

2007-07-02 Thread Timo Sirainen
On Tue, 2007-05-15 at 12:24 +0300, Timo Sirainen wrote: > On 15.5.2007, at 5.16, John Robinson wrote: > > >> One possibility would be to set "uid_file=/vmail/%d gid_file=/ > >> vmail/%d". > >> I guess that would be good. Added to TODO, but I'm not sure when I > >> get > >> around to implementin

[Dovecot] userdb nss

2007-07-02 Thread Timo Sirainen
I remembered people complaining how glibc ignores NSS errors with getpwent(), so I thought I'd see how easy it is to use NSS directly. Unless I misunderstood something, this should work: http://hg.dovecot.org/dovecot/rev/c9b49ed99d28 Tested only with "files" backend. Also it won't work with Solar

Re: [Dovecot] Force rebuild v1.0.1

2007-07-02 Thread Timo Sirainen
On Mon, 2007-07-02 at 14:15 -0400, Bruce Bodger wrote: > Thank you, Timo. One more thing: would you explain the existence of > this file: > > -rw--- 1 bb admin 131104 Jun 27 21:32 dovecot.index.log.2 > > I can understand dovecot-keywords having the old creation date but > dovecot.

Re: [Dovecot] Patch for Dovecot 1.0.1 to support cross realm GSSAPI authentication

2007-07-02 Thread Timo Sirainen
On Mon, 2007-07-02 at 19:55 +0200, Peter Eriksson wrote: > Btw. I think that the Heimdal implementation of GSSAPI has a similar > function but called gss_userok() (without the leading two "_" > characters) that does something similar - and users of Heimdal around > that can verify or deny that?

Re: [Dovecot] Force rebuild v1.0.1

2007-07-02 Thread Bruce Bodger
On Jul 2, 2007, at 1:25 PM, Timo Sirainen wrote: On Mon, 2007-07-02 at 06:23 -0400, Bruce Bodger wrote: Haven't seen a thread discussing forcing rebuilding of indexes / cache, so the question is, if these files in a users home directory were deleted... -rw--- 1 bb admin 80 May 1

Re: [Dovecot] Patch for Dovecot 1.0.1 to support cross realm GSSAPI authentication

2007-07-02 Thread Peter Eriksson
Timo Sirainen skrev: On Mon, 2007-07-02 at 18:08 +0200, Peter Eriksson wrote: + AC_CHECK_LIB(gss, __gss_userok, [ + AC_DEFINE(HAVE___GSS_USEROK,, + Define if you have __gss_usero

Re: [Dovecot] Force rebuild v1.0.1

2007-07-02 Thread Timo Sirainen
On Mon, 2007-07-02 at 06:23 -0400, Bruce Bodger wrote: > Haven't seen a thread discussing forcing rebuilding of indexes / > cache, so the question is, if these files in a users home directory > were deleted... > > -rw--- 1 bb admin 80 May 17 15:05 dovecot-keywords > -rw---

Re: [Dovecot] [Patch] Samba's proposed "ntlm_auth + winbind" support for dovecot-auth

2007-07-02 Thread Dmitry Butskoy
Timo Sirainen wrote: On Mon, 2007-07-02 at 20:19 +0400, Dmitry Butskoy wrote: Timo Sirainen wrote: - Currently I strip domain part of the username returned, i.e. from "DOMAIN\user" just to "user". Maybe better add some option "auth_winbind_strip_domain" for this? What if

Re: [Dovecot] Patch for Dovecot 1.0.1 to support cross realm GSSAPI authentication

2007-07-02 Thread Timo Sirainen
On Mon, 2007-07-02 at 18:08 +0200, Peter Eriksson wrote: > > + AC_CHECK_LIB(gss, __gss_userok, [ > + AC_DEFINE(HAVE___GSS_USEROK,, > + Define if you have > __gss_userok()) > +

Re: [Dovecot] [Patch] Samba's proposed "ntlm_auth + winbind" support for dovecot-auth

2007-07-02 Thread Timo Sirainen
On Mon, 2007-07-02 at 20:19 +0400, Dmitry Butskoy wrote: > Timo Sirainen wrote: > >> - Currently I strip domain part of the username returned, i.e. from > >> "DOMAIN\user" just to "user". Maybe better add some option > >> "auth_winbind_strip_domain" for this? > >> > > > > What if you changed

Re: [Dovecot] Patch for Dovecot 1.0.1 to support cross realm GSSAPI authentication

2007-07-02 Thread Peter Eriksson
Oh, another "hack" that's needed to build Dovecot on Solaris 10 with the native GSS library is a very simple, dummy, "krb5-config" script. Please find it also enclosed (probably not needed when Solaris 10 update 4 is released). - Peter Peter Eriksson wrote: Please find enclosed two patch file

Re: [Dovecot] [Patch] Samba's proposed "ntlm_auth + winbind" support for dovecot-auth

2007-07-02 Thread Dmitry Butskoy
Timo Sirainen wrote: - Currently I strip domain part of the username returned, i.e. from "DOMAIN\user" just to "user". Maybe better add some option "auth_winbind_strip_domain" for this? What if you changed it to [EMAIL PROTECTED] Then you could use Dovecot's standard %n or %u variables.

[Dovecot] Patch for Dovecot 1.0.1 to support cross realm GSSAPI authentication

2007-07-02 Thread Peter Eriksson
Please find enclosed two patch files (one for configure.in and one for src/mech/auth-gssapi.c) that fixes a problem in the GSSAPI code that prevented Dovecot to successfully authenticate when using cross-realm Kerberos credentials. Unfortunately I think it'll only work on Solaris (it uses the

[Dovecot] Force rebuild v1.0.1

2007-07-02 Thread Bruce Bodger
Haven't seen a thread discussing forcing rebuilding of indexes / cache, so the question is, if these files in a users home directory were deleted... -rw--- 1 bb admin 80 May 17 15:05 dovecot-keywords -rw--- 1 bb admin 85449 Jul 2 06:15 dovecot-uidlist -rw---

Re: [Dovecot] Leaky dovecot-auth ?

2007-07-02 Thread Timo Sirainen
On Tue, 2007-07-03 at 00:17 +0900, Christian Balzer wrote: > > > Jun 22 15:08:58 mb11 dovecot: listen(143) failed: Interrupted system > > > call > > > > Did you use killall? I think this happens only with it. Not even with it actually. I was probably thinking about something else. > Nope, this

Re: [Dovecot] Debian packages

2007-07-02 Thread Moritz Mertinkat
Hi, > I'd love some up-to-date packages for Dovecot on Etch. I need to get > some practice in on my personal server before I migrate work... from > 0.99.14 (Still going strong, Timo :) You can get my 1.0.1 packages from http://www.mertinkat.net/dovecot/ Built for Debian etch/i386. Hope everythi

Re: [Dovecot] [Fwd: Bounce action notification]

2007-07-02 Thread Timo Sirainen
On Mon, 2007-07-02 at 18:10 +0300, Antti-Juhani Kaijanaho wrote: > On Mon, Jul 02, 2007 at 10:51:17AM -0400, John Peacock wrote: > > That isn't a terribly helpful error message, since it doesn't include the > > original e-mail message, with headers, so that you could see what Mailman > > thought

Re: [Dovecot] [Fwd: Bounce action notification]

2007-07-02 Thread John Peacock
Antti-Juhani Kaijanaho wrote: Actually, it does include the bounce with headers. The bounce seems to have originated from 81.3.115.182, which reverse-resolves to canville-182.adsl.newnet.co.uk. Duh, of course you are right! I glanced at that block and thought that was the dovecot.org server

Re: [Dovecot] [Patch] Samba's proposed "ntlm_auth + winbind" support for dovecot-auth

2007-07-02 Thread Timo Sirainen
On Mon, 2007-07-02 at 16:19 +0400, Dmitry Butskoy wrote: > - I try to code things most close to used style, i.e. using Dovecot's > memory-management and io-pipe routines etc., but could someone look at > it and check whether I've missed something or not? close() and dup2() errors should be repor

Re: [Dovecot] Leaky dovecot-auth ?

2007-07-02 Thread Christian Balzer
On Mon, 02 Jul 2007 17:37:05 +0300 Timo Sirainen <[EMAIL PROTECTED]> wrote: > On Mon, 2007-07-02 at 15:20 +0900, Christian Balzer wrote: > > Jul 2 14:12:30 engtest03 dovecot: auth(default): pool auth request > > handler: 104 / 4080 bytes Jul 2 14:12:30 engtest03 last message > > repeated 128 tim

Re: [Dovecot] [Fwd: Bounce action notification]

2007-07-02 Thread Antti-Juhani Kaijanaho
On Mon, Jul 02, 2007 at 10:51:17AM -0400, John Peacock wrote: > That isn't a terribly helpful error message, since it doesn't include the > original e-mail message, with headers, so that you could see what Mailman > thought the original Mail-From: address was (which is what is failing > here)...

[Dovecot] passdb/userdb restart

2007-07-02 Thread Thomas Hummel
Hello Timo, I've noticed that when slapd which I'm using as the passdb and the prefetched userdb is restarted I have to restart dovecot. As a matter of fact, if I don't, I get the following error : -- Jul 2 16:38:39 dovecot: imap-login: Internal login failure: user=, method=PLAIN, rip=xxx.

Re: [Dovecot] v1.1 max connections per user

2007-07-02 Thread Timo Sirainen
On Sun, 2007-07-01 at 01:43 +0300, Timo Sirainen wrote: > #mail_max_user_connections = 10 Changed: protocol imap { # Maximum number of IMAP connections allowed for a user from each IP address. # NOTE: The username is compared compared case-sensitively. #mail_max_userip_connections = 10 } p

Re: [Dovecot] [Fwd: Bounce action notification]

2007-07-02 Thread John Peacock
Timo Sirainen wrote: Unable to deliver message to the following address(es) dovecot@dovecot.org Remote host said: 554 delivery error: This user doesn't have an account That isn't a terribly helpful error message, since it doesn't include the original e-mail message, with headers, so that you c

Re: [Dovecot] Leaky dovecot-auth ?

2007-07-02 Thread Timo Sirainen
On Mon, 2007-07-02 at 15:20 +0900, Christian Balzer wrote: > Jul 2 14:12:30 engtest03 dovecot: auth(default): pool auth request handler: > 104 / 4080 bytes > Jul 2 14:12:30 engtest03 last message repeated 128 times Auth request handler is created for each imap-login connection. So if you have 1

[Dovecot] [Fwd: Bounce action notification]

2007-07-02 Thread Timo Sirainen
Anyone have ideas why this happened? Nothing special in logs, all [EMAIL PROTECTED] deliveries went OK. Mailman's bounce log is unhelpful. Why does it say it tried to deliver to dovecot@dovecot.org and when it failed it disabled my account? Why doesn't it even bother saying which remote host gave a

Re: [Dovecot] v1.1 max connections per user

2007-07-02 Thread Christian Balzer
On Mon, 2 Jul 2007 14:32:11 +0200 (CEST) Steffen Kaiser <[EMAIL PROTECTED]> wrote: > > Donnu, but I wouldn't enable a connection limit by default. Let the > admin choose a correct value after "QuickStart" went well. > Agreed. A per IP limit that defaults to something other than UNLIMITED and wh

Re: [Dovecot] v1.1 max connections per user

2007-07-02 Thread Steffen Kaiser
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Sun, 1 Jul 2007, Jürgen Herz wrote: If you think about it, also take NATed networks into account. So it would need a fairly high default and should have a remark in the comment to make admins aware. Yep! A limit per IP is not enforcable in my

[Dovecot] [Patch] Samba's proposed "ntlm_auth + winbind" support for dovecot-auth

2007-07-02 Thread Dmitry Butskoy
The Samba team recommends to use their "ntlm_auth" command line helper for "NTLM" and "GSS-SPNEGO" authentication. This helper interacts with the Samba's winbind daemon, and this way can authenticate users against NT or Active Directory windows domain. Currently Dovecot can do "NTLM" authenti

Re: [Dovecot] mbox vs maildir

2007-07-02 Thread Charles Marcus
I did the ext3 -> ext4 switch on two of our proxyservers a few months ago. Then we forgot (!) about that test and the boxes just kept running and running and running ... Interesting... have you noticed any differences in performance? No. But at least it didn't explode in my face :) Heh.. y

[Dovecot] Force rebuild v1.0.1

2007-07-02 Thread Bruce Bodger
Haven't seen a thread discussing forcing rebuilding of indexes / cache, so the question is, if these files in a users home directory were deleted... -rw--- 1 bb admin 80 May 17 15:05 dovecot-keywords -rw--- 1 bb admin 85449 Jul 2 06:15 dovecot-uidlist -rw---