thr3ads.net - dovecot - public folders, ACLs [Aug 2021]

If this information is useful, please help other people find it:
Share via:

Markus Valentin

2021-Aug-05 08:00 UTC

public folders, ACLs

> On 04/08/2021 15:18 Stefan G. Weichinger <lists at xunil.at> wrote:
> 
>  
> Am 03.08.21 um 13:31 schrieb Stefan G. Weichinger:
> > Am 02.08.21 um 21:07 schrieb Stefan G. Weichinger:
> >>
> >> Am 02.08.21 um 19:59 schrieb Stefan G. Weichinger:
> >>
> >>>> ... "Error: Can't open mailbox Oeffentlich:
Mailbox doesn't exist:
> >>>> Oeffentlich"
> > 
> > *bump*? ... anyone?
> > 
> > Should I ask somewhere else?
> 
> I created another public folder on a test machine here.
> 
> # doveconf -n
> 
> # 2.3.4.1 (f79e8e7e4): /etc/dovecot/dovecot.conf
> 
> # Pigeonhole version 0.5.4 ()
> 
> # OS: Linux 4.19.0-17-amd64 x86_64 Debian 10.10
> 
> # Hostname: tx100.lan.oops.co.at
> 
> auth_mechanisms = plain login
> 
> disable_plaintext_auth = no
> 
> login_trusted_networks = 172.32.99.0/24
> 
> mail_location = maildir:~/Maildir
> 
> mail_plugins = " acl"
> 
> namespace {
> 
>    hidden = no
> 
>    inbox = no
> 
>    location = maildir:/var/mail/public
> 
>    prefix = public.
> 
>    separator = .
> 
>    subscriptions = no
> 
>    type = public
> 
> }
> 
> namespace inbox {
> 
>    inbox = yes
> 
>    location > 
>    mailbox Drafts {
> 
>      special_use = \Drafts
> 
>    }
> 
>    mailbox Junk {
> 
>      special_use = \Junk
> 
>    }
> 
>    mailbox Sent {
> 
>      special_use = \Sent
> 
>    }
> 
>    mailbox "Sent Messages" {
> 
>      special_use = \Sent
> 
>    }
> 
>    mailbox Trash {
> 
>      special_use = \Trash
> 
>    }
> 
>    prefix > 
> }
> 
> passdb {
> 
>    args = session=yes dovecot
> 
>    driver = pam
> 
> }
> 
> plugin {
> 
>    acl = vfile
> 
> }
> 
> protocols = " imap"
> 
> service auth {
> 
>    unix_listener /var/spool/postfix/private/auth {
> 
>      group = postfix
> 
>      mode = 0600
> 
>      user = postfix
> 
>    }
> 
> }
> 
> service imap-login {
> 
>    inet_listener imap {
> 
>      address = 172.32.99.6
> 
>      port = 143
> 
>    }
> 
>    process_min_avail = 1
> 
> }
> 
> ssl = no
> 
> userdb {
> 
>    args = blocking=no
> 
>    driver = passwd
> 
> }
> 
> protocol imap {
> 
>    mail_plugins = " acl imap_acl"
> 
> }
> 
> protocol lda {
> 
>    mail_plugins = " acl"
> 
> }
> 
> 
> 
> # ls -l /var/mail/
> 
> insgesamt 4272
> 
> drwxrwsr-x 2 root mail    4096 Aug  4 15:11 public
> 
> -rw------- 1 root mail 2294634 Apr 16 08:16 root
> 
> -rw------- 1 sgw  mail 2062324 Apr 20 11:53 sgw
> 
> 
> The mailbox "public" gets listed here:
> _expire_plugin, because dlopen() failed: 
> /usr/lib/dovecot/modules/doveadm/lib10_doveadm_expire_plugin.so: 
> undefined symbol: expire_set_deinit (this is usually intentional, so 
> just ignore this message)
> 
> Debug: Skipping module doveadm_quota_plugin, because dlopen() failed: 
> /usr/lib/dovecot/modules/doveadm/lib10_doveadm_quota_plugin.so: 
> undefined symbol: quota_user_module (this is usually intentional, so 
> just ignore this message)
> 
> Debug: Skipping module doveadm_fts_lucene_plugin, because dlopen() 
> failed: 
> /usr/lib/dovecot/modules/doveadm/lib20_doveadm_fts_lucene_plugin.so: 
> undefined symbol: lucene_index_iter_deinit (this is usually intentional, 
> so just ignore this message)
> 
> Debug: Skipping module doveadm_fts_plugin, because dlopen() failed: 
> /usr/lib/dovecot/modules/doveadm/lib20_doveadm_fts_plugin.so: undefined 
> symbol: fts_user_get_language_list (this is usually intentional, so just 
> ignore this message)
> 
> Debug: Skipping module doveadm_mail_crypt_plugin, because dlopen() 
> failed: 
> /usr/lib/dovecot/modules/doveadm/libdoveadm_mail_crypt_plugin.so: 
> undefined symbol: mail_crypt_box_get_pvt_digests (this is usually 
> intentional, so just ignore this message)
> 
> doveadm(sgw)<10564><>: Debug: auth USER input: sgw 
> system_groups_user=sgw uid=1000 gid=1000 home=/home/sgw
> 
> doveadm(sgw): Debug: Effective uid=1000, gid=1000, home=/home/sgw
> 
> doveadm(sgw): Debug: acl: No acl_shared_dict setting - shared mailbox 
> listing is disabled
> 
> doveadm(sgw): Debug: Namespace inbox: type=private, prefix=, sep=, 
> inbox=yes, hidden=no, list=yes, subscriptions=yes
location=maildir:~/Maildir
> 
> doveadm(sgw): Debug: maildir++: root=/home/sgw/Maildir, index=, 
> indexpvt=, control=, inbox=/home/sgw/Maildir, alt> 
> doveadm(sgw): Debug: acl: initializing backend with data: vfile
> 
> doveadm(sgw): Debug: acl: acl username = sgw
> 
> doveadm(sgw): Debug: acl: owner = 1
> 
> doveadm(sgw): Debug: acl vfile: Global ACLs disabled
> 
> doveadm(sgw): Debug: Namespace : type=public, prefix=public., sep=., 
> inbox=no, hidden=no, list=yes, subscriptions=no 
> location=maildir:/var/mail/public
> 
> doveadm(sgw): Debug: maildir++: root=/var/mail/public, index=, 
> indexpvt=, control=, inbox=, alt> 
> doveadm(sgw): Debug: acl: initializing backend with data: vfile
> 
> doveadm(sgw): Debug: acl: acl username = sgw
> 
> doveadm(sgw): Debug: acl: owner = 0
> 
> doveadm(sgw): Debug: acl vfile: Global ACLs disabled
> 
> doveadm(sgw): Debug: acl vfile: file /home/sgw/Maildir/dovecot-acl not
found
> 
> 
> [..]
> 
> doveadm(sgw): Debug: acl vfile: reading file /var/mail/public/dovecot-acl
> 
> doveadm(sgw): Debug: Namespace public.: Using permissions from 
> /var/mail/public: mode=0775 gid=default
> 
> public
>   # HERE
> INBOX
> 
> but this fails:
> 
> 
> # doveadm -Dv acl set  -u sgw "public" sgw lr
> 
> Debug: Loading modules from directory: /usr/lib/dovecot/modules
> 
> Debug: Module loaded: /usr/lib/dovecot/modules/lib01_acl_plugin.so
> 
> Debug: Loading modules from directory: /usr/lib/dovecot/modules/doveadm
> 
> Debug: Module loaded: 
> /usr/lib/dovecot/modules/doveadm/lib10_doveadm_acl_plugin.so
> 
> Debug: Skipping module doveadm_expire_plugin, because dlopen() failed: 
> /usr/lib/dovecot/modules/doveadm/lib10_doveadm_expire_plugin.so: 
> undefined symbol: expire_set_deinit (this is usually intentional, so 
> just ignore this message)
> 
> Debug: Skipping module doveadm_quota_plugin, because dlopen() failed: 
> /usr/lib/dovecot/modules/doveadm/lib10_doveadm_quota_plugin.so: 
> undefined symbol: quota_user_module (this is usually intentional, so 
> just ignore this message)
> 
> Debug: Skipping module doveadm_fts_lucene_plugin, because dlopen() 
> failed: 
> /usr/lib/dovecot/modules/doveadm/lib20_doveadm_fts_lucene_plugin.so: 
> undefined symbol: lucene_index_iter_deinit (this is usually intentional, 
> so just ignore this message)
> 
> Debug: Skipping module doveadm_fts_plugin, because dlopen() failed: 
> /usr/lib/dovecot/modules/doveadm/lib20_doveadm_fts_plugin.so: undefined 
> symbol: fts_user_get_language_list (this is usually intentional, so just 
> ignore this message)
> 
> Debug: Skipping module doveadm_mail_crypt_plugin, because dlopen() 
> failed: 
> /usr/lib/dovecot/modules/doveadm/libdoveadm_mail_crypt_plugin.so: 
> undefined symbol: mail_crypt_box_get_pvt_digests (this is usually 
> intentional, so just ignore this message)
> 
> doveadm(sgw)<10640><>: Debug: auth USER input: sgw 
> system_groups_user=sgw uid=1000 gid=1000 home=/home/sgw
> 
> doveadm(sgw): Debug: Effective uid=1000, gid=1000, home=/home/sgw
> 
> doveadm(sgw): Debug: acl: No acl_shared_dict setting - shared mailbox 
> listing is disabled
> 
> doveadm(sgw): Debug: Namespace inbox: type=private, prefix=, sep=, 
> inbox=yes, hidden=no, list=yes, subscriptions=yes
location=maildir:~/Maildir
> 
> doveadm(sgw): Debug: maildir++: root=/home/sgw/Maildir, index=, 
> indexpvt=, control=, inbox=/home/sgw/Maildir, alt> 
> doveadm(sgw): Debug: acl: initializing backend with data: vfile
> 
> doveadm(sgw): Debug: acl: acl username = sgw
> 
> doveadm(sgw): Debug: acl: owner = 1
> 
> doveadm(sgw): Debug: acl vfile: Global ACLs disabled
> 
> doveadm(sgw): Debug: Namespace : type=public, prefix=public., sep=., 
> inbox=no, hidden=no, list=yes, subscriptions=no 
> location=maildir:/var/mail/public
> 
> doveadm(sgw): Debug: maildir++: root=/var/mail/public, index=, 
> indexpvt=, control=, inbox=, alt> 
> doveadm(sgw): Debug: acl: initializing backend with data: vfile
> 
> doveadm(sgw): Debug: acl: acl username = sgw
> 
> doveadm(sgw): Debug: acl: owner = 0
> 
> doveadm(sgw): Debug: acl vfile: Global ACLs disabled
> 
> doveadm(sgw): Error: Can't open mailbox public: Mailbox doesn't
exist:
> public
> 
> 
> I tried to "rm /var/mail/public/dovecot-acl-list"  and edit 
> /var/mail/public/dovecot-acl:
> 
> # cat /var/mail/public/dovecot-acl
> 
> anyone lr
> 
> user=sgw lrwstipekxa
> 
> No success.
> 
> What's my mistake?
Hi,

i would suggest using 2.3.15 also for testing.

It seems to me that you are trying to use the namespace prefix itself as mailbox
rather than an actual mailbox ("public.foo" for example).

Did you see these docs: 
-
https://doc.dovecot.org/configuration_manual/shared_mailboxes/public_shared/#example-public-mailboxes-with-acls
- https://doc.dovecot.org/configuration_manual/mail_location/Maildir/


Markus
> 
> tia

Stefan G. Weichinger

2021-Aug-05 14:50 UTC

head link

public folders, ACLs

Am 05.08.21 um 10:00 schrieb Markus Valentin:
> Hi,
> 
> i would suggest using 2.3.15 also for testing.
Will do, thanks
> It seems to me that you are trying to use the namespace prefix itself as
mailbox rather than an actual mailbox ("public.foo" for example).
Yes, that's also my assumption.
> Did you see these docs:
> -
https://doc.dovecot.org/configuration_manual/shared_mailboxes/public_shared/#example-public-mailboxes-with-acls
Been there 10 times ;-) to recheck my settings.
> - https://doc.dovecot.org/configuration_manual/mail_location/Maildir/
not for a long time

-

How would I proceed to turn on ACLs for an existing public namespace? 
How to apply the "default" ACLs?

Create acl-files in all first level mailboxes?

There are ~5500 directories in there, I have to make sure to not break 
things.

The main goal is:

- only allow some admins to create and rename project-mailboxes

- the rest of the users should not be able to create/move/remove these 
mailboxes, but should be able to move mails between them

thanks

dovecot - Aug 2021 - public folders, ACLs

public folders, ACLs

public folders, ACLs