- dovecot - dovecot.org

More about my SSL certificate problem
by Steve Matzura 15 Jun '15

15 Jun '15

Someone, I don't remember whether it was Alex or Urban, asked me to check on my private keyfile to see if it began with "Begin RSA private key". I reported that it does not. Now here's where things get strange: When I ran the command: $ openssl req -nodes -newkey rsa:2048 -sha1 -keyout myserver.key -out server.csr on an old Ubuntu system, `myserver.key' does begin with "Begin RSA private key". But when I run that same command on a Fedora 20 system, the word "RSA" isn't there. Could this have anything to do with my 0906D06C error?

4 8

Testin new installation
by Steve Matzura 15 Jun '15

15 Jun '15

The first place I went to for test advice and planning recommendations was http://wiki2.dovecot.org/TestInstallation - The very first test failed. Doc says: Next check that Dovecot is listening for connections: # telnet localhost 143 Trying 127.0.0.1... Connected to localhost. Escape character is '^]'. * OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE STARTTLS AUTH=PLAIN] Dovecot ready. If you got "connection refused", make sure that Dovecot is configured to serve the imap protocol and listening on the expected interfaces/addresses. The simplest way to do that would be using doveconf(1): # doveconf protocols listen protocols = imap pop3 lmtp sieve listen = *, :: If the protocols setting shouldn't contain imap so add it. Also make sure, that relevant !include or !try_include configuration lines are not commented. *** End doc extract *** All of the above specified settings are correct. Yet, when I telnet localhost 143, I get: Trying ::1... # this is certainly suspect Escape character is '^['. Connection closed by foreign host.

7 21

dsync replication issues with shared mailboxes
by Sergey Schwartz 15 Jun '15

15 Jun '15

Gentlemen, I've setup 2 servers with dsync replication and hit a serious issue - some messages got duplicated thousands times in some shared mailboxes(~5). There is actually no reason to replicate anything from shared name space and I've tried to limit replication scope with just 'inbox' name space but it didn't help. dovecot version ||2.2.18 (2de3c7248922) errors in the logs May 26 13:23:38 mx10 dovecot: doveadm: Error: dsync-remote(korobova@mydomain): Error: Mailbox turkey: Save commit failed: Message has been copied too many times (24498 + 8270) May 26 13:25:16 mx10 dovecot: doveadm: Error: dsync-remote(korobova@mydomain): Error: Mailbox turkey: Save commit failed: Message has been copied too many times (24498 + 8270) May 26 13:26:40 mx10 dovecot: dsync-local(zhelonkina@mydomain): Error: Mailbox booking: Save commit failed: Message has been copied too many times (0 + 32768) May 26 13:30:01 mx10 dovecot: dsync-local(kashchits@mydomain): Error: Mailbox shared/davydjanc@mydomain/russia: Save commit failed: Message has been copied too many times (17139 + 15629) May 26 13:30:01 mx10 dovecot: dsync-local(davydjanc@mydomain): Error: Mailbox russia: Save commit failed: Message has been copied too many times (17139 + 15629) May 26 13:30:01 mx10 dovecot: dsync-local(kapitanova@mydomain): Error: Mailbox shared/davydjanc@mydomain/russia: Save commit failed: Message has been copied too many times (17139 + 15629) May 26 13:30:03 mx10 dovecot: dsync-local(grinenko@mydomain): Error: Mailbox shared/davydjanc@mydomain/russia: Save commit failed: Message has been copied too many times (17139 + 15629) May 26 13:30:03 mx10 dovecot: dsync-local(maslova@mydomain): Error: Mailbox shared/davydjanc@mydomain/russia: Save commit failed: Message has been copied too many times (17139 + 15629) Data was not lost and I've been able to run deduplicate for most of mailboxes, but one mailbox got broken and I had to manually move message to another mailbox force-resync failed fot that mailbox doveadm(l.davydjanc@mydomain): Error: mdbox map /srv/vmail/current/mydomain/davydjanc/storage/dovecot.map.index corrupted: map_uid=361735 refcount too low Hope you guys have an idea how to work it around :) replication.conf dsync_remote_cmd = /usr/bin/ssh -i /home/vmail/.ssh/id_rsa -l %{login} %{host} doveadm dsync-server -u %u service aggregator { fifo_listener replication-notify-fifo { user = vmail mode = 0600 } unix_listener replication-notify { user = vmail mode = 0600 } process_min_avail = 1 } service replicator { unix_listener replicator-doveadm { user = vmail mode = 0600 } process_min_avail = 1 } service doveadm { user = vmail process_min_avail = 1 } service config { unix_listener config { user = vmail } process_min_avail = 1 } replication_max_conns = 50 replication_dsync_parameters = -d -n inbox -l 30 -U plugin { mail_replica = remote:vmail@mx20 } doveconf -n # 2.2.18 (2de3c7248922): /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.8 # OS: Linux 3.13.0-34-generic x86_64 Ubuntu 14.04.2 LTS xfs auth_cache_negative_ttl = 0 auth_cache_size = 512 M auth_default_realm = mydomain auth_failure_delay = 5 secs auth_worker_max_count = 4096 default_client_limit = 40960 default_process_limit = 8192 default_vsz_limit = 2 G disable_plaintext_auth = no first_valid_gid = 500 mail_location = mdbox:/srv/vmail/current/%d/%n mail_plugins = acl zlib notify replication mail_shared_explicit_inbox = yes managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mdbox_rotate_size = 32 M namespace { list = yes location = mdbox:/srv/vmail/current/%%d/%%n prefix = shared/%%u/ separator = / subscriptions = no type = shared } namespace inbox { inbox = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk { auto = subscribe special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox Trash { auto = subscribe special_use = \Trash } prefix = separator = / } passdb { args = /etc/dovecot/virtual/base.conf.ext driver = sql } passdb { args = /etc/dovecot/virtual/master.conf.ext driver = sql } plugin { acl = vfile acl_shared_dict = file:/srv/vmail/current/shared.db/000-shared-mailboxes.db sieve = file:/srv/vmail/current/%d/%n/sieve;active=/srv/vmail/current/%d/%n/active.sieve sieve_max_redirects = 0 zlib_save = xz zlib_save_level = 6 } protocols = " imap lmtp sieve" service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0666 user = postfix } } service imap-login { process_min_avail = 24 } service imap { process_limit = 4096 } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } ssl_cert = </etc/ssl/mxbgcom/2015/mydomain.com.crt.chained ssl_key = </etc/ssl/mxbgcom/2015/mydomain.com.key syslog_facility = local0 userdb { args = /etc/dovecot/virtual/base.conf.ext driver = sql } protocol lmtp { mail_plugins = acl zlib notify replication sieve } protocol imap { mail_max_userip_connections = 15 mail_plugins = acl zlib notify replication imap_acl } -- Best regards, Sergey Schwartz Senior System Administrator Biblio Globus Tour Operator www.bgoperator.ru T: +7 495 5042500 ext 1532 E: sergey.schwartz(a)bgoperator.com

1 0

Sorry, another faq
by Martin S 14 Jun '15

14 Jun '15

I've installed a mailserver according to these instructions: http://www.server-world.info/en/note?os=CentOS_7&p=httpd&f=13 When I try to login to the server through Roundcube webmail I get Connection to storage server failed. So checking on this [12-Jun-2015 11:28:53 +0000]: <6jap13r2> IMAP Error: Login failed for martin from 83.251.209.249. Could not connect to ssl://myserver:993: Permission denied in /usr/share/roundcubemail/program/lib/Roundcube/rcube_imap.php on line 198 (POST /roundcubemail/?.... /etc/roundcubemail/config.inc.php Has the following: $config['default_host'] = 'ssl://mail.myserver.tld'; [address obfuscated] $config['default_port'] = 993; as I understand should be correct. I've been looking at various posts on the net that says the problem is a permission on dovecot, but I fail to find anything to how to fix this as it looks right to me. Any suggestions? /Martin S -- Regards, Martin S

5 5

dovecot only partially indexing ... fts
by Infoomatic 14 Jun '15

14 Jun '15

hi, I have a setup using solr as fts, however it seems that when I move messages it does not automatically index the stuff. Also, when using sieve scripts to store messages in different folders I get: dovecot: indexer-worker(user): Indexed 0 messages in testfolder If I get a mail to normal INBOX I get dovecot: indexer-worker(user): Indexed 1 messages in INBOX doveadm index -u user '*' does the trick, however, I have set "fts_autoindex = yes" ... the relevant part of doveconf -n: mail_plugins = fts fts_solr zlib acl quota zlib fts fts_solr acl plugin { fts = solr fts_autoindex = yes fts_solr = url=http://localhost:8983/solr/ break-imap-search sieve = ~/.dovecot.sieve sieve_dir = ~/sieve sieve_extensions = +notify +imapflags } protocol lda { mail_plugins = fts fts_solr zlib sieve acl } protocol imap { mail_plugins = fts fts_solr zlib acl quota imap_acl imap_quota } is this normal behaviour or did I screw something up? TIA, infoomatic

1 0

fts_solr Bad Request / BUG: Unknown internal error
by Nick Rosier 14 Jun '15

14 Jun '15

Hi, yesterday I created a new mailbox; ever since (and only for the new mailbox) I am getting these errors: 2015-06-12T00:00:29.808526+02:00 mail dovecot: indexer-worker(xxx(a)example.com): Error: fts_solr: Lookup failed: Bad Request 2015-06-12T00:00:29.808560+02:00 mail dovecot: indexer-worker(xxx(a)example.com): Error: Mailbox INBOX: Status lookup failed: BUG: Unknown internal error Is this a known issue? Rgds, N.

2 2

RE: Testin new installation
by edgar 13 Jun '15

13 Jun '15

Look at /etc/hosts ::1 is the ipv6 version of localhost. Sent from Samsung tablet -------- Original message -------- From Steve Matzura <number6(a)noisynotes.com> Date: 06/13/2015 6:00 AM (GMT-06:00) To dovecot <dovecot(a)dovecot.org> Subject Testin new installation The first place I went to for test advice and planning recommendations was http://wiki2.dovecot.org/TestInstallation - The very first test failed. Doc says: Next check that Dovecot is listening for connections: # telnet localhost 143 Trying 127.0.0.1... Connected to localhost. Escape character is '^]'. * OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE STARTTLS AUTH=PLAIN] Dovecot ready. If you got "connection refused", make sure that Dovecot is configured to serve the imap protocol and listening on the expected interfaces/addresses. The simplest way to do that would be using doveconf(1): # doveconf protocols listen protocols = imap pop3 lmtp sieve listen = *, :: If the protocols setting shouldn't contain imap so add it. Also make sure, that relevant !include or !try_include configuration lines are not commented. *** End doc extract *** All of the above specified settings are correct. Yet, when I telnet localhost 143, I get: Trying ::1... # this is certainly suspect Escape character is '^['. Connection closed by foreign host.

3 3

postfix/dovecot on debian jessie (url config at OVH)
by klrumpf 13 Jun '15

13 Jun '15

Hi list, could use some help with a pasword issue or ovh dns zone problem, dovecot newbie I have gone thru setting up a mailserver using the below http://www.binarytides.com/install-postfix-dovecot-debian/ when I try to set up an account from my laptop (iceweasel/t-bird) I get password problems. mail.log says Jun 13 18:36:04 www postfix/smtpd[701]: connect from unknown[xx.xx.214.75] Jun 13 18:36:04 www postfix/smtpd[688]: disconnect from unknown[xx.xx.214.75] Jun 13 18:36:04 www postfix/submission/smtpd[687]: disconnect from unknown[xx.xx.214.75] Jun 13 18:36:04 www postfix/submission/smtpd[694]: disconnect from unknown[xx.xx.214.75] Jun 13 18:36:04 www postfix/smtpd[693]: disconnect from unknown[xx.xx.214.75] Jun 13 18:36:04 www postfix/submission/smtpd[698]: disconnect from unknown[.... nstat also looks ok BWE1# netstat -lntp Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name tcp 0 0 127.0.0.1:12301 0.0.0.0:* LISTEN 492/opendkim tcp 0 0 0.0.0.0:110 0.0.0.0:* LISTEN 504/dovecot tcp 0 0 0.0.0.0:143 0.0.0.0:* LISTEN 504/dovecot tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN 486/nginx -g daemon tcp 0 0 0.0.0.0:465 0.0.0.0:* LISTEN 617/master tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 449/sshd tcp 0 0 0.0.0.0:25 0.0.0.0:* LISTEN 617/master tcp 0 0 127.0.0.1:4000 0.0.0.0:* LISTEN 653/ssh tcp 0 0 0.0.0.0:993 0.0.0.0:* LISTEN 504/dovecot tcp 0 0 0.0.0.0:995 0.0.0.0:* LISTEN 504/dovecot tcp 0 0 0.0.0.0:587 0.0.0.0:* LISTEN 617/master tcp 0 0 127.0.0.1:6379 0.0.0.0:* LISTEN 455/redis-server 12 tcp6 0 0 :::110 :::* LISTEN 504/dovecot tcp6 0 0 :::143 :::* LISTEN 504/dovecot tcp6 0 0 :::80 :::* LISTEN 486/nginx -g daemon tcp6 0 0 :::465 :::* LISTEN 617/master tcp6 0 0 :::21 :::* LISTEN 485/vsftpd tcp6 0 0 :::22 :::* LISTEN 449/sshd tcp6 0 0 :::25 :::* LISTEN 617/master tcp6 0 0 ::1:4000 :::* LISTEN 653/ssh tcp6 0 0 :::993 :::* LISTEN 504/dovecot tcp6 0 0 :::995 :::* LISTEN 504/dovecot tcp6 0 0 :::587 :::* LISTEN 617/master maybe someone has done it before, thanks <http://de.linkedin.com/in/klrumpf>

1 0

LDA versus LMTP
by Steve Matzura 13 Jun '15

13 Jun '15

My system has a great big four users. The Dovecot wiki says LMTP is more efficient, and someone on IRC told me I'd need it if I were ever to use sieve, which at this time I have no intention of doing. Should I stick with LDA, or just implement LMTP so I'm ready if ever I need it in the future? The bottom line is, it's unclear from the wiki how to explicitly specify use of one or the other, so that's my question.

5 7

Non-Existent Log File
by Steve Matzura 13 Jun '15

13 Jun '15

My /var/log/maillog was getting pretty big because of lots of testing and re-configuring I've been doing lately with both Dovecot and Postfix. I figured just remove /var/log/maillog and it would be re-created. It wasn't--not by Dovecot, not by Postfix. I had to manually create a new one, put one character in it, save it, properly secure it with chmod, and then Dovecot (and postfix) messages got written to it. This can't possibly be the proper procedure to clear maillog messages ... can it?

3 3

Error when starting Dovecot
by Steve Matzura 13 Jun '15

13 Jun '15

After applying some changes to 10-master.conf as detailed at http://wiki2.dovecot.org/HowTo/PostfixDovecotLMTP I receive the following when trying to start: doveconf: Fatal: Error in configuration file /etc/dovecot/conf.d/10-master.conf line 49: Expecting '{' I'm trying to enable LMTP. The instructions say: Socket configuration The actual socket is configured in /etc/dovecot/conf.d/10-master.conf. The LMTP service can be bound to both INET or Unix sockets. In this example a Unix socket is placed inside the Postfix spool with appropriate permissions set: service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } I copied this block and placed it in my copy of 10-master.conf. Line 49 is the first line of this block, and there's clearly a left-brace there. The braces match, too. Thoughts?

2 3

Orphaned email boxes...
by SH Development 13 Jun '15

13 Jun '15

What is the correct way to delete mailboxes that no longer have a database entry? Jeff

2 3

Imap Notify
by Tony Morehen 12 Jun '15

12 Jun '15

I'm trying to enable Imap Notify in Dovecot 2.2.13. I know that's a bit out of date, but that's what's provided with openSuSe 13.2. The first thing I did was add mailbox_list_index=yes to /etc/dovecot/dovecot.conf. Both doveadm -n and dovecot -n show the change. I then used doveadm reload to force dovecot to reread its config file. Despite this, NOTIFY did not show up it Dovecot's capabilities: * OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE AUTH=PLAIN] Dovecot ready. I then did a systemctl restart dovecot.service and still no luck: * OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE AUTH=PLAIN] Dovecot ready. I also have noticed that the Maildirs of my various accounts include a dovecot.list.index file with a current timestamp, but no dovecot.list.index. So, where do I go for here? The output of doveadm -n: # 2.2.13: /etc/dovecot/dovecot.conf # OS: Linux 3.16.7-21-desktop x86_64 openSUSE 13.2 (x86_64) disable_plaintext_auth = no log_path = /var/log/dovecot/dovecot.log mail_location = maildir:~/Maildir mail_max_userip_connections = 50 mailbox_list_index = yes managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave passdb { args = /etc/dovecot/passwd.dovecot driver = passwd-file } postmaster_address = Tony@localhost protocols = imap lmtp service auth { unix_listener auth-master { group = mailgrp mode = 0660 user = mailuser } } service lmtp { executable = lmtp -L inet_listener lmtp { address = 127.0.0.1 port = 2525 } user = mailuser } ssl = no userdb { args = /etc/dovecot/passwd.dovecot driver = passwd-file } protocol imap { imap_client_workarounds = tb-extra-mailbox-sep } protocol pop3 { mail_plugin_dir = /usr/lib/dovecot/modules/pop3 } protocol lda { log_path = /var/log/dovecot/deliver.log mail_plugin_dir = /usr/lib64/dovecot/modules mail_plugins = sieve } protocol lmtp { log_path = /var/log/dovecot/deliver.log mail_plugin_dir = /usr/lib64/dovecot/modules mail_plugins = sieve }

2 2

1.0.15 gone, can't start version 2
by Steve Matzura 12 Jun '15

12 Jun '15

On advice/recommendation received on this list, I removed version 1.0.15 with: rm -rf /usr/local/dovecot However, now that I have version 2 properly installed, configured, and ready to start testing with Postfix, it appears the old version is still in /usr/local/sbin, /usr/local/include, /usr/local/libexec, /usr/local/lib and /usr/local/shared/doc. Thinking that anything in /usr/local is something that was installed s a result of having built it from source (which 1.0.15 definitely was), should these also be removed?

3 7

Re: Sorry, another faq
by b-dovecot.org＠grmbl.net 12 Jun '15

12 Jun '15

On Fri, Jun 12, 2015 at 03:24:32PM +0200, Martin S wrote: > I get > > openssl s_client -connect mail.myserver.tld:993 > connect: Connection refused > connect:errno=111 > > Both from a client laptop and on the roundcube server. > Both roundcube and dovecot are installed on the same server. That should give you a good idea about what's wrong with your setup. http://lmgtfy.com/?q=dovecot+ssl+setup# B

1 0

Re: 1.0.15 gone, can't start version 2
by Muzaffer Tolga Ozses 12 Jun '15

12 Jun '15

*make clean* then? On 12 June 2015 at 15:52, Steve Matzura <number6(a)noisynotes.com> wrote: > On Fri, 12 Jun 2015 15:13:18 +0300, you wrote: > > >Have you done *make distclean* in prior? That should remove all things > >dovecot. > > I tried, but got: > > make: *** No target to make `distclean'. Stop. >

1 0

how to doveadm search from "<>" (null sender)?
by Daniel Funke 12 Jun '15

12 Jun '15

Hi, I tried to search for mailer daemon messages but can't find a syntax for the null sender. all these does not work: doveadm -u xxx from "<>" doveadm -u xxx from <> doveadm -u xxx from "" any ideas? Thank you Daniel

2 1

Replication: "cross-updates" of mail meta-data
by Andre Nathan 11 Jun '15

11 Jun '15

Hello I have a two-server dovecot setup using replication. Each server runs two dovecot instances, one for director and another for the backend. Initially I set up a single server, got it all working, then rsync'd the data and index partitions to the new one and started the clusters (I used rsync as a way to speed-up dovecot's initial replication). Both servers listen on a virtual IP addresses load-balanced by IPVS as well as their own IP addresses. When I started dovecot in the second server, users started reporting that some of their messages were missing. I noticed that while the mail data seemed to be up to date in server1, it wasn't in server2; however, the indexes were being updated in server2 but not in server1. For example, "doveadm quota get -u some-user" would report the wrong value in server1 and the right value in server2, while a "du" would show that only server1 actually had the most up-to-date data. At the moment I had to take down server2, because as soon as dovecot is running in it, users start reporting missing messages again. To solve that problem, a "doveadm force-resync" in server1 isn't enough. I either rsync the index files from server2 or remove the indexes in server1 before the force-resync, which then works. Has anyone ever saw anything similar to this? Any help would be much appreciated. I'm running Ubuntu 14.04 with dovecot 2.2.15 with the configurations below: === Backend instance === # dovecot -n # 2.2.15: /etc/dovecot/dovecot.conf # OS: Linux 3.16.0-37-generic x86_64 Ubuntu 14.04.2 LTS auth_master_user_separator = * auth_mechanisms = plain login auth_username_chars = abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ01234567890.-_@= auth_worker_max_count = 10 disable_plaintext_auth = no doveadm_password = secret doveadm_port = 12345 listen = server1.mydomain.com mail_fsync = never mail_gid = dovemail mail_plugins = " notify replication quota" mail_uid = dovemail managesieve_sieve_capability = fileinto reject envelope vacation subaddress comparator-i;ascii-numeric relational regex copy include vacation-seconds imapflags notify namespace { inbox = yes location = mailbox SPAM { auto = subscribe } prefix = separator = / type = private } passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } passdb { args = /etc/dovecot/dovecot-sql-master.conf.ext driver = sql master = yes pass = yes } plugin { mail_replica = tcp:192.168.0.2:12345 # server2's replication IP quota = dict:User quota::file:/var/lib/imap/user/%2.256RHn/%n/dovecot-quota quota_rule = *:storage=1GB sieve = /var/lib/imap/sieve/%2.256RHn/%n/dovecot.sieve sieve_dir = /var/lib/imap/sieve/%2.256RHn/%n sieve_extensions = comparator-i;ascii-numeric copy envelope fileinto imapflags include notify regex reject relational subaddress vacation-seconds sieve_max_redirects = 20 sieve_max_script_size = 512KB sieve_quota_max_scripts = 2 sieve_vacation_min_period = 1 sieve_vacation_send_from_recipient = yes } protocols = imap pop3 lmtp sieve replication_dsync_parameters = -f -d -N -l 30 -U service aggregator { fifo_listener replication-notify-fifo { group = dovemail mode = 0666 user = dovemail } unix_listener replication-notify { group = dovemail mode = 0666 user = dovemail } } service auth-worker { user = $default_internal_user } service auth { client_limit = 10240 process_limit = 1 process_min_avail = 1 } service doveadm { inet_listener { address = 192.168.0.1 port = 12345 } vsz_limit = 1 G } service imap { process_limit = 8192 process_min_avail = 10 } service lmtp { inet_listener { address = lmtpcluster.internal.mydomain.com, server1.internal.mydomain.com port = 1124 } process_limit = 512 process_min_avail = 10 } service managesieve-login { inet_listener sieve { address = lmtpcluster.internal.mydomain.com, server1.internal.mydomain.com port = 4190 } } service managesieve { process_limit = 20 process_min_avail = 10 } service pop3 { process_limit = 512 process_min_avail = 10 } service replicator { process_min_avail = 1 unix_listener replicator-doveadm { group = dovemail mode = 0666 user = dovemail } } ssl_cert = </etc/ssl/certs/mydomain.crt ssl_key = </etc/ssl/private/mydomain.key userdb { driver = prefetch } userdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } verbose_proctitle = yes protocol imap { imap_client_workarounds = tb-extra-mailbox-sep delay-newmail imap_idle_notify_interval = 2 mins imap_max_line_length = 64 k mail_max_userip_connections = 50 mail_plugins = " notify replication quota imap_quota" } protocol lmtp { info_log_path = /var/log/mail/dovecot-lmtp.log mail_fsync = optimized mail_plugins = " notify replication sieve quota" } protocol sieve { mail_plugins = " notify replication sieve" managesieve_implementation_string = ManageSieve managesieve_logout_format = bytes=%i/%o managesieve_max_line_length = 65536 managesieve_sieve_capability = comparator-i;ascii-numeric copy envelope fileinto imapflags include notify regex reject relational subaddress vacation-seconds ssl = no } protocol pop3 { mail_plugins = " notify replication quota" pop3_client_workarounds = outlook-no-nuls oe-ns-eoh } === Director instance === # dovecot -n -c /etc/dovecot_director/dovecot_director.conf # 2.2.15: /etc/dovecot_director/dovecot_director.conf # OS: Linux 3.16.0-37-generic x86_64 Ubuntu 14.04.2 LTS auth_master_user_separator = * auth_mechanisms = plain login auth_username_chars = abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ01234567890.-_@= auth_worker_max_count = 10 base_dir = /var/run/dovecot_director director_mail_servers = server1.internal.mydomain.com server2.internal.mydomain.com director_servers = A.B.C.1 A.B.C.2 # server1 and server2 external IP addresses disable_plaintext_auth = no instance_name = dovecot_director listen = lmtpcluster.mydomain.com, server1.mydomain.com lmtp_proxy = yes login_greeting = IMAP/POP3 server mail_fsync = never mail_gid = dovemail mail_plugins = " quota" mail_uid = dovemail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave passdb { args = /etc/dovecot_director/dovecot_director-sql.conf.ext driver = sql } passdb { args = /etc/dovecot_director/dovecot_director-sql-master.conf.ext driver = sql master = yes pass = yes } protocols = imap pop3 lmtp service auth-worker { user = $default_internal_user } service auth { client_limit = 10240 process_limit = 1 process_min_avail = 1 } service director { fifo_listener login/proxy-notify { mode = 0666 } inet_listener { address = A.B.C.1 port = 7777 } unix_listener director-userdb { mode = 0600 } unix_listener login/director { mode = 0666 } } service imap-login { executable = imap-login director idle_kill = 10 secs inet_listener imap { port = 143 } process_limit = 400 process_min_avail = 10 service_count = 0 vsz_limit = 512 M } service lmtp { inet_listener lmtp { address = lmtpcluster.internal.mydomain.com, server1.internal.mydomain.com port = 24 } process_limit = 512 } service pop3-login { executable = pop3-login director idle_kill = 10 secs inet_listener pop3 { port = 110 } process_limit = 256 } ssl_cert = </etc/ssl/certs/mydomain.crt ssl_key = </etc/ssl/private/mydomain.key userdb { driver = prefetch } userdb { args = /etc/dovecot_director/dovecot_director-sql.conf.ext driver = sql } verbose_proctitle = yes protocol lmtp { auth_socket_path = director-userdb info_log_path = /var/log/mail/dovecot-director-lmtp.log passdb { args = proxy=y nopassword=y port=1124 driver = static name = } } Thanks in advance, Andre

1 0

Error starting 1.0.15 with SSL_DISABLE=No
by Steve Matzura 11 Jun '15

11 Jun '15

When starting Dovecot 1.0.15 after building it from source using the standard procedure, I receive the following message when starting, even though SLL_DISABLE=No: Error: SSL support not compiled in but ssl_disable=no Fatal: Invalid configuration in /usr/local/etc/dovecot.conf How is SSL support configured and built in? I know it has something to do with the --SSL_CFLAGS flag.

2 2

suggestion: avoid help keeping XP alive
by A. Schulze 10 Jun '15

10 Jun '15

Hello, if possible encourage people to update then helping them keeping horribly outdated XP + OE still alive... Thanks Andreas

1 0

Order of keys
by Steve Matzura 10 Jun '15

10 Jun '15

I hope I'm asking this on the right list, in the right place. I go through this every three years and for whatever reason keep forgetting to record how this works! In the Dovecot config, there are two places to define SSL certificates--ssl_cert_file and ssl_key_file. My question is this: Which two of the three files--the certifying authority, the signed certificate for the specific system, and the private certificate file--are combined to create the file that goes with ssl_cert_file? Since there are six possible permutations to answer this question (because order of files matters), which two go with ssl_crt_file and in what order? I have a private certificate file, the certifying authority's .CRT file, and the certifying authority's signed .PEM file which contains the system's certified certificate. Thanks in advance.

2 1

can't enable sieve on ubuntu trusty
by Mihai Badici 10 Jun '15

10 Jun '15

I try to create a sieve rule on a Ubuntu server ( managed by i-mscp) For this rule i need the editheader extension. I edited /etc/dovecot/conf.d/90-sieve.conf and added the following: plugin { #sieve_extensions = +notify +imapflags sieve_extensions = +editheader .... Restarted dovecot and didn't work Looks like the content of 90-sieve.conf is ignored. dovecot -n show no rule activated: dovecot -n # 2.2.9: /etc/dovecot/dovecot.conf # OS: Linux 3.13.0-53-generic x86_64 Ubuntu 14.04.2 LTS auth_mechanisms = plain login cram-md5 digest-md5 disable_plaintext_auth = no mail_location = maildir:~/ mail_plugins = quota managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave namespace inbox { inbox = yes location = prefix = INBOX. separator = . type = private } passdb { args = /etc/dovecot/dovecot-sql.conf driver = sql } plugin { autocreate = Trash autocreate2 = Spam autocreate3 = Deffered autocreate4 = Whatever autosubscribe = Trash autosubscribe2 = Spam autosubscribe3 = Deffered quota = maildir:User quota quota_rule = *:storage=1GB quota_warning = storage=95%% quota-warning 95 %u quota_warning2 = storage=80%% quota-warning 80 %u } protocols = " imap lmtp sieve pop3" service auth { unix_listener auth-master { mode = 0600 user = vmail } } service quota-warning { executable = script /var/www/imscp/engine/quota/imscp-dovecot-quota.sh group = imscp unix_listener quota-warning { mode = 0600 user = vmail } } ssl_cert = </etc/imscp/imscp_services.pem ssl_key = </etc/imscp/imscp_services.pem ssl_protocols = !SSLv2 !SSLv3 userdb { driver = prefetch } userdb { args = /etc/dovecot/dovecot-sql.conf driver = sql } protocol imap { mail_plugins = quota imap_quota } protocol pop3 { pop3_uidl_format = %u-%v } protocol lda { auth_socket_path = /var/run/dovecot/auth-master mail_plugins = quota postmaster_address = postmaster(a)ispcp.sf-hosting.net } Mihai Badici[1] -------- [1] http://mihai.badici.ro

1 0

Dovecot mbox & other programs
by Pali Rohár 09 Jun '15

09 Jun '15

Hello, I want to use dovecot as imap server with mbox storage format (described at [1]) but I also want to access (and modify!) those mbox files which are stored on server (and used by dovecot). What is correct way to read those mboxes? From wiki page [1] I read that I should ignore first message in mbox (which contains X-IMAPbase header) and mbox file is in mboxcl2 format. And what is correct way to modify that mbox file (which is used by dovecot imap)? I would like to configure mutt on server to directly access those mbox mailboxes without need to use imap protocol (over localhost). It is possible without any data/message damage? [1] - http://wiki2.dovecot.org/MailboxFormat/mbox -- Pali Rohár pali.rohar(a)gmail.com

6 15

special_use \Archive not working with some foldernames
by Hajo Locke 09 Jun '15

09 Jun '15

Hello list, i use dovecot 2.2.18 compiled on my own and want to report an odd behaviour when using a folder for special_use \Archive. In my case it is not working when using some special foldernames (mbox). I compared to version 2.2.15 which i found pre-packaged on launchpad.net, same behaviour. All other special_use Folder work like expected. My situation: We authenticate users using mysql-db. also we allow users to store individuell special_use settings in db. this is a way which was recommended by this mailinglist some years ago. we use a password_query like this: password_query = SELECT `inbox` as `user`, `password`, `home` as userdb_home, `uid` AS userdb_uid, `gid` AS userdb_gid, `userdb_import` AS userdb_userdb_import FROM `mail_users` WHERE `login` = '%u' AND `active`='Y' typical column in db looks like this: | username | cryptedpass | path | inboxname | uid | gid | Y | namespace/inbox/mailbox=Sent namespace/inbox/mailbox/Sent/name=Gesendet namespace/inbox/mailbox/Sent/auto=subscribe namespace/inbox/mailbox/Sent/special_use=\Sent namespace/inbox/mailbox=Drafts namespace/inbox/mailbox/Drafts/name=EntwÃ¼rfe namespace/inbox/mailbox/Drafts/auto=subscribe namespace/inbox/mailbox/Drafts/special_use=\Drafts namespace/inbox/mailbox=Trash namespace/inbox/mailbox/Trash/name=Papierkorb namespace/inbox/mailbox/Trash/auto=subscribe namespace/inbox/mailbox/Trash/special_use=\Trash namespace/inbox/mailbox=Junk namespace/inbox/mailbox/Junk/name=Spam namespace/inbox/mailbox/Junk/auto=subscribe namespace/inbox/mailbox/Junk/special_use=\Junk namespace/inbox/mailbox=Archives namespace/inbox/mailbox/Archives/name=Archiv namespace/inbox/mailbox/Archives/auto=subscribe namespace/inbox/mailbox/Archives/special_use=\Archive | Now i noticed that in this case the folder Archiv was not binded to special_use \Archive: * LIST (\NoInferiors \UnMarked \Junk) "/" Spam * LIST (\NoInferiors \UnMarked \Drafts) "/" Entw&APw-rfe * LIST (\NoInferiors \UnMarked \Sent) "/" Gesendet * LIST (\NoInferiors \UnMarked \Trash) "/" Papierkorb * LIST (\NoInferiors \UnMarked) "/" Archiv * LIST (\HasNoChildren) "/" INBOX If i change the name of folder which is binded to special_use \Archive its working again, no other changes: * LIST (\NoInferiors \UnMarked \Archive) "/" Archiviu or a shorter one: * LIST (\HasNoChildren \Archive) "/" Arc It works in most cases, it is not working if i have chosen name "Archiv". It seems also that autocreating of folder is not working if name is "Archiv". I activated the debug settings but was not helpful. Looks the same in all cases: Debug: Added userdb setting: namespace/inbox/mailbox=Archives Debug: Added userdb setting: namespace/inbox/mailbox/Archives/auto=subscribe Debug: Added userdb setting: namespace/inbox/mailbox/Archives/name=Arc Debug: Added userdb setting: namespace/inbox/mailbox/Archives/special_use=\Archive or: Debug: Added userdb setting: namespace/inbox/mailbox=Archives Debug: Added userdb setting: namespace/inbox/mailbox/Archives/auto=subscribe Debug: Added userdb setting: namespace/inbox/mailbox/Archives/name=Archiviu Debug: Added userdb setting: namespace/inbox/mailbox/Archives/special_use=\Archive or the not working one: Debug: Added userdb setting: namespace/inbox/mailbox=Archives Debug: Added userdb setting: namespace/inbox/mailbox/Archives/auto=subscribe Debug: Added userdb setting: namespace/inbox/mailbox/Archives/name=Archiv Debug: Added userdb setting: namespace/inbox/mailbox/Archives/special_use=\Archive I have no idea what is going wrong here. I have no further hints in my logs. What to do now? Any ideas? Thanks, Hajo

1 0

Re: Dovecot mbox & other programs
by Joseph Tam 09 Jun '15

09 Jun '15

Pali Roh?r <pali.rohar(a)gmail.com> writes: > Still I want read/write access to storage and want to use mbox as > storage (also for easier backup and copy)... Backup performance may be another big win for Maildir, especially for incremental backups. Be that as it may ... > And my question was how to properly read and write from/to mbox files > which are used by dovecot. Dovecot mailbox indices are self-healing: indices should be rengenerated automatically when the mailbox is out of sync with regards to the indices. There may be a few complaints in the mail logs about it (e.g. UIDVALIDITY changes), but they are mostly harmless. Joseph Tam <jtam.home(a)gmail.com>

1 0

LMTPs between proxy and backend
by Patrick Westenberg 05 Jun '15

05 Jun '15

Hi @all, I have a 3 server setup (MX ==LMTP==> Proxy ==LMTP==> Backend). After upgrading to 2.2.18 I was able to use LMTPs from MX to the proxy but not from the proxy to the backend: Received: from mf01.example.net ([172.17.1.5]) by mb01.example.net (Dovecot) with LMTP id T+LnDWrvcVWDSwAAJnBBGg for <patrick(a)example.net>; Fri, 05 Jun 2015 20:50:58 +0200 Received: from mx01.example.net ([172.17.1.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits) zlib compression) by mf01.example.net (Dovecot) with LMTP id 8uuXJ13vcVW2fgAATr09kg Can anyone help or is Dovecot not able to use LMTPs as client? Regards Patrick Proxy: # 2.2.18: /usr/local/etc/dovecot/dovecot.conf # Pigeonhole version 0.4.8 (0c4ae064f307+) # OS: Linux 3.16.0-0.bpo.4-amd64 x86_64 Debian 7.8 auth_mechanisms = plain login director_mail_servers = 172.17.1.1 172.17.1.2 director_servers = 172.17.1.3 172.17.1.4 director_user_expire = 5 mins lmtp_proxy = yes log_path = /var/log/dovecot.log managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate protocols = imap pop3 lmtp sieve service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0666 user = postfix } unix_listener auth-userdb { user = dovecot } } service director { fifo_listener login/proxy-notify { mode = 0666 } inet_listener { address = 172.17.1.3 port = 9090 } unix_listener director-userdb { mode = 0600 } unix_listener login/director { mode = 0666 } } service imap-login { executable = imap-login director process_min_avail = 1 service_count = 0 } service lmtp { inet_listener lmtp { address = 172.17.1.3 port = 24 } process_min_avail = 20 } service managesieve-login { executable = managesieve-login director inet_listener sieve { port = 4190 } } service pop3-login { executable = pop3-login director } ssl_cert = </etc/ssl/certs/wildcard.pem ssl_cipher_list = <snip> ssl_dh_parameters_length = 2048 ssl_key = </etc/ssl/private/wildcard.key ssl_prefer_server_ciphers = yes ssl_protocols = !SSLv3 !SSLv2 verbose_proctitle = yes protocol !smtp { passdb { args = proxy=y nopassword=y starttls=any-cert driver = static name = } } protocol smtp { passdb { args = /usr/local/etc/dovecot/dovecot-sql.conf.ext driver = sql name = } userdb { args = /usr/local/etc/dovecot/dovecot-sql.conf.ext driver = sql name = } } protocol lmtp { auth_socket_path = director-userdb } Backend: # 2.2.18: /usr/local/etc/dovecot/dovecot.conf # Pigeonhole version 0.4.8 (0c4ae064f307+) # OS: Linux 3.14-0.bpo.1-amd64 x86_64 Debian 7.8 auth_mechanisms = plain login listen = 172.17.1.2 lmtp_save_to_detail_mailbox = yes log_path = /var/log/dovecot.log login_trusted_networks = 172.17.1.3 172.17.1.4 mail_home = /srv/mail/%Ld/%Ln mail_location = maildir:~/Maildir mail_plugins = quota notify replication managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate namespace inbox { inbox = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Spamverdacht { auto = subscribe special_use = \Junk } mailbox Trash { auto = subscribe special_use = \Trash } prefix = INBOX/ separator = / type = private } passdb { args = /usr/local/etc/dovecot/dovecot-sql.conf.ext driver = sql } plugin { mail_replica = tcps:mb01.wk-serv.net quota = dict:User quota::file:%h/Maildir/dovecot-quota quota_rule2 = INBOX/Trash:ignore quota_status_nouser = DUNNO quota_status_success = DUNNO quota_warning = storage=90%% quota-warning 90 %u quota_warning2 = storage=75%% quota-warning 75 %u sieve = ~/.dovecot.sieve sieve_after = /usr/local/etc/dovecot/sieve/sieve_after.sieve sieve_default = /usr/local/etc/dovecot/sieve/default.sieve sieve_dir = ~/sieve } postmaster_address = postmaster(a)wk-serv.de protocols = imap pop3 lmtp sieve service aggregator { fifo_listener replication-notify-fifo { user = vmail } unix_listener replication-notify { user = vmail } } service auth { unix_listener auth-userdb { group = vmail mode = 0666 user = vmail } } service config { unix_listener config { mode = 0600 user = vmail } } service doveadm { inet_listener { port = 12345 ssl = yes } } service imap-login { process_min_avail = 2 service_count = 0 } service lmtp { inet_listener lmtp { address = 172.17.1.2 port = 24 } process_min_avail = 20 } service managesieve-login { inet_listener sieve { port = 4190 } } service quota-status { client_limit = 1 executable = quota-status -p postfix inet_listener { port = 12340 } } service quota-warning { executable = script /usr/local/etc/dovecot/quota_warning.sh unix_listener quota-warning { user = vmail } user = root } service replicator { process_min_avail = 1 unix_listener replicator-doveadm { mode = 0600 user = vmail } } ssl = required ssl_cert = </etc/ssl/certs/wildcard.crt ssl_client_ca_file = /etc/ssl/certs/startssl-bundle.pem ssl_key = </etc/ssl/private/wildcard.key ssl_protocols = !SSLv3 !SSLv2 userdb { driver = prefetch } userdb { args = /usr/local/etc/dovecot/dovecot-sql.conf.ext driver = sql } verbose_proctitle = yes protocol lmtp { mail_plugins = quota notify replication sieve } protocol imap { mail_max_userip_connections = 30 mail_plugins = quota notify replication imap_quota }

1 0

Does Dovecot allow different clients to subscribe different subsets of IMAP folders?
by Steve 04 Jun '15

04 Jun '15

I have a working Dovecot IMAP server (v. 2.2.9) where I have a single user but a lot of folders (over 800 in total, hierarchically arranged, about 50 of which are in active use.) I have multiple clients (including k9Mail on Android and Thunderbird on Linux and Windows). These clients all present a consistent subscription to a single subset of the available folders . What I'd like to be able to do is (somehow) allow different devices (different email clients) to subscribe to a different subset of folders. For example, I may want K9mail on my phone to be subscribed only to my "main Inbox" - but for Thunderbird on Windows to also be subscribed to active mailing-list folders. Does Dovecot support such a mode of operation? If so, how do I configure it? If not, what options are there to achieve the desired end result - i.e. different devices/IMAP clients subscribed to different subsets of the universe of folders available to a single user. Mandatory details: Version : 2.2.9 Configuration: See http://paste.ubuntu.com/11564807/

3 4

Testing SHA512-CRYPT password hashes with doveadm pw -t fails
by Felix Zielcke 04 Jun '15

04 Jun '15

Hi, I use Debian jessie with Dovecot 2.2.13-11. While writing a script for Horde to change the passwords in my passwd file I noticed doveadm pw -t fails for SHA512-CRYPT: # doveadm pw -s SHA1 -p test {SHA1}qUqP5cyxm6YcTAhz05Hph5gvu9M= # doveadm pw -t {SHA1}qUqP5cyxm6YcTAhz05Hph5gvu9M= -p test {SHA1}qUqP5cyxm6YcTAhz05Hph5gvu9M= (verified) # doveadm pw -s SHA512-CRYPT -p test {SHA512-CRYPT}$6$8FfoioQWQDR/Vuzu$ynKiO/E6Xf4dMvfx2LsP9KQotqy5cEOEppnEh5Hqe1UpCYAgOwSIJlNb0O65fxdYcRZH3gNFQ7ZOM/2kD/R811 doveadm pw -t {SHA512-CRYPT}$6$8FfoioQWQDR/Vuzu$ynKiO/E6Xf4dMvfx2LsP9KQotqy5cEOEppnEh5Hqe1UpCYAgOwSIJlNb0O65fxdYcRZH3gNFQ7ZOM/2kD/R811 -p test doveadm(root): Fatal: reverse password verification check failed: Password mismatch If this can't work for SHA512-CRYPT then at least the error message should be more helpful. Or am I understanding the -t option wrongly? Then this sohuld be maybe somewhere clarified. I just use now doveadm auth test which works fine. Regards, Felix Zielcke

2 2

Misleading SSL/TLS Log Messages
by Yahooguntu 03 Jun '15

03 Jun '15

Hi all, I think I've found a small bug in how Dovecot logs SSL/TLS info. Basically, if I connect to the server using TLS, the logs have a lot of entries saying I used SSLv3 (which is not allowed). Here's my system info: OSX Yosemite (x86_64, HFS+) Dovecot 2.2.15 (via Homebrew) OpenSSL 0.9.8zd The configuration (see below) disallows SSLv3, and if I try and connect with OpenSSL to test that ("openssl s_client -connect localhost:993 -ssl3") it fails as expected. If I do the same command, but with "-tls1" instead of "-ssl3", I can connect and run IMAP commands. The problem is, if I open up the Dovecot logs and look at the SSL log messages, they all say I used SSLv3. As an example, this is a truncated log from when I connected to the server and immediately did a LOGOUT: 14:50:59 : master: Warning: Killed with signal 15 (by pid=1 uid=0 code=unknown 0) 14:51:03 : master: Dovecot v2.2.15 starting up for imap, lmtp (core dumps disabled) 14:51:13 : imap-login: Debug: SSL: elliptic curve secp384r1 will be used for ECDH and ECDHE key exchanges 14:51:13 --- last message repeated 1 time --- 14:51:13 : imap-login: Debug: SSL: where=0x10, ret=1: before/accept initialization [127.0.0.1] 14:51:13 : imap-login: Debug: SSL: where=0x2001, ret=1: before/accept initialization [127.0.0.1] 14:51:13 : imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 read client hello A [127.0.0.1] 14:51:13 : imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write server hello A [127.0.0.1] 14:51:13 : imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write certificate A [127.0.0.1] 14:51:13 : imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write key exchange A [127.0.0.1] 14:51:13 : imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write server done A [127.0.0.1] 14:51:13 : imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 flush data [127.0.0.1] 14:51:13 : imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 read client certificate A [127.0.0.1] 14:51:13 : imap-login: Debug: SSL: where=0x2002, ret=-1: SSLv3 read client key exchange A [127.0.0.1] 14:51:13 --- last message repeated 1 time --- 14:51:13 : imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 read client key exchange A [127.0.0.1] 14:51:13 : imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 read finished A [127.0.0.1] 14:51:13 : imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write session ticket A [127.0.0.1] 14:51:13 : imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write change cipher spec A [127.0.0.1] 14:51:13 : imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write finished A [127.0.0.1] 14:51:13 : imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 flush data [127.0.0.1] 14:51:13 : imap-login: Debug: SSL: where=0x20, ret=1: SSL negotiation finished successfully [127.0.0.1] 14:51:13 : imap-login: Debug: SSL: where=0x2002, ret=1: SSL negotiation finished successfully [127.0.0.1] 14:51:19 : imap-login: Aborted login (no auth attempts in 6 secs): user=<>, rip=127.0.0.1, lip=127.0.0.1, TLS, session=<QdX1YaIXTQB/AAAB> 14:51:19 : imap-login: Debug: SSL alert: close notify [127.0.0.1] The second to last line, which indicates I never tried to log in, correctly states that I used TLS. All the lines for SSL debugging, though, state I used SSL or SSLv3. This is a test setup, so it accepts any mail from @example.com addresses over LMTP and allows any user to connect with the password "staticpassword". Here's the output of "dovecot -n": # 2.2.15: /usr/local/etc/dovecot/dovecot.conf # OS: Darwin 14.3.0 x86_64 hfs default_client_limit = 50 default_internal_user = _dovecot default_login_user = _dovenull default_process_limit = 10 listen = 127.0.0.1 mail_gid = admin mail_location = mbox:/usr/local/etc/dovecot/mailboxes/%n mail_uid = [my username] namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = password=staticpassword driver = static } postmaster_address = postmaster at example.com protocols = imap lmtp service lmtp { inet_listener lmtp { address = 127.0.0.1 ::1 port = 24 } } ssl = required ssl_cert = </usr/local/etc/dovecot/ssl/cert.pem ssl_key = </usr/local/etc/dovecot/ssl/key.pem ssl_protocols = !SSLv2 !SSLv3 verbose_ssl = yes

2 1

indexer-worker crashes handling mails with big attachments (dovecot 2.2.16/2.2.18 + FTS Apache Solr + Tika)
by Robinson Bomze 03 Jun '15

03 Jun '15

Hi, yesterday i tried to setup Dovecot with Solr (3.6.2) + Tika (1.8) for FTS. i used a fresh Debian 8.0 system in the beginning with Dovecot 2.2.13 from the Debian repository. After i got some issues with Tika/Dovecot and i read on the mailinglist that these problems where fixed in 2.2.14+, so i tried 2.2.18. With 2.2.18 i get panics with big (ok... huge) attachments. Most mailboxes (and their attachments) get index fine, but on some i got panics from the indexer-worker. i was able to isolate the problem. It seems that when Tika (which works flawless) sends a big reply to Dovecot and Dovecot sends this data to Solr, communication crashes between Dovecot and Solr. Eg. indexing an email with a 200k char wordfile results in a panic of the indexer-worker: Jun 02 23:50:57 indexer-worker(username): Warning: I/O leak: 0x7ff65f39f540 (line 120, fd 20) Jun 02 23:50:57 indexer-worker(username): Warning: Timeout leak: 0x7ff65f39f2e0 (line 325) Jun 02 23:50:57 indexer: Error: Indexer worker disconnected, discarding 1 requests for username Jun 02 23:50:57 imap(username): Error: indexer failed to index mailbox INBOX.username Jun 02 23:50:57 indexer-worker(username): Fatal: master: service(indexer-worker): child 11429 killed with signal 11 (core dumped) I got similar issues results with 2.2.16: Jun 02 23:21:12 indexer-worker(username): Warning: I/O leak: 0x7ffff7811cc0 (line 127, fd 20) Jun 02 23:21:12 indexer-worker(username): Panic: file ioloop.c: line 39 (io_add_file): assertion failed: (callback != NULL) Jun 02 23:21:12 indexer-worker(username): Error: Raw backtrace: /usr/local/lib/dovecot/libdovecot.so.0(+0x77130) [0x7ffff7842130] -> /usr/local/lib/dovecot/libdovecot.so.0(+0x7 Jun 02 23:21:12 indexer: Error: Indexer worker disconnected, discarding 1 requests for username Jun 02 23:21:12 imap(username): Error: indexer failed to index mailbox INBOX.username Jun 02 23:21:12 indexer-worker(username): Fatal: master: service(indexer-worker): child 7909 killed with signal 6 (core dumps disabled) The problem was already posted: http://dovecot.org/pipermail/dovecot/2015-May/100901.html I could trigger the same panic running the indexer via 'doveadm index -u username MAILBOX'. Here is a backtrace (bt) of the 2.2.18-crash (on line #8 you see a fragement of the text sent to solr): #0 array_count_i (array=0x8) at array.h:155 #1 array_get_modifiable_i (count_r=<synthetic pointer>, array=0x8) at array.h:228 #2 priorityq_remove_idx (pq=0x0, idx=0) at priorityq.c:121 #3 0x00007ff65f3ef5eb in priorityq_remove (pq=<optimized out>, item=item@entry=0xa26920) at priorityq.c:138 #4 0x00007ff65f3e1e70 in timeout_remove (_timeout=<optimized out>) at ioloop.c:288 #5 0x00007ff65f3e2781 in io_loop_move_timeout (_timeout=_timeout@entry=0xa27f98) at ioloop.c:861 #6 0x00007ff65f39ff37 in http_client_connection_switch_ioloop (conn=conn@entry=0xa27ea0) at http-client-connection.c:1357 #7 0x00007ff65f3a3d68 in http_client_switch_ioloop (client=client@entry=0xa0bf20) at http-client.c:211 #8 0x00007ff65f39c005 in http_client_request_continue_payload (_req=_req@entry=0xa0ee88, data=0xa42fa0 "k for evidence of fluid spill.\nIf the device is mounted on a stand, examine the condition of the mount.\nIf the device moves on casters, check the condition of the casters. Check operation of brakes, i"..., size=55453) at http-client-request.c:566 #9 0x00007ff65f39c22a in http_client_request_send_payload (_req=_req@entry=0xa0ee88, data=<optimized out>, size=<optimized out>) at http-client-request.c:625 #10 0x00007ff65e972429 in solr_connection_post_more (post=0xa0ee80, data=<optimized out>, size=size@entry=55453) at solr-connection.c:504 #11 0x00007ff65e96ea09 in fts_backed_solr_build_commit (ctx=0xa1a880) at fts-backend-solr.c:341 #12 0x00007ff65e96eaad in fts_backend_solr_update_set_mailbox (_ctx=0xa1a880, box=0x0) at fts-backend-solr.c:407 #13 0x00007ff65eb7cfac in fts_backend_set_cur_mailbox (ctx=ctx@entry=0xa1a880) at fts-api.c:129 #14 0x00007ff65eb7cfe3 in fts_backend_update_deinit (_ctx=<optimized out>) at fts-api.c:143 #15 0x00007ff65eb8303c in fts_transaction_end (t=t@entry=0xa11ed0) at fts-storage.c:550 #16 0x00007ff65eb83e91 in fts_transaction_commit (t=0xa11ed0, changes_r=0x7ffdcdca5e30) at fts-storage.c:615 #17 0x00007ff65f688a82 in mailbox_transaction_commit_get_changes (_t=_t@entry=0x7ffdcdca5ee0, changes_r=changes_r@entry=0x7ffdcdca5e30) at mail-storage.c:1837 #18 0x00007ff65f688b2e in mailbox_transaction_commit (t=t@entry=0x7ffdcdca5ee0) at mail-storage.c:1818 "bt full" looks like this: #0 array_count_i (array=0x8) at array.h:155 No locals. #1 array_get_modifiable_i (count_r=<synthetic pointer>, array=0x8) at array.h:228 No locals. #2 priorityq_remove_idx (pq=0x0, idx=0) at priorityq.c:121 count = <optimized out> #3 0x00007ff65f3ef5eb in priorityq_remove (pq=<optimized out>, item=item@entry=0xa26920) at priorityq.c:138 No locals. #4 0x00007ff65f3e1e70 in timeout_remove (_timeout=<optimized out>) at ioloop.c:288 timeout = 0xa26920 #5 0x00007ff65f3e2781 in io_loop_move_timeout (_timeout=_timeout@entry=0xa27f98) at ioloop.c:861 new_to = 0xa1adf0 old_to = <optimized out> #6 0x00007ff65f39ff37 in http_client_connection_switch_ioloop (conn=conn@entry=0xa27ea0) at http-client-connection.c:1357 No locals. #7 0x00007ff65f3a3d68 in http_client_switch_ioloop (client=client@entry=0xa0bf20) at http-client.c:211 conn = 0xa27ea0 _conn = 0xa27ea0 host = <optimized out> peer = <optimized out> #8 0x00007ff65f39c005 in http_client_request_continue_payload (_req=_req@entry=0xa0ee88, data=0xa42fa0 "k for evidence of fluid spill.\nIf the device is mounted on a stand, examine the condition of the mount.\nIf the device moves on casters, check the condition of the casters. Check operation of brakes, i"..., size=55453) at http-client-request.c:566 prev_ioloop = 0x9f4730 req = 0xa36970 conn = 0xa27ea0 client = 0xa0bf20 ret = <optimized out> __FUNCTION__ = "http_client_request_continue_payload" #9 0x00007ff65f39c22a in http_client_request_send_payload (_req=_req@entry=0xa0ee88, data=<optimized out>, size=<optimized out>) at http-client-request.c:625 __FUNCTION__ = "http_client_request_send_payload" #10 0x00007ff65e972429 in solr_connection_post_more (post=0xa0ee80, data=<optimized out>, size=size@entry=55453) at solr-connection.c:504 conn = 0xa0be50 __FUNCTION__ = "solr_connection_post_more" Hope anyone fixes the code... i need this feature :) Thanks a lot in advance!

2 1

multi sync (>2 servers) + selective sync + trigger
by b-dovecot.org＠grmbl.net 03 Jun '15

03 Jun '15

Hi all, I've been researching ways to replicate mail across multiple mailstores and have a few questions. Synching 2 mailstores (M1 & M2) via dsync works fine. I want to add a 3rd and 4th (M3 & M4) server to also be synced. Multi-sync (>2 servers): 1) How do I tell M1 and/or M2 to also sync to M3 and/or M4? Selective sync: 2) How do I sync specific domains to specific servers and not to others? Trigger: 3) Does a normal sync check only check the mailbox being changed or does it get triggered on mailbox changes to check ALL indexes and sync all changed mailboxes accordingly? 4) Can I use an email to trigger a sync for any other mailboxes which might be out of sync? TIA B

3 3

Outlook Express with XP...
by SH Development 03 Jun '15

03 Jun '15

Dovecot 2.0.9 I am able to connect successfully with Thunderbird, Win 8, Apple Mail, iPhone, iPad. Outlook Express on Win XP receives just fine, but will not send. I get a "Client host rejected: Access denied” message. I believe this is simply Postfix telling me the connection isn’t properly authenticated, as setting up the exact same credentials on another client (non OE) works. It is only with OE on XP that I am unable to send/authenticate. I have literally tried every combination of settings in OE and nothing works. What else might I need to enable to get this working? Using SSL, ports 993, 587 PLAINTEXT. dovecot -n as follows: # 2.0.9: /etc/dovecot/dovecot.conf # OS: Linux 2.6.32-504.16.2.el6.x86_64 x86_64 CentOS release 6.6 (Final) ext4 log_timestamp = "%Y-%m-%d %H:%M:%S " mail_location = maildir:/home/vmail/%d/%n/Maildir mail_max_userip_connections = 50 namespace { inbox = yes location = prefix = INBOX. separator = . type = private } passdb { args = /etc/dovecot/dovecot-sql.conf driver = sql } protocols = imap pop3 service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } unix_listener auth-master { mode = 0600 user = vmail } user = root } ssl_ca = </etc/pki/dovecot/certs/intermediate.pem ssl_cert = </etc/pki/dovecot/certs/dovecot.pem ssl_key = </etc/pki/dovecot/private/dovecot.pem userdb { args = uid=5000 gid=5000 home=/home/vmail/%d/%n allow_all_users=yes driver = static } protocol lda { auth_socket_path = /var/run/dovecot/auth-master log_path = /home/vmail/dovecot-deliver.log postmaster_address = postmaster(a)starionhost.net } protocol pop3 { pop3_uidl_format = %08Xu%08Xv }

7 11

Re: Outlook Express with XP...
by Joseph Tam 03 Jun '15

03 Jun '15

SH Development writes: > I have literally tried every combination of settings in OE and nothing > works. What else might I need to enable to get this working? > > Using SSL, ports 993, 587 PLAINTEXT. As others have noted, your MTA handles the connection. I believe Windows XP needs to be updated to the latest service patch to handle SSLv3 disabled sites. Try checking to make sure your Postfix SSL security settings and your WinXP SSL capabilities are compatible. Joseph Tam <jtam.home(a)gmail.com>

1 0

Pop3 service stops responding
by Mike Eriksson 02 Jun '15

02 Jun '15

Hi! I have problem with the pop3 service stops responding at random intervals on my server. We started to notice this problem as we're running icinga to check the imap & pop3 service. When icinga reports that the service is down. We try to telnet to the server on port 110 but it refuses the connection. I've checked the netstat during this time and it's listens on port 110. My first thought we were hitting the max connections and similar. Changed login_max_connections from 128 to 256. Didnt solve the problem. Started the debug on the dovecot server but could not see anything in the logs. Also the error log or the syslog dosnt report anything that I can see. Best thing would of course be to start and upgrade the software and os(Debian 5) but I'm not comfortable upgrading it at the moment as my knowledge about dovecot / postfix isn't great. Do you have any idéas how to move forward? dovecot -n # 1.0.15: /etc/dovecot/dovecot.conf base_dir: /var/run/dovecot/ log_path: /var/log/dovecot-error.log info_log_path: /var/log/dovecot-info.log log_timestamp: %Y-%m-%d %H:%M:%S protocols: pop3 imap imaps pop3s ssl_cipher_list: ALL:!LOW disable_plaintext_auth: no login_dir: /var/run/dovecot//login login_executable(default): /usr/lib/dovecot/imap-login login_executable(imap): /usr/lib/dovecot/imap-login login_executable(pop3): /usr/lib/dovecot/pop3-login login_max_processes_count: 256 first_valid_uid: 1090 last_valid_uid: 1090 first_valid_gid: 1090 last_valid_gid: 1090 mail_privileged_group: mail mail_location: maildir:~/Maildir mail_executable(default): /usr/lib/dovecot/imap mail_executable(imap): /usr/lib/dovecot/imap mail_executable(pop3): /usr/lib/dovecot/pop3 mail_plugins(default): quota imap_quota mail_plugins(imap): quota imap_quota mail_plugins(pop3): quota mail_plugin_dir(default): /usr/lib/dovecot/modules/imap mail_plugin_dir(imap): /usr/lib/dovecot/modules/imap mail_plugin_dir(pop3): /usr/lib/dovecot/modules/pop3 pop3_uidl_format(default): pop3_uidl_format(imap): pop3_uidl_format(pop3): %08Xu%08Xv auth default: username_chars: abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ01234567890.-_@% username_translation: %@ username_format: %Lu passdb: driver: sql args: /etc/dovecot/dovecot-sql.conf userdb: driver: passwd userdb: driver: sql args: /etc/dovecot/dovecot-sql.conf socket: type: listen client: path: /var/spool/postfix/private/auth mode: 432 user: postfix group: postfix master: path: /var/run/dovecot/auth-master mode: 384 user: vmail group: vmail plugin: quota: maildir sieve_global_path: /etc/dovecot/sieve_scripts/spam-sort.sieve login_max_processes_count: 256 login_max_connections: 256 max_mail_processes: 1024 Best Regards Mike

2 1

Failed running extprograms execute via socket - fatal recv(MSG_PEEK) failed disconnected
by E.B. 01 Jun '15

01 Jun '15

I switched from running my extprograms execute script directly to running with dovecot socket. Log shows only this dovecot: lmtp(test(a)example.com): Debug: wdi0Tb5VPlGfPnEAM/SpMA: sieve: action execute: running program: test dovecot: lmtp(test(a)example.com): Debug: Namespace : Using permissions from /vmail/example.com/test: mode=0770 gid=default dovecot: script: Fatal: recv(MSG_PEEK) failed: disconnected For testing I opened up the script and socket with permissions 777 but the error seems to indicate less about permissions more about some kind of protocol problem i guessing. Sieve script calls using this: execute "test"; Plugin config: plugin { sieve_plugins = sieve_extprograms sieve_global_extensions = +vnd.dovecot.execute sieve_execute_socket_dir = sieve-execute sieve_before = /usr/local/etc/dovecot/sieve } service test { executable = script /usr/local/etc/dovecot/sieve_globals/test.sh unix_listener sieve-execute/test { mode = 0660 group = vmail } } FYI I have quota-warning sockets configured identical to this and they work good. Dovecot 2.2.16 Pigeonhole 0.4.7 Help appreciate a lot.

2 14

Sieve extprograms ?not exexuting?
by E.B. 01 Jun '15

01 Jun '15

Hello, I was testing the extprograms plugin. I think I had it working in the past, but many things have changed since then, so no use trying to figure out where it broke - starting over again... Debug-enabled log give me: Apr 27 04:11:36 mail dovecot: lmtp(test(a)example.com): Debug: qOGyA0DePHVaOyHEM/SpMA: sieve: action execute: running program: test.sh Apr 27 04:11:36 mail dovecot: lmtp(test(a)example.com): Debug: waiting for program `/usr/local/etc/dovecot/sieve_globals/test.sh' to finish after 0 seconds So I guess it thinks it is running my script? But simple test script does nothing. Here it is: #!/bin/sh read INPUT INPUT="Hello world: $INPUT" echo "$INPUT" >> /tmp/hello echo "---------------------------" >> /tmp/hello Permissions on this script file for now are rwxrwxrwx But nothing goes to /tmp/hello at all. Script works when I run it manually. I also tried without the "read" but I think that's required isn't it? Anyway, what else can I do to debug this? Dovecot 2.2.16 Pigeonhole 0.4.7

4 7

OT: Central sieve management
by list＠airstreamcomm.net 29 May '15

29 May '15

A bit off topic, but I was wondering if anyone here has a solution for centrally managing sieve for multiple users from a custom web application? We would like to implement pigeonhole sieve on our dovecot cluster, however we need to be able to access user’s sieve configurations from a central location for troubleshooting and support purposes.

3 3

Enabling Master User for migration
by Charles Marcus 29 May '15

29 May '15

Hi all, Ok, just need a quick-n-dirty way to enable a master user for a migration... Reading the docs, I'm not sure what the bare minimum is I need to do this... At: http://wiki2.dovecot.org/Authentication/MasterUsers The Example config shows: auth_master_user_separator = * passdb { driver = passwd-file args = /etc/dovecot/passwd.masterusers master = yes pass = yes } passdb { driver = shadow } userdb { driver = passwd } But, if I'm using a non-real user (just need a master user that can log in as all other users for the migration), do I need all three of these? Or just the first two? Or, just the first one? I think I need the first two and not the last one, but am unsure. This is on a production system so don't want to break things, and I'm unfamiliar with using multiple passdb's... Thanks, Charles

2 6

Shared inbox?
by Chris Ross 29 May '15

29 May '15

I'm running dovecot 2.2.16 on my FreeBSD mail server. I've read information on the wiki about setting up shared mailboxes, but I want to do something that isn't really coved by the instructions I was reading there. My son (now 7 years old) has an account on the system, but doesn't use it directly. But, for things he's interested in like Minecraft, and/or the local zoo, we have given out his email address in a small number of places. What I would like to set up, both for now while he's not actually ever reading his email himself, and perhaps even for the future when we teach and/or allow for that, is for my wife and I to be able to "view" his inbox from our accounts. The instructions for setting up shared folders all are written so that they're secondary folders to all accounts. Is there a way to either (a) configure sharing someone elses Inbox by other accounts, or (b) setting up a separately configured shared folder to _act_ as the inbox for a single account? Thanks. Any suggestions to achieve the above described end goal would be appreciated. - Chris

3 6

Creating IMAP folders/subfolders with Thunderbird
by Alex Regan 29 May '15

29 May '15

Hi, I have dovecot-2.2.15 on fedora21 with Thunderbird and having some difficulty creating subfolders and deleting folders. Creating subfolders results in a folder at the root with a caret instead of a slash called folder^subfolder with an entry in .subscriptions with that name, instead of a new folder under the directory. I'm also unable to delete any folders. The command from within Thunderbird is just completely ignored. Any idea what's happening here? Thanks, Alex

2 2

X-UID in mail header is removed?
by mkawada＠redhat.com 28 May '15

28 May '15

Dear Dovecot Mailing List, I have 2 questions regarding dovecot and would very much appreciate if you would kindly give me helps. <Question 1> Is 'X-UID' no longer shown in mail header via pop3? I have checked with the following 3 version of dovecot packages in order to make sure if a message sent by dovecot have 'X-UID' in its mail header, and the result is that only "dovecot-0.99.11-10.EL4" shows 'X-UID' and the other ones do not(Please see the result written in the second half of this mail). <Question 2> Is 'X-UID' used for checking if a message has already been sent to a user so that he never gets any duplicated mails that are already in his mbox? The reason why I am asking this here is that I am working on a problem that a user sometimes gets a duplicated mail from dovecot if the user keeps mails on the server as its settings. I actually thought this kind of thing would happen if the 'UIDL' gets corrupted or changed for some reasons. However, it is said that this issue never happened in using "dovecot-0.99.11-10.EL4" which shows 'X-UID' in mail header and in using "dovecot-2.0.9-8.el6_6.4" which does not show 'X-UID', the issue happens sometimes. Thus, I would like information indicating what is exactly used to avoid getting any duplicated messages while downloading a message via pop3 from dovecot. Here is the test result I checked: (dovecot-0.99.11-10.EL4) ]# telnet localhost 110 Trying 127.0.0.1... Connected to localhost.localdomain (127.0.0.1). Escape character is '^]'. +OK dovecot ready. user test +OK pass password +OK Logged in. list +OK 1 messages: 1 786 . RETR 1 +OK 786 octets Return-Path: <root(a)localhost.localdomain> Received: from localhost.localdomain (localhost.localdomain [127.0.0.1]) by localhost.localdomain (8.13.1/8.13.1) with ESMTP id t4S4dBcu006057 for <test(a)localhost.localdomain>; Thu, 28 May 2015 13:39:11 +0900 Received: (from root@localhost) by localhost.localdomain (8.13.1/8.13.1/Submit) id t4S4dB6u006056 for test; Thu, 28 May 2015 13:39:11 +0900 Date: Thu, 28 May 2015 13:39:11 +0900 From: root <root(a)localhost.localdomain> Message-Id: <201505280439.t4S4dB6u006056(a)localhost.localdomain> To: test(a)localhost.localdomain Subject: test mail X-IMAPbase: 1432787986 1 Status: O X-UID: 1 <--X-UID shown here Content-Length: 5 X-Keywords: test . UIDL +OK 1 1432787986.1 (dovecot-1.0.7-9.el5_11.4) ]# telnet localhost 110 Trying 127.0.0.1... Connected to localhost.localdomain (127.0.0.1). Escape character is '^]'. +OK Dovecot ready. user test +OK pass password +OK Logged in. list +OK 1 messages: 1 606 . RETR 1 +OK 606 octets Return-Path: <root(a)localhost.localdomain> Received: from localhost.localdomain (localhost.localdomain [127.0.0.1]) by localhost.localdomain (8.13.8/8.13.8) with ESMTP id t4S27gBo007199 for <test(a)localhost.localdomain>; Thu, 28 May 2015 11:07:42 +0900 Received: (from root@localhost) by localhost.localdomain (8.13.8/8.13.8/Submit) id t4S27fXd007197 for test; Thu, 28 May 2015 11:07:41 +0900 Date: Thu, 28 May 2015 11:07:41 +0900 From: root <root(a)localhost.localdomain> Message-Id: <201505280207.t4S27fXd007197(a)localhost.localdomain> To: test(a)localhost.localdomain Subject: testmail test . UIDL +OK 1 0000000155667888 . (dovecot-2.0.9-8.el6_6.4) ]# telnet localhost 110 Trying ::1... telnet: connect to address ::1: Connection refused Trying 127.0.0.1... Connected to localhost. Escape character is '^]'. +OK Dovecot ready. user test +OK pass password +OK Logged in. list +OK 1 messages: 1 605 . RETR 1 +OK 605 octets Return-Path: <root(a)localhost.localdomain> X-Original-To: test Delivered-To: test(a)localhost.localdomain Received: by localhost.localdomain (Postfix, from userid 0) id 3629F4336A; Wed, 27 May 2015 11:34:39 +0900 (JST) Date: Wed, 27 May 2015 11:34:39 +0900 To: test(a)localhost.localdomain Subject: test mail User-Agent: Heirloom mailx 12.4 7/29/08 MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-Id: <20150527023439.3629F4336A(a)localhost.localdomain> From: root(a)localhost.localdomain (root) test . UIDL +OK 1 0000000155652c77 Thanks, Masaharu Kawada

1 0

Re: FREAK/Logjam, and SSL protocols to use
by Jacques Distler 27 May '15

27 May '15

> For a given computational effort, you get the most bang-for-the-buck by > choosing large parameters (and checking very carefully that they are > "safe") rather than smaller parameters (and/or checking them less > carefully) which you then regenerate. This discussion (on the OpenSSH mailing list) http://marc.info/?t=143221614200001 may be helpful to those thinking about this.

1 0

Re: FREAK/Logjam, and SSL protocols to use
by Jacques Distler 27 May '15

27 May '15

>But when you write NOT to regenerate, are you saying that using larger primes makes regenerating unnecessary, or are you telling us that it's somehow harmful? For a given computational effort, you get the most bang-for-the-buck by choosing large parameters (and checking very carefully that they are "safe") rather than smaller parameters (and/or checking them less carefully) which you then regenerate. Every time you regenerate, there's a small (but finite) probability that the new parameters are actually unsafe. You'd do better using those CPU cycles to improve the proof that your original set of parameters was safe (admittedly, no one actually does this), rather than generating a new set. Remember, the DH parameters (p,g) are NOT secret; they are transmitted in the clear everytime. As long as you're using Ephemeral Diffie-Hellman (choosing new exponents, a and b, for each session) with large safe DH parameters, it's hard to think of a threat model where you improve the security AT ALL by regenerating the DH parameters.

1 0

Re: FREAK/Logjam, and SSL protocols to use
by Jacques Distler 27 May '15

27 May '15

>It is not at this point emphasized anywhere, including on weakdh.org, that it is actually of high importance to regenerate your DH parameters frequently. That's not really correct. If you're using a prime of length at least 2048 bits, then the corresponding discrete-log problem is well-beyond the pre-computation ability of the NSA (or anyone else). It is computationally intensive to generate such large primes, p (and corresponding base parameter, g). You need to ensure that p is actually prime (the costly step [1]) and that g is primitive. Which is why most implementations have used shorter (<= 1024 bit) primes. Using shorter primes, and regenerating DH parameters at regular intervals, is only a linear-time improvement. By contrast, generating longer DH parameters (without bothering to regenerate) is an EXPONENTIAL improvement in security. So the best setting is to set ssl_dh_parameters_length as large as feasible ([2] recommends 2048 bits), and NOT to regenerate. [1] http://en.wikipedia.org/wiki/Miller%E2%80%93Rabin_primality_test [2] https://weakdh.org/sysadmin.html

2 1

FREAK/Logjam, and SSL protocols to use
by Ron Leach 27 May '15

27 May '15

List, good afternoon, I was reading up on a TLS Diffie Hellman protocol weakness described here https://weakdh.org/sysadmin.html which is similar to the earlier FREAK attack, and can result in downgrade of cipher suites. Part of the solution workaround that the researchers describe for Dovecot here https://weakdh.org/sysadmin.html includes altering DH parameters length to 2048, and re-specifying the allowable cipher suites - they give their suggestion. But the researchers make no comment on the allowable protocols that, in Dovecot, are controlled in 10-ssl.conf in the stanza headed # SSL protocols to use #ssl_protocols = !SSLv2 I couldn't find any advice on up-to-date SSL/TLS protocol settings in the Dovecot wiki, either (I looked in http://wiki2.dovecot.org/SSL/DovecotConfiguration ). At the moment our installation is using only the default settings for allowed protocols; I'm not sure what those defaults might be, but our 10-ssl.conf may only be disallowing SSLv2, if the 'example' entry is the default. We're running 2.2.15, and are due to upgrade to 2.2.18 shortly; quite possibly the defaults differ in a more recent release. What SSL protocols do folk on the list recommend should be allowed in Dovecot these days? (Actually, I mean which protocols really 'must' be disallowed?) regards, Ron

5 10

/etc/ssl/certs/dovecot.pem erased by OpenSuse's update mechanism
by Wolfgang Gross 27 May '15

27 May '15

Hi, this is not a genuine Dovecot bug, more a nuisance. It applies to OpenSuse 13.2 but maybe also to other Linux's. The standard installation of Dovecot (especially 10-ssl.conf) places the certificate dovecot.pem in /etc/ssl/certs. Sometimes during updates does OpenSuse renew all certificates in /etc/ssl/certs and erases dovecot.pem. This blocks further access to the mailbox. I found a similar report here: https://bbs.archlinux.de/viewtopic.php?id=27288 Workaround: Move dovecot.pem to another directory and change 10-ssl.conf accordingly. Regards Wolfgang Gross -- Dr. W. Gross Sektion Chirurgische Forschung Klinik für Allgemein-, Viszeral- und Transplantationschirurgie Universitätsklinikum Heidelberg Im Neuenheimer Feld 365, D-69120 Heidelberg, Germany Tel. ++49 (0)6221/566392, Fax: ++49 (0)6221/566402 WGross(a)uni-hd.de

3 3

Can email be shared between POP3 and shell account access?
by Steve Matzura 26 May '15

26 May '15

I needed to receive a message to admin(a)mydomain.com. I waited and waited for it, but it never showed up in the admin mailbox on the mydomain.com machine. So I looked for the admin account in /etc/dovecot.passwd, and there it was, plain-text password and all! I set up a retrieval system for the admin POP3 account and got all the messages I was waiting for, not to mention about 20 that I wasn't, which were obviously old and discardable. This got me to thinking, is it possible to have an account accessible not just via POP3 from the ouside, but through mail/mailx on the inside, and if so, how is that set up?

3 3

sieve: extract first chars of body in sieve script
by Ingo Thierack 26 May '15

26 May '15

Hello, is it possible to extract the first x chars of the body of an message to forward it, or the complete body inside an sieve script. I want to forward specific mails via telegram-messenger. No Problem to extract the "from" and the "subject". if header :matches "Subject" "*" { set "subject" "${1}"; } if header :matches "from" "*" { set "from" "${1}"; } pipe :copy :try "notify.sh" [ "(${from})# ${subject}" ]; But is it also possible for the body? If I can only pass the complete body, I can cut out the first x chars inside the notify-script. Can't find any hint for that. Regards Ingo

2 1

Segfault on "doveadm sync -u <an-specific-user> tcp:<other-node-ip>:port"
by Listas＠Adminlinux 26 May '15

26 May '15

Hi! When I run "doveadm sync -u <an-specific-user> tcp:192.168.0.2:12345", I get this error: http://pastebin.com/NxyyNGJk Only to one specific user... I've tried to repair with "doveadm force-resync", unsuccessfully. Is this known? Ubuntu14.04 + Dovecot-2.2.15. My doveconf -n: http://pastebin.com/25sURwJL Thanks! -- Thiago Henrique

1 0

Typo in systemd commit HG 8dc79a437858
by Thomas Leuxner 25 May '15

25 May '15

The apostrophes need to be removed from the LimitCORE example, otherwise the parameter will not be recognized: $ cat /etc/systemd/system/dovecot.service.d/service.conf [Service] #Environment='OPTIONS=-p' #LimitCORE=8192 LimitCORE=infinity

3 4