- dovecot - dovecot.org

director: pass different username to proxy than the one that is used for hashing
by alex 12 Jan '23

12 Jan '23

dovecot 2.3.13 Hi, I'm looking for a way to make director use a user@domain that is returned by the database for hashing but actually send the original user@domain in the proxied request. I cannot seem to find a way. I can change the name used for hashing by just returning a different user from the db. but that user is also the one that is send in the proxied request. this is what I have so far: director_username_hash = %L{user} # relevant sql: password_query = SELECT \ username as user, \ # -> this is used for hashing if destuser is not present. = OK NULL as password, \ 'y' as proxy, \ 'y' as nopassword, \ '%n@%d' as destuser \ # -> but as soon as I add this, this is used for hashing = !OK FROM dovecot_data('%n', '%d') Anyone know any clever tricks to accomplish this? Thanks! Alex (background: I've inherited a mail setup where mailboxes have multiple logins. (those all share the same 'home' for their maildirs). I need all of these to go to the same server. Most ideal would be hashing on home '%h' instead of %u :)).

1 0

Living without fdpass / SCM_RIGHTS
by Dengler, Gabriel 10 Jan '23

10 Jan '23

Hello everyone, I wanted to run Dovecot inside Gramine [1]. Gramine is a tool to let normal Linux binaries run with the help of the Intel Software Guard Extensions (SGX) technology [2] in a secure enclave to which the operating system doesn't have an access to. Most parts of Dovecot now run fine, however, Dovecot uses the SCM_RIGHTS flag for the sendmsg system call to exchange file descriptors over Unix sockets [3]. Normally, this feature is available in every Unix, but in Gramine, this is currently not supported [4]. So, according to the logs, the authentication works, but after that, the imap-login process cannot exchange the file descriptor with the imap process. Therefore I wanted to ask if there is a possibility to make Dovecot work without this feature or if this would need fundamental changes in the code structure. Thanks for your help in advance! Best regards, Gabriel References: [1] https://gramineproject.io/ [2] https://de.wikipedia.org/wiki/Software_Guard_Extensions [3] https://github.com/dovecot/core/blob/main/src/lib/fdpass.c#L128 [4] https://github.com/gramineproject/gramine/discussions/1013#discussioncommen…

1 0

Dovecot - mail_crypt - lmtp-server - no password to decrypt the key
by Baljeet Bhinder 09 Jan '23

09 Jan '23

I have been using postfix+dovecot successfully for a while now until I tried mail crypt plugin lately. I tried what is describe here https://doc.dovecot.org/configuration_manual/mail_crypt_plugin/ and I went for global-keys as described here: https://doc.dovecot.org/configuration_manual/mail_crypt_plugin/#global-keys /"A good solution for environments where no user folder sharing is needed is to generate per-user EC key pair and encrypt that with something derived from user’s password."/ I am setting mail_crypt_global_private_key, mail_crypt_global_public_key, mail_crypt_save_version from user_query and userdb_mail_crypt_global_private_key_password from password_query. mail_crypt seems to work fine in imap (I saved a message as draft and it is stored encrypted on the disk), but lmtp complains about "mail_crypt_global_private_key_password unset, no password to decrypt the key" As you can see below in logs that it was able to set all other mail_crypt_ configurations successfully from user_query. However, the password is provided via password_query and I assume lmtp does not read password_query. How else can I provide a password in lmtp? Is my approach correct to begin with? -- Dovecot Configurations -- # using doveconf -n # 2.3.19.1 (9b53102964): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.19 (4eae2f79) # OS: Linux 5.15.0-57-generic x86_64 Ubuntu 20.04.5 LTS # Hostname: mailserver-dovecot-7c9ff7b94b-8ldrr auth_mechanisms = plain login auth_verbose = yes auth_verbose_passwords = yes debug_log_path = /dev/stdout haproxy_trusted_networks = 192.168.0.0/16 10.10.10.0/24 10.10.30.0/24 172.17.0.1/16 hostname = imap.mailserver.k8s.local pop.mailserver.k8s.local info_log_path = /dev/stdout listen = * log_path = /dev/stdout mail_debug = yes mail_gid = 1000 mail_home = /var/vmail/mailboxes/%d/%n mail_location = maildir:~/:LAYOUT=fs mail_plugins = quota mail_crypt mail_privileged_group = mail mail_uid = 1000 managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext imapsieve vnd.dovecot.imapsieve namespace inbox { inbox = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Spam { auto = subscribe autoexpunge = 30 days special_use = \Junk } mailbox Trash { auto = subscribe autoexpunge = 30 days special_use = \Trash } prefix = } passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } plugin { imapsieve_mailbox1_before = file:/var/vmail/sieve/global/learn-spam.sieve imapsieve_mailbox1_causes = COPY APPEND FLAG imapsieve_mailbox1_name = Spam imapsieve_mailbox2_before = file:/var/vmail/sieve/global/learn-ham.sieve imapsieve_mailbox2_causes = COPY APPEND FLAG imapsieve_mailbox2_from = Spam imapsieve_mailbox2_name = * mail_crypt_save_version = 0 quota = maildir:User quota quota_exceeded_message = User %u has exhausted allowed storage space. quota_rule = Junk:ignore quota_rule2 = Trash:storage=+100M quota_warning = storage=90%% quota-warning 90 %u %d quota_warning2 = storage=80%% quota-warning 80 %u %d sieve = file:~/sieve;active=~/.dovecot.sieve sieve_before = /var/vmail/sieve/global/spam-global.sieve sieve_global = /var/vmail/sieve/global/ sieve_global_extensions = +vnd.dovecot.pipe +vnd.dovecot.debug sieve_pipe_bin_dir = /var/vmail/sieve/global sieve_plugins = sieve_imapsieve sieve_extprograms } protocols = " imap lmtp sieve pop3" service auth { inet_listener { port = 25252 } } service imap-login { inet_listener imap { haproxy = yes } inet_listener imaps { haproxy = yes ssl = yes } } service lmtp { executable = lmtp -L inet_listener lmtp { address = 0.0.0.0 port = 24 } } service managesieve-login { inet_listener sieve { port = 4190 } } service pop3-login { inet_listener pop3 { haproxy = yes } inet_listener pop3s { haproxy = yes } } ssl = required ssl_cert = </etc/dovecot/certs/tls.crt ssl_client_ca_dir = /etc/ssl/certs ssl_key = # hidden, use -P to show it ssl_prefer_server_ciphers = yes userdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } protocol lmtp { info_log_path = /dev/stdout log_path = /dev/stdout mail_plugins = quota mail_crypt sieve postmaster_address = <hidden> } protocol imap { mail_plugins = quota mail_crypt quota imap_quota imap_sieve } -- Dovecot Configurations Ends -- -- Password Query -- password_query = \ SELECT username, domain, password, \ '%{sha256:password}' AS userdb_mail_crypt_global_private_key_password \ FROM mailbox \ WHERE username='%u'; -- Password Query Ends-- -- User Query -- user_query = SELECT CONCAT('*:bytes=', 1024) as quota_rule, \ private_key AS mail_crypt_global_private_key, \ public_key AS mail_crypt_global_public_key, \ mail_crypt_save_version AS mail_crypt_save_version \ FROM mailbox \ WHERE username='%u'; -- User Query Ends -- -- Debug Logs -- --- Load Inbox --- imap-login: Info: Login: user=<someone(a)example.com>, method=PLAIN, rip=192.168.49.1, lip=192.168.49.2, mpid=241, TLS, session=<oaoI9sLxVKXAqDEB> imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: Loading modules from directory: /usr/lib/dovecot/modules imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: Module loaded: /usr/lib/dovecot/modules/lib10_mail_crypt_plugin.so imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: Module loaded: /usr/lib/dovecot/modules/lib10_quota_plugin.so imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: Module loaded: /usr/lib/dovecot/modules/lib11_imap_quota_plugin.so imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: Module loaded: /usr/lib/dovecot/modules/lib95_imap_sieve_plugin.so imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: Added userdb setting: plugin/mail_crypt_global_private_key=LS0tLS1CRUd.....LS0tLS0K imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: Added userdb setting: plugin/mail_crypt_global_private_key_password=<hidden> imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: Added userdb setting: plugin/mail_crypt_global_public_key=LS0tLS1CRUd.....LS0tCg== imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: Added userdb setting: plugin/mail_crypt_save_version=2 imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: Added userdb setting: plugin/quota_rule=*:bytes=1024000000 imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: Effective uid=1000, gid=1000, home=/var/vmail/mailboxes/example.com/someone imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: mail_crypt_plugin: mail_crypt_curve setting missing - generating EC keys disabled imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: Quota root: name=User quota backend=maildir args= imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: Quota rule: root=User quota mailbox=* bytes=1024000000 messages=0 imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: Quota rule: root=User quota mailbox=Trash bytes=+104857600 messages=0 imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: Quota warning: bytes=921600000 (90%) messages=0 reverse=no command=quota-warning 90 someone(a)example.com example.com imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: Quota warning: bytes=819200000 (80%) messages=0 reverse=no command=quota-warning 80 someone(a)example.com example.com imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: Quota grace: root=User quota bytes=102400000 (10%) imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: open(/proc/self/io) failed: Permission denied imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: Namespace inbox: type=private, prefix=, sep=, inbox=yes, hidden=no, list=yes, subscriptions=yes location=maildir:~/:LAYOUT=fs imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: fs: root=/var/vmail/mailboxes/example.com/someone, index=, indexpvt=, control=, inbox=/var/vmail/mailboxes/example.com/someone, alt= imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: quota: quota_over_flag check: quota_over_script unset - skipping imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: Mailbox INBOX: Mailbox opened --- Load Inbox Ends --- --- Lmtp --- lmtp(248): Info: Connect from 172.17.0.1 lmtp(someone(a)example.com)<248><e2dcD6TuumP4AAAALzF/Qw>: Debug: auth-master: userdb lookup(someone(a)example.com): Started userdb lookup lmtp(someone(a)example.com)<248><e2dcD6TuumP4AAAALzF/Qw>: Debug: auth-master: conn unix:/var/run/dovecot/auth-userdb: Connecting lmtp(someone(a)example.com)<248><e2dcD6TuumP4AAAALzF/Qw>: Debug: auth-master: conn unix:/var/run/dovecot/auth-userdb (pid=143,uid=0): Client connected (fd=18) imap(someone(a)example.com)<247><WlggG8PxEOvAqDEB>: Debug: Mailbox Sent: Purging (new file_seq=1673195172): creating cache imap(someone(a)example.com)<247><WlggG8PxEOvAqDEB>: Debug: Mailbox Sent: Purging finished, file_seq changed 0 -> 1673195172, size=0 -> 388, max_uid=0 lmtp(someone(a)example.com)<248><e2dcD6TuumP4AAAALzF/Qw>: Debug: auth-master: userdb lookup(someone(a)example.com): auth USER input: someone(a)example.com quota_rule=*:bytes=1024000000 mail_crypt_global_private_key=LS0tLS1CRUd.....LS0tLS0K mail_crypt_global_public_key=LS0tLS1CRUd.....LS0tCg== mail_crypt_save_version=2 lmtp(someone(a)example.com)<248><e2dcD6TuumP4AAAALzF/Qw>: Debug: auth-master: userdb lookup(someone(a)example.com): Finished userdb lookup (username=someone(a)example.com quota_rule=*:bytes=1024000000 mail_crypt_global_private_key=LS0tLS1CRUd.....LS0tLS0K mail_crypt_global_public_key=LS0tLS1CRUd.....LS0tCg== mail_crypt_save_version=2) lmtp(someone(a)example.com)<248><e2dcD6TuumP4AAAALzF/Qw>: Debug: lmtp-server: conn 172.17.0.1:6376 [1]: rcpt someone(a)example.com: Added userdb setting: plugin/mail_crypt_global_private_key=LS0tLS1CRUd.....LS0tLS0K imap(someone(a)example.com)<247><WlggG8PxEOvAqDEB>: Debug: duplicate db: Initialize lmtp(someone(a)example.com)<248><e2dcD6TuumP4AAAALzF/Qw>: Debug: lmtp-server: conn 172.17.0.1:6376 [1]: rcpt someone(a)example.com: Added userdb setting: plugin/mail_crypt_global_public_key=LS0tLS1CRUd.....LS0tCg== imap(someone(a)example.com)<247><WlggG8PxEOvAqDEB>: Debug: sieve: Pigeonhole version 0.5.19 (4eae2f79) initializing lmtp(someone(a)example.com)<248><e2dcD6TuumP4AAAALzF/Qw>: Debug: lmtp-server: conn 172.17.0.1:6376 [1]: rcpt someone(a)example.com: Added userdb setting: plugin/mail_crypt_save_version=2 lmtp(someone(a)example.com)<248><e2dcD6TuumP4AAAALzF/Qw>: Debug: lmtp-server: conn 172.17.0.1:6376 [1]: rcpt someone(a)example.com: Added userdb setting: plugin/quota_rule=*:bytes=1024000000 lmtp(someone(a)example.com)<248><e2dcD6TuumP4AAAALzF/Qw>: Debug: lmtp-server: conn 172.17.0.1:6376 [1]: rcpt someone(a)example.com: Effective uid=1000, gid=1000, home=/var/vmail/mailboxes/example.com/someone lmtp(someone(a)example.com)<248><e2dcD6TuumP4AAAALzF/Qw>: Debug: lmtp-server: conn 172.17.0.1:6376 [1]: rcpt someone(a)example.com: mail_crypt_plugin: mail_crypt_curve setting missing - generating EC keys disabled lmtp(someone(a)example.com)<248><e2dcD6TuumP4AAAALzF/Qw>: Debug: lmtp-server: conn 172.17.0.1:6376 [1]: rcpt someone(a)example.com: Quota root: name=User quota backend=maildir args= lmtp(someone(a)example.com)<248><e2dcD6TuumP4AAAALzF/Qw>: Debug: lmtp-server: conn 172.17.0.1:6376 [1]: rcpt someone(a)example.com: Quota rule: root=User quota mailbox=* bytes=1024000000 messages=0 lmtp(someone(a)example.com)<248><e2dcD6TuumP4AAAALzF/Qw>: Debug: lmtp-server: conn 172.17.0.1:6376 [1]: rcpt someone(a)example.com: Quota rule: root=User quota mailbox=Trash bytes=+104857600 messages=0 lmtp(someone(a)example.com)<248><e2dcD6TuumP4AAAALzF/Qw>: Debug: lmtp-server: conn 172.17.0.1:6376 [1]: rcpt someone(a)example.com: Quota warning: bytes=921600000 (90%) messages=0 reverse=no command=quota-warning 90 someone(a)example.com example.com lmtp(someone(a)example.com)<248><e2dcD6TuumP4AAAALzF/Qw>: Debug: lmtp-server: conn 172.17.0.1:6376 [1]: rcpt someone(a)example.com: Quota warning: bytes=819200000 (80%) messages=0 reverse=no command=quota-warning 80 someone(a)example.com example.com lmtp(someone(a)example.com)<248><e2dcD6TuumP4AAAALzF/Qw>: Debug: lmtp-server: conn 172.17.0.1:6376 [1]: rcpt someone(a)example.com: Quota grace: root=User quota bytes=102400000 (10%) lmtp(248): Error: lmtp-server: conn 172.17.0.1:6376 [1]: rcpt someone(a)example.com: Failed to initialize user: mail_crypt_plugin: mail_crypt_global_private_key: mail_crypt_global_private_key_password unset, no password to decrypt the key lmtp(248): Info: Disconnect from 172.17.0.1: Logged out (state=READY) --- Lmtp Ends --- -- Debug Logs Ends -- Thanks Baljeet Bhinder

3 3

Keycloak Authorization Code Flow
by Gary Horchem 08 Jan '23

08 Jan '23

Can dovecot use Keycloak Authorization Code Flow? I would like to use it instead of Password Resource Grant Flow for better security. Sent from my iPhone

1 0

How to set otp one time password
by weihao.chen＠artisantechnologies.cn 07 Jan '23

07 Jan '23

Dear Everybody: May I ask how to configure dovecot otp one-time verification login, that is, after the user logs in to the mailbox with the password + otp, he can send and receive emails without entering the password + otp again? # This is my settings: # /etc/dovecot/conf.d/10-auth.conf disable_plaintext_auth = yes auth_cache_size = 10M auth_failure_delay = 5 secs auth_ssl_username_from_cert = yes auth_mechanisms = otp !include auth-ldap.conf.ext error logs: ------------------------------- 6952-Jan 06 18:03:01 master: Info: Dovecot v2.3.19.1 (9b53102964) starting up for imap, lmtp (core dumps disabled) 6953-Jan 06 18:03:02 auth: Debug: Loading modules from directory: /usr/lib/dovecot/auth 6954-Jan 06 18:03:02 auth: Debug: Module loaded: /usr/lib/dovecot/auth/lib20_auth_var_expand_crypt.so 6955:Jan 06 18:03:02 auth: Fatal: OTP mechanism can't be supported with given passdbs 6956-Jan 06 18:03:02 master: Error: service(auth): command startup failed, throttling for 2.000 secs 6957-Jan 06 18:03:02 imap-login: Info: Disconnected: Auth process broken (disconnected before auth was ready, waited 0 secs): user=<>, rip=172.30.20.51, lip=172.16.5.111, TLS handshaking, session=<OiDkhZXx7fasHhQz> 6958-Jan 06 18:03:07 auth: Debug: Loading modules from directory: /usr/lib/dovecot/auth 6959-Jan 06 18:03:07 auth: Debug: Module loaded: /usr/lib/dovecot/auth/lib20_auth_var_expand_crypt.so 6960:Jan 06 18:03:07 auth: Fatal: OTP mechanism can't be supported with given passdbs 6961-Jan 06 18:03:07 master: Error: service(auth): command startup failed, throttling for 4.000 secs 6962-Jan 06 18:03:07 imap-login: Info: Disconnected: Auth process broken (disconnected before auth was ready, waited 0 secs): user=<>, rip=172.30.20.51, lip=172.16.5.111, TLS handshaking, session=<qgIyhpXx8PasHhQz> 6963-Jan 06 18:03:11 auth: Debug: Loading modules from directory: /usr/lib/dovecot/auth 6964-Jan 06 18:03:11 auth: Debug: Module loaded: /usr/lib/dovecot/auth/lib20_auth_var_expand_crypt.so 6965:Jan 06 18:03:11 auth: Fatal: OTP mechanism can't be supported with given passdbs 6966-Jan 06 18:03:11 master: Error: service(auth): command startup failed, throttling for 8.000 secs 6967-Jan 06 18:03:11 imap-login: Info: Disconnected: Auth process broken (disconnected before auth was ready, waited 3 secs): user=<>, rip=172.30.20.51, lip=172.16.5.111, TLS, session=<gDdvhpXx8/asHhQz> 6968-Jan 06 18:03:19 auth: Debug: Loading modules from directory: /usr/lib/dovecot/auth 6969-Jan 06 18:03:19 auth: Debug: Module loaded: /usr/lib/dovecot/auth/lib20_auth_var_expand_crypt.so 6970:Jan 06 18:03:19 auth: Fatal: OTP mechanism can't be supported with given passdbs 6971-Jan 06 18:03:19 master: Error: service(auth): command startup failed, throttling for 16.000 secs 6972-Jan 06 18:03:19 imap-login: Info: Disconnected: Auth process broken (disconnected before auth was ready, waited 8 secs): user=<>, rip=172.30.20.51, lip=172.16.5.111, TLS, session=<qp7phpXx9PasHhQz> 6973-Jan 06 18:03:29 imap-login: Info: Disconnected: Connection closed (disconnected before auth was ready, waited 5 secs): user=<>, rip=172.30.20.51, lip=172.16.5.111, TLS, session=<N1qAh5Xx/PasHhQz> 6974-Jan 06 18:03:35 auth: Debug: Loading modules from directory: /usr/lib/dovecot/auth 6975-Jan 06 18:03:35 auth: Debug: Module loaded: /usr/lib/dovecot/auth/lib20_auth_var_expand_crypt.so 6976:Jan 06 18:03:35 auth: Fatal: OTP mechanism can't be supported with given passdbs 6977-Jan 06 18:03:35 master: Error: service(auth): command startup failed, throttling for 32.000 secs 6978-Jan 06 18:04:01 master: Warning: Killed with signal 15 (by pid=2692494 uid=0 code=kill) 6979-Jan 06 18:04:02 master: Info: Dovecot v2.3.19.1 (9b53102964) starting up for imap, lmtp (core dumps disabled) 6980-Jan 06 18:04:09 auth: Debug: Loading modules from directory: /usr/lib/dovecot/auth 6981-Jan 06 18:04:09 auth: Debug: Module loaded: /usr/lib/dovecot/auth/lib20_auth_var_expand_crypt.so 6982:Jan 06 18:04:09 auth: Fatal: OTP mechanism can't be supported with given passdbs 6983-Jan 06 18:04:09 master: Error: service(auth): command startup failed, throttling for 2.000 secs 6984-Jan 06 18:04:09 imap-login: Info: Disconnected: Auth process broken (disconnected before auth was ready, waited 0 secs): user=<>, rip=172.30.20.51, lip=172.16.5.111, TLS handshaking, session=<8VrsiZXxFfesHhQz> 6985-Jan 06 18:04:56 auth: Debug: Loading modules from directory: /usr/lib/dovecot/auth 6986-Jan 06 18:04:56 auth: Debug: Module loaded: /usr/lib/dovecot/auth/lib20_auth_var_expand_crypt.so 6987:Jan 06 18:04:56 auth: Fatal: OTP mechanism can't be supported with given passdbs 6988-Jan 06 18:04:56 master: Error: service(auth): command startup failed, throttling for 4.000 secs 6989-Jan 06 18:05:57 auth: Debug: Loading modules from directory: /usr/lib/dovecot/auth 6990-Jan 06 18:05:57 auth: Debug: Module loaded: /usr/lib/dovecot/auth/lib20_auth_var_expand_crypt.so 6991:Jan 06 18:05:57 auth: Fatal: OTP mechanism can't be supported with given passdbs 6992-Jan 06 18:05:57 master: Error: service(auth): command startup failed, throttling for 8.000 secs 6993-Jan 06 18:06:26 master: Warning: Killed with signal 15 (by pid=2692680 uid=0 code=kill) 6994-Jan 06 18:06:27 log(2692602): Warning: Killed with signal 15 (by pid=1 uid=0 code=kill) 6995-Jan 06 18:06:27 master: Info: Dovecot v2.3.19.1 (9b53102964) starting up for imap, lmtp (core dumps disabled) 6996-Jan 06 18:06:47 auth: Debug: Loading modules from directory: /usr/lib/dovecot/auth 6997-Jan 06 18:06:47 auth: Debug: Module loaded: /usr/lib/dovecot/auth/lib20_auth_var_expand_crypt.so 6998-Jan 06 18:06:47 auth: Debug: Read auth token secret from /var/run/dovecot//auth-token-secret.dat 6999-Jan 06 18:06:47 auth: Error: ldap_bind 7000-Jan 06 18:06:47 auth: Error: ldap_simple_bind 7001-Jan 06 18:06:47 auth: Error: ldap_sasl_bind ------------------------------- if option: auth_mechanisms = plain login Can send and receive emails successfully, but when the otp time expires, you need to re-enter the password + otp, which is unacceptable to the user Looking forward to your reply, Tanks -- nick(Weihao) weihao.chen(a)artisantechnologies.cn

2 1

postfix connects to dovecot lmtp socket, but nothing is delivered
by Gerben Wierda 05 Jan '23

05 Jan '23

I am setting up a new server combination (postfix + dovecot). dovecot's auth service works for postfix. Just lmtp does not and I need to find out why. I don't see anything in the dovecot logging, but I see this on the postfix side (debug) Jan 05 16:11:59 snape postfix/lmtp[127]: connection established Jan 05 16:11:59 snape postfix/lmtp[127]: master_notify: status 0 Jan 05 16:11:59 snape postfix/lmtp[127]: deliver_request_initial: send initial response Jan 05 16:11:59 snape postfix/lmtp[127]: send attr protocol = delivery_request_protocol Jan 05 16:16:59 snape postfix/lmtp[126]: smtp_get: timeout Jan 05 16:16:59 snape postfix/lmtp[126]: connect to subsystem private/defer Jan 05 16:16:59 snape postfix/lmtp[126]: private/defer socket: wanted attribute: protocol Jan 05 16:16:59 snape postfix/lmtp[126]: input attribute name: protocol Jan 05 16:16:59 snape postfix/lmtp[126]: input attribute value: delivery_status_protocol Jan 05 16:16:59 snape postfix/lmtp[126]: private/defer socket: wanted attribute: (list terminator) Jan 05 16:16:59 snape postfix/lmtp[126]: input attribute name: (end) Jan 05 16:16:59 snape postfix/lmtp[126]: send attr nrequest = 0 Jan 05 16:16:59 snape postfix/lmtp[126]: send attr flags = 0 Jan 05 16:16:59 snape postfix/lmtp[126]: send attr queue_id = C71B3D1262 Jan 05 16:16:59 snape postfix/lmtp[126]: send attr original_recipient = sysbh(a)rna.nl Jan 05 16:16:59 snape postfix/lmtp[126]: send attr recipient = sysbh(a)rna.nl Jan 05 16:16:59 snape postfix/lmtp[126]: send attr offset = 18446744073709551615 Jan 05 16:16:59 snape postfix/lmtp[126]: send attr dsn_orig_rcpt = rfc822;sysbh(a)rna.nl Jan 05 16:16:59 snape postfix/lmtp[126]: send attr notify_flags = 0 Jan 05 16:16:59 snape postfix/lmtp[126]: send attr status = 4.4.2 Jan 05 16:16:59 snape postfix/lmtp[126]: send attr diag_type = Jan 05 16:16:59 snape postfix/lmtp[126]: send attr diag_text = Jan 05 16:16:59 snape postfix/lmtp[126]: send attr mta_type = Jan 05 16:16:59 snape postfix/lmtp[126]: send attr mta_mname = Jan 05 16:16:59 snape postfix/lmtp[126]: send attr action = delayed Jan 05 16:16:59 snape postfix/lmtp[126]: send attr reason = conversation with snape.rna.nl[private/lmtp] timed out while receiving the initial server greeting Jan 05 16:16:59 snape postfix/lmtp[126]: private/defer socket: wanted attribute: status Jan 05 16:16:59 snape postfix/lmtp[126]: input attribute name: status Jan 05 16:16:59 snape postfix/lmtp[126]: input attribute value: 0 Jan 05 16:16:59 snape postfix/lmtp[126]: private/defer socket: wanted attribute: (list terminator) Jan 05 16:16:59 snape postfix/lmtp[126]: input attribute name: (end) Jan 05 16:16:59 snape postfix/lmtp[126]: C71B3D1262: to=<sysbh(a)rna.nl>, relay=snape.rna.nl[private/lmtp], delay=300, delays=0.02/0/300/0, dsn=4.4.2, status=deferred (conversation with snape.rna.nl[private/lmtp] timed out while receiving the initial server greeting) Jan 05 16:16:59 snape postfix/lmtp[126]: flush_add: site rna.nl id C71B3D1262 Jan 05 16:16:59 snape postfix/lmtp[126]: match_list_match: rna.nl: no match Jan 05 16:16:59 snape postfix/lmtp[126]: flush_add: site rna.nl id C71B3D1262 status 4 Jan 05 16:16:59 snape postfix/lmtp[126]: deliver_request_final: send: "conversation with snape.rna.nl[private/lmtp] timed out while receiving the initial server greeting" -1 Jan 05 16:16:59 snape postfix/lmtp[126]: send attr status = 4.4.2 Jan 05 16:16:59 snape postfix/lmtp[126]: send attr diag_type = Jan 05 16:16:59 snape postfix/lmtp[126]: send attr diag_text = Jan 05 16:16:59 snape postfix/lmtp[126]: send attr mta_type = Jan 05 16:16:59 snape postfix/lmtp[127]: master_notify: status 1 Jan 05 16:16:59 snape postfix/lmtp[126]: send attr mta_mname = Jan 05 16:16:59 snape postfix/lmtp[127]: connection closed Jan 05 16:16:59 snape postfix/lmtp[126]: send attr action = Jan 05 16:16:59 snape postfix/lmtp[126]: send attr reason = conversation with snape.rna.nl[private/lmtp] timed out while receiving the initial server greeting Jan 05 16:16:59 snape postfix/lmtp[126]: send attr status = 4294967295 Jan 05 16:16:59 snape postfix/lmtp[126]: master_notify: status 1 Jan 05 16:16:59 snape postfix/lmtp[126]: connection closed It seems dovecot doesn't react to whatever postfix is doing on the socket. Another possibility is that the socket doesn't really work and dovecot never gets a connection request. How can I debug this? Might I test if the socket is the problem by running lmtp on the dovecot side on TCP on 127.0.0.1 and have postfix use that? Just to see if it works? If so, how do I tell postfix to do that? In dovecot I have added the tcp: service lmtp { inet_listener lmtp { address = 127.0.0.1 port = 24 } unix_listener /var/spool/postfix/private/lmtp { mode = 0660 user = postfix group = postfix } } service lmtp { executable = lmtp -L } protocol lmtp { info_log_path = /var/log/mail/dovecot-lmtp.log } Any other tips? Gerben Wierda (LinkedIn <https://www.linkedin.com/in/gerbenwierda>) R&A IT Strategy <https://ea.rna.nl/> (main site) Book: Chess and the Art of Enterprise Architecture <https://ea.rna.nl/the-book/> Book: Mastering ArchiMate <https://ea.rna.nl/the-book-edition-iii/>

4 8

Migrating, syncing, maybe load-balancing/failover two dovecot servers?
by Gerben Wierda 05 Jan '23

05 Jan '23

I am in the process of migrating from dovecot on one OS (macOS/darwin) to a new server running dovecot with another OS (Ubuntu Linux 22.4). I have mostly copied/adapted the setup of the old server to the new. I am in the process of finishing that and adding some stuff that still needs to be added/migrated, like rspamd. And the data of course before the new one takes over from the old. I have done a migration before (MacOS X Server dovecot to MacPorts dovecot on macOS), many years ago, I recall that I used dovecot syncing but also rsync and I don't really recall (and anyway, the software has changed since) I have been thinking about keeping them both alive, with one as a failover for the other. They will not share their storage (e.g. NFS), So, I was wondering if I can do something with syncing between instances and dovecot director. I have been looking at the documentation, but a quick scan reveals I cannot locate some sort of tutorial and I am uncertain what will work and what not. If keeping both alive in parallel is too problematic, it is OK to have regular syncing in one direction (old to new) at first and then switch over and have syncing in the other direction (new to old) Can someone enlighten me? Gerben Wierda (LinkedIn <https://www.linkedin.com/in/gerbenwierda>) R&A IT Strategy <https://ea.rna.nl/> (main site) Book: Chess and the Art of Enterprise Architecture <https://ea.rna.nl/the-book/> Book: Mastering ArchiMate <https://ea.rna.nl/the-book-edition-iii/>

4 5

imap and lmtp create different index/control folders
by George Asenov 05 Jan '23

05 Jan '23

Hello, We have migrated our mail server from procmail lda to dovecot lmtp/sieve . dovecot imap create the dir with the email account test(a)s32.teststring.ml for name but lmtp create it as test-s32.someteststring.ml(a)serverhostname.tld I can't figure out how to manipulate nor what username postfix send to dovecot/lmtp or how dovecot/lmtp interpret it. As you will see in the config below there is a separate userdb set for lmtp because it receive the username/envelope from postfix as test-s32.someteststring.ml(a)serverhostname.tld which prevent it to use the pam authentication to verify and use the mail user to deliver email. So I use driver = passwd-file which have the option to configure the format of the username. But this is kind of dirty hack which i do not like. Anyone now how to configure dovecot/lmtp by default to remove the @myserverhostname.tld from the username or configure postfix not to add it? Here is the postfix config: ############################# postconf 2bounce_notice_recipient = postmaster access_map_defer_code = 450 access_map_reject_code = 554 address_verify_cache_cleanup_interval = 12h address_verify_default_transport = $default_transport address_verify_local_transport = $local_transport address_verify_map = btree:$data_directory/verify_cache address_verify_negative_cache = yes address_verify_negative_expire_time = 3d address_verify_negative_refresh_time = 3h address_verify_pending_request_limit = 5000 address_verify_poll_count = ${stress?{1}:{3}} address_verify_poll_delay = 3s address_verify_positive_expire_time = 31d address_verify_positive_refresh_time = 7d address_verify_relay_transport = $relay_transport address_verify_relayhost = $relayhost address_verify_sender = $double_bounce_sender address_verify_sender_dependent_default_transport_maps = $sender_dependent_default_transport_maps address_verify_sender_dependent_relayhost_maps = $sender_dependent_relayhost_maps address_verify_sender_ttl = 0s address_verify_service_name = verify address_verify_transport_maps = $transport_maps address_verify_virtual_transport = $virtual_transport alias_database = hash:/etc/aliases alias_maps = hash:/etc/aliases allow_mail_to_commands = alias, forward allow_mail_to_files = alias, forward allow_min_user = no allow_percent_hack = no allow_untrusted_routing = no alternate_config_directories = always_add_missing_headers = no always_bcc = anvil_rate_time_unit = 60s anvil_status_update_time = 600s append_at_myorigin = yes append_dot_mydomain = ${{$compatibility_level} < {1} ? {yes} : {no}} application_event_drain_time = 100s authorized_flush_users = static:anyone authorized_mailq_users = static:anyone authorized_submit_users = static:anyone backwards_bounce_logfile_compatibility = yes berkeley_db_create_buffer_size = 16777216 berkeley_db_read_buffer_size = 131072 best_mx_transport = biff = yes body_checks = body_checks_size_limit = 51200 bounce_notice_recipient = postmaster bounce_queue_lifetime = 5d bounce_service_name = bounce bounce_size_limit = 50000 bounce_template_file = broken_sasl_auth_clients = yes canonical_classes = envelope_sender, envelope_recipient, header_sender, header_recipient canonical_maps = cleanup_service_name = cleanup command_directory = /usr/sbin command_execution_directory = command_expansion_filter = 1234567890!@%-_=+:,./abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ command_time_limit = 1000s compatibility_level = 2 config_directory = /etc/postfix confirm_delay_cleared = no connection_cache_protocol_timeout = 5s connection_cache_service_name = scache connection_cache_status_update_time = 600s connection_cache_ttl_limit = 2s content_filter = cyrus_sasl_config_path = daemon_directory = /usr/libexec/postfix daemon_table_open_error_is_fatal = no daemon_timeout = 18000s data_directory = /var/lib/postfix debug_peer_level = 2 debug_peer_list = debugger_command = PATH=/bin:/usr/bin:/usr/local/bin:/usr/X11R6/bin ddd $daemon_directory/$process_name $process_id & sleep 5 default_database_type = hash default_delivery_slot_cost = 5 default_delivery_slot_discount = 50 default_delivery_slot_loan = 3 default_delivery_status_filter = default_destination_concurrency_failed_cohort_limit = 1 default_destination_concurrency_limit = 20 default_destination_concurrency_negative_feedback = 1 default_destination_concurrency_positive_feedback = 1 default_destination_rate_delay = 0s default_destination_recipient_limit = 50 default_extra_recipient_limit = 1000 default_filter_nexthop = default_minimum_delivery_slots = 3 default_privs = nobody default_process_limit = 100 default_rbl_reply = $rbl_code Service unavailable; $rbl_class [$rbl_what] blocked using $rbl_domain${rbl_reason?; $rbl_reason} default_recipient_limit = 20000 default_recipient_refill_delay = 5s default_recipient_refill_limit = 100 default_transport = smtp default_transport_rate_delay = 0s default_verp_delimiters = += defer_code = 450 defer_service_name = defer defer_transports = delay_logging_resolution_limit = 2 delay_notice_recipient = postmaster delay_warning_time = 0h deliver_lock_attempts = 20 deliver_lock_delay = 1s destination_concurrency_feedback_debug = no detect_8bit_encoding_header = yes disable_dns_lookups = no disable_mime_input_processing = no disable_mime_output_conversion = no disable_verp_bounces = no disable_vrfy_command = yes dns_ncache_ttl_fix_enable = no dnsblog_reply_delay = 0s dnsblog_service_name = dnsblog dont_remove = 0 double_bounce_sender = double-bounce duplicate_filter_limit = 1000 empty_address_default_transport_maps_lookup_key = <> empty_address_recipient = MAILER-DAEMON empty_address_relayhost_maps_lookup_key = <> enable_idna2003_compatibility = no enable_long_queue_ids = no enable_original_recipient = yes error_delivery_slot_cost = $default_delivery_slot_cost error_delivery_slot_discount = $default_delivery_slot_discount error_delivery_slot_loan = $default_delivery_slot_loan error_destination_concurrency_failed_cohort_limit = $default_destination_concurrency_failed_cohort_limit error_destination_concurrency_limit = $default_destination_concurrency_limit error_destination_concurrency_negative_feedback = $default_destination_concurrency_negative_feedback error_destination_concurrency_positive_feedback = $default_destination_concurrency_positive_feedback error_destination_rate_delay = $default_destination_rate_delay error_destination_recipient_limit = $default_destination_recipient_limit error_extra_recipient_limit = $default_extra_recipient_limit error_initial_destination_concurrency = $initial_destination_concurrency error_minimum_delivery_slots = $default_minimum_delivery_slots error_notice_recipient = postmaster error_recipient_limit = $default_recipient_limit error_recipient_refill_delay = $default_recipient_refill_delay error_recipient_refill_limit = $default_recipient_refill_limit error_service_name = error error_transport_rate_delay = $default_transport_rate_delay execution_directory_expansion_filter = 1234567890!@%-_=+:,./abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ expand_owner_alias = no export_environment = TZ MAIL_CONFIG LANG fallback_transport = fallback_transport_maps = fast_flush_domains = $relay_domains fast_flush_purge_time = 7d fast_flush_refresh_time = 12h fault_injection_code = 0 flush_service_name = flush fork_attempts = 5 fork_delay = 1s forward_expansion_filter = 1234567890!@%-_=+:,./abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ forward_path = $home/.forward${recipient_delimiter}${extension}, $home/.forward frozen_delivered_to = yes hash_queue_depth = 1 hash_queue_names = deferred, defer header_address_token_limit = 10240 header_checks = header_from_format = standard header_size_limit = 102400 helpful_warnings = yes home_mailbox = Maildir/ hopcount_limit = 50 html_directory = no ignore_mx_lookup_error = no import_environment = MAIL_CONFIG MAIL_DEBUG MAIL_LOGTAG TZ XAUTHORITY DISPLAY LANG=C POSTLOG_SERVICE POSTLOG_HOSTNAME in_flow_delay = 1s inet_interfaces = all inet_protocols = ipv4 info_log_address_format = internal initial_destination_concurrency = 5 internal_mail_filter_classes = invalid_hostname_reject_code = 501 ipc_idle = 5s ipc_timeout = 3600s ipc_ttl = 1000s line_length_limit = 2048 lmdb_map_size = 16777216 lmtp_address_preference = any lmtp_address_verify_target = rcpt lmtp_assume_final = no lmtp_balance_inet_protocols = yes lmtp_bind_address = lmtp_bind_address6 = lmtp_body_checks = lmtp_cname_overrides_servername = no lmtp_connect_timeout = 0s lmtp_connection_cache_destinations = lmtp_connection_cache_on_demand = yes lmtp_connection_cache_time_limit = 2s lmtp_connection_reuse_count_limit = 0 lmtp_connection_reuse_time_limit = 300s lmtp_data_done_timeout = 600s lmtp_data_init_timeout = 120s lmtp_data_xfer_timeout = 180s lmtp_defer_if_no_mx_address_found = no lmtp_delivery_slot_cost = $default_delivery_slot_cost lmtp_delivery_slot_discount = $default_delivery_slot_discount lmtp_delivery_slot_loan = $default_delivery_slot_loan lmtp_delivery_status_filter = $default_delivery_status_filter lmtp_destination_concurrency_failed_cohort_limit = $default_destination_concurrency_failed_cohort_limit lmtp_destination_concurrency_limit = $default_destination_concurrency_limit lmtp_destination_concurrency_negative_feedback = $default_destination_concurrency_negative_feedback lmtp_destination_concurrency_positive_feedback = $default_destination_concurrency_positive_feedback lmtp_destination_rate_delay = $default_destination_rate_delay lmtp_destination_recipient_limit = $default_destination_recipient_limit lmtp_discard_lhlo_keyword_address_maps = lmtp_discard_lhlo_keywords = lmtp_dns_reply_filter = lmtp_dns_resolver_options = lmtp_dns_support_level = lmtp_enforce_tls = no lmtp_extra_recipient_limit = $default_extra_recipient_limit lmtp_fallback_relay = lmtp_generic_maps = lmtp_header_checks = lmtp_host_lookup = dns lmtp_initial_destination_concurrency = $initial_destination_concurrency lmtp_lhlo_name = $myhostname lmtp_lhlo_timeout = 300s lmtp_line_length_limit = 998 lmtp_mail_timeout = 300s lmtp_mime_header_checks = lmtp_minimum_delivery_slots = $default_minimum_delivery_slots lmtp_mx_address_limit = 5 lmtp_mx_session_limit = 2 lmtp_nested_header_checks = lmtp_per_record_deadline = no lmtp_pix_workaround_delay_time = 10s lmtp_pix_workaround_maps = lmtp_pix_workaround_threshold_time = 500s lmtp_pix_workarounds = disable_esmtp,delay_dotcrlf lmtp_quit_timeout = 300s lmtp_quote_rfc821_envelope = yes lmtp_randomize_addresses = yes lmtp_rcpt_timeout = 300s lmtp_recipient_limit = $default_recipient_limit lmtp_recipient_refill_delay = $default_recipient_refill_delay lmtp_recipient_refill_limit = $default_recipient_refill_limit lmtp_reply_filter = lmtp_rset_timeout = 20s lmtp_sasl_auth_cache_name = lmtp_sasl_auth_cache_time = 90d lmtp_sasl_auth_enable = no lmtp_sasl_auth_soft_bounce = yes lmtp_sasl_mechanism_filter = lmtp_sasl_password_maps = lmtp_sasl_path = lmtp_sasl_security_options = noplaintext, noanonymous lmtp_sasl_tls_security_options = $lmtp_sasl_security_options lmtp_sasl_tls_verified_security_options = $lmtp_sasl_tls_security_options lmtp_sasl_type = cyrus lmtp_send_dummy_mail_auth = no lmtp_send_xforward_command = no lmtp_sender_dependent_authentication = no lmtp_skip_5xx_greeting = yes lmtp_skip_quit_response = no lmtp_starttls_timeout = 300s lmtp_tcp_port = 24 lmtp_tls_CAfile = lmtp_tls_CApath = lmtp_tls_block_early_mail_reply = no lmtp_tls_cert_file = lmtp_tls_chain_files = lmtp_tls_ciphers = medium lmtp_tls_connection_reuse = no lmtp_tls_dcert_file = lmtp_tls_dkey_file = $lmtp_tls_dcert_file lmtp_tls_eccert_file = lmtp_tls_eckey_file = $lmtp_tls_eccert_file lmtp_tls_enforce_peername = yes lmtp_tls_exclude_ciphers = lmtp_tls_fingerprint_cert_match = lmtp_tls_fingerprint_digest = md5 lmtp_tls_force_insecure_host_tlsa_lookup = no lmtp_tls_key_file = $lmtp_tls_cert_file lmtp_tls_loglevel = 0 lmtp_tls_mandatory_ciphers = medium lmtp_tls_mandatory_exclude_ciphers = lmtp_tls_mandatory_protocols = !SSLv2, !SSLv3 lmtp_tls_note_starttls_offer = no lmtp_tls_per_site = lmtp_tls_policy_maps = lmtp_tls_protocols = !SSLv2, !SSLv3 lmtp_tls_scert_verifydepth = 9 lmtp_tls_secure_cert_match = nexthop lmtp_tls_security_level = lmtp_tls_servername = lmtp_tls_session_cache_database = lmtp_tls_session_cache_timeout = 3600s lmtp_tls_trust_anchor_file = lmtp_tls_verify_cert_match = hostname lmtp_tls_wrappermode = no lmtp_transport_rate_delay = $default_transport_rate_delay lmtp_use_tls = no lmtp_xforward_timeout = 300s local_command_shell = local_delivery_slot_cost = $default_delivery_slot_cost local_delivery_slot_discount = $default_delivery_slot_discount local_delivery_slot_loan = $default_delivery_slot_loan local_delivery_status_filter = $default_delivery_status_filter local_destination_concurrency_failed_cohort_limit = $default_destination_concurrency_failed_cohort_limit local_destination_concurrency_limit = 2 local_destination_concurrency_negative_feedback = $default_destination_concurrency_negative_feedback local_destination_concurrency_positive_feedback = $default_destination_concurrency_positive_feedback local_destination_rate_delay = $default_destination_rate_delay local_destination_recipient_limit = 1 local_extra_recipient_limit = $default_extra_recipient_limit local_header_rewrite_clients = "" local_initial_destination_concurrency = $initial_destination_concurrency local_minimum_delivery_slots = $default_minimum_delivery_slots local_recipient_limit = $default_recipient_limit local_recipient_maps = proxy:unix:passwd.byname $alias_maps local_recipient_refill_delay = $default_recipient_refill_delay local_recipient_refill_limit = $default_recipient_refill_limit local_transport = local:$myhostname local_transport_rate_delay = $default_transport_rate_delay luser_relay = mail_name = Postfix mail_owner = postfix mail_release_date = 20201107 mail_spool_directory = /var/mail mail_version = 3.5.8 mailbox_command = mailbox_command_maps = mailbox_delivery_lock = fcntl, dotlock mailbox_size_limit = 0 mailbox_transport = lmtp:unix:private/dovecot-lmtp mailbox_transport_maps = maillog_file = maillog_file_compressor = gzip maillog_file_prefixes = /var, /dev/stdout maillog_file_rotate_suffix = %Y%m%d-%H%M%S mailq_path = /usr/bin/mailq.postfix manpage_directory = /usr/share/man maps_rbl_domains = maps_rbl_reject_code = 554 masquerade_classes = envelope_sender, header_sender, header_recipient masquerade_domains = masquerade_exceptions = master_service_disable = max_idle = 100s max_use = 100 maximal_backoff_time = 4000s maximal_queue_lifetime = 1d message_drop_headers = bcc, content-length, resent-bcc, return-path message_reject_characters = message_size_limit = 32000000 message_strip_characters = meta_directory = /etc/postfix milter_command_timeout = 30s milter_connect_macros = j {daemon_name} {daemon_addr} v _ milter_connect_timeout = 30s milter_content_timeout = 300s milter_data_macros = i milter_default_action = accept milter_end_of_data_macros = i milter_end_of_header_macros = i milter_header_checks = milter_helo_macros = {tls_version} {cipher} {cipher_bits} {cert_subject} {cert_issuer} milter_macro_daemon_name = $myhostname milter_macro_defaults = milter_macro_v = $mail_name $mail_version milter_mail_macros = i {auth_type} {auth_authen} {auth_author} {mail_addr} {mail_host} {mail_mailer} milter_protocol = 6 milter_rcpt_macros = i {rcpt_addr} {rcpt_host} {rcpt_mailer} milter_unknown_command_macros = mime_boundary_length_limit = 2048 mime_header_checks = $header_checks mime_nesting_limit = 100 minimal_backoff_time = 300s multi_instance_directories = multi_instance_enable = no multi_instance_group = multi_instance_name = multi_instance_wrapper = multi_recipient_bounce_reject_code = 550 mydestination = $myhostname, localhost.$mydomain, localhost, localhost.localdomain mydomain = mydomain.tld myhostname = sub.mydomain.tld mynetworks = 127.0.0.1/32 mynetworks_style = ${{$compatibility_level} < {2} ? {subnet} : {host}} myorigin = $myhostname nested_header_checks = $header_checks newaliases_path = /usr/bin/newaliases.postfix non_fqdn_reject_code = 504 non_smtpd_milters = inet:rspamd.domain.tld:11332 notify_classes = resource, software openssl_path = openssl owner_request_special = yes parent_domain_matches_subdomains = debug_peer_list,fast_flush_domains,mynetworks,permit_mx_backup_networks,qmqpd_authorized_clients,relay_domains,smtpd_access_maps permit_mx_backup_networks = pickup_service_name = pickup pipe_delivery_status_filter = $default_delivery_status_filter plaintext_reject_code = 450 postlog_service_name = postlog postlogd_watchdog_timeout = 10s postmulti_control_commands = reload flush postmulti_start_commands = start postmulti_stop_commands = stop abort drain quick-stop postscreen_access_list = permit_mynetworks postscreen_bare_newline_action = ignore postscreen_bare_newline_enable = no postscreen_bare_newline_ttl = 30d postscreen_blacklist_action = ignore postscreen_cache_cleanup_interval = 12h postscreen_cache_map = btree:$data_directory/postscreen_cache postscreen_cache_retention_time = 7d postscreen_client_connection_count_limit = $smtpd_client_connection_count_limit postscreen_command_count_limit = 20 postscreen_command_filter = postscreen_command_time_limit = ${stress?{10}:{300}}s postscreen_disable_vrfy_command = $disable_vrfy_command postscreen_discard_ehlo_keyword_address_maps = $smtpd_discard_ehlo_keyword_address_maps postscreen_discard_ehlo_keywords = $smtpd_discard_ehlo_keywords postscreen_dnsbl_action = ignore postscreen_dnsbl_max_ttl = ${postscreen_dnsbl_ttl?{$postscreen_dnsbl_ttl}:{1}}h postscreen_dnsbl_min_ttl = 60s postscreen_dnsbl_reply_map = postscreen_dnsbl_sites = postscreen_dnsbl_threshold = 1 postscreen_dnsbl_timeout = 10s postscreen_dnsbl_whitelist_threshold = 0 postscreen_enforce_tls = $smtpd_enforce_tls postscreen_expansion_filter = $smtpd_expansion_filter postscreen_forbidden_commands = $smtpd_forbidden_commands postscreen_greet_action = ignore postscreen_greet_banner = $smtpd_banner postscreen_greet_ttl = 1d postscreen_greet_wait = ${stress?{2}:{6}}s postscreen_helo_required = $smtpd_helo_required postscreen_non_smtp_command_action = drop postscreen_non_smtp_command_enable = no postscreen_non_smtp_command_ttl = 30d postscreen_pipelining_action = enforce postscreen_pipelining_enable = no postscreen_pipelining_ttl = 30d postscreen_post_queue_limit = $default_process_limit postscreen_pre_queue_limit = $default_process_limit postscreen_reject_footer = $smtpd_reject_footer postscreen_reject_footer_maps = $smtpd_reject_footer_maps postscreen_tls_security_level = $smtpd_tls_security_level postscreen_upstream_proxy_protocol = postscreen_upstream_proxy_timeout = 5s postscreen_use_tls = $smtpd_use_tls postscreen_watchdog_timeout = 10s postscreen_whitelist_interfaces = static:all prepend_delivered_header = command, file, forward process_id = 2311500 process_id_directory = pid process_name = postconf propagate_unmatched_extensions = canonical, virtual proxy_interfaces = proxy_read_maps = $local_recipient_maps $mydestination $virtual_alias_maps $virtual_alias_domains $virtual_mailbox_maps $virtual_mailbox_domains $relay_recipient_maps $relay_domains $canonical_maps $sender_canonical_maps $recipient_canonical_maps $relocated_maps $transport_maps $mynetworks $smtpd_sender_login_maps $sender_bcc_maps $recipient_bcc_maps $smtp_generic_maps $lmtp_generic_maps $alias_maps $smtpd_client_restrictions $smtpd_helo_restrictions $smtpd_sender_restrictions $smtpd_relay_restrictions $smtpd_recipient_restrictions $address_verify_sender_dependent_default_transport_maps $address_verify_sender_dependent_relayhost_maps $address_verify_transport_maps $fallback_transport_maps $lmtp_discard_lhlo_keyword_address_maps $lmtp_pix_workaround_maps $lmtp_sasl_password_maps $lmtp_tls_policy_maps $mailbox_command_maps $mailbox_transport_maps $postscreen_discard_ehlo_keyword_address_maps $rbl_reply_maps $sender_dependent_default_transport_maps $sender_dependent_relayhost_maps $smtp_discard_ehlo_keyword_address_maps $smtp_pix_workaround_maps $smtp_sasl_password_maps $smtp_tls_policy_maps $smtpd_discard_ehlo_keyword_address_maps $smtpd_milter_maps $virtual_gid_maps $virtual_uid_maps proxy_write_maps = $smtp_sasl_auth_cache_name $lmtp_sasl_auth_cache_name $address_verify_map $postscreen_cache_map proxymap_service_name = proxymap proxywrite_service_name = proxywrite qmgr_clog_warn_time = 300s qmgr_daemon_timeout = 1000s qmgr_fudge_factor = 100 qmgr_ipc_timeout = 60s qmgr_message_active_limit = 20000 qmgr_message_recipient_limit = 20000 qmgr_message_recipient_minimum = 10 qmqpd_authorized_clients = qmqpd_client_port_logging = no qmqpd_error_delay = 1s qmqpd_timeout = 300s queue_directory = /var/spool/postfix queue_file_attribute_count_limit = 100 queue_minfree = 0 queue_run_delay = 300s queue_service_name = qmgr rbl_reply_maps = readme_directory = /usr/share/doc/postfix/README_FILES receive_override_options = recipient_bcc_maps = recipient_canonical_classes = envelope_recipient, header_recipient recipient_canonical_maps = recipient_delimiter = reject_code = 554 reject_tempfail_action = defer_if_permit relay_clientcerts = relay_delivery_slot_cost = $default_delivery_slot_cost relay_delivery_slot_discount = $default_delivery_slot_discount relay_delivery_slot_loan = $default_delivery_slot_loan relay_destination_concurrency_failed_cohort_limit = $default_destination_concurrency_failed_cohort_limit relay_destination_concurrency_limit = $default_destination_concurrency_limit relay_destination_concurrency_negative_feedback = $default_destination_concurrency_negative_feedback relay_destination_concurrency_positive_feedback = $default_destination_concurrency_positive_feedback relay_destination_rate_delay = $default_destination_rate_delay relay_destination_recipient_limit = $default_destination_recipient_limit relay_domains = ${{$compatibility_level} < {2} ? {$mydestination} : {}} relay_domains_reject_code = 554 relay_extra_recipient_limit = $default_extra_recipient_limit relay_initial_destination_concurrency = $initial_destination_concurrency relay_minimum_delivery_slots = $default_minimum_delivery_slots relay_recipient_limit = $default_recipient_limit relay_recipient_maps = relay_recipient_refill_delay = $default_recipient_refill_delay relay_recipient_refill_limit = $default_recipient_refill_limit relay_transport = relay relay_transport_rate_delay = $default_transport_rate_delay relayhost = relocated_maps = remote_header_rewrite_domain = require_home_directory = no reset_owner_alias = no resolve_dequoted_address = yes resolve_null_domain = no resolve_numeric_domain = no retry_delivery_slot_cost = $default_delivery_slot_cost retry_delivery_slot_discount = $default_delivery_slot_discount retry_delivery_slot_loan = $default_delivery_slot_loan retry_destination_concurrency_failed_cohort_limit = $default_destination_concurrency_failed_cohort_limit retry_destination_concurrency_limit = $default_destination_concurrency_limit retry_destination_concurrency_negative_feedback = $default_destination_concurrency_negative_feedback retry_destination_concurrency_positive_feedback = $default_destination_concurrency_positive_feedback retry_destination_rate_delay = $default_destination_rate_delay retry_destination_recipient_limit = $default_destination_recipient_limit retry_extra_recipient_limit = $default_extra_recipient_limit retry_initial_destination_concurrency = $initial_destination_concurrency retry_minimum_delivery_slots = $default_minimum_delivery_slots retry_recipient_limit = $default_recipient_limit retry_recipient_refill_delay = $default_recipient_refill_delay retry_recipient_refill_limit = $default_recipient_refill_limit retry_transport_rate_delay = $default_transport_rate_delay rewrite_service_name = rewrite rhel_ipv6_normalize = no sample_directory = /usr/share/doc/postfix/samples send_cyrus_sasl_authzid = no sender_bcc_maps = hash:/etc/postfix/bcc sender_canonical_classes = envelope_sender, header_sender sender_canonical_maps = sender_dependent_default_transport_maps = hash:/etc/postfix/dependent sender_dependent_relayhost_maps = sendmail_fix_line_endings = always sendmail_path = /usr/sbin/sendmail.postfix service_name = service_throttle_time = 60s setgid_group = postdrop shlib_directory = /usr/lib64/postfix show_user_unknown_table_name = yes showq_service_name = showq smtp_address_preference = any smtp_address_verify_target = rcpt smtp_always_send_ehlo = yes smtp_balance_inet_protocols = yes smtp_bind_address = smtp_bind_address6 = smtp_body_checks = smtp_cname_overrides_servername = no smtp_connect_timeout = 30s smtp_connection_cache_destinations = smtp_connection_cache_on_demand = yes smtp_connection_cache_time_limit = 2s smtp_connection_reuse_count_limit = 0 smtp_connection_reuse_time_limit = 300s smtp_data_done_timeout = 600s smtp_data_init_timeout = 120s smtp_data_xfer_timeout = 180s smtp_defer_if_no_mx_address_found = no smtp_delivery_slot_cost = $default_delivery_slot_cost smtp_delivery_slot_discount = $default_delivery_slot_discount smtp_delivery_slot_loan = $default_delivery_slot_loan smtp_delivery_status_filter = $default_delivery_status_filter smtp_destination_concurrency_failed_cohort_limit = $default_destination_concurrency_failed_cohort_limit smtp_destination_concurrency_limit = $default_destination_concurrency_limit smtp_destination_concurrency_negative_feedback = $default_destination_concurrency_negative_feedback smtp_destination_concurrency_positive_feedback = $default_destination_concurrency_positive_feedback smtp_destination_rate_delay = $default_destination_rate_delay smtp_destination_recipient_limit = $default_destination_recipient_limit smtp_discard_ehlo_keyword_address_maps = smtp_discard_ehlo_keywords = smtp_dns_reply_filter = smtp_dns_resolver_options = smtp_dns_support_level = smtp_enforce_tls = no smtp_extra_recipient_limit = $default_extra_recipient_limit smtp_fallback_relay = $fallback_relay smtp_generic_maps = smtp_header_checks = smtp_helo_name = $myhostname smtp_helo_timeout = 300s smtp_host_lookup = dns smtp_initial_destination_concurrency = $initial_destination_concurrency smtp_line_length_limit = 998 smtp_mail_timeout = 300s smtp_mime_header_checks = smtp_minimum_delivery_slots = $default_minimum_delivery_slots smtp_mx_address_limit = 5 smtp_mx_session_limit = 2 smtp_nested_header_checks = smtp_never_send_ehlo = no smtp_per_record_deadline = no smtp_pix_workaround_delay_time = 10s smtp_pix_workaround_maps = smtp_pix_workaround_threshold_time = 500s smtp_pix_workarounds = disable_esmtp,delay_dotcrlf smtp_quit_timeout = 300s smtp_quote_rfc821_envelope = yes smtp_randomize_addresses = yes smtp_rcpt_timeout = 300s smtp_recipient_limit = $default_recipient_limit smtp_recipient_refill_delay = $default_recipient_refill_delay smtp_recipient_refill_limit = $default_recipient_refill_limit smtp_reply_filter = smtp_rset_timeout = 20s smtp_sasl_auth_cache_name = smtp_sasl_auth_cache_time = 90d smtp_sasl_auth_enable = no smtp_sasl_auth_soft_bounce = yes smtp_sasl_mechanism_filter = smtp_sasl_password_maps = smtp_sasl_path = smtp_sasl_security_options = noplaintext, noanonymous smtp_sasl_tls_security_options = $smtp_sasl_security_options smtp_sasl_tls_verified_security_options = $smtp_sasl_tls_security_options smtp_sasl_type = cyrus smtp_send_dummy_mail_auth = no smtp_send_xforward_command = no smtp_sender_dependent_authentication = no smtp_skip_5xx_greeting = yes smtp_skip_quit_response = yes smtp_starttls_timeout = 300s smtp_tcp_port = smtp smtp_tls_CAfile = /etc/pki/tls/certs/ca-bundle.crt smtp_tls_CApath = /etc/pki/tls/certs smtp_tls_block_early_mail_reply = no smtp_tls_cert_file = smtp_tls_chain_files = smtp_tls_ciphers = medium smtp_tls_connection_reuse = no smtp_tls_dane_insecure_mx_policy = dane smtp_tls_dcert_file = smtp_tls_dkey_file = $smtp_tls_dcert_file smtp_tls_eccert_file = smtp_tls_eckey_file = $smtp_tls_eccert_file smtp_tls_enforce_peername = yes smtp_tls_exclude_ciphers = RC4, aNULL, EXPORT, LOW, MEDIUM smtp_tls_fingerprint_cert_match = smtp_tls_fingerprint_digest = md5 smtp_tls_force_insecure_host_tlsa_lookup = no smtp_tls_key_file = $smtp_tls_cert_file smtp_tls_loglevel = 0 smtp_tls_mandatory_ciphers = medium smtp_tls_mandatory_exclude_ciphers = smtp_tls_mandatory_protocols = !SSLv2,!SSLv3 smtp_tls_note_starttls_offer = no smtp_tls_per_site = smtp_tls_policy_maps = smtp_tls_protocols = !SSLv2,!SSLv3 smtp_tls_scert_verifydepth = 9 smtp_tls_secure_cert_match = nexthop, dot-nexthop smtp_tls_security_level = may smtp_tls_servername = smtp_tls_session_cache_database = smtp_tls_session_cache_timeout = 3600s smtp_tls_trust_anchor_file = smtp_tls_verify_cert_match = hostname smtp_tls_wrappermode = no smtp_transport_rate_delay = $default_transport_rate_delay smtp_use_tls = no smtp_xforward_timeout = 300s smtpd_authorized_verp_clients = $authorized_verp_clients smtpd_authorized_xclient_hosts = smtpd_authorized_xforward_hosts = smtpd_banner = $myhostname ESMTP $mail_name smtpd_client_auth_rate_limit = 0 smtpd_client_connection_count_limit = 10 smtpd_client_connection_rate_limit = 60 smtpd_client_event_limit_exceptions = ${smtpd_client_connection_limit_exceptions:$mynetworks} smtpd_client_message_rate_limit = 0 smtpd_client_new_tls_session_rate_limit = 0 smtpd_client_port_logging = no smtpd_client_recipient_rate_limit = 0 smtpd_client_restrictions = smtpd_command_filter = smtpd_data_restrictions = smtpd_delay_open_until_valid_rcpt = yes smtpd_delay_reject = yes smtpd_discard_ehlo_keyword_address_maps = smtpd_discard_ehlo_keywords = chunking smtpd_dns_reply_filter = smtpd_end_of_data_restrictions = smtpd_enforce_tls = no smtpd_error_sleep_time = 1s smtpd_etrn_restrictions = smtpd_expansion_filter = \t\40!"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~ smtpd_forbidden_commands = CONNECT GET POST smtpd_hard_error_limit = ${stress?{1}:{20}} smtpd_helo_required = no smtpd_helo_restrictions = smtpd_history_flush_threshold = 100 smtpd_junk_command_limit = ${stress?{1}:{100}} smtpd_log_access_permit_actions = smtpd_milter_maps = smtpd_milters = inet:rspamd.domain.tld:11332 smtpd_noop_commands = smtpd_null_access_lookup_key = <> smtpd_peername_lookup = yes smtpd_per_record_deadline = ${stress?{yes}:{no}} smtpd_policy_service_default_action = 451 4.3.5 Server configuration problem smtpd_policy_service_max_idle = 300s smtpd_policy_service_max_ttl = 1000s smtpd_policy_service_policy_context = smtpd_policy_service_request_limit = 0 smtpd_policy_service_retry_delay = 1s smtpd_policy_service_timeout = 100s smtpd_policy_service_try_limit = 2 smtpd_proxy_ehlo = $myhostname smtpd_proxy_filter = smtpd_proxy_options = smtpd_proxy_timeout = 100s smtpd_recipient_limit = 1000 smtpd_recipient_overshoot_limit = 1000 smtpd_recipient_restrictions = permit_sasl_authenticated, reject_unauth_destination, reject_invalid_hostname, reject_unauth_pipelining, reject_non_fqdn_sender, reject_unknown_sender_domain, reject_non_fqdn_recipient, reject_unknown_recipient_domain, reject_rbl_client zen.spamhaus.org, reject_rhsbl_client dbl.spamhaus.org smtpd_reject_footer = smtpd_reject_footer_maps = smtpd_reject_unlisted_recipient = yes smtpd_reject_unlisted_sender = yes smtpd_relay_restrictions = ${{$compatibility_level} < {1} ? {} : {permit_mynetworks, permit_sasl_authenticated, defer_unauth_destination}} smtpd_restriction_classes = smtpd_sasl_auth_enable = yes smtpd_sasl_authenticated_header = no smtpd_sasl_exceptions_networks = smtpd_sasl_local_domain = smtpd_sasl_path = smtpd smtpd_sasl_response_limit = 12288 smtpd_sasl_security_options = noanonymous smtpd_sasl_service = smtp smtpd_sasl_tls_security_options = $smtpd_sasl_security_options smtpd_sasl_type = cyrus smtpd_sender_login_maps = unionmap:{regexp:/etc/postfix/login_maps.pcre hash:/etc/postfix/virtual} smtpd_sender_restrictions = smtpd_service_name = smtpd smtpd_soft_error_limit = 10 smtpd_starttls_timeout = ${stress?{10}:{300}}s smtpd_timeout = ${stress?{10}:{300}}s smtpd_tls_CAfile = /etc/postfix/postfix.ca.pem smtpd_tls_CApath = smtpd_tls_always_issue_session_ids = yes smtpd_tls_ask_ccert = no smtpd_tls_auth_only = no smtpd_tls_ccert_verifydepth = 9 smtpd_tls_cert_file = smtpd_tls_chain_files = /etc/pki/tls/private/postfix.key,/etc/pki/tls/certs/postfix.pem smtpd_tls_ciphers = medium smtpd_tls_dcert_file = smtpd_tls_dh1024_param_file = smtpd_tls_dh512_param_file = smtpd_tls_dkey_file = $smtpd_tls_dcert_file smtpd_tls_eccert_file = smtpd_tls_eckey_file = $smtpd_tls_eccert_file smtpd_tls_eecdh_grade = auto smtpd_tls_exclude_ciphers = RC4, aNULL, EXPORT, LOW, MEDIUM smtpd_tls_fingerprint_digest = md5 smtpd_tls_key_file = $smtpd_tls_cert_file smtpd_tls_loglevel = 0 smtpd_tls_mandatory_ciphers = high smtpd_tls_mandatory_exclude_ciphers = smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3 smtpd_tls_protocols = !SSLv2,!SSLv3 smtpd_tls_received_header = no smtpd_tls_req_ccert = no smtpd_tls_security_level = may smtpd_tls_session_cache_database = smtpd_tls_session_cache_timeout = 3600s smtpd_tls_wrappermode = no smtpd_upstream_proxy_protocol = smtpd_upstream_proxy_timeout = 5s smtpd_use_tls = yes smtputf8_autodetect_classes = sendmail, verify smtputf8_enable = ${{$compatibility_level} < {1} ? {no} : {yes}} soft_bounce = no stale_lock_time = 500s stress = strict_7bit_headers = no strict_8bitmime = no strict_8bitmime_body = no strict_mailbox_ownership = yes strict_mime_encoding_domain = no strict_rfc821_envelopes = no strict_smtputf8 = no sun_mailtool_compatibility = no swap_bangpath = yes syslog_facility = mail syslog_name = ${multi_instance_name?{$multi_instance_name}:{postfix}} tcp_windowsize = 0 tls_append_default_CA = no tls_daemon_random_bytes = 32 tls_dane_digests = sha512 sha256 tls_disable_workarounds = tls_eecdh_auto_curves = X25519 X448 prime256v1 secp521r1 secp384r1 tls_eecdh_strong_curve = prime256v1 tls_eecdh_ultra_curve = secp384r1 tls_export_cipherlist = aNULL:-aNULL:HIGH:MEDIUM:LOW:EXPORT:+RC4:@STRENGTH tls_fast_shutdown_enable = yes tls_high_cipherlist = aNULL:-aNULL:HIGH:@STRENGTH tls_legacy_public_key_fingerprints = no tls_low_cipherlist = aNULL:-aNULL:HIGH:MEDIUM:LOW:+RC4:@STRENGTH tls_medium_cipherlist = aNULL:-aNULL:HIGH:MEDIUM:+RC4:@STRENGTH tls_null_cipherlist = eNULL:!aNULL tls_preempt_cipherlist = no tls_random_bytes = 32 tls_random_exchange_name = ${data_directory}/prng_exch tls_random_prng_update_period = 3600s tls_random_reseed_period = 3600s tls_random_source = dev:/dev/urandom tls_server_sni_maps = hash:/etc/postfix/vmail_ssl tls_session_ticket_cipher = aes-256-cbc tls_ssl_options = tls_wildcard_matches_multiple_labels = yes tlsmgr_service_name = tlsmgr tlsproxy_client_CAfile = $smtp_tls_CAfile tlsproxy_client_CApath = $smtp_tls_CApath tlsproxy_client_cert_file = $smtp_tls_cert_file tlsproxy_client_chain_files = $smtp_tls_chain_files tlsproxy_client_dcert_file = $smtp_tls_dcert_file tlsproxy_client_dkey_file = $smtp_tls_dkey_file tlsproxy_client_eccert_file = $smtp_tls_eccert_file tlsproxy_client_eckey_file = $smtp_tls_eckey_file tlsproxy_client_enforce_tls = $smtp_enforce_tls tlsproxy_client_fingerprint_digest = $smtp_tls_fingerprint_digest tlsproxy_client_key_file = $smtp_tls_key_file tlsproxy_client_level = $smtp_tls_security_level tlsproxy_client_loglevel = $smtp_tls_loglevel tlsproxy_client_loglevel_parameter = smtp_tls_loglevel tlsproxy_client_per_site = $smtp_tls_per_site tlsproxy_client_policy = $smtp_tls_policy_maps tlsproxy_client_scert_verifydepth = $smtp_tls_scert_verifydepth tlsproxy_client_use_tls = $smtp_use_tls tlsproxy_enforce_tls = $smtpd_enforce_tls tlsproxy_service_name = tlsproxy tlsproxy_tls_CAfile = $smtpd_tls_CAfile tlsproxy_tls_CApath = $smtpd_tls_CApath tlsproxy_tls_always_issue_session_ids = $smtpd_tls_always_issue_session_ids tlsproxy_tls_ask_ccert = $smtpd_tls_ask_ccert tlsproxy_tls_ccert_verifydepth = $smtpd_tls_ccert_verifydepth tlsproxy_tls_cert_file = $smtpd_tls_cert_file tlsproxy_tls_chain_files = $smtpd_tls_chain_files tlsproxy_tls_ciphers = $smtpd_tls_ciphers tlsproxy_tls_dcert_file = $smtpd_tls_dcert_file tlsproxy_tls_dh1024_param_file = $smtpd_tls_dh1024_param_file tlsproxy_tls_dh512_param_file = $smtpd_tls_dh512_param_file tlsproxy_tls_dkey_file = $smtpd_tls_dkey_file tlsproxy_tls_eccert_file = $smtpd_tls_eccert_file tlsproxy_tls_eckey_file = $smtpd_tls_eckey_file tlsproxy_tls_eecdh_grade = $smtpd_tls_eecdh_grade tlsproxy_tls_exclude_ciphers = $smtpd_tls_exclude_ciphers tlsproxy_tls_fingerprint_digest = $smtpd_tls_fingerprint_digest tlsproxy_tls_key_file = $smtpd_tls_key_file tlsproxy_tls_loglevel = $smtpd_tls_loglevel tlsproxy_tls_mandatory_ciphers = $smtpd_tls_mandatory_ciphers tlsproxy_tls_mandatory_exclude_ciphers = $smtpd_tls_mandatory_exclude_ciphers tlsproxy_tls_mandatory_protocols = $smtpd_tls_mandatory_protocols tlsproxy_tls_protocols = $smtpd_tls_protocols tlsproxy_tls_req_ccert = $smtpd_tls_req_ccert tlsproxy_tls_security_level = $smtpd_tls_security_level tlsproxy_use_tls = $smtpd_use_tls tlsproxy_watchdog_timeout = 10s trace_service_name = trace transport_maps = transport_retry_time = 60s trigger_timeout = 10s undisclosed_recipients_header = unknown_address_reject_code = 450 unknown_address_tempfail_action = $reject_tempfail_action unknown_client_reject_code = 450 unknown_helo_hostname_tempfail_action = $reject_tempfail_action unknown_hostname_reject_code = 450 unknown_local_recipient_reject_code = 550 unknown_relay_recipient_reject_code = 550 unknown_virtual_alias_reject_code = 550 unknown_virtual_mailbox_reject_code = 550 unverified_recipient_defer_code = 450 unverified_recipient_reject_code = 450 unverified_recipient_reject_reason = unverified_recipient_tempfail_action = $reject_tempfail_action unverified_sender_defer_code = 450 unverified_sender_reject_code = 450 unverified_sender_reject_reason = unverified_sender_tempfail_action = $reject_tempfail_action verp_delimiter_filter = -=+ virtual_alias_address_length_limit = 1000 virtual_alias_domains = $virtual_alias_maps virtual_alias_expansion_limit = 1000 virtual_alias_maps = hash:/etc/postfix/virtual virtual_alias_recursion_limit = 1000 virtual_delivery_slot_cost = $default_delivery_slot_cost virtual_delivery_slot_discount = $default_delivery_slot_discount virtual_delivery_slot_loan = $default_delivery_slot_loan virtual_delivery_status_filter = $default_delivery_status_filter virtual_destination_concurrency_failed_cohort_limit = $default_destination_concurrency_failed_cohort_limit virtual_destination_concurrency_limit = $default_destination_concurrency_limit virtual_destination_concurrency_negative_feedback = $default_destination_concurrency_negative_feedback virtual_destination_concurrency_positive_feedback = $default_destination_concurrency_positive_feedback virtual_destination_rate_delay = $default_destination_rate_delay virtual_destination_recipient_limit = $default_destination_recipient_limit virtual_extra_recipient_limit = $default_extra_recipient_limit virtual_gid_maps = virtual_initial_destination_concurrency = $initial_destination_concurrency virtual_mailbox_base = virtual_mailbox_domains = $virtual_mailbox_maps virtual_mailbox_limit = 51200000 virtual_mailbox_lock = fcntl, dotlock virtual_mailbox_maps = virtual_minimum_delivery_slots = $default_minimum_delivery_slots virtual_minimum_uid = 100 virtual_recipient_limit = $default_recipient_limit virtual_recipient_refill_delay = $default_recipient_refill_delay virtual_recipient_refill_limit = $default_recipient_refill_limit virtual_transport = virtual virtual_transport_rate_delay = $default_transport_rate_delay virtual_uid_maps = ############################# dovecot config: ############################# doveconf # 2.3.16 (7e2e900c1a): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.16 (09c29328) # OS: Linux 4.18.0-425.3.1.el8.x86_64 x86_64 Rocky Linux release 8.7 (Green Obsidian) # Hostname: m13.domain.tld # NOTE: Send doveconf -n output instead when asking for help. auth_anonymous_username = anonymous auth_cache_negative_ttl = 1 hours auth_cache_size = 0 auth_cache_ttl = 1 hours auth_cache_verify_password_with_worker = no auth_debug = no auth_debug_passwords = no auth_default_realm = auth_failure_delay = 2 secs auth_gssapi_hostname = auth_krb5_keytab = auth_master_user_separator = auth_mechanisms = plain login auth_policy_check_after_auth = yes auth_policy_check_before_auth = yes auth_policy_hash_mech = sha256 auth_policy_hash_nonce = auth_policy_hash_truncate = 12 auth_policy_log_only = no auth_policy_reject_on_fail = no auth_policy_report_after_auth = yes auth_policy_request_attributes = login=%{requested_username} pwhash=%{hashed_password} remote=%{rip} device_id=%{client_id} protocol=%s session_id=%{session} auth_policy_server_api_header = auth_policy_server_timeout_msecs = 2000 auth_policy_server_url = auth_proxy_self = auth_realms = auth_socket_path = auth-userdb auth_ssl_require_client_cert = no auth_ssl_username_from_cert = no auth_stats = no auth_use_winbind = no auth_username_chars = abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ01234567890.-_@ auth_username_format = %Lu auth_username_translation = auth_verbose = no auth_verbose_passwords = no auth_winbind_helper_path = /usr/bin/ntlm_auth auth_worker_max_count = 30 base_dir = /run/dovecot config_cache_size = 1 M debug_log_path = default_client_limit = 1000 default_idle_kill = 1 mins default_internal_group = dovecot default_internal_user = dovecot default_login_user = dovenull default_process_limit = 100 default_vsz_limit = 256 M deliver_log_format = msgid=%m: %$ dict_db_config = director_flush_socket = director_mail_servers = director_max_parallel_kicks = 100 director_max_parallel_moves = 100 director_output_buffer_size = 10 M director_ping_idle_timeout = 30 secs director_ping_max_timeout = 1 mins director_servers = director_user_expire = 15 mins director_user_kick_delay = 2 secs director_username_hash = %u disable_plaintext_auth = no dotlock_use_excl = yes doveadm_allowed_commands = doveadm_api_key = doveadm_http_rawlog_dir = doveadm_password = doveadm_port = 0 doveadm_socket_path = doveadm-server doveadm_ssl = no doveadm_username = doveadm doveadm_worker_count = 0 dsync_alt_char = _ dsync_commit_msgs_interval = 100 dsync_features = dsync_hashed_headers = Date Message-ID dsync_remote_cmd = ssh -l%{login} %{host} doveadm dsync-server -u%u -U first_valid_gid = 1 first_valid_uid = 1000 haproxy_timeout = 3 secs haproxy_trusted_networks = hostname = imap_capability = imap_client_workarounds = imap_fetch_failure = disconnect-immediately imap_hibernate_timeout = 0 imap_id_log = imap_id_retain = no imap_id_send = name * imap_idle_notify_interval = 2 mins imap_literal_minus = no imap_logout_format = in=%i out=%o deleted=%{deleted} expunged=%{expunged} trashed=%{trashed} hdr_count=%{fetch_hdr_count} hdr_bytes=%{fetch_hdr_bytes} body_count=%{fetch_body_count} body_bytes=%{fetch_body_bytes} imap_max_line_length = 64 k imap_metadata = no imap_urlauth_host = imap_urlauth_logout_format = in=%i out=%o imap_urlauth_port = 143 imapc_cmd_timeout = 5 mins imapc_connection_retry_count = 1 imapc_connection_retry_interval = 1 secs imapc_features = imapc_host = imapc_list_prefix = imapc_master_user = imapc_max_idle_time = 29 mins imapc_max_line_length = 0 imapc_password = imapc_port = 143 imapc_rawlog_dir = imapc_sasl_mechanisms = imapc_ssl = no imapc_ssl_verify = yes imapc_user = import_environment = TZ CORE_OUTOFMEM CORE_ERROR info_log_path = instance_name = dovecot last_valid_gid = 0 last_valid_uid = 0 lda_mailbox_autocreate = no lda_mailbox_autosubscribe = no lda_original_recipient_header = libexec_dir = /usr/libexec/dovecot listen = *, :: lmtp_add_received_header = yes lmtp_client_workarounds = lmtp_hdr_delivery_address = final lmtp_proxy = no lmtp_proxy_rawlog_dir = lmtp_rawlog_dir = lmtp_rcpt_check_quota = no lmtp_save_to_detail_mailbox = no lmtp_user_concurrency_limit = 0 lock_method = fcntl log_core_filter = log_debug = log_path = syslog log_timestamp = "%b %d %H:%M:%S " login_access_sockets = login_greeting = Dovecot ready. login_log_format = %$: %s login_log_format_elements = user=<%u> method=%m rip=%r lip=%l mpid=%e %c session=<%{session}> login_plugin_dir = /usr/lib64/dovecot/login login_plugins = login_proxy_max_disconnect_delay = 0 login_proxy_max_reconnects = 3 login_proxy_notify_path = proxy-notify login_proxy_timeout = 30 secs login_source_ips = login_trusted_networks = mail_access_groups = mail_always_cache_fields = mail_attachment_detection_options = mail_attachment_dir = mail_attachment_fs = sis posix mail_attachment_hash = %{sha1} mail_attachment_min_size = 128 k mail_attribute_dict = mail_cache_fields = flags mail_cache_min_mail_count = 0 mail_chroot = mail_debug = no mail_fsync = optimized mail_full_filesystem_access = no mail_gid = mail_home = mail_location = maildir:~/Maildir:INDEX=/var/lib/dovecot-virtualmin/index/%u:CONTROL=/var/lib/dovecot-virtualmin/control/%u mail_log_prefix = "%s(%u)<%{pid}><%{session}>: " mail_max_keyword_length = 50 mail_max_lock_timeout = 0 mail_max_userip_connections = 10 mail_never_cache_fields = imap.envelope mail_nfs_index = no mail_nfs_storage = no mail_plugin_dir = /usr/lib64/dovecot mail_plugins = mail_prefetch_count = 0 mail_privileged_group = mail_save_crlf = no mail_server_admin = mail_server_comment = mail_shared_explicit_inbox = no mail_sort_max_read_count = 0 mail_temp_dir = /tmp mail_temp_scan_interval = 1 weeks mail_uid = mail_vsize_bg_after_count = 0 mailbox_idle_check_interval = 30 secs mailbox_list_index = yes mailbox_list_index_include_inbox = no mailbox_list_index_very_dirty_syncs = no maildir_broken_filename_sizes = no maildir_copy_with_hardlinks = yes maildir_empty_new = no maildir_stat_dirs = no maildir_very_dirty_syncs = no managesieve_client_workarounds = managesieve_implementation_string = Dovecot Pigeonhole managesieve_logout_format = bytes=%i/%o managesieve_max_compile_errors = 5 managesieve_max_line_length = 64 k managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext vacation-seconds imapsieve vnd.dovecot.imapsieve master_user_separator = mbox_dirty_syncs = yes mbox_dotlock_change_timeout = 2 mins mbox_lazy_writes = yes mbox_lock_timeout = 5 mins mbox_md5 = apop3d mbox_min_index_size = 0 mbox_read_locks = fcntl mbox_very_dirty_syncs = no mbox_write_locks = fcntl mdbox_preallocate_space = no mdbox_rotate_interval = 0 mdbox_rotate_size = 10 M mmap_disable = no namespace inbox { disabled = no hidden = no ignore_on_failure = no inbox = yes list = yes location = mailbox Drafts { auto = subscribe autoexpunge = 0 autoexpunge_max_mails = 0 comment = driver = special_use = \Drafts } mailbox Junk { auto = subscribe autoexpunge = 0 autoexpunge_max_mails = 0 comment = driver = special_use = \Junk } mailbox Sent { auto = subscribe autoexpunge = 0 autoexpunge_max_mails = 0 comment = driver = special_use = \Sent } mailbox "Sent Messages" { auto = no autoexpunge = 0 autoexpunge_max_mails = 0 comment = driver = special_use = \Sent } mailbox Trash { auto = subscribe autoexpunge = 0 autoexpunge_max_mails = 0 comment = driver = special_use = \Trash } mailbox spam { auto = subscribe autoexpunge = 0 autoexpunge_max_mails = 0 comment = driver = special_use = \Junk } order = 0 prefix = separator = subscriptions = yes type = private } old_stats_carbon_interval = 30 secs old_stats_carbon_name = old_stats_carbon_server = old_stats_command_min_time = 1 mins old_stats_domain_min_time = 12 hours old_stats_ip_min_time = 12 hours old_stats_memory_limit = 16 M old_stats_session_min_time = 15 mins old_stats_user_min_time = 1 hours passdb { args = auth_verbose = default default_fields = deny = no driver = pam master = no mechanisms = name = override_fields = pass = no result_failure = continue result_internalfail = continue result_success = return-ok skip = never username_filter = } plugin { imapsieve_mailbox1_before = file:/var/lib/dovecot/sieve/learn-spam.sieve imapsieve_mailbox1_causes = COPY APPEND FLAG imapsieve_mailbox1_name = spam imapsieve_mailbox2_before = file:/var/lib/dovecot/sieve/learn-ham.sieve imapsieve_mailbox2_causes = COPY imapsieve_mailbox2_from = spam imapsieve_mailbox2_name = * imapsieve_mailbox3_before = file:/var/lib/dovecot/sieve/learn-spam.sieve imapsieve_mailbox3_causes = COPY APPEND FLAG imapsieve_mailbox3_name = Junk imapsieve_mailbox4_before = file:/var/lib/dovecot/sieve/learn-ham.sieve imapsieve_mailbox4_causes = COPY imapsieve_mailbox4_from = Junk imapsieve_mailbox4_name = * quota = fs:user userquota quota_grace = 100M quota_warning = storage=95%% quota-warning 95 %n %d quota_warning2 = storage=90%% quota-warning 90 %n %d quota_warning3 = storage=80%% quota-warning 80 %n %d sieve = file:~/sieve;active=~/.dovecot.sieve sieve_before = /var/lib/dovecot/sieve/before-global.sieve sieve_extensions = +vacation-seconds sieve_global_extensions = +vnd.dovecot.pipe +vnd.dovecot.environment +vnd.dovecot.debug sieve_pipe_bin_dir = /var/lib/dovecot/sieve sieve_plugins = sieve_extprograms sieve_imapsieve sieve_vacation_default_period = 10d sieve_vacation_max_period = 30d sieve_vacation_min_period = 1h } pop3_client_workarounds = pop3_delete_type = default pop3_deleted_flag = pop3_enable_last = no pop3_fast_size_lookups = no pop3_lock_session = no pop3_logout_format = top=%t/%p, retr=%r/%b, del=%d/%m, size=%s pop3_no_flag_updates = no pop3_reuse_xuidl = no pop3_save_uidl = no pop3_uidl_duplicates = allow pop3_uidl_format = %08Xu%08Xv pop3c_features = pop3c_host = pop3c_master_user = pop3c_password = pop3c_port = 110 pop3c_quick_received_date = no pop3c_rawlog_dir = pop3c_ssl = no pop3c_ssl_verify = yes pop3c_user = %u postmaster_address = postmaster@%{if;%d;ne;;%d;%{hostname}} protocols = imap pop3 lmtp sieve quota_full_tempfail = no rawlog_dir = recipient_delimiter = + rejection_reason = Your message to <%t> was automatically rejected:%n%r rejection_subject = Rejected: %s replication_dsync_parameters = -d -N -l 30 -U replication_full_sync_interval = 1 days replication_max_conns = 10 replicator_host = replicator replicator_port = 0 sendmail_path = /usr/sbin/sendmail service aggregator { chroot = . client_limit = 0 drop_priv_before_exec = no executable = aggregator extra_groups = fifo_listener replication-notify-fifo { group = mode = 0600 user = } group = idle_kill = 0 privileged_group = process_limit = 0 process_min_avail = 0 protocol = service_count = 0 type = unix_listener replication-notify { group = mode = 0600 user = } user = $default_internal_user vsz_limit = 18446744073709551615 B } service anvil { chroot = empty client_limit = 0 drop_priv_before_exec = no executable = anvil extra_groups = group = idle_kill = 4294967295 secs privileged_group = process_limit = 1 process_min_avail = 1 protocol = service_count = 0 type = anvil unix_listener anvil-auth-penalty { group = mode = 0600 user = } unix_listener anvil { group = mode = 0600 user = } user = $default_internal_user vsz_limit = 18446744073709551615 B } service auth-worker { chroot = client_limit = 1 drop_priv_before_exec = no executable = auth -w extra_groups = group = idle_kill = 0 privileged_group = process_limit = 0 process_min_avail = 0 protocol = service_count = 0 type = worker unix_listener auth-worker { group = mode = 0600 user = $default_internal_user } user = vsz_limit = 18446744073709551615 B } service auth { chroot = client_limit = 0 drop_priv_before_exec = no executable = auth extra_groups = group = idle_kill = 0 privileged_group = process_limit = 1 process_min_avail = 0 protocol = service_count = 0 type = unix_listener auth-client { group = mode = 0600 user = $default_internal_user } unix_listener auth-login { group = mode = 0600 user = $default_internal_user } unix_listener auth-master { group = mode = 0600 user = } unix_listener auth-userdb { group = mode = 0666 user = $default_internal_user } unix_listener login/login { group = mode = 0666 user = } unix_listener token-login/tokenlogin { group = mode = 0666 user = } user = $default_internal_user vsz_limit = 18446744073709551615 B } service config { chroot = client_limit = 0 drop_priv_before_exec = no executable = config extra_groups = group = idle_kill = 4294967295 secs privileged_group = process_limit = 0 process_min_avail = 0 protocol = service_count = 0 type = config unix_listener config { group = mode = 0600 user = } user = vsz_limit = 18446744073709551615 B } service dict-async { chroot = client_limit = 0 drop_priv_before_exec = no executable = dict extra_groups = group = idle_kill = 0 privileged_group = process_limit = 0 process_min_avail = 0 protocol = service_count = 0 type = unix_listener dict-async { group = $default_internal_group mode = 0660 user = } user = $default_internal_user vsz_limit = 18446744073709551615 B } service dict { chroot = client_limit = 1 drop_priv_before_exec = no executable = dict extra_groups = group = idle_kill = 0 privileged_group = process_limit = 0 process_min_avail = 0 protocol = service_count = 0 type = unix_listener dict { group = $default_internal_group mode = 0660 user = } user = $default_internal_user vsz_limit = 18446744073709551615 B } service director { chroot = . client_limit = 0 drop_priv_before_exec = no executable = director extra_groups = fifo_listener login/proxy-notify { group = mode = 00 user = } group = idle_kill = 4294967295 secs inet_listener { address = haproxy = no port = 0 reuse_port = no ssl = no } privileged_group = process_limit = 1 process_min_avail = 0 protocol = service_count = 0 type = unix_listener director-admin { group = mode = 0600 user = } unix_listener director-userdb { group = mode = 0600 user = } unix_listener login/director { group = mode = 00 user = } user = $default_internal_user vsz_limit = 18446744073709551615 B } service dns-client { chroot = client_limit = 1 drop_priv_before_exec = no executable = dns-client extra_groups = group = idle_kill = 0 privileged_group = process_limit = 0 process_min_avail = 0 protocol = service_count = 0 type = unix_listener dns-client { group = mode = 0666 user = } unix_listener login/dns-client { group = mode = 0666 user = } user = $default_internal_user vsz_limit = 18446744073709551615 B } service doveadm { chroot = client_limit = 1 drop_priv_before_exec = no executable = doveadm-server extra_groups = $default_internal_group group = idle_kill = 0 privileged_group = process_limit = 0 process_min_avail = 0 protocol = service_count = 1 type = unix_listener doveadm-server { group = mode = 0600 user = } user = vsz_limit = 18446744073709551615 B } service health-check { chroot = client_limit = 1 drop_priv_before_exec = yes executable = script -p health-check.sh extra_groups = group = idle_kill = 0 privileged_group = process_limit = 0 process_min_avail = 0 protocol = service_count = 0 type = user = $default_internal_user vsz_limit = 18446744073709551615 B } service imap-hibernate { chroot = client_limit = 0 drop_priv_before_exec = no executable = imap-hibernate extra_groups = group = idle_kill = 0 privileged_group = process_limit = 0 process_min_avail = 0 protocol = imap service_count = 0 type = unix_listener imap-hibernate { group = $default_internal_group mode = 0660 user = } user = $default_internal_user vsz_limit = 18446744073709551615 B } service imap-login { chroot = login client_limit = 0 drop_priv_before_exec = no executable = imap-login extra_groups = group = idle_kill = 0 inet_listener imap { address = haproxy = no port = 143 reuse_port = no ssl = no } inet_listener imaps { address = haproxy = no port = 993 reuse_port = no ssl = yes } privileged_group = process_limit = 0 process_min_avail = 5 protocol = imap service_count = 0 type = login user = $default_login_user vsz_limit = 18446744073709551615 B } service imap-urlauth-login { chroot = token-login client_limit = 0 drop_priv_before_exec = no executable = imap-urlauth-login extra_groups = group = idle_kill = 0 privileged_group = process_limit = 0 process_min_avail = 0 protocol = imap service_count = 1 type = login unix_listener imap-urlauth { group = mode = 0666 user = } user = $default_login_user vsz_limit = 18446744073709551615 B } service imap-urlauth-worker { chroot = client_limit = 1 drop_priv_before_exec = no executable = imap-urlauth-worker extra_groups = $default_internal_group group = idle_kill = 0 privileged_group = process_limit = 1024 process_min_avail = 0 protocol = imap service_count = 1 type = unix_listener imap-urlauth-worker { group = mode = 0600 user = $default_internal_user } user = vsz_limit = 18446744073709551615 B } service imap-urlauth { chroot = client_limit = 1 drop_priv_before_exec = no executable = imap-urlauth extra_groups = group = idle_kill = 0 privileged_group = process_limit = 1024 process_min_avail = 0 protocol = imap service_count = 1 type = unix_listener token-login/imap-urlauth { group = mode = 0666 user = } user = $default_internal_user vsz_limit = 18446744073709551615 B } service imap { chroot = client_limit = 1 drop_priv_before_exec = no executable = imap extra_groups = $default_internal_group group = idle_kill = 0 privileged_group = process_limit = 400 process_min_avail = 0 protocol = imap service_count = 1 type = unix_listener imap-master { group = mode = 0600 user = } unix_listener login/imap { group = mode = 0666 user = } user = vsz_limit = 18446744073709551615 B } service indexer-worker { chroot = client_limit = 1 drop_priv_before_exec = no executable = indexer-worker extra_groups = $default_internal_group group = idle_kill = 0 privileged_group = process_limit = 10 process_min_avail = 0 protocol = service_count = 0 type = worker unix_listener indexer-worker { group = mode = 0600 user = $default_internal_user } user = vsz_limit = 18446744073709551615 B } service indexer { chroot = client_limit = 0 drop_priv_before_exec = no executable = indexer extra_groups = group = idle_kill = 0 privileged_group = process_limit = 1 process_min_avail = 0 protocol = service_count = 0 type = unix_listener indexer { group = mode = 0666 user = } user = $default_internal_user vsz_limit = 18446744073709551615 B } service ipc { chroot = empty client_limit = 0 drop_priv_before_exec = no executable = ipc extra_groups = group = idle_kill = 0 privileged_group = process_limit = 1 process_min_avail = 0 protocol = service_count = 0 type = unix_listener ipc { group = mode = 0600 user = $default_internal_user } unix_listener login/ipc-proxy { group = mode = 0600 user = $default_login_user } user = $default_internal_user vsz_limit = 18446744073709551615 B } service lmtp { chroot = client_limit = 1 drop_priv_before_exec = no executable = lmtp extra_groups = $default_internal_group group = idle_kill = 0 privileged_group = process_limit = 0 process_min_avail = 0 protocol = lmtp service_count = 0 type = unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 01224 user = postfix } unix_listener lmtp { group = mode = 0666 user = } user = vsz_limit = 18446744073709551615 B } service log { chroot = client_limit = 0 drop_priv_before_exec = no executable = log extra_groups = group = idle_kill = 4294967295 secs privileged_group = process_limit = 1 process_min_avail = 0 protocol = service_count = 0 type = log unix_listener log-errors { group = mode = 0600 user = } user = vsz_limit = 18446744073709551615 B } service managesieve-login { chroot = login client_limit = 0 drop_priv_before_exec = no executable = managesieve-login extra_groups = group = idle_kill = 0 inet_listener sieve { address = haproxy = no port = 4190 reuse_port = no ssl = no } privileged_group = process_limit = 0 process_min_avail = 0 protocol = sieve service_count = 1 type = login user = $default_login_user vsz_limit = 18446744073709551615 B } service managesieve { chroot = client_limit = 1 drop_priv_before_exec = no executable = managesieve extra_groups = group = idle_kill = 0 privileged_group = process_limit = 0 process_min_avail = 0 protocol = sieve service_count = 1 type = unix_listener login/sieve { group = mode = 0666 user = } user = vsz_limit = 18446744073709551615 B } service old-stats { chroot = empty client_limit = 0 drop_priv_before_exec = no executable = old-stats extra_groups = fifo_listener old-stats-mail { group = mode = 0600 user = } fifo_listener old-stats-user { group = mode = 0600 user = } group = idle_kill = 4294967295 secs privileged_group = process_limit = 1 process_min_avail = 0 protocol = service_count = 0 type = unix_listener old-stats { group = mode = 0600 user = } user = $default_internal_user vsz_limit = 18446744073709551615 B } service pop3-login { chroot = login client_limit = 0 drop_priv_before_exec = no executable = pop3-login extra_groups = group = idle_kill = 0 inet_listener pop3 { address = haproxy = no port = 110 reuse_port = no ssl = no } inet_listener pop3s { address = haproxy = no port = 995 reuse_port = no ssl = yes } privileged_group = process_limit = 0 process_min_avail = 0 protocol = pop3 service_count = 1 type = login user = $default_login_user vsz_limit = 18446744073709551615 B } service pop3 { chroot = client_limit = 1 drop_priv_before_exec = no executable = pop3 extra_groups = $default_internal_group group = idle_kill = 0 privileged_group = process_limit = 200 process_min_avail = 0 protocol = pop3 service_count = 1 type = unix_listener login/pop3 { group = mode = 0666 user = } user = vsz_limit = 18446744073709551615 B } service quota-warning { chroot = client_limit = 0 drop_priv_before_exec = no executable = script /var/lib/dovecot/quota-warning.sh extra_groups = group = idle_kill = 0 privileged_group = process_limit = 0 process_min_avail = 0 protocol = service_count = 1 type = unix_listener quota-warning { group = dovecot mode = 0666 user = dovecot } user = vsz_limit = 18446744073709551615 B } service replicator { chroot = client_limit = 0 drop_priv_before_exec = no executable = replicator extra_groups = group = idle_kill = 4294967295 secs privileged_group = process_limit = 1 process_min_avail = 0 protocol = service_count = 0 type = unix_listener replicator-doveadm { group = mode = 00 user = $default_internal_user } unix_listener replicator { group = mode = 0600 user = $default_internal_user } user = vsz_limit = 18446744073709551615 B } service stats { chroot = client_limit = 0 drop_priv_before_exec = no executable = stats extra_groups = group = idle_kill = 4294967295 secs privileged_group = process_limit = 1 process_min_avail = 0 protocol = service_count = 0 type = unix_listener stats-reader { group = mode = 0600 user = } unix_listener stats-writer { group = $default_internal_group mode = 0660 user = } user = $default_internal_user vsz_limit = 18446744073709551615 B } service submission-login { chroot = login client_limit = 0 drop_priv_before_exec = no executable = submission-login extra_groups = group = idle_kill = 0 inet_listener submission { address = haproxy = no port = 587 reuse_port = no ssl = no } privileged_group = process_limit = 0 process_min_avail = 0 protocol = submission service_count = 1 type = login user = $default_login_user vsz_limit = 18446744073709551615 B } service submission { chroot = client_limit = 1 drop_priv_before_exec = no executable = submission extra_groups = $default_internal_group group = idle_kill = 0 privileged_group = process_limit = 1024 process_min_avail = 0 protocol = submission service_count = 1 type = unix_listener login/submission { group = mode = 0666 user = } user = vsz_limit = 18446744073709551615 B } shutdown_clients = yes ssl = yes ssl_alt_cert = ssl_alt_key = ssl_ca = ssl_cert = </etc/pki/dovecot/certs/dovecot.pem ssl_cert_username_field = commonName ssl_cipher_list = PROFILE=SYSTEM ssl_cipher_suites = ssl_client_ca_dir = ssl_client_ca_file = ssl_client_cert = ssl_client_key = ssl_client_require_valid_cert = yes ssl_crypto_device = ssl_curve_list = ssl_dh = ssl_key = # hidden, use -P to show it ssl_key_password = ssl_min_protocol = TLSv1.2 ssl_options = ssl_prefer_server_ciphers = no ssl_require_crl = yes ssl_verify_client_cert = no state_dir = /var/lib/dovecot stats_http_rawlog_dir = stats_writer_socket_path = stats-writer submission_client_workarounds = submission_host = submission_logout_format = in=%i out=%o submission_max_mail_size = 0 submission_max_recipients = 0 submission_relay_command_timeout = 5 mins submission_relay_connect_timeout = 30 secs submission_relay_host = submission_relay_master_user = submission_relay_max_idle_time = 29 mins submission_relay_password = submission_relay_port = 25 submission_relay_rawlog_dir = submission_relay_ssl = no submission_relay_ssl_verify = yes submission_relay_trusted = no submission_relay_user = submission_ssl = no submission_timeout = 30 secs syslog_facility = mail userdb { args = auth_verbose = default default_fields = driver = passwd name = override_fields = result_failure = continue result_internalfail = continue result_success = return-ok skip = never } valid_chroot_dirs = verbose_proctitle = no verbose_ssl = no version_ignore = no protocol lmtp { mail_plugins = " sieve" userdb { args = username_format=%n /etc/passwd driver = passwd-file name = } } protocol imap { mail_plugins = " imap_quota imap_sieve quota" } local_name sub.domain.tld { ssl_cert = </etc/pki/dovecot/certs/sub.domain.tld.pem ssl_key = # hidden, use -P to show it } local_name othersub.domain.tld { ssl_cert = </etc/dovecot/cert.othersub.domain.tld.pem ssl_key = # hidden, use -P to show it } ############################# /etc/passwd ############################# test@s32.someteststring.ml:x:14127:3625:fsadf:/home/s32/homes/test:/dev/null test-s32.someteststring.ml:x:14127:3625:fsadf:/home/s32/homes/test:/dev/null ############################# /etc/postfix/virtual ############################# test(a)s32.someteststring.ml test-s32.someteststring.ml #############################

1 0

submissiond xoauth2 authentication: line too long
by Tobias Florek 04 Jan '23

04 Jan '23

Hi, I am running the latest container image which has dovecot-submissiond 2:2.3.20-3+debian11 I am running into the following problem. I have successfully set up xoauth2 for IMAP and ManageSieve. Now when roundcube tries to send email to submissiond it fails with 500 5.5.2 Line too long This happens right after roundcube sends AUTH XOAUTH2 dXNlcj10ZkBzY2hhZWZmZXItYWcu[...] (a line of length 2149 characters). Reading RFC 4954, section 4 I suppose that this does not look standard compliant. Am I correct? I will raise this issue with roundcube as well. Cheers, Tobi

1 1

CRAM MD5 passwd db permission issue
by Gerben Wierda 04 Jan '23

04 Jan '23

I am busy migrating. I am moving from macOS+MacPorts to Ubuntu+Docker On the old system, I have this in the dovecot config: mail_uid = _dovecot mail_gid = mail mail_privileged_group = mail mail_access_groups = mail This seems weird to me, I think the dovecot user should be in group dovecot only if I understand the docs. On the old system dovecot, postfix, dovenull and rspamd are all members of the mail group. On that system, the cram md5 passwd database (file) has these permissions: drwxr-xr-x 3 root wheel 96 Feb 2 2021 . drwxr-xr-x 22 root admin 704 Jan 4 15:17 .. -rw-r----- 1 root mail 1234 Feb 2 2021 cram-md5.pwd and that has worked like that for many years, basically starting with Mac OS X Server, surviving all kinds of macOS migrations. On my new Ubuntu system I've copied this setup over: drwxr-xr-x 2 root root 4096 Jan 4 09:49 . drwxr-xr-x 7 root root 4096 Jan 4 15:21 .. -rw-r----- 1 root mail 1234 Feb 2 2021 cram-md5.pwd mail_uid = dovecot mail_gid = mail mail_privileged_group = mail mail_access_groups = mail But: Jan 04 15:40:08 auth: Error: passwd-file /etc/dovecot/etc/cram-md5.pwd:open(/etc/dovecot/etc/cram-md5.pwd) failed: Permission denied (euid=91(dovecot) egid=91(dovecot) missing +r perm: /etc/dovecot/etc/cram-md5.pwd, we're not in group 8(mail), dir owned by 0:0 mode=0755) And really, dovecot is in group mail. From /etc/group: mail:x:8:postfix,dovecot dovenull:x:90: dovecot:x:91: And from /etc/passwd: dovenull:x:90:90::/home/dovenull:/usr/sbin/nologin dovecot:x:91:91::/home/dovecot:/usr/sbin/nologin So, that I get this error baffles me. Gerben Wierda (LinkedIn <https://www.linkedin.com/in/gerbenwierda>) R&A IT Strategy <https://ea.rna.nl/> (main site) Book: Chess and the Art of Enterprise Architecture <https://ea.rna.nl/the-book/> Book: Mastering ArchiMate <https://ea.rna.nl/the-book-edition-iii/>

2 1

doveadm proxy list has strange entries
by Tobias Florek 02 Jan '23

02 Jan '23

Hi! I am using dovecot from the latest docker image: Version 2:2.3.20-3+debian11 When getting the proxy list I get the following entries. # doveadm -f flow proxy list username=user(a)example.com proto=imap src ip=10.254.0.13 dest ip=172.23.6.194 port=143 username=username proto=service src ip=src-ip dest ip=dest-ip port=dest-port username=user2(a)example.com proto=imap src ip=10.254.0.13 dest ip=172.23.6.194 port=143 username=username proto=service src ip=src-ip dest ip=dest-ip port=dest-port username=user3(a)example.com proto=imap src ip=10.254.0.13 dest ip=172.23.6.194 port=143 username=username proto=service src ip=src-ip dest ip=dest-ip port=dest-port ... These correspond to the http API's response: # curl -H "Authorization: X-Dovecot-API $(echo -n MY_API_KEY|base64 -w0)" http://localhost:8080/doveadm/v1 -H "Content-Type: application/json" -d '[["proxyList",{},"tag1"]]' | jq [ [ "doveadmResponse", [ { "username": "user(a)example.com", "service": "imap", "src-ip": "10.254.0.13", "dest-ip": "172.23.6.194", "dest-port": "143" }, { "username": "username", "service": "service", "src-ip": "src-ip", "dest-ip": "dest-ip", "dest-port": "dest-port" }, ... ], "tag1" ] ] This does not look right. Cheers, Tobias Florek

3 2

Error: Failed to get quota resource STORAGE: quota-fs: quotactl(Q_GETQUOTA, NFS:/home) failed: No such file or directory
by Jorge Concha C. 01 Jan '23

01 Jan '23

Hello everyone, I'm migrating my dovecot (imap) server from CentOS-6 to RockyLinux-9, but I can't get the QUOTA-FS plugin to work. When trying the "doveadm quota get -u user" command, it returns an error "doveadm(user): Error: Failed to get quota resource STORAGE: quota-fs: quotactl(Q_GETQUOTA, nfs:/home) failed: No such file or directory" If the user has his "$home" on a local drive, everything works fine, but if the user has his $home on a nfs-filesystem, it throws that error. On CentOS-6, everything works fine, with the same users on the same nfs-filesystem. I don't know if it is the product of the OS change or the dovecot version change. CentOS6 -> Dovecot 2.2.10 RockyLinux-9 -> Dovecot 2.3.16 Does anyone have any ideas? Thanks -- Jorge Concha C. Área de Sistemas - CEC U. de Chile

3 12

Iteration failure on passwd-file when listing all users?
by EML 31 Dec '22

31 Dec '22

Dovecot 2.3.16, Ubuntu 22.04. I'm trying to get a list of all dovecot users, on a simple test setup on my local network (which "works", in that I can get IMAP mails from dovecot): passdb { driver = passwd-file args = /var/mail/vhosts/%d/shadow } userdb { driver = passwd-file args = /var/mail/vhosts/%d/passwd } The command 'doveadm user -u foo(a)example.com' correctly shows that user. However, any attempt to wildcard the user fails: # doveadm user -u *(a)example.com Error: auth-master: userdb list: User listing returned failure Fatal: user listing failed The log file shows Error: conn unix:auth-worker (pid=13471,uid=129): auth-worker<1>: passwd-file(*(a)example.com): passwd-file: User iteration isn't currently supported with %variable paths Any ideas? And, if I can get this to work, is this method any better than just reading /var/mail/vhosts/example.com/passwd and extracting the first field to get the user name? Or just finding all the maildir directories in /var/mail/vhosts/example.com? Thanks. If you're interested, I'm doing this so that I can automate postfix setup (by mapping new addresses to known dovecot users in the postfix virtual mailbox file). The vmailbox file might look like: # 'user1' is a known dovecot user foo(a)example.com example.com/user1

3 6

Permissions issue with doveadm mailbox command
by James Moe 31 Dec '22

31 Dec '22

I have been exploring dovecot and came across this: $ sudo doveadm mailbox list doveadm(root): Error: Mail access for users with UID 303 not permitted (see first_valid_uid in config file, uid from mail_uid setting). Hmm. After setting "first_valid_uid = 300": $ sudo doveadm mailbox list doveadm(root)<4380><4VP8EENer2McEQAAvbJltg>: Error: chdir(/root/) failed: Permission denied (euid=303(vmail) egid=303(vmail) missing +x perm: /root, dir owned by 0:0 mode=0700) INBOX I do not understand the error message. The current configuration. (Note I have changed first_valid_uid to its original value.) $ postconf -n # 2.3.15 (0503334ab1): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.15 (e6a84e31) # OS: Linux 5.14.21-150400.24.33-default x86_64 btrfs # Hostname: sma-server3.sma.com auth_mechanisms = plain login base_dir = /var/run/dovecot/ debug_log_path = /data01/var/log/dovecot/dovecot-debug.log disable_plaintext_auth = no first_valid_uid = 1001 info_log_path = /data01/var/log/dovecot/dovecot-info.log log_path = /data01/var/log/dovecot/dovecot.log log_timestamp = %Y-%m-%dT%H:%M:%S mail_gid = vmail mail_location = maildir:/var/mail/vmail/%u/ mail_uid = vmail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { driver = pam } passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } plugin { sieve = file:~/sieve;active=~/.dovecot.sieve } protocols = imap service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } } service log { group = users user = dovecot } ssl = no ssl_cipher_list = ALL:!aNULL:!eNULL:!EXPORT:!DES:!3DES:!MD5:!PSK:!RC4:!ADH:!LOW@STRENGTH ssl_options = no_compression ssl_prefer_server_ciphers = yes userdb { driver = passwd } userdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } -- James Moe moe dot james at sohnen-moe dot com 520.743.3936 Think.

2 1

Permissions for dovecot logging
by James Moe 31 Dec '22

31 Dec '22

dovecot 2.3.15 opensuse LEAP 15.4 I changed logging to use a path rather than syslog. Doing so makes it easier to work with fail2ban. Dovecot fails to start with the error: Can't open log file /data01/var/log/dovecot.log: Permission denied Permissions: drwxrwxr-x 1 root users 104 Feb 25 2018 /data01/ drwxrwxr-x 1 sma-user3x users 102 Dec 17 14:50 /data01/var/ drwxrwxr-x 1 sma-user3x users 146 Dec 27 15:37 /data01/var/log/ drwxrwxr-x 1 dovecot users 22 Dec 27 15:47 /data01/var/log/dovecot/ "dovecot" is a member of "users". What "permission" am I missing? Note: A long time ago I had a problem with programs consuming all available space on the system disk with log or backup files. I have since gotten in the habit of putting log files on a non-system disk. -- James Moe moe dot james at sohnen-moe dot com 520.743.3936 Think.

4 6

Self hosting solution for Christmas
by Andre Rodier 29 Dec '22

29 Dec '22

Hello everyone, Here my present for Christmas: a new version of HomeBox, the self hosted email solution. Feel free to drop comments, create issues, update the docs, etc. I released this quickly before going on vacation, so you may find some issues. However, this is mostly stable, and the code is easy to modify. Also, you can now add and remove components individually, with an Ansible playbook. https://github.com/progmaticltd/homebox System installation and features - Custom Debian installer generation with full disk encryption and fully automatic installation. - Unlock the system upon boot by entering the passphrase through SSH. - Install packages only from Debian stable (Bullseye). - Automatic letsencrypt certificates generation using Lego and DNS challenge. - Automatic security updates (optional). - Centralised authentication with an LDAP users database, SSL certificate, password policies, PAM integration. - AppArmor activated with a profile for all daemons. - XKCD Random passwords generated and saved into pass (or on file system). - Can be used at home, on a dedicated or virtual server hosted online. - Flexible IP address support: IPv4 only, IPv6 only, and IPv4+IPv4 or IPv4+IPv6. - Embedded DNS server, with CAA, DNSSEC and SSHFP (SSH fingerprint) support. - Grade A https sites, HSTS implemented by default. - Automatic configuration of OpenPGP Web Key Directory. - Automatic firewall rules for inbound, outbound and forwarding traffic, using nftables. - Restricted outbound web sites access to the minimum. - Automatic update of DNS keys, DNS servers and glue records on Gandi. Emails - Postfix configuration and installation, with LDAP lookups, internationalised email aliases, fully SSL compliant. - Generate DKIM keys, SPF and DMARC DNS records. The DKIM keys are generated every year. - Automatic copy of sent emails into the sent folder. - Automatic creation of the postmaster account and special email addresses using RFC 2142 specifications. - Dovecot configuration, IMAPS, POP3S, Quotas, ManageSieve. - Simple spam and ham learning by moving emails in and out the Junk folder - Sieve and vacation scripts. - Virtual folders for server search: unread messages, conversations view, all messages, flagged and messages labelled as "important". - Email addresses with recipient delimiter included, e.g. john.doe+lists(a)dbcooper.com. - Optional master user creation, e.g. for families with children or moderated communities. - Server side full text search inside emails, attached documents and files and compressed archives, with better results than GMail. - SOGo webmail with sieve filters management, password change form, Calendar and Address book management, GUI to import other account emails. - Powerful and light antispam system with rspamd and optional access to the web interface. - Antivirus for inbound and outbound emails with clamav (optional). - Automatic configuration for Thunderbird and Outlook using published XML and other clients with special DNS records (RFC 6186). Calendar and Address book - Install and configure a CalDAV / CardDAV server, with automatic discovery (RFC 6186). - Groupware functionality in a web interface, with SOGo. - Recurring events, email alerts, shared address books and calendars. - Mobile devices compatibility: Android, Apple iOS, BlackBerry 10 and Windows mobile through Microsoft ActiveSync. Other optional features - Incremental backups, encrypted, on multiple destination (SFTP, S3, Samba share or USB drive), with email and Jabber reporting. - Jabber server, using ejabberd, with LDAP authentication, direct or offline file transfer and optional server to server communication. - Static web site skeleton configuration, with https certificates and A+ security grade by default. Development - YAML files validation on each commit, using travis-ci. - End to end integration tests for the majority of components. - Playbooks to facilitate the installation or removal of development packages. - Global debug flag to activate the debug mode of all components. - Fully open source Ansible scripts licensed under GPLv3. Merry Christmas, André

4 7

Sieve duplicates
by Ferenc 28 Dec '22

28 Dec '22

Hi list, I’m trying this again from a different account because of lots of SPF warnings. I have Sieve scripts that duplicate e-mails. I don’t want that. My dovecot version is 2.3.4.1 (f79e8e7e4), Pigeonhole version 0.5.4 on Linux 5.4.189-2-pve x86_64 Debian 10.13. My scripts get called on an imap COPY action (imapsieve extension). The mail is fed to an external script (spam/ham training or retraining) via a pipe :copy action (vnd.dovecot.pipe extension). An header is added to keep track of what happened (editheader extension). I use "if header :contains” for my (simple) logic. If contains header X, do this, add header Y. If contains header Y, do that, add header X. I end each "if” part with “keep;" and “stop;” commands. Simple versions of the scripts, without the if-then construct, seem to work ok with imapsieve. As soon as I try to use if-then-else I find a duplicate of the processed e-mail; the original mail seems to be untouched, the duplicate appears to have been processed. With macos mail not all duplicates show up but with Roundcube webmail I can see them all. The scripts are like this: # without if-then require … pipe :copy … addheader … keep; # with if-then require … if header :contains pipe :copy … addheader … keep; stop; if not exists pipe :copy … addheader … keep; stop; keep; The scripts get called from “imapsieve_mailbox1_before” for example. Cheers, Ferenc

2 2

Dovecot v2.3.20 released
by Aki Tuomi 28 Dec '22

28 Dec '22

We are pleased to release v2.3.20 of Dovecot. https://dovecot.org/releases/2.3/dovecot-2.3.20.tar.gz https://dovecot.org/releases/2.3/dovecot-2.3.20.tar.gz.sig Binary packages in https://repo.dovecot.org/ Docker images in https://hub.docker.com/r/dovecot/dovecot Regards, Aki Tuomi Open-Xchange oy -- + Add dsync_features=no-header-hashes. When this setting is enabled and one dsync side doesn't support mail GUIDs (i.e. imapc), there is no fallback to using header hashes. Instead, dsync assumes that all mails with identical IMAP UIDs contains the same mail contents. This can significantly improve dsync performance with some IMAP servers that don't support caching Date/Message-ID headers. + lua: HTTP client has more settings now, see https://doc.dovecot.org/admin_manual/lua/#dovecot.http.client + replicator: "doveadm replicator status" command now outputs when the next sync is expected for the user. - LAYOUT=index: duplicate GUIDs were not cleaned out. Also the list recovery was not optimal. - auth: Assert crash would occur when iterating multiple userdb backends. - director: Logging into director using master user with auth_master_user_separator character redirected user to a wrong backend, unless master_user_separator setting was also set to the same value. Merged these into auth_master_user_separator. - dsync: Couldn't always fix folder GUID conflicts automatically with Maildir format. This resulted in replication repeatedly failing with "Remote lost mailbox GUID". - dsync: Failed to migrate INBOX when using namespace prefix=INBOX/, resulting in "Remote lost mailbox GUID" errors. - dsync: INBOX was created too early with namespace prefix=INBOX/, resulting a GUID conflict. This may have been resolved automatically, but not always. - dsync: v2.3.18 regression: Wrong imapc password with dsync caused Panic: file lib-event.c: line 506 (event_pop_global): assertion failed: (event == current_global_event) - imapc: Requesting STATUS for a mailbox with imapc and INDEXPVT configured did not return correct (private) unseen counts. - lib-dict: Process would crash when committing data to redis without dict proxy. - lib-mail: Corrupted cached BODYSTRUCTURE caused panic during FETCH. Fixes: Panic: file message-part-data.c: line 579 (message_part_is_attachment): assertion failed: (data != NULL). v2.3.13 regression. - lib-storage: mail_attribute_dict with dict-sql failed when it tried to lookup empty dict keys. - lib: ioloop-kqueue was missing include breaking some BSD builds. - lua-http: Dovecot Lua HTTP client could not resolve DNS names in mail processes, because it expected "dns-client" socket to exist in the current directory. - oauth2: Using %{oauth2:name} variables could cause useless introspections. - pop3: Sending POP3 command with ':' character caused an assert-crash. v2.3.18 regression. - replicator: Replication queue had various issues, potentially causing replication requests to become stuck. - stats: Invalid Prometheus label names were created with specific

5 7

Happy Holidays From SCOM.CA Internet Services Inc.
by Paul Kudla 23 Dec '22

23 Dec '22

1 0

Pigeonhole v0.5.20 released
by Aki Tuomi 22 Dec '22

22 Dec '22

We are pleased to release v0.5.20 of Pigeonhole. https://pigeonhole.dovecot.org/releases/2.3/dovecot-2.3-pigeonhole-0.5.20.t… https://pigeonhole.dovecot.org/releases/2.3/dovecot-2.3-pigeonhole-0.5.20.t… Binary packages in https://repo.dovecot.org/ Docker images in https://hub.docker.com/r/dovecot/dovecot Regards, Aki Tuomi Open-Xchange oy -- * No changes - release done to keep version numbers synced.

1 0

OT: Two simultaneous POP3 connections from Outlook
by kjohnson＠eclypse.org 21 Dec '22

21 Dec '22

Hello, I recognize this may be somewhat off-topic, but my search-fu has failed to provide useful results, so I ask for pointers to further information. Today, while examining Dovecot logs, I found a case where the Outlook mail client (probably 2016 or later) on a user's computer opened two simultaneous, or at least overlapping, POP3 connections to Dovecot. This did not go well, naturally. Warning: Transaction log file .../mail/.imap/INBOX/dovecot.index.log was locked for 156 seconds (rotating while syncing) If anyone else has found useful information about this peculiar behavior for an email client, I would be pleased to receive a pointer in that direction. Thank you. Ken

2 1

How is URLAUTH broken, and for how long?
by Andy Balholm 21 Dec '22

21 Dec '22

The documentation for imap_urlauth_host says: > Warning > > URLAUTH in current versions of Dovecot is broken in several ways. > This will be fixed in the future, but activating URLAUTH support > on production systems is not recommended. In what ways is it broken? Is anyone actually working on fixing it? Andy

1 0

Re: SPF DNS Error / R_SPF_DNSFAIL
by Jochen Bern 20 Dec '22

20 Dec '22

On 19.12.22 13:20, Carlos Mogas da Silva wrote: > On Mon, 2022-12-19 at 12:38 +0100, Benny Pedersen wrote: >> Carlos Mogas da Silva skrev den 2022-12-19 11:57: >>> What can cause this error and/or how can I debug it? >> >> try avoid to many dns querys > > Even on a caching dns server? Any ideas on why it is failing? I don't remember it being in an actual RFC, but SPF records are supposed to not require more than 10 DNS queries to fully resolve. https://dmarcian.com/spf-survey/ gives cttexpresso.pt an all-green result, but notes that the "+a:email.reditus.pt" part is inoperational ("no A or AAAA RRs found", in fact, I'm getting an NXDOMAIN for the FQDN). Regards, -- Jochen Bern Systemingenieur Binect GmbH

1 0

SPF DNS Error / R_SPF_DNSFAIL
by Carlos Mogas da Silva 20 Dec '22

20 Dec '22

Hi list. My incoming messages are getting R_SPF_DNSFAIL and an error on the Authentication-Results header: spf=temperror (mail01.r3pek.org: error in processing during lookup of no-reply(a)cttexpresso.pt: DNS error) I see the DNS request on my DNS server and a "working" reply going out. What can cause this error and/or how can I debug it?

4 6

mail filters
by mick.crane 20 Dec '22

20 Dec '22

I'm using what ever is in Debian Bookworm, I'm pretty sure. These filters? I collect from different email addresses like gmail and that. If filter for the "Sent to" email address, move to this directory If "From" contains "blah", move to this other directory. If something is Sent to and also From contains "blah" then I get 2 copies of the message in both filter directories. How can I fix this? regards mick

5 6

feature request: add base64 variable modifier
by alex 19 Dec '22

19 Dec '22

Hi, It would be very convenient to have a base64 variable modifier. Main use-case is to base64-encode passwords when changing your hashing scheme. With a base64 encoding modifier (e.g. %B) something like this would safely work: userdb { driver = prefetch default_fields = plain_pass=%Bw } without things breaking when there are %-characters in the password, and without having to send the plaintext password to the database, as current solutions propose, which is never a good idea. alternative solution: adapt the generic hash-modifier to accept a none/plaintext hashing-scheme and use the base64 output functionality that is already available there. Thanks! Alex

1 0

What do I do with the ".ext?"
by James Moe 18 Dec '22

18 Dec '22

dovecot 2.3.15 opensuse LEAP 15.4 I am installing dovecot and have postfix as the SMTP agent. It also needs to use a MySQL database. In </etc/dovecot> there is the main dovecot.conf file, and a number of other files with the extension ".conf.ext." It is not clear how to use these. I could nothing in the documentation that discusses it. Do I copy one, say dovecot-sql.conf.ext, modify it: - rename the copy without the ".ext?" - or move the copy to the "conf.d" directory, with or without the "ext?" -- James Moe moe dot james at sohnen-moe dot com 520.743.3936 Think.

2 2

2.3.14: stale imap-login processes due to bogus user setup tying up process limit
by Volker Stolz 16 Dec '22

16 Dec '22

I just dealt with an interesting Dovecot issue on our small server, and thought I might share it. I also feel that although in the end it was a configuration error, Dovecot should somehow avoid leaving this processes around and hence filling up the process limit quickly. - set up Dovecot IMAP on Debian buster (either with the older 2.3.x Debian package, or 2.3.14 from the dovecot-repo) - config: ... namespace inbox { inbox = yes location = ... default settings ... ... passdb { args = scheme=HMAC-MD5 username_format=%u /etc/dovecot/users driver = passwd-file } protocols = " imap" ... userdb { args = blocking=no driver = passwd } ... - secret sauce: have a user in the passdb that doesn't have a physical account on the system yet (we were migrating to a new machine). The log-file shows successful authentication for that user (after we flipped DNS to point to this new machine), but over time (2-3 times/day) we were left with an increasing number of `imap-login` processes in state `pre-login`, eventually requiring a dovecot restart. Dialling up process_limits didn't seem to help, we'd just get more of these stale processes. After creating the user on the system, the behaviour reverted to normal, no more stale processes. I do not know what error message that user received on their end, but since we announced we were migrating, they probably just ignored it and thought it as part of the transition. Best, Volker (a happy & long Dovecot user)

3 4

Re: Can't figure out why managesieve (pigeonhole) can't connect
by colin＠colinlikesfood.com 15 Dec '22

15 Dec '22

thank you again. it seems you have seen my paste of config.inc.php. I do not have a config.php: my_user@some_host:/usr/local/www/roundcube/config # ls -l total 67 -rw-r--r-- 1 root wheel 164 Jul 23 15:17 .htaccess -rw-r--r-- 1 root wheel 1867 Nov 22 15:12 config.inc.php -rw-r--r-- 1 root wheel 2943 Jul 23 15:17 config.inc.php.sample -rw-r--r-- 1 root wheel 63790 Oct 29 20:24 defaults.inc.php -rw-r--r-- 1 root wheel 2806 Jul 23 15:17 mimetypes.php my_user@some_host:/usr/local/www/roundcube/config # I have tried changing tls:// to ssl:// and back again (in the line $config['managesieve_host'] = 'tls://obfuscated.domain';) but the error remains the same: roundcube: PHP Error: Connection refused (GET /index.php?_task=settings&_action=plugin.managesieve) roundcube: PHP Error: Unable to connect to managesieve on obfuscated.domain:4190 in /usr/local/www/roundcube/plugins/managesieve/lib/Roundcube/rcube_sieve_engine.php on line 221 (GET /index.php?_task=settings&_action=plugin.managesieve) roundcube: PHP Error: Not currently in AUTHORISATION state (GET /index.php?_task=settings&_action=plugin.managesieve) php: PHP Error: Not currently connected (GET /index.php?_task=settings&_action=plugin.managesieve) roundcube: PHP Error: Connection refused (GET /index.php?_task=settings&_action=plugin.managesieve-action&_framed=1&_nav=hide) roundcube: PHP Error: Unable to connect to managesieve on obfuscated.domain:4190 in /usr/local/www/roundcube/plugins/managesieve/lib/Roundcube/rcube_sieve_engine.php on line 221 (GET /index.php?_task=settings&_action=plugin.managesieve-action&_framed=1&_nav=hide) php: PHP Error: Not currently connected (GET /index.php?_task=settings&_action=plugin.managesieve-action&_framed=1&_nav=hide) roundcube: PHP Error: Connection refused (POST /?_task=settings&_action=plugin.managesieve-save) roundcube: PHP Error: Unable to connect to managesieve on obfuscated.domain:4190 in /usr/local/www/roundcube/plugins/managesieve/lib/Roundcube/rcube_sieve_engine.php on line 221 (POST /?_task=settings&_action=plugin.managesieve-save) i don't understand why it can't connect, this seems to work fine: # gnutls-cli --tofu --starttls -p 4190 10.0.0.91 Processed 142 CA certificate(s). Resolving '10.0.0.91:4190'... Connecting to '10.0.0.91:4190'... - Simple Client Mode: "IMPLEMENTATION" "dovecot" "SIEVE" "fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext" "NOTIFY" "mailto" "SASL" "CRAM-MD5" "STARTTLS" "VERSION" "1.0" OK "Dovecot ready." STARTTLS OK "Begin TLS negotiation now." *** Starting TLS handshake - Certificate type: X.509 - Got a certificate list of 3 certificates. - Certificate[0] info: - subject `CN=obfuscated.domain.com', issuer `CN=R3,O=Let's Encrypt,C=US', serial xxxxxxxxxxxxxxxxxxxxxx, RSA key 2048 bits, signed using RSA-SHA256, activated `yyyy-mm-dd 17:48:15 UTC', expires `yyyy-mm-dd 17:48:14 UTC', pin-sha256="xxxxxxxxxxxxxxxxxxxxxx" Public Key ID: sha1:xxxxxxxxxxxxxxxxxxxxxx sha256:xxxxxxxxxxxxxxxxxxxxxx Public Key PIN: pin-sha256:xxxxxxxxxxxxxxxxxxxxxx - Certificate[1] info: - subject `CN=R3,O=Let's Encrypt,C=US', issuer `CN=ISRG Root X1,O=Internet Security Research Group,C=US', serial xxxxxxxxxxxxxxxxxxxxxx, RSA key 2048 bits, signed using RSA-SHA256, activated `yyyy-mm-dd 00:00:00 UTC', expires `yyyy-mm-dd 16:00:00 UTC', pin-sha256="xxxxxxxxxxxxxxxxxxxxxx" - Certificate[2] info: - subject `CN=ISRG Root X1,O=Internet Security Research Group,C=US', issuer `CN=DST Root CA X3,O=Digital Signature Trust Co.', serial yyyy-mm-dd, RSA key 4096 bits, signed using RSA-SHA256, activated `yyyy-mm-dd 19:14:03 UTC', expires `yyyy-mm-dd 18:14:03 UTC', pin-sha256="xxxxxxxxxxxxxxxxxxxxxx" - Status: The certificate is NOT trusted. The name in the certificate does not match the expected. *** PKI verification of server certificate failed... Host 10.0.0.91 (sieve) has never been contacted before. Its certificate is valid for 10.0.0.91. Are you sure you want to trust it? (y/N): y - Description: (TLS1.3-X.509)-(ECDHE-SECP256R1)-(RSA-PSS-RSAE-SHA256)-(AES-256-GCM) - Session ID: xx:yy:xx:yy:xx:yy... - Options: "IMPLEMENTATION" "dovecot" "SIEVE" "fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext" "NOTIFY" "mailto" "SASL" "CRAM-MD5" "VERSION" "1.0" OK "TLS negotiation successful." On 2022-11-23 13:35, Yassine Chaouche wrote: > also make sure your are editing config.php and not config.inc.php > (which you pasted) > > Yassine. > > Le 23 novembre 2022 8:30:36 PM GMT+01:00, Yassine Chaouche > <a.chaouche(a)algerian-radio.dz> a écrit : > >> good. we have established that the problem shouldn't be on dovecot's >> side. i suspect roundcube is misconfigured or can't connect for some >> reason. I believe someone mentioned SSL and TLS support problem in RC >> for a specific version? can you try without? also can you paste RC >> config? >> >> Yassine.

5 6

Kerberos/GSSAPI auth weirdness?
by r3pek 14 Dec '22

14 Dec '22

Hi list! I'm migrating my server into a new REALM (INT.R3PEK.ORG) from an old one (R3PEK.ORG) This is a completely new install and configuration, so no leftovers exits. The machine is correctly register into the REALM and users are able to login without a problem. Now, when I try to login using a Kerberos ticket, for some reason that I can't understand, dovecot is looking for a ticket on the old REALM. Maybe because of the email domain (which stayed the same)? This is the error message I see on the clients: "Failed to authenticate: Server krbtgt/R3PEK.ORG(a)INT.R3PEK.ORG" The one it should be looking for is krbtgt/INT.R3PEK.ORG(a)INT.R3PEK.ORG, but I can't seem to figure out where the problem is. # doveconf | grep -i realm auth_default_realm = INT.R3PEK.ORG auth_realms = INT.R3PEK.ORG What do I need to change to make this work?

1 0

sasl service for other app
by Henry R 13 Dec '22

13 Dec '22

can dovecot run as a general sasl service for other apps? such as webdav. Thanks.

6 10

Backups
by Doug Hardie 11 Dec '22

11 Dec '22

I started to investigate using doveadm backup to backup my mail system. I have a small number of users and the mail store is not large. It uses maildir format. I setup a test system that is not connected to the internet and started up dovecot. I used the following command to backup one user: doveadm backup -u ben remote:test ben is the user is in the mail store. Test is the actual server name. That worked just fine. The maildir was copied completely (as best as I can tell with ls). Then I tried the second user: doveadm backup -u jean remote:test This gives 2 error messages: doveadm(jean)[]<McRYOFI0jGN1MwAAmC+70w>: Error: Mailbox INBOX: Failed to get attribute vendor/vendor.dovecot/pvt/server/sieve/files/.dovecot: Mailbox attributes not enabled doveadm(jean)[]<0IwxIlI0jGMgUwAAZU03Dg>: Error: Remote command returned error 65: ssh test doveadm dsync-server -ujean -U In addition, the maildir directories are created, but there are no emails in any of them (e.g., cur). What is the problem with the 2nd and why does it behave differently from the first? -- Doug

4 8

Sieve duplicates
by Ferenc 09 Dec '22

09 Dec '22

Hi list, I have Sieve scripts that unintentionally duplicate e-mails. My dovecot version is 2.3.4.1 (f79e8e7e4), Pigeonhole version 0.5.4 on Linux 5.4.189-2-pve x86_64 Debian 10.13. My scripts get called on an imap COPY action (imapsieve extension). The mail is fed to an external script (spam/ham training) via a pipe :copy action (vnd.dovecot.pipe extension). An header is added to keep track of what happened (editheader extension). I use "if header :contains” for my (simple) logic. If contains header X, do this, add header Y. If contains header Y, do that, add header X. I end each "if” part with keep; and stop; commands. Simple versions of this script, without the if-then construct, seem to work ok. As soon as I try to use if-then-else I find a duplicate of the processed e-mail; one that seems to be untouched, one that appears to have been processed. I hope I’m making myself clear… # without if-then require … pipe :copy … addheader … keep; # with if-then require … if header :contains pipe :copy … addheader … keep; stop; if not exists pipe :copy … addheader … keep; stop; keep; The scripts get called from for instance imapsieve_mailbox1_before. Cheers, Ferenc

1 0

Seen Flags per User
by Maurice Kunze 08 Dec '22

08 Dec '22

Hello, i want to configure seen flags per user for shared public mailboxes in dovecot. I have added the INDEVPVT Option to the location parameter in the namespace and restarted the services and the server. Unfortunately nothing changed and there are still global seen flags in the configuration. In a post i read that i have to manually add some files to the location but this isnt specified in the documentation. below is the version we use and the config. dovecot --version 2.3.13 (89f716dc2) dovecot -n # 2.3.13 (89f716dc2): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.13 (cdd19fe3) # OS: Linux 5.10.0-17-amd64 x86_64 Debian 11.4 ext4 # Hostname: <SERVERNAME> auth_debug = yes auth_debug_passwords = yes auth_verbose = yes auth_verbose_passwords = plain mail_debug = yes mail_gid = vmail mail_location = maildir:/var/mail/user mail_plugins = acl mail_privileged_group = vmail mail_uid = vmail namespace { list = yes location = maildir:/var/mail/public:INDEXPVT=/var/mail/public prefix = public/ separator = / subscriptions = no type = public } namespace { list = yes location = maildir:/var/mail/user/%u/Maildir:INDEX=/var/mail/user/%u/shared/%u:CONTROL=/var/mail/user/%u/shared/%u prefix = shared/%%u/ separator = / subscriptions = no type = shared } namespace inbox { hidden = no inbox = yes list = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = separator = / subscriptions = yes type = private } passdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } plugin { acl = vfile acl_anyone = allow acl_shared_dict = file:/var/mail/database/shared-mailboxes.db } protocols = " imap" service stats { unix_listener stats-reader { group = vmail mode = 0660 user = vmail } unix_listener stats-writer { group = vmail mode = 0660 user = vmail } } ssl_cert = </var/ssl/dove.crt ssl_client_ca_dir = /etc/ssl/certs ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } protocol imap { mail_plugins = acl imap_acl }

2 5

access dict in lua auth script
by Tobias Florek 08 Dec '22

08 Dec '22

Hi! I want to access a configured dictionary in a lua authentication script. Unfortunately the documentation <https://doc.dovecot.org/admin_manual/lua/> does mention a dict object but no way to get one. I also did not find any lua tests in dovecot's source code. Is using the built-in dict not supported? Cheers, Tobias Florek

2 2

moving messages between namespaces go into purge
by Marc 07 Dec '22

07 Dec '22

I think it would be nice to have an option where the moving of messages between namespaces (by automated server scripts) would not result in messages ending up in the 'purge' queue. Currently when you move these copied messages, they end up in the purge queue combined with messages that users deleted. I am more or less forced to purge the mailbox after moving GB's while I prefer not to do this, because I would like to keep the opportunity to recover from the purge queue. Maybe there is a way to 'deduplicate' this purge queue?

3 4

How to configure Dovecot with Keycloak correctly
by Gary Horchem 07 Dec '22

07 Dec '22

Hello I’m trying to configure Dovecot with Keycloak I’m using the proxy with password grant method. Here’s my dovecot-oauth2.plain.conf.ext grant_url = https://server-1.gary-springfield-mo.net/realms/sso/protocol/openid-connect… client_id = dovecot client_secret = WtZ5uZsBi2QPfh1EWuMWjUVGNNT4HEGR introspection_url = https://server-1.gary-springfield-mo.net/realms/sso/protocol/openid-connect… introspection_mode = post use_grant_password = yes debug = yes username_attribute = username pass_attrs = host=server-1:8181 proxy=y proxy_mech=xoauth2 pass=%{oauth2:access_token} And my dovecot-oauth2.token.conf.ext grant_url = https://server-1.gary-springfield-mo.net/realms/sso/protocol/openid-connect… client_id = dovecot client_secret = WtZ5uZsBi2QPfh1EWuMWjUVGNNT4HEGR tokeninfo_url = https://server-1.gary-springfield-mo.net/realms/sso/protocol/openid-connect… introspection_url = https://server-1.gary-springfield-mo.net/realms/sso/protocol/openid-connect… introspection_mode = post use_grant_password = no debug = yes username_attribute = username pass_attrs = pass=%{oauth2:access_token} Do I also need to configure the dovecot-oauth2.conf.ext Sent from my iPhone

2 1

lmtp with sieve editheader Panic: file edit-mail.c: line 1809 (merge_from_parent): assertion failed
by Matthias Lay 06 Dec '22

06 Dec '22

Hi, I have experienced a crash in lmtp delivery on some mails when sieve editheader plugin is used. The first one was an "analytics mail" from azure exchange. I stripped down the mail to the relevant parts that trigger this error. log message: lmtp(johnd)<27019><VM4XLJVVj2OLaQAA/TOvIg>: Error: Raw backtrace: /usr/lib/dovecot/libdovecot.so.0(backtrace_append+0x42) [0x7f3048ca0b72] -> /usr/lib/dovecot/libdovecot.so.0(backtrace_get+0x1e) [0x7f3048ca0c8e] -> /usr/lib/dovecot/libdovecot.so.0(+0xff5eb) [0x7f3048cad5eb] -> /usr/lib/dovecot/libdovecot.so.0(+0xff681) [0x7f3048cad681] -> /usr/lib/dovecot/libdovecot.so.0(+0x542c4) [0x7f3048c022c4] -> /usr/lib/dovecot/libdovecot-sieve.so.0(+0x2e11d) [0x7f304841811d] -> /usr/lib/dovecot/libdovecot.so.0(i_stream_read_memarea+0x74) [0x7f3048cb92d4] -> /usr/lib/dovecot/libdovecot.so.0(+0x10eb05) [0x7f3048cbcb05] -> /usr/lib/dovecot/libdovecot.so.0(+0x10f0a9) [0x7f3048cbd0a9] -> /usr/lib/dovecot/libdovecot.so.0(i_stream_read_memarea+0x74) [0x7f3048cb92d4] -> /usr/lib/dovecot/libdovecot.so.0(i_stream_read+0x3a) [0x7f3048cb94ba] -> /usr/lib/dovecot/libdovecot.so.0(+0x112f51) [0x7f3048cc0f51] -> /usr/lib/dovecot/libdovecot.so.0(i_stream_read_memarea+0x74) [0x7f3048cb92d4] -> /usr/lib/dovecot/libdovecot.so.0(i_stream_read+0x3a) [0x7f3048cb94ba] -> /usr/lib/dovecot/libdovecot.so.0(i_stream_read_data+0x3d) [0x7f3048cb9ddd] -> /usr/lib/dovecot/libdovecot.so.0(io_stream_copy+0x74) [0x7f3048cd28f4] -> /usr/lib/dovecot/libdovecot.so.0(o_stream_send_istream+0x4f) [0x7f3048cd25ef] -> /usr/lib/dovecot/libdovecot-storage.so.0(index_storage_save_continue+0x29) [0x7f3048e5dd39] -> /usr/lib/dovecot/libdovecot-storage.so.0(maildir_save_continue+0x20) [0x7f3048e07930] -> /usr/lib/dovecot/libdovecot-storage.so.0(mailbox_save_continue+0x3a) [0x7f3048ddff3a] -> /usr/lib/dovecot/libdovecot-storage.so.0(mail_storage_copy+0xb1) [0x7f3048dd0b71] -> /usr/lib/dovecot/libdovecot-lda.so.0(+0x475b) [0x7f3048eed75b] -> /usr/lib/dovecot/libdovecot-storage.so.0(+0x6439f) [0x7f3048de039f] -> /usr/lib/dovecot/libdovecot-sieve.so.0(+0x52ff4) [0x7f304843cff4] -> /usr/lib/dovecot/libdovecot-sieve.so.0(+0x473e9) [0x7f30484313e9] -> /usr/lib/dovecot/libdovecot-sieve.so.0(+0x482a0) [0x7f30484322a0] -> /usr/lib/dovecot/libdovecot-sieve.so.0(sieve_result_execute+0x1af) [0x7f3048432fbf] -> /usr/lib/dovecot/libdovecot-sieve.so.0(sieve_multiscript_finish+0x218) [0x7f3048446f38] -> /usr/lib/dovecot/lib90_sieve_plugin.so(+0x4030) [0x7f3048ba9030] -> /usr/lib/dovecot/libdovecot-lda.so.0(mail_deliver+0x16f) [0x7f3048eee8ef] lmtp(johnd)<27019><VM4XLJVVj2OLaQAA/TOvIg>: Fatal: master: service(lmtp): child 27019 killed with signal 6 (core dumps disabled - https://dovecot.org/bugreport.html#coredumps) the sieve script only has one addheader line require ["editheader","fileinto","body", "include"]; addheader :last "X-Long-Duration" "XXX"; I will attach doveconf and the lmtp communication. inserted to lmtp with: socat - UNIX-CONNECT:$lmtp_socket <<<"$(<$file)" greetz Matze

1 0

Sieve: fileinto a subfolder of inbox
by Federico Fanton 05 Dec '22

05 Dec '22

Hi everyone! I'm trying to write a sieve script that moves emails to a *subfolder* of the inbox. My script: require ["envelope", "fileinto", "mailbox"]; if anyof( address "to" "support(a)domain.cc", address "cc" "support(a)domain.cc", envelope "to" "support(a)domain.cc" ) { fileinto :create "INBOX.support"; } But this creates a new "support" folder BESIDE the inbox, not INSIDE it. I've tried replacing "INBOX.support" with "INBOX/support" but then I get an error: "Name must not have '/' characters" Is there something else I could try? Here is the output of dovecot -n: # 2.3.4.1 (f79e8e7e4): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.4 () # OS: Linux 4.19.0-21-amd64 x86_64 Debian 10.0 ext4 auth_mechanisms = plain login lda_mailbox_autosubscribe = yes mail_location = maildir:/home/vmail/maildir/%d/%n/Maildir mail_plugins = " zlib lazy_expunge" mail_privileged_group = vmail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext namespace { hidden = yes list = no location = maildir:/home/vmail/maildir/%d/%n/Maildir/expunged prefix = .EXPUNGED/ separator = / } namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { driver = pam } passdb { args = scheme=SHA1 /etc/dovecot/users.conf driver = passwd-file } plugin { lazy_expunge = .EXPUNGED/ sieve = file:~/sieve;active=~/.dovecot.sieve sieve_vacation_default_period = 1d sieve_vacation_to_header_ignore_envelope = yes } protocols = imap sieve service auth { executable = /usr/lib/dovecot/auth unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } unix_listener /var/spool/postfix/private/dovecot-auth { group = postfix mode = 0660 user = postfix } unix_listener auth-master { group = vmail mode = 0600 user = vmail } } service doveadm { inet_listener { port = 24242 } } service imap-login { process_limit = 200 } service stats { unix_listener stats-reader { group = vmail mode = 0660 user = vmail } unix_listener stats-writer { group = vmail mode = 0660 user = vmail } } ssl_cipher_list = ALL:!LOW:!SSLv2:ALL:!aNULL:!ADH:!eNULL:!EXP:RC4+RSA:+HIGH:+MEDIUM ssl_client_ca_dir = /etc/ssl/certs ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { driver = passwd } userdb { args = uid=1001 gid=1001 home=/home/vmail/maildir/%d/%n allow_all_users=yes driver = static } protocol lda { mail_plugins = " zlib lazy_expunge sieve" } protocol imap { imap_client_workarounds = delay-newmail mail_max_userip_connections = 20 } local 192.168.2.0/24 { doveadm_allowed_commands = sieve list,sieve get,sieve put,sieve activate,sieve deactivate doveadm_password = # hidden, use -P to show it } Many thanks for your time!

3 4

Backups and disaster recovery
by GDS 04 Dec '22

04 Dec '22

Hello all! After reading some of the past threads on backups, I was wondering if I could get a sanity check... I run a Maildir configuration for a small (10 mailboxes) mail server. Using "doveadm backup", for each mailbox I do: - Weekly full backups and then copy the files to a network-based filesystem.- Daily incremental backups and then copy the files to a network-based filesystem. My recovery assumption is that in case of hardware failure, I would re-set up the mail service and for each mailbox I will recover at the right directory the latest full mailbox backup and on top of it, each incremental backup to the latest day. Does this sound like a sound strategy? Also, I was thinking of setting up a second dovecot server on another server and replicating my primary on an hourly basis to decrease recovery time. But I looked at mbsync and it seems to require mailbox login/password for each mailbox (which I don't have). Is there an alternative? Thank you!

4 4

HIGHESTMODSEQ not increasing
by Ronny Forberger 04 Dec '22

04 Dec '22

Hi, I have a problem with my Dovecot IMAP Server on Debian Linux. I migrated it from FreeBSD to Debian, but since then the HIGHESTMODSEQ value for INBOX is not increasing, when I receive new e-mail. This causes my Groupware not to report any new e-mail via ActiveSync. Here is the protocol transscript: [I] <~>-> openssl s_client -crlf -connect mail.forberger-online.de:993 CONNECTED(00000003) [...] --- read R BLOCK * OK [CAPABILITY IMAP4rev1 SASL-IR LOGIN-REFERRALS ID ENABLE IDLE LITERAL+ AUTH=PLAIN AUTH=LOGIN] Dovecot (Debian) ready. A LOGIN REDACTED REDACTED A OK [CAPABILITY IMAP4rev1 SASL-IR LOGIN-REFERRALS ID ENABLE IDLE SORT SORT=DISPLAY THREAD=REFERENCES THREAD=REFS THREAD=ORDEREDSUBJECT MULTIAPPEND URL-PARTIAL CATENATE UNSELECT CHILDREN NAMESPACE UIDPLUS LIST-EXTENDED I18NLEVEL=1 CONDSTORE QRESYNC ESEARCH ESORT SEARCHRES WITHIN CONTEXT=SEARCH LIST-STATUS BINARY MOVE SNIPPET=FUZZY PREVIEW=FUZZY STATUS=SIZE SAVEDATE LITERAL+ NOTIFY SPECIAL-USE] Logged in A SELECT INBOX (CONDSTORE) * FLAGS (\Answered \Flagged \Deleted \Seen \Draft $MDNSent Junk NonJunk $label4 $label1 $label2 $label3 $label5 Old $Forwarded NOTJUNK $has_cal) * OK [PERMANENTFLAGS (\Answered \Flagged \Deleted \Seen \Draft $MDNSent Junk NonJunk $label4 $label1 $label2 $label3 $label5 Old $Forwarded NOTJUNK $has_cal \*)] Flags permitted. * 7286 EXISTS * 0 RECENT * OK [UIDVALIDITY 1291740963] UIDs valid * OK [UIDNEXT 158448] Predicted next UID * OK [HIGHESTMODSEQ 190086] Highest A OK [READ-WRITE] Select completed (0.001 + 0.000 secs). A SELECT INBOX (CONDSTORE) * FLAGS (\Answered \Flagged \Deleted \Seen \Draft $MDNSent Junk NonJunk $label4 $label1 $label2 $label3 $label5 Old $Forwarded NOTJUNK $has_cal) * OK [PERMANENTFLAGS (\Answered \Flagged \Deleted \Seen \Draft $MDNSent Junk NonJunk $label4 $label1 $label2 $label3 $label5 Old $Forwarded NOTJUNK $has_cal \*)] Flags permitted. * 7288 EXISTS * 0 RECENT * OK [UIDVALIDITY 1291740963] UIDs valid * OK [UIDNEXT 158450] Predicted next UID * OK [HIGHESTMODSEQ 190086] Highest A OK [READ-WRITE] Select completed (0.002 + 0.000 + 0.001 secs). The Groupware's IMAP client library is reporting, that MODSEQ is not increasing. It stays at 190086, nevertheless I receive new e-mail. I have tried the commands doveadm index and doveadm force-resync on the INBOX, without any change. My filesystem where the mailboxes reside is on ext4. Can you help me what is wrong? Best regards, Ronny Forberger -- Ronny Forberger ronnyforberger(a)ronnyforberger.de

1 1

Some info to configure OAuth2 using Keycloak
by Gary Horchem 02 Dec '22

02 Dec '22

Hello I’m about to configure and test Dovecot with Keycloak. When do you use the dovecot-oauth2.token.conf.ext and/or dovecot-oauth2.plain.conf.ext over dovecot-oauth2.token.conf.ext Thanks. and/or Sent from my iPhone

2 1

Doveadm Move Query
by Simon B 01 Dec '22

01 Dec '22

I have a production Dovecot problem and although I searched the mailing lists, I could not find an answer and I hope you can give me a quick answer/pointer in the right direction. I have mails for a user (user(a)domain.net) under /var/spool/mail/virtual/ domain.net/user and I want to move ALL the mails to /var/spool/mail/virtual/domain.com/user If I use #doveadm -Dv move -u user(a)domain.net Maildir:/var/spool/mail/virtual/ domain.net/user Maildir:/var/spool/mail/virtual/domain.com/user ALL I get doveadm(root): Fatal: Unknown argument MAILDIR:/var/spool/mail/virtual/ domain.com/user if I use #doveadm -Dv move -u user(a)domain.net Maildir:/var/spool/mail/virtual/ domain.net/user /var/spool/mail/virtual/domain.com/user ALL doveadm(root): Fatal: Unknown argument /var/spool/mail/virtual/ domain.com/user What the hell am I doing wrong!? :) Thanks. Simon

3 3

Can't figure out why managesieve (pigeonhole) can't connect
by colin＠colinlikesfood.com 27 Nov '22

27 Nov '22

Subject line says it all? I am using Roundcube, and every time i click on "filters" i get RC's "unable to connect to server" message. This might be an SQL error, but i can't figure out how to pull the relevant logs yet. Please see below and any advice you have is so very appreciated SYSLOG: ------------------- Nov 22 10:29:27 mail roundcube[66295]: <keirks4p> PHP Error: Connection refused (GET /index.php?_task=settings&_action=plugin.managesieve) Nov 22 10:29:27 mail roundcube[66295]: <keirks4p> PHP Error: Unable to connect to managesieve on obfuscated.domain:4190 in /usr/local/www/roundcube/plugins/managesieve/lib/Roundcube/rcube_sieve_engine.php on line 221 (GET /index.php?_task=settings&_action=plugin.managesieve) Nov 22 10:29:27 mail roundcube[66295]: <keirks4p> PHP Error: Not currently in AUTHORISATION state (GET /index.php?_task=settings&_action=plugin.managesieve) Nov 22 10:29:27 mail php[66295]: <keirks4p> PHP Error: Not currently connected (GET /index.php?_task=settings&_action=plugin.managesieve) Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> PHP Error: Connection refused (GET /index.php?_task=settings&_action=plugin.managesieve-action&_framed=1&_nav=hide) Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> PHP Error: Unable to connect to managesieve on obfuscated.domain:4190 in /usr/local/www/roundcube/plugins/managesieve/lib/Roundcube/rcube_sieve_engine.php on line 221 (GET /index.php?_task=settings&_action=plugin.managesieve-action&_framed=1&_nav=hide) Nov 22 10:29:31 mail php[66295]: <keirks4p> PHP Error: Not currently connected (GET /index.php?_task=settings&_action=plugin.managesieve-action&_framed=1&_nav=hide) Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> PHP Error: Connection refused (POST /?_task=settings&_action=plugin.managesieve-save) Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> PHP Error: Unable to connect to managesieve on obfuscated.domain:4190 in /usr/local/www/roundcube/plugins/managesieve/lib/Roundcube/rcube_sieve_engine.php on line 221 (POST /?_task=settings&_action=plugin.managesieve-save) Nov 22 10:29:43 mail roundcube[71055]: PHP Warning: Trying to access array offset on value of type null in /usr/local/www/roundcube/plugins/managesieve/lib/Roundcube/rcube_sieve_engine.php on line 1065 Nov 22 10:29:43 mail php[71055]: <keirks4p> PHP Error: Not currently connected (POST /?_task=settings&_action=plugin.managesieve-save) DOVECOT.LOG: ------------------- Nov 22 10:28:58 mail roundcube[66297]: <keirks4p> [43CD] C: A0008 LOGOUT Nov 22 10:28:58 mail dovecot[8514]: imap(obfuscated(a)user.name)<8609><XgBCqxHusXAKAAAB>: Disconnected: Logged out in=219 out=1045 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0 Nov 22 10:28:58 mail roundcube[66297]: <keirks4p> [43CD] S: * BYE Logging out Nov 22 10:28:58 mail roundcube[66297]: <keirks4p> [43CD] S: A0008 OK Logout completed (0.001 + 0.000 secs). Nov 22 10:29:25 mail roundcube[66295]: <keirks4p> [1] SELECT "vars", "ip", "changed", datetime('now') AS ts, CASE WHEN "changed" < datetime('now', '-600 seconds') THEN 1 ELSE 0 END AS expired FROM "session" WHERE "sess_id" = 'keirks4pbepr17um9mvj1qsvt2'; Nov 22 10:29:25 mail roundcube[66295]: <keirks4p> [2] SELECT * FROM "users" WHERE "user_id" = '2'; Nov 22 10:29:25 mail roundcube[66295]: <keirks4p> [3] UPDATE "session" SET "changed" = datetime('now'), "vars" = 'bGFuZ3VhZ2V8czo1OiJlbl9VUyI7aW1hcF9uYW1lc3BhY2V8YTo0OntzOjg6InBlcnNvbmFsIjthOjE6e2k6MDthOjI6e2k6MDtzOjA6IiI7aToxO3M6MToiLyI7fX1zOjU6Im90aGVyIjtOO3M6Njoic2hhcmVkIjtOO3M6MTA6InByZWZpeF9vdXQiO3M6MDoiIjt9aW1hcF9kZWxpbWl0ZXJ8czoxOiIvIjtpbWFwX2xpc3RfY29uZnxhOjI6e2k6MDtOO2k6MTthOjA6e319dXNlcl9pZHxpOjI7dXNlcm5hbWV8czoyNDoiY29saW5AY29saW5saWtlc2Zvb2QuY29tIjtzdG9yYWdlX2hvc3R8czoxODoiY29saW5saWtlc2Zvb2QuY29tIjtzdG9yYWdlX3BvcnR8aToxNDM7c3RvcmFnZV9zc2x8czozOiJ0bHMiO3Bhc3N3b3JkfHM6NDQ6ImNYOCt0VmJXV010VEMxRTlXQVB4ZjVOSlU1bWlKa2ZveC8xRWpuZVB2Ym89Ijtsb2dpbl90aW1lfGk6MTY2OTA2MzM4OTt0aW1lem9uZXxzOjE1OiJBbWVyaWNhL0NoaWNhZ28iO2F1dGhfc2VjcmV0fHM6MjY6ImNHdkc4ZWR5QmFmNWJITVpISG5sTEY3ZmpZIjtyZXF1ZXN0X3Rva2VufHM6MzI6IkM5VXlNNVBMUnhSeERiVm9HTlNMNjdVZ05NaWE4WVZGIjt0YXNrfHM6ODoic2V0dGluZ3MiO3NraW5fY29uZmlnfGE6Nzp7czoxNzoic3VwcG9ydGVkX2xheW91dHMiO2E6MTp7aTowO3M6MTA6IndpZGVzY3JlZW4iO31zOjIyOiJqcXVlcnlfdWlfY29sb3JzX3RoZW1lIjtzOjk6ImJvb3RzdHJhcCI7czoxODoiZW1iZWRfY3NzX2xvY2F0aW9uIjtzOjE3OiIvc3R5bGVzL2VtYmVkLmNzcyI7c zoxOToiZWRpdG9yX2Nzc19sb2NhdGlvbiI7czoxNzoiL3N0eWxlcy9lbWJlZC5jc3MiO3M6MTc6ImRhcmtfbW9kZV9zdXBwb3J0IjtiOjE7czoyNjoibWVkaWFfYnJvd3Nlcl9jc3NfbG9jYXRpb24iO3M6NDoibm9uZSI7czoyMToiYWRkaXRpb25hbF9sb2dvX3R5cGVzIjthOjM6e2k6MDtzOjQ6ImRhcmsiO2k6MTtzOjU6InNtYWxsIjtpOjI7czoxMDoic21hbGwtZGFyayI7fX1pbWFwX2hvc3R8czoxODoiY29saW5saWtlc2Zvb2QuY29tIjttYm94fHM6NToiSU5CT1giO3NvcnRfY29sfHM6MDoiIjtzb3J0X29yZGVyfHM6NDoiREVTQyI7U1RPUkFHRV9USFJFQUR8YTozOntpOjA7czoxMDoiUkVGRVJFTkNFUyI7aToxO3M6NDoiUkVGUyI7aToyO3M6MTQ6Ik9SREVSRURTVUJKRUNUIjt9U1RPUkFHRV9RVU9UQXxiOjA7U1RPUkFHRV9MSVNULUVYVEVOREVEfGI6MTtsaXN0X2F0dHJpYnxhOjc6e3M6NDoibmFtZSI7czo4OiJtZXNzYWdlcyI7czoyOiJpZCI7czoxMToibWVzc2FnZWxpc3QiO3M6NToiY2xhc3MiO3M6NDI6Imxpc3RpbmcgbWVzc2FnZWxpc3Qgc29ydGhlYWRlciBmaXhlZGhlYWRlciI7czoxNToiYXJpYS1sYWJlbGxlZGJ5IjtzOjIyOiJhcmlhLWxhYmVsLW1lc3NhZ2VsaXN0IjtzOjk6ImRhdGEtbGlzdCI7czoxMjoibWVzc2FnZV9saXN0IjtzOjE0OiJkYXRhLWxhYmVsLW1zZyI7czoxODoi Nov 22 10:29:27 mail roundcube[66295]: <keirks4p> [1] SELECT "vars", "ip", "changed", datetime('now') AS ts, CASE WHEN "changed" < datetime('now', '-600 seconds') THEN 1 ELSE 0 END AS expired FROM "session" WHERE "sess_id" = 'keirks4pbepr17um9mvj1qsvt2'; Nov 22 10:29:27 mail roundcube[66295]: <keirks4p> [2] SELECT * FROM "users" WHERE "user_id" = '2'; Nov 22 10:29:27 mail roundcube[66295]: <keirks4p> PHP Error: Connection refused (GET /index.php?_task=settings&_action=plugin.managesieve) Nov 22 10:29:27 mail roundcube[66295]: <keirks4p> PHP Error: Unable to connect to managesieve on obfuscated.domain:4190 in /usr/local/www/roundcube/plugins/managesieve/lib/Roundcube/rcube_sieve_engine.php on line 221 (GET /index.php?_task=settings&_action=plugin.managesieve) Nov 22 10:29:27 mail roundcube[66295]: <keirks4p> PHP Error: Not currently in AUTHORISATION state (GET /index.php?_task=settings&_action=plugin.managesieve) Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [1] SELECT "vars", "ip", "changed", datetime('now') AS ts, CASE WHEN "changed" < datetime('now', '-600 seconds') THEN 1 ELSE 0 END AS expired FROM "session" WHERE "sess_id" = 'keirks4pbepr17um9mvj1qsvt2'; Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [2] SELECT * FROM "users" WHERE "user_id" = '2'; Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> PHP Error: Connection refused (GET /index.php?_task=settings&_action=plugin.managesieve-action&_framed=1&_nav=hide) Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> PHP Error: Unable to connect to managesieve on obfuscated.domain:4190 in /usr/local/www/roundcube/plugins/managesieve/lib/Roundcube/rcube_sieve_engine.php on line 221 (GET /index.php?_task=settings&_action=plugin.managesieve-action&_framed=1&_nav=hide) Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] Connecting to tls://obfuscated.domain:143... Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] S: * OK [CAPABILITY IMAP4rev1 SASL-IR LOGIN-REFERRALS ID ENABLE IDLE LITERAL+ STARTTLS LOGINDISABLED AUTH=CRAM-MD5] Dovecot ready. Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] C: A0001 STARTTLS Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] S: A0001 OK Begin TLS negotiation now. Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] C: A0002 CAPABILITY Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] S: * CAPABILITY IMAP4rev1 SASL-IR LOGIN-REFERRALS ID ENABLE IDLE LITERAL+ LOGINDISABLED AUTH=CRAM-MD5 Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] S: A0002 OK Pre-login capabilities listed, post-login capabilities have more. Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] C: A0003 AUTHENTICATE CRAM-MD5 Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] S: + PDI3MjU4Mjg1ODUxMTkzMTEuMTY2OTEzNDU3MUBtYWlsPg== Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] C: ****** [74] Nov 22 10:29:31 mail dovecot[8514]: imap-login: Login: user=<obfuscated(a)user.name>, method=CRAM-MD5, rip=10.0.0.1, lip=10.0.0.91, mpid=8639, TLS, session=<51k6rRHuw5gKAAAB> Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] S: A0003 OK [CAPABILITY IMAP4rev1 SASL-IR LOGIN-REFERRALS ID ENABLE IDLE SORT SORT=DISPLAY THREAD=REFERENCES THREAD=REFS THREAD=ORDEREDSUBJECT MULTIAPPEND URL-PARTIAL CATENATE UNSELECT CHILDREN NAMESPACE UIDPLUS LIST-EXTENDED I18NLEVEL=1 CONDSTORE QRESYNC ESEARCH ESORT SEARCHRES WITHIN CONTEXT=SEARCH LIST-STATUS BINARY MOVE SNIPPET=FUZZY PREVIEW=FUZZY PREVIEW STATUS=SIZE SAVEDATE LITERAL+ NOTIFY SPECIAL-USE] Logged in Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] C: A0004 ID ("name" "Roundcube" "version" "1.6.0" "php" "8.0.25" "os" "FreeBSD" "command" "/index.php?_task=settings&_action=plugin.managesieve-action&_framed=1&_nav=hide") Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] S: * ID ("name" "Dovecot") Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] S: A0004 OK ID completed (0.001 + 0.000 secs). Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] C: A0005 LIST (SUBSCRIBED) "" "*" Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] S: * LIST (\Subscribed) "/" Drafts Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] S: * LIST (\Subscribed) "/" Junk Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] S: * LIST (\Subscribed) "/" Sent Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] S: * LIST (\Subscribed) "/" Trash Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] S: * LIST (\Subscribed) "/" INBOX/NAS-Alerts Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] S: * LIST (\Subscribed) "/" INBOX/email-reports Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] S: A0005 OK List completed (0.001 + 0.000 secs). Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [3] UPDATE "session" SET "changed" = datetime('now'), "vars" = 'bGFuZ3VhZ2V8czo1OiJlbl9VUyI7aW1hcF9uYW1lc3BhY2V8YTo0OntzOjg6InBlcnNvbmFsIjthOjE6e2k6MDthOjI6e2k6MDtzOjA6IiI7aToxO3M6MToiLyI7fX1zOjU6Im90aGVyIjtOO3M6Njoic2hhcmVkIjtOO3M6MTA6InByZWZpeF9vdXQiO3M6MDoiIjt9aW1hcF9kZWxpbWl0ZXJ8czoxOiIvIjtpbWFwX2xpc3RfY29uZnxhOjI6e2k6MDtOO2k6MTthOjA6e319dXNlcl9pZHxpOjI7dXNlcm5hbWV8czoyNDoiY29saW5AY29saW5saWtlc2Zvb2QuY29tIjtzdG9yYWdlX2hvc3R8czoxODoiY29saW5saWtlc2Zvb2QuY29tIjtzdG9yYWdlX3BvcnR8aToxNDM7c3RvcmFnZV9zc2x8czozOiJ0bHMiO3Bhc3N3b3JkfHM6NDQ6ImNYOCt0VmJXV010VEMxRTlXQVB4ZjVOSlU1bWlKa2ZveC8xRWpuZVB2Ym89Ijtsb2dpbl90aW1lfGk6MTY2OTA2MzM4OTt0aW1lem9uZXxzOjE1OiJBbWVyaWNhL0NoaWNhZ28iO2F1dGhfc2VjcmV0fHM6MjY6ImNHdkc4ZWR5QmFmNWJITVpISG5sTEY3ZmpZIjtyZXF1ZXN0X3Rva2VufHM6MzI6IkM5VXlNNVBMUnhSeERiVm9HTlNMNjdVZ05NaWE4WVZGIjt0YXNrfHM6ODoic2V0dGluZ3MiO3NraW5fY29uZmlnfGE6Nzp7czoxNzoic3VwcG9ydGVkX2xheW91dHMiO2E6MTp7aTowO3M6MTA6IndpZGVzY3JlZW4iO31zOjIyOiJqcXVlcnlfdWlfY29sb3JzX3RoZW1lIjtzOjk6ImJvb3RzdHJhcCI7czoxODoiZW1iZWRfY3NzX2xvY2F0aW9uIjtzOjE3OiIvc3R5bGVzL2VtYmVkLmNzcyI7c zoxOToiZWRpdG9yX2Nzc19sb2NhdGlvbiI7czoxNzoiL3N0eWxlcy9lbWJlZC5jc3MiO3M6MTc6ImRhcmtfbW9kZV9zdXBwb3J0IjtiOjE7czoyNjoibWVkaWFfYnJvd3Nlcl9jc3NfbG9jYXRpb24iO3M6NDoibm9uZSI7czoyMToiYWRkaXRpb25hbF9sb2dvX3R5cGVzIjthOjM6e2k6MDtzOjQ6ImRhcmsiO2k6MTtzOjU6InNtYWxsIjtpOjI7czoxMDoic21hbGwtZGFyayI7fX1pbWFwX2hvc3R8czoxODoiY29saW5saWtlc2Zvb2QuY29tIjttYm94fHM6NToiSU5CT1giO3NvcnRfY29sfHM6MDoiIjtzb3J0X29yZGVyfHM6NDoiREVTQyI7U1RPUkFHRV9USFJFQUR8YTozOntpOjA7czoxMDoiUkVGRVJFTkNFUyI7aToxO3M6NDoiUkVGUyI7aToyO3M6MTQ6Ik9SREVSRURTVUJKRUNUIjt9U1RPUkFHRV9RVU9UQXxiOjA7U1RPUkFHRV9MSVNULUVYVEVOREVEfGI6MTtsaXN0X2F0dHJpYnxhOjc6e3M6NDoibmFtZSI7czo4OiJtZXNzYWdlcyI7czoyOiJpZCI7czoxMToibWVzc2FnZWxpc3QiO3M6NToiY2xhc3MiO3M6NDI6Imxpc3RpbmcgbWVzc2FnZWxpc3Qgc29ydGhlYWRlciBmaXhlZGhlYWRlciI7czoxNToiYXJpYS1sYWJlbGxlZGJ5IjtzOjIyOiJhcmlhLWxhYmVsLW1lc3NhZ2VsaXN0IjtzOjk6ImRhdGEtbGlzdCI7czoxMjoibWVzc2FnZV9saXN0IjtzOjE0OiJkYXRhLWxhYmVsLW1zZyI7czoxODoi Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] C: A0006 LOGOUT Nov 22 10:29:31 mail dovecot[8514]: imap(obfuscated(a)user.name)<8639><51k6rRHuw5gKAAAB>: Disconnected: Logged out in=215 out=821 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0 Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] S: * BYE Logging out Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] S: A0006 OK Logout completed (0.001 + 0.000 secs). Nov 22 10:29:42 mail roundcube[71055]: <keirks4p> [1] SELECT "vars", "ip", "changed", datetime('now') AS ts, CASE WHEN "changed" < datetime('now', '-600 seconds') THEN 1 ELSE 0 END AS expired FROM "session" WHERE "sess_id" = 'keirks4pbepr17um9mvj1qsvt2'; Nov 22 10:29:42 mail roundcube[71055]: <keirks4p> [2] SELECT * FROM "users" WHERE "user_id" = '2'; Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> PHP Error: Connection refused (POST /?_task=settings&_action=plugin.managesieve-save) Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> PHP Error: Unable to connect to managesieve on obfuscated.domain:4190 in /usr/local/www/roundcube/plugins/managesieve/lib/Roundcube/rcube_sieve_engine.php on line 221 (POST /?_task=settings&_action=plugin.managesieve-save) Nov 22 10:29:43 mail roundcube[71055]: PHP Warning: Trying to access array offset on value of type null in /usr/local/www/roundcube/plugins/managesieve/lib/Roundcube/rcube_sieve_engine.php on line 1065 Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] Connecting to tls://obfuscated.domain:143... Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] S: * OK [CAPABILITY IMAP4rev1 SASL-IR LOGIN-REFERRALS ID ENABLE IDLE LITERAL+ STARTTLS LOGINDISABLED AUTH=CRAM-MD5] Dovecot ready. Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] C: A0001 STARTTLS Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] S: A0001 OK Begin TLS negotiation now. Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] C: A0002 CAPABILITY Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] S: * CAPABILITY IMAP4rev1 SASL-IR LOGIN-REFERRALS ID ENABLE IDLE LITERAL+ LOGINDISABLED AUTH=CRAM-MD5 Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] S: A0002 OK Pre-login capabilities listed, post-login capabilities have more. Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] C: A0003 AUTHENTICATE CRAM-MD5 Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] S: + PDE2NjcxMDUwNTU2NDcwMTMuMTY2OTEzNDU4M0BtYWlsPg== Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] C: ****** [74] Nov 22 10:29:43 mail dovecot[8514]: imap-login: Login: user=<obfuscated(a)user.name>, method=CRAM-MD5, rip=10.0.0.1, lip=10.0.0.91, mpid=8644, TLS, session=<677prRHu4aAKAAAB> Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] S: A0003 OK [CAPABILITY IMAP4rev1 SASL-IR LOGIN-REFERRALS ID ENABLE IDLE SORT SORT=DISPLAY THREAD=REFERENCES THREAD=REFS THREAD=ORDEREDSUBJECT MULTIAPPEND URL-PARTIAL CATENATE UNSELECT CHILDREN NAMESPACE UIDPLUS LIST-EXTENDED I18NLEVEL=1 CONDSTORE QRESYNC ESEARCH ESORT SEARCHRES WITHIN CONTEXT=SEARCH LIST-STATUS BINARY MOVE SNIPPET=FUZZY PREVIEW=FUZZY PREVIEW STATUS=SIZE SAVEDATE LITERAL+ NOTIFY SPECIAL-USE] Logged in Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] C: A0004 ID ("name" "Roundcube" "version" "1.6.0" "php" "8.0.25" "os" "FreeBSD" "command" "/") Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] S: * ID ("name" "Dovecot") Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] S: A0004 OK ID completed (0.001 + 0.000 secs). Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] C: A0005 LIST (SUBSCRIBED) "" "*" Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] S: * LIST (\Subscribed) "/" Drafts Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] S: * LIST (\Subscribed) "/" Junk Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] S: * LIST (\Subscribed) "/" Sent Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] S: * LIST (\Subscribed) "/" Trash Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] S: * LIST (\Subscribed) "/" INBOX/NAS-Alerts Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] S: * LIST (\Subscribed) "/" INBOX/email-reports Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] S: A0005 OK List completed (0.001 + 0.000 secs). Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] C: A0006 LOGOUT Nov 22 10:29:43 mail dovecot[8514]: imap(obfuscated(a)user.name)<8644><677prRHu4aAKAAAB>: Disconnected: Logged out in=137 out=821 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0 Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] S: * BYE Logging out Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] S: A0006 OK Logout completed (0.001 + 0.000 secs). DOVECOT INFO: ------------------------ # dovecot --version 2.3.19.1 (9b53102964) # dovecot -n # 2.3.19.1 (9b53102964): /usr/local/etc/dovecot/dovecot.conf # Pigeonhole version 0.5.19 (4eae2f79) # OS: FreeBSD 13.1-RELEASE-p2 amd64 zfs # Hostname: localhost auth_mechanisms = cram-md5 first_valid_gid = 10000 first_valid_uid = 10000 mail_location = maildir:/var/mail/users/%u managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext namespace inbox { inbox = yes location = mailbox Drafts { auto = create special_use = \Drafts } mailbox Junk { auto = create special_use = \Junk } mailbox Sent { auto = create special_use = \Sent } mailbox Trash { auto = create special_use = \Trash } prefix = separator = / } passdb { args = username_format=%u /usr/local/etc/dovecot/users driver = passwd-file } plugin { sieve = file:/usr/local/etc/dovecot/sieve;active=/usr/local/etc/dovecot/sieve/.dovecot.sieve sieve_before = /usr/local/etc/dovecot/sieve/before-global.sieve sieve_default = /usr/local/etc/dovecot/sieve/default.sieve sieve_global = /usr/local/etc/dovecot/sieve/global/ } protocols = imap lmtp sieve service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0666 user = postfix } } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0660 user = postfix } } service managesieve-login { inet_listener sieve { port = 4190 } } ssl_cert = </usr/local/etc/letsencrypt/live/obfuscated.domain/fullchain.pem ssl_cipher_list = HIGH:!aNULL:!AES128:!SSLv2 ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it syslog_facility = local1 userdb { args = username_format=%u /usr/local/etc/dovecot/users driver = passwd-file } protocol lmtp { mail_plugins = " sieve" } protocol sieve { info_log_path = /var/log/dovecot-sieve.log log_path = /var/log/dovecot-sieve-errors.log managesieve_implementation_string = dovecot managesieve_max_line_length = 64 k } THANKS! Colin

5 9

bug: ARGON2 hash selection incompatible with LDAP
by Krisztián Szegi 25 Nov '22

25 Nov '22

Good day to all, this is my first post to the mailing list! I'd like to report that non-binding auth to (Open)LDAP doesn't work if the latter hashes passwords with ARGON2. Although dovecot (I am using http://2.3.19.1) does support ARGON2 with libsodium, but it doesn't recoginize hashes beginning "{ARGON2}$argon2id$" stored (and hashed, using ppolicy module's hashCleartext) by OpenLDAP. Now, I understand that ARGON2I, -D, and -ID are not compatible, but the ACTUAL algorithm is there between the two $. Furthermore, I think dovecot is in the minority here, I haven't met any software that specifies the ARGON2 subtype between {}. BTW, I haven't met any software that hashes passwords with ARGON2, but not with the ARGON2ID subtype (where libsodium is available, which also seems to be the standard here), as THAT is the recommended one anyway. I patched the rpm in OpenSUSE repo to alias {ARGON2} to {ARGON2ID}: https://build.opensuse.org/package/view_file/home:Samonitari:branches:openS… Could we get something like this (but maybe more correct) into the official source? Maybe a config switch to alias it runtime? Thanks for the attention: Krisztián

3 3

Dovecot and TLSv1 on ubuntu 22.04
by Six002 24 Nov '22

24 Nov '22

Hello, I have ubuntu 22.04, dovecot 2.3.16 and old email client (Outlook 2013) and their dont support TLSv1_2. In dovecot 10-ssl.conf i put: ssl_min_protocol = TLSv1, in openssl.cnf i have: openssl_conf = default_conf [ default_conf ] ssl_conf = ssl_section [ssl_section] system_default = ssl_default_sectq [ssl_default_sect] MinProtocol = TLSv1CipherString = DEFAULT:@SECLEVEL=1 but when i check openssl s_client -connect localhost:993 -tls1_1 have output: CONNECTED(00000003) 803BD26AC67F0000:error:0A000126:SSL routines:ssl3_read_n:unexpected eof while reading:../ssl/record/rec_layer_s3.c:308: --- no peer certificate available --- No client certificate CA names sent --- SSL handshake has read 0 bytes and written 111 bytes Verification: OK --- New, (NONE), Cipher is (NONE) Secure Renegotiation IS NOT supported Compression: NONE Expansion: NONE No ALPN negotiated SSL-Session: Protocol : TLSv1.1 Cipher : 0000 Session-ID: Session-ID-ctx: Master-Key: PSK identity: None PSK identity hint: None SRP username: None Start Time: 1668602712 Timeout : 7200 (sec) Verify return code: 0 (ok) Extended master secret: no --- version tls1_2 and 1_3 works fine. What I doing wrong?Thanks for help.

3 2

compiled sieve files svbin ?
by jeremy ardley 23 Nov '22

23 Nov '22

Hi, I have recently started using claws mail to manage my user sieve scripts using server dovecot-sieve_1%3a2.3.13+dfsg1-2_arm64.deb I originally edited ~/.dovecot.sieve to hold my script and I recall that ~/.dovecot.svbin was automatically generated on first use. (either that or I have forgotten that I had used sievec) Later I used claws mail to generate sieve scripts but they were written into directory ~/sieve/ In experimentation I changed ~/.dovecot.sieve into a link to my principal script ~/sieve/main.sieve The oddity now is that sieve seems to be working when there is no compiled version Should I expect a compiled .svbin version to be generated from claws client? Or generated by first run of the sieve server on the user account? Or should I manage the scripts with claws, but log in to the server later to generate the .svbin versions? In any event what effect does not having a .svbin version have on typical small installation? -- Jeremy

2 1

Can't figure out why managesieve (pigeonhole) can't connect
by colin＠colinlikesfood.com 22 Nov '22

22 Nov '22

Subject line says it all? I am using Roundcube, and every time i click on "filters" i get RC's "unable to connect to server" message. This might be an SQL error, but i can't figure out how to pull the relevant logs yet. Please see below and any advice you have is so very appreciated SYSLOG: ------------------- Nov 22 10:29:27 mail roundcube[66295]: <keirks4p> PHP Error: Connection refused (GET /index.php?_task=settings&_action=plugin.managesieve) Nov 22 10:29:27 mail roundcube[66295]: <keirks4p> PHP Error: Unable to connect to managesieve on obfuscated.domain:4190 in /usr/local/www/roundcube/plugins/managesieve/lib/Roundcube/rcube_sieve_engine.php on line 221 (GET /index.php?_task=settings&_action=plugin.managesieve) Nov 22 10:29:27 mail roundcube[66295]: <keirks4p> PHP Error: Not currently in AUTHORISATION state (GET /index.php?_task=settings&_action=plugin.managesieve) Nov 22 10:29:27 mail php[66295]: <keirks4p> PHP Error: Not currently connected (GET /index.php?_task=settings&_action=plugin.managesieve) Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> PHP Error: Connection refused (GET /index.php?_task=settings&_action=plugin.managesieve-action&_framed=1&_nav=hide) Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> PHP Error: Unable to connect to managesieve on obfuscated.domain:4190 in /usr/local/www/roundcube/plugins/managesieve/lib/Roundcube/rcube_sieve_engine.php on line 221 (GET /index.php?_task=settings&_action=plugin.managesieve-action&_framed=1&_nav=hide) Nov 22 10:29:31 mail php[66295]: <keirks4p> PHP Error: Not currently connected (GET /index.php?_task=settings&_action=plugin.managesieve-action&_framed=1&_nav=hide) Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> PHP Error: Connection refused (POST /?_task=settings&_action=plugin.managesieve-save) Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> PHP Error: Unable to connect to managesieve on obfuscated.domain:4190 in /usr/local/www/roundcube/plugins/managesieve/lib/Roundcube/rcube_sieve_engine.php on line 221 (POST /?_task=settings&_action=plugin.managesieve-save) Nov 22 10:29:43 mail roundcube[71055]: PHP Warning: Trying to access array offset on value of type null in /usr/local/www/roundcube/plugins/managesieve/lib/Roundcube/rcube_sieve_engine.php on line 1065 Nov 22 10:29:43 mail php[71055]: <keirks4p> PHP Error: Not currently connected (POST /?_task=settings&_action=plugin.managesieve-save) DOVECOT.LOG: ------------------- Nov 22 10:28:58 mail roundcube[66297]: <keirks4p> [43CD] C: A0008 LOGOUT Nov 22 10:28:58 mail dovecot[8514]: imap(obfuscated(a)user.name)<8609><XgBCqxHusXAKAAAB>: Disconnected: Logged out in=219 out=1045 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0 Nov 22 10:28:58 mail roundcube[66297]: <keirks4p> [43CD] S: * BYE Logging out Nov 22 10:28:58 mail roundcube[66297]: <keirks4p> [43CD] S: A0008 OK Logout completed (0.001 + 0.000 secs). Nov 22 10:29:25 mail roundcube[66295]: <keirks4p> [1] SELECT "vars", "ip", "changed", datetime('now') AS ts, CASE WHEN "changed" < datetime('now', '-600 seconds') THEN 1 ELSE 0 END AS expired FROM "session" WHERE "sess_id" = 'keirks4pbepr17um9mvj1qsvt2'; Nov 22 10:29:25 mail roundcube[66295]: <keirks4p> [2] SELECT * FROM "users" WHERE "user_id" = '2'; Nov 22 10:29:25 mail roundcube[66295]: <keirks4p> [3] UPDATE "session" SET "changed" = datetime('now'), "vars" = 'bGFuZ3VhZ2V8czo1OiJlbl9VUyI7aW1hcF9uYW1lc3BhY2V8YTo0OntzOjg6InBlcnNvbmFsIjthOjE6e2k6MDthOjI6e2k6MDtzOjA6IiI7aToxO3M6MToiLyI7fX1zOjU6Im90aGVyIjtOO3M6Njoic2hhcmVkIjtOO3M6MTA6InByZWZpeF9vdXQiO3M6MDoiIjt9aW1hcF9kZWxpbWl0ZXJ8czoxOiIvIjtpbWFwX2xpc3RfY29uZnxhOjI6e2k6MDtOO2k6MTthOjA6e319dXNlcl9pZHxpOjI7dXNlcm5hbWV8czoyNDoiY29saW5AY29saW5saWtlc2Zvb2QuY29tIjtzdG9yYWdlX2hvc3R8czoxODoiY29saW5saWtlc2Zvb2QuY29tIjtzdG9yYWdlX3BvcnR8aToxNDM7c3RvcmFnZV9zc2x8czozOiJ0bHMiO3Bhc3N3b3JkfHM6NDQ6ImNYOCt0VmJXV010VEMxRTlXQVB4ZjVOSlU1bWlKa2ZveC8xRWpuZVB2Ym89Ijtsb2dpbl90aW1lfGk6MTY2OTA2MzM4OTt0aW1lem9uZXxzOjE1OiJBbWVyaWNhL0NoaWNhZ28iO2F1dGhfc2VjcmV0fHM6MjY6ImNHdkc4ZWR5QmFmNWJITVpISG5sTEY3ZmpZIjtyZXF1ZXN0X3Rva2VufHM6MzI6IkM5VXlNNVBMUnhSeERiVm9HTlNMNjdVZ05NaWE4WVZGIjt0YXNrfHM6ODoic2V0dGluZ3MiO3NraW5fY29uZmlnfGE6Nzp7czoxNzoic3VwcG9ydGVkX2xheW91dHMiO2E6MTp7aTowO3M6MTA6IndpZGVzY3JlZW4iO31zOjIyOiJqcXVlcnlfdWlfY29sb3JzX3RoZW1lIjtzOjk6ImJvb3RzdHJhcCI7czoxODoiZW1iZWRfY3NzX2xvY2F0aW9uIjtzOjE3OiIvc3R5bGVzL2VtYmVkLmNzcyI7c zoxOToiZWRpdG9yX2Nzc19sb2NhdGlvbiI7czoxNzoiL3N0eWxlcy9lbWJlZC5jc3MiO3M6MTc6ImRhcmtfbW9kZV9zdXBwb3J0IjtiOjE7czoyNjoibWVkaWFfYnJvd3Nlcl9jc3NfbG9jYXRpb24iO3M6NDoibm9uZSI7czoyMToiYWRkaXRpb25hbF9sb2dvX3R5cGVzIjthOjM6e2k6MDtzOjQ6ImRhcmsiO2k6MTtzOjU6InNtYWxsIjtpOjI7czoxMDoic21hbGwtZGFyayI7fX1pbWFwX2hvc3R8czoxODoiY29saW5saWtlc2Zvb2QuY29tIjttYm94fHM6NToiSU5CT1giO3NvcnRfY29sfHM6MDoiIjtzb3J0X29yZGVyfHM6NDoiREVTQyI7U1RPUkFHRV9USFJFQUR8YTozOntpOjA7czoxMDoiUkVGRVJFTkNFUyI7aToxO3M6NDoiUkVGUyI7aToyO3M6MTQ6Ik9SREVSRURTVUJKRUNUIjt9U1RPUkFHRV9RVU9UQXxiOjA7U1RPUkFHRV9MSVNULUVYVEVOREVEfGI6MTtsaXN0X2F0dHJpYnxhOjc6e3M6NDoibmFtZSI7czo4OiJtZXNzYWdlcyI7czoyOiJpZCI7czoxMToibWVzc2FnZWxpc3QiO3M6NToiY2xhc3MiO3M6NDI6Imxpc3RpbmcgbWVzc2FnZWxpc3Qgc29ydGhlYWRlciBmaXhlZGhlYWRlciI7czoxNToiYXJpYS1sYWJlbGxlZGJ5IjtzOjIyOiJhcmlhLWxhYmVsLW1lc3NhZ2VsaXN0IjtzOjk6ImRhdGEtbGlzdCI7czoxMjoibWVzc2FnZV9saXN0IjtzOjE0OiJkYXRhLWxhYmVsLW1zZyI7czoxODoi Nov 22 10:29:27 mail roundcube[66295]: <keirks4p> [1] SELECT "vars", "ip", "changed", datetime('now') AS ts, CASE WHEN "changed" < datetime('now', '-600 seconds') THEN 1 ELSE 0 END AS expired FROM "session" WHERE "sess_id" = 'keirks4pbepr17um9mvj1qsvt2'; Nov 22 10:29:27 mail roundcube[66295]: <keirks4p> [2] SELECT * FROM "users" WHERE "user_id" = '2'; Nov 22 10:29:27 mail roundcube[66295]: <keirks4p> PHP Error: Connection refused (GET /index.php?_task=settings&_action=plugin.managesieve) Nov 22 10:29:27 mail roundcube[66295]: <keirks4p> PHP Error: Unable to connect to managesieve on obfuscated.domain:4190 in /usr/local/www/roundcube/plugins/managesieve/lib/Roundcube/rcube_sieve_engine.php on line 221 (GET /index.php?_task=settings&_action=plugin.managesieve) Nov 22 10:29:27 mail roundcube[66295]: <keirks4p> PHP Error: Not currently in AUTHORISATION state (GET /index.php?_task=settings&_action=plugin.managesieve) Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [1] SELECT "vars", "ip", "changed", datetime('now') AS ts, CASE WHEN "changed" < datetime('now', '-600 seconds') THEN 1 ELSE 0 END AS expired FROM "session" WHERE "sess_id" = 'keirks4pbepr17um9mvj1qsvt2'; Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [2] SELECT * FROM "users" WHERE "user_id" = '2'; Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> PHP Error: Connection refused (GET /index.php?_task=settings&_action=plugin.managesieve-action&_framed=1&_nav=hide) Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> PHP Error: Unable to connect to managesieve on obfuscated.domain:4190 in /usr/local/www/roundcube/plugins/managesieve/lib/Roundcube/rcube_sieve_engine.php on line 221 (GET /index.php?_task=settings&_action=plugin.managesieve-action&_framed=1&_nav=hide) Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] Connecting to tls://obfuscated.domain:143... Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] S: * OK [CAPABILITY IMAP4rev1 SASL-IR LOGIN-REFERRALS ID ENABLE IDLE LITERAL+ STARTTLS LOGINDISABLED AUTH=CRAM-MD5] Dovecot ready. Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] C: A0001 STARTTLS Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] S: A0001 OK Begin TLS negotiation now. Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] C: A0002 CAPABILITY Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] S: * CAPABILITY IMAP4rev1 SASL-IR LOGIN-REFERRALS ID ENABLE IDLE LITERAL+ LOGINDISABLED AUTH=CRAM-MD5 Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] S: A0002 OK Pre-login capabilities listed, post-login capabilities have more. Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] C: A0003 AUTHENTICATE CRAM-MD5 Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] S: + PDI3MjU4Mjg1ODUxMTkzMTEuMTY2OTEzNDU3MUBtYWlsPg== Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] C: ****** [74] Nov 22 10:29:31 mail dovecot[8514]: imap-login: Login: user=<obfuscated(a)user.name>, method=CRAM-MD5, rip=10.0.0.1, lip=10.0.0.91, mpid=8639, TLS, session=<51k6rRHuw5gKAAAB> Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] S: A0003 OK [CAPABILITY IMAP4rev1 SASL-IR LOGIN-REFERRALS ID ENABLE IDLE SORT SORT=DISPLAY THREAD=REFERENCES THREAD=REFS THREAD=ORDEREDSUBJECT MULTIAPPEND URL-PARTIAL CATENATE UNSELECT CHILDREN NAMESPACE UIDPLUS LIST-EXTENDED I18NLEVEL=1 CONDSTORE QRESYNC ESEARCH ESORT SEARCHRES WITHIN CONTEXT=SEARCH LIST-STATUS BINARY MOVE SNIPPET=FUZZY PREVIEW=FUZZY PREVIEW STATUS=SIZE SAVEDATE LITERAL+ NOTIFY SPECIAL-USE] Logged in Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] C: A0004 ID ("name" "Roundcube" "version" "1.6.0" "php" "8.0.25" "os" "FreeBSD" "command" "/index.php?_task=settings&_action=plugin.managesieve-action&_framed=1&_nav=hide") Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] S: * ID ("name" "Dovecot") Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] S: A0004 OK ID completed (0.001 + 0.000 secs). Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] C: A0005 LIST (SUBSCRIBED) "" "*" Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] S: * LIST (\Subscribed) "/" Drafts Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] S: * LIST (\Subscribed) "/" Junk Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] S: * LIST (\Subscribed) "/" Sent Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] S: * LIST (\Subscribed) "/" Trash Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] S: * LIST (\Subscribed) "/" INBOX/NAS-Alerts Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] S: * LIST (\Subscribed) "/" INBOX/email-reports Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] S: A0005 OK List completed (0.001 + 0.000 secs). Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [3] UPDATE "session" SET "changed" = datetime('now'), "vars" = 'bGFuZ3VhZ2V8czo1OiJlbl9VUyI7aW1hcF9uYW1lc3BhY2V8YTo0OntzOjg6InBlcnNvbmFsIjthOjE6e2k6MDthOjI6e2k6MDtzOjA6IiI7aToxO3M6MToiLyI7fX1zOjU6Im90aGVyIjtOO3M6Njoic2hhcmVkIjtOO3M6MTA6InByZWZpeF9vdXQiO3M6MDoiIjt9aW1hcF9kZWxpbWl0ZXJ8czoxOiIvIjtpbWFwX2xpc3RfY29uZnxhOjI6e2k6MDtOO2k6MTthOjA6e319dXNlcl9pZHxpOjI7dXNlcm5hbWV8czoyNDoiY29saW5AY29saW5saWtlc2Zvb2QuY29tIjtzdG9yYWdlX2hvc3R8czoxODoiY29saW5saWtlc2Zvb2QuY29tIjtzdG9yYWdlX3BvcnR8aToxNDM7c3RvcmFnZV9zc2x8czozOiJ0bHMiO3Bhc3N3b3JkfHM6NDQ6ImNYOCt0VmJXV010VEMxRTlXQVB4ZjVOSlU1bWlKa2ZveC8xRWpuZVB2Ym89Ijtsb2dpbl90aW1lfGk6MTY2OTA2MzM4OTt0aW1lem9uZXxzOjE1OiJBbWVyaWNhL0NoaWNhZ28iO2F1dGhfc2VjcmV0fHM6MjY6ImNHdkc4ZWR5QmFmNWJITVpISG5sTEY3ZmpZIjtyZXF1ZXN0X3Rva2VufHM6MzI6IkM5VXlNNVBMUnhSeERiVm9HTlNMNjdVZ05NaWE4WVZGIjt0YXNrfHM6ODoic2V0dGluZ3MiO3NraW5fY29uZmlnfGE6Nzp7czoxNzoic3VwcG9ydGVkX2xheW91dHMiO2E6MTp7aTowO3M6MTA6IndpZGVzY3JlZW4iO31zOjIyOiJqcXVlcnlfdWlfY29sb3JzX3RoZW1lIjtzOjk6ImJvb3RzdHJhcCI7czoxODoiZW1iZWRfY3NzX2xvY2F0aW9uIjtzOjE3OiIvc3R5bGVzL2VtYmVkLmNzcyI7c zoxOToiZWRpdG9yX2Nzc19sb2NhdGlvbiI7czoxNzoiL3N0eWxlcy9lbWJlZC5jc3MiO3M6MTc6ImRhcmtfbW9kZV9zdXBwb3J0IjtiOjE7czoyNjoibWVkaWFfYnJvd3Nlcl9jc3NfbG9jYXRpb24iO3M6NDoibm9uZSI7czoyMToiYWRkaXRpb25hbF9sb2dvX3R5cGVzIjthOjM6e2k6MDtzOjQ6ImRhcmsiO2k6MTtzOjU6InNtYWxsIjtpOjI7czoxMDoic21hbGwtZGFyayI7fX1pbWFwX2hvc3R8czoxODoiY29saW5saWtlc2Zvb2QuY29tIjttYm94fHM6NToiSU5CT1giO3NvcnRfY29sfHM6MDoiIjtzb3J0X29yZGVyfHM6NDoiREVTQyI7U1RPUkFHRV9USFJFQUR8YTozOntpOjA7czoxMDoiUkVGRVJFTkNFUyI7aToxO3M6NDoiUkVGUyI7aToyO3M6MTQ6Ik9SREVSRURTVUJKRUNUIjt9U1RPUkFHRV9RVU9UQXxiOjA7U1RPUkFHRV9MSVNULUVYVEVOREVEfGI6MTtsaXN0X2F0dHJpYnxhOjc6e3M6NDoibmFtZSI7czo4OiJtZXNzYWdlcyI7czoyOiJpZCI7czoxMToibWVzc2FnZWxpc3QiO3M6NToiY2xhc3MiO3M6NDI6Imxpc3RpbmcgbWVzc2FnZWxpc3Qgc29ydGhlYWRlciBmaXhlZGhlYWRlciI7czoxNToiYXJpYS1sYWJlbGxlZGJ5IjtzOjIyOiJhcmlhLWxhYmVsLW1lc3NhZ2VsaXN0IjtzOjk6ImRhdGEtbGlzdCI7czoxMjoibWVzc2FnZV9saXN0IjtzOjE0OiJkYXRhLWxhYmVsLW1zZyI7czoxODoi Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] C: A0006 LOGOUT Nov 22 10:29:31 mail dovecot[8514]: imap(obfuscated(a)user.name)<8639><51k6rRHuw5gKAAAB>: Disconnected: Logged out in=215 out=821 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0 Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] S: * BYE Logging out Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] S: A0006 OK Logout completed (0.001 + 0.000 secs). Nov 22 10:29:42 mail roundcube[71055]: <keirks4p> [1] SELECT "vars", "ip", "changed", datetime('now') AS ts, CASE WHEN "changed" < datetime('now', '-600 seconds') THEN 1 ELSE 0 END AS expired FROM "session" WHERE "sess_id" = 'keirks4pbepr17um9mvj1qsvt2'; Nov 22 10:29:42 mail roundcube[71055]: <keirks4p> [2] SELECT * FROM "users" WHERE "user_id" = '2'; Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> PHP Error: Connection refused (POST /?_task=settings&_action=plugin.managesieve-save) Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> PHP Error: Unable to connect to managesieve on obfuscated.domain:4190 in /usr/local/www/roundcube/plugins/managesieve/lib/Roundcube/rcube_sieve_engine.php on line 221 (POST /?_task=settings&_action=plugin.managesieve-save) Nov 22 10:29:43 mail roundcube[71055]: PHP Warning: Trying to access array offset on value of type null in /usr/local/www/roundcube/plugins/managesieve/lib/Roundcube/rcube_sieve_engine.php on line 1065 Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] Connecting to tls://obfuscated.domain:143... Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] S: * OK [CAPABILITY IMAP4rev1 SASL-IR LOGIN-REFERRALS ID ENABLE IDLE LITERAL+ STARTTLS LOGINDISABLED AUTH=CRAM-MD5] Dovecot ready. Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] C: A0001 STARTTLS Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] S: A0001 OK Begin TLS negotiation now. Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] C: A0002 CAPABILITY Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] S: * CAPABILITY IMAP4rev1 SASL-IR LOGIN-REFERRALS ID ENABLE IDLE LITERAL+ LOGINDISABLED AUTH=CRAM-MD5 Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] S: A0002 OK Pre-login capabilities listed, post-login capabilities have more. Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] C: A0003 AUTHENTICATE CRAM-MD5 Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] S: + PDE2NjcxMDUwNTU2NDcwMTMuMTY2OTEzNDU4M0BtYWlsPg== Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] C: ****** [74] Nov 22 10:29:43 mail dovecot[8514]: imap-login: Login: user=<obfuscated(a)user.name>, method=CRAM-MD5, rip=10.0.0.1, lip=10.0.0.91, mpid=8644, TLS, session=<677prRHu4aAKAAAB> Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] S: A0003 OK [CAPABILITY IMAP4rev1 SASL-IR LOGIN-REFERRALS ID ENABLE IDLE SORT SORT=DISPLAY THREAD=REFERENCES THREAD=REFS THREAD=ORDEREDSUBJECT MULTIAPPEND URL-PARTIAL CATENATE UNSELECT CHILDREN NAMESPACE UIDPLUS LIST-EXTENDED I18NLEVEL=1 CONDSTORE QRESYNC ESEARCH ESORT SEARCHRES WITHIN CONTEXT=SEARCH LIST-STATUS BINARY MOVE SNIPPET=FUZZY PREVIEW=FUZZY PREVIEW STATUS=SIZE SAVEDATE LITERAL+ NOTIFY SPECIAL-USE] Logged in Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] C: A0004 ID ("name" "Roundcube" "version" "1.6.0" "php" "8.0.25" "os" "FreeBSD" "command" "/") Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] S: * ID ("name" "Dovecot") Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] S: A0004 OK ID completed (0.001 + 0.000 secs). Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] C: A0005 LIST (SUBSCRIBED) "" "*" Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] S: * LIST (\Subscribed) "/" Drafts Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] S: * LIST (\Subscribed) "/" Junk Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] S: * LIST (\Subscribed) "/" Sent Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] S: * LIST (\Subscribed) "/" Trash Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] S: * LIST (\Subscribed) "/" INBOX/NAS-Alerts Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] S: * LIST (\Subscribed) "/" INBOX/email-reports Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] S: A0005 OK List completed (0.001 + 0.000 secs). Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] C: A0006 LOGOUT Nov 22 10:29:43 mail dovecot[8514]: imap(obfuscated(a)user.name)<8644><677prRHu4aAKAAAB>: Disconnected: Logged out in=137 out=821 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0 Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] S: * BYE Logging out Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] S: A0006 OK Logout completed (0.001 + 0.000 secs). DOVECOT INFO: ------------------------ # dovecot --version 2.3.19.1 (9b53102964) # dovecot -n # 2.3.19.1 (9b53102964): /usr/local/etc/dovecot/dovecot.conf # Pigeonhole version 0.5.19 (4eae2f79) # OS: FreeBSD 13.1-RELEASE-p2 amd64 zfs # Hostname: localhost auth_mechanisms = cram-md5 first_valid_gid = 10000 first_valid_uid = 10000 mail_location = maildir:/var/mail/users/%u managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext namespace inbox { inbox = yes location = mailbox Drafts { auto = create special_use = \Drafts } mailbox Junk { auto = create special_use = \Junk } mailbox Sent { auto = create special_use = \Sent } mailbox Trash { auto = create special_use = \Trash } prefix = separator = / } passdb { args = username_format=%u /usr/local/etc/dovecot/users driver = passwd-file } plugin { sieve = file:/usr/local/etc/dovecot/sieve;active=/usr/local/etc/dovecot/sieve/.dovecot.sieve sieve_before = /usr/local/etc/dovecot/sieve/before-global.sieve sieve_default = /usr/local/etc/dovecot/sieve/default.sieve sieve_global = /usr/local/etc/dovecot/sieve/global/ } protocols = imap lmtp sieve service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0666 user = postfix } } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0660 user = postfix } } service managesieve-login { inet_listener sieve { port = 4190 } } ssl_cert = </usr/local/etc/letsencrypt/live/obfuscated.domain/fullchain.pem ssl_cipher_list = HIGH:!aNULL:!AES128:!SSLv2 ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it syslog_facility = local1 userdb { args = username_format=%u /usr/local/etc/dovecot/users driver = passwd-file } protocol lmtp { mail_plugins = " sieve" } protocol sieve { info_log_path = /var/log/dovecot-sieve.log log_path = /var/log/dovecot-sieve-errors.log managesieve_implementation_string = dovecot managesieve_max_line_length = 64 k } THANKS! Colin

3 5

Event 0x560045857eb0 leaked
by support＠openmbox.net 18 Nov '22

18 Nov '22

what do these logs mean in mail.log? Nov 18 10:23:03 mx dovecot: auth: Warning: Event 0x560045857eb0 leaked (parent=(nil)): auth-client-connection.c:338 Nov 18 10:23:03 mx dovecot: auth: Warning: Event 0x560045894390 leaked (parent=(nil)): auth-client-connection.c:338 Nov 18 10:23:03 mx dovecot: auth: Warning: Event 0x56004589d3e0 leaked (parent=(nil)): auth-client-connection.c:338 Nov 18 10:23:03 mx dovecot: auth: Warning: Event 0x56004588f810 leaked (parent=(nil)): auth-client-connection.c:338 Nov 18 10:23:03 mx dovecot: auth: Warning: Event 0x560045857240 leaked (parent=(nil)): auth-client-connection.c:338 Nov 18 10:23:03 mx dovecot: auth: Warning: Event 0x56004589cfd0 leaked (parent=(nil)): auth-client-connection.c:338 Nov 18 10:23:03 mx dovecot: auth: Warning: Event 0x56004586b130 leaked (parent=(nil)): auth-client-connection.c:338 I am using this version dovecot in a ubunto 20.04 box. # dovecot --version 2.3.7.2 (3c910f64b) thanks.

1 0

Dovecot 2.2 to 2.3 migration
by Markus Wienhöfer 17 Nov '22

17 Nov '22

Hi, we are currently using Dovecot 2.2 (from the Ubuntu 18.04 repos) and would like to migrate to 2.3 I have read the migration documentation regarding the configuration changes. Apart from that, is it feasible/possible to change from Ubuntu to official Dovecot repositories and upgrade the dovecot package this way? Or is there anything else we should be aware of? Best regards Markus

3 3