- dovecot - dovecot.org

Question about push notification plugin
by Zakaria 17 Feb '25

17 Feb '25

Hi Dovecot Mailing List members, I just struggled to understand the plugin events and wondered if anyone can help on this. I wanted to capture the event when I mark message as not spam move event as well as when I move message to new folder event, I found MessageNew and MessageAppend, and couldnt figure out which one is responsible of the relevant event? Also, feedback to the dovecot dev team, it would great if we have push notification redis driver. Thanks in advance. Zakaria.

2 2

Re: Doveadm Backup Error
by Asai 17 Feb '25

17 Feb '25

Thank you, Timo, that fixed the problem. Asai On 2/17/2025 9:03 AM, Timo Sirainen wrote: > On 17. Feb 2025, at 16.26, Asai via dovecot <dovecot(a)dovecot.org> wrote: >> >> sieve_script personal { >> active_path = /vmail/%{user | domain }/%{user | username >> }/home/.dovecot.sieve >> driver = file >> path = /vmail/%{user | domain }/%{user | username }/home/sieve >> } > > Looks like %variables aren't really working right with Sieve / doveadm > combination. It gives an error: > > Error: sieve: sieve_file_storage settings: Failed to parse > configuration: Failed to expand sieve_script_path setting variables: > Unknown variable 'user' > > So for now the only way is to avoid %variables there - that simplifies > the config anyway: > > sieve_script personal { > active_path = ~/.dovecot.sieve > path = ~/sieve > } > Thank you, Timo, that fixed the problem. Asai On 2/17/2025 9:03 AM, Timo Sirainen wrote: On 17. Feb 2025, at 16.26, Asai via dovecot <dovecot(a)dovecot.org> wrote: sieve_script personal { active_path = /vmail/%{user | domain }/%{user | username }/ home/.dovecot.sieve driver = file path = /vmail/%{user | domain }/%{user | username }/home/sieve } Looks like %variables aren't really working right with Sieve / doveadm combination. It gives an error: Error: sieve: sieve_file_storage settings: Failed to parse configuration: Failed to expand sieve_script_path setting variables: Unknown variable 'user' So for now the only way is to avoid %variables there - that simplifies the config anyway: sieve_script personal { active_path = ~/.dovecot.sieve path = ~/sieve }

1 0

Re: Doveadm Backup Error
by Asai 17 Feb '25

17 Feb '25

Thanks Timo, OK, I'll give that a try, I should point out that the Sieve filters are working as they should be for general delivery, outside of doveadm backup. Asai On 2/17/2025 9:03 AM, Timo Sirainen wrote: > On 17. Feb 2025, at 16.26, Asai via dovecot <dovecot(a)dovecot.org> wrote: >> >> sieve_script personal { >> active_path = /vmail/%{user | domain }/%{user | username >> }/home/.dovecot.sieve >> driver = file >> path = /vmail/%{user | domain }/%{user | username }/home/sieve >> } > > Looks like %variables aren't really working right with Sieve / doveadm > combination. It gives an error: > > Error: sieve: sieve_file_storage settings: Failed to parse > configuration: Failed to expand sieve_script_path setting variables: > Unknown variable 'user' > > So for now the only way is to avoid %variables there - that simplifies > the config anyway: > > sieve_script personal { > active_path = ~/.dovecot.sieve > path = ~/sieve > } > Thanks Timo, OK, I'll give that a try, I should point out that the Sieve filters are working as they should be for general delivery, outside of doveadm backup. Asai On 2/17/2025 9:03 AM, Timo Sirainen wrote: On 17. Feb 2025, at 16.26, Asai via dovecot <dovecot(a)dovecot.org> wrote: sieve_script personal { active_path = /vmail/%{user | domain }/%{user | username }/ home/.dovecot.sieve driver = file path = /vmail/%{user | domain }/%{user | username }/home/sieve } Looks like %variables aren't really working right with Sieve / doveadm combination. It gives an error: Error: sieve: sieve_file_storage settings: Failed to parse configuration: Failed to expand sieve_script_path setting variables: Unknown variable 'user' So for now the only way is to avoid %variables there - that simplifies the config anyway: sieve_script personal { active_path = ~/.dovecot.sieve path = ~/sieve }

1 0

FTS Xapian 1.9.1 released - Compatibility with git and 2.4
by Joan Moreau 17 Feb '25

17 Feb '25

Hi Finally released 1.9.1 to catch-up with 2.4.x and git recent changes Same "simplistic" approach - You get what you search for, no approximation/elastic/stemming, any language - No config required by default - Drastically reduced storage required / Drastically improved indexing/searching speed - Works on small servers or big servers https://github.com/grosjo/fts-xapian/ Thank you Aki Tuomi to help me pass this over the line Enjoy JM Hi Finally released 1.9.1 to catch-up with 2.4.x and git recent changes Same "simplistic" approach - You get what you search for, no approximation/elastic/stemming, any language - No config required by default - Drastically reduced storage required / Drastically improved indexing/ searching speed - Works on small servers or big servers https://github.com/grosjo/fts-xapian/ Thank you Aki Tuomi to help me pass this over the line Enjoy JM

2 1

Doveadm Backup Error
by Asai 17 Feb '25

17 Feb '25

Greetings, On 2.3 I was able to run the following command, but now on 2.4 I'm getting the following error: doveadm backup -u user(a)domain.tld maildir:/mnt/backups/daily/domain.tld/user dsync(user(a)domain.tld): Error: brain M: Exporting mailbox INBOX failed: Mailbox attribute iteration failed: Mailbox attributes not enabled So, I tried to set the configs to include: protocol imap { imap_metadata = yes ... } mail_attribute { dict file { path = %{home}/dovecot-attributes } } But then I get: Error: brain M: Exporting mailbox INBOX failed: Mailbox attribute iteration failed: BUG: Unknown internal error Can anyone clarify the proper configs for this? Thank you, Asai

3 5

Dovecot 2.4 - Example config
by Joan Moreau 17 Feb '25

17 Feb '25

Hi For those struggling with the new config, here an example I am using (Xapian, Sieve, mdbox, LMTP, ...) --- dovecot_config_version = 2.4.0 dovecot_storage_version = 2.4.0 base_dir = /run/dovecot state_dir = /var/lib/dovecot default_login_user = dovecot listen = * :: verbose_proctitle = yes mail_gid = mail mail_uid = mailusers mail_driver = mdbox mail_path = /data/mails/%{user | domain }/%{user | username } mail_home = /data/mails/%{user | domain }/%{user | username } mail_plugins = fts fts_xapian # mail_debug = yes # mail_cache_max_size = 128M ssl_server_cert_file = /etc/letsencrypt/live/gjnet/fullchain.pem ssl_server_key_file = /etc/letsencrypt/live/gjnet/privkey.pem ssl_server_dh_file = /etc/mail/dovecot/dh.pem mdbox_rotate_size = 64M default_vsz_limit = unlimited sendmail_path = /usr/sbin/sendmail sql_driver = mysql mysql localhost { user = services password = MYPASSWORD dbname = services } fts xapian { } fts_autoindex = yes fts_decoder_driver = script fts_decoder_script_socket_path = decode2text sieve_script default { type = default driver = file path = /data/mails/sieve/default.sieve } sieve_script before { type = before driver = file path = /data/mails/sieve/after.sieve } sieve_script after { type = after driver = file path = /data/mails/sieve/after.sieve } sieve_script personal { type = personal driver = file path = /data/mails/%{user | domain }/%{user | username }/sieve/ active_path = /data/mails/%{user | domain }/%{user | username }/sieve/default.sieve } sieve_script global { type = global driver = file path = /data/mails/sieve/ } namespace inbox { inbox = yes mailbox Trash { auto = subscribe special_use = \Trash fts_autoindex = no } mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Sent { auto = subscribe special_use = \Sent } mailbox Spam { auto = subscribe special_use = \Junk } } userdb sql { query = SELECT 1 from users where user like '%{user | username}' and domain like '%{user | domain}' and active=1 iterate_query = SELECT user AS username, domain FROM users where active=1 } passdb sql { query = SELECT concat(user, '@', domain) AS user, password from users where user like '%{user | username}' and domain like '%{user | domain}' and active=1 } service auth { unix_listener auth-userdb { mode = 0600 user = mailusers } } protocols = imap pop3 sieve lmtp service imap-login { chroot = login process_min_avail = 8 restart_request_count = unlimited } service indexer-worker { vsz_limit = 4G } protocol imap { imap_client_workarounds = delay-newmail tb-extra-mailbox-sep imap_max_line_length = 655360 mail_max_userip_connections = 256 } service pop3-login { chroot = login } protocol pop3 { mail_max_userip_connections = 256 pop3_enable_last = yes pop3_lock_session = no pop3_reuse_xuidl = yes } service lmtp { inet_listener lmtp { address = 127.0.0.1 ::1 port = 24 } unix_listener lmtp { mode = 0666 } process_min_avail = 8 } service managesieve-login { chroot = login inet_listener sieve { port = 4190 } inet_listener sieveold { port = 2000 } } protocol sieve { managesieve_implementation_string = dovecot mail_max_userip_connections = 256 managesieve_max_line_length = 65536 } protocol lmtp { mail_plugins { fts = yes fts_xapian = yes sieve = yes } } protocol lda { auth_socket_path = /run/dovecot/auth-userdb hostname = mx.grosjo.net mail_plugins = $mail_plugins sieve postmaster_address = admin(a)grosjo.net lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes mail_plugins { fts = yes fts_xapian = yes sieve = yes } } service stats { unix_listener stats-writer { mode = 0660 user = mailusers } } service decode2text { executable = script /usr/libexec/dovecot/decode2text.sh user = dovecot unix_listener decode2text { mode = 0666 } }

1 0

Registering module in 2.4
by Joan Moreau 16 Feb '25

16 Feb '25

Hi I am trying to adjust the Xapian plugin to the very recent massive changes. https://github.com/grosjo/fts-xapian I implemented the changes about the settings However, I get to : Feb 16 13:39:44 gjserver dovecot[2211311]: imap(xxx)<2211361><W21YikIuomA2rj7G>: Error: fts: Failed to initialize backend 'xapian': Unknown backend Has the module registration changed as well ? Thank you so much

1 4

Userdb lookup problems
by Ken Wright 16 Feb '25

16 Feb '25

I finally got my new Dovecot 2.4 installation going to the point I can log in from Evolution, but for some reason it won't accept my password. Here are the pertinent sections from the dovecot.conf, 10-mail.conf, and dovecot-sql.conf.ext files: dovecot.conf: userdb sql { query = SELECT home, uid, gid FROM mailbox WHERE username = '%{user | username}' AND domain = '%{user | domain}' AND active= '1' 10-mail.conf: mail_driver = maildir #mail_home = %{home} mail_home = /var/vmail/%{user | domain }/%{user | username } mail_path = ~/mail mail_inbox_path = /var/vmail/%{user | domain}/%{user | username } mailbox_list_utf8 = yes namespace inbox { separator = / inbox = yes } dovecot-sql.conf.ext: driver = mysql connect = host=localhost dbname=postfixadmin user=postfixadmin password=hidden userdb_default_password_scheme = ARGON2I password_query = SELECT username AS username, password FROM mailbox WHERE username = '%{user | username }' AND active= '1' user_query = SELECT maildir, 2000 AS uid, 2000 AS gid FROM mailbox WHERE username = '%{user | username }' AND active= '1' iterate_query = SELECT username AS username FROM mailbox I hope someone can explain my horrible mistake! Ken

6 32

v2.4 and fts-flatcurve configuration
by Felix Zielcke 16 Feb '25

16 Feb '25

Hi, I updated today to 2.4.0 and still have problems configuring fts- flatcurve. This is in my config: mail_plugins { fts = yes fts_flatcurve = yes } fts flatcurve { language de { default = yes } language en { } autoindex = yes } But it then fails to start with: doveconf: Error: Failed to get language de: Filter language=de unexpectedly not found (invalid userdb or -o override settings?) doveconf: Fatal: Error in configuration file /etc/dovecot/dovecot.conf: Failed to get language de: Filter language=de unexpectedly not found (invalid userdb or -o override settings?) If I comment out the language settings, then it starts. But a "doveadm fts rescan -A" fails with: doveadm(***): Error: fts: Failed to initialize backend 'flatcurve': languages settings: Invalid settings: No language { .. } defined doveadm(***): Error: fts not enabled for user's namespace INBOX How do I fix these 2 errors?

2 2

Dovecot 2.4-GIT -> Some errors
by Joan Moreau 16 Feb '25

16 Feb '25

Hi Using latest git, I get 2 very weird errors 1 - Just launching dovecot, I get: Feb 15 14:04:05 gjserver dovecot[444199]: doveconf: Fatal: Error in configuration file /etc/mail/dovecot/dovecot.conf line 13: mail_location: Unknown setting: mail_location My mail_location is mail_location = mdbox:/data/mails/%d/%n All was working fine at the time of release of 2.4 Not any more 2 - Trying to adjust my plugin (FTS Xapian) to latest git, I get : make[2]: Entering directory '/files/src/fts-xapian/src' /bin/sh ../libtool --tag=CC --mode=compile gcc -DHAVE_CONFIG_H -I. -I.. -O2 -I/usr/include/dovecot -DFTS_MAIL_USER_INIT_FOUR_ARGS=1 -g -O2 -std=gnu99 -fstack-protector-strong -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=2 -O2 -MT fts-xapian-plugin.lo -MD -MP -MF .deps/fts-xapian-plugin.Tpo -c -o fts-xapian-plugin.lo fts-xapian-plugin.c libtool: compile: gcc -DHAVE_CONFIG_H -I. -I.. -O2 -I/usr/include/dovecot -DFTS_MAIL_USER_INIT_FOUR_ARGS=1 -g -O2 -std=gnu99 -fstack-protector-strong -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=2 -O2 -MT fts-xapian-plugin.lo -MD -MP -MF .deps/fts-xapian-plugin.Tpo -c fts-xapian-plugin.c -fPIC -DPIC -o .libs/fts-xapian-plugin.o In file included from /usr/include/dovecot/lib.h:37, from fts-xapian-plugin.h:7, from fts-xapian-plugin.c:3: /usr/include/dovecot/macros.h:173:21: error: size of unnamed array is negative 173 | (sizeof(char[1 - 2 * ((condition) ? 1 : 0)]) > 0 ? FALSE : FALSE) | ^ The first line of fts-xapian-plugin.h is #include "lib.h" (nothing else before) Your help welcome Thank you so muich

4 18

Dovecot v2.4.0 released
by Aki Tuomi 16 Feb '25

16 Feb '25

Hi all, after a very long wait we are finally happy to release Dovecot v2.4.0! Some IMPORTANT things to notice: - We have changed the signing key for 2.4 going forward, releases are signed with EF0882079FD4ED32BF8B23B2A1B09EF84EDC5219, which can be found at https://repo.dovecot.org/DOVECOT-REPO-GPG-2.4 and is signed with the previous key. The old key has been renamed to https://repo.dovecot.org/DOVECOT-REPO-GPG-2.3. - New 2.4 packages **are not** compatible with old 2.3 configuration, please carefully review https://doc.dovecot.org/2.4.0/installation/upgrade/2.3-to-2.4.html before installing the new packages. - We are happy to provide experimental arm64 support in the form of a Docker image. - Docker images are now ran rootless, with UID 1000 as vmail using built sources. Please take this into consideration when upgrading. Latest 2.3 image can be used with tag 2.3-latest, if you are not ready for this change. We won't be sending separate mail about Pigeonhole anymore as we will release one anyways when we release Dovecot, and Pigeonhole versioning has been changed to match Dovecot versioning. Source codes available at - https://www.dovecot.org/releases/2.4/dovecot-2.4.0.tar.gz - https://www.dovecot.org/releases/2.4/dovecot-2.4.0.tar.gz.sig - https://pigeonhole.dovecot.org/releases/2.4/dovecot-pigeonhole-2.4.0.tar.gz - https://pigeonhole.dovecot.org/releases/2.4/dovecot-pigeonhole-2.4.0.tar.gz… Binary packages in https://repo.dovecot.org/ Docker images in https://hub.docker.com/r/dovecot/dovecot Kind regards, Aki Tuomi Open-Xchange oy --- Dovecot Core NEWS ----------------- * config: dovecot_config_version must be the first non-comment line in configuration file. * config: dovecot_storage_version must be in the configuration file. * config: Many configuration options have changed so old configuration files do not work without rewrite. See https://doc.dovecot.org/main/installation/upgrade/2.3-to-2.4.html * config: New variable expansion syntax has been introduced, see https://doc.dovecot.org/main/core/settings/variables.html * config: Some default settings have changed. * config: plugin {} section has been removed. * *-login: With ssl=required, connections from login_trusted_networks are now also required to be SSL/TLS encrypted. * acl: Use ACL settings instead of Global ACL Directories. * auth-worker: auth_worker_max_count is replaced with service auth-worker { process_limit }. * auth: Weak password schemes are disabled by default, use auth_allow_weak_schemes to enable them. * auth_debug, mail_debug: Use log_debug filter instead. * config: All sections require a name, for example passdb/userdb: passdb static { password=secret } * db2: Remove Berkeley DB support. * dict-memcached: This is removed, use Redis instead. * director: Feature has been removed. See potential replacement at https://github.com/dovecot/tools/blob/main/director.lua * doveadm: USER environment variable is only supported with --no-userdb-lookup. One of -u, -F or -A must be used otherwise. * doveconf: Option -n is now default when running doveconf. * dsync: Use doveadm sync instead, legacy symlink has been removed. * fs-sis: Feature is now deprecated and has been made read-only. It will be removed in future release. * fts-lucene, fts-squat: These have been removed, use fts-flatcurve or fts-solr instead. * imap-login: IMAP compression is now handled in proxies. * imap_quota: SETQUOTA / quota_set has been removed. * imap_zlib: This plugin is no longer needed, it's always enabled. * imapc: All features are enabled by default, imapc_features can be used to explicitly disable features that are not wanted. * lib-storage: mbox driver is now frozen. * mail_compress: XZ and LZMA algorithm support has been removed. * mailbox-alias: Plugin has been removed. * old_stats, auth_stats: These have been removed. * openssl: Minimum supported version of OpenSSL is now 1.1.1. * openssl: Add support for OpenSSL 3.x * quota-dict, quota-dirsize: These have been removed, use quota-count instead. You can use quota_clone to copy quota usage to some database. * replicator: Feature has been removed. Use NFS or some other shared filesystem instead, or run doveadm sync in crontab. * stats: The bytes_in and bytes_out field in several events have been renamed as net_in_bytes and net_out_bytes. * zlib: Renamed to mail_compress plugin. + Experimental SMTPUTF8 and IMAP UTF8=ACCEPT support has been added. Needs --enable-experimental-mail-utf8 configure option and mail_utf8_extensions=yes setting. + Long running mail commands can be aborted with Ctrl-C / doveadm kick. + auth: LDAP driver now supports multi-value attributes. + auth: Add support for SCRAM-SHA-1-PLUS and SCRAM-SHA-256-PLUS. + auth: Add support for TLS channel binding. + auth: Support sending JA3 hash to policy server. + configure: Detect latest Lua version. + *-login: Support for TLS Server Name has been improved to allow pre-login settings. For example capabilities to be changed based on TLS Server Name. + *-login: Support for TLS ALPN has been added, connections with mismatching application are now refused. Missing ALPN is accepted. + fts-flatcurve: New Xapian based FTS plugin has been added. + imap: Support for INPROGRESS untagged messages as per RFC 9585. + lib-lua: Expose Dovecot DNS client. + lib-lua: Expose Dovecot HTTP client. + lib-sasl: Support SCRAM-SHA mechanisms. + lmtp: SNI support has been added which allows settings to be applied based on TLS Server Name. + sqlite: Support WAL mode. + stats: Submetric name size has been increased. + submission: Add submission_add_received_header setting to protect sender identity by suppressing the Received: header. - Many bugs have been fixed. Pigeonhole NEWS --------------- * Change configuration syntax to match new Dovecot configuration syntax. * vacation: Reduce default days to 60 from infinity * vacation: vacation_max_period=0 is now an error. * Version has been changed to match Dovecot version. + Added i;unicode-casecmp comparator. - Lots of bugs have been fixed.

21 49

Doveadm backup and sieves
by Doug Hardie 15 Feb '25

15 Feb '25

I am using doveadm backup to backup mailfiles to a second drive. That works just fine. However, the sieve files are not backed up. I couldn't find anything in the backup documentation that addresses sieves. Is there a way to back those up also? -- Doug

1 0

Segfault Errors
by Asai 15 Feb '25

15 Feb '25

Greetings, I just migrated over to Dovecot 2.4.0-2 on a new VM running Alma 9. Everything seems to be working fine but I'm noticing these errors on the VM console every couple of hours. Is this something that I can fix with system settings, or something that I can ignore? Were running the mailstore on NFS, if that's anything. Thanks for your assistance. Here's an example: [224035.047834] imap[119919]: segfault at 160 ip 00007f430f850d3b sp 00007ffff874fcf0 error 4 in libdovecot.so.0.0.0[7f430f4a0a80+138000] likely on CPU 0 (core 0, socket 0) [224035.048074] Code: ff 48 c7 c5 48 b6 0c 80 00 00 48 89 d5 3c b6 0c 80 00 48 83 c4 08 5b 41 5c c3 0f 1f 80 f3 0f 1e fa 4 55 48 89 e5 53 <48> 8b bf 60 01 80 48 05 ff 74 51 48 89 f3 31 f6 e8 ef d7 ef ff [224058.098121] imap[119971]: segfault at 160 ip 00007f395e15d3b sp 00007ffff6e43b60 error 4 in libdovecot.so.0.0.0[7f395e0fa0a0+138000] likely on CPU 0 (core 0, socket 0) [224059.896511] Code: ff 48 c7 c5 48 b6 0c 80 00 00 48 89 d5 3c b6 0c 80 00 48 83 c4 08 5b 41 5c c3 0f 1f 80 f3 0f 1e fa 4 55 48 89 e5 53 <48> 8b bf 60 01 80 48 05 ff 74 51 48 89 f3 31 f6 e8 ef d7 ef ff [224268.735121] imap[119917]: segfault at 160 ip 00007f9e4335d3b sp 00007ffff6d12ab0 error 4 in libdovecot.so.0.0.0[7f9e4324a0b0+138000] likely on CPU 0 (core 0, socket 0) [224268.736464] Code: ff 48 c7 c5 48 b6 0c 80 00 00 48 89 d5 3c b6 0c 80 00 48 83 c4 08 5b 41 5c c3 0f 1f 80 f3 0f 1e fa 4 55 48 89 e5 53 <48> 8b bf 60 01 80 48 05 ff 74 51 48 89 f3 31 f6 e8 ef d7 ef ff Asai

2 1

lmtp "Saved" but no maildir file
by MRob 15 Feb '25

15 Feb '25

Hello I have accounts with Maildir (mail_location is empty/default) and postfix using lmtp for delivery. Some account create new file in Maildir/new after each deliver. However a couple account I see lmtp successful delivery but no new file anywhere in the Maildir: lmtp(21379): Connect from local lmtp(me)<21379><Mbc+GgTmrofPHw4vAMIs8i>: msgid=<...trimmed...>: saved mail to INBOX 370A131BE: to=<me(a)example.com>, relay=email.example.com[private/dovecot-lmtp], delay=0.3, delays=0.22/0.01/0.02/0.01, dsn=2.0.0, status=sent (250 2.0.0 <me(a)example.com> Mbc+GgTmrofPHw4vAMIs8i Saved) lmtp(21379): Disconnect from local: Logged out (state=READY) /home/me/Maildir/new is empty and also try "find /home/me/Maildir -type f | wc -l" but no different before/after Very interesting I can see trace of message in dovecot cache! "grep -r 'domain.from.message.id' /home/" (search all accounts) says: grep: /home/me/Maildir/dovecot.index.cache: binary file matches So dovecot put traces of message into Maildir but no message file after successful "Saved" in logs. What can I do?

2 2

dovecot with libsodium on macos 10.13
by Jan Henk Koning 14 Feb '25

14 Feb '25

L.S. My name is Jan Henk Koning I am from the Netherlands and i would like youre help on the following subject. I saw a lot of reactions of you online in regards to questions about getting ARGON2I password hashing scheme available in dovecot. I tried a lot of suggestions and even installed / compiled your dovecot-libsodium-plugin-master which needed a lot of debugging on my system. Unfortunately I can not get it to work. I have dovecot 2.3.21.1 (d492236fa0) installed via macports. I also have mysql8 and php83 all via macports. I understood that I needed to have libsodium installed, so I also installed that via Macports. The problem is that I can not find the way to tell dovecot to use the libsodium plugin. I tried "!include sodium.h" in my 10-auth.conf file, but that does not work. I also edited the portfile of dovecot with the line "--with sodium" no succes. sudo doveadm pw -l gives me: SHA1 SSHA512 SCRAM-SHA-256 BLF-CRYPT PLAIN HMAC-MD5 OTP SHA512 SHA DES-CRYPT CRYPT SSHA MD5-CRYPT PLAIN-MD4 PLAIN-MD5 SCRAM-SHA-1 CLEAR CLEARTEXT SSHA256 MD5 PBKDF2 SHA256 CRAM-MD5 PLAIN-TRUNC SMD5 DIGEST-MD5 LDAP-MD5 I can not find specific instructions for dovecot and sodium installed via Macports on macos. Can you maybe help me in the right direction ? Many thanks in advance, Best regards, Jan Henk Koning

2 1

Migrating from 2.3 to 2.4 Maildir Config Problems
by Asai 13 Feb '25

13 Feb '25

Greetings, We've been using Dovecot since 2007, and I'm migrating yet again to a new version of Dovecot. Going from 2.3 to 2.4 and a lot of things have changed. I've been able to manage many of them, but I'm stuck on Maildir configuration, and I'm unable to understand the documentation as relates to this. Hopefully someone can clarify. Error: Initializing mail storage from mail_driver=maildir setting failed: maildir: maildir settings: Failed to parse configuration: Failed to override configuration from userdb: Invalid maildir=gcmm.net/test/: Setting is a named filter, use 'maildir {' Here's my doveconf as it has been migrated from 2.3 to 2.4 thus far. I realize that there are probably better ways to do things and I'm open to suggestions, but keep in mind that this is a production set up with hundreds of users and I've tried to maintain backwards compatibility through the years. Thanks for your assistance, Asai # 2.4.0 (daeb6bc59c): /etc/dovecot/dovecot.conf # Pigeonhole version 2.4.0 (1b2d5bb9) # OS: Linux 5.14.0-503.23.1.el9_5.x86_64 x86_64 AlmaLinux release 9.5 (Teal Serval) xfs # Hostname: xxxxx dovecot_config_version = 2.4.0 auth_allow_weak_schemes = yes auth_mechanisms = auth_mechanisms { plain = yes login = yes } auth_verbose_passwords = plain debug_log_path = /var/log/dovecot-debug.log default_vsz_limit = 512M deliver_log_format = msgid=%{msgid}: from=%{from}: %{deliver_log_format_extras} dovecot_storage_version = 2.4.0 hostname = xx.xxxx.xxxx log_path = /var/log/dovecot.log mail_driver = maildir mail_fsync = always #mail_home = /vmail/%{user | domain }/%{user | username }/home mail_log_events { delete = yes undelete = yes expunge = yes copy = yes mailbox_delete = yes mailbox_rename = yes flag_change = yes append = yes } mail_log_fields { uid = yes box = yes msgid = yes from = yes flags = yes } #mail_path = /vmail/%{user | domain }/%{user | username } mmap_disable = yes protocols { imap = yes lmtp = yes sieve = yes } sql_driver = mysql submission_relay_host = xxxx.xxxx.xxxxx submission_relay_port = 587 submission_relay_ssl = starttls submission_relay_trusted = yes syslog_facility = local5 mysql localhost { dbname = xxxx password = xxxxx user = postfix } passdb sql { default_password_scheme = PLAIN-MD5 query = SELECT password FROM mailbox WHERE username = '%{user}' } userdb sql { iterate_query = select username from mailbox; query = SELECT maildir, concat('/vmail/',maildir,'home') as home, 1001 AS uid, 1001 AS gid FROM mailbox WHERE username = '%{user}' and active = 1 } #namespace inbox { # inbox = yes # prefix = # separator = / # type = private #mailbox Drafts { # auto = subscribe # special_use { # "\\Drafts" = yes # } #} #mailbox Junk { # auto = subscribe # special_use { # "\\Junk" = yes # } #} #mailbox Spam { # special_use { # "\\Junk" = yes # } #} #mailbox Trash { # auto = subscribe # special_use { # "\\Trash" = yes # } #} #mailbox Sent { # auto = subscribe # special_use { # "\\Sent" = yes # } #} #mailbox "Sent Messages" { # special_use { # "\\Sent" = yes # } #} #mailbox "Sent Items" { # special_use { # "\\Sent" = yes # } #} #} #namespace empty { # prefix = # separator = / # alias_for = inbox # subscriptions = yes # mailbox_list_index_prefix = #} maildir { broken_filename_sizes = yes mail_path = /vmail/%{user | domain }/%{user | username } mail_home = /vmail/%{user | domain }/%{user | username }/home } service imap-login { restart_request_count = unlimited inet_listener imap { port = 143 } inet_listener imaps { port = 993 ssl = yes } } service lmtp { vsz_limit = 512M unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0660 user = postfix } } service imap { process_limit = 4096 vsz_limit = 1024 MB } service auth { user = root unix_listener auth-master { group = vmail mode = 0660 user = vmail } unix_listener auth-userdb { group = vmail mode = 0666 user = vmail } unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } } service auth-worker { } service dict { unix_listener dict { } } ssl_server { cert_file = /etc/postfix/ssl/server.pem dh_file = /etc/dovecot/dh.pem key_file = /etc/postfix/ssl/server.key } service stats { unix_listener stats-reader { group = vmail mode = 0660 user = vmail } unix_listener stats-writer { group = vmail mode = 0660 user = vmail } } protocol lda { } protocol imap { mail_max_userip_connections = 20 mail_plugins { mail_log = yes notify = yes } } protocol lmtp { mail_plugins { sieve = yes } } service managesieve-login { process_min_avail = 0 restart_request_count = 1 vsz_limit = 64M inet_listener sieve { port = 4190 } } service managesieve { process_limit = 1024 } sieve_script personal { active_path = /vmail/%{user | domain }/%{user | username }/home/.dovecot.sieve driver = file path = /vmail/%{user | domain }/%{user | username }/home/sieve } sieve_script before { path = /vmail/sieve/junk-spam.sieve type = before } sieve_script after { path = /vmail/sieve/junk-spam.sieve type = after } mail_debug = yes auth_verbose = yes auth_debug = yes auth_debug_passwords = yes log_debug = category=mail

2 4

Mustiple domains
by Ken Wright 13 Feb '25

13 Feb '25

I host two email servers, example1.com and example2.net. How can I configure Dovecot 2.4 to distinguish between the two? Ken

6 13

Re: suggestion: Argon2id example in `doveadm pw` examples
by Michael Slusarz 13 Feb '25

13 Feb '25

> On 02/08/2025 10:31 PM MST Sean McBride via dovecot <dovecot(a)dovecot.org> wrote: > > It says here https://www.dovecot.org/bugreport-mail/ that bug reports should go to this list. Does that apply to suggestions too? Assuming so... Best practice these days is to file a bug report (or MR) to GitHub. https://github.com/dovecot/ shows the various Dovecot components. We are actively working on improving our various websites, so this updated recommendation will (eventually) work its way on the pages somewhere. > The docs here are very good: > > https://doc.dovecot.org/main/core/man/doveadm-pw.1.html > > but it's always nice to have examples of current best practice. As I understand it, the best password hashing algorithm these days is Argon2id, according to: > > https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet… > > So it would be nice to have an example corresponding to best practices, showing use of argon2id. > > I could attempt a PR on GitHub if you'd like. That would be the proper way to suggest. Do note: as mentioned in another message to the list I just sent, the mission of the Dovecot documentation is to document how the software works. It is not to document email server hosting best practices. Determination of which PW hashing algorithm to use seems to be in the latter category. (Documenting that Dovecot supports argon2id is in scope per the former, but it sounds like we did our job there.) michael

3 2

Dovecot's default password storage scheme is not GDPR compliant
by Rupert Gallagher 13 Feb '25

13 Feb '25

Dovecot aligns the password encryption scheme used by the imap client with the password storage scheme used by the server. Since the default is set to plain text, the client sends the password in plain text (tls tunneled), and the server local storage of passwords is a plain text file. For minimum protection, just enough to say you are not using plaintext, you can use md5, so the client sends the hashed password and the server's local storage is a plain text file containing hashed passwords. Last year a GDPR commissioner filed a hefty monetary sanction to a company because they used md5 to store passwords. Therefore, Dovecot's plain text default, and the md5 option, are both non-GDPR compliant. To avoid monetary sanctions, Dovecot ought to change how it stores passwords by default. Please do not ignore this message.

10 17

dovecot 2.4.0: Unable to build without LDAP/LUA headers/libs.
by h_y_i_e_n＠yahoo.com 13 Feb '25

13 Feb '25

I'm getting LDAP/LUA build errors with dovecot 2.4.0 even when --without-lua and --without-ldap is specified: eg. In file included from db-ldap-settings.c:9: ../../src/lib-ldap/ldap-settings-parse.h:4:10: fatal error: ldap.h: No such file or directory 4 | #include <ldap.h> | ^~~~~~~~ compilation terminated. make[3]: *** [Makefile:2134: auth-db-ldap-settings.o] Error 1

3 2

Configuration rewrite feature is now in main
by Aki Tuomi 12 Feb '25

12 Feb '25

Hi all! We were finally able to merge the content in 2.4.0 + new development to main. We had to rebase it few times before merging, so release-2.4.0 will not match with main exactly. 2.4.1 will be made from main though, so it will be fine again in this regards. Regards, Aki Tuomi

1 0

Re: Dovecot's default password storage scheme is not GDPR compliant
by Michael Slusarz 12 Feb '25

12 Feb '25

GDPR applies to companies operating software, not the software itself. As Aki pointed out (somewhere) in this thread, Dovecot doesn't store passwords itself, and doesn't work unless an admin proactively configures at least one authentication mechanism, so it is "secure by default" under any definition I'm aware of. We might be open to a (short) MR on some language to add to the base authentication configuration page that would alert an admin to possible GDPR requirements. But the Dovecot configuration site is maintained to describe how the software works, not educate on what you might or might not need to do to operate a public mail platform, so the scope of such MR would need to be exceedingly narrow. michael > On 02/12/2025 9:16 AM MST infoomatic via dovecot <dovecot(a)dovecot.org> wrote: > > > On 12.02.25 01:25, Steven Varco via dovecot wrote: > > So, after my mandatory rant :D, the DEFAULT setup of dovecot should actually be as simple as possible. > > > I fully second that. There is no need to discuss whether dovecots > default password storage complies to GDPR or not. The administrator or > the liable person of a company is responsible for taking care about it, > just as Steven Varco mentioned, the same goes with web servers or any > publicly available service. The important point is: you can configure > dovecot complying to the GDPR. > > Because what's next - argue that a web framework is not GDPR compliant > in its standard configuration because there is no cookie consent popup > by default? This is ridiculous. > > Regards, > Robert > _______________________________________________ > dovecot mailing list -- dovecot(a)dovecot.org > To unsubscribe send an email to dovecot-leave(a)dovecot.org

1 0

Re: mailinglist (mailman) + dovecot
by Schulz 12 Feb '25

12 Feb '25

Hello, just have a look at the mailman documentation (hooking up the mail server). Yes, mailman receives mail via LMTP. No, the container is not stateless, mailman processes data on local queue directories that should be persistent. Maybe you want to switch over to the mailman list after consulting the detailed mailman3 documentation. Am 12. Februar 2025 um 15:43 schrieb "Marc" <Marc(a)f1-outsourcing.eu mailto:Marc@f1-outsourcing.eu?to=%22Marc%22%20%3CMarc%40f1-outsourcing.eu%3E >: > > Yes I also don't like to have this on the server. I was just looking at these Dockerfiles they have there. I prefer to have an external stateless container for this. This mailman seems to connect to a database. So I was just wondering how it should receive the emails. > > currently I have sendmail deliver to docker lmtp. > FEATURE(`local_lmtp',`[IPC]',`FILE /var/run/dovecot/lmtp')dnl > > I guess I should be able to deliver remotely with something like this. > dnl FEATURE(`local_lmtp',`[IPC]',`TCP [192.168.xx.xx] 24')dnl > > Just need to figure out how to configure sendmail for what to use when. > > Do you know if you can run mailman in stateless containers because it stores everything in the db? And this lmtp is only for temporary new mail processing? And does it indeed have an 'lmtp" port open? > > > > > we always prefer to separate things, for example in docker containers > > (https://github.com/maxking/docker-mailman is the official one), but > > when you use a python .venv, isolation is already halfway done > > > > > > Am 12. Februar 2025 um 14:38 schrieb "Marc via dovecot" > > <dovecot(a)dovecot.org > > <mailto:dovecot@dovecot.org?to=%22Marc%20via%20dovecot%22%20%3Cdovecot%4 > > 0dovecot.org%3E> >: > > > > I was think of adding a mailinglist for a few users. First I > > thought about maybe using separate container for this, but maybe I can > > just also add this to the server running dovecot. > > > > Anyone having experience with running mailman or something else > > next to dovecot? > > > > > > _______________________________________________ > > dovecot mailing list -- dovecot(a)dovecot.org > > To unsubscribe send an email to dovecot-leave(a)dovecot.org > > >

1 0

mailinglist (mailman) + dovecot
by Marc 12 Feb '25

12 Feb '25

I was think of adding a mailinglist for a few users. First I thought about maybe using separate container for this, but maybe I can just also add this to the server running dovecot. Anyone having experience with running mailman or something else next to dovecot?

1 0

Dovecot uses wrong separator after migration, modify sieve script
by Matthias Fechner 12 Feb '25

12 Feb '25

Dear all, I migrated a dovecot installation that was using pam to a virtual setup where users are stored in a SQL database. I see that my old pam based installation on the filesystem directories are starting with a dot. The new server does not have the leading dot. So even if the configuration is mostly equal, I cannot find a reason why dovecot changed its behavior here. I do not define a separator in the dovecot configuration and the same dovecot package on FreeBSD is used for both installations. My problem is now, that I use a rather complex sieve script to automatically sort mailinglist based emails automatically into subfolders. But as this script is using a dot it is now not moving the email into a nested directory like: github/haproxy/haproxy but is generating a flat directory (depth 1) as github.haproxy.haproxy I cannot change the behavior of dovecot, as I have several users running there and I do not want to cause problem for them changing the dovecot configuration. So I must modify the sieve script. As I do not really know the sieve syntax, I would like to ask if hopefully someone here can help me. I think is is necessary to change the dots to slashes before the fileinto is executed. The sievescript I use to sort mailing based emails into subfolder is: # # 2016-5-2 Script to sort mailing list mails automatically to folders # ## require [ "regex", "include", "variables", "fileinto", "envelope", "mailbox", "imap4flags", "vnd.dovecot.debug" ]; global ["sender_userpart", "sender_domain", "listname"]; # split out the various list forms # Mailman & other lists using list-id if exists "list-id" { fileinto :create "${listname}"; stop; } # Listar and mailman like elsif exists "x-list-id" { debug_log "Mailinglist: x-list-id found"; if header :regex "x-list-id" "<([a-z_0-9-]+)\\\\." { set :lower "listname" "${1}"; fileinto :create "${listname}"; } else { keep; } stop; } # Ezmlm elsif exists "mailing-list" { debug_log "Mailinglist: mailing-list found"; if header :regex "mailing-list" "([a-z_0-9-]+)@" { set :lower "listname" "${1}"; fileinto :create "${listname}"; } else { keep; } stop; } # York lists service elsif exists "x-mailing-list" { debug_log "Mailinglist: x-mailing-list found"; if header :regex "x-mailing-list" "^\\\\s*([a-z_0-9-]+)@?" { set :lower "listname" "${1}"; fileinto :create "${listname}"; } else { keep; } stop; } # Smartlist elsif exists "x-loop" { debug_log "Mailinglist: x-loop found"; if header :regex "x-loop" "^\\\\s*(a-z_0-9-]+)@?" { set :lower "listname" "${1}"; fileinto :create "${listname}"; } else { keep; } stop;} # poorly identified elsif envelope :contains "from" "owner-" { debug_log "Mailinglist: poorly identified matched"; if envelope :regex "from" "owner-([a-z_0-9-]+)-outgoing@" { set :lower "listname" "${1}"; fileinto :create "${listname}"; } elsif envelope :regex "from" "owner-([a-z_0-9-]+)@" { set :lower "listname" "${1}"; fileinto :create "${listname}"; } elsif header :regex "Sender" "owner-([a-z_0-9-]+)@" { set :lower "listname" "${1}"; fileinto :create "${listname}"; } else { keep; } stop;} # other poorly identified elsif envelope :contains "from" "-request" { if envelope :regex "from" "([a-z_0-9-]+)-request@" { set :lower "listname" "${1}"; fileinto :create "${listname}"; } else { keep; } stop; } Thanks a lot! Gruß Matthias -- "Programming today is a race between software engineers striving to build bigger and better idiot-proof programs, and the universe trying to produce bigger and better idiots. So far, the universe is winning." -- Rich Cook

1 0

Error in tests for Dovecot 2.4.0 aarch64
by Peter 11 Feb '25

11 Feb '25

When attempting to build Dovecot 2.4.0 on the aarch64 platform, when running tests... test-file-cache.c:268: Assert failed: file_cache_set_size(cache, 1024) == -1 Panic: file test-common.c: line 222 (test_expect_error_string_n_times): assertion failed: (expected_errors == 0) test-common.c:256: Assert failed: suppress == TRUE Error: Raw backtrace: #0 fatal_handler_real[0x7f73779dcca0] -> #1 default_fatal_handler[0x7f73779dcda0] -> #2 i_panic[0x7f73779766ec] -> #3 test_file_cache[0x7f7377997740] -> #4 main[0x7f7377977420] -> #5 __libc_start_call_main[0x4000008f4210] -> #6 __libc_start_main[0x4000008f42c0] -> #7 _start[0x7f7377977980] Any ideas on this one? Peter

4 7

How do I change the password encryption scheme?
by Ken Wright 10 Feb '25

10 Feb '25

Still working through difficulties upgrading to Dovecot 2.4. Right now I'm having trouble getting my mail client (Evolution) to connect; I keep getting "temporary authentication failures." Before upgrading I was using the ARGON2I encryption scheme, so all my users' passwords are stored that way. How do I tell 2.4 to use ARGON2I by default? There used to be a "default_pass_scheme" parameter but that's apparently gone now. Any help is greatly appreciated! Ken

2 1

Dovecot 2.4.0 fails to start with exit code 89
by Ken Wright 10 Feb '25

10 Feb '25

I've been trying to upgrade to 2.4.0. I've gone through the conf files, changing variables per the upgrade instructions. When I try to run sudo systemctl start dovecot.service, I get error 89. Journalctl shows me the error in question is "File name too long." I think it's coming from where 10-ssl.conf looks for the certs, but I'm probably wrong. Can anyone make a suggestion? Ken

4 4

Different Replicator Crash??
by Kent Borg 09 Feb '25

09 Feb '25

I added the suggested "count--" and recompiled, and it now appears to work, the replication goes both ways, eyeballing the e-mail on the two servers they look the same. Good. But part of the time I am still getting what looks very much like the same crash, is there another "count--" I need to add to that file? > Jan 28 10:53:08 la dovecot[96175]: replicator: Panic: data stack: Out > of memory when allocating 268435496 bytes > Jan 28 10:53:08 la dovecot[96175]: replicator: Error: Raw backtrace: > #0 t_askpass[0x7fb404b0c0] -> #1 backtrace_append[0x7fb404b374] -> #2 > backtr\ > ace_get[0x7fb404b510] -> #3 execvp_const[0x7fb4057ba4] -> #4 > i_syslog_fatal_handler[0x7fb4058510] -> #5 i_panic[0x7fb3fa6808] -> #6 > t_pop_pass_st\ > r[0x7fb4050eb4] -> #7 connection_deinit[0x7fb4056430] -> #8 > pool_datastack_create[0x7fb407e7b0] -> #9 > array_bsearch_insert_pos_i[0x7fb40446d0] ->\ > #10 t_base64_scheme_decode[0x7fb404cb24] -> #11 > buffer_append[0x7fb404d3d0] -> #12 replicator_queue_push[0x558c4b4f40] > -> #13 replicator_brain_i\ > nit[0x558c4b53e4] -> #14 _start[0x558c4b3d70] -> #15 > _start[0x558c4b3f04] -> #16 io_loop_call_io[0x7fb4072f20] -> #17 > io_loop_handler_run_interna\ > l[0x7fb4075450] -> #18 io_loop_handler_run[0x7fb4075680] -> #19 > io_loop_run[0x7fb4075944] -> #20 master_service_run[0x7fb3fd84b0] -> > #21 main[0x5\ > 58c4b3930] -> #22 __libc_init_first[0x7fb3dd76d0] -> #23 > __libc_start_main[0x7fb3dd7780] -> #24 _start[0x558c4b3b80] > Jan 28 10:53:08 la dovecot[96175]: replicator: Fatal: master: > service(replicator): child 96714 killed with signal 6 (core dumps > disabled - https:\ > //dovecot.org/bugreport.html#coredumps) Thanks, -kb

4 4

crash on authentication to 2.3.21
by Eugene M. Zheganin 09 Feb '25

09 Feb '25

Hello, I'm trying to move a dovecot mail server from a remote Cpanel VPS to my site. I've set up the dovectot to my knowledge, but as soon as I try to authenticate, I got a crash: ===Cut=== Feb 9 11:15:12 freebsd dovecot[89257]: imap-login: Login: user=<gluck(a)kimlab.link>, method=CRAM-MD5, rip=92.255.139.77, lip=49.12.36.80, mpid=545, session=<O6+RtLMt1iBc/4tN> Feb 9 11:15:12 freebsd dovecot[89257]: imap(gluck(a)kimlab.link)<545><O6+RtLMt1iBc/4tN>: Panic: file array.c: line 10 (array_idx_modifiable_i): assertion failed: (idx < array->buffer->used / array->element_size) Feb 9 11:15:12 freebsd dovecot[89257]: imap(gluck(a)kimlab.link)<545><O6+RtLMt1iBc/4tN>: Fatal: master: service(imap): child 545 killed with signal 6 (core not dumped - https://dovecot.org/bugreport.html#coredumps) ===Cut=== Thhe only reference I've fount to this error is that it seems to be an issue in 2.3.17, but I have 2.3.21 version, so I think there's something in my config. I've also hhave a bunch of old maildirs and I tried to do a force-resync on 'em, but that didn't help. Here's my config: ===Cut=== # 2.3.21.1 (d492236fa0): /usr/local/etc/dovecot/dovecot.conf # Pigeonhole version 0.5.21.1 (49005e73) # OS: FreeBSD 14.2-RELEASE amd64 # Hostname: mail.kimlab.link auth_debug = yes auth_debug_passwords = yes auth_mechanisms = plain login cram-md5 scram-sha-1 scram-sha-256 default_client_limit = 40963 default_process_limit = 10240 disable_plaintext_auth = no first_valid_gid = 143 first_valid_uid = 143 hostname = mail.kimlab.link mail_gid = 143 mail_home = /var/imap/%d/%n mail_location = maildir:~/ mail_uid = 143 managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext mbox_write_locks = fcntl namespace { inbox = yes list = yes location = prefix = separator = / subscriptions = yes type = private } namespace { location = maildir:/var/imap/%d/public prefix = Public/ separator = / subscriptions = no type = public } namespace { list = children location = maildir:%%h/Maildir:INDEX=~/Maildir/shared/%%u prefix = shared/%%u/ separator = / subscriptions = no type = shared } passdb { args = scheme=PLAIN username_format=%u /usr/local/etc/dovecot/users driver = passwd-file master = yes pass = yes } plugin { acl = vfile acl_shared_dict = file:/var/db/dovecot/shared-mailboxes fts = squat fts_autoindex = yes fts_squat = partial=4 full=10 quota = maildir:User quota quota_rule = *:storage=50G quota_rule2 = Trash:storage=+10%% quota_rule3 = Spam:storage=+20%% quota_warning = storage=95%% quota-warning 95 %u quota_warning2 = storage=80%% quota-warning 80 %u sieve = ~/.dovecot.sieve sieve_after = /var/imap/sieve/sieve-after sieve_before = /var/imap/sieve/sieve-before/spam.sieve sieve_default = /var/imap/sieve/default.sieve sieve_dir = /var/imap/%d/%n/sieve sieve_global_dir = /var/imap/sieve sieve_max_script_size = 1M } postmaster_address = postmaster(a)kimlab.link protocols = imap pop3 lmtp sieve service auth { client_limit = 62464 unix_listener /var/imap/private/auth { group = dovecot mode = 0660 user = dovecot } unix_listener auth-userdb { group = dovecot mode = 0660 user = dovecot } } service imap-login { client_limit = 10000 inet_listener imap { port = 143 } inet_listener imaps { port = 993 ssl = yes } process_limit = 10240 process_min_avail = 1 service_count = 0 vsz_limit = 512 M } service imap { drop_priv_before_exec = yes process_limit = 10240 } service lmtp { unix_listener lmtp { group = dovecot mode = 0660 user = dovecot } } service managesieve-login { inet_listener sieve { port = 4190 } } service pop3-login { inet_listener pop3 { port = 110 } inet_listener pop3s { port = 995 ssl = yes } } service quota-warning { executable = script /usr/local/bin/quota-warning.sh unix_listener quota-warning { user = dovecot } user = dovecot } service stats { unix_listener stats-writer { group = dovecot mode = 0660 user = dovecot } } ssl_cert = </usr/local/etc/nginx/tls.d/kimlab.link.pem ssl_key = # hidden, use -P to show it syslog_facility = local6 userdb { args = username_format=%u /usr/local/etc/dovecot/users default_fields = uid=dovecot gid=dovecot home=/var/imap/%d/%n driver = passwd-file } protocol lmtp { mail_plugins = " quota acl sieve" } protocol lda { mail_plugins = " quota acl sieve" } protocol imap { imap_client_workarounds = tb-extra-mailbox-sep mail_max_userip_connections = 512 mail_plugins = quota imap_quota fts fts_squat } ===Cut=== here's my obfuscated users passdb file: ===Cut=== gluck@kimlab.link:{PLAIN}XXXXXXXXX:::::: emz@kimlab.link:{PLAIN}XXXXXXXXX:::::: ===Cut=== I'm totally open to any ideas. I can provide coredumps as well, but I tend to think that's something obvious since I have very little experience with dovecot. Thanks. Eugene.

2 1

suggestion: Argon2id example in `doveadm pw` examples
by Sean McBride 09 Feb '25

09 Feb '25

Hi all, It says here https://www.dovecot.org/bugreport-mail/ that bug reports should go to this list. Does that apply to suggestions too? Assuming so... The docs here are very good: https://doc.dovecot.org/main/core/man/doveadm-pw.1.html but it's always nice to have examples of current best practice. As I understand it, the best password hashing algorithm these days is Argon2id, according to: https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet… So it would be nice to have an example corresponding to best practices, showing use of argon2id. I could attempt a PR on GitHub if you'd like. Cheers, Sean

1 0

how to set pop3_deleted_flag for one mailbox (email address)?
by krzf83＠gmail.com 08 Feb '25

08 Feb '25

How to set pop3_deleted_flag for one (email address)? I've tried using extra_fields in userdb. pop3_deleted_flag seems to be ignored there. It makes no sense for pop3_deleted_flag be to be global setting and yet it seems to be so.

2 2

Writing custom sieve plugins and extensions
by mb-dovecot＠mailroom.meme 08 Feb '25

08 Feb '25

I am a pretty heavy user of Sieve, and one of the services where I have extensive Sieve scripts is Protonmail. For my own mailserver setup, Dovecot's sieve-test has been excellent. I have a library of example email messages, and my own tooling setup for being able to test whether a given change has broken anything else unintentionally. If it does, I can trace the decision tree. With protonmail this has severe limitations. Most of those scripts apply expire, and what the expire is can change as it passes through the filters. But I cannot test any of that with sieve-test because that extension is unique to them. I always have to strip it out of sieve first, and that doesn't help me understand what's happening. I have some software engineering experience, so I was poking around at the pigeonhole source code, but since it's really focused on the RFC (understandably) there doesn't seem to be a friendly on-ramp to creating a one-off extension. What I'd really like to do though is make some kind of custom extension to sieve-test specifically which would allow the user to define custom vendor plugins/modules and appropriate messages. After all, I don't need sieve-test to know how to expire a message, I just need it to not throw an error on the extension when it's loaded, and to inform me in the output that it would have applied the expire action to a given message with a given value. I suspect the easiest way to do that is with a stubbed out extension that can handle that, but I'm open to other approaches that might work.

2 1

Dovecot 2.4 quota_storage_size override from userdb not working
by Andreas Oster 06 Feb '25

06 Feb '25

Hello, I am currently trying to migrate my Dovecot 2.3 server to version 2.4. Unfortunately I do not seem to get the basic per user quota to work. I am using LDAP for userdb and have used the "Override: LDAP" example from https://doc.dovecot.org/2.4.0/core/plugins/quota.html as a starting point. ( By the way, there is an error in the example: % is missing in front of "{ldap:quotaBytes}B" ) I have set the LDAP field according to my setup and validated with "doveadm auth test username" that the correct value is returned. In my case I get "quota_storage_size=3G" but this does not override the default value of 1G from the global quota config file: quota "User quota" { storage_size = 1G } Can someone please help with this issue ? Thank you very much. -- Best regards Andreas Oster

1 0

question from a newbie
by Zane B Stein 06 Feb '25

06 Feb '25

My mail was hosted by a site that no longer handles email. I asked them if they could send me a file with all my emails in it and they said sure. I was thinking maybe I would get something I could import into Outlook such as a .pst or .ost file, or perhaps a .csv file. What I received was a zipped file and when I opened it there were a bunch of folders with emails in them in some strange format (each one with a . in front of it, such as .NEWMAIL ), plus a bunch of files along with the folders such as dovecat.index, dovecatindex.cache, dovecot.index.log2, dovecot.list.inex, divecot.mailbox and others with a dovecot prefix, plus one called maildirsize and one called subscriptions. I have no idea how to read the emails in this format. Can someone tell me how I can access the emails in this set of files? Feel free to ask if you need more information before you can answer. If I need a special program to read the files, is there an easy one available that is user friendly for someone with no experience with dovecot files? Thank you. Zane B Stein

5 7

solved my problem
by Zane B Stein 06 Feb '25

06 Feb '25

In my initial post I questioned, as a newbie, how to access the email files I was given that were in dovecot format, and a few people were kind enough to explain things to me a bit. But some of the solutions were a bit over my head. And then I found a solution. I downloaded an app called "SysTools Maildir Converter" and was able to convert the whole email file into a .pst file, and input it in Outlook. Now all my emails are accessible, and I can reply to them like any other emails in Outlook. The only thing I don't exactly understand is that each folder I had with emails in it has a subfolder called "cur" and that is where all the emails reside. It is not an issue, just not sure exactly why that is so. (If someone has an idea why the emails are in "cur" subfolders rather than directly in the folders, and can explain it to me without getting super technical, that would be great. But it isn't a big deal, I'm just curious.) Zane

2 1

Replicator Crash
by Kent Borg 05 Feb '25

05 Feb '25

I have replicator working well enough…to crash: > Jan 28 11:26:12 la dovecot[1187]: replicator: Panic: data stack: Out > of memory when allocating 268435496 bytes > Jan 28 11:26:12 la dovecot[1187]: replicator: Error: Raw backtrace: #0 > t_askpass[0x7fa59db0c0] -> #1 backtrace_append[0x7fa59db374] -> #2 > backtra\ > ce_get[0x7fa59db510] -> #3 execvp_const[0x7fa59e7ba4] -> #4 > i_syslog_fatal_handler[0x7fa59e8510] -> #5 i_panic[0x7fa5936808] -> #6 > t_pop_pass_str\ > [0x7fa59e0eb4] -> #7 connection_deinit[0x7fa59e6430] -> #8 > pool_datastack_create[0x7fa5a0e7b0] -> #9 > array_bsearch_insert_pos_i[0x7fa59d46d0] -> \ > #10 t_base64_scheme_decode[0x7fa59dcb24] -> #11 > buffer_append[0x7fa59dd3d0] -> #12 replicator_queue_push[0x556e8f4f40] > -> #13 replicator_brain_in\ > it[0x556e8f53e4] -> #14 _start[0x556e8f3d70] -> #15 > _start[0x556e8f3f04] -> #16 io_loop_call_io[0x7fa5a02f20] -> #17 > io_loop_handler_run_internal\ > [0x7fa5a05450] -> #18 io_loop_handler_run[0x7fa5a05680] -> #19 > io_loop_run[0x7fa5a05944] -> #20 master_service_run[0x7fa59684b0] -> > #21 main[0x55\ > 6e8f3930] -> #22 __libc_init_first[0x7fa57676d0] -> #23 > __libc_start_main[0x7fa5767780] -> #24 _start[0x556e8f3b80] > Jan 28 11:26:12 la dovecot[1187]: replicator: Fatal: master: > service(replicator): child 1185 killed with signal 6 (core dumps > disabled - https://\ > dovecot.org/bugreport.html#coredumps) This is on Debian 12. > # dovecot --version > 2.3.19.1 (9b53102964) There are gigabytes of free RAM, though it says it is trying to allocate 268,435,496 bytes--on the stack--and that does seem wrong in any case. The Maildir being synced is over 430MB, is that too much for dsync?? Suggestions? Thanks, -kb

3 4

iOS email content loading issue
by Zieseniss Peter 05 Feb '25

05 Feb '25

Hello All, i hope everyone is well! i have a rather irksome and pressing issue that i can't seem to resolve.. This happens only on iOS devices.. Specifically, the problem is that the content of messages seems to timeout when it loads either when you open a message, or when you hit reply or forward, or whatever.. The email appears to load, but the content simply never shows up, leaving only a wheel that says 'Loading' Please see a screenshot of what it looks like: https://zconsulting.net/_stuff/dovecot-ios-loading.jpg This happens on all iOS devices (at least 18), many different versions from the most current down to iOS 16.. This has been happening for at least 2 years, and it happens about 50-80% of the time when interacting with an older message (more than 6 months old) Mail on macOS, Thunderbird on Windows, and RoundCube on the server all work perfectly.. Note that most of these accounts have at between 12GB and 80GB (that's the extreme case) of email.. The server is: Dedicated 4-Core Xeon, 16GB RAM, 512GB NVMe SSD AlmaLinux release 8.10 (Cerulean Leopard) Dovecot 2.3.21.1 Exim 4.98 Here's what i've tried: On the server, i installed FTS-Xapian On the server, i set mail_max_userip_connections=512 On the clients, i disabled all email privacy settings and disabled iCloud mail The problem is that i really can't figure out what the issue is, but this seems to be a very common issue between Dovecot and iOS, judging by the amount of similar questions i see on g00gle, but no useful answers (example here <https://dovecot.org/mailman3/archives/list/dovecot@dovecot.org/thread/6YCEV…>).. It certainly seems like the iOS mail client is timing out when receiving the body of these older messages, but i don't see anything useful in the logs.. Please help! Any suggestions are welcome! My client is about to crucify me over this.. Thank You All in advance! Sincerely, Peter -- Peter Zieseniss Principal https://www.zconsulting.net peter(a)zconsulting.net

3 2

Fatal: block_alloc(134217728): Out of memory
by Michael 05 Feb '25

05 Feb '25

hey, :) i have a postfix instance trying to deliver a message to dovecot via lmtp, but fails due to an out-of-memory error in dovecot: the message is generated by a cron job like a thousand times before, and hundreds of times afterwards. the only thing maybe worth mentioning is its size of ~80MB. but since i don't have any size limits configured, i don't see why it shouldn't be delivered. any hints are appreciated! greetings... # dovecot --version 2.3.21.1 (d492236fa0) # cat /etc/apt/sources.list.d/dovecot.list #deb http://repo.dovecot.org/ce-2.3-latest/debian/bullseye bullseye main deb https://repo.dovecot.org/ce-2.3-latest/debian/bullseye bullseye main postfix log: Feb 5 12:21:42 mail01 postfix/qmgr[1175]: B95E360E5C: from=<root(a)mail01.example.com>, size=85100558, nrcpt=1 (queue active) Feb 5 12:21:43 mail01 postfix/lmtp[3990]: B95E360E5C: to=<root(a)example.com>, orig_to=<root>, relay=mail01.example.com[private/dovecot-lmtp], delay=3265236, delays=3265235/0.01/0.01/1.1, dsn=4.4.2, status=deferred (lost connection with mail01.example.com[private/dovecot-lmtp] while sending end of data -- message may be sent more than once) dovecot log: /var/log/dovecot/dovecot-lmtp.log:Feb 05 12:21:43 lmtp(root(a)example.com)<3991><SEldMcZJo2eXDwAAPczdCw>: Fatal: block_alloc(134217728): Out of memory /var/log/dovecot/dovecot-lmtp.log:Feb 05 12:21:43 lmtp(root(a)example.com)<3991><SEldMcZJo2eXDwAAPczdCw>: Error: Raw backtrace: /usr/lib/dovecot/libdovecot.so.0(backtrace_append+0x42) [0x7f439cc1e662] -> /usr/lib/dovecot/libdovecot.so.0(backtrace_get+0x1e) [0x7f439cc1e77e] -> /usr/lib/dovecot/libdovecot.so.0(+0x1043db) [0x7f439cc2b3db] -> /usr/lib/dovecot/libdovecot.so.0(+0x104411) [0x7f439cc2b411] -> /usr/lib/dovecot/libdovecot.so.0(+0x5688f) [0x7f439cb7d88f] -> /usr/lib/dovecot/libdovecot.so.0(+0x5ae87) [0x7f439cb81e87] -> /usr/lib/dovecot/libdovecot.so.0(+0x1245ac) [0x7f439cc4b5ac] -> /usr/lib/dovecot/libdovecot-sieve.so.0(+0x2f524) [0x7f439c30b524] -> /usr/lib/dovecot/libdovecot-sieve.so.0(+0x307e9) [0x7f439c30c7e9] -> /usr/lib/dovecot/libdovecot-sieve.so.0(sieve_message_body_get_text+0x4a) [0x7f439c30d40a] -> /usr/lib/dovecot/libdovecot-sieve.so.0(ext_body_get_part_list+0x51) [0x7f439c34a3e1] -> /usr/lib/dovecot/libdovecot-sieve.so.0(+0x6ebc2) [0x7f439c34abc2] -> /usr/lib/dovecot/libdovecot-sieve.so.0(sieve_interpreter_continue+0x9a) [0x7f439c320cda] -> /usr/lib/dovecot/libdovecot-sieve.so.0(sieve_multiscript_run+0x92) [0x7f439c338202] -> /usr/lib/dovecot/modules/lib90_sieve_plugin.so(+0x39ba) [0x7f439c3a99ba] -> /usr/lib/dovecot/libdovecot-lda.so.0(mail_deliver+0x179) [0x7f439ce6f8d9] -> dovecot/lmtp(lmtp_local_default_deliver+0x1d4) [0x55c39e8ec724] -> dovecot/lmtp(lmtp_local_data+0x5ac) [0x55c39e8ece7c] -> dovecot/lmtp(client_default_cmd_data+0x18d) [0x55c39e8eb83d] -> dovecot/lmtp(cmd_data_continue+0x180) [0x55c39e8eb5d0] -> /usr/lib/dovecot/libdovecot.so.0(+0x7628b) [0x7f439cb9d28b] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_call_io+0x69) [0x7f439cc41609] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run_internal+0x132) [0x7f439cc42cf2] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run+0x50) [0x7f439cc416b0] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_run+0x40) [0x7f439cc41870] -> /usr/lib/dovecot/libdovecot.so.0(master_service_run+0x13) [0x7f439cbb38e3] -> dovecot/lmtp(main+0x22a) [0x55c39e8ea27a] -> /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xea) [0x7f439c972d7a] -> dovecot/lmtp(_start+0x2a) [0x55c39e8ea38a]

4 4

Help with migration of LDAP Quota config to 2.4.0
by Eduardo Costa 05 Feb '25

05 Feb '25

Hi, I converted most of my configuration to 2.4.0, but I couldn't figure out in the documentation how to convert my LDAP-based quota configuration: ... dict { quota = ldap:/usr/local/etc/dovecot/dovecot-ldap.conf.ext } .... mail_plugins = $mail_plugins quota ... protocol imap { mail_plugins = $mail_plugins imap_quota } ... user_attrs = mailMessageStore=home,mailQuotaSize=quota_rule=*:storage=%$B,mail_plugins ... plugin { quota = maildir quota_rule2 = Trash:storage=+10%% } How can I convert to the new version, or even to the new driver count? Regards, Eduardo Costa

1 0

RFC 2971: Cannot find Client ID in LOG
by Patrick Ben Koetter 05 Feb '25

05 Feb '25

Greetings, I'm trying to get dovecot (2.3.21.1 (d492236fa0)) to note a client's ID (see: RFC 2971) in the LOG, but no matter if I increase LOG verbosity using (mail|auth)_debug = yes or not I can't find it allthough dovecot supports the RFC, shows it in a session and responds to it like this: # telnet localhost 143 Trying ::1... Connected to localhost. Escape character is '^]'. * OK [CAPABILITY IMAP4rev1 SASL-IR LOGIN-REFERRALS ID ENABLE IDLE LITERAL+ STARTTLS AUTH=PLAIN] Dovecot ready. a0001 LOGIN user password a0001 OK [CAPABILITY IMAP4rev1 SASL-IR LOGIN-REFERRALS ID ENABLE IDLE SORT SORT=DISPLAY THREAD=REFERENCES THREAD=REFS THREAD=ORDEREDSUBJECT MULTIAPPEND URL-PARTIAL CATENATE UNSELECT CHILDREN NAMESPACE UIDPLUS LIST-EXTENDED I18NLEVEL=1 CONDSTORE QRESYNC ESEARCH ESORT SEARCHRES WITHIN CONTEXT=SEARCH LIST-STATUS BINARY MOVE SNIPPET=FUZZY PREVIEW=FUZZY PREVIEW STATUS=SIZE SAVEDATE LITERAL+ NOTIFY SPECIAL-USE] Logged in a0002 ID ("name" "sodr" "version" "19.34" "vendor" "Pink Floyd Music Limited") * ID ("name" "Dovecot") a0002 OK ID completed (0.001 + 0.000 secs). a0003 LOGOUT * BYE Logging out a0003 OK Logout completed (0.001 + 0.000 secs). In the LOG I see this: Feb 05 11:17:13 v22016013320531498 dovecot[319998]: imap-login: Login: user=<user>, method=PLAIN, rip=::1, lip=::1, mpid=320008, secured I would expect it to note something like that: Feb 05 11:17:13 v22016013320531498 dovecot[319998]: imap-login: Login: user=<user>, method=PLAIN, rip=::1, lip=::1, mpid=320008, id=... secured Am I doing it wrong? TIA, p@rick -- [*] sys4 AG https://sys4.de, +49 (89) 30 90 46 64 Schleißheimer Straße 26/MG,80333 München Sitz der Gesellschaft: München, Amtsgericht München: HRB 199263 Vorstand: Patrick Ben Koetter, Marc Schiffbauer Aufsichtsratsvorsitzender: Florian Kirstein

2 2

Exim / Dovecot v2.4.0 authentication patch
by Timo Sirainen 04 Feb '25

04 Feb '25

Hi, Dovecot v2.4.0 changed authentication protocol slightly to allow new functionality (SCRAM TLS channel binding). It attempted to preserve backwards compatibility by checking client-provided VERSION first before sending data that the client wouldn't handle correctly. However, Exim's Dovecot authenticator doesn't send VERSION until Dovecot has sent the whole authentication handshake. This causes Exim to get stuck when trying to authenticate. I guess we'll provide some kind of a workaround for v2.4.1, but this should get fixed on Exim side as well. Attached a patch that I tested works (against 4.97-4ubuntu4).

2 1

OpenLDAP Pass-through Authentication
by Dino Edwards 04 Feb '25

04 Feb '25

Hi, Trying to get pass-through authentication working however, I'm running to the following error in OpenLDAP: openldap | 679ceede.3aa31e0a 0x7f2ff617e6c0 conn=1004 op=1 SRCH attr=uid mail displayName openldap | 679ceede.3aa4b816 0x7f2ff617e6c0 conn=1004 op=1 SEARCH RESULT tag=101 err=0 qtime=0.000019 etime=0.000172 nentries=1 text= openldap | 679ceede.3aaafd88 0x7f2ff597d6c0 conn=1005 fd=14 ACCEPT from IP=172.16.32.1:47082 (IP=0.0.0.0:1389) openldap | 679ceede.3aab8f34 0x7f2ff597d6c0 conn=1005 op=0 BIND dn="cn=username(a)domain.tld,ou=users,dc=domain,dc=local" method=128 openldap | 679ceede.3aac9267 0x7f2ff597d6c0 SASL [conn=1005] Failure: cannot connect to saslauthd server: No such file or directory openldap | 679ceede.3aad25b9 0x7f2ff597d6c0 conn=1005 op=0 RESULT tag=97 err=49 qtime=0.000005 etime=0.000120 text= openldap | 679ceede.3ab0191f 0x7f2ff617e6c0 conn=1005 fd=14 closed (connection lost) openldap | 679ceede.3ab3d76a 0x7f2ff597d6c0 conn=1004 fd=13 closed (connection lost) I followed the admin docs at: https://www.openldap.org/doc/admin26/guide.html#Pass-Through%20authenticatio n Here's what I did: Created /usr/lib/sasl2/slapd.conf with the following content: mech_list: plain pwcheck_method: saslauthd saslauthd_path: /var/run/sasl2/mux Created /etc/saslauthd.conf with the following content: ldap_servers: ldap://192.168.xxx.xxx.xxx ldap_search_base: OU=Users,DC=domain,DC=tld ldap_filter: (uid=%u) ldap_bind_dn: CN=saslauthd,CN=Users,DC=domain,DC=tld ldap_password: somepassword Added a user that already exists in domain.tld in openldap with the following password: {SASL}username(a)domain.tld I would appreciate some help on this. Thanks

1 1

Re: [OFFLIST] Re: IMAP dovecot\postgres low authentication performance
by Anatoliy Zhestov 03 Feb '25

03 Feb '25

> > Long ago in MagicMail we recognized that there was a problem with > Postgres direct back addressing a large number of AUTH attempts at once, > and we went down the road to using a high performace DBFILE mechanisms, > with real time updates from the Postgres database.. allowed us to scale > greatly.. Thank you, this looks interesting but I don't really understand how to organize it correctly. Do you have a link to some manual that could serve as an example? On Mon, Feb 3, 2025 at 8:39 PM Michael Peddemors <michael(a)linuxmagic.com> wrote: > Long ago in MagicMail we recognized that there was a problem with > Postgres direct back addressing a large number of AUTH attempts at once, > and we went down the road to using a high performace DBFILE mechanisms, > with real time updates from the Postgres database.. allowed us to scale > greatly.. > > Don't know much about you, your product or use case, just thought it > might help.. > > On 2025-02-02 21:05, Anatoliy Zhestov via dovecot wrote: > > Hi. We have a performance problem with imap authentication through > > postgresql. > > Our servers(modoboa based) have a big amount of permanent imap > > connections(5000-50000). > > Current performance is about 3000 successful authentications per hour. No > > visible reasons for such low speed. Accordingly, after a network failure > or > > server restart, all clients try to reconnect, but restoring the > connection > > pool takes hours and even tens of hours. Judging by the logs after the > > restart, a huge number of auth requests closed by timeout after 70-90 > > seconds. The postgresql database is not overloaded at the restore > > connections process and the postgresql connection pool (100) does not > > overflow. Manually started sql auth queries work fast, tables have > indexes. > > So I guess there is a bottleneck somewhere in dovecot auth service or > > postgresql driver. > > > > I couldn't find any settings in the documentation that are directly > > responsible for regulating the number of connections to PostgreSQL from > the > > auth service or performance of the driver. Is there any way to manage > this? > > Does it make sense to use pgbouncer in front of the base? What else can > be > > a bottleneck in our configuration and how to regulate the number of > > possible simultaneous authentications via PostgreSQL? I would be happy > for > > any advice on how to increase the performance to at least 100 > > authentications per second. > > > > > > Thanks in advance for your help. > > Anatoliy Zhestov. > > > > ---------------- configs of server with 48 core, 184 gb mem > --------------- > > > > dovecot 2.3.16 > > # 2.3.16 (7e2e900c1a): /etc/dovecot/dovecot.conf > > # Pigeonhole version 0.5.16 (09c29328) > > # OS: Linux 5.15.0-126-generic x86_64 Ubuntu 22.04.5 LTS > > # Hostname: imap.ourcompany.net > > auth_cache_negative_ttl = 0 > > auth_cache_size = 20 M > > auth_cache_ttl = 3 hours > > auth_master_user_separator = * > > auth_mechanisms = plain login > > default_client_limit = 131072 > > default_process_limit = 131072 > > dict { > > quota = pgsql:/etc/dovecot/dovecot-dict-sql.conf.ext > > } > > mail_location = maildir:~/Maildir > > mail_plugins = quota > > managesieve_notify_capability = mailto > > managesieve_sieve_capability = fileinto reject envelope encoded-character > > vacation subaddress comparator-i;ascii-numeric relational regex > imap4flags > > copy include variables body enotify environment mai > > lbox date index ihave duplicate mime foreverypart extracttext editheader > > imapflags notify vnd.dovecot.pipe vnd.dovecot.execute > > namespace inbox { > > inbox = yes > > location = > > mailbox Drafts { > > auto = subscribe > > special_use = \Drafts > > } > > mailbox Junk { > > auto = subscribe > > special_use = \Junk > > } > > mailbox Sent { > > auto = subscribe > > special_use = \Sent > > } > > mailbox Trash { > > auto = subscribe > > special_use = \Trash > > } > > prefix = > > } > > passdb { > > args = /etc/dovecot/dovecot-sql.conf.ext > > driver = sql > > } > > passdb { > > args = /etc/dovecot/dovecot-sql-master.conf.ext > > driver = sql > > master = yes > > pass = yes > > } > > plugin { > > quota = dict:User quota::proxy::quota > > sieve = ~/.dovecot.sieve > > sieve_dir = ~/sieve > > sieve_execute_bin_dir = /usr/lib/dovecot/sieve-execute > > sieve_execute_socket_dir = . > > sieve_extensions = +notify +imapflags +editheader +body > > +vnd.dovecot.execute +vnd.dovecot.pipe > > sieve_pipe_bin_dir = /usr/lib/dovecot/sieve-execute > > sieve_pipe_socket_dir = . > > sieve_plugins = sieve_extprograms > > } > > protocols = " imap lmtp sieve" > > service anvil { > > client_limit = 393219 > > } > > service auth { > > client_limit = 524288 > > unix_listener /var/spool/postfix/private/auth { > > group = postfix > > mode = 0666 > > user = postfix > > } > > unix_listener auth-radicale { > > group = radicale > > mode = 0666 > > user = radicale > > } > > unix_listener auth-userdb { > > user = vmail > > } > > } > > service config { > > vsz_limit = 1 G > > } > > service dict { > > unix_listener dict { > > mode = 0600 > > user = vmail > > } > > } > > service imap { > > executable = imap postlogin > > process_limit = 131072 > > vsz_limit = 1 G > > } > > service lmtp { > > unix_listener /var/spool/postfix/private/dovecot-lmtp { > > group = postfix > > mode = 0600 > > user = postfix > > } > > vsz_limit = 512 M > > } > > service pop3 { > > executable = pop3 postlogin > > } > > service postlogin { > > executable = script-login /usr/local/bin/postlogin.sh > > service_count = 1000 > > process_min_avail = 5 > > user = modoboa > > } > > > > service send-to-click-frontapp1 { > > executable = script > > /usr/lib/dovecot/sieve-execute/clickhouse_log_frontapp1.sh > > unix_listener send-to-click-frontapp1 { > > group = vmail > > mode = 0666 > > user = vmail > > } > > user = dovenull > > vsz_limit = 2 G > > } > > service send-to-click { > > executable = script /usr/lib/dovecot/sieve-execute/clickhouse_log.sh > > unix_listener send-to-click { > > group = vmail > > mode = 0666 > > user = vmail > > } > > user = dovenull > > vsz_limit = 2 G > > } > > service stats { > > unix_listener stats-reader { > > group = vmail > > mode = 0660 > > user = vmail > > } > > unix_listener stats-writer { > > group = vmail > > mode = 0660 > > user = vmail > > } > > vsz_limit = 2 G > > } > > ssl_cert = </etc/letsencrypt/live/imap.ourcompany.net/fullchain.pem > > ssl_cipher_list = > > > EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+aRSA+RC4:EECDH:EDH+aRSA:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS:!RC4 > > ssl_client_ca_dir = /etc/ssl/certs > > ssl_dh = # hidden, use -P to show it > > ssl_key = # hidden, use -P to show it > > ssl_min_protocol = TLSv1 > > stats_writer_socket_path = > > userdb { > > driver = prefetch > > } > > userdb { > > args = /etc/dovecot/dovecot-sql.conf.ext > > driver = sql > > } > > protocol lmtp { > > mail_plugins = quota sieve > > postmaster_address = postmaster(a)imap.ourcompany.net > > } > > protocol imap { > > mail_max_userip_connections = 50 > > mail_plugins = quota imap_quota > > } > > > > > > > > > > /etc/dovecot/dovecot-sql-master.conf.ex > > driver = pgsql > > connect = host=127.0.0.1 port=5432 dbname=modoboa user=modoboa > > password=XXXXXXXXXXXXXXXXX > > password_query = SELECT email AS user, password FROM core_user WHERE > > email='%u' and is_active and master_user > > > > > > /etc/dovecot/dovecot-sql.conf.ext > > driver = pgsql > > connect = host=127.0.0.1 port=5432 dbname=modoboa user=modoboa > > password=XXXXXXXXXXXXXXXXX > > user_query = SELECT '/srv/vmail/%d/%n' AS home, 1003 as uid, 1003 as gid, > > '*:bytes=' || mb.quota || 'M' AS quota_rule FROM admin_mailbox mb INNER > > JOIN admin_domain dom ON mb.domain_id=dom.id INNER JOIN core_user u ON > > u.id=mb.user_id > > WHERE (mb.is_send_only IS NOT TRUE OR '%s' NOT IN ('imap', 'pop3', > 'lmtp')) > > AND mb.address='%n' AND dom.name='%d' > > password_query = SELECT email AS user, password, '/srv/vmail/%d/%n' AS > > userdb_home, 1003 AS userdb_uid, 1003 AS userdb_gid, CONCAT('*:bytes=', > > mb.quota, 'M') AS userdb_quota_rule FROM core_user u INNER JOIN > > admin_mailbox mb ON u.id=mb.user_id INNER JOIN admin_domain dom ON > > mb.domain_id=dom.id WHERE (mb.is_send_only IS NOT TRUE OR '%s' NOT IN > > ('imap', 'pop3')) AND email='%u' AND is_active AND dom.enabled > > iterate_query = SELECT email AS user FROM core_user > > > > > > > > /usr/local/bin/postlogin.sh > > #!/bin/sh > > PATH="/usr/bin:/usr/local/bin:/bin" > > psql -c "UPDATE core_user SET last_login=now() WHERE username='$USER'" > > > /dev/null > > exec "$@" > > > > > > /usr/lib/dovecot/sieve-execute/clickhouse_log_frontapp1.sh > > #!/bin/bash > > cd /tmp > > logger -i -t SIEVE_TEST "$1,$2,$3,$4" > > clickhouse-client -h XXXXXXXXXXXXXXXXX -d default -u some_user --password > > XXXXXXXXXXXXXXXXX \ > > --param_origin_from="$1" \ > > --param_origin_to="$2" \ > > --param_message_id="$3" \ > > --param_forward="$4" \ > > -q "INSERT INTO frontapp1_redirects > > (origin_from_email,origin_to_email,message_id,forward_email) VALUES > > > ({origin_from:String},{origin_to:String},{message_id:String},{forward:String})" > > > > /usr/lib/dovecot/sieve-execute/clickhouse_log.sh > > #!/bin/bash > > cd /tmp > > logger -i -t SIEVE_TEST "$1,$2,$3,$4" > > clickhouse-client -h XXXXXXXXXXXXXXXXX -d default -u some_user --password > > XXXXXXXXXXXXXXXXX \ > > --param_origin_from="$1" \ > > --param_origin_to="$2" \ > > --param_message_id="$3" \ > > --param_forward="$4" \ > > -q "INSERT INTO frontapp_redirects > > (origin_from_email,origin_to_email,message_id,forward_email) VALUES > > > ({origin_from:String},{origin_to:String},{message_id:String},{forward:String})" > > _______________________________________________ > > dovecot mailing list -- dovecot(a)dovecot.org > > To unsubscribe send an email to dovecot-leave(a)dovecot.org > > > -- > "Catch the Magic of Linux..." > ------------------------------------------------------------------------ > Michael Peddemors, President/CEO LinuxMagic Inc. > Visit us at http://www.linuxmagic.com @linuxmagic > A Wizard IT Company - For More Info http://www.wizard.ca > "LinuxMagic" a Reg. TradeMark of Wizard Tower TechnoServices Ltd. > ------------------------------------------------------------------------ > 604-682-0300 Beautiful British Columbia, Canada > >

2 1

Dovecot autoexpunge lock errors - Couldn't create dovecot.autoexpunge.lock
by mihai.aurel88＠gmail.com 03 Feb '25

03 Feb '25

Hello, We are seeing lots of errors like this in the logs: "dovecot: imap(user@domain)<31219><Dly3bTyt4tesENjH>: Error: autoexpunge: Couldn't create dovecot.autoexpunge.lock lock: file_create_locked(/home/virtual/domain/user/dovecot.autoexpunge.lock) failed: fstat(/home/virtual/domain/user/dovecot.autoexpunge.lock) failed: Stale file handle" We don't understand why Dovecot is trying to create the dovecot.autoexpunge.lock file in the mail home directory instead of mail location directory. For some accounts, the dovecot.autoexpunge.lock file is correctly created inside the mail home directory. Any ideas on what could be causing this behavior? # doveadm user user@domain field value uid 150 gid 8 home /home/virtual/domain/user mail maildir:~/Maildir quota_rule *:bytes=8192000000 # doveconf -n # 2.3.21.1 # Pigeonhole version 0.5.21.1 # OS: Linux 6.1.0-29-amd64 x86_64 Debian 12.9 auth_cache_verify_password_with_worker = yes auth_mechanisms = plain login auth_verbose = yes auth_worker_max_count = 256 default_client_limit = 10000 default_process_limit = 10000 default_vsz_limit = 1 G dict { lastlogin = mysql:/etc/dovecot/mysql/dovecot-dict-lastlogin.conf quotadict = mysql:/etc/dovecot/mysql/dovecot-dict-quota.conf } disable_plaintext_auth = no first_valid_uid = 100 imap_hibernate_timeout = 30 secs log_timestamp = "%Y-%m-%d %H:%M:%S " login_log_format_elements = user=<%u> method=%m rip=%r lip=%l pid=%p %c login_trusted_networks = mail_fsync = always mail_gid = 8 mail_home = /home/virtual/%d/%n mail_location = maildir:~/Maildir mail_nfs_index = yes mail_nfs_storage = yes mail_plugins = zlib quota mail_log notify mail_privileged_group = mail mail_uid = 150 maildir_stat_dirs = yes managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave metric imap_command { filter = event=imap_command_finished AND tagged_reply_state=OK group_by = cmd_name } metric imap_select_no { filter = event=imap_command_finished AND cmd_name=SELECT AND tagged_reply_state=NO } metric imap_select_no_notfound { filter = event=imap_command_finished AND cmd_name=SELECT AND tagged_reply="NO*Mailbox doesn't exist:*" } metric storage_http_gets { filter = event=http_request_finished AND category=storage AND method=get } mmap_disable = yes namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Spam { auto = subscribe autoexpunge = 30 days special_use = \Junk } mailbox Trash { auto = subscribe autoexpunge = 60 days special_use = \Trash } mailbox virtual/All { special_use = \All } prefix = } passdb { args = /etc/dovecot/mysql/dovecot-sql.conf driver = sql } plugin { last_login_dict = proxy::lastlogin last_login_key = # hidden, use -P to show it mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename mail_log_fields = uid box msgid size quota = dict:user::proxy::quotadict quota_rule2 = Trash:ignore quota_rule3 = Spam:ignore quota_status_nouser = DUNNO quota_status_overquota = 552 5.2.2 The email account that you tried to reach is over quota quota_status_success = DUNNO quota_warning = storage=95%% quota-warning 95 %u quota_warning2 = storage=80%% quota-warning 80 %u sieve = ~/.dovecot.sieve sieve_before = /etc/dovecot/sieve/default.sieve sieve_dir = ~/sieve sieve_vacation_send_from_recipient = yes trash = /etc/dovecot/dovecot-trash.conf zlib_save = gz zlib_save_level = 6 } protocols = imap sieve pop3 lmtp service anvil { client_limit = 50000 unix_listener anvil-auth-penalty { mode = 00 } } service auth { client_limit = 50000 unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } unix_listener auth-master { group = mail mode = 0660 user = vmail } user = root vsz_limit = 1 G } service dict { unix_listener dict { mode = 0660 user = vmail } } service imap-hibernate { unix_listener imap-hibernate { group = $default_internal_group mode = 0660 user = vmail } } service imap-login { inet_listener imap { address = * port = 143 } inet_listener imaps { address = * port = 993 } process_min_avail = 1 service_count = 0 } service imap { extra_groups = $default_internal_group process_min_avail = 16 unix_listener imap-master { user = $default_internal_user } vsz_limit = 2 G } service lmtp { process_min_avail = 16 unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } vsz_limit = 1 G } service managesieve-login { inet_listener sieve { port = 4190 } process_min_avail = 16 service_count = 1 } service managesieve { vsz_limit = 1 G } service pop3-login { inet_listener pop3 { address = * port = 110 } inet_listener pop3s { address = * port = 995 } process_min_avail = 16 service_count = 1 } service pop3 { process_min_avail = 16 vsz_limit = 1 G } service quota-status { executable = /usr/lib/dovecot/quota-status -p postfix process_min_avail = 16 unix_listener /var/spool/postfix/private/quota-status { group = postfix mode = 0666 user = postfix } } service quota-warning { executable = script /usr/local/bin/quota-warning.sh unix_listener quota-warning { mode = 0660 user = vmail } user = vmail } service stats { unix_listener stats-reader { mode = 0660 user = vmail } unix_listener stats-writer { mode = 0666 user = vmail } } ssl_cert = </etc/dovecot/ssl/cert.pem ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it ssl_min_protocol = TLSv1 userdb { args = /etc/dovecot/mysql/dovecot-sql.conf driver = sql } verbose_proctitle = yes protocol imap { imap_max_line_length = 64 k mail_max_userip_connections = 16 mail_plugins = zlib quota mail_log notify trash imap_quota } protocol pop3 { mail_max_userip_connections = 10 mail_plugins = zlib quota mail_log notify pop3_client_workarounds = outlook-no-nuls oe-ns-eoh pop3_fast_size_lookups = yes pop3_no_flag_updates = yes pop3_uidl_format = %08Xu%08Xv } protocol sieve { mail_max_userip_connections = 10 managesieve_max_compile_errors = 5 } protocol lda { auth_socket_path = /var/run/dovecot/auth-master mail_plugins = zlib quota mail_log notify sieve sendmail_path = /usr/lib/sendmail syslog_facility = mail } protocol lmtp { mail_plugins = zlib quota mail_log notify sieve syslog_facility = mail }

1 0

Clarification Question about migrating_mailboxes and broken doc link
by Aleks 02 Feb '25

02 Feb '25

Hi. I have read the https://doc.dovecot.org/2.3/admin_manual/migrating_mailboxes/#id7 and there is one part which is not 100% clear to me. We have 2 Dovecot servers mail1 (2.2.36.4) and mail2 ( 2.3.21 ). Now I have understood that I need to add this to mail1 ``` service doveadm { inet_listener { port = 12354 } } doveadm_password = supersecret ``` and this on mail2 ``` doveadm_password = supersecret ``` The question is for me now: I think that this command `doveadm backup -Ru username tcp:host:port` should be executed on the mail2. Is this assumption right? What I also found is that on that Page https://doc.dovecot.org/2.3/admin_manual/doveadm_mailbox_commands/ the wiki is linked for the manpages but the wiki link shows this. ``` The old wiki has been closed Our primary documentation is now at https://doc.dovecot.org, please update your links. ``` What's the right link for the manpages in the web? Best regards Aleks

2 2

[Off-topic] ANN: Nauthilus
by Christian Rößner 01 Feb '25

01 Feb '25

Today I am pleased to announce the Nauthilus software. Nauthilus (N-Auth-ilus) is a centralized authentication server with a comprehensive policy engine. The idea behind this project is to connect services centrally in one place and perform extensive tests during authentication. # What can Nauthilus do and what problems does it solve? Many services on the Internet require authentication. Each application must then be connected to databases and must implement its own protective measures to ward off attackers. Every installation carries the risk of compromisation and therefore also access to the databases. With Nauthilus, the task is centralized in one place. Nauthilus is essentially an HTTP REST server that can be accessed by any application. It takes on the role of a guardian. Nauthilus integrates very well with Dovecot and Postfix. # Authentication process Nauthilus uses several authentication steps: ## 1. features Features include tests such as TLS verification, relay domains (is the system even responsible for the requested domain?), blocklists, RBLs and freely definable Lua features. Nauthilus has a powerful brute force concept with buckets to detect even slow attacks over days and weeks. It offers a bucket system for this purpose. ## 2. backend authentication Nauthilus includes LDAP support and Lua to perform the authentication itself. A large library of predefined functions is available in Lua, including SQL support. ## 3 Policies Policies are run through after authentication. Despite a successful login, the system can reject the login (or, conversely, allow it!). There is also space here for GeoIP lookups, etc. ## 4. Post-processing After the 3rd point, authentication has been completed, but at this point further tests can run in the background such as: * Check password policy and take action * Consult the Haveibeenpwnd network * GeoIP tracking across national borders and much more. ## Miscellaneous Nauthilus allows the free definition of so-called hooks. Each hook listens for a specific URI (callback) in the HTTP request. These callbacks are written by the administrator in Lua. In an initial proof of concept, Nauthilus can take on the role of a Dovecot director. This has already been tested with version 2.4.0. Currently, Nauthilus can dynamically delegate incoming connections to backends. The hooks concept is used here as an example. # Final words By integrating a Lua VM into the server, Nauthilus can be integrated and customized in almost any setup. See also the other Nauthilus-related projects listed in the appendix. To enable single sign-on (SSO), it can be operated with an Ory-Hydra server or the sister project nauthilus-keycloak can be used as a custom authenticator in Keycloak. 100% Open-Source 100% Community # Project https://github.com/croessner/nauthilus # Sub projects https://github.com/croessner/nauthilus-demo https://github.com/croessner/nauthilus-keycloak https://github.com/croessner/pfxhttp https://github.com/croessner/geoip-policyd # Mailing lists: https://lists.nauthilus.org N.B.: In the future, announcements are sent over the nauthilus-announce ML. This is just a hello world! Christian Rößner -- Rößner-Network-Solutions Zertifizierter ITSiBe / CISO Marburger Str. 70a, 36304 Alsfeld Fax: +49 6631 78823409, Mobil: +49 171 9905345 USt-IdNr.: DE225643613, https://roessner.website PGP fingerprint: 658D 1342 B762 F484 2DDF 1E88 38A5 4346 D727 94E5

2 2

Replication ade
by Hanns Mattes 01 Feb '25

01 Feb '25

Hei, mit 2.4 verschwindet ja, wenn ich das richtig verstanden habe, die Replication aus dem Werkzeugkasten von Dovecot. Obwohl ich nur ein recht kleines System mit etwa 500 Nutzern betreibe fand ich die Replication als ziemlich beruhigend :-) Meine Frage in die Runde: Wie wollt Ihr die Replikation ersetzen? Irgendwas mit NFS oder gibt es da eine empfohlene Herangehensweise? Fragende Grüße Hanns -- Sig for hire.

4 4

Re: 2.4.0 on MacOS
by John Muccigrosso 01 Feb '25

01 Feb '25

(Looks like I forgot to reply to the list last time.) With `sudo dovecot -F`, I'm now getting: Fatal: setrlimit(RLIMIT_DATA, 2147483648): Invalid argument The old(?) solution doesn't work for me: default_vsz_limit = 0 It reports: doveconf: Fatal: Error in configuration file /opt/homebrew/etc/dovecot/dovecot.conf: service(log): vsz_limit is too low > On Feb 1, 2025, at 08:55, John Muccigrosso <muccigrosso(a)icloud.com> wrote: > > On Feb 1, 2025, at 07:31, Aki Tuomi via dovecot <dovecot(a)dovecot.org> wrote: > >> You sure the default internal group isnt _dovecot as well? > > I'm not sure what you're asking. Do I not have the internal group set via this line?: > > default_internal_group = mail > > I think I may have to dig into group memberships, if this is the issue. I'm getting conflicting result when checking. That is, when I check the group "mail" for members, _dovecot isn't in it, even though checking which groups _dovecot belongs to includes "mail". The opposite happens for the "dovecot" group. And dovecot itself can't find the _dovecot or dovecot group. Seems to be a macOS thing with group membership. > >> You are missing >> >> mail_home = /Users/%{user} > > Thanks. As I said, I was trying to follow the documentation where they give the two lines under Maildir, but not this third one (even though it's given in the first part of this section).

3 4

2.4.0 missing fields in documentation for event smtp_server_transaction_finished
by Christian Rößner 01 Feb '25

01 Feb '25

Hi, Event: smtp_server_transaction_finished remote_ip and remote_port are also available Feature-request: Please also add user to the fields, as lmtp_proxy=yes does a userdb lookup and is aware of the user. Would make things much easier... Regards Christian Rößner -- Rößner-Network-Solutions Zertifizierter ITSiBe / CISO Marburger Str. 70a, 36304 Alsfeld Fax: +49 6631 78823409, Mobil: +49 171 9905345 USt-IdNr.: DE225643613, https://roessner.website PGP fingerprint: 658D 1342 B762 F484 2DDF 1E88 38A5 4346 D727 94E5

2 1