- dovecot - dovecot.org

LDAP iterate (dovecoc 2.2.27)
by Debreczeni Attila 15 Apr '19

15 Apr '19

Dear Dovecot Team, We would like to use the LDAP iterate for dovecot replication, but I got this error: dovecot: auth-worker(10149): Error: ldap(*): ldap_search(base=ou=mail,o=asd,c=TLD filter=(objectClass=inetMailUser) failed: Size limit exceeded dovecot: replicator: Error: User listing returned failure dovecot: replicator: Error: listing users failed, can't replicate existing data When I check the "doveadm replicator status": ... Total number of known users 1200 But we have more than 10.000 users. When I run the ldapsearch manually, I get the full list of the mail addresses. Who can I fix it? Thank you, Attila # dovecot --version 2.2.27 (c0f36b0) # dovecot -n | filtered # 2.2.27 (c0f36b0): /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.16 (fed8554) # OS: Linux 4.9.0-6-amd64 x86_64 Debian 9.8 auth_worker_max_count = 150 default_vsz_limit = 512 M doveadm_password = # hidden, use -P to show it doveadm_port = *** mail_gid = vmail mail_plugins = " quota notify replication" namespace inbox { ... } passdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } plugin { mail_replica = tcp:REMOTE_IP } replication_dsync_parameters = -d -N -1 -l 30 -U service aggregator { fifo_listener replication-notify-fifo { user = vmail } unix_listener replication-notify { user = vmail } } service auth { inet_listener { address = LOCAL_IP port = LOCAL_PORT } unix_listener auth-userdb { group = vmail mode = 0600 user = vmail } } service dict { unix_listener dict { group = vmail mode = 0600 user = vmail } } service lmtp { inet_listener lmtp { address = LOCAL_IP port = LOCAL_PORT } } service replicator { process_min_avail = 1 unix_listener replicator-doveadm { mode = 0600 } } userdb { args = /etc/dovecot/dovecot-domain-ldap.conf.ext driver = ldap result_success = continue-ok } userdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap result_failure = return-fail } protocol imap { ... } protocol pop3 { ... } # grep -v '^ *$#.*$\?$' dovecot-ldap.conf.ext uris = ldaps://ldap.URL dn = uid=auth,o=domain,c=TLD dnpass = **** sasl_bind = no tls_ca_cert_dir = /etc/ssl/certs tls_require_cert = demand ldap_version = 3 base = ou=mail,o=asd,c=TLD deref = never scope = subtree user_attrs = =home=/dev/null/%Ld/%L{ldap:uid}, mailQuota=quota_rule=*:bytes=%$ user_filter = (objectClass=inetMailUser) pass_attrs = userPassword=password pass_filter = (objectClass=inetMailUser) iterate_attrs = mail=user iterate_filter = (objectClass=inetMailUser) default_pass_scheme = PLAIN

1 0

LDAP iterate (dovecoc 2.2.27)
by Debreczeni Attila 15 Apr '19

15 Apr '19

Dear Dovecot Team, We would like to use the LDAP iterate for dovecot replication, but I got this error: dovecot: auth-worker(10149): Error: ldap(*): ldap_search(base=ou=mail,o=asd,c=TLD filter=(objectClass=inetMailUser) failed: Size limit exceeded dovecot: replicator: Error: User listing returned failure dovecot: replicator: Error: listing users failed, can't replicate existing data When I check the "doveadm replicator status": ... Total number of known users 1200 But we have more than 10.000 users. When I run the ldapsearch manually, I get the full list of the mail addresses. Who can I fix it? Thank you, Attila # dovecot --version 2.2.27 (c0f36b0) # dovecot -n | filtered # 2.2.27 (c0f36b0): /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.16 (fed8554) # OS: Linux 4.9.0-6-amd64 x86_64 Debian 9.8 auth_worker_max_count = 150 default_vsz_limit = 512 M doveadm_password = # hidden, use -P to show it doveadm_port = *** mail_gid = vmail mail_plugins = " quota notify replication" namespace inbox { ... } passdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } plugin { mail_replica = tcp:REMOTE_IP } replication_dsync_parameters = -d -N -1 -l 30 -U service aggregator { fifo_listener replication-notify-fifo { user = vmail } unix_listener replication-notify { user = vmail } } service auth { inet_listener { address = LOCAL_IP port = LOCAL_PORT } unix_listener auth-userdb { group = vmail mode = 0600 user = vmail } } service dict { unix_listener dict { group = vmail mode = 0600 user = vmail } } service lmtp { inet_listener lmtp { address = LOCAL_IP port = LOCAL_PORT } } service replicator { process_min_avail = 1 unix_listener replicator-doveadm { mode = 0600 } } userdb { args = /etc/dovecot/dovecot-domain-ldap.conf.ext driver = ldap result_success = continue-ok } userdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap result_failure = return-fail } protocol imap { ... } protocol pop3 { ... } # grep -v '^ *$#.*$\?$' dovecot-ldap.conf.ext uris = ldaps://ldap.URL dn = uid=auth,o=domain,c=TLD dnpass = **** sasl_bind = no tls_ca_cert_dir = /etc/ssl/certs tls_require_cert = demand ldap_version = 3 base = ou=mail,o=asd,c=TLD deref = never scope = subtree user_attrs = =home=/dev/null/%Ld/%L{ldap:uid}, mailQuota=quota_rule=*:bytes=%$ user_filter = (objectClass=inetMailUser) pass_attrs = userPassword=password pass_filter = (objectClass=inetMailUser) iterate_attrs = mail=user iterate_filter = (objectClass=inetMailUser) default_pass_scheme = PLAIN

1 0

Re: SOLR/Index?
by Larry Rosenman 15 Apr '19

15 Apr '19

full solr.log at: https://www.lerctr.org/~ler/solr.log The search DOES make it to SOLR: ⌂77% [ler@thebighonker.lerctr.org:~] 130 $ grep sysutils /var/log/solr/solr.log 2019-04-14 18:31:34.749 INFO (qtp349420578-7538) [ x:dovecot] o.a.s.c.S.Request [dovecot] webapp=/solr path=/select params={q={!lucene+q.op%3DAND}(hdr:sysutils\/+OR+body:sysutils\/)&fl=uid,score&sort=uid+asc&fq=%2Bbox:8097632f69627b5b58950000bbe98eac+%2Buser:ler&rows=22644&wt=xml} hits=0 status=0 QTime=460 Pick showing subjects: https://www.lerctr.org/~ler/sysutils_mail.png What else? I'm happy to provide access. -- Larry Rosenman http://www.lerctr.org/~ler Phone: +1 214-642-9640 (c) E-Mail: larryrtx(a)gmail.com US Mail: 5708 Sabbia Dr, Round Rock, TX 78665-2106

3 11

SOLR/Index?
by Larry Rosenman 15 Apr '19

15 Apr '19

Given all the discussion on FTS/Solr, etc, I have a question: I have autoindex set, and searching in roundcube most of the time does NOT find things, HOWEVER if I do: doveadm fts rescan doveadm index I can find things in the mailboxes. WHY? (doveconf -n attached). -- Larry Rosenman http://www.lerctr.org/~ler Phone: +1 214-642-9640 (c) E-Mail: larryrtx(a)gmail.com US Mail: 5708 Sabbia Dr, Round Rock, TX 78665-2106

2 1

Re: dovecot Digest, Vol 192, Issue 52
by Peter Mogensen 15 Apr '19

15 Apr '19

On 4/14/19 4:04 PM, dovecot-request(a)dovecot.org wrote: >> Solr ships with autoCommit set to 15 seconds and openSearcher set to >> false on the autoCommit.? The autoSoftCommit setting is not enabled by >> default, but depending on how the index was created, Solr might try to >> set autoSoftCommit to 3 seconds ... which is WAY too short. I just run with the default. 15s autoCommit and no autoSoftCommit >> This thread says that dovecot is sending explicit commits.? I see explicit /update req. with softCommit and waitSearcer=true in a tcpdump. >> One thing >> that might be happening to exceed 60 seconds is an extremely long >> commit, which is usually caused by excessive cache autowarming, but >> might be related to insufficient memory.? The max heap setting on an >> out-of-the-box Solr install (5.0 and later) is 512MB.? That's VERY >> small, and it doesn't take much index data before a much larger heap >> is required. I run with SOLR_JAVA_MEM="-Xmx8g -Xms2g" > I looked into the code (version 2.3.5.1): This is 2.2.35. I haven't checked the source difference to 2.3.x I must admit. > I immagine that one of the reasons dovecot sends softCommits is because > without autoindex active and even if mailboxes are periodically indexed > from cron, the last emails received with be indexed at the moment of the > search.? I expect that dovecot has to because of it's default behavior by only bringing the index up-to-date just before search. So it has towait for the index result to be available if there's been any new mails indexed. > 1) a configurable batch size would enable to tune the number of emails > per request and help stay under the 60 seconds hard coded http request > timeout. A configurable http timeout would be less useful, since this > will potentially run into other timeouts on solr side. Being able to configure it is great. But I don't think it solves much. I recompiled with 100 as batch size and it still ended in timeouts. Then I recompiled with 10min timeout and now I see all the batches completing and their processesing time is mostly between 1 and 2 minutes (so all would have failed). To me it looks like Solr just takes too long time to index. This is no small machine. It's a 20 core Intel(R) Xeon(R) Silver 4114 CPU @ 2.20GHz and for this test it's not doing anything else, so I'm a bit surprised that even with only a few users this takes so long time. /Peter

2 1

Re: Solr connection timeout hardwired to 60s
by Peter Mogensen 15 Apr '19

15 Apr '19

On 4/4/19 6:47 PM, dovecot-request(a)dovecot.org wrote: > For a typical Solr index, 60 seconds is an eternity. Most people aim > for query times of 100 milliseconds or less, and they often achieve > that goal. I'm pretty sure I get these while indexing, not querying. Apr 04 16:44:50 host dovecot[114690]: indexer-worker(me(a)example.com): Error: fts_solr: Indexing failed: Request timed out (Request queued 66.015 secs ago, 1 attempts in 66.005 secs, 63.146 in http ioloop, 0.000 in other ioloops, connected 94.903 secs ago) /Peter

5 8

Fwd: Problem with solr working, but not indexing
by TG Servers 14 Apr '19

14 Apr '19

2 2

Problem with solr working, but not indexing
by TG Servers 14 Apr '19

14 Apr '19

2 1

Re: Solr connection timeout hardwired to 60s
by Peter Mogensen 14 Apr '19

14 Apr '19

sorry... I got distracted half way and forgot to put a meaningfull subject so the archive could figure out the thread. - resending. On 4/14/19 4:04 PM, dovecot-request(a)dovecot.org wrote: >> Solr ships with autoCommit set to 15 seconds and openSearcher set to >> false on the autoCommit.? The autoSoftCommit setting is not enabled by >> default, but depending on how the index was created, Solr might try to >> set autoSoftCommit to 3 seconds ... which is WAY too short. I just run with the default. 15s autoCommit and no autoSoftCommit >> This thread says that dovecot is sending explicit commits.? I see explicit /update req. with softCommit and waitSearcer=true in a tcpdump. >> One thing >> that might be happening to exceed 60 seconds is an extremely long >> commit, which is usually caused by excessive cache autowarming, but >> might be related to insufficient memory.? The max heap setting on an >> out-of-the-box Solr install (5.0 and later) is 512MB.? That's VERY >> small, and it doesn't take much index data before a much larger heap >> is required. I run with SOLR_JAVA_MEM="-Xmx8g -Xms2g" > I looked into the code (version 2.3.5.1): This is 2.2.35. I haven't checked the source difference to 2.3.x I must admit. > I immagine that one of the reasons dovecot sends softCommits is because > without autoindex active and even if mailboxes are periodically indexed > from cron, the last emails received with be indexed at the moment of the > search.? I expect that dovecot has to because of it's default behavior by only bringing the index up-to-date just before search. So it has towait for the index result to be available if there's been any new mails indexed. > 1) a configurable batch size would enable to tune the number of emails > per request and help stay under the 60 seconds hard coded http request > timeout. A configurable http timeout would be less useful, since this > will potentially run into other timeouts on solr side. Being able to configure it is great. But I don't think it solves much. I recompiled with 100 as batch size and it still ended in timeouts. Then I recompiled with 10min timeout and now I see all the batches completing and their processesing time is mostly between 1 and 2 minutes (so all would have failed). To me it looks like Solr just takes too long time to index. This is no small machine. It's a 20 core Intel(R) Xeon(R) Silver 4114 CPU @ 2.20GHz and for this test it's not doing anything else, so I'm a bit surprised that even with only a few users this takes so long time. /Peter

2 2

Re: Mail account brute force / harassment
by Odhiambo Washington 14 Apr '19

14 Apr '19

On Thu, 11 Apr 2019 at 13:24, Marc Roos via dovecot <dovecot(a)dovecot.org> wrote: > > > Say for instance you have some one trying to constantly access an > account > > > Has any of you made something creative like this: > > * configure that account to allow to login with any password > * link that account to something like /dev/zero that generates infinite > amount of messages > (maybe send an archive of virusses?) > * transferring TB's of data to this harassing client. > > I think it would be interesting to be able to do such a thing. > > Instead of being evil, just use fail2ban to address this problem :-) -- Best regards, Odhiambo WASHINGTON, Nairobi,KE +254 7 3200 0004/+254 7 2274 3223 "Oh, the cruft.", grep ^[^#] :-)

10 24

permissions for quota-status
by Andreas Meyer 14 Apr '19

14 Apr '19

Hello! doveconf --version 2.2.36 I want to move to a new server with dovecot but get an error Error: service(quota-status): listen(*, 12340) failed: Permission denied when I define service quota-status { executable = quota-status -p postfix inet_listener { port = 12340 } client_limit = 1 } private]# ll insgesamt 0 srw-rw-rw-. 1 postfix postfix 0 14. Apr 15:05 anvil srw-rw-rw-. 1 postfix postfix 0 14. Apr 15:05 bounce srw-rw-rw-. 1 postfix postfix 0 14. Apr 15:05 defer srw-rw-rw-. 1 postfix postfix 0 14. Apr 15:05 discard srw-------. 1 postfix postfix 0 14. Apr 15:08 dovecot-lmtp srw-rw-rw-. 1 postfix postfix 0 14. Apr 15:05 error srw-rw-rw-. 1 postfix postfix 0 14. Apr 15:05 lmtp srw-rw-rw-. 1 postfix postfix 0 14. Apr 15:05 local srw-rw-rw-. 1 postfix postfix 0 14. Apr 15:05 proxymap srw-rw-rw-. 1 postfix postfix 0 14. Apr 15:05 proxywrite srw-rw----. 1 postfix postfix 0 14. Apr 14:58 quota-status srw-rw-rw-. 1 postfix postfix 0 14. Apr 15:05 relay srw-rw-rw-. 1 postfix postfix 0 14. Apr 15:05 retry srw-rw-rw-. 1 postfix postfix 0 14. Apr 15:05 rewrite srw-rw-rw-. 1 postfix postfix 0 14. Apr 15:05 scache srw-rw-rw-. 1 postfix postfix 0 14. Apr 15:05 smtp srw-rw-rw-. 1 postfix postfix 0 14. Apr 15:05 tlsmgr srw-rw-rw-. 1 postfix postfix 0 14. Apr 15:05 trace srw-rw-rw-. 1 postfix postfix 0 14. Apr 15:05 verify srw-rw-rw-. 1 postfix postfix 0 14. Apr 15:05 virtual Don't know what's wrong. Can someone help? Kind regards Andreas -- PGP-Fingerprint: D392 5D21 0299 63D7 5BAE 4562 1E56 B2EA 81A2 59F1

2 1

nginx configuration to pass x-originating-ip
by André Rodier 14 Apr '19

14 Apr '19

Hello, There is a bug in SOGo, as it sends the original IP after successful login, and not before the login process. I traced the bug to the source code. https://sogo.nu/bugs/view.php?id=2979. Then, in my research, I found this old thread: https://forum.nginx.org/read.php?29,237299,237367#msg-237367 Can I use Nginx as an IMAP proxy to add the missing ID. I suspect this is something that can be achieved? I already have an Nginx for the SOGo front-end, so I would add another one for the IMAP proxy. With a little bit of luck, I should be able to pass the original IP between the two servers Does anyone has a working example? Thanks, André -- André Rodier HomeBox: https://github.com/progmaticltd/homebox

1 0

Post login scripts environment
by André Rodier 14 Apr '19

14 Apr '19

Dear Dovecot users, I am running Dovecot 2.2.27 on Debian Stretch, no issue so far. I wonder if there is a way to pass the remote IP address, in an environment variable, in the post login script. My Post login scripts are working well, except that when the server is accessed through a webmail (Roundcube or SOGo), the remote IP address is systematically 127.0.0.1. The other question I have is, is it possible to pass the user agent of the email client used to access the server? I know this can be easily forged, but I would like to log it. Thanks for your insight. -- André Rodier

2 6

Using userdb/passdb data in director_username_hash
by Mark Moseley 12 Apr '19

12 Apr '19

TL;DR: Can director_username_hash use %{userdb:...} or %{passdb:...} ? ==================================== This is on Ubuntu Precise, running dovecot 2.2.36. It's a fully production, director-ized env, so assume everything is working correctly. Happy to post doveconf if it's relevant but wanted to ask a general question first. I was curious if there's a way to get userdb/passdb data into director_username_hash. Currently, we've got default hashing (on %u). I'm returning a SQL field called 'real_username' (the owner of the mailbox, so almost never the same as %u). I'd like (for mdbox reasons) to hash on that rather than %u. My test SQL is returning (this is just a chunk -- it's duplicated for testing): UserName AS userdb_real_username, UserName AS real_username I can see in my director boxes that it's at least picking up the latter: passdb out: PASS 1 user=tesbox(a)mailbox.com proxy=y real_username=testuser Is it possible to inject 'real_username' into director_username_hash? That is, I'd rather hash on 'testuser' instead of 'testbed'. I've been trying different permutations on my director boxes with no luck. director_username_hash = %{userdb:real_username} director_username_hash = %{passdb:real_username} director_username_hash = %{userdb:userdb_real_username} director_username_hash = %{passdb:userdb_real_username} With any of those settings, every mailbox gets hashed to the same backend, so I'm guessing it's not getting anything useful (i.e. probably resolving to the same empty string and hashing on that -- or perhaps is just hashing on the literal string, e.g. "%{userdb:real_username}" ). And I'm not even sure if director_username_hash has access to any passdb/userdb data. Is there a debug setting that would show what string director is using to do the hashing? Current debug settings are: auth_debug = yes auth_debug_passwords = yes mail_debug = yes but not a peep as to the string that director is hashing on.

2 2

Migrating from external server to Dovecot (doveadm sync issues)
by Sven Strickroth 12 Apr '19

12 Apr '19

Hi, I'm experiencing serious issues when using doveadm sync not working at all or do not properly sync. I wanted to use this for migrating external mailboxes to my server (in order to overcome the time when some servers/clients still use the old server and some already the my server). I tried to find a few steps in order to replicate this: For testing purposes I simulate both the remote and local server on my Dovecot instance. I created remote(a)DOMAIN.TLD and local(a)DOMAIN.TLD both use mdbox and are empty (i.e., the mail_location is still non-existent). Then I send two mails to remote(a)DOMAIL.TLD (Subjects: Test1 and Test2). Start backup remote IMAP account (remote(a)DOMAIN.TLD) to local account (local(a)DOMAIN.TLD) * doveadm -o imapc_user="remote(a)DOMAIN.TLD" -o imapc_password="PW" -o imapc_host="localhost" -o mail_prefetch_count=20 -o imapc_features="rfc822.size fetch-headers" backup -R -u local(a)DOMAIN.TLD imapc: (without this I often got errors such as "Error: Backend didn't update mailbox Trash GUID" on sync runs, which seems to be an unrecoverable error). Now the two mailboxes seem to be the same (can confirm this when logging into the two mailboxes). Now, run first sync: * doveadm -o imapc_user="remote(a)DOMAIN.TLD" -o imapc_password="PW" -o imapc_host="localhost" -o mail_prefetch_count=20 -o imapc_features="rfc822.size fetch-headers" sync -R -u local(a)DOMAIN.TLD imapc: Seems to work and does nothing at the moment. Deliver one message to local(a)DOMAIN.TLD (Subject Test3). * doveadm -o imapc_user="remote(a)DOMAIN.TLD" -o imapc_password="PW" -o imapc_host="localhost" -o mail_prefetch_count=20 -o imapc_features="rfc822.size fetch-headers" sync -R -u local(a)DOMAIN.TLD imapc: Now Test1,2,3 are in both mailboxes (further runs do change nothing). Everything OK up the here. Now deliver one messages to remote(a)DOMAIN.TLD (Test4) and delete one old message (Test3). Deliver two messages to local(a)DOMAIN.TLD (Subjects Test5 and Test6) and delete one message (Test2). In sum both mailboxes look like this: remote(a)DOMAIN.TLD has Test1,2,4 and local(a)DOMAIN.TLD has 1,3,5,6. Now sync: * doveadm -o imapc_user="remote(a)DOMAIN.TLD" -o imapc_password="PW" -o imapc_host="localhost" -o mail_prefetch_count=20 -o imapc_features="rfc822.size fetch-headers" sync -R -u local(a)DOMAIN.TLD imapc: dsync(local(a)DOMAIN.TLD): Warning: Mailbox changes caused a desync. You may want to run dsync again: 3 UIDs changed due to UID conflicts Rerun again and see that mails start duplicating and deletings are not synced: remote(a)DOMAIN.TLD: Test1,2,4,3,5,6,5,6,6,5,3,4 (12 mails) and local(a)DOMAIN.TLD: 1,6,4,3,5,6,4,3,5,6,5 (11 mails) When I re-run again I sometimes see the above error message again, mails keep duplicating in both mailboxes and the mailboxes are not synced at all. Am I using doveadm sync wrongly? Is there a way to use "sync" directly w/o backup from the beginning (i.e., how to get rid of the error "Error: Backend didn't update mailbox Trash GUID"). Context: # 2.2.27 (c0f36b0): /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.16 (fed8554) # OS: Linux 4.9.0-8-amd64 x86_64 Debian 9.8 imap_client_workarounds = delay-newmail I can't upgrade to latest Dovecot right now. :( -- Best regards, Sven Strickroth PGP key id F5A9D4C4 @ any key-server

1 0

Mail account brute force / harassment
by Marc Roos 12 Apr '19

12 Apr '19

Say for instance you have some one trying to constantly access an account Has any of you made something creative like this: * configure that account to allow to login with any password * link that account to something like /dev/zero that generates infinite amount of messages (maybe send an archive of virusses?) * transferring TB's of data to this harassing client. I think it would be interesting to be able to do such a thing.

3 2

Emails redownloading
by azurit＠pobox.sk 12 Apr '19

12 Apr '19

Hi, recently, we had a problem on one of our mail servers and, after reboot, HDD with emails wasn't mounted into system. Until we fixed it, LOTS of users logged in (Dovecot allowed login and recreated directory structure of mailboxes) and saw empty mailboxes. Now they are redownloading all email, which isn't fun, as it's about 2 TB of data. Anyway, is there a way how to prevent this in the future? Can i set Dovecot to disallow logins in such situations? Thanks. azur

3 5

Doveadm stats
by ＠lbutlr 12 Apr '19

12 Apr '19

Are there any examples of the utility of doveadm stats? in the man page: > dump accepts following types: command, session, user, domain, ip and > global. > > Filter can be > > user=<wildcard> > Match given user. I've tried the following commands after looking at the (sparse and example-less) man page. # doveadm stats dump metric_name field count sum min max avg median stddev %95 # doveadm stats dump user Error: Extraneous arguments found: user # doveadm stats dump user user="*" Error: Extraneous arguments found: user user=* # doveadm stats dump global Error: Extraneous arguments found: global # doveadm stats dump global user="*" Error: Extraneous arguments found: global user=* # I assume there is more to the configuration for stats than merely making it not report an error. So, the first question is what sorts of stats would be most likely to be useful and what do I do in the configuration to get those? Second question is why is this required to be enabled if, by default, it has no functionality? -- Beware of geeks bearing .GIF's

2 1

Mailbox INBOX: Opening INBOX failed: Mailbox doesn't exist: INBOX. Maybe master user + namespace problem?
by Usuario prueba 12 Apr '19

12 Apr '19

2 2

Secure Client-Initiated Renegotiation
by sergio 12 Apr '19

12 Apr '19

Hello. I've just tested my system that runs dovecot 2.3.4.1 on debian buster with testssl.sh (https://testssl.sh/) and is says: Secure Renegotiation (CVE-2009-3555) not vulnerable (OK) Secure Client-Initiated Renegotiation VULNERABLE (NOT ok), potential DoS threat Is this a configuration or a compilation issue and how to solve it? -- sergio.

2 1

Re: High availability of Dovecot
by Gerald Galster 12 Apr '19

12 Apr '19

> Am 11.04.2019 um 11:48 schrieb luckydog xf <luckydogxf(a)gmail.com>: > > As your statement, nothing speical is needed to do except setting up DNS MX records, right? MX records are for incoming MAIL: yourdomain.com <http://yourdomain.com/> IN MX 100 mail1.yourdomain.com <http://server1.yourdomain.com/> yourdomain.com <http://yourdomain.com/> IN MX 100 mail2.yourdomain.com <http://mail2.yourdomain.com/> -> both priority 100 = 50/50 load balancing (globally, not when checked on a single resolver!) Then you need A Records (AAAA for ipv6) mail1.yourdomain.com IN A 192.168.10.1 mail2.yourdomain.com <http://mail2.yourdomain.com/> IN A 192.168.20.1 mail.yourdomain.com IN A 192.168.10.1 mail.yourdomain.com IN A 192.168.20.1 mail1/mail2 is for direct connection (MTAs) Your users (outlook, thunderbird, ...) connect to mail.yourdomain.com <http://mail.yourdomain.com/> which returns the two ip addresses. In this scenario MUA just connects to mail.yourdomain.com <http://mail.yourdomain.com/> and randomly uses one of the two ips. You can't control which one, but this gives you active/active loadbalancing. In case one server is down the MUA just uses the other ip. dsync replicates bi-directionally so that both servers are up-to-date. You don't need shared storage, every server is a copy of the other. If you want to use shared storage, then dsync is not for you because there is nothing to sync at that stage. I would use shared storage only if you need to have more than two servers. The above setup has no locking problems and is performant due to local filesystems. It depends on how many users you have and how much storage you need. You could buy two 2HE servers with 24 2.5" disks each (up to 96 with 4 HE), which may be sufficient for your needs. > User's mail store is running on shared storage, basically user's MUA connects to primary MX , the backup one is used once Primary is down. If you're not using Maildir beware of locking issues with concurrent access. It could crash indices. > It's a native HA of email system? I'll test those solution out. Yes, it works well with small setups. For big setups you'd typically use dovecot director, shared storage, object storage ... but you need more servers and it is way more complex and expensive. Best regards Gerald

3 3

failed: read(/var/run/dovecot/dns-client)
by Laura Smith 12 Apr '19

12 Apr '19

=== dsync(foobar(a)example.com): Error: imapc(foobar.example.com:993): dns_lookup(foobar.example.com) failed: read(/var/run/dovecot/dns-client) failed: read(size=512) failed: Connection reset by peer dsync(foobar(a)example.com): Error: Failed to initialize user: imapc: Login to foobar.example.com failed: Disconnected from server === Initially I thought "oh no, not another AppArmor block". But then surely the second message would not appear if the DNS lookup was not successful ? Also "dig foobar.example.com" works fine. How should I be troubleshooting this ? And if it is still likely to be AppArmor, what is calling it ? "doveadm" itself or something else ? What does "/var/run/dovecot/dns-client" do and why doesn't dovecot use standard OS calls like everyone else ? So many questions !

3 18

auth-worker unknown user
by Laura Smith 11 Apr '19

11 Apr '19

pam(foobar(a)example.com,192.0.1.1,<9zMTUUCGNfHZzMpL>): unknown user (SHA1 of given password: ff75068c2f4d700a49dae204d56477a5ffa5d23d) The password is correct, i.e. 'echo -n 'passed' | openssl dgst -sha1' matches. The user is setup correctly in /etc/dovecot/users (the /etc/dovecot/users was copied from another known-good server, so the syntax is correct and appropriate adjustments have been made for chmod and directory). doveconf -N follows: # 2.3.3 (dcead646b): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.3 (f018bbab) # OS: Linux 4.12.14-lp150.12.48-default x86_64 # Hostname: foobar auth_mechanisms = plain login auth_verbose = yes auth_verbose_passwords = sha1 doveadm_password = # hidden, use -P to show it first_valid_uid = 471 imapc_features = rfc822.size fetch-headers imapc_host = foobar.example.com imapc_password = # hidden, use -P to show it imapc_port = 993 imapc_ssl = imaps imapc_user = %u mail_location = maildir:~/Maildir mail_plugin_dir = /usr/lib64/dovecot/modules mail_prefetch_count = 20 mailbox_list_index = yes managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body environment mailbox date ihave enotify namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { driver = pam name = } plugin { sieve = file:~/.dovecot.sieve } protocols = imap lmtp service auth { unix_listener /var/spool/postfix/private/dovecot-auth { group = postfix mode = 0660 user = postfix } } service imap-login { process_min_avail = 3 } service lmtp { process_min_avail = 5 unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0660 user = postfix } user = my_virtmailuser } service managesieve-login { inet_listener sieve { port = 4190 } inet_listener sieves { address = port = 5190 ssl = yes } } ssl = required ssl_ca = </etc/dovecot/ssl/certbot_ca.pem ssl_cert = </etc/dovecot/ssl/certbot.pem ssl_cipher_list = ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS ssl_client_ca_dir = /etc/ssl/certs ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it ssl_min_protocol = TLSv1.2 ssl_options = no_compression ssl_prefer_server_ciphers = yes userdb { driver = passwd name = } userdb { args = scheme=ARGON2ID username_format=%u /etc/dovecot/users auth_verbose = yes driver = passwd-file name = } protocol lmtp { mail_plugins = sieve postmaster_address = foobar(a)example.com } protocol lda { deliver_log_format = msgid=%m: %$ mail_plugins = sieve postmaster_address = postmaster quota_full_tempfail = yes rejection_reason = Your message to <%t> was automatically rejected:%n%r } protocol imap { mail_max_userip_connections = 20 }

2 7

LMTP, PAM session and home directory autocreation
by Ivars Strazdins 11 Apr '19

11 Apr '19

Hi, mail is delivered by Dovecot's LMTP locally and I need user's home directory to be created if it doesn't exist yet. There is a setting in Dovecot's configuration, "session=yes", in /etc/Dovecot/conf.d/auth-system.conf.ext, which should do that. passdb { driver = pam args = session=yes dovecot } But I think it does not work in my setup because I do not see any PAM log entry for Dovecot in system log when this error happens: Apr 9 13:01:55 mailhost dovecot: lmtp(2935): Connect from local Apr 9 13:01:55 mailhost dovecot: lmtp(2935, testuser): Error: User initialization failed: Namespace '': mkdir(/home/testuser/Maildir) failed: Permission denied (euid=174000327(testuser) egid=174000327(testuser ) missing +w perm: /home, dir owned by 0:0 mode=0755) Apr 9 13:01:55 mailhost dovecot: lmtp(2935): Disconnect from local: Successful quit The error above seems expected, because it is not LMTP agent's job to create user's home directory but pam_oddjob_mkhomedir.so module should do that. Right? And there are common PAM log entries for every user session: Apr 9 13:24:42 mailhost auth: pam_sss(dovecot:auth): authentication success; logname= uid=0 euid=0 tty=dovecot ruser=validuser rhost=::1 user= validuser Apr 9 13:24:42 mailhost auth: pam_unix(dovecot:session): session opened for user validuser by (uid=0) Apr 9 13:24:42 mailhost auth: pam_unix(dovecot:session): session closed for user validuser How to debug this problem and find out why Dovecot does not open PAM session or - if I am wrong and it does, then what else is going wrong? Home directory autocreation is configured with command "authconfig --enablemkhomedir --update" and it works if user logs into system via shell or webmail. I tried to enable "mail_debug" in Dovecot's settings, but it did not give me any more information on PAM session. Running on Centos 7.6, with Dovecot 2.2.36. It looks like a common mistake or issue, because I am not alone: http://tinyurl.com/y6kjhsnw Thank you very much in advance for your time. Ivars /etc/pam.d/dovecot #%PAM-1.0 auth required pam_nologin.so auth include password-auth account include password-auth session include password-auth /etc/pam.d/password-auth #%PAM-1.0 # This file is auto-generated. # User changes will be destroyed the next time authconfig is run. auth required pam_env.so auth [default=1 success=ok] pam_localuser.so auth [success=done ignore=ignore default=die] pam_unix.so nullok try_first_pass auth requisite pam_succeed_if.so uid >= 1000 quiet_success auth sufficient pam_sss.so forward_pass auth required pam_deny.so account required pam_unix.so account sufficient pam_localuser.so account sufficient pam_succeed_if.so uid < 1000 quiet account [default=bad success=ok user_unknown=ignore] pam_sss.so account required pam_permit.so password requisite pam_pwquality.so try_first_pass local_users_only retry=3 authtok_type= password sufficient pam_unix.so sha512 shadow nullok try_first_pass use_authtok password sufficient pam_sss.so use_authtok password required pam_deny.so session optional pam_keyinit.so revoke session required pam_limits.so -session optional pam_systemd.so session optional pam_oddjob_mkhomedir.so umask=0077 session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid session required pam_unix.so session optional pam_sss.so doveconf -n # 2.2.36 (1f10bfa63): /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.24 (124e06aa) # OS: Linux 3.10.0-957.10.1.el7.x86_64 x86_64 CentOS Linux release 7.6.1810 (Core) # Hostname: mailhost.example.com auth_mechanisms = plain login auth_socket_path = /var/run/dovecot/auth-master auth_username_format = %Ln auth_verbose = yes default_client_limit = 3500 default_process_limit = 500 disable_plaintext_auth = no first_valid_uid = 203 imap_client_workarounds = tb-lsub-flags tb-extra-mailbox-sep lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes lmtp_save_to_detail_mailbox = yes mail_location = maildir:~/Maildir:INBOX=~/Maildir:LAYOUT=fs mail_plugins = " fts fts_lucene" mail_privileged_group = mail maildir_very_dirty_syncs = yes managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext imapsieve vnd.dovecot.imapsieve mbox_write_locks = fcntl namespace inbox { inbox = yes list = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk { auto = subscribe special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Messages" { auto = subscribe special_use = \Sent } mailbox Trash { auto = subscribe special_use = \Trash } prefix = separator = / type = private } passdb { args = session=yes dovecot driver = pam } plugin { autocreate = Junk autocreate2 = Sent autocreate3 = Drafts autocreate4 = Trash autosubscribe = Junk autosubscribe2 = Sent autosubscribe3 = Drafts autosubscribe4 = Trash fts = lucene fts_lucene = whitespace_chars=@. imapsieve_mailbox1_before = file:/usr/lib64/dovecot/sieve/report-spam.sieve imapsieve_mailbox1_causes = COPY imapsieve_mailbox1_name = Junk imapsieve_mailbox2_before = file:/usr/lib64/dovecot/sieve/report-ham.sieve imapsieve_mailbox2_causes = COPY imapsieve_mailbox2_from = Junk imapsieve_mailbox2_name = * sieve = file:~/sieve;active=~/roundcube.sieve sieve_before = /var/lib/sieve/junk.sieve sieve_global_extensions = +vnd.dovecot.pipe +vnd.dovecot.environment sieve_pipe_bin_dir = /usr/lib64/dovecot/sieve sieve_plugins = sieve_imapsieve sieve_extprograms } pop3_client_workarounds = outlook-no-nuls oe-ns-eoh pop3_uidl_format = %v.%u protocols = imap pop3 lmtp sieve service auth { unix_listener /var/spool/postfix/private/dovecot-auth { group = postfix mode = 0660 user = postfix } unix_listener auth-master { group = user mode = 0660 user = root } } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } ssl_cert = </etc/letsencrypt/live/webmail.example.com/fullchain.pem ssl_key = # hidden, use -P to show it syslog_facility = local0 userdb { driver = passwd } valid_chroot_dirs = /var/mail:/home protocol lmtp { mail_fsync = never mail_plugins = " fts fts_lucene sieve" postmaster_address = postmaster(a)example.com } protocol lda { mail_fsync = never mail_plugins = " fts fts_lucene sieve expire" } protocol imap { mail_max_userip_connections = 25 mail_plugins = " fts fts_lucene fts fts_squat expire imap_sieve" } protocol sieve { managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date } protocol pop3 { mail_max_userip_connections = 20 mail_plugins = " fts fts_lucene fts fts_squat expire" }

1 0

High availability of Dovecot
by luckydog xf 11 Apr '19

11 Apr '19

Hi, list, I'm going to deploy postfix + dovecot + CephFS( as Mail Storage). Basically I want to use two servers for them, which is kind of HA. My idea is that using keepalived or Pacemaker to host a VIP, which could fail over the other server once one is down. And I'll use Haproxy or Nginx to schedule connections to one of those server based on source IP( Session stickiness), I'll use VIP as DNS record.etc, is my plan doable? I know MX could be server ones with different priority. But I think it brings along shortage that DNS couldn't know Email server is up or down, it just returns results to MUA, right? Thanks for any suggestions and ideas. -

7 6

Re: Mail account brute force / harassment
by Odhiambo Washington 11 Apr '19

11 Apr '19

All your approaches are not well thought out. The best solutions are always the simplest ones. KISS principle dictates so. On Thu, 11 Apr 2019 at 15:01, Marc Roos <M.Roos(a)f1-outsourcing.eu> wrote: > > How long have we been using the current strategy? Do we have less or > more abuse clouds operating? > > "Let the others bother with their own problems." is a bit narrow minded > view. If every one on this mailing list would have this attitude, there > would be no single answer to your question. > > > -----Original Message----- > From: Odhiambo Washington [mailto:odhiambo@gmail.com] > Sent: donderdag 11 april 2019 12:54 > To: Marc Roos > Cc: dovecot > Subject: Re: Mail account brute force / harassment > > Marc, > > There is a strategy loosely referred to as "choose your battles well" > :-) > If you can, hack the server and dump the 500GB - you'll be using > resources transferring the 500GB as the other server receives it. Two > servers wasting resources because you think you are punishing an > offender! > > > On Thu, 11 Apr 2019 at 13:43, wrote: > > > Please do not assume anything other than what is written, it is a > hypothetical situation > > > A. With the fail2ban solution > - you 'solve' that the current ip is not able to access you > - it will continue bothering other servers and admins > - you get the next abuse host to give a try. > > B. With 500GB dump > - the owner of the attacking server (probably hacked) will notice > it > will be forced to take action. > > > If abuse clouds are smart (most are) they would notice that > attacking my > servers, will result in the loss of abuse nodes, hence they will > not > bother me anymore. > > If every one would apply strategy B, the abuse problem would get > less. > Don't you agree?? > > > > > > > -----Original Message----- > From: Odhiambo Washington > Sent: donderdag 11 april 2019 12:28 > To: Marc Roos > Cc: dovecot > Subject: Re: Mail account brute force / harassment > > > > On Thu, 11 Apr 2019 at 13:24, Marc Roos via dovecot > <dovecot(a)dovecot.org> wrote: > > > > > Say for instance you have some one trying to constantly > access an > account > > > Has any of you made something creative like this: > > * configure that account to allow to login with any > password > * link that account to something like /dev/zero that > generates > infinite > amount of messages > (maybe send an archive of virusses?) > * transferring TB's of data to this harassing client. > > I think it would be interesting to be able to do such a > thing. > > > > > Instead of being evil, just use fail2ban to address this problem > :-) > > -- > > Best regards, > Odhiambo WASHINGTON, > Nairobi,KE > +254 7 3200 0004/+254 7 2274 3223 > "Oh, the cruft.", grep ^[^#] :-) > > > > > > > -- > > Best regards, > Odhiambo WASHINGTON, > Nairobi,KE > +254 7 3200 0004/+254 7 2274 3223 > "Oh, the cruft.", grep ^[^#] :-) > > > -- Best regards, Odhiambo WASHINGTON, Nairobi,KE +254 7 3200 0004/+254 7 2274 3223 "Oh, the cruft.", grep ^[^#] :-)

1 0

Re: Mail account brute force / harassment
by Odhiambo Washington 11 Apr '19

11 Apr '19

Marc, There is a strategy loosely referred to as "choose your battles well" :-) Let the others bother with their own problems. If you can, hack the server and dump the 500GB - you'll be using resources transferring the 500GB as the other server receives it. Two servers wasting resources because you think you are punishing an offender! On Thu, 11 Apr 2019 at 13:43, Marc Roos <M.Roos(a)f1-outsourcing.eu> wrote: > Please do not assume anything other than what is written, it is a > hypothetical situation > > > A. With the fail2ban solution > - you 'solve' that the current ip is not able to access you > - it will continue bothering other servers and admins > - you get the next abuse host to give a try. > > B. With 500GB dump > - the owner of the attacking server (probably hacked) will notice it > will be forced to take action. > > > If abuse clouds are smart (most are) they would notice that attacking my > servers, will result in the loss of abuse nodes, hence they will not > bother me anymore. > > If every one would apply strategy B, the abuse problem would get less. > Don't you agree?? > > > > > > > -----Original Message----- > From: Odhiambo Washington > Sent: donderdag 11 april 2019 12:28 > To: Marc Roos > Cc: dovecot > Subject: Re: Mail account brute force / harassment > > > > On Thu, 11 Apr 2019 at 13:24, Marc Roos via dovecot > <dovecot(a)dovecot.org> wrote: > > > > > Say for instance you have some one trying to constantly access an > account > > > Has any of you made something creative like this: > > * configure that account to allow to login with any password > * link that account to something like /dev/zero that generates > infinite > amount of messages > (maybe send an archive of virusses?) > * transferring TB's of data to this harassing client. > > I think it would be interesting to be able to do such a thing. > > > > > Instead of being evil, just use fail2ban to address this problem :-) > > -- > > Best regards, > Odhiambo WASHINGTON, > Nairobi,KE > +254 7 3200 0004/+254 7 2274 3223 > "Oh, the cruft.", grep ^[^#] :-) > > > -- Best regards, Odhiambo WASHINGTON, Nairobi,KE +254 7 3200 0004/+254 7 2274 3223 "Oh, the cruft.", grep ^[^#] :-)

2 1

Re: Lua Push Notification Plugin
by Sami Ketola 11 Apr '19

11 Apr '19

Hi, doveadm mailbox metadata get -u victim INBOX /private/vendor/vendor.dovecot/pvt/server/vendor/vendor.dovecot/http-notify or doveadm mailbox metadata set if you are not using appsuite as your mail frontend then you need to set the metadata manually or make sure that your mail frontend does set it. Sami > On 11 Apr 2019, at 11.50, Pabsky <j0hnw0rk3r(a)gmail.com> wrote: > > Sami, > > the package 'appsuite' is not mentioned in the documentation, also I already enabled imap metadata. > > What do you mean by 'It's not supposed to be a file. It's supposed to be a attribute on the users INBOX'? > > I'm attaching my dovecot configuration file for you to examine. Thanks Sami! > > On 11/04/2019 4:37 PM, Sami Ketola wrote: >> >> >>> On 11 Apr 2019, at 11.00, Pabsky via dovecot <dovecot(a)dovecot.org <mailto:dovecot@dovecot.org>> wrote: >>> >>> Thanks AKI! I'm a step closer to achieving my goals. >>> >>> However, I'm getting a new error as indicated from below: >>> >>> Apr 11 01:45:34 lmtp(user(a)mydomain.com <mailto:user@mydomain.com>)<20801><pVlIEJ7wrlxBUQAAUdwEFQ>: Debug: push-notification-ox: Skipped because not active (/private/vendor/vendor.dovecot/pvt/server/vendor/vendor.dovecot/http-notify METADATA not set) >>> Apr 11 01:45:34 lmtp(user(a)mydomain.com <mailto:user@mydomain.com>)<20801><pVlIEJ7wrlxBUQAAUdwEFQ>: Debug: push-notification: Push notification transaction completed >>> >>> By the way, the file /private/vendor/vendor.dovecot/pvt/server/vendor/vendor.dovecot/http-notify does not exist on my server. >> >> It's not supposed to be a file. It's supposed to be a attribute on the users INBOX. Also you need to enable imap metadata or appsuite can't set the attribute. >> >> Sami >> >> > <dovecot.conf>

1 0

Passord change problem. (INTERNAL)
by Arvid.Eikas＠telenor.com 11 Apr '19

11 Apr '19

Hi, We have a strange problem with login after password change. We need to kill the auth_worker processes to activate the new password. It doesn't work with SIGHUP on pid, it doesn't help to run "doveadm auth cache flush". It runs flush xx but the new password still doesn't work. Are there any suggestions for how this can be resolved? Our release is 2.3.5. Arvid

1 0

Re: Lua Push Notification Plugin
by Pabsky 11 Apr '19

11 Apr '19

Thanks AKI! I'm a step closer to achieving my goals. However, I'm getting a new error as indicated from below: Apr 11 01:45:34 lmtp(user(a)mydomain.com)<20801><pVlIEJ7wrlxBUQAAUdwEFQ>:*Debug: push-notification-ox: Skipped because not active (/private/vendor/vendor.dovecot/pvt/server/vendor/vendor.dovecot/http-notify METADATA not set)* Apr 11 01:45:34 lmtp(user(a)mydomain.com)<20801><pVlIEJ7wrlxBUQAAUdwEFQ>:*Debug: push-notification: Push notification transaction completed *By the way, the file****/private/vendor/vendor.dovecot/pvt/server/vendor/vendor.dovecot/http-notify* *does not exist on my server. Again, I appreciate the help :) ** > On 11 April 2019 07:57 Robust Coding via dovecot <dovecot(a)dovecot.org> wrote: > > > Hi Admin, > > I hope you consider reading and addressing my concern promptly. > > For the past few days I've been setting up a VPS with cPanel and WHM > pre-installed on Bluehost. I want to enable push notification plugin in > Dovecot2.3.5. I tried OX and Lua plugins and got errors. > > For using OX plugin: > push_notification_driver = ox:url=http://staging.mydomain.com/mail-notify/v1 > user_from_metadata > And got this error on runtime: > Error: push-notification-ox: Skipped because unable to get attribute: Mailbox > attributes not enabled > mail_attribute_dict = file:%h/Maildir/dovecot-attributes > When using Lua: > mail_plugins = $mail_plugins mail_lua notify push_notification > push_notification_lua > > plugin { > push_notification_driver = lua:file=/path/to/lua/push.lua > } > And got this order: > Plugin 'push_notification_lua' not found from directory /usr/lib64/dovecot > You do not have push_notification_lua installed. > I think I'm missing something here but I can't figure it out. Please HELP! > > Sincerely, > John Lopena > > -- > > "Become a programmer - Lose your brain's virginity" Aki

3 2

masteruser can not select INBOX
by Ludwig Wieland 11 Apr '19

11 Apr '19

Hello, My Dovecot Master can login but not not select INBOX ! What's wrong ? best regards Luda 1) USER can select INBOX: OK --------------------------------------------------- telnet localhost imap Trying ::1... Connected to localhost. Escape character is '^]'. * OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE STARTTLS AUTH=CRAM-MD5 AUTH=DIGEST-MD5 AUTH=GSSAPI AUTH=PLAIN AUTH=LOGIN] Dovecot ready. a login test1 password a OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE SORT SORT=DISPLAY THREAD=REFERENCES THREAD=REFS THREAD=ORDEREDSUBJECT MULTIAPPEND URL-PARTIAL CATENATE UNSELECT CHILDREN NAMESPACE UIDPLUS LIST-EXTENDED I18NLEVEL=1 CONDSTORE QRESYNC ESEARCH ESORT SEARCHRES WITHIN CONTEXT=SEARCH LIST-STATUS BINARY MOVE SEARCH=FUZZY SPECIAL-USE COMPRESS=DEFLATE QUOTA ACL RIGHTS=texk] Logged in b select INBOX * FLAGS (\Answered \Flagged \Deleted \Seen \Draft) * OK [PERMANENTFLAGS (\Answered \Flagged \Deleted \Seen \Draft \*)] Flags permitted. * 5 EXISTS * 0 RECENT * OK [UNSEEN 1] First unseen. * OK [UIDVALIDITY 1328091893] UIDs valid * OK [UIDNEXT 6] Predicted next UID * OK [HIGHESTMODSEQ 11] Highest b OK [READ-WRITE] Select completed (0.000 + 0.000 secs). c logout * BYE Logging out c OK Logout completed. Connection closed by foreign host. 2) MASTER-USER can't select INBOX: ! --------------------------------------------------- admins$ telnet localhost imap Trying ::1... Connected to localhost. Escape character is '^]'. * OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE STARTTLS AUTH=CRAM-MD5 AUTH=DIGEST-MD5 AUTH=GSSAPI AUTH=PLAIN AUTH=LOGIN] Dovecot ready. a login test1*mailmaster password a OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE SORT SORT=DISPLAY THREAD=REFERENCES THREAD=REFS THREAD=ORDEREDSUBJECT MULTIAPPEND URL-PARTIAL CATENATE UNSELECT CHILDREN NAMESPACE UIDPLUS LIST-EXTENDED I18NLEVEL=1 CONDSTORE QRESYNC ESEARCH ESORT SEARCHRES WITHIN CONTEXT=SEARCH LIST-STATUS BINARY MOVE SEARCH=FUZZY SPECIAL-USE COMPRESS=DEFLATE QUOTA ACL RIGHTS=texk] Logged in b select INBOX b NO [SERVERBUG] Internal error occurred. Refer to server log for more information. [2019-04-09 08:20:46] (0.000 + 0.000 secs). c logout * BYE Logging out c OK Logout completed. Connection closed by foreign host. ---------------------------------------- An the Server Error log says: Apr 09 00:05:40 imap(pid 62335 user test1): Error: Opening INBOX failed: Mailbox doesn't exist: INBOX ---------------------------------------- admins$ doveconf -n # 2.2.24 (a82c823): /Library/Server/Mail/Config/dovecot/dovecot.conf # OS: Darwin 16.7.0 x86_64 hfs auth_master_user_separator = * auth_mechanisms = cram-md5 digest-md5 gssapi plain login apop auth_realms = xserver.mydomain.ch auth_socket_path = /var/run/dovecot/auth-userdb auth_username_format = %n debug_log_path = /Library/Logs/Mail/mail-debug.log default_internal_user = _dovecot default_login_user = _dovenull disable_plaintext_auth = no first_valid_gid = 6 first_valid_uid = 6 imap_id_log = * imap_id_send = "name" * "version" * imap_urlauth_submit_user = submit info_log_path = /Library/Logs/Mail/mail-info.log log_path = /Library/Logs/Mail/mail-err.log login_log_format_elements = user=<%u> method=%m rip=%r lip=%l mpid=%e %c mail_access_groups = mail mail_attribute_dict = file:/Library/Server/Mail/Data/attributes/attributes.dict mail_location = maildir:/Library/Server/Mail/Data/mail/%u mail_log_prefix = "%s(pid %p user %u): " mail_plugins = quota zlib acl fts fts_sk managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave mdbox_rotate_size = 200 M namespace acl-mailboxes { list = children location = maildir:/Library/Server/Mail/Data/mail/users/%%u:INDEX=/Library/Server/Mail/Data/mail/shared/%%u prefix = shared.%%u. separator = . subscriptions = no type = shared } namespace inbox { inbox = yes location = mailbox "Deleted Messages" { special_use = \Trash } mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } namespace list-archives { list = children location = maildir:/Library/Server/Mail/Data/listserver/messages/archive/lists/%%u:INDEX=/Library/Server/Mail/Data/listserver/messages/archive/shared/%%u prefix = archives.%%u. separator = . subscriptions = no type = shared } passdb { args = /Library/Server/Mail/Config/dovecot/master-users driver = passwd-file master = yes pass = yes } passdb { driver = od } passdb { args = /Library/Server/Mail/Config/dovecot/submit.passdb driver = passwd-file } plugin { acl = vfile:/Library/Server/Mail/Config/dovecot/global-acls:cache_secs=300 acl_shared_dict = file:/Library/Server/Mail/Data/shared/shared-mailboxes fts = sk quota = maildir:User quota quota_warning = storage=100%% quota-exceeded %u quota_warning2 = storage=80%% quota-warning %u sieve = /Library/Server/Mail/Data/rules/%u/dovecot.sieve sieve_dir = /Library/Server/Mail/Data/rules/%u stats_refresh = 30 secs stats_track_cmds = yes } postmaster_address = postmaster(a)xserver.myserver.ch protocols = imap pop3 lmtp sieve quota_full_tempfail = yes service auth { idle_kill = 15 mins unix_listener auth-userdb { user = _dovecot } } service dns_client { unix_listener dns-client { mode = 0600 } } service imap-login { inet_listener imap { port = 143 } inet_listener imaps { port = 993 ssl = yes } service_count = 0 } service imap { client_limit = 5 process_limit = 200 service_count = 0 } service indexer-worker { user = _dovecot } service lmtp { unix_listener lmtp { mode = 0600 } } service managesieve-login { inet_listener sieve { port = 4190 } } service pop3-login { inet_listener pop3 { port = 110 } inet_listener pop3s { port = 995 ssl = yes } } service pop3 { client_limit = 5 process_limit = 200 service_count = 0 } service quota-exceeded { executable = script /Applications/Server.app/Contents/ServerRoot/usr/libexec/dovecot/quota-exceeded.sh unix_listener quota-exceeded { group = mail mode = 0660 user = _dovecot } user = _dovecot } service quota-warning { executable = script /Applications/Server.app/Contents/ServerRoot/usr/libexec/dovecot/quota-warning.sh unix_listener quota-warning { group = mail mode = 0660 user = _dovecot } user = _dovecot } service stats { fifo_listener stats-mail { mode = 0600 user = _dovecot } } ssl = required ssl_ca = </etc/certificates/myserver.ch.A9FFFFB4B4C0E4CA959917BC2F60BDECBC414D35.chain.pem ssl_cert = </etc/certificates/myserver.ch.A9FFFFB4B4C0E4CA959917BC2F60BDECBC414D35.cert.pem ssl_cipher_list = ALL:!LOW:!SSLv2:!EXP:!aNULL:!ADH:!eNULL ssl_key = </etc/certificates/myserver.ch.A9FFFFB4B4C0E4CA959917BC2F60BDECBC414D35.key.pem ssl_key_path = /etc/certificates/myserver.ch.A9FFFFB4B4C0E4CA959917BC2F60BDECBC414D35.key.pem ssl_protocols = !SSLv2 !SSLv3 userdb { args = partition=/Library/Server/Mail/Config/dovecot/partition_map.conf global_quota=0 enforce_quotas=yes driver = od } userdb { args = /Library/Server/Mail/Config/dovecot/submit.passdb driver = passwd-file } verbose_proctitle = yes protocol lmtp { mail_plugins = quota zlib acl fts fts_sk sieve } protocol lda { mail_plugins = quota zlib acl fts fts_sk sieve } protocol imap { mail_max_userip_connections = 20 mail_plugins = quota zlib acl fts fts_sk imap_acl imap_quota imap_zlib } protocol pop3 { mail_max_userip_connections = 6 }

3 8

Lua Push Notification Plugin
by Robust Coding 11 Apr '19

11 Apr '19

Hi Admin, I hope you consider reading and addressing my concern promptly. For the past few days I've been setting up a VPS with cPanel and WHM pre-installed on Bluehost. I want to enable push notification plugin in Dovecot2.3.5. I tried OX and Lua plugins and got errors. For using OX plugin: push_notification_driver = ox:url=http://staging.mydomain.com/mail-notify/v1 user_from_metadata And got this error on runtime: *Error: push-notification-ox: Skipped because unable to get attribute: Mailbox attributes not enabled* When using Lua: mail_plugins = $mail_plugins mail_lua notify push_notification push_notification_luaplugin { push_notification_driver = lua:file=/path/to/lua/push.lua} And got this order: *Plugin 'push_notification_lua' not found from directory /usr/lib64/dovecot* I think I'm missing something here but I can't figure it out. Please HELP! Sincerely, John Lopena -- *"Become a programmer - Lose your brain's virginity"*

2 1

ssl_cert: Can't open file permission denied
by Laura Smith 10 Apr '19

10 Apr '19

Dovecot 2.3.3 (dcead646b) openSUSE Leap 15.0 I am getting a weird error message: Fatal: Error in configuration file /etc/dovecot/local.conf line 16: ssl_cert: Can't open file /etc/foobar/ssl/certbot.pem: Permission denied I have tried the following: - chmod -R 655 /etc/foobar/ssl (/etc/foobar is 755) - create "ssl_users" group add dovecot to it chown -R dovecot:ssl_users /etc/foobar/ssl How can I fix this ? There's no obvious solution ?

5 7

/var/run/dovecot/stats-writer) failed: Permission denied
by ＠lbutlr 10 Apr '19

10 Apr '19

I am getting this error in logs net_connect_unix(/var/run/dovecot/stats-writer) failed: Permission den)) and I looked around the google results and it seems to be related to using service stats, which I am not using. # doveconf -n | grep stat # doveconf -n | head -3 # 2.3.5.1 (7ec6d0ade): /usr/local/etc/dovecot/dovecot.conf # Pigeonhole version 0.5.5 (2483b085) # OS: FreeBSD 11.2-RELEASE-p4 i386 Postfix is 3.4-20190106 (the newest version in ports) -- Over 3,500 gay marriages and, what, no hellfire? I was promise hellfire. And riots. What gives? -- Mark Morford

4 12

Restoring mailboxes from backup duplicates messages in POP clients
by Luis F. V. Gomes 10 Apr '19

10 Apr '19

Hello I had a disk problem and had to reformat it. All mailboxes were backed up using rsync. After I restored the mailboxes, the POP clients (Thunderbird) that were configured to leave the messages on the mailserver for, let's say, 30 days, didn't understand that some messages were already transfered and the users got duplicated messages in their Inbox. How can we avoid this? -- Thanks Luís F. Gomes IT Manager (55)(21) 3527-1220 Departamento de Engenharia Elétrica PUC-Rio R. Marques de S. Vicente 225/401L 22451-900 - Rio de Janeiro/RJ

3 4

protocols: Unknown protocol: sieve
by luckydog xf 10 Apr '19

10 Apr '19

Hi, list, I downloaded dovecot-2.3-pigeonhole-0.5.5.tar.gz and installed it, after I enabled #/etc/dovecot/conf.d/20-managesieve.conf protocols = $protocols sieve it said " protocols: Unknown protocol: sieve" What's wrong?" Thanks,

3 2

sieve match ANY header
by Shawn Heisey 10 Apr '19

10 Apr '19

I would like to create a sieve rule where I do a regex match on ALL headers, not a specific header. I've been trying to find out the proper syntax, but haven't found anything. Is this possible, and if so, how do I write it? Thanks, Shawn

4 6

Dovecot index compatibility
by Frido Otten 10 Apr '19

10 Apr '19

We're in the process of upgrading Dovecot from version 2.1.17 to 2.2.27 (package Debian Stretch). We have a shared NFS storage in use by multiple servers without Dovecot director. I've tested by connecting to IMAP on the new server to my own mailbox. This isn't a problem. But when the server with the Dovecot version 2.1.17 LDA drops a new message in my mailbox it thinks the index file is corrupted, and the message bounces to it's sender. So there must be a index compatibility issue between both versions. This is still no problem if I upgrade the entire platform in a maintenance window at once. But what I want is a rollback possibility. To which minimal Dovecot version should I upgrade the old platform to create this rollback possibility. I was looking for a table of dovecot index compatibility between the different versions (forward and backward), but couldn't find it. Is there any? Please advice. Best regards, Frido

1 0

dict: Error: Fatal error in defaults handling. Program aborted
by Hugo Manuel Ojendiz Lemus 10 Apr '19

10 Apr '19

Good day to everyone Currently, I'm trying to implement the sieve "vacation" plugin with the sieve "Extdata" plugin to lookup information from a MySQL remote server. I'm following the instructions in the documentation: https://wiki2.dovecot.org/Pigeonhole/Sieve/Plugins/Extdata ===== I have the following error === Apr 09 13:46:51 mail dovecot[5512]: dict: Error: Fatal error in defaults handling. Program aborted Apr 09 13:46:51 mail dovecot[5512]: lmtp(usrx(a)themail.com)<5539><PNwlBJvorFyjFQAAYWwSRA:2>: Warning: sieve: before: line 18: extdata: failed to lookup value `reply_enabled': Connection closed (reply took 0.016 secs (0.017 in dict wait, 0.000 in other ioloops, 0.000 in locks, async-id reply 0.001 secs ago)) Apr 09 13:46:51 mail dovecot[5512]: dict: Fatal: master: service(dict): child 5542 killed with signal 11 (core dumps disabled - https://dovecot.org/bugreport.html#coredumps) Apr 09 13:46:51 mail.halmex.com.mx dovecot[5512]: dict: Error: Fatal error in defaults handling. Program aborted ============================ ====== Dovecot Information ====== 2.3.5.1 (7ec6d0ade): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.5 (2483b085) # OS: Linux 3.10.0-514.16.1.el7.x86_64 x86_64 CentOS Linux release 7.3.1611 (Core) xfs doveconf: Warning: please set ssl_dh=</etc/dovecot/dh.pem doveconf: Warning: You can generate it with: dd if=/var/lib/dovecot/ssl-parameters.dat bs=1 skip=88 | openssl dhparam -inform der > /etc/dovecot/dh.pem dict { sieve = mysql:/etc/dovecot/pigeonhole-sieve.dict } log_timestamp = "%Y-%m-%d %H:%M:%S " mail_location = maildir:/var/vmail/%d/%Ln managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext namespace inbox { inbox = yes location = prefix = separator = . type = private } passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } plugin { pop3_migration_mailbox = imapc: sieve_extdata_dict_uri = proxy::sieve sieve_global_extensions = +vnd.dovecot.extdata sieve_plugins = sieve_extdata sieve_vacation_send_from_recipient = yes sieve_before = /var/lib/dovecot/before.sieve } pop3c_host = mail.halmex.com.mx service auth-worker { user = root } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } unix_listener auth-master { mode = 0600 user = vmail } user = root } service dict { unix_listener dict { group = vmail mode = 0600 user = vmail } } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } userdb { args = uid=5000 gid=5000 home=/var/vmail/%d/%Ln allow_all_users=yes driver = static } protocol pop3 { disable_plaintext_auth = no } protocol doveadm { mail_plugins = " pop3_migration" } protocol lmtp { mail_plugins = " sieve" } ============================ An important bit of information it's that the dict service was trying to read the /etc/my.cnf file, but SELinux prevent it, and the sieve script worked fine, once I solved the SELinux access problem, the errors began to appear. This is a postfix server working great for years, with a local MariaDB. The remote MySQL server its in the same LAN and Its reachable by the mail server and other servers, the account has access, and like Ive mention, before I gave access to the local /etc/my.cnf the sieve script worked fine (just the SELinux warnings). Looks like the dict service has problems with the local MariaDB configuration file, but in this scenario its not required Any information or help you can provide me would be greatly appreciated. Hugo Manuel Ojendiz Lemus Desarrollo | Recursos Humanos | HALMEX ((°J°))

2 1

Where to report (potential) Dovecot bugs
by Mark Moseley 10 Apr '19

10 Apr '19

I'm curious if this is still the right place to report potential bugs with Dovecot. Is there a Dovecot bug tracker somewhere?

2 2

LMTP, PAM session and home directory autocreating
by Ivars Strazdins 09 Apr '19

09 Apr '19

Hi, mail is delivered by Dovecot's lmtp locally and I need user's home directory to be created if it doesn't exist yet. There is a setting in Dovecot's configuration, "session=yes", in /etc/Dovecot/conf.d/auth-system.conf.ext, which should do that. passdb { driver = pam args = session=yes dovecot } But I think it does not work in my setup because I do not see any PAM log entry for Dovecot when this error happens: Apr 9 13:01:55 mailhost dovecot: lmtp(2935): Connect from local Apr 9 13:01:55 mailhost dovecot: lmtp(2935, testuser): Error: User initialization failed: Namespace '': mkdir(/home/testuser/Maildir) failed: Permission denied (euid=174000327(testuser) egid=174000327(testuser ) missing +w perm: /home, dir owned by 0:0 mode=0755) Apr 9 13:01:55 mailhost dovecot: lmtp(2935): Disconnect from local: Successful quit The error above seems expected, because it is not lmtp agent's job to create user's home directory but pam_oddjob_mkhomedir.so module should do that. Right? And there are log entries every PAM user session: Apr 9 13:24:42 mailhost auth: pam_sss(dovecot:auth): authentication success; logname= uid=0 euid=0 tty=dovecot ruser=validuser rhost=::1 user= validuser Apr 9 13:24:42 mailhost auth: pam_unix(dovecot:session): session opened for user validuser by (uid=0) Apr 9 13:24:42 mailhost auth: pam_unix(dovecot:session): session closed for user validuser I ask for help how to debug this problem and find out why Dovecot does not open PAM session or - if I am wrong and it does, then what else is going wrong. Home directory autocreation is configured with command "authconfig --enablemkhomedir --update" and it works if user logs into system manually. I tried to enable "mail_debug" in Dovecot's settings, but it did not give me any more information on PAM session. Running on Centos 7.6, with Dovecot 2.2.36. I sort of remember this was working 2 years ago when I enabled "session=yes" but something has changed along the way with all the Centos updates. Thank you very much in advance for your time. Ivars /etc/pam.d/dovecot #%PAM-1.0 auth required pam_nologin.so auth include password-auth account include password-auth session include password-auth /etc/pam.d/password-auth #%PAM-1.0 # This file is auto-generated. # User changes will be destroyed the next time authconfig is run. auth required pam_env.so auth [default=1 success=ok] pam_localuser.so auth [success=done ignore=ignore default=die] pam_unix.so nullok try_first_pass auth requisite pam_succeed_if.so uid >= 1000 quiet_success auth sufficient pam_sss.so forward_pass auth required pam_deny.so account required pam_unix.so account sufficient pam_localuser.so account sufficient pam_succeed_if.so uid < 1000 quiet account [default=bad success=ok user_unknown=ignore] pam_sss.so account required pam_permit.so password requisite pam_pwquality.so try_first_pass local_users_only retry=3 authtok_type= password sufficient pam_unix.so sha512 shadow nullok try_first_pass use_authtok password sufficient pam_sss.so use_authtok password required pam_deny.so session optional pam_keyinit.so revoke session required pam_limits.so -session optional pam_systemd.so session optional pam_oddjob_mkhomedir.so umask=0077 session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid session required pam_unix.so session optional pam_sss.so doveconf -n # 2.2.36 (1f10bfa63): /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.24 (124e06aa) # OS: Linux 3.10.0-957.10.1.el7.x86_64 x86_64 CentOS Linux release 7.6.1810 (Core) # Hostname: mailhost.example.com auth_mechanisms = plain login auth_socket_path = /var/run/dovecot/auth-master auth_username_format = %Ln auth_verbose = yes default_client_limit = 3500 default_process_limit = 500 disable_plaintext_auth = no first_valid_uid = 203 imap_client_workarounds = tb-lsub-flags tb-extra-mailbox-sep lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes lmtp_save_to_detail_mailbox = yes mail_location = maildir:~/Maildir:INBOX=~/Maildir:LAYOUT=fs mail_plugins = " fts fts_lucene" mail_privileged_group = mail maildir_very_dirty_syncs = yes managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext imapsieve vnd.dovecot.imapsieve mbox_write_locks = fcntl namespace inbox { inbox = yes list = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk { auto = subscribe special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Messages" { auto = subscribe special_use = \Sent } mailbox Trash { auto = subscribe special_use = \Trash } prefix = separator = / type = private } passdb { args = session=yes dovecot driver = pam } plugin { autocreate = Junk autocreate2 = Sent autocreate3 = Drafts autocreate4 = Trash autosubscribe = Junk autosubscribe2 = Sent autosubscribe3 = Drafts autosubscribe4 = Trash fts = lucene fts_lucene = whitespace_chars=@. imapsieve_mailbox1_before = file:/usr/lib64/dovecot/sieve/report-spam.sieve imapsieve_mailbox1_causes = COPY imapsieve_mailbox1_name = Junk imapsieve_mailbox2_before = file:/usr/lib64/dovecot/sieve/report-ham.sieve imapsieve_mailbox2_causes = COPY imapsieve_mailbox2_from = Junk imapsieve_mailbox2_name = * sieve = file:~/sieve;active=~/roundcube.sieve sieve_before = /var/lib/sieve/junk.sieve sieve_global_extensions = +vnd.dovecot.pipe +vnd.dovecot.environment sieve_pipe_bin_dir = /usr/lib64/dovecot/sieve sieve_plugins = sieve_imapsieve sieve_extprograms } pop3_client_workarounds = outlook-no-nuls oe-ns-eoh pop3_uidl_format = %v.%u protocols = imap pop3 lmtp sieve service auth { unix_listener /var/spool/postfix/private/dovecot-auth { group = postfix mode = 0660 user = postfix } unix_listener auth-master { group = user mode = 0660 user = root } } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } ssl_cert = </etc/letsencrypt/live/webmail.example.com/fullchain.pem ssl_key = # hidden, use -P to show it syslog_facility = local0 userdb { driver = passwd } valid_chroot_dirs = /var/mail:/home protocol lmtp { mail_fsync = never mail_plugins = " fts fts_lucene sieve" postmaster_address = postmaster(a)example.com } protocol lda { mail_fsync = never mail_plugins = " fts fts_lucene sieve expire" } protocol imap { mail_max_userip_connections = 25 mail_plugins = " fts fts_lucene fts fts_squat expire imap_sieve" } protocol sieve { managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date } protocol pop3 { mail_max_userip_connections = 20 mail_plugins = " fts fts_lucene fts fts_squat expire" }

1 0

Problem with filter forwarded messages when using director proxy
by Ted 09 Apr '19

09 Apr '19

Hey there, I've been able to switch our mailservers over to using director to proxy logins and received email to the backend servers which store email on a shared NFS mount. Before I did this we were having trouble with the indexes running into errors because multiple servers accessing and modifying the dovecot.index files at the same time. I'm still seeing a small amount of this, and tracing it through it appears that when an account uses a filter to forward email to another address within our mail system, it recognises that it is a local email address it is responsible for and saves the message locally despite the fact that it is not the director specified server for the recipient address. As an example, lets say that test1(a)example.com is currently pointed to the 01 backend server by director, and test2(a)example.com to 02. If a filter at test1 forwards email to test2, then when an email for test1 comes in the director porxy will direct it to the 01 backend server, and when the message is saved the filter will run to forward it, and the 01 server will recognise that it is also responsible for test2 and so 01 will save the message for test2 rather than 02, as per director. This is causing a smallish number of clashes which I'd like to get cleaned up. I've tried getting the server to send through a relay but if it recognises the account as local it will not use the relay to send the email. Has anyone run into anything like this or have any ideas about how to approach the problem? Thank you Ted easyDNS Technologies

1 0

Editing fail2ban page?
by Mauricio Tavares 09 Apr '19

09 Apr '19

In https://wiki.dovecot.org/HowTo/Fail2Ban, for a current (I know for a fact in 2.2.36) I believe it should be filter = dovecot instead of filter = dovecot-pop3imap [root@mail ~]# ls -l /etc/fail2ban/filter.d/doveco* -rw-r--r-- 1 root root 1875 May 11 2017 /etc/fail2ban/filter.d/dovecot.conf [root@mail ~]#

2 1

dovecot[30008]: auth-worker: Fatal: master: service(auth-worker): child 31074 killed with signal 11
by Herbert 09 Apr '19

09 Apr '19

Hi Since a recent DNF update, I see many log file entries like the following: Apr 08 16:16:36 udoo.symmetrix.ch audit[31074]: ANOM_ABEND auid=4294967295 uid=0 gid=0 ses=4294967295 subj=system_u:system_r:dovecot_auth_t:s0 pid=31074 comm="auth" exe="/usr/libexec/dovecot/auth" sig=11 res=1 Apr 08 16:16:36 udoo.symmetrix.ch kernel: traps: auth[31074] general protection fault ip:7ff45b5f98a7 sp:7fff0df96830 error:0 in libmariadb.so.3[7ff45b5d7000+46000] Apr 08 16:16:36 udoo.symmetrix.ch dovecot[30008]: auth-worker: Fatal: master: service(auth-worker): child 31074 killed with signal 11 (core not dumped - https://dovecot.org/bugreport.html#coredumps) Apr 08 16:16:38 udoo.symmetrix.ch abrt-dump-journal-oops[1139]: abrt-dump-journal-oops: Found oopses: 1 Apr 08 16:16:38 udoo.symmetrix.ch abrt-dump-journal-oops[1139]: abrt-dump-journal-oops: Creating problem directories Apr 08 16:16:39 udoo.symmetrix.ch abrt-dump-journal-oops[1139]: Reported 1 kernel oopses to Abrt Apr 08 16:16:39 udoo.symmetrix.ch abrt-server[31104]: Can't find a meaningful backtrace for hashing in '.' Apr 08 16:16:39 udoo.symmetrix.ch abrt-server[31104]: Option 'DropNotReportableOopses' is not configured Apr 08 16:16:39 udoo.symmetrix.ch abrt-server[31104]: Preserving oops '.' because DropNotReportableOopses is 'no' Apr 08 16:16:39 udoo.symmetrix.ch dbus-daemon[1022]: [system] Activating service name='org.freedesktop.problems' requested by ':1.779' (uid=0 pid=31122 comm="/usr/bin/python3 /usr/bin/abrt-action-notify -d /v" label="system_u:system_r:abrt_t:s0-s0:c0.c1023") (using servicehelper) Apr 08 16:16:40 udoo.symmetrix.ch dbus-daemon[1022]: [system] Successfully activated service 'org.freedesktop.problems' Apr 08 16:16:40 udoo.symmetrix.ch abrt-notification[31129]: System encountered a non-fatal error in ??() # uname -a Linux udoo.symmetrix.ch 5.0.5-100.fc28.x86_64 #1 SMP Wed Mar 27 22:16:29 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux # dovecot --version 2.3.5 (513208660) # mysql --version mysql Ver 15.1 Distrib 10.2.22-MariaDB, for Linux (x86_64) using readline 5.1 Unfortunately I didn't manage to get a core dump, sorry. Kind regards, Herbert

2 1

Re: SMTPUTF8 support
by David Bürgin 08 Apr '19

08 Apr '19

André, are you quite sure you have it working? In this thread someone from Open-Xchange stated that no, Dovecot doesn’t have SMTPUTF8 support implemented, and the same response was given by another Dovecot developer last September (it ‘is being considered’ was the answer then, see https://dovecot.org/pipermail/dovecot/2018-September/112887.html) I am using LMTP to deliver mail to Dovecot from Postfix, and delivery fails with Postfix reporting: ‘SMTPUTF8 is required, but was not offered by host mail.my.org[private/dovecot-lmtp]’. I doubt that this can work without a change in Dovecot LMTP. Anyway, I am also interested in SMTPUTF8 support, so +1 from me! -- David

6 10

OpenFTS
by Cerebus 05 Apr '19

05 Apr '19

All the discussion on FTS reminds me, is there any plan to support OpenFTS in dovecot or is there a reason preventing that? -- This is my signature. There are many like it, but this one is mine.

2 1

SMTPUTF8 support
by sylvhem＠lepubdelobservateur.fr 05 Apr '19

05 Apr '19

Hi, I'm currently trying to set up SMTPUTF8 on my mail stack, but I can't find any information on Dovecot's RFC 6531 support. Has it been implemented yet? If so, does anyone know how to activate it? Regards. -- Sylvhem

4 5

Solr connection timeout hardwired to 60s
by Peter Mogensen 05 Apr '19

05 Apr '19

Hi, What's the recommended way to handling timeouts on large mailboxes given the hardwired request timeout of 60s in solr-connection.c: http_set.request_timeout_msecs = 60*1000; /Peter

5 5

doveadm backup + ISO 8859-1 mailbox name
by Michael Goth 04 Apr '19

04 Apr '19

Hi! I'm trying to migrate a mailbox from an old IMAP server (not Dovecot) to a new Dovecot server with 'doveadm backup'. The command fails because of an unexpected character in a mailbox name: doveadm -o imapc_user=ag(a)example.org \ -o imapc_password=XXX \ -o imapc_host=old-mailserver.webflow.de \ -o imapc_port=993 \ -o imapc_ssl=imaps \ -o imapc_ssl_verify=no \ -o imapc_features=rfc822.size,fetch-headers \ -o ssl_client_ca_dir=/etc/ssl \ backup -R -f -x ~* -u migration-ag(a)example.org imapc: dsync(migration-ag(a)example.org): Info: imapc(old-mailserver.webflow.de:993): Connected to 1.1.1.1:993 (local 2.2.2.2:46154) dsync(migration-ag(a)example.org): Error: Failed to access mailbox Entw?rfe: mailbox does not exist The problem is with "Entw?rfe" here. It's actually Entw<0xfc>rfe, which translates to "Entwürfe" in ISO-8859-1. Why can't doveadm find that mailbox? Is the old mailserver misbehaving (I hope not because I have no idea how to change that...), or does this happen on the new server? Can I tell doveadm something that makes this work? Thank you Michael -- Michael Goth .webflow GmbH Geschäftsführer: Andreas Schrei Wasserburger Straße 4 D - 83352 Altenmarkt a. d. Alz Amtsgericht Traunstein HRB 18537 E-Mail: mg(a)webflow.de Tel: +49 (0) 8621 - 99989 - 26 Fax: +49 (0) 8621 - 99989 - 28 Web: www.webflow.de

3 3

Autosubscribe to public folder
by Рустам 04 Apr '19

04 Apr '19

Hello everyone! I am trying to migrate from Dovecot 1.2 to Dovecot 2.2 and I can`t find information how to subscribe all users to public folder. In Dovecot 1.2 I have a few strings kind of "autosubscribeX = Public.Documents" and every users get subscribed to this Public folders and can`t unsubscribe. This is a goal. Is any posibility to make the same in Dovecot 2.2 or each user have to susbscribe to public folders themselves and this is kind of policy of Dovecot 2.2? -- С уважением, Рустам Багов.

2 1