- dovecot - dovecot.org

Troubles with Dovecot 2.3.3 - mkdir permission denied due to +w perm: /var, dir owned by 0:0 mode=0755)
by Kunal A. 22 Feb '19

22 Feb '19

Hi, I am quite new to Dovecot and I followed a tutorial on Linode to set up Dovecot, Postfix and MySql on the following site:- https://www.linode.com/docs/email/postfix/email-with-postfix-dovecot-and-my… Everything seems to work fine(telnet etc) except dovecot does not create mailboxes. Highly appreciate if someone could check the error messages and the dovecot -n on the bottom and provide some advise. I was unable to get the SQL config but I don't think its related to SQL but more of permission related. Please help Thanks Kevin Dovecot Version: 2.3.3 Error Message: Feb 22 08:54:42 computer dovecot[2224]: imap(email1(a)example.com)<4452><TTHt3nuC+rIAAAAAAAAAAAAAAAAAAAAB>: Server shutting down. in=16 out=539 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0 Feb 22 08:54:42 computer dovecot[4870]: master: Dovecot v2.3.3 (dcead646b) starting up for imap, pop3 Feb 22 08:55:06 computer dovecot[4872]: imap-login: Login: user=< email1(a)example.com>, method=PLAIN, rip=::1, lip=::1, mpid=4878, secured, session=<PfIL8HuCnLMAAAAAAAAAAAAAAAAAAAAB> Feb 22 08:55:14 computer dovecot[4872]: imap(email1(a)example.com)<4878><PfIL8HuCnLMAAAAAAAAAAAAAAAAAAAAB>: Error: mkdir(/var/vmail/email1(a)example.com/Maildir) failed: Permission denied (euid=5000(vmail) egid=5000(vmail) missing +w perm: /var, dir owned by 0:0 mode=0755) Feb 22 08:55:14 computer dovecot[4872]: imap(email1(a)example.com)<4878><PfIL8HuCnLMAAAAAAAAAAAAAAAAAAAAB>: Error: mkdir(/var/vmail/email1(a)example.com/Maildir) failed: Permission denied (euid=5000(vmail) egid=5000(vmail) missing +w perm: /var, dir owned by 0:0 mode=0755) Feb 22 08:55:14 computer dovecot[4872]: imap(email1(a)example.com)<4878><PfIL8HuCnLMAAAAAAAAAAAAAAAAAAAAB>: Error: Mailbox INBOX: Failed to autocreate mailbox: Internal error occurred. Refer to server log for more information. [2019-02-22 08:55:14] Feb 22 09:25:14 computer dovecot[4872]: imap(email1(a)example.com)<4878><PfIL8HuCnLMAAAAAAAAAAAAAAAAAAAAB>: Disconnected for inactivity in=16 out=546 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0 Output of dovecot -n : # 2.3.3 (dcead646b): /etc/dovecot/dovecot.conf # OS: Linux 4.20.10-200.fc29.x86_64 x86_64 Fedora release 29 (Twenty Nine) # Hostname: computer auth_mechanisms = plain login mail_location = maildir:~/Maildir mail_privileged_group = mail mbox_write_locks = fcntl namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { driver = pam } passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } postmaster_address = postmaster at example.com protocols = imap pop3 service auth-worker { user = vmail } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0666 user = postfix } unix_listener auth-userdb { mode = 0600 user = vmail } user = dovecot } service imap-login { inet_listener imap { port = 143 } inet_listener imaps { port = 993 ssl = yes } } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } service pop3-login { inet_listener pop3 { port = 0 } inet_listener pop3s { port = 995 ssl = yes } } ssl = required ssl_cert = </etc/pki/dovecot/certs/dovecot.pem ssl_cipher_list = PROFILE=SYSTEM ssl_key = # hidden, use -P to show it userdb { driver = passwd } userdb { args = uid=vmail gid=vmail home=/var/vmail/%u driver = static }

2 2

dovecot Buch 2014 vs 2016
by Heiko Schlittermann 22 Feb '19

22 Feb '19

Moin, Es geht um das Dovecot-Buch. Ich nehme an, daß hier mindestens einer, der sich auskennt, mitliest: Gibt es - außer der Sprache und dem Preis - einen Unterschied zwischen der ersten (und einzigen?) deutschen Auflage von 2014 und der englischen Auflage von 2016? -- Heiko

3 3

Sieve vnd.dovecot.filter hanging issue
by Scott M. 22 Feb '19

22 Feb '19

I am trying to add a signature to all messages and it should be possible via vnd.dovecot.filter, the problem is that any script I try to filter through just hangs. I am running on FreeBSD 11.2 and I tried with dovecot 2.2.32 & pigeonhole 0.4.19 and with dovecot 2.3.2 && pigeonhole 0.5.2. In both cases, the output from dovecot is the same: Feb 19 18:24:22 mx13 dovecot: lda(user1): Debug: sieve: action filter: running program: append Feb 19 18:24:22 mx13 dovecot: lda(user1): Debug: Mailbox stdin: Opened mail UID=1 because: mail stream Feb 19 18:24:22 mx13 dovecot: lda(user1): Debug: waiting for program `/usr/local/gtech/sieve/append' to finish after 3 msecs Feb 19 18:25:22 mx13 dovecot: lda(user1): Debug: program `/usr/local/gtech/sieve/append'(55055) execution timed out after 60000 milliseconds: sending TERM signal Feb 19 18:25:27 mx13 dovecot: lda(user1): Debug: program `/usr/local/gtech/sieve/append' (55055) did not die after 5000 milliseconds: sending KILL signal at first I tried using my actual script but since it was failing I switched to a simple shell script: #!/bin/sh cat /dev/null echo "hey" exit 0 I got that idea after reading: http://dovecot.2317879.n4.nabble.com/execute-sieve-command-fails-to-notice-… (http://dovecot.2317879.n4.nabble.com/execute-sieve-command-fails-to-notice-…) The result is unfortunately the same. From what I can gather ( ran it inside strace/truss too), dovecot-lda hangs on the output. Is this accurate ? How can I get this to work ?

2 1

Using SHA256/512 for SQL based password
by Robert Moskowitz 21 Feb '19

21 Feb '19

I have trying to find how to set the dovecot-sql.conf for using SHA256/512. I am going to start clean with the stronger format, not migrate from the old MD5. It seems all I need is: driver = mysql connect = host=/var/lib/mysql/mysql.sock dbname=postfix user=postfix password=$Postfix_Database_Password default_pass_scheme = SHAxxx-CRYPT # following should all be on one line. password_query = SELECT username as user, password, concat('/home/vmail/', maildir) as userdb_home, concat('maildir:/home/vmail/', maildir) as userdb_mail, 101 as userdb_uid, 12 as userdb_gid FROM mailbox WHERE username = '%u' AND active = '1' # following should all be on one line user_query = SELECT concat('/home/vmail/', maildir) as home, concat('maildir:/home/vmail/', maildir) as mail, 101 AS uid, 12 AS gid, CONCAT('*:messages=30000:bytes=', quota) as quota_rule FROM mailbox WHERE username = '%u' AND active = '1' where xxx is either 256 or 512. All the rest I have been finding in my searches concern converting the format and are not needed for a clean start? thanks

13 30

Re: Assistance with doveadm backup...
by SH Development 21 Feb '19

21 Feb '19

Here is my command: [root@mail maelstrombackups] #mkdir -p vmailbackup [root@mail vmail]# chown: vmail:vmail /mnt/maelstrombackups/vmailbackup [root@mail vmail]# doveadm backup -u jeff maildir:/mnt/maelstrombackups/vmailbackup Only gives me the usage list, doesn’t work. Jeff > On Feb 21, 2019, at 1:29 AM, Sami Ketola <Sami.Ketola(a)Open-Xchange.com> wrote: > > > >> On 21 Feb 2019, at 7.04, SH Development via dovecot <dovecot(a)dovecot.org> wrote: >> >> Not really. The suggestions in the post seemed to be: >> >> 1. Tar the whole directory, which I have tried in the past, but a 130G directory takes over 18 hours to tar. >> 2. It was also suggested to rsync the directory, but the question was brought up, and not answered, about whether it was advisable to copy live mail, thus the need for doveadm sync/backup. >> >> Based on what I’ve read about doveadm backup, this is what I need, I am just having a hard time formulating the syntax for the command. >> > > root@ketola ~]# mkdir -p /backup/sami > root@ketola ~]# chown vmail:vmail /backup/sami > root@ketola ~]# doveadm backup -u sami Maildir:/backup/sami > <snip> > root@ketola ~]# du -hs /backup/sami > 211M /backup/sami > > does this help? > > Sami

1 0

Re: Assistance with doveadm backup...
by SH Development 21 Feb '19

21 Feb '19

Sorry for being such a newbie when it comes to scripting. Created a directory for the backups on the network mounted volume. Changed the appropriate path and am getting this: dsync(root): Error: user nfsnobody: Initialization failed: Namespace 'INBOX.': mkdir(/mnt/maelstrombackups/vmailbackup/nfsnobody) failed: Permission denied (euid=5000(vmail) egid=5000(vmail) missing +w perm: /mnt/maelstrombackups/vmailbackup, euid is not dir owner) dsync(root): Fatal: User init failed Backup done for user: nfsnobody ... dsync(root): Error: user vmail: Initialization failed: Namespace 'INBOX.': mkdir(/mnt/maelstrombackups/vmailbackup/vmail) failed: Permission denied (euid=5000(vmail) egid=5000(vmail) missing +w perm: /mnt/maelstrombackups/vmailbackup, euid is not dir owner) dsync(root): Fatal: User init failed Backup done for user: vmail … After running the script, I suddenly have two new directories in my vmail folder, “nfsnobody” and “vmail”. What are these users? Jeff > On Feb 20, 2019, at 10:32 PM, Kenren Taisho <toushin.taishi(a)gmail.com> wrote: > > No worries, that simple script should get you to a start though. Just replace the path with a mounted NFS share if you want it to reside in a network volume. > > On Thu, Feb 21, 2019 at 12:10 PM SH Development <listaccount(a)starionline.com> wrote: > My apologies, you are absolutely right. Will post this in the correct forum. > > Spent the last couple of hours poring through the postfix list and just forgot where I was at. > > Jeff > > > >> On Feb 20, 2019, at 8:55 PM, Kenren Taisho <toushin.taishi(a)gmail.com> wrote: >> >> Hi Jeff, >> >> This should be better off to dovecot's mailing list. >> But just to get you started, this is the first thing that came to mind: >> >> example: >> >> for users in `doveadm user "*"`; do >> LOCALPART=${users%%@*} >> dsync -v -f -u $users backup maildir:/tmp/backup/$LOCALPART >> echo "Backup done for user: $users ..." >> done >> >> HTH >> >> >> On Thu, Feb 21, 2019 at 9:55 AM SH Development <listaccount(a)starionline.com> wrote: >> I am having trouble locating examples of how to use doveadm backup. All the examples I see are for sync. I simply want to create a backup to a network volume of the email server's vmail folders. The goal here is to have a reasonably current backup should the main drive on the email server go south. >> >> We currently authenticate our users from a mysql database. User’s mailboxes are stored as domainname/username/Maildir >> >> I assume what I will wind up on the network volume is a duplicate directory structure as the vmail folder on the email server? >> >> Can someone help get me started here? >> >> Jeff >

1 0

sieve filter not working
by subin ks 20 Feb '19

20 Feb '19

I've Dovecot and dovecot-sieve v 2.2.27 installed on a Debian 9.6. I'm trying to set a Sieve filter which will redirect all emails from `info` (i.e. .info) TLD to another email. This is the filter: require ["regex"]; # rule:[test] if header :regex "from" "info$" { redirect "subbs(a)domain.com"; } It's not being honored; all emails from .info TLD ends up in the inbox and none are redirected. Let me know what I'm doing wrong. Thanks.

4 6

Error sending email from client
by Latin Bishop 20 Feb '19

20 Feb '19

Latest So if I telnet into port 25 I am able to send an email to my gmail account True it comes into my spam folder But when I try sending via client where my server is I get error 4 6 5 configuration error Also email I send to server are lost ??????? Pleas3 help

3 3

Need to authenticate Outlook and NTLM
by Mark Foley 20 Feb '19

20 Feb '19

I've posted questions on this before, but now I really, really need a solution. Using Dovecot 2.2.33.2 We've been using Dovecot as IMAP server for several years on a Linux host which is also the Active Directory / Domain Controller. We have both Thunderbird and Outlook clients. The Thunderbird clients authenticate w/o problem with AD credentials using Kerberos/GSSAPI. I've never been able to get the Outlook clients to authenticate using domain credentials, so I've also hard-coded user and password into /etc/passwd and let the Dovecot authenticate via PLAIN LOGIN. Now, however, I am mandated to switch all users to Outlook, so I need an AD credential solution. I found https://wiki2.dovecot.org/HowTo/ActiveDirectoryNtlm and followed those instructions. The first problem I ran into was in Step 3 where it said to put the following line in the config: auth_ntlm_use_winbind = yes This gave me an error when I restarted Dovecot: Restarting Dovecotdoveconf: Fatal: Error in configuration file /usr/local/etc/dovecot/conf.d/10-auth.conf line 84: Unknown setting: auth_ntlm_use_winbind googling this error indicated that this was a version 1.x directive and 2.x used only auth_use_winbind. I removed the auth_ntlm_use_winbind and Dovecot restart. If this is true, the wiki should be updated since it purports to be a version 2.x wiki. I followed the rest of the instructions on that wiki and my modified config is: $ doveconf -n # 2.2.33.2 (d6601f4ec): /usr/local/etc/dovecot/dovecot.conf # OS: Linux 4.4.157 x86_64 Slackware 14.2 auth_debug = yes auth_debug_passwords = yes auth_gssapi_hostname = $ALL auth_krb5_keytab = /etc/dovecot/dovecot.keytab auth_mechanisms = plain login gssapi ntlm auth_use_winbind = yes auth_username_format = %n auth_verbose = yes auth_verbose_passwords = plain disable_plaintext_auth = no info_log_path = /var/log/dovecot_info mail_location = maildir:~/Maildir passdb { driver = shadow } protocols = imap ssl_cert = </etc/ssl/certs/OHPRS/GoDaddy/Apache/2016-08-10/54e789087d419b6e.crt ssl_key = # hidden, use -P to show it userdb { driver = passwd } verbose_ssl = yes New additions to my pre-ntlm conf is only the 'ntlm' added the the auth_mechanism and: auth_winbind_helper_path = /usr/bin/ntlm_auth which interestingly doesn't show into the 'doveconf -n' output, above. Is it a default? I then attempted to connect from Outlook and got the error: auth: Info: ntlm(?,192.168.0.58,<qd9nulmB4sLAqAA6>): ntlm_auth reports broken helper: NT_STATUS_UNSUCCESSFUL After more searching I came across this post, https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=774263 which, in summary, said that ntlm_auth had to run as root. So, I added the following to my dovecot config per that post's suggestion: service auth { user = root } After restarting and trying again to connect from Outlook I got the message: auth: Info: ntlm(?,192.168.0.58,<SCINjFqBKcXAqAA6>): user not authenticated: NT_STATUS_NO_MEMORY At this point I've been unable to find a solution to this error. I've listed the entire dovecot log output for this last attempt to connect from Outlook below. Has anyone in the Universe successfully connected from Outlook using active domain credentials? If so, what's the secret? What am I not doing correctly? Thanks for any and all help! --Mark dovecot log: Feb 07 23:39:40 auth: Debug: Loading modules from directory: /usr/local/lib/dovecot/auth Feb 07 23:39:40 auth: Debug: Module loaded: /usr/local/lib/dovecot/auth/lib20_auth_var_expand_crypt.so Feb 07 23:39:40 auth: Debug: Read auth token secret from /usr/local/var/run/dovecot/auth-token-secret.dat Feb 07 23:39:40 auth: Debug: auth client connected (pid=16357) Feb 07 23:39:40 auth: Debug: client in: AUTH 1 NTLM service=imap session=SCINjFqBKcXAqAA6 lip=192.168.0.2 rip=192.168.0.58 lport=143 rport=50473 Feb 07 23:39:40 auth: Debug: client passdb out: CONT 1 Feb 07 23:39:40 auth: Debug: client in: CONT 1 TlRMTVNTUAABAAAAB4IIogAAAAAAAAAAAAAAAAAAAAAGAbEdAAAADw== (previous base64 data may contain sensitive data) Feb 07 23:39:40 auth: Debug: client passdb out: CONT 1 TlRMTVNTUAACAAAACAAIADgAAAAFgomifTyOI3AwfogAAAAAAAAAAGIAYgBAAAAABgEAAAAAAA9IAFAAUgBTAAIACABIAFAAUgBTAAEACABNAEEASQBMAAQAFABoAHAAcgBzAC4AbABvAGMAYQBsAAMAHgBtAGEAaQBsAC4AaABwAHIAcwAuAGwAbwBjAGEAbAAHAAgAVIrLTWi/1AEAAAAA Feb 07 23:39:40 auth: Debug: client in: CONT 1 TlRMTVNTUAADAAAAGAAYAGwAAAD8APwAhAAAAAAAAABYAAAACAAIAFgAAAAMAAwAYAAAAAAAAACAAQAABYKIogYBsR0AAAAPEulY2h+wL/nnNAXbmMSVx20AYQByAGsAQwBPAE0ATQBPAE4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA5+rNhVU1odt5650z/pNVpQEBAAAAAAAAVIrLTWi/1AFg5+W08PtmxQAAAAACAAgASABQAFIAUwABAAgATQBBAEkATAAEABQAaABwAHIAcwAuAGwAbwBjAGEAbAADAB4AbQBhAGkAbAAuAGgAcAByAHMALgBsAG8AYwBhAGwABwAIAFSKy01ov9QBBgAEAAIAAAAIADAAMAAAAAAAAAABAAAAACAAAOity40ZG1J9BpqGn4TwBjP02UByQ6D/OUD6DrRDhg+3CgAQAAAAAAAAAAAAAAAAAAAAAAAJABIAaQBtAGEAcAAvAG0AYQBpAGwAAAAAAAAAAAAAAAAA (previous base64 data may contain sensitive data) Feb 07 23:39:40 auth: Info: ntlm(?,192.168.0.58,<SCINjFqBKcXAqAA6>): user not authenticated: NT_STATUS_NO_MEMORY Feb 07 23:39:42 auth: Debug: client passdb out: FAIL 1

3 7

Virtual mailbox shows mails that are too old
by Stefan Hagen 19 Feb '19

19 Feb '19

Hello, I'm using dovecot on my personal / private email server. I have set up virtual mailboxes in my inbox namespace like this: namespace inbox { inbox = yes prefix = "Virtual/" separator = / location = "virtual:~/.emails_virtual:LAYOUT=fs:INDEX=dovecot.virtual.index:LISTINDEX=dovecot.virtual.list.index" list = yes subscriptions = yes mailbox { auto = subscribe } } I had quite some trouble with it at first with UIDs changing all the time, but after adding INDEX and LISTINDEX it started to work just fine. I've created dovecot_virtual files like this one: $ cat ~/.emails_virtual/2-LastDay/dovecot-virtual * -Trash -Sent -Drafts -Spam -Virtual -Virtual/* all younger 86400 After stopping dovecot and deleting the index files and restarting dovecot, the virtual mailbox shows all mail from the last day - as expected. But after one day, it shows mail from two days. After three, it shows mails from three days. It looks like dovecot selects emails from the last day, but never cleans out emails that are older, once they have been selected. My full dovecot -n can be found here: https://codevoid.de/?q=/0/p/dovecot-n.txt Any ideas about what could be wrong? Best Regards, Stefan -- Stefan Hagen | (gopher|https)://codevoid.de(/gpg) CBD3 C468 64B4 6517 E8FB B90F B6BC 2EC5 52BE 43BA

3 2

freebsd log process problem
by Bane Ivosev 19 Feb '19

19 Feb '19

After version 2.2.32 we have an issue that occures randomly a couple times per day, log process gets stuck at 100% CPU usage with message dovecot: log(56027): Warning: Log connection fd 20 listen_fd 20 prefix 'imap: ' is sending input faster than we can write It happens with several Dovecot version after 2.2.32 on FreeBSD 10.4 and 11.2-RELEASE. We tried 2.2.34, 2.3.2, 2.3.4 On the same system version 2.2.32 and earlier works perfectly. Did anyone experience similar problem?

1 0

dovecot/lmtp dumps core when proxying to multiple recipients via protocol=smtp
by Piper Andreas 19 Feb '19

19 Feb '19

Hello, when trying to set up a migration scenario from my old mailbox-servers to my new dovecot-cluster, I get a coredump from dovecot/lmtp when proxying mail-delivery to more than one recipient on the old mailbox-server. My setup: 3 director-hosts (Debian stretch) are proxying to a pair of replicator-hosts and during migration also to the old mailbox-server. For migration the not-migrated user-addresses are included via a passwd-file with entries like: grtest1@hrz.uni-marburg.de:::::::director_tag=hrz protocol=smtp user=grtest1 grtest2@hrz.uni-marburg.de:::::::director_tag=hrz protocol=smtp user=grtest2 ... The director_tag points to the old mailbox-server, with 'protocol=smtp' SMTP is used for delivery, as the old machine is not capable of LMTP. The setup works fine for imap-proxying and for mail-delivery to single recipients. But if a mail is addressed to more than one recipient, lmtp produces a coredump after delivering to all recipients. The error-message in the log is: Feb 14 12:15:05 vhrzxxx dovecot[63861]: lmtp(64663): Connect from 127.0.0.1 Feb 14 12:15:05 vhrzxxx dovecot[63861]: lmtp(64663): 206UIrlNZVyX/AAAGwthQA: Sent message to <grtest2> at 137.248.xxx.yyy:25: 250 2.0.0 x1EBF5Ro016092 Message accepted for delivery (1/2 at 79 ms) Feb 14 12:15:05 vhrzxxx dovecot[63861]: lmtp(64663): 206UIrlNZVyX/AAAGwthQA: Sent message to <grtest2> at 137.248.xxx.yyy:25: 250 2.0.0 x1EBF5Ro016092 Message accepted for delivery (2/2 at 79 ms) Feb 14 12:15:05 vhrzxxx dovecot[63861]: lmtp(64663): Fatal: master: service(lmtp): child 64663 killed with signal 11 (core dumped) The backtrace from the coredump is: Reading symbols from /usr/lib/dovecot/lmtp...(no debugging symbols found)...done. [New LWP 64663] [Thread debugging using libthread_db enabled] Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1". Core was generated by `dovecot/lmtp'. Program terminated with signal SIGSEGV, Segmentation fault. #0 0x00007f347fc7a2c0 in ?? () from /usr/lib/dovecot/libdovecot.so.0 (gdb) bt full #0 0x00007f347fc7a2c0 in ?? () from /usr/lib/dovecot/libdovecot.so.0 No symbol table info available. #1 0x00007f347fc77d73 in smtp_client_command_fail_reply () from /usr/lib/dovecot/libdovecot.so.0 No symbol table info available. #2 0x00007f347fc77fbe in smtp_client_commands_list_fail_reply () from /usr/lib/dovecot/libdovecot.so.0 No symbol table info available. #3 0x00007f347fc7c8dc in smtp_client_connection_disconnect () from /usr/lib/dovecot/libdovecot.so.0 No symbol table info available. #4 0x00007f347fc7cf19 in smtp_client_connection_unref () from /usr/lib/dovecot/libdovecot.so.0 No symbol table info available. #5 0x00007f347fc7e35d in ?? () from /usr/lib/dovecot/libdovecot.so.0 No symbol table info available. #6 0x00007f347fd1f5d5 in io_loop_call_io () from /usr/lib/dovecot/libdovecot.so.0 No symbol table info available. #7 0x00007f347fd20fd9 in io_loop_handler_run_internal () from /usr/lib/dovecot/libdovecot.so.0 No symbol table info available. #8 0x00007f347fd1f6e6 in io_loop_handler_run () from /usr/lib/dovecot/libdovecot.so.0 No symbol table info available. #9 0x00007f347fd1f8f8 in io_loop_run () from /usr/lib/dovecot/libdovecot.so.0 No symbol table info available. #10 0x00007f347fc93d43 in master_service_run () from /usr/lib/dovecot/libdovecot.so.0 No symbol table info available. #11 0x00005613fcbc1f70 in main () No symbol table info available. (gdb) doveconf -n gives: # 2.3.4.1 (3c0b8769e): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.4 (60b0f48d) # OS: Linux 4.9.0-8-amd64 x86_64 Debian 9.7 # Hostname: vhrzxxx.HRZ.Uni-Marburg.DE auth_cache_negative_ttl = 0 auth_cache_size = 10 M auth_master_user_separator = * auth_worker_max_count = 1024 base_dir = /var/run/dovecot/ default_vsz_limit = 1 G director_mail_servers = 172.25.1.93 172.25.1.95 137.248.xxx.yyy@hrz 137.248.xxx.zzz@staff 137.248.aaa.bbb@students director_servers = 172.25.1.42:9090 172.25.1.41:9090 172.25.1.92:9090 director_username_hash = %Ln@%Ld doveadm_password = # hidden, use -P to show it doveadm_port = 12345 imap_max_line_length = 640 k lmtp_proxy = yes managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext passdb { args = /etc/dovecot.deny deny = yes driver = passwd-file } passdb { args = /etc/dovecot/private/passwd.masterusers driver = passwd-file master = yes } passdb { args = /etc/dovecot/dovecot-ldap.staff.conf.ext driver = ldap result_success = continue-ok } passdb { args = /etc/dovecot/migration/migrate-staff driver = passwd-file name = passdb_staff_query } passdb { args = /etc/dovecot/dovecot-ldap.students.conf.ext driver = ldap result_success = continue-ok } passdb { args = /etc/dovecot/migration/migrate-students driver = passwd-file name = passdb_students_query } passdb { args = /etc/dovecot/dovecot-ldap.hrz.conf.ext driver = ldap result_success = continue-ok } passdb { args = /etc/dovecot/migration/migrate-hrz driver = passwd-file name = passdb_hrz_query } plugin { sieve = file:~/sieve;active=~/.dovecot.sieve } pop3_uidl_format = %08Xv%08Xu postmaster_address = postmaster(a)hrz.uni-marburg.de protocols = imap pop3 lmtp sieve service auth-worker { user = $default_internal_user } service auth { client_limit = 6000 } service director { inet_listener { port = 9090 } unix_listener director-userdb { mode = 0600 } unix_listener login/director { mode = 0666 } } service doveadm { inet_listener { port = 12345 } vsz_limit = 768 M } service imap-login { executable = imap-login director process_min_avail = 64 service_count = 0 } service imap { process_limit = 4096 } service lmtp { inet_listener lmtp { port = 24 } } service managesieve-login { executable = managesieve-login director inet_listener sieve { port = 4190 } } service pop3-login { executable = pop3-login director } ssl = required ssl_ca = </etc/ssl/certs/umr-chain.pem ssl_cert = </etc/ssl/certs/vhrzxxx.hrz.uni-marburg.de.pem ssl_client_ca_dir = /etc/ssl/certs ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it ssl_require_crl = no userdb { args = /etc/dovecot/dovecot-ldap-userdb.conf.ext driver = ldap } protocol lmtp { auth_socket_path = director-userdb } protocol doveadm { auth_socket_path = director-userdb } protocol imap { mail_max_userip_connections = 25 mail_plugins = " zlib imap_zlib" } I would appreciate any help on this. If any more information is needed, please ask. With many thanks and best regards, Andreas -- ________________________________________________________________________ Dr. Andreas Piper, Hochschulrechenzentrum der Philipps-Univ. Marburg Hans-Meerwein-Straße 6, 35032 Marburg, Germany Phone: +49 6421 28-23521 Fax: -26994 E-Mail: piper(a)HRZ.Uni-Marburg.DE

1 1

Migrate mail data from Dovecot to Dovecot
by Odhiambo Washington 19 Feb '19

19 Feb '19

I have built a new server (FreeBSD-12) running dovecot-2.3.4. My old server (FreeBSD-9.3) is running dovecot-2.3.4 as well. The configurations are 1:1 identical. The are about 250 users on this server, all virtual. They are mostly POP3 users, but they do "leave a copy of message on the server" for set various number of days. Now, to migrate the mail data, can I simply rsync the mail directories between the old and the new server? Would that create a pitfall?? What is the recommended method? -- Best regards, Odhiambo WASHINGTON, Nairobi,KE +254 7 3200 0004/+254 7 2274 3223 "Oh, the cruft.", grep ^[^#] :-)

2 2

Error configuring unix_listener stats-writer
by Peter Nabbefeld 18 Feb '19

18 Feb '19

Hello, I've got a very strange problem: When I try to configure the stats-writer socket, I'm told the configuration is a duplicate, though none exists in the configuration files. So I'd guess the configuration is set either built-in or implicitly. I've put the following into conf.d/10-master.conf: service auth { unix_listener auth-userdb { } unix_listener stats-writer { user = vmail group = vmail mode = 0666 } } BTW, using imap for mail traffic. Is there any tool displaying an "effective" config tree (i.e., a tool displaying the resulting configuration from every file, displaying the original file and line number)? "dovecot -a" only displays all configurations, but without source reference, so it's impossible to find out about the details. :-( Kind regards Peter

4 9

Dsync and network issues
by Danilo G. Baio 18 Feb '19

18 Feb '19

Hi. Our scenario: dovecot-2.3.4.1 Two FreeBSD servers, A (master) and B (slave). replication_max_conns = 10 doveadm_port = 60025 All mails are received on server A and replicated to server B. Sometimes we get these messages on server B: Feb 18 08:27:35 dsync-server(XX@XX): Error: client_connection_tcp_free: close((&conn->fd)) @ client-connection-tcp.c:632 failed (fd=15): Connection reset by peer Feb 18 08:28:00 dsync-server(XZ@XZ): Error: client_connection_tcp_free: close((&conn->fd)) @ client-connection-tcp.c:632 failed (fd=15): Connection reset by peer Feb 18 08:33:14 dsync-server(XY@XY): Error: client_connection_tcp_free: close((&conn->fd)) @ client-connection-tcp.c:632 failed (fd=15): Connection reset by peer Feb 18 08:44:07 dsync-server(XW@XW): Error: client_connection_tcp_free: close((&conn->fd)) @ client-connection-tcp.c:632 failed (fd=15): Connection reset by peer It happens sometimes (usually early morning) when users are syncing their mailboxes. Is there a way to debug this and find what is happening? Thanks for your time. -- Danilo G. Baio

1 0

imap-hibernate returned failure: Failed to parse client input: Invalid peer_dev_minor value
by Alex 18 Feb '19

18 Feb '19

Hello! I tried to use imap-hibernate. But errors in maillog: Oct 19 05:14:24 server dovecot: imap(email(a)example.com)<67125><Lu7ndYt4n8aASO/q>: Error: kevent(-1) for notify remove failed: Bad file descriptor Oct 19 05:14:24 server dovecot: imap(email(a)example.com)<67125><Lu7ndYt4n8aASO/q>: Error: close(-1) for notify remove failed: Bad file descriptor Oct 19 05:14:24 server dovecot: imap-hibernate: Error: Failed to parse client input: Invalid peer_dev_minor value: 18446744073709486335 Oct 19 05:14:24 server dovecot: imap(email(a)example.com)<67125><Lu7ndYt4n8aASO/q>: Error: /var/run/dovecot/imap-hibernate returned failure: Failed to parse client input: Invalid peer_dev_minor value: 18446744073709486335 Oct 19 05:14:24 server dovecot: imap: Error: dovecot-2.3.3, FreeBSD 10.4 dovenull 38990 0,0 0,0 43748 16308 - S 3:54 0:00,08 imap-login: (imap-login) dovenull 38998 0,0 0,1 47844 19536 - S 3:54 0:00,18 imap-login: [34.193.82.152 TLS proxy] (imap-login) dovenull 38999 0,0 0,1 47844 17180 - S 3:54 0:00,19 imap-login: (imap-login) dovenull 39000 0,0 0,0 35556 9584 - S 3:54 0:00,03 dovecot/imap-login dovenull 39001 0,0 0,0 43748 16320 - S 3:54 0:00,12 imap-login: (imap-login) dovenull 39002 0,0 0,0 43748 16320 - S 3:54 0:00,13 imap-login: (imap-login) dovenull 39003 0,0 0,0 43748 16328 - S 3:54 0:00,16 imap-login: (imap-login) dovenull 39004 0,0 0,1 47844 17948 - S 3:54 0:00,17 imap-login: [12.34.56.78 TLS proxy] (imap-login) vmail 39042 0,0 0,0 15936 3040 - I 3:54 0:00,01 imap-hibernate: [0 connections] (imap-hibernate) vmail 39076 0,0 0,0 78900 8984 - S 3:54 0:00,05 imap: [email(a)example.com 12.34.56.78 IDLE] (imap) vmail 44114 0,0 0,0 78900 8936 - I 4:06 0:00,05 imap: [email(a)example.com 34.193.82.152 IDLE] (imap) srw-rw---- 1 root dovecot 0 19 окт 03:54 imap-hibernate srw------- 1 root dovecot 0 19 окт 03:54 imap-master srw------- 1 root wheel 0 19 окт 03:54 imap-postlogin srw-rw-rw- 1 root wheel 0 19 окт 03:54 imap-urlauth srw------- 1 dovecot wheel 0 19 окт 03:54 imap-urlauth-worker imap_hibernate_timeout = 5 secs service imap-hibernate { extra_groups = $default_internal_group unix_listener imap-hibernate { group = dovecot } user = vmail } service imap { extra_groups = $default_internal_group unix_listener imap-master { group = $default_internal_group } } I tried to set user/group vmail, set mode = 0666, but the same errors. Can you help me with hibernate confiration ? Best regards, Alex

3 8

unsubscibe
by Henry Otten 18 Feb '19

18 Feb '19

unsubscribe

1 0

Re: Dove to error
by Aki Tuomi 18 Feb '19

18 Feb '19

mail_privileged_group=mail Aki > On 17 February 2019 at 19:03 Latin Bishop <soydepr(a)gmail.com> wrote: > > > When testing with thunder mail getting this error > > Feb 17 11:59:40 pepino dovecot: imap(pi): Error: open(/var/mail/pi) failed: Permission denied (euid=1000(pi) egid=1000(pi) missing +w perm: /var/mail, we're not in group 8(mail), dir owned by 0:8 mode=0775) > Feb 17 11:59:40 pepino dovecot: imap(pi): Error: Failed to autocreate mailbox INBOX: Internal error occurred. Refer to server log for more information. [2019-02-17 11:59:40] > Feb 17 11:59:50 pepino dovecot: imap(pi): Logged out in=155 out=874 > > > > On Feb 17, 2019, at 8:46 AM, Aki Tuomi <aki.tuomi(a)open-xchange.com> wrote: > > > > You probably mean -quiet flag which works > > > > Aki > > > >> On 17 February 2019 at 12:10 Latin Bishop <soydepr(a)gmail.com> wrote: > >> > >> > >> Thanks > >> > >> Was 143. I notice the -quite flag no longer works in openssl when testing connection > >> > >>> On Feb 17, 2019, at 3:33 AM, Aki Tuomi <aki.tuomi(a)open-xchange.com> wrote: > >>> > >>> > >>>> On 17 February 2019 at 05:50 Latin Bishop via dovecot < dovecot(a)dovecot.org> wrote: > >>>> > >>>> > >>>> > >>>> Getting this error after following > >>>> this tutorial > >>>> > >>>> Error in configuration file /etc/dovecot/dovecot.conf duplicate listener > >>>> > >>>> > >>>> https://samhobbs.co.uk/2013/12/raspberry-pi-email-server-part-2-dovecot > >>>> > >>> > >>> Usually doveconf -n tells you where the duplicate listener is so you can remove it. > >>> --- > >>> Aki Tuomi

3 7

Re: Dove to error
by Aki Tuomi 17 Feb '19

17 Feb '19

Wow, that is lot of useless config, see below for a fixed version to put into dovecot.conf =) Aki auth_mechanisms = plain login ## doing this lets people log in without SSL #disable_plaintext_auth = no listen = * mail_location = mbox:~/mail:INBOX=/var/mail/%u namespace { inbox = yes mailbox { special_use = \Drafts name = Drafts } mailbox { special_use = \Junk name = Junk } mailbox { special_use = \Sent name = Sent } mailbox { special_use = \Sent name = Sent Messages } mailbox { special_use = \Trash name = Trash } name = inbox } passdb { driver = pam } protocols = imap service auth { unix_listener { group = postfix mode = 0660 user = postfix path = /var/spool/postfix/private/auth } } ## this is useless config, as it's default #service imap-login { # inet_listener { # port = 143 # name = imap # } # inet_listener { # port = 993 # ssl = yes # name = imaps # } #} ssl_cert = </etc/dovecot/dovecot.pem ssl_key = # hidden, use -P to show it userdb { driver = passwd } ## end of config > On 17 February 2019 at 12:45 soydepr <soydepr(a)gmail.com> wrote: > > > # 2.2.27 (c0f36b0): /etc/dovecot/dovecot.conf > # Pigeonhole version 0.4.16 (fed8554) > # OS: Linux 4.14.79-v7+ armv7l Debian 9.6 > auth_mechanisms = plain login > disable_plaintext_auth = no > listen = * > mail_location = mbox:~/mail:INBOX=/var/mail/%u > namespace { > inbox = yes

2 1

Re: Dove to error
by Aki Tuomi 17 Feb '19

17 Feb '19

That really depends on your dovecot config, but try doveadm log find also you can list recent errors with doveadm log errors Aki > On 17 February 2019 at 20:03 Latin Bishop <soydepr(a)gmail.com> wrote: > > > Where I find dovecot log > > > > > On Feb 17, 2019, at 12:56 PM, Aki Tuomi <aki.tuomi(a)open-xchange.com> wrote: > > > > Yes, well, this is postfix log, which is not very useful when debugging dovecot problems... > > > > Aki > > > >> On 17 February 2019 at 19:50 Latin Bishop <soydepr(a)gmail.com> wrote: > >> > >> > >> Feb 17 12:48:00 pepino postfix/smtps/smtpd[3988]: connect from localhost[127.0.0.1] > >> Feb 17 12:48:01 pepino postfix/smtps/smtpd[3988]: warning: unknown smtpd restriction: "permit_ssl_authenticated" > >> Feb 17 12:48:01 pepino postfix/smtps/smtpd[3988]: NOQUEUE: reject: RCPT from localhost[127.0.0.1]: 451 4.3.5 Server configuration error; from=<pi(a)torombolo.ml> to=<pi(a)torombolo.ml> proto=ESMTP helo=<[127.0.0.1]> > >> Feb 17 12:48:07 pepino postfix/cleanup[3998]: 25EC480E6B: message-id=<20190217174807.25EC480E6B@pepino> > >> Feb 17 12:48:07 pepino postfix/smtps/smtpd[3988]: disconnect from localhost[127.0.0.1] ehlo=1 auth=1 mail=1 rcpt=0/1 quit=1 commands=4/5 > >> Feb 17 12:48:07 pepino postfix/qmgr[2604]: 25EC480E6B: from=<double-bounce@pepino>, size=970, nrcpt=1 (queue active) > >> Feb 17 12:48:07 pepino postfix/local[3999]: 25EC480E6B: to=<root(a)despiertapr.com>, orig_to=<postmaster>, relay=local, delay=0.06, delays=0.03/0/0/0.03, dsn=2.0.0, status=sent (delivered to maildir) > >> Feb 17 12:48:07 pepino postfix/qmgr[2604]: 25EC480E6B: removed > >> > >>> On Feb 17, 2019, at 12:40 PM, Aki Tuomi <aki.tuomi(a)open-xchange.com> wrote: > >>> > >>> Can you try adding 'pi' to group 'mail' too? Also, can you provide the actual errors from log? > >>> > >>> Aki > >>> > >>>> On 17 February 2019 at 19:37 Latin Bishop <soydepr(a)gmail.com> wrote: > >>>> > >>>> > >>>> Yes it is. Basically can’t send nor receive confit looks good > >>>> > >>>> > >>>> > >>>>> On Feb 17, 2019, at 12:34 PM, Aki Tuomi <aki.tuomi(a)open-xchange.com> wrote: > >>>>> > >>>>> Is user 'dovecot' member of group 'mail'? > >>>>> > >>>>> Aki > >>>>> > >>>>>> On 17 February 2019 at 19:28 Latin Bishop <soydepr(a)gmail.com> wrote: > >>>>>> > >>>>>> > >>>>>> Changed permissions but still have issues > >>>>>> > >>>>>> A error occurred while sending email the mail server responded 4.3.5 server configuration error > >>>>>> Please check the message recipient > >>>>>> > >>>>>> Sent from my iPad > >>>>>> > >>>>>>> On Feb 17, 2019, at 12:06 PM, Aki Tuomi <aki.tuomi(a)open-xchange.com> wrote: > >>>>>>> > >>>>>>> mail_privileged_group=mail > >>>>>>> > >>>>>>> Aki > >>>>>>> > >>>>>>>> On 17 February 2019 at 19:03 Latin Bishop <soydepr(a)gmail.com> wrote: > >>>>>>>> > >>>>>>>> > >>>>>>>> When testing with thunder mail getting this error > >>>>>>>> > >>>>>>>> Feb 17 11:59:40 pepino dovecot: imap(pi): Error: open(/var/mail/pi) failed: Permission denied (euid=1000(pi) egid=1000(pi) missing +w perm: /var/mail, we're not in group 8(mail), dir owned by 0:8 mode=0775) > >>>>>>>> Feb 17 11:59:40 pepino dovecot: imap(pi): Error: Failed to autocreate mailbox INBOX: Internal error occurred. Refer to server log for more information. [2019-02-17 11:59:40] > >>>>>>>> Feb 17 11:59:50 pepino dovecot: imap(pi): Logged out in=155 out=874 > >>>>>>>> > >>>>>>>> > >>>>>>>>> On Feb 17, 2019, at 8:46 AM, Aki Tuomi <aki.tuomi(a)open-xchange.com> wrote: > >>>>>>>>> > >>>>>>>>> You probably mean -quiet flag which works > >>>>>>>>> > >>>>>>>>> Aki > >>>>>>>>> > >>>>>>>>>> On 17 February 2019 at 12:10 Latin Bishop <soydepr(a)gmail.com> wrote: > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>> Thanks > >>>>>>>>>> > >>>>>>>>>> Was 143. I notice the -quite flag no longer works in openssl when testing connection > >>>>>>>>>> > >>>>>>>>>>> On Feb 17, 2019, at 3:33 AM, Aki Tuomi <aki.tuomi(a)open-xchange.com> wrote: > >>>>>>>>>>> > >>>>>>>>>>> > >>>>>>>>>>>> On 17 February 2019 at 05:50 Latin Bishop via dovecot < dovecot(a)dovecot.org> wrote: > >>>>>>>>>>>> > >>>>>>>>>>>> > >>>>>>>>>>>> > >>>>>>>>>>>> Getting this error after following > >>>>>>>>>>>> this tutorial > >>>>>>>>>>>> > >>>>>>>>>>>> Error in configuration file /etc/dovecot/dovecot.conf duplicate listener > >>>>>>>>>>>> > >>>>>>>>>>>> > >>>>>>>>>>>> https://samhobbs.co.uk/2013/12/raspberry-pi-email-server-part-2-dovecot > >>>>>>>>>>>> > >>>>>>>>>>> > >>>>>>>>>>> Usually doveconf -n tells you where the duplicate listener is so you can remove it. > >>>>>>>>>>> --- > >>>>>>>>>>> Aki Tuomi

2 2

Re: [grosjo/fts-xapian] `doveadm fts rescan` removes all indices (#15)
by Joan Moreau 17 Feb '19

17 Feb '19

In such case, as long as the API is not upgraded, should doveadm index -A -q \* be considered a replacement of doveadm fts rescan On 2019-02-14 16:24, Timo Sirainen via dovecot wrote: > Hi, > > The rescan() function is a bit badly designed. Currently what you could do what fts-lucene does and: > - Get list of UIDs for all mails in each folder > - If Xapian has UID that doesn't exist -> delete it from Xapian > - If UID is missing from Xapian -> expunge the rest of the UIDs in that folder, so the next indexing will cause them to be indexed > > The expunging of rest of the mails is rather ugly, yes.. A better API would be if backend simply had a way to iterate all mails in the index, preferrably sorted by folder. Then a more generic code could go through them and expunge the necessary mails and index the missing mails. Although not all FTS backends support indexing in the middle. Anyway, we don't really have time to implement this new API soon. > > I'm not sure if this is a big problem though. I don't think most people running FTS have ever run rescan. > > On 8 Feb 2019, at 9.54, Joan Moreau via dovecot <dovecot(a)dovecot.org> wrote: > > Hi, > > THis is a core problem in Dovecot in my understanding. > > In my opinion, the rescan in dovecot should send to the FTS plugin the list of "supposedly" indexed emails (UID), and the plugin shall purge the redundant UID (i..e UID present in the index but not in the list sent by dovecot) and send back the list of UID not in its indexes to dovecot, so Dovect can send one by one the missing emails > > WHat do you think ? > > -------- Original Message -------- > > SUBJECT: > [grosjo/fts-xapian] `doveadm fts rescan` removes all indices (#15) > > DATE: > 2019-02-08 08:28 > > FROM: > Leonard Lausen <notifications(a)github.com> > > TO: > grosjo/fts-xapian <fts-xapian(a)noreply.github.com> > > CC: > Subscribed <subscribed(a)noreply.github.com> > > REPLY-TO: > grosjo/fts-xapian <reply+0022e607fd2eb3ff93959543198455bc7db5bdd58aa0286b92cf000000011874f1ae92a169ce185221c2(a)reply.github.com> > > doveadm fts rescan -A deletes all indices, ie. all folders and files in the xapian-indexes are deleted. However, according to man doveadm fts, the rescan command should only > > Scan what mails exist in the full text search index and compare those to what > actually exist in mailboxes. This removes mails from the index that have already > been expunged and makes sure that the next doveadm index will index all the > missing mails (if any). > > Deleting all indices does not seem to be the intended action, especially as constructing the index anew may take very long on large mailboxes. > > -- > You are receiving this because you are subscribed to this thread. > Reply to this email directly, view it on GitHub [1], or mute the thread [2]. Links: ------ [1] https://github.com/grosjo/fts-xapian/issues/15 [2] https://github.com/notifications/unsubscribe-auth/ACLmB9OB-7GaKIvhNc8sCgi7K…

2 2

Re: Dove to error
by Aki Tuomi 17 Feb '19

17 Feb '19

You probably mean -quiet flag which works Aki > On 17 February 2019 at 12:10 Latin Bishop <soydepr(a)gmail.com> wrote: > > > Thanks > > Was 143. I notice the -quite flag no longer works in openssl when testing connection > > > On Feb 17, 2019, at 3:33 AM, Aki Tuomi <aki.tuomi(a)open-xchange.com> wrote: > > > > > >> On 17 February 2019 at 05:50 Latin Bishop via dovecot < dovecot(a)dovecot.org> wrote: > >> > >> > >> > >> Getting this error after following > >> this tutorial > >> > >> Error in configuration file /etc/dovecot/dovecot.conf duplicate listener > >> > >> > >> https://samhobbs.co.uk/2013/12/raspberry-pi-email-server-part-2-dovecot > >> > > > > Usually doveconf -n tells you where the duplicate listener is so you can remove it. > > --- > > Aki Tuomi

1 0

Re: Dove to error
by Tuomi, Aki 17 Feb '19

17 Feb '19

Can you post doveconf -n output?Aki -------- Original message --------From: soydepr <soydepr(a)gmail.com> Date: 17/02/2019 12:20 (GMT+02:00) To: Aki Tuomi <aki.tuomi(a)open-xchange.com> Subject: Re: Dove to error now getting this error eb 17 05:03:19 pepino systemd[1]: Starting Dovecot IMAP/POP3 email server...Feb 17 05:03:19 pepino dovecot[8814]: Error: systemd listens on port 143, but it's not configured in Dovecot. Closing.Feb 17 05:03:19 pepino dovecot[8814]: Error: systemd listens on port 993, but it's not configured in Dovecot. Closing.here is my entiresservice imap-login { inet_listener imap { port = 143 } inet_listener imaps { port = 993 ssl = yes }On Sun, Feb 17, 2019 at 5:10 AM Latin Bishop <soydepr(a)gmail.com> wrote:Thanks Was 143. I notice the -quite flag no longer works in openssl when testing connection On Feb 17, 2019, at 3:33 AM, Aki Tuomi <aki.tuomi(a)open-xchange.com> wrote: On 17 February 2019 at 05:50 Latin Bishop via dovecot < dovecot(a)dovecot.org> wrote: Getting this error after following this tutorial Error in configuration file /etc/dovecot/dovecot.conf duplicate listener https://samhobbs.co.uk/2013/12/raspberry-pi-email-server-part-2-dovecot Usually doveconf -n tells you where the duplicate listener is so you can remove it. --- Aki Tuomi

1 0

Dove to error
by Latin Bishop 17 Feb '19

17 Feb '19

Getting this error after following this tutorial Error in configuration file /etc/dovecot/dovecot.conf duplicate listener https://samhobbs.co.uk/2013/12/raspberry-pi-email-server-part-2-dovecot

2 1

Fwd: [grosjo/fts-xapian] `doveadm fts rescan` removes all indices (#15)
by Joan Moreau 14 Feb '19

14 Feb '19

Hi, THis is a core problem in Dovecot in my understanding. In my opinion, the rescan in dovecot should send to the FTS plugin the list of "supposedly" indexed emails (UID), and the plugin shall purge the redundant UID (i..e UID present in the index but not in the list sent by dovecot) and send back the list of UID not in its indexes to dovecot, so Dovect can send one by one the missing emails WHat do you think ? -------- Original Message -------- SUBJECT: [grosjo/fts-xapian] `doveadm fts rescan` removes all indices (#15) DATE: 2019-02-08 08:28 FROM: Leonard Lausen <notifications(a)github.com> TO: grosjo/fts-xapian <fts-xapian(a)noreply.github.com> CC: Subscribed <subscribed(a)noreply.github.com> REPLY-TO: grosjo/fts-xapian <reply+0022e607fd2eb3ff93959543198455bc7db5bdd58aa0286b92cf000000011874f1ae92a169ce185221c2(a)reply.github.com> doveadm fts rescan -A deletes all indices, ie. all folders and files in the xapian-indexes are deleted. However, according to man doveadm fts, the rescan command should only > Scan what mails exist in the full text search index and compare those to what > actually exist in mailboxes. This removes mails from the index that have already > been expunged and makes sure that the next doveadm index will index all the > missing mails (if any). Deleting all indices does not seem to be the intended action, especially as constructing the index anew may take very long on large mailboxes. -- You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub [1], or mute the thread [2]. Links: ------ [1] https://github.com/grosjo/fts-xapian/issues/15 [2] https://github.com/notifications/unsubscribe-auth/ACLmB9OB-7GaKIvhNc8sCgi7K…

2 2

Quota count and clone questions
by Robert Moskowitz 14 Feb '19

14 Feb '19

all this almost reads like I can drop maintaining the quota2 table? From https://wiki.dovecot.org/Quota/Count mailbox_list_index = yes # Avoid spending excessive time waiting for the quota calculation to finish when # mails' vsizes aren't already cached. If this many mails are opened, finish the # quota calculation on background in indexer-worker process. Mail deliveries will # be assumed to succeed, and explicit quota lookups will return internal error. mail_vsize_bg_after_count = 100 seems to belong in 10-mail.conf. That is where those var are shown. But: plugin { # 10MB quota limit quota = count:User quota quota_rule = *:storage=10M # This is required - it uses "virtual sizes" rather than "physical sizes" for quota counting: quota_vsizes = yes } I am having problems with. Right now for quota I have: plugin { quota = dict:user::proxy::sqlquota trash = /etc/dovecot/dovecot-trash.conf.ext } How do I reconcile these two? Then for clone: https://wiki.dovecot.org/Plugins/QuotaClone how does: mail_plugins = $mail_plugins quota quota_clone plugin { quota_clone_dict = redis:host=127.0.0.1:port=6379 } get replaced with something for mysql? dovecot-sql.conf.ext: driver = mysql connect = host=/var/lib/mysql/mysql.sock dbname=postfix user=postfix password=$Postfix_Database_Password default_pass_scheme = $cryptsha-CRYPT # following should all be on one line. password_query = SELECT username as user, password, concat('/home/vmail/', maildir) as userdb_home, concat('maildir:/home/vmail/', maildir) as userdb_mail, 101 as userdb_uid, 12 as userdb_gid FROM mailbox WHERE username = '%u' AND active = '1' # following should all be on one line user_query = SELECT concat('/home/vmail/', maildir) as home, concat('maildir:/home/vmail/', maildir) as mail, 101 AS uid, 12 AS gid, CONCAT('*:messages=30000:bytes=', quota) as quota_rule FROM mailbox WHERE username = '%u' AND active = '1' and dovecot-dict-sql.conf.ext: connect = host=/var/lib/mysql/mysql.sock dbname=postfix user=postfix password=$Postfix_Database_Password map { pattern = priv/quota/storage table = quota2 username_field = username value_field = bytes } map { pattern = priv/quota/messages table = quota2 username_field = username value_field = messages } thanks

1 1

unsubcribe
by Henry Otten 14 Feb '19

14 Feb '19

1 0

Archive maildir
by Gandalf Corvotempesta 14 Feb '19

14 Feb '19

Hi to all We have a maildir with about 180GB of emails. We have to archive them to a structure like: .Archive.YYY./MM.folder Are you aware of a script doing this ? I've found a perl script that doesn't spit in year and month and a very, very, very, very, very old python script that: 1) doesn't manage base64 encoded subject properly 2) doesn't work with python 3.x (that is able to manage base64 encoded subject properly Any idea ?

6 9

Maintaining table quota2
by Robert Moskowitz 14 Feb '19

14 Feb '19

Does dovecot compute that values for quota2 with each email it updates for the user? Or only an incremental change? I ask because I am looking at migrating all the user mail from the old server to the new and building a new sql database. All I see is: dovecot-dict-sql.conf.ext: connect = host=/var/lib/mysql/mysql.sock dbname=postfix user=postfix password=$Postfix_Database_Password map { pattern = priv/quota/storage table = quota2 username_field = username value_field = bytes } map { pattern = priv/quota/messages table = quota2 username_field = username value_field = messages } what is actually done with this table? thanks

3 11

problem witht working director
by Maciej Milaszewski IQ PL 13 Feb '19

13 Feb '19

Hi I have dovecot director with 2-3 ring and 4 dovecot My ring is : 10.0.100.2 9090 right never synced 8 37305225 39763861 0 723 2019-02-13 16:02:04 2019-02-13 16:02:04 10.0.100.3 9090 left never synced 8 57409664 8707830 0 737 2019-02-13 16:02:04 2019-02-13 16:02:04 10.0.100.4 9090 self never ring synced 1 - - - - - - 10.0.100.4 - This is my default server where clients connect - default direcor 2.2.36 10.0.100.3 - second direcot 2.2.36 10.0.100.2 - second director with older ver 2.2.18 Today I found the error in my default mailserver Feb 13 13:21:23 kernel: [24253349.641695] qmail-remote: page allocation failure: order:2, mode:0x204020 and problem with logging via imap and pop3 I try "doveadm director status" i get time out I try restart dovecot and get: Feb 13 13:21:03 thebe3 dovecot: master: Fatal: Dovecot is already running? Socket already exists: /var/run/dovecot/login/director before failure i found: "imap-login: Error: write(proxy-notify) failed: Resource temporarily unavailable" but my setting they seem correct https://paste.debian.net/1067596/ I moved IP (via keepalive) all to other director (secound servcer) And when I try "doveadm director status" i get time out https://paste.debian.net/1067601/ I do not understand why I had a problem with second server and restart dovecot in server2 restart solved the problem ?

1 0

smtp_address_cmp does not ignore case of localpart
by Andreas Jobs 13 Feb '19

13 Feb '19

Hi, in src/lib-smtp/smtp-address.c line 759 the localpart is compared with null_strcmp, which does not ignore the case. While this is the correct behavior (according to the RFC) it causes problems in real life. In my case the vacation notices are not sent, if someone writes to First.Last(a)ruhr-uni-bochum.de because :addresses contains (only) first.last(a)ruhr-uni-bochum.de. Regards, Andreas -- ! AJ3630-RIPE @ RUB8-RIPE Network Operation Center ! ! Dezernat 5.I Ruhr-Universitaet Bochum ! ! The amount of energy necessary to refute bullshit is ! ! an order of magnitude bigger than to produce it. -- Alberto Brandolini !

2 3

Can't sync mailbox XXX: Mailbox isn't selectable
by Tamas Hegedus 12 Feb '19

12 Feb '19

Hi, I have users with file system folders, which contain mbox files and dovecot indexes, in the ~/mail directory. If I run dsync, I have an error message and the sync can not be completed: Can't sync mailbox FOLDER_NAME: Mailbox isn't selectable I could not find any solution via google or any hint what to do in this situation. Thanks for your help and suggestion, Tamas -- Tamas Hegedus, PhD Senior Research Fellow MTA-SE Molecular Biophysics Research Group Hungarian Academy of Sciences | phone: (36) 1-459 1500/60233 Semmelweis University | fax: (36) 1-266 6656 Tuzolto utca 37-47 | mailto:tamas@hegelab.org Budapest, 1094, Hungary | http://www.hegelab.org --- This email has been checked for viruses by AVG. https://www.avg.com

2 1

doveadm import with subfolder oddity
by Mark Moseley 12 Feb '19

12 Feb '19

This has got to be something weird in my config. And the standard disclaimer of '"happy to post doveconf -n, but wanted to see if this is normal first" :) Background: Ubuntu Xenial, running 2.2.36. Mailbox type is mdbox and I've got a period separator in my inbox namespace: namespace { hidden = no inbox = yes list = yes location = mailbox Spam { auto = no autoexpunge = 1 weeks special_use = \Junk } mailbox Trash { auto = no special_use = \Trash } prefix = INBOX. separator = . subscriptions = yes type = private } If I do a import for a regular folder under INBOX, it works just fine: doveadm import -u testbox2(a)testing.local -U testbox1(a)testing.local mdbox:~/mdbox INBOX all mailbox Sent ... returns happily, message count gets incremented If I try to do the same with a subfolder (and a subfolder that most definitely exists on both source and destination side), I get an error: doveadm import -u testbox2(a)testing.local -U testbox1(a)testing.local mdbox:~/mdbox INBOX all mailbox Sub.Sub1 doveadm(testbox2(a)testing.local): Error: remote(10.1.17.98:4000): Mailbox Sub.Sub1: Mailbox sync failed: Mailbox doesn't exist: Sub.Sub1 If I use / instead of . in my query, it works: doveadm import -u testbox2(a)testing.local -U testbox1(a)testing.local mdbox:~/mdbox INBOX all mailbox Sub/Sub1 ... returns happily and message count gets incremented. Since we're using '.' as our separator, that was a bit unexpected :) Ironically, if I'm doing a IMAPc 'import', it works just fine with a query of 'all mailbox Sub.Sub1'. It's only when importing from a local src and local dest (i.e. source_location == mdbox:~/mdbox) that it fails. With source_location set to 'imapc:', it works. I imagine that's due to using straight IMAP on the source side. Likely a misconfig on my part? Expected behavior? I can see in the strace that the error is triggered when doveadm is looking at the source mailbox. It looks for mdbox/mailboxes/Sub.Sub1/dbox-Mails first, then falls back to mdbox/mailboxes/Sub/Sub1/dbox-Mails (which it finds). Then a little bit later in the strace, it again looks for mdbox/mailboxes/Sub.Sub1/dbox-Mails (which it doesn't find) but doesn't try mdbox/mailboxes/Sub/Sub1/dbox-Mails this time, and then spits out 'Mailbox Sub.Sub1: Mailbox sync failed: Mailbox doesn't exist: Sub.Sub1'. With a query of 'all mailbox Sub/Sub1', the stat() is for mdbox/mailboxes/Sub/Sub1/dbox-Mails which it finds and uses happily. Having to substitute the '.'s for '/'s in the 'mailbox' part of the query isn't an awful workaround, but it very much feels like I'm doing something wrong. This is a production setup, so everything else is otherwise working fine. But I've only just begun working with 'doveadm import', so I might be turning up some issues with my config. Thanks! Sorry I'm so verbose :)

1 1

Doveadm service as non-root user
by Mark Moseley 12 Feb '19

12 Feb '19

Running: Ubuntu xenial, dovecot 2.2.36 I've been working on moving our user base from maildir to mdbox and trying to come up with solutions for things like moving emails around. In the past, with maildir, our support guys could just mv the files around and done. For mdbox, I've been working on getting things set up to use doveadm. One weirdness I've seen is that in imports (i.e. doveadm import), mail gets copied correctly but the resulting files are left with root ownership (I don't have 'service doveadm' 'user' set, so I guess it defaults to root). It's typically new m.* files as well as the dovecot.list.index and dovecot.list.index.log files. Looking at strace, no chown is done on them, nor was there setuid. The import had no trouble finding the correct user in the db, so I know that it knows the correct UID (I can see it just fine in debug logs too). And it will happily import to existing m.* files with no permissions issues (but considering it's running as root, I wouldn't expect it to). I've seen this using 'import' via IMAPc as well as with both src and dest on the same server. I can see this behavior in both scenarios. We have a single shared UID for mail, so especially in that "src/dest on same server" case, it's not a matter of UID-mismatch. It's a director setup, so all doveadm commands are coming through the director. If I run the import directly on the backend (which obviously would be a bad idea in real life), the ownership of new m.* files seems to be correct (I can see it setuid'ing to the correct UID from userdb in strace). If I run the import on the director, I can get a new root-owned file every time it rolls over to the next m.* file. Two questions: * Is that a bug? Is this expected behavior? Seems like the expected thing would be to use the UID from userdb and either do a setuid (just like running 'doveadm import' locally did) or chown'ing any new files to the correct UID. I always always assume misconfiguration (vs bug, since it's almost never a bug) but I'm baffled on this one. * I see that it's possible to set a user for service doveadm and the wiki even suggests that it's a good idea in a single UID setup. If there are no mailboxes with any other UIDs, *will setting 'service doveadm' to the same UID possibly break anything*? I can't think of why it would, but I want to be duly diligent. Plus I'm a little leery about closing the door to ever having additional UIDs for mailboxes. Happy to provide 'doveconf -n' but wanted to check first, before spending 15 minutes gently obfuscating it :)

2 3

expunge not removing attachments?
by Ralf Hildebrandt 12 Feb '19

12 Feb '19

I have a large mail backup folder backup(a)backup.invalid; I'm cleaning up daily like this: infimum=`date -d "-4 day" +"%Y-%m-%d"` doveadm expunge -u backup(a)backup.invalid mailbox INBOX SAVEDBEFORE $infimum doveadm purge -u backup(a)backup.invalid yet I see this: # find attachments/ -type f -ctime +5 | wc -l 7522 # find attachments/ -type f | wc -l 127579 # find attachments/ -type f -mtime +5 | wc -l 14361 # find attachments/ -type f | wc -l 127793 About 5.9% of the files in attachments and below are older than 5 days. Why? Is that normal? using dovecot 2:2.3.1-1 from the official repos. -- Ralf Hildebrandt Geschäftsbereich IT | Abteilung Netzwerk Charité - Universitätsmedizin Berlin Campus Benjamin Franklin Hindenburgdamm 30 | D-12203 Berlin Tel. +49 30 450 570 155 | Fax: +49 30 450 570 962 ralf.hildebrandt(a)charite.de | https://www.charite.de

2 3

APPEND Error in dovecot.log
by Alessandro Battaglini 12 Feb '19

12 Feb '19

Hi dovecot --version => 2.2.22 (fe789d2) Scenario: Sometimes imap client send email correctly but there's is any message stored in sent mail folder in that scenario I have found an error in my dovecot.log : 2019-02-11 09:04:52 imap(-----@------------): Info: Disconnected in APPEND (1 msgs, 125 secs, 2818048/4426899 bytes) in=3365352 out=1522206 Question: what about this? Is there, in dovecot configuration, a parameter that insist to any kind of APPEND like value.? I have not find that. Have you any idea to solve this? Thanks

1 0

assertion failed: (srcleft <= CHARSET_MAX_PENDING_BUF_SIZE)
by Giacomo 11 Feb '19

11 Feb '19

I'm running the following: # 2.3.4 (0ecbaf23d): /usr/local/etc/dovecot/dovecot.conf # OS: FreeBSD 11.2-RELEASE-p4 amd64 # FS: ZFS auth_mechanisms = plain login auth_username_format = %Ln listen = * mail_location = maildir:~/Maildir namespace inbox { inbox = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk { auto = subscribe special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox Trash { auto = subscribe special_use = \Trash } prefix = } passdb { driver = pam } protocols = imap lmtp service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0666 user = postfix } user = dovecot } service imap-login { inet_listener imap { port = 0 } } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } service stats { unix_listener stats-reader { group = mode = 0600 user = } unix_listener stats-writer { group = $default_internal_group mode = 0666 user = } user = $default_internal_user } ssl_cert = </root/cert.pem ssl_key = # hidden, use -P to show it userdb { driver = passwd } dmesg shows: pid 74441 (imap), uid 1002: exited on signal 6 pid 74784 (imap), uid 1002: exited on signal 6 pid 21471 (imap), uid 1002: exited on signal 6 pid 21470 (imap), uid 1002: exited on signal 6 pid 21464 (imap), uid 1002: exited on signal 6 pid 21731 (imap), uid 1002: exited on signal 6 Sometimes the dovecot process serving an user crashes. He runs mostly airmail on macOS and samsung mail on Android. Happens only to that particular user. The log shows the following: (maillog) Dec 16 14:52:35 mail dovecot: imap-login: Login: user=<USER>, method=PLAIN, rip=79.12.201.157, lip=192.168.1.28, mpid=74779, TLS, session=<wMQI+iN9VtRPDMmd> Dec 16 14:52:39 mail dovecot: imap(USER)<74441><nLa+7SN9+fhPDMmd>: Panic: file charset-iconv.c: line 83 (charset_to_utf8_try): assertion failed: (srcleft <= CHARSET_MAX_PENDING_BUF_SIZE) Dec 16 14:52:39 mail dovecot: imap(USER)<74441><nLa+7SN9+fhPDMmd>: Fatal: master: service(imap): child 74441 killed with signal 6 (core not dumped - https://dovecot.org/bugreport.html#coredumps - set service imap { drop_priv_before_exec=yes }) I'm here if more info is needed. Thanks for taking a look.

4 7

Bounces?
by ＠lbutlr 11 Feb '19

11 Feb '19

I just got this On 9 Feb 2019, at 00:00, dovecot-request(a)dovecot.org wrote: > Your membership in the mailing list dovecot has been disabled due to > excessive bounces The last bounce received from you was dated > 02-Feb-2019. You will not get any more messages from this list until > you re-enable your membership. You will receive 1 more reminders like > this before your membership in the list is deleted. > > To re-enable your membership, you can simply respond to this message > (leaving the Subject: line intact), or visit the confirmation page at > > https://dovecot.org/mailman/confirm/dovecot/41881d… When clicking the link I get "Bad confirmation sting" and something about maybe the link expired. I see no connection attempts from dovecot.org over the last few days other than this message. -- If at first you don't succeed, destroy all evidence that you tried.

8 18

Use sieve to move all mail automatically based on List-Id
by Matthias Fechner 09 Feb '19

09 Feb '19

Dear all, I currently use the following rule to automatically sort email into folders based on mailing lists: # split out the various list forms # Mailman & other lists using list-id if exists "list-id" { if header :regex "list-id" "<([a-z_0-9-]+)[.@]" { set :lower "listname" "${1}"; fileinto :create "${listname}"; } else { if header :regex "list-id" "^\\s*<?([a-z_0-9-]+)[.@]" { set :lower "listname" "${1}"; fileinto :create "${listname}"; } else { keep; } } stop; } This works really nice. The only problem I have here is that it does use the ID, but not the name and this can lead to strange folder names. If an email has e.g. the following header: List-Id: mfechner/ci-test <142.ci-test.mfechner.gitlab.fechner.net> it moves the email to the folder 142 as the regex matches inside the <> string till the none-letter/none-number/_/- is matching. I do not understand the expresion [.@] so it is nearly impossible for my to extend that query. What I would like to do is using the ID as folder name as fallback. So in this case I would like that the email is moved to folder `mfechner/ci-test`. I'm not sure if sieve can handle the `/` correctly. Thanks a lot for any tip. Gruß Matthias -- "Programming today is a race between software engineers striving to build bigger and better idiot-proof programs, and the universe trying to produce bigger and better idiots. So far, the universe is winning." -- Rich Cook

1 0

lib-master test failure i686
by Eric Broch 08 Feb '19

08 Feb '19

Hello List, I've built and checked successfully dovecot and dovecot-pigeonhole on CentOS 6 x86_64 Immediately below are the successful make check (ok) tests of dovecot 'lib-master' (x86_64). Below that are the unsuccessful (fails) tests of dovecot 'lib-master' on i686. Does anyone have a clue as to why these test would fail on i686? (x86_64): Making check in lib-master make[2]: Entering directory `/builddir/build/BUILD/dovecot-2.3.4/src/lib-master' make check-local make[3]: Entering directory `/builddir/build/BUILD/dovecot-2.3.4/src/lib-master' for bin in test-master-service-settings-cache test-event-stats; do \ if ! ./$bin; then exit 1; fi; \ done 0 / 0 tests failed no merging parent is NULL ............................................ : ok no merging parent sent to stats ...................................... : ok no merging parent timestamp differs .................................. : ok merge events parent NULL ............................................. : ok merge events parent sent to stats .................................... : ok skip empty parents ................................................... : ok merge events and skip empty parents .................................. : ok 0 / 7 tests failed make[3]: Leaving directory `/builddir/build/BUILD/dovecot-2.3.4/src/lib-master' make[2]: Leaving directory `/builddir/build/BUILD/dovecot-2.3.4/src/lib-master' (i686): Making check in lib-master make[2]: Entering directory `/builddir/build/BUILD/dovecot-2.3.4/src/lib-master' make check-local make[3]: Entering directory `/builddir/build/BUILD/dovecot-2.3.4/src/lib-master' for bin in test-master-service-settings-cache test-event-stats; do \ if ! ./$bin; then exit 1; fi; \ done 0 / 0 tests failed no merging parent is NULL ............................................ : ok test-event-stats.c:365: Assert failed: compare_test_stats_to( "EVENT %lu 1 0 0" " stest-event-stats.c %d" " l0 0 ctest2\n", id, l) no merging parent sent to stats ...................................... : FAILED test-event-stats.c:394: Assert failed: compare_test_stats_to( "BEGIN %lu 0 1 0 0" " stest-event-stats.c %d ctest1\n" "EVENT %lu 1 1 0" " stest-event-stats.c %d" " l1 0 ctest2\n" "END\t%lu\n", idp, lp, idp, l, idp) no merging parent timestamp differs .................................. : FAILED merge events parent NULL ............................................. : ok test-event-stats.c:458: Assert failed: compare_test_stats_to( "EVENT %lu 1 0 0" " stest-event-stats.c %d l0 0" " ctest3 ctest2 ctest1 Tkey3" " 10 0 Ikey2 20" " Skey1 str1\n", id, l) merge events parent sent to stats .................................... : FAILED test-event-stats.c:490: Assert failed: compare_test_stats_to( "BEGIN %lu 0 1 0 0" " stest-event-stats.c %d ctest1\n" "EVENT %lu 1 3 0 " "stest-event-stats.c %d l3 0" " ctest2\nEND\t%lu\n", id, lp, id, l, id) skip empty parents ................................................... : FAILED test-event-stats.c:533: Assert failed: compare_test_stats_to( "BEGIN %lu 0 1 0 0" " stest-event-stats.c %d ctest1\n" "EVENT %lu 1 3 0 " "stest-event-stats.c %d l3 0 " "ctest4 ctest5 Tkey3 10 0 Skey4" " str4\nEND\t%lu\n", id, lp, id, l, id) merge events and skip empty parents .................................. : FAILED 5 / 7 tests failed make[3]: Leaving directory `/builddir/build/BUILD/dovecot-2.3.4/src/lib-master' make[3]: *** [check-local] Error 1 make[2]: *** [check-am] Error 2 make[2]: Leaving directory `/builddir/build/BUILD/dovecot-2.3.4/src/lib-master' -- Eric Broch White Horse Technical Consulting (WHTC)

2 4

mbox 2 Maildir
by Tamas Hegedus 08 Feb '19

08 Feb '19

Hi, I am not an professional system admin, but I am running a small debian mail server for many years. It is time to migrate from mbox to Maildir. There is a nice and clean description for doing this without service downtime at https://wiki.dovecot.org/Tools/Doveadm/Sync I have to set per-user config for mailbox type using userdb extra fields. However, I miss some information and I can not find useful info by google. 1. The main question: dovecot will know that for some users the mailbox format is still mbox, but others already have Maildir. I do not see any hint that I should setup postfix/procmail for handling the delivery per-user basis. But I think I have to set this, too. 2. I have not learned much about userdb and it seems that dovecot was written for and used by experts. I mean that the docs/wiki is not enough for me: from the wiki page of userdb it will be for me difficult to setup one. Can you suggest some docs for dummies? Thanks for your help, Tamas dovecot --version 2.2.27 (c0f36b0) postfix 3.1.8 procmail v3.23pre 2001/09/13 -- Tamas Hegedus, PhD Senior Research Fellow MTA-SE Molecular Biophysics Research Group Hungarian Academy of Sciences | phone: (36) 1-459 1500/60233 Semmelweis University | fax: (36) 1-266 6656 Tuzolto utca 37-47 | mailto:tamas@hegelab.org Budapest, 1094, Hungary | http://www.hegelab.org --- This email has been checked for viruses by AVG. https://www.avg.com

4 8

system wakeup caused by write operations to /var/lib/dovecot/instances
by Tijl 07 Feb '19

07 Feb '19

Hi, I hope someone can help me with this. Problem Dovecot writes to _/var/lib/dovecot/instances_ 1 up to 3 times a day, causing the system to wake up and disks to spin up. Details content of /var/lib/dovecot/instances : 1549073010 dovecot /var/run/dovecot /etc/dovecot/dovecot.conf --> only the timestamp is changed (to current time) when dovecot writes to this file --> during write the file is temporary renamed to _instances.lock_ dovecot running processes: dovecot (main process) --> it's this process that writes to /var/lib/instances dovecot/anvil dovecot/log dovecot/config --> sometimes this process is not running, but doesn't change anything note: no clients connected problem also occur in the middle of the night (no human activity, client devices powered off, all external traffic blocked) the writings occur around every 8 hours, but vary, sometimes it's 6 hours up to 13 hours. Configuration See attachment: doveconfig-short-[platform].txt (output of _"/usr/sbin/dovecot -n"_) doveconfig-long-[platform].txt (output of _"/usr/bin/doveconf"_) --> _3-docker_ config is the most simple setup of the 3 Environment Tested on 3 platforms Platform 1: Intel Atom C2538 (Synology DiskStation 415+) Linux version 3.10.105 Dovecot version 2.2.19 (Synology MailPlus Server) Platform 2: ARMv7 rev 1 (Synology DiskStation 215j) Linux version 3.2.40 Dovecot version 2.2.19 (Synology Mail Server) Platform 3: Intel Atom C2538 (Docker container) Linux version 3.10.105 Dovecot version 2.3.2.1 (0719df592) How can dovecot be run without writing to /var/lib/dovecot/instances everyday? Is there a configuration setting for this? Thanks already! Tijl

3 4

Dovecot v2.2.36.1 released
by Aki Tuomi 07 Feb '19

07 Feb '19

https://dovecot.org/releases/2.2/dovecot-2.2.36.1.tar.gz https://dovecot.org/releases/2.2/dovecot-2.2.36.1.tar.gz.sig * CVE-2019-3814: If imap/pop3/managesieve/submission client has trusted certificate with missing username field (ssl_cert_username_field), under some configurations Dovecot mistakenly trusts the username provided via authentication instead of failing. * ssl_cert_username_field setting was ignored with external SMTP AUTH, because none of the MTAs (Postfix, Exim) currently send the cert_username field. This may have allowed users with trusted certificate to specify any username in the authentication. This bug didn't affect Dovecot's Submission service. - pop3_no_flag_updates=no: Don't expunge RETRed messages without QUIT - director: Kicking a user assert-crashes if login process is very slow - lda/lmtp: Fix assert-crash with some Sieve scripts when mail_attachment_detection_options=add-flags-on-save - fs-compress: Using maybe-gz assert-crashed when reading 0 sized file - Snippet generation crashed with invalid Content-Type:multipart --- Aki Tuomi Open-Xchange Oy

11 13

alterstorage for archiv
by Maciej Milaszewski IQ PL 07 Feb '19

07 Feb '19

Hi I have a testing lab with: debian10 + dovecot-2.2.33 (director) and one backaned with 2.2.33.2 mail_location = maildir:~/Maildir:INDEX=/var/dovecot_indexes%h All works fine but I thinking now about solutions to moved all messeges older by (14day) to my alter storage with poor disk to folder Archive like:/vmail/domain/user@domain/Maildir/ to: /otherstorage/vmail/domain/user@domain/ And i thinking about ( hmm mapping folder Archive) /vmail/domain/user@domain/Maildir/Archive/ mail_location = maildir:~/Maildir:INDEX=/var/dovecot_indexes%h:ALT:/otherstorage%h is that "solutions" Is good idea ? Or maby is another working solutions ? because: doveadm altmove not working with Maildir

1 0

"sieve: failed to store into mailbox 'Junk': Read-only mbox" over root_squashed NFS, lmtp : euid/egid set and access() don't mix together for me
by Ludovic POUZENC 07 Feb '19

07 Feb '19

Hi, I try to migrate an old fashioned mailsystem to Debian 9.7 / dovecot 2.2.7. I "have" to cope with mbox for now. I try to get rid of Sun OS 5.9 sendmail before mbox to mdbox migration (I'm fine if you laugh loudly ^^). Intended setup : 2 VM with exim (smtp in, smtp out roughly), 3 VM with dovecot (mbox, maildir, testbed), 1 VM with IMAP proxy and LMTP proxy. doveconf -n is at end of this mail. My test case is : root@wagram:~# swaks --to tstifi04 --server imap --protocol lmtp --header-X-Spam-Status yes root@wagram:~# (imap VM LMTP proxies to telegraphe5 VM in this test) mbox folders are in users homedir, no generic "vmail" unix account. Real posixAccounts in LDAP, NFS root_squashed. sieve "fileinto "Junk" call goes wrong : > Feb 6 17:56:03 telegraphe5 dovecot: lmtp(tstifi04): Error: > PytSHqIRW1x2dgAA+Fldtw: sieve: msgid=unspecified: failed to store into > mailbox 'Junk': Read-only mbox straced : https://pastebin.com/A53hDYnS I may miss some configuration options... but I get stuck. I get to IRC and it seems that there is no simple things to circumvent. I tried to read some code path too. https://wiki.dovecot.org/LMTP states : > > Security > > Unfortunately LMTP process currently needs to run as root, and only > temporarily drop privileges to users. Otherwise it couldn't handle > mail deliveries to more than a single user with different UID. If > you're using only a single global UID/GID, you can improve security by > running lmtp processes as that user: > service lmtp { > user = vmail > } lmtp run as root, drop temporarily privileges. The point, IHMO, is lmtp calls sieve code paths, that call some mbox saving function, that calls libc/syscall access(). And this explicitly not consider effective uid/gid. From strace (more in pastebin) : > [pid 30326] geteuid() = 0 > [pid 30326] setresuid(-1, 20609, -1) = 0 > [pid 30326] geteuid() = 20609 > [pid 30326] access("/home/tstifi04/mail-imap/Junk", R_OK|W_OK) = -1 > EACCES (Permission denied) From man access > The check is done using the calling process's real UID and GID, > rather than the effective IDs as is done when actually > attempting an operation (e.g., open(2)) on the file. > Similarly, for the root user, the check uses the set of permitted > capabilities rather than the set of effective capabilities; and > for non-root users, the check uses an empty set of capa- > bilities. I think that the process has effectively sufficient permissions to write into the root_squashed file, and infortunately access() check another thing. In dovecot sources, src/lib/eacces-error.c is aware of those "problems" with access(), but I think that mbox and maybe other storage backends don't use this for main codepath (like save a mail), but "only" for smart log messages in some cases. I may gone wrong while seeking about it. Do you see a configuration that can use root squashed mboxes and LMTP ? Should test_access() variant could be used as access() replacement ? There is eaccess() and euidaccess() too but may be not portable enough (_GNU_SOURCE only). Regards, Ludovic telegraphe5:/dev/shm# mount | grep tstifi04 cifs1:/homeeleves/tstifi/tstifi04 on /home/tstifi04 type nfs (rw,nosuid,nodev,relatime,vers=3,rsize=65536,wsize=65536,namlen=255,hard,proto=tcp,timeo=600,retrans=2,sec=sys,mountaddr=172.16.2.29,mountvers=3,mountport=635,mountproto=udp,local_lock=none,addr=172.16.2.29) telegraphe5:/dev/shm# dovecot -n # 2.2.27 (c0f36b0): /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.16 (fed8554) # OS: Linux 4.9.0-8-amd64 x86_64 Debian 9.7 auth_debug = yes auth_verbose = yes default_client_limit = 10240 default_process_limit = 2048 lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes mail_debug = yes mail_fsync = always mail_location = mbox:~/mail-imap:INBOX=/var/mail/mailbox/%u:INDEX=/var/dovecot-indexes/%u mail_nfs_storage = yes mail_plugins = quota managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext mbox_write_locks = fcntl mmap_disable = yes namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } plugin { mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename mail_log_fields = uid box msgid size quota = count:Quota mail global quota_rule = *:storage=100M quota_rule2 = Trash:storage=+100M quota_vsizes = yes quota_warning = storage=95%% quota-warning 95 %u quota_warning2 = storage=80%% quota-warning 80 %u sieve = file:/var/mail/mailconf/%1u/%u/sieve;active=/var/mail/mailconf/%1u/%u/.dovecot.sieve sieve_after = /var/mail/mailconf/global/sieve/after.d/ sieve_before = /var/mail/mailconf/global/sieve/before.d/ sieve_global = /var/mail/mailconf/global/sieve sieve_vacation_dont_check_recipient = yes } protocols = " imap lmtp sieve sieve" service anvil { unix_listener anvil-auth-penalty { mode = 00 } } service imap-login { inet_listener imap { port = 0 } } service lmtp { inet_listener lmtp { port = 24 } } service managesieve { process_limit = 16 } service quota-warning { executable = script /usr/local/bin/quota-warning.sh unix_listener quota-warning { mode = 0666 } user = root } ssl = required ssl_cert = </etc/ssl/local_certs/telegraphe5_cert.pem ssl_key = # hidden, use -P to show it syslog_facility = local0 userdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } verbose_proctitle = yes protocol lmtp { mail_plugins = quota sieve } protocol imap { mail_max_userip_connections = 20 mail_plugins = quota imap_quota } telegraphe5:/dev/shm# grep -vE '^(#|$)' /etc/dovecot/dovecot-ldap.conf.ext uris = ldaps://ldap-test.mines-albi.fr tls_require_cert = hard auth_bind = yes base = ou=People,dc=enstimac,dc=fr user_attrs = homeDirectory=home,uidNumber=uid,gidNumber=gid,\ dcMailQuota=quota_rule=*:bytes=%{ldap:dcMailQuota}M user_filter = (&(objectClass=posixAccount)(|(uid=%n)(mail=%n(a)mines-albi.fr))) iterate_attrs = uid=user iterate_filter = (objectClass=posixAccount) telegraphe5:/dev/shm# ls -l /var/mail/mailconf/global/sieve/before.d/ total 0 telegraphe5:/dev/shm# ls -al /var/mail/mailconf/t/tstifi04/ total 44 drwx------ 3 tstifi04 ifie2012 4096 févr. 5 10:46 . drwxrwxrwt 169 root root 16384 janv. 5 18:48 .. lrwxrwxrwx 1 tstifi04 ifie2012 25 janv. 31 17:50 .dovecot.sieve -> sieve/rainloop.user.sieve -rw------- 1 tstifi04 ifie2012 1520 févr. 5 13:22 .dovecot.sieve.log -rw------- 1 tstifi04 ifie2012 10336 févr. 5 10:46 .dovecot.sieve.log.0 -rw------- 1 tstifi04 ifie2012 172 janv. 31 17:56 .dovecot.svbin drwx------ 3 tstifi04 ifie2012 4096 janv. 31 17:50 sieve telegraphe5:/dev/shm# ls -al /var/mail/mailconf/t/tstifi04/sieve/rainloop.user.sieve -rw------- 1 tstifi04 ifie2012 102 janv. 31 17:50 /var/mail/mailconf/t/tstifi04/sieve/rainloop.user.sieve telegraphe5:/dev/shm# cat /var/mail/mailconf/t/tstifi04/sieve/rainloop.user.sieve # This is RainLoop Webmail sieve script. # Please don't change anything here. # RAINLOOP:SIEVE telegraphe5:/dev/shm# telegraphe5:/dev/shm# cat /var/mail/mailconf/global/sieve/after.d/spam-into-junk.sieve require ["fileinto"]; if header :is "X-Spam-Status" "Yes" { fileinto "Junk"; stop; }

1 0

acl_groups in LDAP
by Christian Rößner 06 Feb '19

06 Feb '19

Hi, I found a 9 year old thread (https://www.dovecot.org/list/dovecot/2010-October/054407.html) concerning acl_groups in OpenLDAP. In this thread someone asked, if it is possible to provide ACLs as multi value in OpenLDAP. I know that Dovecot expects acl_groups as a comma separated list, so currently I do this with a single value. Did the code change a little bit and accepts multi values now? Would be nice to have attributes like: ACLAttribute: group1 ACLAttribute: group2 ... Instead of: ACLAttribute: group1,group2 Thanks in advance Christian -- Rößner-Network-Solutions Karl-Bröger-Str. 10, 36304 Alsfeld T: +49 6631 9110725, F: +49 6631 78823409, M: +49 171 9905345 USt-IdNr.: DE225643613, https://roessner-network-solutions.com

2 1

Release notify (2.2.36.1 and 2.3.4.1)
by Aki Tuomi 05 Feb '19

05 Feb '19

Due to DMARC issues some people have failed to receive the latest security information, so here it is repeated for both releases: 2.3.4.1 https://dovecot.org/releases/2.3/dovecot-2.3.4.1.tar.gz https://dovecot.org/releases/2.3/dovecot-2.3.4.1.tar.gz.sig <https://dovecot.org/releases/2.3/dovecot-2.3.2.tar.gz.sig> Binary packages in https://repo.dovecot.org/ * CVE-2019-3814: If imap/pop3/managesieve/submission client has trusted certificate with missing username field (ssl_cert_username_field), under some configurations Dovecot mistakenly trusts the username provided via authentication instead of failing. * ssl_cert_username_field setting was ignored with external SMTP AUTH, because none of the MTAs (Postfix, Exim) currently send the cert_username field. This may have allowed users with trusted certificate to specify any username in the authentication. This bug didn't affect Dovecot's Submission service. 2.2.36.1 https://dovecot.org/releases/2.2/dovecot-2.2.36.1.tar.gz https://dovecot.org/releases/2.2/dovecot-2.2.36.1.tar.gz.sig * CVE-2019-3814: If imap/pop3/managesieve/submission client has trusted certificate with missing username field (ssl_cert_username_field), under some configurations Dovecot mistakenly trusts the username provided via authentication instead of failing. * ssl_cert_username_field setting was ignored with external SMTP AUTH, because none of the MTAs (Postfix, Exim) currently send the cert_username field. This may have allowed users with trusted certificate to specify any username in the authentication. This bug didn't affect Dovecot's Submission service. - pop3_no_flag_updates=no: Don't expunge RETRed messages without QUIT - director: Kicking a user assert-crashes if login process is very slow - lda/lmtp: Fix assert-crash with some Sieve scripts when mail_attachment_detection_options=add-flags-on-save - fs-compress: Using maybe-gz assert-crashed when reading 0 sized file - Snippet generation crashed with invalid Content-Type:multipart

4 13

SELinux policy to allow Dovecot to connect to Mysql
by Robert Moskowitz 05 Feb '19

05 Feb '19

As I have noted in previous messages, I been getting the following on my new mailserver: Apr 7 10:17:27 z9m9z dovecot: dict: Error: mysql(localhost): Connect failed to database (postfix): Can't connect to local MySQL server through socket '/var/lib/mysql/mysql.sock' (13) - waiting for 25 seconds before retry They go away when I setenforce 0. It is not a timing issue as I earlier thought. So I googled dovecot mysql selinux and the only worthwhile hit was: http://zszsit.blogspot.com/2012/12/dovecot-mysql-selinux-issue-on-centos6.h… that provides a /etc/selinux/dovecot2mysql.te and other selinux stuff. Is there a simpler way like a setsbool option? With all the howtos on dovecot with mysql, it is interesting that none of them seem to have this problem. Maybe because they connect to mysql through TCP port 3306 which has ITS set of problems (like MariaDB defaults to not listening on TCP). thanks!

1 3

problem using different dovecot versions
by Gonzalo Palacios Goicolea 05 Feb '19

05 Feb '19

Hi All, I'm new to the list and may be it's a known issue. I have a set of servers with RHEL6 and dovecot-2.2.10-1_14.el6.x86_64 and another set of servers with RHEL7 and, now, with dovecot-2.2.36-3.el7.x86_64. Both sets write to the same NFS. Since I updated RHEL7 servers (from 2.2.10-8.el7.x86_64) I've problems with index files when a RHEL7 dovecot service write to the filesystem of a user (the first log line corresponds to RHEL7 and the others to RHEL6): Feb 5 09:33:05 listas3 dovecot: lda(user@domain): sieve: msgid=<007bxxxxxxx(a)uam.es>: stored mail into mailbox 'INBOX' Feb 5 09:33:25 buzon1 dovecot: imap(user@domain): Error: Corrupted transaction log file /.../Maildir/dovecot.index.log seq 1610: Invalid transaction log size (28408 vs 28528): /.../Maildir/dovecot.index.log (sync_offset=28408) Feb 5 09:33:25 buzon1 dovecot: imap(user@domain): Panic: file mail-index-sync-keywords.c: line 227 (keywords_update_records): assertion failed: (data_offset >= sizeof(struct mail_index_record)) Feb 5 09:33:25 buzon1 dovecot: imap(user@domain): Error: Raw backtrace: /usr/lib64/dovecot/libdovecot.so.0() [0x3713268b8a] -> /usr/lib64/dovecot/libdovecot.so.0() [0x3713268bf6] -> /usr/lib64/dovecot/libdovecot.so.0() [0x37132224aa] -> /usr/lib64/dovecot/libdovecot-storage.so.0(mail_index_sync_keywords+0x7fd) [0x3713aca43d] -> /usr/lib64/dovecot/libdovecot-storage.so.0(mail_index_sync_record+0xec) [0x3713acacac] -> /usr/lib64/dovecot/libdovecot-storage.so.0(mail_index_sync_map+0x234) [0x3713acbae4] -> /usr/lib64/dovecot/libdovecot-storage.so.0(mail_index_map+0x83) [0x3713abcce3] -> /usr/lib64/dovecot/libdovecot-storage.so.0(mail_index_refresh+0xe) [0x3713ab793e] -> /usr/lib64/dovecot/libdovecot-storage.so.0(maildir_sync_header_refresh+0x10) [0x3713a4e1e0] -> /usr/lib64/dovecot/libdovecot-storage.so.0() [0x3713a4e330] -> /usr/lib64/dovecot/libdovecot-storage.so.0() [0x3713a4f3d4] -> /usr/lib64/dovecot/libdovecot-storage.so.0() [0x3713a4f7b3] -> /usr/lib64/dovecot/libdovecot-storage.so.0(maildir_storage_sync_init+0xd9) [0x3713a4fa59] -> /usr/lib64/dovecot/libdovecot-storage.so.0(mailbox_sync_init+0x31) [0x3713a7d731] -> /usr/lib64/dovecot/libdovecot-storage.so.0(mailbox_sync+0x27) [0x3713a7e7b7] -> /usr/lib64/dovecot/libdovecot-storage.so.0(index_storage_get_status+0x62) [0x3713aa8fc2] -> /usr/lib64/dovecot/lib10_quota_plugin.so(+0xc3ec) [0x7fd272dfe3ec] -> /usr/lib64/dovecot/libdovecot-storage.so.0(mailbox_get_status+0x5c) [0x3713a7f4fc] -> dovecot/imap(imap_status_get+0x7a) [0x41dbea] -> dovecot/imap(cmd_status+0x179) [0x413059] -> dovecot/imap(command_exec+0x3d) [0x4170bd] -> dovecot/imap() [0x416180] -> dovecot/imap() [0x41627a] -> dovecot/imap(client_handle_input+0x11d) [0x4164ed] -> dovecot/imap(client_input+0x6f) [0x41685f] -> /usr/lib64/dovecot/libdovecot.so.0(io_loop_call_io+0x36) [0x3713278a56] -> /usr/lib64/dovecot/libdovecot.so.0(io_loop_handler_run+0xa7) [0x3713279b27] -> /usr/lib64/dovecot/libdovecot.so.0(io_loop_run+0x38) [0x37132789c8] Feb 5 09:33:25 buzon1 dovecot: imap(user@domain): Fatal: master: service(imap): child 2057 killed with signal 6 (core dumped) Feb 5 09:33:25 buzon4 dovecot: imap-login: Login: user=<user@domain>, method=PLAIN, rip=192.168.x.x, lip=150.x.x.x, mpid=3459, session=<ZUSAdiGBdwDAqAzY> Feb 5 09:33:30 buzon4 dovecot: imap(user@domain): Panic: file mail-index-sync-keywords.c: line 227 (keywords_update_records): assertion failed: (data_offset >= sizeof(struct mail_index_record)) Feb 5 09:33:30 buzon4 dovecot: imap(user@domain): Error: Raw backtrace: /usr/lib64/dovecot/libdovecot.so.0() [0x3a88668b8a] -> /usr/lib64/dovecot/libdovecot.so.0() [0x3a88668bf6] -> /usr/lib64/dovecot/libdovecot.so.0() [0x3a886224aa] -> /usr/lib64/dovecot/libdovecot-storage.so.0(mail_index_sync_keywords+0x7fd) [0x3a88eca43d] -> /usr/lib64/dovecot/libdovecot-storage.so.0(mail_index_sync_record+0xec) [0x3a88ecacac] -> /usr/lib64/dovecot/libdovecot-storage.so.0(mail_index_sync_map+0x234) [0x3a88ecbae4] -> /usr/lib64/dovecot/libdovecot-storage.so.0(mail_index_map+0x83) [0x3a88ebcce3] -> /usr/lib64/dovecot/libdovecot-storage.so.0() [0x3a88eb797c] -> /usr/lib64/dovecot/libdovecot-storage.so.0() [0x3a88eb7d58] -> /usr/lib64/dovecot/libdovecot-storage.so.0(mail_index_open+0xf0) [0x3a88eb7ec0] -> /usr/lib64/dovecot/libdovecot-storage.so.0(index_storage_mailbox_open+0xad) [0x3a88eab2bd] -> /usr/lib64/dovecot/libdovecot-storage.so.0() [0x3a88e4d71a] -> /usr/lib64/dovecot/libdovecot-storage.so.0() [0x3a88e4d7ef] -> /usr/lib64/dovecot/libdovecot-storage.so.0() [0x3a88e7f694] -> /usr/lib64/dovecot/libdovecot-storage.so.0(mailbox_open+0xf) [0x3a88e7f84f] -> /usr/lib64/dovecot/libdovecot-storage.so.0(index_storage_get_status+0x4a) [0x3a88ea8faa] -> /usr/lib64/dovecot/lib10_quota_plugin.so(+0xc3ec) [0x7fbd599263ec] -> /usr/lib64/dovecot/libdovecot-storage.so.0(mailbox_get_status+0x5c) [0x3a88e7f4fc] -> dovecot/imap(imap_status_get+0x7a) [0x41dbea] -> dovecot/imap(cmd_status+0x179) [0x413059] -> dovecot/imap(command_exec+0x3d) [0x4170bd] -> dovecot/imap() [0x416180] -> dovecot/imap() [0x41627a] -> dovecot/imap(client_handle_input+0x11d) [0x4164ed] -> dovecot/imap(client_input+0x6f) [0x41685f] -> /usr/lib64/dovecot/libdovecot.so.0(io_loop_call_io+0x36) [0x3a88678a56] -> /usr/lib64/dovecot/libdovecot.so.0(io_loop_handler_run+0xa7) [0x3a88679b27] -> /usr/lib64/dovecot/libdovecot.so.0(io_loop_run+0x38) [0x3a886789c8] Feb 5 09:33:30 buzon4 dovecot: imap(user@domain): Fatal: master: service(imap): child 3459 killed with signal 6 (core dumped) Due to this issue when the user goes into his webmail, he can not see the inbox. If I delete dovecot.* files from the user maildir it gets solved, but usually it happens again, so it's not the solution. Is it any solution for this issue or should I downgrade dovecot to 2.2.10-8.el7.x86_64 again? Thanks and best regards -- *Gonzalo Palacios Goicolea* U.T de Infraestructura de Equipos Centrales /Tecnologías de la Información/ Universidad Autónoma de Madrid • Campus de Cantoblanco <3D"http://www.uam.es/">

1 0

CVE-2019-3814: Suitable client certificate can be used to login as other user
by Aki Tuomi 05 Feb '19

05 Feb '19

Dear subscribers, we're sharing our latest advisory with you and would like to thank everyone who contributed in finding and solving those vulnerabilities. Feel free to join our bug bounty programs (open-xchange, dovecot, powerdns) at HackerOne. Please find patches for v2.2.36 and v2.3.4 attached, or download new version from https://dovecot.org Yours sincerely, Aki Tuomi Open-Xchange Oy Product: Dovecot Vendor: Open-Xchange Oy Internal reference: DOV-2890 (Bug ID) Vulnerability type: Improper Authentication - Generic (CWE287) Vulnerable versions: 1.1.0 - 2.2.36 and 2.3.0 - 2.3.4 Vulnerable component: authentication Report confidence: Confirmed Solution status: Fixed by Vendor Fixed versions: 2.2.36.1, 2.3.4.1 Vendor notification: 2019-01-16 Solution date: 2019-01-20 Public disclosure: 2019-02-05 Researcher Credits: https://hackerone.com/halfdog CVE reference: CVE-2019-3814 CVSS: 8.2 (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N) Vulnerability Details: Normally Dovecot is configured to authenticate imap/pop3/managesieve/submission clients using regular username/password combination. Some installations have also required clients to present a trusted SSL certificate on top of that. It's also possible to configure Dovecot to take the username from the certificate instead of from the user provided authentication. It's also possible to avoid having a password at all, only trusting the SSL certificate. If the provided trusted SSL certificate is missing the username field, Dovecot should be failing the authentication. However, the earlier versions will take the username from the user provided authentication fields (e.g. LOGIN command). If there is no additional password verification, this allows the attacker to login as anyone else in the system. This affects only installations using: auth_ssl_require_client_cert = yes auth_ssl_username_from_cert = yes Attacker must also have access to a valid trusted certificate without the ssl_cert_username_field in it. The default is commonName, which almost certainly exists in all certificates. This could happen for example if ssl_cert_username_field is a field that normally doesn't exist, and attacker has access to a web server's certificate (and key), which is signed with the same CA. Attack can be migitated by having the certificates with proper Extended Key Usage, such as 'TLS Web Server' and 'TLS Web Server Client'. Also, ssl_cert_username_field setting was ignored with external SMTP AUTH, because none of the MTAs (Postfix, Exim) currently send the cert_username field. This may have allowed users with trusted certificate to specify any username in the authentication. This does not apply to Dovecot Submission service. Proof of concept Create a CA certificate for signing, and sign a certificate with missing commoName attribute. With following configuration passdb { driver = static arguments = nopassword } ssl_ca =</path/to/ca.pem auth_ssl_require_client_cert = yes auth_ssl_username_from_cert = yes You are able to log in as any user with this certificate using following commands: openssl s_client -connect server:port -cert /path/to/cert -key /path/to/key a LOGIN anyusername anypassword

1 0