- dovecot - dovecot.org

TCP replication: high connection rate and looping in incomplete state
by tok 16 Jun '18

16 Jun '18

Hi, I am trying to establish TCP(s)-based replication between two FreeBSD 11.1 machines, both running Dovecot 2.2.35 (via pkg) with 10 virtual users and 1.2GB maildir. I followed the Wiki description (https://wiki2.dovecot.org/Replication) just skipped the SSH part. My resulting configurations are attached below. Problem: After reloading both Dovecot instances, a few seconds later they start to initiate connections in an absurdly high rate (30-50 new connections during 10 secs, closing old ones after 2-3 secs) and even after 1 hour they do not „calm down". E-mails are copied, but judging by size and file count, not completely (approx. 1GB and maybe 90% of files are getting synced). What is going on here? On the destination host (with empty storage before replication) I see "incremental - Waiting for dsync to finish“ in dsync-status, constantly flipping between handshake and waiting, for solely 4 out of 10 accounts. Replicator status says 0 requests and 10 total users. On the source host, replicator status says 4 queued full resyncs, 3 waiting failed and 10 total users. I already tried both tcps and tcp; activating debug log did not reveal any errors (e.g. SSL). Would be happy for any advice to track this down. Best regards, tok Config source host: ----- # 2.2.35 (b1cb664): /usr/local/etc/dovecot/dovecot.conf # Pigeonhole version 0.4.23 (b2e41927) # OS: FreeBSD 11.1-RELEASE-p10 amd64 zfs # Hostname: srv1.TLD auth_mechanisms = plain login doveadm_password = # hidden, use -P to show it doveadm_port = 12345 lmtp_save_to_detail_mailbox = yes login_trusted_networks = 172.16.1.110/32 mail_location = maildir:/srv/mail/vhosts/%d/%n mail_plugins = quota mailbox_alias notify replication namespace inbox { […] } passdb { args = scheme=CRYPT username_format=%u /usr/local/etc/dovecot/users driver = passwd-file } plugin { mail_replica = tcps:srv2.TLD:12345 quota = maildir:User quota quota_grace = 10%% quota_max_mail_size = 50M quota_rule = *:storage=1G quota_rule2 = Trash:storage=+10%% quota_rule3 = Junk:storage=+20%% quota_status_nouser = DUNNO quota_status_overquota = 552 5.2.2 Mailbox is over quota / full quota_status_success = DUNNO quota_warning = storage=95%% quota-warning 95 %u quota_warning2 = storage=80%% quota-warning 80 %u quota_warning3 = -storage=100%% quota-warning below %u [...] } postmaster_address = postmaster@TLD quota_full_tempfail = yes service aggregator { fifo_listener replication-notify-fifo { mode = 0666 user = vmail } unix_listener replication-notify { mode = 0666 user = vmail } } service auth-worker { user = $default_internal_user } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } } service config { unix_listener config { user = vmail } } service doveadm { inet_listener { port = 12345 ssl = yes } } service imap-login { process_min_avail = 1 service_count = 1 } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } service pop3-login { process_min_avail = 1 service_count = 1 } service quota-status { client_limit = 1 executable = quota-status -p postfix inet_listener { address = 127.0.0.1 port = 12340 } } service quota-warning { executable = script /usr/local/bin/dovecot-quota-warning.sh user = vmail } service replicator { process_min_avail = 1 unix_listener replicator-doveadm { group = vmail mode = 0666 } } ssl_cert = </usr/local/etc/ssl/acme.sh/srv1.TLD/fullchain.pem ssl_client_ca_file = /etc/ssl/cert.pem userdb { args = username_format=%u /usr/local/etc/dovecot/users driver = passwd-file } protocol lmtp { mail_plugins = quota mailbox_alias notify replication quota sieve } protocol lda { mail_plugins = quota mailbox_alias notify replication sieve } protocol imap { mail_plugins = quota mailbox_alias notify replication imap_quota imap_sieve } ----- Diff config of destination host: ----- 4c4 < # Hostname: srv2.TLD --- > # Hostname: srv1.TLD 9a10 > login_trusted_networks = 172.16.1.110/32 60c61 < mail_replica = tcps:srv1.TLD:12345 --- > mail_replica = tcps:srv2.TLD:12345 156c157 < ssl_cert = </usr/local/etc/ssl/acme.sh/srv1.TLD/fullchain.pem --- > ssl_cert = </usr/local/etc/ssl/acme.sh/srv1.TLD/fullchain.pem -----

1 0

failed: Stream is smaller than expected (0 < 5098)
by Vladimir Tiukhtin 15 Jun '18

15 Jun '18

Hi Looks like I have got in a situation with missing or corrupted attachments. I am getting from time to time lmtp(17147, user1(a)example.com) Error: read(attachments-connector(zlib(/var/spool/mail/example.com/user2/mail/stor… failed: read(/srv/attachments/user2/4a/e0/4ae062027dd745f56c2cc1c43fa4f349f52986a0-2bcf4e063994235bfb4200006f28d014[base64:19 b/l]) failed: Stream is smaller than expected (0 < 5098) Replication works, but is there a way to recover the logic even with empty files or cleaning indices? Thanks Vladimir

2 2

After logrotation Dovecot still writes to old log file
by Michael Heuberger 15 Jun '18

15 Jun '18

Hi there This is weird. On my latest Ubuntu server Dovecot seems to write to /var/log/dovecot.log.1 instead of a recently created /var/log/dovecot.log Here my logrotate config for Dovecot: /var/log/dovecot.log { su root syslog rotate 7 missingok copytruncate create 666 root syslog sharedscripts postrotate doveadm log reopen endscript } Doveadm should reopen it but no, still writes to old log file. Not sure, maybe it's someone else, not dovecot, writing to the log file? And here the versions: # 2.2.33.2 (d6601f4ec): /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.21 (92477967) # OS: Linux 4.14.49-rh65-20180612025235.xenU.x86_64 x86_64 Ubuntu 18.04 LTS How can we investigate best? Or is there a mistake in the above logrotate config? - Michael -- Binary Kitchen Michael Heuberger 1/33 Parrish Road Sandringham Auckland 1025 (New Zealand) Mobile (text only) ... +64 21 261 89 81 Email ................ michael(a)binarykitchen.com Website .............. http://www.binarykitchen.com

3 4

new problem
by Walter Ulmke 14 Jun '18

14 Jun '18

1) my inbox is "Posteingang". should I officially declare it somewhere? I now get the following error messages: Jun 14 00:23:32 ulmke2 dovecot[3981]: imap(ulw)<3997><4O/Xbo1uotLAqGQd>: Error: opendir(/u/ulw/Mail) failed: Permission denied (euid=503(ulw) egid=100(users) UNIX perms appear ok (ACL/MAC wrong?)) Jun 14 00:23:32 ulmke2 dovecot[3981]: imap(ulw)<3997><4O/Xbo1uotLAqGQd>: Error: opendir(/u/ulw/Mail) failed: Permission denied (euid=503(ulw) egid=100(users) UNIX perms appear ok (ACL/MAC wrong?)) Jun 14 00:23:32 ulmke2 dovecot[3981]: imap(ulw)<3997><4O/Xbo1uotLAqGQd>: Error: Couldn't create mailbox list lock /u/ulw/Mail/mailboxes.lock: file_create_locked(/u/ulw/Mail/mailboxes.lock) failed: safe_mkstemp(/u/ulw/Mail/mailboxes.lock) failed: Permission denied Jun 14 00:23:33 ulmke2 dovecot[3981]: Error: imap(ulw)<3997><4O/Xbo1uotLAqGQd>: open(/u/ulw/Mail/dovecot.index.log) failed: Permission denied (euid=503(ulw) egid=100(users) UNIX perms appear ok (ACL/MAC wrong?)) Jun 14 00:23:33 ulmke2 dovecot[3981]: Error: imap(ulw)<3997><4O/Xbo1uotLAqGQd>: Mailbox INBOX: file_dotlock_create(/u/ulw/Mail/dovecot-uidlist) failed: Permission denied (euid=503(ulw) egid=100(users) UNIX perms appear ok (ACL/MAC wrong?)) Jun 14 00:23:33 ulmke2 dovecot[3981]: Error: imap(ulw)<3997><4O/Xbo1uotLAqGQd>: Mailbox INBOX: open(/u/ulw/Mail/dovecot-uidlist) failed: Permission denied Jun 14 00:23:43 ulmke2 dovecot[3981]: Error: imap(ulw)<3997><4O/Xbo1uotLAqGQd>: open(/u/ulw/Mail/dovecot.index.log) failed: Permission denied (euid=503(ulw) egid=100(users) UNIX perms appear ok (ACL/MAC wrong?)) Also, when I start Thunderbird I get the following error message: "der aktuelle Vorgang in "Posteingang" ist fehlgeschlagen. Der Server des Kontos antwortete (Serverbug) Internal error ocurred. Refer to server log WHERE IS THE SERVER LOG? -- -- Best Regards, Walter Ulmke Ulmke Machine Tools, 48496 Hopsten, Germany Tel. ++49/5458/93345-0 Fax. ++49/5458/93345-45 Mobile: ++49/172/5357999 eMail: ulw(a)ulmke.com Dipl.-Ing. Walter Ulmke e.K. AG Steinfurt HRA 4384

5 6

Namespaces for Apple Client
by Janzen, Tobias 14 Jun '18

14 Jun '18

Hi, i have a plesk server with postfix an dovecot. Webmail is roundcube. Version of Dovecot is 2.3.0.1 I want apple clients to use the default special folders. My config for namespaces worked till last week. Now I cant get it to work again. Hope someone can help me. # 2.3.0.1 (ffd8a29): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.0.1 (d33dca20) # OS: Linux 4.4.0-042stab130.1 x86_64 Ubuntu 16.04.4 LTS reiserfs auth_mechanisms = plain login digest-md5 cram-md5 apop auth_username_chars = abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ01234567890&.-_@' disable_plaintext_auth = no first_valid_uid = 30 imap_client_workarounds = delay-newmail imap_logout_format = rcvd=%i, sent=%o mail_home = /var/qmail/mailnames/%Ld/%Ln mail_location = maildir:/var/qmail/mailnames/%Ld/%Ln/Maildir mail_log_prefix = "service=%s, user=%u, ip=[%r]. " mail_plugins = " quota" managesieve_logout_format = rcvd=%i, sent=%o managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext imapflags notify namespace inbox { inbox = yes location = mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Messages" { auto = create special_use = \Sent } prefix = INBOX. separator = . type = private } passdb { driver = plesk } plugin { mail_crypt_global_private_key = <ecprivkey.pem mail_crypt_global_public_key = <ecpubkey.pem mail_crypt_save_version = 2 quota = maildir:User quota quota_grace = 0 sieve = ~/.dovecot.sieve sieve_dir = ~/sieve sieve_extensions = +notify +imapflags } pop3_client_workarounds = outlook-no-nuls oe-ns-eoh pop3_logout_format = rcvd=%i, sent=%o, top=%t/%p, retr=%r/%b, del=%d/%m, size=%s protocols = imap pop3 sieve service auth-worker { group = user = } service auth { group = unix_listener auth-userdb { group = popuser mode = 0600 user = popuser } user = } service imap { process_limit = 1024 service_count = 1 } service pop3 { process_limit = 1024 service_count = 1 } ssl_cert = </etc/dovecot/private/ssl-cert-and-key.pem ssl_cipher_list = HIGH:!aNULL:!MD5 ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it ssl_prefer_server_ciphers = yes userdb { args = uid=popuser gid=popuser driver = static } protocol imap { mail_plugins = " quota imap_quota" } protocol pop3 { pop3_uidl_format = UID%u-%v } protocol lda { mail_plugins = " quota sieve" } HEIM & HAUS Produktion und Vertrieb GmbH Hochstra?e 7-9, 47169 Duisburg Telefon: +49 203 40644-0 Telefax: +49 203 407312 E-Mail: service-du(a)heimhaus.de Internet: http://www.heimhaus.de USt-IdNr.: DE 272301801 Sitz Duisburg, HRB 22438 Gesch?ftsf?hrer: Michael Demming, Dipl.-Ing. Klaus Rappers

1 0

can't login to Dovecot solved
by Walter Ulmke 14 Jun '18

14 Jun '18

solved. It was doen to not being able to log in in "plain" -- -- Best Regards, Walter Ulmke Ulmke Machine Tools, 48496 Hopsten, Germany Tel. ++49/5458/93345-0 Fax. ++49/5458/93345-45 Mobile: ++49/172/5357999 eMail: ulw(a)ulmke.com Dipl.-Ing. Walter Ulmke e.K. AG Steinfurt HRA 4384

1 0

cant login to Dovecot
by Walter Ulmke 13 Jun '18

13 Jun '18

Hi all, I can't login. This is a dovecot server for a small inhouse network, and I doon't use any encryption, and just want to login using the standard Linux login dovecot status gives me the following error messages: un 12 12:30:06 ulmke2 dovecot[5814]: auth: Fatal: APOP mechanism can't be supported with given passdbs Jun 12 12:30:06 ulmke2 dovecot[5811]: master: Error: service(auth): command startup failed, throttling for 32 secs Jun 12 12:30:06 ulmke2 dovecot[5814]: imap-login: Disconnected: Auth process broken (disconnected before auth was ready, waited 10 secs): user=<>, rip=192.168.100.29, lip=192.168.100.2, session=<qXOLWW9uBNPAqGQd> Jun 12 12:30:06 ulmke2 dovecot[5814]: imap-login: Warning: Timeout leak: 0x7fa8a7d372a0 (auth-server-connection.c:397) Jun 12 12:30:16 ulmke2 dovecot[5814]: imap-login: Warning: Auth process not responding, delayed sending initial response (greeting): user=<>, rip=192.168.100.29, lip=192.168.100.2, session=<pw8lWm9uBtPAqGQd> Jun 12 12:30:36 ulmke2 dovecot[5814]: imap-login: Error: Timeout waiting for handshake from auth server. my pid=5874, input bytes=0 Jun 12 12:30:36 ulmke2 dovecot[5814]: imap-login: Disconnected: Auth process broken (disconnected before auth was ready, waited 30 secs): user=<>, rip=192.168.100.29, lip=192.168.100.2, session=<pw8lWm9uBtPAqGQd> Jun 12 12:30:38 ulmke2 dovecot[5814]: auth: Error: stats: open(old-stats-user) failed: Permission denied Jun 12 12:30:38 ulmke2 dovecot[5814]: auth: Fatal: APOP mechanism can't be supported with given passdbs Jun 12 12:30:38 ulmke2 dovecot[5811]: master: Error: service(auth): command startup failed, throttling for 60 secs I'm moving to a new server. stats: open(old-stats-user) failed: Permission denied This file may be somewhere on the old server. Can anyone help me? -- -- Best Regards, Walter Ulmke

4 8

can't login to Dovecot
by Walter Ulmke 13 Jun '18

13 Jun '18

I've managed to turn on "plain" and now it seems I can logon. Jun 13 17:24:20 ulmke2 dovecot[1973]: imap(ulw)<2474><+kyqk4du5M7AqGQd>: Namespace '': Mail storage autodetection failed with home=/u/ulw in=0 out=373 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0 Jun 13 17:24:20 ulmke2 dovecot[1973]: imap-login: Login: user=<ulw>, method=PLAIN, rip=192.168.100.29, lip=192.168.100.2, mpid=2476, session=<GJCrk4du5s7AqGQd> Jun 13 17:24:20 ulmke2 dovecot[1973]: imap(ulw)<2476><GJCrk4du5s7AqGQd>: Error: Namespace '': Mail storage autodetection failed with home=/u/ulw All users mailboxes are $HOME/Mail How do I tell Dovecot this? -- -- Best Regards, Walter Ulmke Ulmke Machine Tools, 48496 Hopsten, Germany Tel. ++49/5458/93345-0 Fax. ++49/5458/93345-45 Mobile: ++49/172/5357999 eMail: ulw(a)ulmke.com Dipl.-Ing. Walter Ulmke e.K. AG Steinfurt HRA 4384

2 1

can't login to Dovecot
by Walter Ulmke 13 Jun '18

13 Jun '18

I have now deleted EVERYTHING and installed fresh. Now at least it starts doveconf -n: managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext namespace inbox { inbox = yes location = passdb { driver = pam } plugin { sieve = file:~/sieve;active=~/.dovecot.sieve } ssl_cipher_list = ALL:!aNULL:!eNULL:!EXPORT:!DES:!3DES:!MD5:!PSK:!RC4:!ADH:!LOW@STRENGTH ssl_options = no_compression ssl_prefer_server_ciphers = yes userdb { driver = passwd } ----------------------------------- looks like PAM is already configured. I CAN'T LOKIN USING PLAIN TEXT. HOW DO i TURN THIS OFF?? -- -- Best Regards, Walter Ulmke Ulmke Machine Tools, 48496 Hopsten, Germany Tel. ++49/5458/93345-0 Fax. ++49/5458/93345-45 Mobile: ++49/172/5357999 eMail: ulw(a)ulmke.com Dipl.-Ing. Walter Ulmke e.K. AG Steinfurt HRA 4384

1 0

Re: 2.3.1 Replication is throwing scary errors
by Thore Bödecker 13 Jun '18

13 Jun '18

Aaaaand I forgot to CC the list, sorry for that, it's way too early in the morning :P On 07.06.18 - 07:39, Thore Bödecker wrote: > What does the output of these two commands show after that error has > been logged? > > doveadm replicator status > > doveadm replicator dsync-status > > If there are *waiting failed* requests, that never make it "through" > (after being temporarily in state *queued failed* and then returning > to *waiting failed*) this means there is something wrong with the > replication. > > You can try forcing replication of all known users using > > doveadm replicator replicate '*' > > And see if that resolves the failed requests, but I doubt it. > > Please let us know how your status outputs look like. > > > Cheers, > Thore > > -- > Thore Bödecker > > GPG ID: 0xD622431AF8DB80F3 > GPG FP: 0F96 559D 3556 24FC 2226 A864 D622 431A F8DB 80F3 > > > On 07.06.18 - 15:21, Reuben Farrelly wrote: > > Still not quite right for me. > > > > Jun 7 15:11:33 thunderstorm.reub.net dovecot: doveadm: Error: > > dsync(lightning.reub.net): I/O has stalled, no activity for 600 seconds > > (last sent=mail, last recv=mail (EOL)) > > Jun 7 15:11:33 thunderstorm.reub.net dovecot: doveadm: Error: Timeout > > during state=sync_mails (send=mails recv=recv_last_common) > > > > I'm not sure if there is an underlying replication error or if the message > > is just cosmetic, though. > > > > Reuben > > > > > > On 7/06/2018 4:55 AM, Remko Lodder wrote: > > > Hi Timo, > > > > > > Yes this seems to work fine so far. I’ll ask the people to add it to the > > > current FreeBSD version.. > > > > > > Cheers > > > Remko > > > > > > > On 6 Jun 2018, at 19:34, Timo Sirainen <tss(a)iki.fi > > > > <mailto:tss@iki.fi>> wrote: > > > > > > > > Should be fixed by https://github.com/dovecot/core/commit/a952e178943a5944255cb7c053d970f8e6d4… > > > > > > >

1 2

2.3.1: Core dump on quota reach
by Tom Sommer 12 Jun '18

12 Jun '18

Just upgraded from 2.2.34 to 2.3.1: Jun 12 16:06:38 lmtp(example(a)example.name)<46176><8JrHEW7TH1tgtAAAd9aEAw>: Info: msgid=<iOIOOFTVyrtapfaoLCJKLCGX2P21E2eVWiGnXPfSSik.ezvWGm_MVMKKL2i0I81WDbYtapg7RisY9PCL91ga0WQ(a)ketopasuse.date>: save failed to INBOX: The email account that you tried to reach is over quota (Mailbox is full). Jun 12 16:06:38 lmtp(example(a)example.name)<46176><8JrHEW7TH1tgtAAAd9aEAw>: Fatal: master: service(lmtp): child 46176 killed with signal 11 (core dumps disabled - https://dovecot.org/bugreport.html#coredumps) And also, unrelated: Jun 12 16:21:32 lmtp(53430): Error: lmtp-server: conn director.local:39204 [6]: Connection lost during data transfer: read(director.local:39204 [6]) failed: <no error> -- Tom

2 1

Race condition when setting flags (\Deleted) + expunge quickly, leaving mails not deleted
by Tomas Forsman 12 Jun '18

12 Jun '18

Hello. I seem to have found a race condition, when setting flags on multiple emails rapidly. 5 commands including login to reproduce. Problem found using mutt in real world usage. Seems to happen both with UID STORE 1:3 and UID STORE 1,2,3 .. I have tried with the following packages, with a minimized config in a throwaway vm: https://packages.debian.org/stretch/dovecot-core Package: dovecot-core (1:2.2.27-3+deb9u2) https://packages.debian.org/stretch-backports/dovecot-core Package: dovecot-core (1:2.2.34-2~bpo9+1) Also tested pristine: https://dovecot.org/releases/2.3/dovecot-2.3.0.1.tar.gz https://dovecot.org/releases/2.2/dovecot-2.2.34.tar.gz https://dovecot.org/releases/2.2/dovecot-2.2.35.tar.gz .. built on Debian9 with: # apt-get build-dep dovecot-core # bash configure --prefix=/scratch/dovecot-test Tried with both mailbox over NFS (backed by ext4), and also mailbox on ext4. On my test systems, I am only able to reproduce it with mbox_lazy_writes=no, but with production settings on a Ubuntu 14.04 with 1:2.2.9-1ubuntu2.4 that has mbox_lazy_writes=yes it is still reproducable with mutt. I have found two different ways to reproduce it with netcat + cut'n'paste, below is done with 2.2.34/35. All servers are VMs in Ganeti/kvm clusters (Debian hosts in one cluster&organization, Ubuntu host in another cluster&organization). Debian minimized config: > doveconf -n # 2.2.34 (874deae): /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.22 (22940fb7) # OS: Linux 4.9.0-6-amd64 x86_64 Debian 9.4 # Hostname: mail2-vm.cs.umu.se auth_mechanisms = plain login auth_verbose = yes debug_log_path = syslog info_log_path = syslog mail_location = mbox:~/Mail:INBOX=/var/mail/%u mail_privileged_group = mail mbox_lazy_writes = no namespace inbox { inbox = yes location = prefix = } passdb { driver = pam } protocols = imap service auth { client_limit = 2500 unix_listener auth-client { group = postfix mode = 0660 } } service imap-login { inet_listener imap { port = 143 } } service imap { executable = imap } ssl = no syslog_facility = local1 userdb { driver = passwd } Attached is a mailbox that can be used to reproduce the problem, called "error-box", anonymized with mbox-anonymize.pl. It was created by sending test messages with mutt 1.7.2 through Dovecot/Postfix/Amavis. **** Method 1, with IDLE: Setup a local account, MY-USER / MY-PASSWORD (replace below). > mkdir Mail > cp error-box Mail/error1 > nc -v localhost 143 Paste the following 3 lines in a go: a0000 LOGIN "MY-USER" "MY-PASSWORD" a0010 SELECT "error1" a0020 IDLE then wait a second.. then paste the following 3 in a go: DONE a0030 UID STORE 1:3 +FLAGS (\Deleted) a0040 EXPUNGE Notice that the results from UID STORE + EXPUNGE gives: * 2 FETCH (UID 2 FLAGS (\Recent)) * 3 FETCH (UID 3 FLAGS (\Recent)) * 1 EXPUNGE * 3 RECENT a0030 OK Store completed (0.004 + 0.000 + 0.003 secs). a0040 OK Expunge completed (0.004 + 0.000 + 0.003 secs). Verify what's left in the mailbox with: a0050 UID FETCH 1:4 FLAGS * 1 FETCH (UID 2 FLAGS (\Recent)) * 2 FETCH (UID 3 FLAGS (\Recent)) * 3 FETCH (UID 4 FLAGS (\Recent)) a0050 OK Fetch completed (0.001 + 0.000 secs). Since 1 to 3 should be \Deleted and then EXPUNGEd, we should only have UID 4 left, not uid 2-4 without Deleted flag. Try same again, but with 1 inserted delay (use a new mailbox name for every test, otherwise UID numbering will vary, indexes etc): > cp error-box Mail/error2 > nc -v localhost 143 Paste the following 3 lines in a go: a0000 LOGIN "MY-USER" "MY-PASSWORD" a0010 SELECT "error2" a0020 IDLE then wait a second.. then paste 1 line: DONE then [newly introduced] wait a second.. then paste 2 lines: a0030 UID STORE 1:3 +FLAGS (\Deleted) a0040 EXPUNGE Notice that the results from UID STORE + EXPUNGE gives: * 1 FETCH (UID 1 FLAGS (\Deleted \Recent)) * 2 FETCH (UID 2 FLAGS (\Deleted \Recent)) * 3 FETCH (UID 3 FLAGS (\Deleted \Recent)) a0030 OK Store completed (0.003 + 0.000 + 0.002 secs). * 3 EXPUNGE * 2 EXPUNGE * 1 EXPUNGE * 1 RECENT a0040 OK Expunge completed (0.003 + 0.000 + 0.002 secs). Verify what's left in the mailbox with: a0050 UID FETCH 1:4 FLAGS * 1 FETCH (UID 4 FLAGS (\Recent)) a0050 OK Fetch completed (0.001 + 0.000 secs). So if I wait some between DONE and UID STORE, it seems to be ok. If I, in the problem-triggering method, change a0030 UID STORE 1:3 +FLAGS (\Deleted) a0040 EXPUNGE to a0030 UID STORE 1:3 +FLAGS (\Deleted) a0035 UID FETCH 1:4 FLAGS a0040 EXPUNGE The untagged responses become: * 1 FETCH (UID 1 FLAGS (\Deleted \Recent)) * 2 FETCH (UID 2 FLAGS (\Deleted \Recent)) * 3 FETCH (UID 3 FLAGS (\Deleted \Recent)) * 4 FETCH (UID 4 FLAGS (\Recent)) * 2 FETCH (UID 2 FLAGS (\Recent)) * 3 FETCH (UID 3 FLAGS (\Recent)) * 1 EXPUNGE * 3 RECENT Full transcript (in&out from screen) from first, failing, run: localhost [127.0.0.1] 143 (imap2) open * OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE AUTH=PLAIN AUTH=LOGIN] Dovecot (Debian) ready. a0000 LOGIN "MY-USERNAME" "MY-PASSWORD" a0010 SELECT "error1" a0020 IDLE a0000 OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE SORT SORT=DISPLAY THREAD=REFERENCES THREAD=REFS THREAD=ORDEREDSUBJECT MULTIAPPEND URL-PARTIAL CATENATE UNSELECT CHILDREN NAMESPACE UIDPLUS LIST-EXTENDED I18NLEVEL=1 CONDSTORE QRESYNC ESEARCH ESORT SEARCHRES WITHIN CONTEXT=SEARCH LIST-STATUS BINARY MOVE SNIPPET=FUZZY] Logged in * FLAGS (\Answered \Flagged \Deleted \Seen \Draft) * OK [PERMANENTFLAGS (\Answered \Flagged \Deleted \Seen \Draft \*)] Flags permitted. * 4 EXISTS * 4 RECENT * OK [UNSEEN 1] First unseen. * OK [UIDVALIDITY 1520944853] UIDs valid * OK [UIDNEXT 5] Predicted next UID a0010 OK [READ-WRITE] Select completed (0.003 + 0.000 + 0.004 secs). + idling DONE a0030 UID STORE 1:3 +FLAGS (\Deleted) a0040 EXPUNGE a0020 OK Idle completed (7.805 + 7.804 + 7.804 secs). * 2 FETCH (UID 2 FLAGS (\Recent)) * 3 FETCH (UID 3 FLAGS (\Recent)) * 1 EXPUNGE * 3 RECENT a0030 OK Store completed (0.004 + 0.000 + 0.003 secs). a0040 OK Expunge completed (0.004 + 0.000 + 0.003 secs). a0050 UID FETCH 1:4 FLAGS * 1 FETCH (UID 2 FLAGS (\Recent)) * 2 FETCH (UID 3 FLAGS (\Recent)) * 3 FETCH (UID 4 FLAGS (\Recent)) a0050 OK Fetch completed (0.001 + 0.000 secs). Full transcript (in&out from screen) from the second, slower, run: localhost [127.0.0.1] 143 (imap2) open * OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE AUTH=PLAIN AUTH=LOGIN] Dovecot (Debian) ready. a0000 LOGIN "MY-USERNAME" "MY-PASSWORD" a0010 SELECT "error2" a0020 IDLE a0000 OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE SORT SORT=DISPLAY THREAD=REFERENCES THREAD=REFS THREAD=ORDEREDSUBJECT MULTIAPPEND URL-PARTIAL CATENATE UNSELECT CHILDREN NAMESPACE UIDPLUS LIST-EXTENDED I18NLEVEL=1 CONDSTORE QRESYNC ESEARCH ESORT SEARCHRES WITHIN CONTEXT=SEARCH LIST-STATUS BINARY MOVE SNIPPET=FUZZY] Logged in * FLAGS (\Answered \Flagged \Deleted \Seen \Draft) * OK [PERMANENTFLAGS (\Answered \Flagged \Deleted \Seen \Draft \*)] Flags permitted. * 4 EXISTS * 4 RECENT * OK [UNSEEN 1] First unseen. * OK [UIDVALIDITY 1520944957] UIDs valid * OK [UIDNEXT 5] Predicted next UID a0010 OK [READ-WRITE] Select completed (0.003 + 0.000 + 0.004 secs). + idling DONE a0020 OK Idle completed (2.830 + 2.829 + 2.829 secs). a0030 UID STORE 1:3 +FLAGS (\Deleted) a0040 EXPUNGE * 1 FETCH (UID 1 FLAGS (\Deleted \Recent)) * 2 FETCH (UID 2 FLAGS (\Deleted \Recent)) * 3 FETCH (UID 3 FLAGS (\Deleted \Recent)) a0030 OK Store completed (0.003 + 0.000 + 0.002 secs). * 3 EXPUNGE * 2 EXPUNGE * 1 EXPUNGE * 1 RECENT a0040 OK Expunge completed (0.003 + 0.000 + 0.002 secs). a0050 UID FETCH 1:4 FLAGS * 1 FETCH (UID 4 FLAGS (\Recent)) a0050 OK Fetch completed (0.001 + 0.000 secs). Transcript from .muttdebug0 when using mutt 1.7.2 against the production server with NFS backed storage, marking message 1-3 for deletion and hitting $ for sync. This is how the problem was first found. [2018-03-12 13:46:28] 5> a0020 IDLE^M [2018-03-12 13:46:28] 5< + idling ... [2018-03-12 13:46:29] Marking 3 messages deleted... [2018-03-12 13:46:29] Expunging messages from server... [2018-03-12 13:46:29] 5> DONE^M a0021 UID STORE 1:3 +FLAGS.SILENT (\Deleted)^M a0022 EXPUNGE^M [2018-03-12 13:46:29] 5< a0020 OK Idle completed (0.001 + 1.634 + 1.633 secs). [2018-03-12 13:46:29] 5< * 2 FETCH (FLAGS (\Recent)) [2018-03-12 13:46:29] Handling FETCH [2018-03-12 13:46:29] FETCH response ignored for this message [2018-03-12 13:46:29] 5< * 3 FETCH (FLAGS (\Recent)) [2018-03-12 13:46:29] Handling FETCH [2018-03-12 13:46:29] FETCH response ignored for this message [2018-03-12 13:46:29] 5< * 1 EXPUNGE [2018-03-12 13:46:29] Handling EXPUNGE [2018-03-12 13:46:29] 5< * 3 RECENT [2018-03-12 13:46:29] 5< a0021 OK Store completed (0.001 + 0.000 + 0.001 secs). [2018-03-12 13:46:29] 5< a0022 OK Expunge completed (0.001 + 0.000 secs). [2018-03-12 13:46:29] IMAP queue drained [2018-03-12 13:46:29] imap_cmd_finish: Expunging mailbox *** Method 2, without IDLE (seems to require that I fetch flags before the wait/store) Copy'n'paste the following: a0000 LOGIN "MY-USER" "MY-PASSWORD" a0010 SELECT "error20" a0015 FETCH 1:4 (UID FLAGS) <wait a second, then paste the next two in one go> a0020 UID STORE 1:3 +FLAGS (\Deleted) a0025 EXPUNGE Gives the following transcript: mail3-vm:~/Mail> nc -v localhost 143 localhost [127.0.0.1] 143 (imap2) open * OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE AUTH=PLAIN AUTH=LOGIN] Dovecot ready. a0000 LOGIN "MY-USER" "MY-PASSWORD" a0010 SELECT "error20" a0015 FETCH 1:4 (UID FLAGS) a0000 OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE SORT SORT=DISPLAY THREAD=REFERENCES THREAD=REFS THREAD=ORDEREDSUBJECT MULTIAPPEND URL-PARTIAL CATENATE UNSELECT CHILDREN NAMESPACE UIDPLUS LIST-EXTENDED I18NLEVEL=1 CONDSTORE QRESYNC ESEARCH ESORT SEARCHRES WITHIN CONTEXT=SEARCH LIST-STATUS BINARY MOVE SNIPPET=FUZZY] Logged in * FLAGS (\Answered \Flagged \Deleted \Seen \Draft) * OK [PERMANENTFLAGS (\Answered \Flagged \Deleted \Seen \Draft \*)] Flags permitted. * 4 EXISTS * 4 RECENT * OK [UNSEEN 1] First unseen. * OK [UIDVALIDITY 1521552107] UIDs valid * OK [UIDNEXT 5] Predicted next UID a0010 OK [READ-WRITE] Select completed (0.001 + 0.000 + 0.001 secs). * 1 FETCH (UID 1 FLAGS (\Recent)) * 2 FETCH (UID 2 FLAGS (\Recent)) * 3 FETCH (UID 3 FLAGS (\Recent)) * 4 FETCH (UID 4 FLAGS (\Recent)) a0015 OK Fetch completed (0.001 + 0.000 secs). a0020 UID STORE 1:3 +FLAGS (\Deleted) a0025 EXPUNGE * 2 FETCH (UID 2 FLAGS (\Recent)) * 3 FETCH (UID 3 FLAGS (\Recent)) * 1 EXPUNGE * 3 RECENT a0020 OK Store completed (0.001 + 0.000 secs). a0025 OK Expunge completed (0.001 + 0.000 secs). /Tomas -- Tomas Forsman, stric(a)cs.umu.se, http://people.cs.umu.se/stric/ `- SysAdmin at Computing Science, University of Umeå

2 3

outlook hangs using TLS
by Vladimir Tiukhtin 11 Jun '18

11 Jun '18

Hello I am using dovecot 2.2.10 on CentOS 7 Any Outlook versions (2007, 2010, 2013...) hang if I tried to use TLS, it works if I switch in client TLS to SSL. Thunderbird works perfect both scenarios Please find debug log mail dovecot[24287]: imap-login: Debug: SSL: where=0x10, ret=1: before/accept initialization [X.X.X.X] mail dovecot[24287]: imap-login: Debug: SSL: where=0x2001, ret=1: before/accept initialization [X.X.X.X] mail dovecot[24287]: imap-login: Debug: SSL: where=0x2002, ret=-1: SSLv2/v3 read client hello A [X.X.X.X] mail dovecot[24287]: imap-login: Debug: SSL: elliptic curve secp384r1 will be used for ECDH and ECDHE key exchanges mail dovecot[24287]: imap-login: Debug: SSL: elliptic curve secp384r1 will be used for ECDH and ECDHE key exchanges mail dovecot[24287]: auth: Debug: auth client connected (pid=24300) mail dovecot[24287]: imap-login: Disconnected (no auth attempts in 31 secs): user=<>, rip=X.X.X.X, lip=X.X.X.X, TLS handshaking: Disconnected, session=<bivt8iNuBgA+A08O> Please find my config # 2.2.10: /etc/dovecot/dovecot.conf # OS: Linux 3.10.0-862.3.2.el7.x86_64 x86_64 CentOS Linux release 7.5.1804 (Core) auth_cache_size = 16 M auth_cache_ttl = 1 days auth_debug = yes auth_mechanisms = plain login auth_username_chars = abcdefghijklmnopqrstuvwxyz.@ auth_verbose = yes default_client_limit = 1024 default_process_limit = 16 doveadm_password = mysecretpasswordsharedamongservers first_valid_uid = 1000 mail_attachment_dir = /srv/attachments mail_attachment_min_size = 4 k mail_debug = yes mail_home = /var/spool/mail/%d/%n mail_location = mdbox:~/mail mail_plugins = replication notify mail_privileged_group = mail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave mbox_write_locks = fcntl namespace inbox { inbox = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Messages" { auto = subscribe special_use = \Sent } mailbox Spam { auto = create special_use = \Junk } mailbox Trash { auto = subscribe special_use = \Trash } mailbox virtual/All { auto = no special_use = \All } prefix = type = private } passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } plugin { sieve = ~/.dovecot.sieve sieve_dir = ~/sieve } protocols = imap lmtp service aggregator { fifo_listener replication-notify-fifo { mode = 0666 user = $default_internal_user } unix_listener replication-notify { mode = 0666 user = $default_internal_user } } service auth { unix_listener auth-userdb { mode = 0666 } } service doveadm { inet_listener { port = 55555 } } service imap-login { inet_listener imap { port = 0 } inet_listener imaps { port = 993 ssl = yes } process_min_avail = 2 service_count = 1 } service imap { client_limit = 0 } service lmtp { unix_listener lmtp { group = postfix mode = 0600 user = postfix } } ssl = required ssl_cert = </etc/letsencrypt/live/mail.example.com/fullchain.pem ssl_dh_parameters_length = 2048 ssl_key = </etc/letsencrypt/live/mail.example.com/privkey.pem ssl_prefer_server_ciphers = yes ssl_protocols = !SSLv2 !SSLv3 TLSv1 TLSv1.1 TLSv1.2 userdb { driver = prefetch } userdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } verbose_ssl = yes protocol imap { imap_client_workarounds = tb-extra-mailbox-sep delay-newmail }

4 6

Doveadm sync: Can't create mailbox mail_public/public: Permission denied if synchronize all the available namespaces
by vkosharskiy＠gmail.com 09 Jun '18

09 Jun '18

I have old dovecot server: (# 2.2.33.2 (d6601f4ec): /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.21 (92477967) # OS: Linux 4.14.15-3.el7xen.x86_64 x86_64 CentOS Linux release 7.4.1708 (Core) and new dovecot server: # 2.3.1 (c5a5c0c82): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.devel (61b47828) # OS: Linux 4.14.47-5.el7xen.x86_64 x86_64 CentOS Linux release 7.5.1804 (Core) I try to sync old server with doveadm sync with parameter -N (Synchronize all the available namespaces) Sync successfull in log, but destination server in log have "Can't create mailbox mail_public/public: Permission denied." Config dumps, logs in attaches.

1 0

Re: 2.3.1 Replication is throwing scary errors
by Reuben Farrelly 09 Jun '18

09 Jun '18

Hi Andy, Funny you say that - I've been testing this very problem for some time today to narrow down the commits where I think the problem started occurring. So far I have been able to roll forward to commit from git: 74ef8506dcb946acc42722683e49fdcb964eed19 >> "doveadm: Unref header search context after use" . So far I have been running on that code for a few hours and I'm not yet seeing the problem, which indicates the issue is probably subsequent to this. I'm of the view that the problem started occurring somewhere between that commit above on 6 March and the final 2.3.1 release on 27 March. There are a lot of changes between those two dates, and testing to narrow down to one specific commit is extremely time consuming. It would be really helpful if even one of the Dovecot developers could comment on this and give us some direction (or candidate commits to investigate) or just let us know if the root cause has been found. This bug is a showstopper and has stopped me tracking master-2.3 for over 3 months now, as I can't test later builds or even upgrade to the 2.3.1 release while replication is so broken. Reuben > Message: 1 > Date: Sun, 6 May 2018 13:21:57 +1000 > From: Andy Weal <andy(a)bizemail.com.au> > To: dovecot(a)dovecot.org > Subject: 2.3.1 Replication is throwing scary errors > Message-ID: <f4274128-350b-9a74-a344-8e6caeffa112(a)bizemail.com.au> > Content-Type: text/plain; charset="utf-8"; Format="flowed" > > Hi all, > > New to the mailing lists but have joined up because of above */2.3.1 > Replication is throwing scary errors > > > /*Brief system configuration > ??? MX1 - Main > ??? ??? Freebsd 11.1-Release-p9 > ??? ??? Hosted on a Vultr VM in Sydney AU > ??? ??? MTA = Postfix 3.4-20180401 > ??? ??? Dovecot = 2.3.1 > ??? ??? File system = ufs > ??? MX2 - Backup > ??? ??? Freebsd 11.1-Release-p9 > ??? ???? Running on bare metal - no VM or jails > ??? ??? MTA = Postfix 3.4-20180401 > ??? ??? Dovecot = 2.3.1 > ??? ??? File system = ufs ( on SSD) > > */ > /*Brief sequence of events > > 1. ??? apx 10 days back upgraded both mx1 and mx2 to dovecot 2.3.1_2 > from 2.3.0 ? (service dovecot stop, portmaster upgrade, service > dovecot start) > 2. ??? both systems ran ok with no errors for 10 days. > 3. ??? Last night I shutdown mx2 and restarted it a few hours later > 4. ??? within minutes i was getting the following types of errors on mx2 > > ???????? May 06 12:56:29 doveadm: Error: Couldn't lock > /var/mail/vhosts/example.net/user1/.dovecot-sync.lock: > fcntl(/var/mail/vhosts/example.net/user1/.dovecot-sync.lock, write-lock, > F_SETLKW) locking failed: Timed out after 30 seconds (WRITE lock held by > pid 1960) > > ? Before i venture down the rabbit hole of fault finding and excess > coffee consumption I was wondering if any of you had any updates on the > problems discussed below. > > > Cheers for now, > Andy > > > > Hi, > > [Formatting is a bit rough, replying from a trimmed digest email] > >> /Message: 1 />/Date: Fri, 6 Apr 2018 15:04:35 +0200 />/From: Michael Grimm <trashcan at ellael.org > <https://dovecot.org/mailman/listinfo/dovecot>> />/To: Dovecot Mailing List <dovecot at dovecot.org > <https://dovecot.org/mailman/listinfo/dovecot>> />/Subject: Re: 2.3.1 Replication is throwing scary errors />/Message-ID: <E7E7A927-68F8-443F-BA59-E66CED8FE878 at ellael.org > <https://dovecot.org/mailman/listinfo/dovecot>> />/Content-Type: text/plain; charset=utf-8 />//>/Reuben Farrelly wrote: />>/From: Michael Grimm <trashcan at ellael.org > <https://dovecot.org/mailman/listinfo/dovecot>> />//>>>/[This is Dovecot 2.3.1 at FreeBSD STABLE-11.1 running in two jails at > distinct servers.] />>>/I did upgrade from 2.2.35 to 2.3.1 today, and I do become pounded by > error messages at server1 (and vice versa at server2) as follows: />>>/| Apr 2 17:12:18 <mail.err> server1.lan dovecot: doveadm: Error: > dsync(server2.lan): I/O has stalled, \ />>>/no activity for 600 seconds (last sent=mail_change, last > recv=mail_change (EOL)) />>>/| Apr 2 17:12:18 <mail.err> server1.lan dovecot: doveadm: Error: Timeout > during state=sync_mails \ />>>/(send=changes recv=mail_requests) />>>/[?] />>>/| Apr 2 18:59:03 <mail.err> server1.lan dovecot: doveadm: Error: > dsync(server2.lan): I/O has stalled, \ />>>/no activity for 600 seconds (last sent=mail, last recv=mail (EOL)) />>>/| Apr 2 18:59:03 <mail.err> server1.lan dovecot: doveadm: Error: Timeout > during state=sync_mails \ />>>/(send=mails recv=recv_last_common) />>>/I cannot see in my personal account any missing replications, *but* I > haven't tested this thoroughly enough. I do have customers being > serviced at these productive servers, *thus* I'm back to 2.2.35 until I > do understand or have learned what is going on. />//>/In my reply to this statement of mine I mentioned that I have seen those > timeouts quite some times during the past year. Thus, I upgraded to > 2.3.1 again, and boom: after some hours I ended up in hanging processes > [1] like (see Remko's mail in addition) ... />//>/doveadm-server: [IP4/6 <USER1> SOME/MAILBOX import:0/0] (doveadm-server) />//>/? at server2 paired with a file like ? />//>/-rw------- 1 vmail dovecot uarch 0 Apr 3 16:52 > /home/to/USER1/.dovecot-sync.lock />//>/Corresponding logfile entries at server2 are like ? />//>/Apr 3 17:10:49 <mail.err> server2.lan dovecot: doveadm: Error: Couldn't > lock /home/to/USER1/.dovecot-sync.lock: \ />/fcntl(/home/to/USER1/.dovecot-sync.lock, write-lock, F_SETLKW) locking > failed: Timed out after 30 seconds \ />/(WRITE lock held by pid 51110) />//>/[1] Even stopping dovecot will not end those processes. One has to > manually kill those before restarting dovecot. />//>/After one day of testing 2.3.1 with a couple of those episodes of > locking/timeout, and now missing mails depending with server your MUA > will connect to, I went back to 2.2.35. After two days at that version I > never had such an episode again. />//>>/It's not just you. This issue hit me recently, and it was impacting />>/replication noticeably. I am following git master-2.3 . />/[...] />>/There is also a second issue of a long standing race with replication />>/occurring somewhere whereby if a mail comes in, is written to disk, is />>/replicated and then deleted in short succession, it will reappear />>/again to the MUA. I suspect the mail is being replicated back from />>/the remote. A few people have reported it over the years but it's not />>/reliable or consistent, so it has never been fixed. />>/And lastly there has been an ongoing but seemingly minor issue />>/relating to locking timing out after 30s particularly on the remote />>/host that is being replicated to. I rarely see the problem on my />>/local disk where almost all of the mail comes in, it's almost always />>/occurring on the replicate/remote system. />//>/It might be time to describe our setups in order to possibly find co > mmon > grounds that might trigger this issue you describe and Rimko and myself > ran into as well. />//>/Servers: Cloud Instances (both identical), around 25ms latency apart. />/Intel Core Processor (Haswell, no TSX) (3092.91-MHz K8-class CPU) />/Both servers are connected via IPsec/racoon tunnels />/OS: FreeBSD 11.1-STABLE (both servers) />/Filesystem: ZFS />/MTA: postfix 3.4-20180401 (postfix delivers via dovecot's LMTP) />/IMAP: dovecot running in FreeBSD jails (issues with 2.3.1, fine with > 2.2.35) />/Replication: unsecured tcp / master-master />/MUA: mainly iOS or macOS mail.app, rarely roundcube / > For me: > > Servers: Main: VM on a VMWare ESXi local system (light > load), local SSD disks (no NFS) > Redundant: Linode VM in Singapore, around 250ms away > Also no NFS. Linode use SSDs for IO. > There is native IPv6 connectivity between both VMs. > As I am using TCPs I don't have a VPN between them - > just raw IPv6 end to end. > OS: Gentoo Linux x86_64 kept well up to date > Filesystem: EXT4 for both > MTA: Postfix 3.4-x (same as you) > IMAP: Dovecot running natively on the machine (no jail/chroot) > Replication: Secured TCP / master-master (but only one master is > actively used for SMTP and MUA access) > MUA: Thunderbird, Maildroid, MS Mail, Gmail client, > Roundcube, LG Mail client on handset etc > >> /I believe it is worthwhile to mention here that I run a poor man's > fail-over approach (round-robin DNS) as follows: />//>/DNS: mail.server.tld resolves to one IP4 and one IP6 address of each > server, thus 4 IP addresses in total / > For me I have a simple pair of servers that replicate mail to each > other. Clients connect to the main server only, which is where mail > comes in. The second one that experiences the problem with locking is > only a redundant server which is a secondary MX, that only gets > occasional SMTP deliveries from time to time. So the amount of > replication back from the "secondary" is very minimal; the vast bulk of > the replication is the primary replicating changes out. > > Reuben >

8 20

sieve, pigeonhole; reject message
by dovecot-user 08 Jun '18

08 Jun '18

Hello everybody. I use the version of dovecot 2.3.0.1 and postfix 3.3.0 on my test computer. Postfix pass incoming messages to Dovecot via the LMTP protocol. I want to understand how to fine tune the "reject" action in sieve-scripts. The task: in my installation I use the translation of a set of aliases into the (hidden) target email address inside postfix (postfix directives: canonical_classes = envelope_recipient; canonical_maps = hash://etc/postfix/canonical), so in dovecot the mails fall into one mailbox; However, the original headers (for example, the alias of the recipient) can be extracted with sieve scripts (the "Received" header). In my case, when I use the "reject" action in the sieve script, dovecot generates a message to the sender with the text: "Your message to <hidden(a)domain.tld> was automatically rejected ..", but this behavior opens the address to the sender of what is hidden behind the alias. Is it possible to redefine the text of the reject message using the extracting values from the "Received" header so that the email address hidden behind the alias does not appear there? Or some other way to customize the reject-message? Thank you.

1 0

dovecot-pigeonhole Missing sieve_imapsieve Plugin?
by Will Foster 07 Jun '18

07 Jun '18

Hi Folks, I am having a problem configuring imapsieve via dovecot-pidgeonhole on CentOS7. After following the docs here: https://wiki2.dovecot.org/Pigeonhole/Sieve/Plugins/IMAPSieve I get: dovecot[22026]: managesieve: Fatal: Plugin 'sieve_imapsieve' not found from directory /usr/lib64/dovecot/sieve dovecot[22026]: doveconf: Error: managesieve-login: dump-capability process returned 89 There doesn't seem to be that plugin present or provided by dovecot-pigeonhole # ls -lah /usr/lib64/dovecot/sieve/ total 56K drwxr-xr-x. 2 root root 46 Jun 5 12:16 . drwxr-xr-x. 7 root root 4.0K Jun 5 12:16 .. -rwxr-xr-x. 1 root root 52K Aug 3 2017 lib90_sieve_extprograms_plugin.so Am I doing something wrong? This is provided via the CentOS EPEL package Here's my system details: * dovecot-pigeonhole-2.2.10-8.el7.x86_64 * CentOS 7.5 on XFS * Rainloop Webmail / Mutt / IMAP access Here's my dovecot -n ------------ # 2.2.10: /etc/dovecot/dovecot.conf managesieve(root): Fatal: Plugin 'sieve_imapsieve' not found from directory /usr/lib64/dovecot/sieve doveconf: Error: managesieve-login: dump-capability process returned 89 # OS: Linux 3.10.0-862.2.3.el7.x86_64 x86_64 CentOS Linux release 7.5.1804 (Core) first_valid_uid = 1000 info_log_path = /var/log/dovecot-info.log log_path = /var/log/dovecot.log mail_location = mbox:~/Mail:INBOX=/home/%u/Mail/INBOX_MAIL mail_privileged_group = mail mbox_write_locks = fcntl namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = %s driver = pam } passdb { driver = pam } plugin { imapsieve_url = sieve://localhost:4190 sieve = file:~/sieve;active=~/.dovecot.sieve sieve_after = /etc/dovecot/sieve-after sieve_dir = ~/sieve sieve_plugins = sieve_imapsieve sieve_extprograms sieve_user_log = ~/.dovecot.sieve.log } protocols = imap sieve sieve service imap-login { inet_listener imap { port = 143 } inet_listener imaps { port = 993 ssl = yes } } service managesieve-login { inet_listener sieve { port = 4190 } process_min_avail = 0 service_count = 1 vsz_limit = 64 M } ssl = required ssl_cert = </etc/pki/tls/certs/example.net.crt ssl_key = </etc/pki/tls/private/example.net.key userdb { driver = passwd } userdb { driver = passwd } protocol lmtp { mail_plugins = " sieve" } protocol lda { mail_plugins = " sieve" } protocol imap { mail_plugins = " imap_sieve" } ------------- Thanks for any guidance here. -- @sadsfae // gpg: A31F27E0 // irc: sadsfae come have a squat at https://hobo.house

2 2

Re: 2.3.1 Replication is throwing scary errors
by Michael Grimm 07 Jun '18

07 Jun '18

Am 2018-06-07 08:48, schrieb Remko Lodder: > On Thu, Jun 07, 2018 at 08:04:49AM +0200, Michael Grimm wrote: >> Conclusion: After 12 hours of running a patched FBSD port I do get >> those >> error messages but replictaion seems to work now. But, I still have >> the >> feeling that there might something else going wrong. > > I agree with that. Are you using the new pkg that ler@ prepared ? That > includes > the patch and is a 'native' package.. Yes, I am running this new port from ler@. And: Thanks for his very fast modification! Regards, Michael

1 0

Shared mailboxes, index files and 'per-user-seen' flags
by Thomas Robers 07 Jun '18

07 Jun '18

Hello, i have a dovecot server version 2.3.1 under CentOS 6.9 and we're using shared mailboxes with index files shared. With this configuration I can see a lot of error messages like: Jun 6 13:20:31 mail dovecot: Error: imap(userA(a)tutech.de)<4513> <onjjWPdtDuLAqG3R>: /export/home/imap/userA(a)tutech.de/shared /userB(a)tutech.de/folder/dovecot.index.pvt view is inconsistent In 10-mail.conf the location setting is: location = maildir:%%h/Maildir:INDEXPVT=%h/shared/%%u I thought setting the index files to "not shared" might help to get rid of the errors, so I changed the setting to: location = maildir:%%h/Maildir:INDEX=%h/shared/%%u:INDEXPVT=%h /shared/%%u like it's mentioned in the Dovecot wiki. But that doesn't work as I expected, because the 'per-user-seen' flags do not work correctly anymore, i think. If UserA, who has UserB as shared mailbox, changes the seen flags of UserBs INBOX, UserBs seen flags are also changed. The other way, if UserB changes seen flags in his INBOX they are not changed in the shared view of UserA. Is this the supposed way to work or do i have an error in the configuration? Any help is appreciated. Thanks, Thomas. Here's my currently used configuration: # 2.3.1 (c5a5c0c82): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.devel (61b47828) # OS: Linux 2.6.32-696.23.1.el6.x86_64 x86_64 CentOS release 6.9 (Final) ext4 # Hostname: mail.tutech.de auth_master_user_separator = * auth_mechanisms = plain login auth_verbose = yes disable_plaintext_auth = no doveadm_password = # hidden, use -P to show it doveadm_port = 12345 imap_max_line_length = 2 M mail_debug = yes mail_location = maildir:/export/home/imap/%Lu/Maildir mail_plugins = acl zlib mail_log notify mail_prefetch_count = 1 mailbox_idle_check_interval = 10 secs managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext namespace { hidden = no ignore_on_failure = no inbox = no list = children location = maildir:%%h/Maildir:INDEXPVT=%h/shared/%%u prefix = shared/%%u/ separator = / subscriptions = yes type = shared } namespace inbox { hidden = no inbox = yes list = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = INBOX/ separator = / type = private } passdb { args = /etc/dovecot/master-users driver = passwd-file master = yes } passdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } plugin { acl = vfile:/etc/dovecot/global-acls:cache_secs=300 acl_shared_dict = file:/export/home/shared-db/shared-mailboxes mail_log_events = append delete undelete expunge copy mailbox_delete mailbox_rename flag_change mail_log_fields = uid box msgid size from flags mail_replica = tcp:mail2.tutech.de sieve = ~/.dovecot.sieve sieve_dir = ~/sieve sieve_global = /var/lib/dovecot/sieve/global/ sieve_user_log = ~/.dovecot.sieve.log zlib_save = gz zlib_save_level = 6 } protocols = imap pop3 lmtp sieve sieve service aggregator { fifo_listener replication-notify-fifo { mode = 0666 user = vmail } unix_listener replication-notify { mode = 0666 user = vmail } } service auth { unix_listener /var/spool/postfix/private/auth { mode = 0666 } unix_listener auth-userdb { group = vmail mode = 0660 user = vmail } } service config { unix_listener config { user = vmail } } service doveadm { inet_listener { port = 12345 } user = vmail } service imap-login { inet_listener imaps { port = 993 ssl = yes } process_limit = 500 process_min_avail = 20 } service imap { executable = imap } service lmtp { inet_listener lmtp { address = 127.0.0.1 port = 24 } } service managesieve-login { inet_listener sieve { port = 4190 } inet_listener sieve_deprecated { port = 2000 } } service pop3-login { inet_listener pop3s { port = 995 ssl = yes } } service pop3 { executable = pop3 } service replicator { unix_listener replicator-doveadm { mode = 0666 } } ssl = required ssl_cert = </etc/pki/dovecot/certs/mail.tutech.de.crt_chain ssl_cipher_list = ALL:!LOW:!SSLv2:!EXP:!aNULL:!EXPORT ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it syslog_facility = local6 userdb { args = /etc/dovecot/dovecot-ldap-userdb.conf.ext driver = ldap } protocol lmtp { mail_plugins = acl zlib mail_log notify sieve } protocol imap { mail_max_userip_connections = 100 mail_plugins = acl zlib mail_log notify imap_zlib imap_acl rawlog_dir = /tmp/rawlog/%u }

2 1

Header DATE field not returned when placed after MIME section
by Xavier Guerin 06 Jun '18

06 Jun '18

Hello, I am using Dovecot 2.2.34p0 on OpenBSD 6.3 stable. I am writting an application using the vmime (http://www.vmime.org) library (x-ref issue: https://github.com/kisli/vmime/issues/199) I noticed through testing over my own e-mail server that in some situations the DATE field is not returned upon ENVELOPE or HEADER.FIELDS request. The e-mails at fault happen to have the DATE field at the very end of the header, after the MIME section. Example 1: Delivered-To: Received: Return-Path: Delivered-To: DKIM-Signature: From: To: Message-ID: Subject: MIME-Version: 1.0 Content-Type: text/html;charset=UTF-8 Content-Transfer-Encoding: 7bit Date: Fri, 01 Jun 2018 17:44:44 -0400 Example 2: Return-Path: Delivered-To: Received: Delivered-To: DKIM-Signature: From: Reply-To: To: Subject: MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="----=_Part_338_1573405959.1527768044781" X-Mailer: EMail_2.0 Date: Fri, 01 Jun 2018 17:36:01 -0400 Thanks in advance for the insight,

3 2

offtopic: Solr compatible IMAP client
by Andy Smith 04 Jun '18

04 Jun '18

Hi, not sure if I'm allowed to go this off topic on here, sorry if not! I've just installed Solr FTS for Dovecot and its great, as is Dovecot! ;) It works perfectly for fast searches using Roundcube, but can anyone suggest any Windows and/or Linux mail clients that work well with IMAP searches rather than doing their own searches on local copies of mails? I've had a look at Thunderbird and you can use IMAP search, buy you have to manually select it from an advanced search dialogue and it seems you cannot make this the default behaviour. I also tried OperaMail but it doesn't appear to work at all (only header is searchable without downloading local copies). I'm pretty sure Outlook will only use its own search engine on its local copy of data. thanks a lot, Andy. PS this guide was really helpful for setting up Solr FTS with a recent release of Solr (I'm using 6.5), might be worth including a link somewhere on the Dovecot wiki?: http://mor-pah.net/2016/08/15/dovecot-2-2-with-solr-6-or-5

4 7

Re: SSL error after upgrading to 2.31
by Aki Tuomi 01 Jun '18

01 Jun '18

You forgot to cc the list. ssl_ca is used only for validating client certificates. ---Aki TuomiDovecot oy -------- Original message --------From: Marc Perkel <marc(a)perkel.com> Date: 21/05/2018 18:25 (GMT+02:00) To: Aki Tuomi <aki.tuomi(a)dovecot.fi> Subject: Re: SSL error after upgrading to 2.31 On 05/21/2018 07:54 AM, Aki Tuomi wrote: Does ssl_cert file contain intermediates? No - but the ssl_ca does. --- Aki Tuomi Dovecot oy -------- Original message -------- From: Marc Perkel <marc(a)perkel.com> Date: 21/05/2018 16:32 (GMT+02:00) To: dovecot(a)dovecot.org Subject: SSL error after upgrading to 2.31 After upgrading to 2.31 I'm getting this error. Not sure what I'm doing wrong. No (No signatures could be verified because the chain contains only one certificate and it is not self signed.) ssl = yes ssl_cert = </etc/exim/certs/ctyme.com.crt ssl_key = </etc/exim/certs/ctyme.com.key ssl_ca = </etc/exim/certs/ca.crt local mail.ctyme.com { protocol imap { ssl_cert = </etc/exim/certs/ctyme.com.crt ssl_key = </etc/exim/certs/ctyme.com.key ssl_ca = </etc/exim/certs/ca.crt } protocol pop3 { ssl_cert = </etc/exim/certs/ctyme.com.crt ssl_key = </etc/exim/certs/ctyme.com.key ssl_ca = </etc/exim/certs/ca.crt } } local mail.junkemailfilter.com { protocol imap { ssl_cert = </etc/exim/certs/junkemailfilter.com.crt ssl_key = </etc/exim/certs/junkemailfilter.com.key ssl_ca = </etc/exim/certs/ca.crt } protocol pop3 { ssl_cert = </etc/exim/certs/junkemailfilter.com.crt ssl_key = </etc/exim/certs/junkemailfilter.com.key ssl_ca = </etc/exim/certs/ca.crt } }

3 9

Struggling with sieve, fileinto and variables.
by Barry Pearce 31 May '18

31 May '18

Hi, Im on Manjaro linux fully up to date running dovecot 2.3.1-2 pigeonhole 0.5.1-2 All is running well except I am having problems with fileinto - it refuses to use variables, and mailboxexists is also failing for me. Im just dealing with plus addressing - should be simple but the behaviour Im experiencing isnt right. require ["variables", "envelope", "fileinto", "subaddress", "mailbox"]; if envelope :matches :detail "to" "*" { set :lower "name" "${1}"; } fileinto :create "folder3"; This works, but changing the last line to: fileinto :create "${name}"; fails and files into inbox. As does: fileinto :create "${1}"; It makes no difference if the fileinto is placed inside the if statement or otherwise. Using sieve-test suggests the basic script it should work and traces show the right action. On a related matter the script Im actually trying to get to work is: require ["variables", "envelope", "fileinto", "subaddress", "mailbox"]; if envelope :matches :detail "to" "*" { set :lower "name" "${1}"; } if mailboxexists "${name}" { fileinto :create "${name}"; } But fails and files in the inbox. Modifying the script to: require ["variables", "envelope", "fileinto", "subaddress", "mailbox"]; if envelope :matches :detail "to" "*" { set :lower "name" "${1}"; } if mailboxexists "${name}" { fileinto :create "folder7"; } else { fileinto :create "folder8"; } Files into folder8. So the mailboxexists is failing. ## Started executing script 'plus-addressing' 3: envelope test 3: starting `:matches' match with `i;ascii-casemap' comparator: 3: getting `to' part from message envelope 3: extracting `detail' part from address <test+folder4(a)test.net> 3: matching value `folder4' 3: with key `*' => 1 3: finishing match with result: matched 3: jump if result is false 3: not jumping 4: set command 7: modify :lower "folder4" => "folder4" 7: assign `name' [0] = "folder4" 7: mailboxexists test 7: mailbox `folder4' cannot be opened 7: some mailboxes are unavailable 7: jump if result is false 7: jumping to line 9 10: fileinto action 10: store message in mailbox `folder8' ## Finished executing script 'plus-addressing' Here folder4 actually does exist - so the sieve-test confirms that issue. Im at a loss as to whats going on. Im particularly perplexed by the difference in behaviour between sieve-test and the result under the live server. Any ideas?

2 3

strange misflagging of incoming mail as trash
by Robb Aley Allan 31 May '18

31 May '18

Setting up postfix/dovecot on a clean FreeBSD cloud server, and have discovered a strange problem resulting from the interaction of Mac OS X Mail and dovecot (using the Maildir file structure). Essentially, under very specific circumstances, Mail somehow tells dovecot that a new incoming message is trash, dovecot marks it as such, and the message effectively vanishes. The specific circumstance is as follows: 1. A message is sent to a server running postfix. It is placed in the Maildir mail structure in the “new” directory. 2. OS X Mail is used to retrieve mail via IMAP, and dovecot transfers the message from “new” to “cur”. 3. OS X Mail has a rule that seeks to transfer an incoming message to a subfolder if the message sender belongs to a group created in the Contacts app (IOW the sender is matched against an OS-internal contacts database). 4. IF the sender is the user, AND the user is in the group against which the rule is compared, the message is marked as trash (suffix “T”) and is never loaded into the mail client, either in the inbox or in the trash folder. For all intents and purposes, it disappears. The connection log shows the following line: "WROTE May 30 23:38:11.960 [kCFStreamSocketSecurityLevelTLSv1_2] -- host:cloud.helical.com -- port:993 -- socket:0x6080004b6c80 -- thread:0x604000678e40 12.3 UID STORE 125 +FLAGS.SILENT (\Deleted)” which appears to be the client instructing dovecot to mark the message as deleted. I have the log files from the connection on both sides, and the console log from the Mac, but can’t understand 1. how Mail decides that the message should be deleted, and 2. why Mail “loses” the message (doesn’t appear in the Trash mailbox or anywhere else). _____ Robb Aley Allan

1 0

imapsieve: mailbox Trash: FLAG event
by Peter Schiffer 30 May '18

30 May '18

Hi all, after upgrade from Dovecot 2.2 to 2.3 I started to see that emails from Trash folder are automatically deleted after ~7 days. Email clients are not configured to automatically expunge or empty trash on log out (I see this behavior for multiple mailboxes, with different clients). With mail_debug enabled, I see this log message for every email that gets deleted from Trash: May 29 08:02:17 hostname dovecot: imap(some@mail)<7725><xxb6+VFtL+JT0CE 8>: Debug: imapsieve: mailbox Trash: FLAG event (changed flags: \Deleted) I have Dovecot 2.3.1 (8e2f634) and Pigeonhole 0.5.1 for sieve. My configuration can be found here: https://github.com/pschiffe/mailcow-dockerized/tree/master/data/conf/dovecot There is enabled support for sieve config in sql, but all sieve tables are empty, and there are no sieve filters for Trash flagging. Do you know how to find the source of that Trash flag event? I need to disable it or to configure it so it deletes emails at least couple of months old. Thanks all, peter

2 1

Re: Fatal: nfs flush requires mail_fsync=always
by Juan C. Blanco 30 May '18

30 May '18

Hello, any news about the attached error? I'm preparing the 2.2 to 2.3 upgrade and having the same error. We have the mail stores in an NFS filer. Regards > On 19.01.2018 11:55, Søren Skou wrote: >> Hiya all, >> >> I'm seeing this "Fatal: nfs flush requires mail_fsync=always" error on >> my testbed. The issue is that from what I can see, mail_fsync is set >> to always : >> >> # doveconf -n | grep mail_fs >> mail_fsync = always >> >> The result is that the client does not connect at all, which is not >> really what I wanted to happen :) >> >> Any idea what is going wrong here? >> >> Best regards >> Søren P. Skou >> >> doveconf -n >> >> # 2.3.1.alpha0 (bdfa22623) [XI:2:2.3.1~alpha0-1~auto+14]: >> /etc/dovecot/dovecot.conf >> # Pigeonhole version 0.5.1.alpha0 (d5f710e0) >> # OS: Linux 4.9.0-4-amd64 x86_64 Debian 9.3 nfs >> auth_worker_max_count = 200 >> dict { >> expire = mysql:/etc/dovecot/dovecot-dict-sql.conf.ext >> quota = mysql:/etc/dovecot/dovecot-dict-sql.conf.ext >> sqlquota = mysql:/etc/dovecot/dovecot-dict-sql.conf.ext >> } >> disable_plaintext_auth = no >> lock_method = dotlock >> mail_fsync = always >> mail_location = maildir:/mnt/virtual_mail/%d/%n >> mail_nfs_index = yes >> mail_nfs_storage = yes >> mail_plugins = quota >> mailbox_list_index = no >> metric imap_select_no { >> event_name = imap_command_finished >> filter { >> name = SELECT >> tagged_reply_state = NO >> } >> } >> mmap_disable = yes >> namespace inbox { >> inbox = yes >> location = >> mailbox Drafts { >> special_use = \Drafts >> } >> mailbox Junk { >> auto = subscribe >> special_use = \Junk >> } >> mailbox Sent { >> special_use = \Sent >> } >> mailbox "Sent Messages" { >> special_use = \Sent >> } >> mailbox Trash { >> special_use = \Trash >> } >> prefix = >> } >> passdb { >> args = /etc/dovecot/dovecot-sql.conf.ext >> driver = sql >> } >> plugin { >> quota = dict:User quota::proxy::sqlquota >> quota_grace = 10%% >> quota_rule = *:storage=1000m:messages=300000 >> quota_rule2 = Trash:storage=+10%%:messages=+10%% >> quota_rule3 = Junk:storage=+20%%:messages=+20%% >> quota_status_nouser = DUNNO >> quota_status_overquota = 552 5.2.2 Mailbox is full >> quota_status_success = DUNNO >> quota_warning = storage=75%%:messages=75%% quota-warning 75 %u >> quota_warning2 = storage=95%%:messages=95%% quota-warning 95 %u >> quota_warning3 = -storage=100%%:messages=100%% quota-warning below %u >> sieve = /etc/dovecot/sieve/default.sieve >> sieve_global_dir = /etc/dovecot/sieve >> } >> protocols = " imap pop3" >> service dict { >> unix_listener dict { >> mode = 0600 >> user = vmail >> } >> } >> service imap { >> executable = imap >> } >> service quota-status { >> client_limit = 1000 >> executable = quota-status -p postfix >> inet_listener { >> address = 127.0.0.1 >> port = 12340 >> } >> } >> service quota-warning { >> executable = script /usr/local/bin/quota-warning.sh >> user = vmail >> } >> ssl_ca = /etc/ssl/certs/ca-root.crt >> ssl_cert = </etc/ssl/certs/stjerne.danskkabeltv.dk-2019.crt >> ssl_cipher_list = TLSv1+HIGH !SSLv2 !RC4 !aNULL !eNULL !3DES-CBC !3DES @STRENGTH >> ssl_dh = # hidden, use -P to show it >> ssl_key = # hidden, use -P to show it >> userdb { >> args = uid=2000 gid=2000 home=/mnt/virtual_mail/%d/%n >> driver = static >> } >> protocol lmtp { >> mail_plugins = quota >> } >> protocol lda { >> mail_plugins = quota >> } >> protocol imap { >> mail_plugins = quota imap_quota >> rawlog_dir = /tmp/rawlog/%u >> } > > Hi! > > Thanks, we'll look into it. > > Aki -- +-------------------------------------------------------------------+ | Juan C. Blanco | | | | Centro de Calculo | | | E.T.S. Ingenieros Informáticos | E-mail: jcblanco(a)fi.upm.es | | Universidad Politécnica de Madrid | | | Campus de Montegancedo | | | Boadilla del Monte | Tel.: (+34) 91 067 2771 | | 28660 MADRID (Spain) | Fax : (+34) 91 336 7412 | +-------------------------------------------------------------------+

2 2

Second rule isn't apply when first rule matches
by daniel_1983＠protonmail.com 30 May '18

30 May '18

Dear list, I want to define two concurrent rules : 1. I want to flag an e-mail containing the word "cloud" in the body 2. I want to move mail sent explicitly to me (as opposed to mail sent to an alias I am part of) going to "INOBX.I must answere this" If I put rule (1) first, everything works as expected. If put rule (2) first, only that rule applies. Here's a small test case you should be able to reproduce on your setup. Let's work on this fake test e-mail : $ cat testmail.eml Date: Mon, 28 May 2018 12:41:53 +0100 From: friend(a)otherdomain.tld To: me(a)mydomain.tld Subject: dur dur la vie mon frère, le cloud c'est le top du top Here's the first, broken version of the script $ cat test.sieve require ["body","fileinto","imap4flags","vacation"]; # rule:[Mail about me] if anyof (header :contains "to" "me(a)mydomain.tld", body :text :contains "ahmed") { fileinto "INBOX.I must answere this"; } # rule:[Mail about the Cloud] if body :text :contains "cloud" { addflag "\\Flagged"; } Let's test it out, the two rules should be applied : $ sieve-test test.sieve testmail.eml Performed actions: * store message in folder: INBOX.I must answere Implicit keep: (none) sieve-test(root): Info: final result: success $ Notice that the last rule isn't applied although it matches. Now we invert the order of the rules and apply the script on the same test e-mail : $ cat test.sieve require ["body","fileinto","imap4flags","vacation"]; # rule:[Mail about the Cloud] if body :text :contains "cloud" { addflag "\\Flagged"; } # rule:[Mail about me] if anyof (header :contains "to" "me(a)mydomain.tld", body :text :contains "ahmed") { fileinto "INBOX.I must answere this"; } Running the test again : $ sieve-test test.sieve testmail.eml Performed actions: * store message in folder: INBOX.I must answere + add IMAP flags: \flagged Implicit keep: (none) sieve-test(root): Info: final result: success $ The IMAP flag was set ! Any ideas ?

2 3

Problem in Pigeonhole sievec
by Thorsten Hater 30 May '18

30 May '18

Dear all, I stumbled upon the following behaviour of Pigeonhole, which I consider to be problematic. A user deployed a Sieve script similar to the following snippet if not anyof (address :is ["from","cc"] ["...", ..., "...@... GARBAGE", ...] { fileinto "inbox.Trash"; stop; } Note the extra line break before GARBAGE. This script is obviously broken, but gets accepted by sievec and only fails later, at runtime with line X: error: found stray carriage-return (CR) character in quoted string started at line X. So, the question is whether line breaks in strings are allowed in general and the runtime error is unavoidable, or should sievec return an error? Best regards, Thorsten

3 3

OAUTH2 + proxying [host=??]
by DevOps 30 May '18

30 May '18

All, We currently use a proxy configuration with an sql query to authenticate and discover which backend server an address belongs to and proxy the connection to that host to authenticate and retrieve mail. We are looking to move to OAUTH2 for authentication and am just trying to figure how how to get that extra host information as part of the passdb query when using this mechanism. Looking at doco if we were running a director setup (which we are not) that process seems to be able to poke that info into response but is there any other way of doing this ? Should we be getting or can we get OAUTH2 to return extra fields and configure the pass_attrs to be host=%{passdb:proxyToHost} or something like that ? Any information/thoughts would be good to hear. rgds Matt

2 1

Bug: Dovecot index loosing sync with FTS despite "fts_autoindex = yes"
by kfx 29 May '18

29 May '18

dovecot 2.2.34 solr 7.2 I only see new messages after typing on the server "doveadm fts rescan -u username" though I've followed the wiki and added "fts_autoindex = yes" in 90-plugin.conf . Subsequent search for the same pattern always gives the same result, ignoring new emails with that particular pattern. Solr is working correctly and the correct search results comes immediately (whatever the searched word) after a "doveadm fts rescan" # doveconf | grep fts mail_plugins = " quota stats fts fts_solr" fts = solr fts_autoindex = yes fts_solr = url=http://localhost:8983/solr/dovecot/ [POP] mail_plugins = " quota stats fts fts_solr sieve virtual" [IMAP] mail_plugins = " quota stats fts fts_solr imap_quota virtual imap_stats"

4 14

Search problem
by Federico Bartolucci 28 May '18

28 May '18

Hello, when doing a simple search through the lucene indexes in some mailboxes (with actually many subfolders) the search terminates after a few seconds with no result and the dovecot log shows this error: Fatal: master: service(imap): child 15433 killed with signal 6 (core not dumped) Any clue about the reasons? the lucene indexes have been already rebuilt and look OK. Regards -federico

3 3

Re: Best mail encryption solution for per-user
by Aki Tuomi 27 May '18

27 May '18

> On 26 May 2018 at 10:36 mail(a)sjemm.net wrote: > > > May 23, 2018 10:10 AM, mail(a)sjemm.net wrote: > > May 23, 2018 9:46 AM, "Aki Tuomi" <aki.tuomi(a)dovecot.fi> wrote: > > > >> On 23.05.2018 10:15, mail(a)sjemm.net wrote: > >> > >>> May 23, 2018 8:31 AM, "Aki Tuomi" <aki.tuomi(a)dovecot.fi> wrote: > >> > >> On 23.05.2018 09:13, mail(a)sjemm.net wrote: > >>> May 20, 2018 8:01 PM, mail(a)sjemm.net wrote: > >>> May 20, 2018 2:47 PM, "Aki Tuomi" <aki.tuomi(a)dovecot.fi> wrote: > >>> On 19 May 2018 at 16:40 mail(a)sjemm.net wrote: > >>> > >>> May 18, 2018 10:01 PM, "Aki Tuomi" <aki.tuomi(a)dovecot.fi> wrote: > >>> On 18 May 2018 at 21:44 mail(a)sjemm.net wrote: > >>> > >>> May 18, 2018 4:43 PM, "Aki Tuomi" <aki.tuomi(a)dovecot.fi> wrote: > >>> On 18 May 2018 at 17:38 mail(a)sjemm.net wrote: > >>> > >>> May 18, 2018 4:05 PM, "Aki Tuomi" <aki.tuomi(a)dovecot.fi> wrote: > >>> On 18 May 2018 at 16:43 mail(a)sjemm.net wrote: > >>> > >>> Hi Tai74 and Aki, > >>> I followed your conversation with interest on how to setup per user encryption in dovecot. > >>> I have setup my dovecot with the following in a conf file: > >>> > >>> ============== > >>> > >>> mail_attribute_dict = file:%h/Maildir/dovecot-attributes > >>> mail_plugins = $mail_plugins mail_crypt > >>> plugin { > >>> > >>> mail_crypt_curve = secp521r1 > >>> > >>> mail_crypt_save_version = 2 > >>> > >>> } > >>> > >>> ============== > >>> > >>> This works nice, all emails are being encrypted and every user/folder has keys. > >>> But as I understood from your conversation these keys are not protected. And I want them to be > >>> protected by the users password used by imap. > >>> > >>> Those passwords are stored in a mysql DB file. ( I used a guide from workaround [dot] org to set up > >>> the DB and postfix/dovecot) > >>> > >>> but how would i set it so, that the users password from the DB is used to encrypt the keys? > >>> > >>> should i use mail_crypt_private_password = ? > >>> how do i point it to the mysql db then? > >>> im unsure about this > >>> > >>> Do you have any hints on this? > >>> > >>> Kind regards, > >>> Zjemm > >>> > >>> The passwords in your MySQL database are, hopefully, not in plaintext. If you want to secure your > >>> user's keys using user's login password, you must have a TOOL that manages this. > >>> > >>> You can use mail_crypt_private_password = %w in (mysql) passdb fields to provide the user's login > >>> password as private password. You might want to run it thru some hash, so %{sha1:password} might be > >>> a good option. > >>> > >>> You can change the key password using 'doveadm mailbox cryptokey', this needs to be done every time > >>> user changes his password. > >>> > >>> Also note that if you go down this road, and the user forgets his password, you will not be able to > >>> recover the emails without backup copy of the private key. > >>> > >>> Aki > >>> > >>> Hi Aki > >>> > >>> I used the following command: > >>> dovecot pw -s SHA256-CRYPT > >>> > >>> the output on the chosen password looks like: {SHA256-CRYPT}$5$Rokc06a7In4SF3bO$OQpGQWqg........ > >>> > >>> This output is used to store in the password fields in the database. So no plain text passwords no > >>> :) > >>> > >>> You can use mail_crypt_private_password = %w in (mysql) passdb fields to provide the user's login > >>> password as private password. > >>> > >>> can you explain this a bit more for me? > >>> > >>> for now i have in the 10-auth.conf file the following: > >>> ============== > >>> passdb { > >>> driver = sql > >>> > >>> # Path for SQL configuration file, see example-config/dovecot-sql.conf.ext > >>> args = /etc/dovecot/dovecot-sql.conf.ext > >>> } > >>> > >>> and: > >>> > >>> userdb { > >>> driver = static > >>> args = uid=vmail gid=vmail home=/var/vmail/%d/%n > >>> } > >>> ============== > >>> > >>> then i have in dovecot-sql.conf.ext > >>> ============== > >>> driver = mysql > >>> connect = host=x.x.x.x dbname=mailserver user=mailuser password=mailpasswordexample > >>> default_pass_scheme = SHA256-CRYPT > >>> password_query = SELECT email as user, password FROM virtual_users WHERE email='%u'; > >>> ============== > >>> Where do i need to set : mail_crypt_private_password = %w ? > >>> > >>> password as private password. You might want to run it thru some hash, so %{sha1:password} might be > >>> a good option. > >>> > >>> the passwords are allready hashed in the DB using: dovecot pw -s SHA256-CRYPT to genereate the has. > >>> so this step isnt nesesary anymore am i right? > >>> > >>> Thank you for your quick response, very helpfull > >>> > >>> Zjemm > >>> > >>> You misunderstood a bit. The idea is to use the *plaintext* password as the password for the > >>> private key. Otherwise anyone could just decrypt it by looking at your database where the hashed > >>> password is.. > >>> > >>> So: > >>> > >>> password_query = SELECT email as user, password, '%w' AS userdb_mail_crypt_private_password FROM > >>> virtual_users WHERE email='%u' > >>> > >>> Aki > >>> > >>> Hi Aki, > >>> > >>> Thank you very much for your help, i realy appreciate that. > >>> > >>> Ok so if i understand it correctly i'll have to use: > >>> > >>> password_query = SELECT email as user, password, '%w' AS userdb_mail_crypt_private_password FROM > >>> virtual_users WHERE email='%u' > >>> > >>> in my dovecot-sql.conf.ext file > >>> > >>> This query selects the user, the password, and %w > >>> > >>> if i run a little query myself: > >>> MariaDB [mailserver]> SELECT email as user, password, '%w' AS userdb_mail_crypt_private_password > >>> FROM virtual_users; > >>> +------------------+----------------------------------+------------------------------------+ > >>> | user | password | userdb_mail_crypt_private_password | > >>> +------------------+----------------------------------+------------------------------------+ > >>> | john(a)example.org | {SHA256-CRYPT}$5$M/GWzmtjsLroRWI | %w | > >>> +------------------+----------------------------------+------------------------------------+ > >>> > >>> %w is a dovecot variable, and stands for the plaintext password, but the password is not stored as > >>> plaintext in the DB, %w get filled with the actual plaintext password by dovecot upon the user that > >>> is typing in the password when authenticating. > >>> > >>> is this correct? > >>> > >>> yes. > >>> > >>> so then i have the username the hashed password en the plaintext password as a result of the query. > >>> > >>> yes > >>> > >>> now userdb_mail_crypt_private_password = the plaintext password > >>> do i need to reference it somewhere? or is userdb_mail_crypt_private_password autmatically used by > >>> the dovecot mail_crypt plugin to encrypt the keys? or should it be mail_crypt_private_password? > >>> > >>> It gets injected into the mail process as 'mail_crypt_private_password', as if it was set in plugin > >>> {} section. > >>> > >>> if i have this setup working i'm going to write a blog post on this topic to share this knowledge > >>> > >>> Thanks again and have a great weekend. > >>> > >>> Zjemm > >>> > >>> Aki > >>> > >>> Hi Aki, > >>> > >>> Cool i'm testing it right now. > >>> I have set up a new mailserver (life is great with lxc containers :) ) > >>> > >>> postfix and dovecot are working like normal > >>> > >>> next i enable mail_crypt > >>> > >>> i did create a file: /etc/dovecot/conf.d/10-mailcrypt.conf > >>> ========================== > >>> mail_attribute_dict = file:%h/Maildir/dovecot-attributes > >>> > >>> mail_plugins = $mail_plugins mail_crypt > >>> > >>> plugin { > >>> mail_crypt_curve = secp521r1 > >>> mail_crypt_save_version = 2 > >>> } > >>> ========================== > >>> > >>> and then i changed the file: /etc/dovecot/dovecot-sql.conf.ext > >>> > >>> so the query is now the new query: > >>> password_query = SELECT email as user, password, '%w' AS userdb_mail_crypt_private_password FROM > >>> virtual_users WHERE email='%u'; > >>> > >>> then i restarted dovecot and postfix and send a test email to the one and only testuser that is in > >>> there. > >>> > >>> when i open the mailbox with the tool mutt, i can see the new email, and when openening the email > >>> the mutt client drops the connection. > >>> > >>> in the log i can see: > >>> > >>> May 19 13:34:48 mailserver1.example.local dovecot[600]: imap-login: Login: user=<john(a)example.org>, > >>> method=PLAIN, rip=::1, lip=::1, mpid=713, TLS, session=<E3PnIY9sNM4AAAAAAAAAAAAAAAAAAAAB> > >>> May 19 13:34:49 mailserver1.example.local dovecot[600]: imap(john(a)example.org): Error: read() > >>> failed: > >>> read(/var/vmail/example.org/john/Maildir/cur/1526736378.M161472P641.mailser…, > >>> =571:2,) failed: Private key not available: Cannot decrypt key > >>> bfc5bb25b1bf64290eea6dc14b516c6a0a25b64551b6e4f0f8677ba7274887cb: error:03070068:bignum > >>> routines:BN_mpi2bn:encoding error (FETCH BODY[] for mailbox INBOX UID 8) > >>> > >>> i think i missed a step, but witch one? > >>> > >>> the userpassword hasnt been changed (that would be the next step in the testing process) > >>> > >>> should i've use doveadm first to encrypt the key with that userpassword? i thought it would do that > >>> on the fly, because the initial keys where only just created when enabling the mail_crypt plugin > >>> > >>> please let me know your thougts > >>> Zjemm > >>> I noticed you replied directly to me, and not to the list, too... fixed that for you. > >>> > >>> mail_crypt_private_password is used when key is created, but if you have created it before using > >>> password, you'll need to encrypt it before turning the setting on. > >>> > >>> Aki > >>> Hi, Ok i'm sorry about that, thank you for fixing that. i'm a bit new to mailing lists :) > >>> > >>> are you a dovecot devoloper? or a enthusiastic user? > >>> > >>> anyway, i managed to get it working now with all your help :) > >>> > >>> to start fresh i did a: > >>> rm -rf /var/vmail/example.org > >>> > >>> so all email is gone, and i assume all dovecot keys are gone that way. > >>> > >>> Then i tried to set a password first: > >>> > >>> root@mailserver1:/var/vmail# doveadm mailbox cryptokey password -u john(a)example.org -n summersun > >>> result: Changed password for 0 key(s) > >>> > >>> (summersun = the password for this user) > >>> > >>> but then it says there are 0 keys, so then i send the test user an email and try to open the > >>> mailbox, i'll get: > >>> > >>> imap(john(a)example.org): Error: read() failed: > >>> read(/var/vmail/example.org/john/Maildir/cur/1526827992.M149712P883.mailser…, > >>> =561:2,) failed: Private key not available: Cannot decrypt key > >>> 71849013a70b0c631c06112077e7c2fe39b0b2737b4933b219793841209d4e7f: error:03070068:bignum > >>> routines:BN_mpi2bn:encoding error > >>> > >>> but hey, now the key's are created, so i tried to set the password again: > >>> > >>> root@mailserver1:/var/vmail# doveadm mailbox cryptokey password -u john(a)example.org -n summersun > >>> result: dcrypt_key_load_private(787701bd677dd69a26842547a3926cbaa625b0b5a91751f06678c3e9708343d9) > >>> failed: password missing > >>> ========= > >>> > >>> Lets start over again, i did a new: > >>> rm -rf /var/vmail/example.org > >>> > >>> i disabled the mail_crypt_private_password in the sql query and send an email to the test user. > >>> now again new keys are generated. > >>> > >>> then i did set the password via doveadm: > >>> > >>> root@mailserver1:/var/vmail# doveadm mailbox cryptokey password -u john(a)example.org -n summersun > >>> result: Changed password for 1 key(s) > >>> > >>> i enabled the mail_crypt_private_password again in the sql query part and now it works :) > >>> > >>> YESSS!!! > >>> > >>> if i now change the password for the user, i cannot read the email anymore. that is what should > >>> happen. > >>> so now i changed the password for this user also with doveadm: > >>> - doveadm mailbox cryptokey password -u john(a)example.org -n qwerty -o summersun > >>> > >>> and now i'm able to read the emails again. so it all works now as expected. > >>> > >>> i have now only one thing remaining. > >>> > >>> when i want to add a new user, i have to somehow: > >>> - create the new user in the mysql DB > >>> - start with dovecot not using mail_crypt_private_password (so disabled) > >>> - send an initial email to let the users mailbox be created and generate the keys > >>> - set the users password with doveadm > >>> - restart dovecot again with mail_crypt_private_password (so enabled) > >>> > >>> but this would be disruptive to existing users, and i would have to script the whole thing as a > >>> "add-new-user" script to make it usable i guess. > >>> > >>> do you know of a more easy way of acomplishing this? > >>> could i use doveadm for all steps, and get around the mail_crypt_private_password disable part? > >>> > >>> or could i add a column in the mysql db called userdb_mail_crypt_private_password and fill that > >>> column with %w for users that allready exist, and empty for new users. > >>> when being empty, it might not set the mail_crypt_private_password for new users > >>> > >>> or is this the wrong way of thinking? > >>> > >>> let me know your thoughts on this. > >>> > >>> And last but not least, i really want to thank you for all your help. It is a really nice > >>> experience. > >>> Bless you! > >>> > >>> Zjemm > >>> Hi Aki, > >>> > >>> You did fix the posting on the mail archive, i can see our conversation on there, all but the last > >>> email i send to you. > >>> Maybe you did not received the last email? > >>> > >>> would you be willing to take a look at my last question in the email See below: > >>> Thank you very much. > >>> > >>> ================================ > >>> i have now only one thing remaining. > >>> > >>> when i want to add a new user, i have to somehow: > >>> - create the new user in the mysql DB > >>> - start with dovecot not using mail_crypt_private_password (so disabled) > >>> - send an initial email to let the users mailbox be created and generate the keys > >>> - set the users password with doveadm > >>> - restart dovecot again with mail_crypt_private_password (so enabled) > >>> > >>> but this would be disruptive to existing users, and i would have to script the whole thing as a > >>> "add-new-user" script to make it usable i guess. > >>> > >>> do you know of a more easy way of acomplishing this? > >>> could i use doveadm for all steps, and get around the mail_crypt_private_password disable part? > >>> > >>> or could i add a column in the mysql db called userdb_mail_crypt_private_password and fill that > >>> column with %w for users that allready exist, and empty for new users. > >>> when being empty, it might not set the mail_crypt_private_password for new users > >>> > >>> or is this the wrong way of thinking? > >>> > >>> let me know your thoughts on this. > >>> > >>> And last but not least, i really want to thank you for all your help. It is a really nice > >>> experience. > >>> Bless you! > >>> > >>> Zjemm > >> > >> If you have mail_crypt_private_password set *when* keys are generated, > >> dovecot should use that password to encrypt the user key. > >> > >> Aki > >>> Hi Aki, > >>> > >>> well, if there is a new email user setup in the mysql DB, and no email has been send to that new > >>> user. at that point there are no keys. > >>> > >>> So trying to set a password on those key's wont work. see: > >>> root@mailserver1:/var/vmail/example.org# doveadm mailbox cryptokey password -u john2(a)example.org -n > >>> qwerty > >>> result: Changed password for 0 key(s) > >>> > >>> the keys need to be generated first. And that only happens when sending a mail to that new user. > >>> Also, at the point of creating the keys, the mail_crypt_private_password should be disabled > >>> otherwise the keys are generated and also encrypted with no user password, and then im unable to > >>> set a new pasword for that key > >>> > >>> How can i set the password before the keys are generated? > >>> or can i manually generate key's and then set the password? > >>> > >>> so at this point i have to do the following: > >> > >> You can use doveadm mailbox cryptokey generate -u user -U > >> > >> to generate a user key. > >> > >> Aki > >> > >>> - create the new user in the mysql DB > >>> - start with dovecot not using mail_crypt_private_password (so disabled) > >>> - send an initial email to let the users mailbox be created and generate the keys > >>> - set the users password with doveadm > >>> - restart dovecot again with mail_crypt_private_password (so enabled) > >>> can i somehow enable the mail_crypt_private_password per user? > >>> because this mysql query always returns: %w > >>> and thus allways sets: userdb_mail_crypt_private_password > >>> SELECT email as user, password, '%w' AS userdb_mail_crypt_private_password FROM virtual_users; > > > > Hi Aki, > > > > You are correct > > > > doveadm mailbox cryptokey generate -u user -U generates the keys, but i have to first remove: > > '%w' AS userdb_mail_crypt_private_password > > from dovecot configuration and restart dovecot. > > > > if i don't do that, the keys are generated, but also somehow encrypted using: no > > password/empty/something else (i don't know) > > > > here you can see that happening: > > > > root@mailserver1:/var/vmail/example.org# doveadm mailbox cryptokey generate -u john2(a)example.org -U > > Folder Public ID > > ✓ <userkey> 53004acf9886f887ca081c83d7392a5aa3fac4b5a20ce013db91a341fb4644c4 > > root@mailserver1:/var/vmail/example.org# doveadm mailbox cryptokey password -u john2(a)example.org -n > > qwerty > > result: dcrypt_key_load_private(53004acf9886f887ca081c83d7392a5aa3fac4b5a20ce013db91a341fb4644c4) > > failed: password missing > > > > it expects an old password wich is never set in my opinion. > > > > so the last part of this setup would be to figure out a way to disable '%w' AS > > userdb_mail_crypt_private_password for new users without manually removing that part from the query > > and restarting dovecot. As that would mean connection interruption while adding new users > > > > if we could add new users to the DB and somehow not give '%w' AS userdb_mail_crypt_private_password > > for that new user in the query, we can add the password afterward, and then enable '%w' AS > > userdb_mail_crypt_private_password in the query for this user > > > > could we add a column in the user db lets say called: encrypted (yes/no) > > > > and then change the existing query: SELECT email as user, password, '%w' AS > > userdb_mail_crypt_private_password FROM virtual_users; > > > > to firrt check if encryption is set to 'yes', if so retrun: > > SELECT email as user, password, '%w' AS userdb_mail_crypt_private_password FROM virtual_users; > > > > if not return: > > SELECT email as user, password FROM virtual_users; > > > > but then in one mysql query so dovecot can work with it > > > > ? > > > Hi Aki, > > would you be willing to respond to my last question i had send to you last week? > its this one: > ================================== > > doveadm mailbox cryptokey generate -u user -U generates the keys, but i have to first remove: > > '%w' AS userdb_mail_crypt_private_password > > from dovecot configuration and restart dovecot. > > > > if i don't do that, the keys are generated, but also somehow encrypted using: no > > password/empty/something else (i don't know) > > > > here you can see that happening: > > > > root@mailserver1:/var/vmail/example.org# doveadm mailbox cryptokey generate -u john2(a)example.org -U > > Folder Public ID > > ✓ <userkey> 53004acf9886f887ca081c83d7392a5aa3fac4b5a20ce013db91a341fb4644c4 > > root@mailserver1:/var/vmail/example.org# doveadm mailbox cryptokey password -u john2(a)example.org -n > > qwerty > > result: dcrypt_key_load_private(53004acf9886f887ca081c83d7392a5aa3fac4b5a20ce013db91a341fb4644c4) > > failed: password missing > > > > it expects an old password wich is never set in my opinion. > > could this be a bug? or am i doing it wrong? if needed i could send in a bug report? > > or might we need to enable the userdb_mail_crypt_private_password "per user" ? > > > > > so the last part of this setup would be to figure out a way to disable '%w' AS > > userdb_mail_crypt_private_password for new users without manually removing that part from the query > > and restarting dovecot. As that would mean connection interruption while adding new users > > > > if we could add new users to the DB and somehow not give '%w' AS userdb_mail_crypt_private_password > > for that new user in the query, we can add the password afterward, and then enable '%w' AS > > userdb_mail_crypt_private_password in the query for this user > > > > could we add a column in the user db lets say called: encrypted (yes/no) > > > > and then change the existing query: SELECT email as user, password, '%w' AS > > userdb_mail_crypt_private_password FROM virtual_users; > > > > to firrt check if encryption is set to 'yes', if so retrun: > > SELECT email as user, password, '%w' AS userdb_mail_crypt_private_password FROM virtual_users; > > > > if not return: > > SELECT email as user, password FROM virtual_users; > > > > but then in one mysql query so dovecot can work with it > > Please let me know your thougts, after this last thing im done :) > also let me know if i can support this project in some way, im willing to contribute > > Zjemm You can select it as userdb_mail_crypt_save_version=0 to disable encryption (it won't disable decryption). You can use value '2' for enabling encryption. DO NOT USE 1. Also I tried the SQL based thing, and if you had EMPTY mail_crypt_private_password, try these to change the password. If the one that works is the second one, let me know =) doveadm mailbox cryptokey password -u testuser -nnewpass -o "" doveadm mailbox cryptokey password -u testuser -nnewpass -o "yes" Aki

1 0

lda / postfix / dovecot -- bounced messages not working
by Scott Ruckh 25 May '18

25 May '18

I saw another thread about this topic, but I did not understand the solution. . . I recently discovered my bounced messages were not getting delivered. Obviously since I was not getting any messages, I thought everything was fine. Anyway, my maillog has entries similar to below for bounced messages: Mar 29 10:48:09 firewall postfix/pipe[9089]: 19565807: to=<myuser(a)my.domain>, relay=dovecot, delay=0.11, delays=0.02/0.01/0/0.08, dsn=5.3.0, status=bounced (command line usage error. Command output: lda: Fatal: Invalid -f parameter: Missing domain ) In the previous thread discussing this issue it mentioned that this was a dovecot error and possibly due to a dovecot 2.3.0 upgrade. I am running dovecot-2.3.0-1.1 on a CentOS 7 server. The solution from the other thread simply stated that the original poster is instead using lmtp instead of lda, or at least that it was I got from the thread. If using lmtp instead of lda is the correct solution, could I get an example of what configuration changes need to be made to make that happen? Otherwise, has anyone else seen this error and know the solution to make it work. My current dovecot configuration for postfix (master.cf) is using the de-facto standard from many web docs: dovecot unix - n n - - pipe flags=DRhu user=vmail:vmail argv=/usr/libexec/dovecot/deliver -f ${sender} -d ${recipient} This is the same configuration that was originally setup and has worked for years; until the bounced message problem was recently discovered. If anyone has seen this error and knows the solution, I would appreciate the help. Thank You. Scott

2 1

last login tracking error
by David Mehler 25 May '18

25 May '18

Hello, I'm running dovecot 2.2 and trying to do last login tracking. I am using a MySQL database. When a user logs in I get this in the log: 2018-04-07 16:55:14 imap(user(a)example.com)<54415><BmevY0hpMN5/AAAB>: Error: last_login_dict: Failed to write value for user user(a)example.com: dict-server returned failure: sql dict: commit failed: Field 'name' doesn't have a default value (reply took 0.018 secs (0.000 in dict wait, 0.009 in other ioloops, 0.001 in locks, async-id reply 0.000 secs ago, started on dict-server 0.006 secs ago, took 0.006 secs)) Here's an excerpt from my dovecot-dict-sql.conf.ext file: map { pattern = shared/last-login/$user table = accounts value_field = last_login value_type = uint fields { username = $user } } The username does have a value. Can anyone see what I've got wrong? Thanks. Dave. doveconf -n 2018-04-07 16:55:14 imap(user(a)example.com)<54415><BmevY0hpMN5/AAAB>: Error: last_login_dict: Failed to write value for user user(a)example.com: dict-server returned failure: sql dict: commit failed: Field 'name' doesn't have a default value (reply took 0.018 secs (0.000 in dict wait, 0.009 in other ioloops, 0.001 in locks, async-id reply 0.000 secs ago, started on dict-server 0.006 secs ago, took 0.006 secs)) # 2.3.1 (8e2f634): /usr/local/etc/dovecot/dovecot.conf # Pigeonhole version 0.5.1 (d9bc6dfe) # OS: FreeBSD 11.1-RELEASE-p4 amd64 # Hostname: localhost auth_cache_size = 24 M auth_cache_ttl = 18 hours auth_default_realm = example.com auth_mechanisms = plain login auth_realms = example.com nickandwill.com dict { acl = mysql:/usr/local/etc/dovecot/dovecot-dict-sql.conf.ext lastlogin = mysql:/usr/local/etc/dovecot/dovecot-dict-sql.conf.ext quota = mysql:/usr/local/etc/dovecot/dovecot-dict-sql.conf.ext } first_valid_gid = 999 first_valid_uid = 999 hostname = mail.example.com imap_idle_notify_interval = 10 mins last_valid_gid = 999 last_valid_uid = 999 lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes lda_original_recipient_header = X-Original-To listen = 127.0.0.1 66.228.47.34 log_path = /var/log/dovecot/dovecot.log log_timestamp = "%Y-%m-%d %H:%M:%S " mail_access_groups = vmail mail_gid = vmail mail_home = /home/vmail/mailboxes/%d/%n mail_location = maildir:~/mail:LAYOUT=fs mail_plugins = acl mail_log notify quota trash virtual welcome zlib mail_privileged_group = vmail mail_server_admin = mailto:postmaster@example.com mail_uid = vmail mailbox_idle_check_interval = 59 secs managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext spamtest spamtestplus virustest editheader imapflags notify imapsieve vnd.dovecot.imapsieve namespace { location = maildir:/home/vmail/public/:CONTROL=~/mail/public:INDEX=~/mail/public mailbox TestFolder { auto = subscribe comment = Public Folder for message sharing } prefix = Public/ separator = / subscriptions = yes type = public } namespace { hidden = no location = maildir:/home/vmail/shared/office/.Maildir:CONTROL=~/.Maildir/control/office:INDEX=~/.Maildir/index/office prefix = office/ separator = / } namespace inbox { inbox = yes location = mailbox Archives { auto = subscribe special_use = \Archive } mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Sent { auto = subscribe special_use = \Sent } mailbox Spam { auto = subscribe autoexpunge = 30 days special_use = \Junk } mailbox Trash { auto = subscribe autoexpunge = 30 days special_use = \Trash } mailbox virtual/All { comment = All my messages special_use = \All } prefix = separator = / type = private } namespace virtual { location = virtual:/usr/local/etc/dovecot/virtual:INDEX=~/virtual:CONTROL=~/virtual prefix = virtual/ separator = / } passdb { args = /usr/local/etc/dovecot/dovecot-sql.conf.ext driver = sql } plugin { acl = vfile:/usr/local/etc/dovecot/global-acls:cache_secs=300 acl_anyone = allow acl_globals_only = yes acl_shared_dict = proxy::acl fts = lucene fts_autoindex = yes fts_autoindex_max_recent_msgs = 80 fts_index_timeout = 90 fts_lucene = whitespace_chars=@. normalize no_snowball imapsieve_mailbox1_before = file:/home/vmail/sieve/global/learn-spam.sieve imapsieve_mailbox1_causes = COPY imapsieve_mailbox1_name = Spam imapsieve_mailbox2_before = file:/home/vmail/sieve/global/learn-ham.sieve imapsieve_mailbox2_causes = COPY imapsieve_mailbox2_from = Spam imapsieve_mailbox2_name = * last_login_dict = proxy::lastlogin last_login_key = last-login/%n mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename mail_log_fields = uid box msgid size quota = dict:User quota::proxy::quota quota_exceeded_message = Storage quota for this account has been exceeded, please try again later. quota_grace = 10%% quota_status_nouser = DUNNO quota_status_overquota = 552 5.2.2 Mailbox is full quota_status_success = DUNNO quota_vsizes = true quota_warning = storage=100%% quota-exceeded 100 %u quota_warning2 = storage=95%% quota-warning 95 %u quota_warning3 = storage=90%% quota-warning 90 %u quota_warning4 = storage=85%% quota-warning 85 %u quota_warning5 = storage=75%% quota-warning 75 %u sieve = ~/.dovecot.sieve sieve_before = /home/vmail/sieve/before.d sieve_default = /home/vmail/sieve/default.sieve sieve_dir = ~/sieve sieve_extensions = +notify +imapflags +spamtest +spamtestplus +virustest +editheader sieve_global_dir = /home/vmail/sieve sieve_global_extensions = +vnd.dovecot.pipe +vnd.dovecot.execute +vnd.dovecot.environment sieve_max_redirects = 30 sieve_max_script_size = 1M sieve_pipe_bin_dir = /home/vmail/sieve sieve_plugins = sieve_imapsieve sieve_extprograms sieve_spamtest_max_header = X-Spamd-Result: default: [[:alnum:]]+ \[-?[[:digit:]]+\.[[:digit:]]+ / (-?[[:digit:]]+\.[[:digit:]]+)\] sieve_spamtest_status_header = X-Spamd-Result: default: [[:alnum:]]+ \[(-?[[:digit:]]+\.[[:digit:]]+) / -?[[:digit:]]+\.[[:digit:]]+\] sieve_spamtest_status_type = score sieve_user_log = /home/vmail/sieve/sieve_error.log sieve_virustest_status_header = X-Virus-Scan: Found to be (.+)\. sieve_virustest_status_type = text sieve_virustest_text_value1 = clean sieve_virustest_text_value5 = infected trash = /usr/local/etc/dovecot/trash.conf welcome_script = welcome %u postmaster@%d welcome_wait = yes } postmaster_address = postmaster(a)example.com protocols = imap lmtp sieve sendmail_path = /usr/local/sbin/sendmail service auth-worker { user = vmail } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0666 user = postfix } unix_listener auth-userdb { group = vmail mode = 0666 user = vmail } } service dict { unix_listener dict { group = vmail mode = 0660 user = vmail } user = root } service imap-login { inet_listener imap { address = 127.0.0.1 } inet_listener imaps { address = 66.228.47.34 port = 993 ssl = yes } } service imap-postlogin { executable = script-login /usr/local/etc/dovecot/trackauth.sh user = vmail } service imap { executable = imap } service lmtp { executable = lmtp unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0666 user = postfix } } service managesieve-login { inet_listener sieve { address = 127.0.0.1 port = 4190 } } service quota-status { client_limit = 1 executable = quota-status -p postfix unix_listener /var/spool/postfix/private/dovecot-quota { group = postfix mode = 0660 user = postfix } } service quota-warning { executable = script /usr/local/etc/dovecot/quota-warning.sh unix_listener quota-warning { group = vmail mode = 0660 user = vmail } user = vmail } service welcome { executable = script /usr/local/etc/dovecot/welcome.sh unix_listener welcome { user = vmail } user = vmail } ssl = required ssl_cert = </usr/local/etc/ssl/acme/example.com/fullchain.pem ssl_cipher_list = ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256 ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it ssl_min_protocol = TLSv1.2 ssl_prefer_server_ciphers = yes userdb { args = /usr/local/etc/dovecot/dovecot-sql.conf.ext driver = sql } protocol lmtp { info_log_path = /var/log/dovecot/dovecot-lmtp.log log_path = /var/log/dovecot/dovecot-lmtp-errors.log mail_plugins = acl mail_log notify quota trash virtual welcome zlib sieve } protocol lda { mail_plugins = acl mail_log notify quota trash virtual welcome zlib sieve } protocol imap { mail_max_userip_connections = 20 mail_plugins = acl mail_log notify quota trash virtual welcome zlib imap_acl imap_quota imap_sieve imap_zlib last_login fts fts_lucene } protocol sieve { info_log_path = /var/log/dovecot/dovecot-sieve.log log_path = /var/log/dovecot/dovecot-sieve-errors.log }

2 1

Bug: subscriptions file
by Rupert Gallagher 24 May '18

24 May '18

Dovecot does not clear the subscription file from non-existent folders.

5 10

question on setting ulimit on debian
by Sophie Loewenthal 24 May '18

24 May '18

Hi, I’ve been trying to increase the number of open files for the dovecot user on Debian 9 and have so far, failed! I’ve tried this: # cat /etc/security/limits.d/limits_dovecot.conf dovecot soft nofile 2048 dovecot hard nofile 8192 # cat /etc/systemd/system/dovecot.service.d/service.conf LimitNOFILE=8192 But to no avail: # prlimit -p 27208|grep -i nofile NOFILE max number of open files 1024 4096 files Lost me :( Any ideas? Thanks,Sophie.

2 2

Dovecot send duplicated certificates when using ssl_alt_cert
by Jean-Daniel Dupas 24 May '18

24 May '18

Hello, I'm running dovecot 2.3.1 (c5a5c0c82) and trying to experiment with using both RSA and ECDSA certificates. My configuration is as follow: ssl_alt_cert = </path/to/my.rsa.key ssl_alt_key = </path/to/my.rsa.key ssl_cert = </path/to/my.ecdsa.pem ssl_key = </path/to/my.ecdsa.key Both certificates are let's encrypt certificate, so both are using the same intermediate CA. The certificate chain are: for rsa: - my certificate - Let's Encrypt Authority X3 - DST Root CA X3 for ecdsa: - my certificate - Let's Encrypt Authority X3 - DST Root CA X3 My problem is that when connecting, dovecot includes 2 copies of Let's Encrypt Authority X3 in the certificate chain. I think this is a bug. When building the chain, dovecot should ignore duplicated certificates and when opening the connection, it should only send intermediates related to the used certificate (either RSA or ECDSA). (and as a side note, when using dovecot -n, dovecot hides the ssl_key (ssl_key = # hidden, use -P to show it) but not the ssl_alt_key. This is probably a bug too). --------------- openssl s_client -showcerts -host imap.example.com -port 993 -servername imap.example.com CONNECTED(00000005) depth=1 C = US, O = Let's Encrypt, CN = Let's Encrypt Authority X3 verify error:num=20:unable to get local issuer certificate verify return:0 --- Certificate chain 0 s:/CN=imap.example.com i:/C=US/O=Let's Encrypt/CN=Let's Encrypt Authority X3 -----BEGIN CERTIFICATE----- MIIHPDCCBiSgAwIBAgISA2e3bP2o1mpdOr9kTDm/R/zuMA0GCSqGSIb3DQEBCwUA … -----END CERTIFICATE----- 1 s:/C=US/O=Let's Encrypt/CN=Let's Encrypt Authority X3 i:/O=Digital Signature Trust Co./CN=DST Root CA X3 -----BEGIN CERTIFICATE----- MIIEkjCCA3qgAwIBAgIQCgFBQgAAAVOFc2oLheynCDANBgkqhkiG9w0BAQsFADA/ MSQwIgYDVQQKExtEaWdpdGFsIFNpZ25hdHVyZSBUcnVzdCBDby4xFzAVBgNVBAMT … -----END CERTIFICATE----- 2 s:/C=US/O=Let's Encrypt/CN=Let's Encrypt Authority X3 i:/O=Digital Signature Trust Co./CN=DST Root CA X3 -----BEGIN CERTIFICATE----- MIIEkjCCA3qgAwIBAgIQCgFBQgAAAVOFc2oLheynCDANBgkqhkiG9w0BAQsFADA/ MSQwIgYDVQQKExtEaWdpdGFsIFNpZ25hdHVyZSBUcnVzdCBDby4xFzAVBgNVBAMT … -----END CERTIFICATE----- --- Server certificate subject=/CN=imap.example.com issuer=/C=US/O=Let's Encrypt/CN=Let's Encrypt Authority X3 --- No client certificate CA names sent --- SSL handshake has read 5140 bytes and written 468 bytes --- New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES256-GCM-SHA384 Server public key is 4096 bit Secure Renegotiation IS supported Compression: NONE Expansion: NONE No ALPN negotiated SSL-Session: Protocol : TLSv1.2 Cipher : ECDHE-RSA-AES256-GCM-SHA384 Session-ID: 591240C021A02B399CCB010F37AF7AD83227DC1770C606F73B3EEA3514AF07FB Session-ID-ctx: Master-Key: 7D5A5BFC1B4B8EECF4F41DC084265AF6D32B82130F381B8DDF685B589D54D9BDEBFC20F1DD80E150CD56850C0D062E9E TLS session ticket lifetime hint: 300 (seconds) TLS session ticket: 0000 - 3a 72 98 05 72 af 3d ed-26 a9 e7 2b 68 6b 0a 25 :r..r.=.&..+hk.% … Start Time: 1526482021 Timeout : 300 (sec) Verify return code: 0 (ok) ---

3 3

Re: lazy_expuge + mdbox
by Matt Bryant 24 May '18

24 May '18

To a degree I agree .. given mdbox doesnt delete until purge .. but then would be nice if purge took a dovecot search rather than just ditch everything with refcount=0 ... in that way could say purge everything thats been marked as delete according to a specified criteria. rgds Matt completly unrelated moved mailserver back home and listed on cyren so atm getting bounced by dovecot.fi .. have requested de-listing > Aki Tuomi <mailto:aki.tuomi@dovecot.fi> > 24 May 2018 at 3:35 pm > > I am not sure if lazy expunge makes much sense with mdbox, at least if > you use the same mdbox storage with it. It might make sense with > separate mdbox/sdbox/something for .EXPUNGED. > > Aki > Matt Bryant <mailto:matt@the-bryants.net> > 24 May 2018 at 11:53 am > So moving on from earlier issue now looking at converting mail inbox to > mdbox and keeping lazy_expunge as mdbox also .. but again seeing some > wierdness so questions .... > > 1) When i purge trash folder I seem to get 2 copies of the message in > .EXPUNGED/Trash folder .. however if I set > lazy_expunge_only_last_instance = yes then dont seem to get ANY copy .. > just nothing. > > 2) If I go into Trash and delete a message ... then it does not get > moved .. I assume that a delete in Trash is not actually an expunge on > TB and hence does get caught by the plugin. > > 3) Since mdbox doesnt delte anything anyway until purged would it be > better not to use lazy-expunge but just have a job that moves any > messages in mdbox_deleted: storage to the hidden .EXPUNGED namespace .. > does doveadm move work with mdbox_deleted ??? > > any help appreciated > > rgds > > Matt

2 1

lazy_expuge + mdbox
by Matt Bryant 24 May '18

24 May '18

So moving on from earlier issue now looking at converting mail inbox to mdbox and keeping lazy_expunge as mdbox also .. but again seeing some wierdness so questions .... 1) When i purge trash folder I seem to get 2 copies of the message in .EXPUNGED/Trash folder .. however if I set lazy_expunge_only_last_instance = yes then dont seem to get ANY copy .. just nothing. 2) If I go into Trash and delete a message ... then it does not get moved .. I assume that a delete in Trash is not actually an expunge on TB and hence does get caught by the plugin. 3) Since mdbox doesnt delte anything anyway until purged would it be better not to use lazy-expunge but just have a job that moves any messages in mdbox_deleted: storage to the hidden .EXPUNGED namespace .. does doveadm move work with mdbox_deleted ??? any help appreciated rgds Matt

1 0

Released Pigeonhole v0.4.24 for Dovecot v2.2.36.
by Stephan Bosch 24 May '18

24 May '18

Hello Dovecot users, Here is the Pigeonhole release that goes with the new Dovecot v2.2.36 release. Apart from the changes that were already in the RC, this final release adds one new feature: a plugin for the IMAP FILTER=SIEVE capability. The is a vendor-defined feature that adds the ability to manually invoke Sieve filtering in IMAP. Changelog v0.4.24: + Implement plugin for the a vendor-defined IMAP capability called "FILTER=SIEVE". It adds the ability to manually invoke Sieve filtering in IMAP. More information can be found in doc/plugins/imap_filter_sieve.txt. - Fix assert panics triggered by empty messages that are being forwarded using redirect or vnd.dovecot.report. This does not likely normally occur, but this is seen as a result of certain benign failures in object storage. - Make the length of the subject header for the vacation response configurable and enforce the limit in UTF-8 codepoints rather than bytes. The subject header for a vacation response was statically truncated to 256 bytes, which is too limited for multi-byte UTF-8 characters. - Sieve editheader extension: Fix assertion panic occurring when it is used to manipulate a message header with a very large header field. - Properly abort execution of the sieve_discard script upon error. Before, the LDA Sieve plugin attempted to execute the sieve_discard script when an error occurs. This can lead to the message being lost. - Fix the interaction between quota and the sieve_discard script. When quota was used together with a sieve_discard script, the message delivery did not bounce when the quota was exceeded. The release is available as follows: https://pigeonhole.dovecot.org/releases/2.2/dovecot-2.2-pigeonhole-0.4.24.t… https://pigeonhole.dovecot.org/releases/2.2/dovecot-2.2-pigeonhole-0.4.24.t… Refer to http://pigeonhole.dovecot.org and the Dovecot v2.x wiki for more information. Have fun testing this release and don't hesitate to notify me when there are any problems. Regards, -- Stephan Bosch stephan(a)rename-it.nl

1 0

Autofile Junk for all users
by ＠lbutlr 23 May '18

23 May '18

How would I get the rule if header :contains "X-spam-flag" "YES" { fileinto "Junk"; } To apply to all users mail at delivery time?

4 4

Creating users on the fly, for testing?
by Eric Abrahamsen 23 May '18

23 May '18

I'm trying to set up a reproducible test environment for a MUA I'm working on, with accounts and dummy data that can be trashed and restored while testing. I'd like to exercise the IMAP client part of the MUA, and am looking into using a local dovecot instance to do that. I'm trying to make this as minimal-config as possible: ideally the test environment could create a dummy (virtual) user, insert dummy message data, allow the MUA to log in and manipulate the messages, and then destroy both user and message data at the end of the session. I have the sense that I'll be able to get there by shipping a custom config file along with the test library, that sets up a virtual user with a mail_location under /tmp, and then all operations are done with dovecot -c customconfig.conf Then the temp folder is trashed at the end of the session. Is this likely to work? Is anything likely to bite me? Thanks, Eric

1 0

v2.2.36 released
by Timo Sirainen 23 May '18

23 May '18

https://dovecot.org/releases/2.2/dovecot-2.2.36.tar.gz https://dovecot.org/releases/2.2/dovecot-2.2.36.tar.gz.sig This is the last planned v2.2.x release. We didn't fix everything reported (especially build changes) to try to minimize any unexpected breakages. v2.3.2 will be out with a lot of fixes hopefully in a few weeks. That will start becoming the recommended version to run then. * login-proxy: If ssl_require_crl=no, allow revoked certificates. Also don't do CRL checks for incoming client certificates. * stats plugin: Don't temporarily enable PR_SET_DUMPABLE while opening /proc/self/io. This may still cause security problems if the process is ptrace()d at the same time. Instead, open it while still running as root. + doveadm: Added mailbox cache decision&remove commands. See doveadm-mailbox(1) man page for details. + doveadm: Added rebuild attachments command for rebuilding $HasAttachment or $HasNoAttachment flags for matching mails. See doveadm-rebuild(1) man page for details. + cassandra: Use fallback_consistency on more types of errors - cassandra: Fix consistency=quorum to work - dsync: Lock file generation failed if home directory didn't exist - In some configs if namespace root directory didn't yet exist, Dovecot failed to create mailboxes.lock when trying to create mailboxes - Snippet generation for HTML mails didn't ignore &entities inside blockquotes, producing strange looking snippets. - imapc: Fix assert-crash if getting disconnected and after reconnection all mails in the selected mailbox are gone. - pop3c: Handle unexpected server disconnections without assert-crash - fts: Fixes to indexing mails via virtual mailboxes. - fts: If mails contained NUL characters, the text around it wasn't indexed. - Obsolete dovecot.index.cache offsets were sometimes used. Trying to fetch a field that was just added to cache file may not have always found it. - dict-sql: Fix crash when reading NULL value from database

1 0

XMPP notifications
by André Rodier 23 May '18

23 May '18

Hello all, What is the best way, using sieve, to send XMPP notifications? I am using Debian Stretch, with Dovecot core / sieve packages version 2.2.27-3+deb9u2. Should I use the enotify extension, or a script with extprograms extension? Thanks for your answers. -- André Rodier

2 2

Re: Lmtp issues on dovecot 2.3.x with big messages
by Michael Tratz 23 May '18

23 May '18

> >> Messages are being sent to dovecot LMTP by postfix. If I change this email > >> to another server with dovecot 2.2.x the same message are delivered > >> immediately. > > Confirmed. Starts to fail here around 30Mb. Tested with Swaks. > > > > Working on a fix... > > Problem found. It is an explicit limit of 40Mb (for the 30Mb I saw in my > tests, there was also a base64 encoding I forgot about). > > Will fix both the unhelpful error and the fact that there should be no > limit (currently) for LMTP. > Stephan, I’m having the same issue with LMTP and large messages with dovecot 2.3.x. Can you tell me which commit fixes this issue? I looked through the GitHub commits, but it’s not clear to me which commit fixes this issue. I’d like to apply the patch and re-compile dovecot for my machines instead of having to downgrade to 2.2.35. Thanks, Michael

3 3

lazy_expunge ...
by Matt Bryant 23 May '18

23 May '18

So I decided to configure this plugin and take it for a test drive .. configured using mdbox (main namespace is Maildir) .. So as per Wiki have the following namespaces defined ... location is held within db ... but basically Maildir:~/Maildir for inbox namespace ==== 8< =============== namespace inbox { list = yes type = private inbox = yes prefix = INBOX/ separator = / mailbox Drafts { auto = create special_use = \Drafts } mailbox Spam { auto = create special_use = \Junk } mailbox Trash { auto = create special_use = \Trash } mailbox Sent { auto = create special_use = \Sent } mailbox Archive { auto = create special_use = \Archive } } namespace lazyexpunge { prefix = .EXPUNGED/ hidden = yes list = children subscriptions = no separator = / location = mdbox:~/mdbox:INDEX=~/mdbox:MAILBOXDIR=expunged:LISTINDEX=expunged.list.index } ==================== Can see its working since can see files in the mdbox storage along with indexs etc ... but there seems little to no documentation on how to delete from the expunged namespace and atm trying to even search doesnt seem to work .. doveadm -Dvvv search -u matt(a)the-bryants.net mailbox .EXPUNGED/* subject space gets errors below .. and although says refer to server log .. nothing in there either .. mail_debug is on ... doveadm(matt(a)the-bryants.net): Debug: fts: Indexes disabled for namespace '' doveadm(matt(a)the-bryants.net): Debug: .EXPUNGED/Trash: Mailbox opened because: search doveadm(matt(a)the-bryants.net): Error: fts: Failed to sync mailbox .EXPUNGED: Mailbox doesn't exist: .EXPUNGED doveadm(matt(a)the-bryants.net): Error: Searching mailbox .EXPUNGED/Trash failed: Internal error occurred. Refer to server log for more information. [2018-05-23 15:07:21] doveadm(matt(a)the-bryants.net): Debug: .EXPUNGED/Trash/cobbler: Mailbox opened because: search doveadm(matt(a)the-bryants.net): Error: fts: Failed to sync mailbox .EXPUNGED: Mailbox doesn't exist: .EXPUNGED doveadm(matt(a)the-bryants.net): Error: Searching mailbox .EXPUNGED/Trash/cobbler failed: Internal error occurred. Refer to server log for more information. [2018-05-23 15:07:21] Any ideas is there any better doco around this plugin and use etc ... thanks & rgds Matt

2 6

Upgrading dovecot 2.2 to 2.3 without downtime when using proxy/director?
by Niels Kobschätzki 23 May '18

23 May '18

Hi, I have a setup with several dovecot-servers (2.2.35) and I use dovecot proxy. I upgraded one server to 2.3.1 and got the configs fixed so far that it started again. But when I tried to add it into the proxying again with "doveadm director add" I see the following in the logfiles: May 6 07:19:30 host dovecot: director: Warning: Director xxx.xxx.xxx.176:9090/out disconnected us with reason: Invalid input: OPTIONS May 6 07:19:30 $host dovecot: director: Connecting to xxx.xxx.xxx.171:9090 (as xxx.xxx.xxx.176): Reconnecting after error xxx.xxx.xxx.176 is the upgraded host, xxx.xxx.xxx.171 is one of the other hosts (the applicable hosts are in the range xxx.xxx.xxx.171-176). Do I have to remove all the hosts from the proxy, upgrade them and then add them again? Or is there a way to handle the upgrade without a downtime? After all one of the reasons I use several hosts is that I do not want to have a downtime. Niels

3 3

Re: Best mail encryption solution for per-user
by Aki Tuomi 23 May '18

23 May '18

On 23.05.2018 10:15, mail(a)sjemm.net wrote: > May 23, 2018 8:31 AM, "Aki Tuomi" <aki.tuomi(a)dovecot.fi> wrote: >> On 23.05.2018 09:13, mail(a)sjemm.net wrote: >> >>> May 20, 2018 8:01 PM, mail(a)sjemm.net wrote: >>>> May 20, 2018 2:47 PM, "Aki Tuomi" <aki.tuomi(a)dovecot.fi> wrote: >>> On 19 May 2018 at 16:40 mail(a)sjemm.net wrote: >>> >>> May 18, 2018 10:01 PM, "Aki Tuomi" <aki.tuomi(a)dovecot.fi> wrote: >>> On 18 May 2018 at 21:44 mail(a)sjemm.net wrote: >>> >>> May 18, 2018 4:43 PM, "Aki Tuomi" <aki.tuomi(a)dovecot.fi> wrote: >>> On 18 May 2018 at 17:38 mail(a)sjemm.net wrote: >>> >>> May 18, 2018 4:05 PM, "Aki Tuomi" <aki.tuomi(a)dovecot.fi> wrote: >>> On 18 May 2018 at 16:43 mail(a)sjemm.net wrote: >>> >>> Hi Tai74 and Aki, >>> I followed your conversation with interest on how to setup per user encryption in dovecot. >>> I have setup my dovecot with the following in a conf file: >>> >>> ============== >>> >>> mail_attribute_dict = file:%h/Maildir/dovecot-attributes >>> mail_plugins = $mail_plugins mail_crypt >>> plugin { >>> >>> mail_crypt_curve = secp521r1 >>> >>> mail_crypt_save_version = 2 >>> >>> } >>> >>> ============== >>> >>> This works nice, all emails are being encrypted and every user/folder has keys. >>> But as I understood from your conversation these keys are not protected. And I want them to be >>> protected by the users password used by imap. >>> >>> Those passwords are stored in a mysql DB file. ( I used a guide from workaround [dot] org to set up >>> the DB and postfix/dovecot) >>> >>> but how would i set it so, that the users password from the DB is used to encrypt the keys? >>> >>> should i use mail_crypt_private_password = ? >>> how do i point it to the mysql db then? >>> im unsure about this >>> >>> Do you have any hints on this? >>> >>> Kind regards, >>> Zjemm >>> >>> The passwords in your MySQL database are, hopefully, not in plaintext. If you want to secure your >>> user's keys using user's login password, you must have a TOOL that manages this. >>> >>> You can use mail_crypt_private_password = %w in (mysql) passdb fields to provide the user's login >>> password as private password. You might want to run it thru some hash, so %{sha1:password} might be >>> a good option. >>> >>> You can change the key password using 'doveadm mailbox cryptokey', this needs to be done every time >>> user changes his password. >>> >>> Also note that if you go down this road, and the user forgets his password, you will not be able to >>> recover the emails without backup copy of the private key. >>> >>> Aki >>> >>> Hi Aki >>> >>> I used the following command: >>> dovecot pw -s SHA256-CRYPT >>> >>> the output on the chosen password looks like: {SHA256-CRYPT}$5$Rokc06a7In4SF3bO$OQpGQWqg........ >>> >>> This output is used to store in the password fields in the database. So no plain text passwords no >>> :) >>> >>> You can use mail_crypt_private_password = %w in (mysql) passdb fields to provide the user's login >>> password as private password. >>> >>> can you explain this a bit more for me? >>> >>> for now i have in the 10-auth.conf file the following: >>> ============== >>> passdb { >>> driver = sql >>> >>> # Path for SQL configuration file, see example-config/dovecot-sql.conf.ext >>> args = /etc/dovecot/dovecot-sql.conf.ext >>> } >>> >>> and: >>> >>> userdb { >>> driver = static >>> args = uid=vmail gid=vmail home=/var/vmail/%d/%n >>> } >>> ============== >>> >>> then i have in dovecot-sql.conf.ext >>> ============== >>> driver = mysql >>> connect = host=x.x.x.x dbname=mailserver user=mailuser password=mailpasswordexample >>> default_pass_scheme = SHA256-CRYPT >>> password_query = SELECT email as user, password FROM virtual_users WHERE email='%u'; >>> ============== >>> Where do i need to set : mail_crypt_private_password = %w ? >>> >>> password as private password. You might want to run it thru some hash, so %{sha1:password} might be >>> a good option. >>> >>> the passwords are allready hashed in the DB using: dovecot pw -s SHA256-CRYPT to genereate the has. >>> so this step isnt nesesary anymore am i right? >>> >>> Thank you for your quick response, very helpfull >>> >>> Zjemm >>> >>> You misunderstood a bit. The idea is to use the *plaintext* password as the password for the >>> private key. Otherwise anyone could just decrypt it by looking at your database where the hashed >>> password is.. >>> >>> So: >>> >>> password_query = SELECT email as user, password, '%w' AS userdb_mail_crypt_private_password FROM >>> virtual_users WHERE email='%u' >>> >>> Aki >>> >>> Hi Aki, >>> >>> Thank you very much for your help, i realy appreciate that. >>> >>> Ok so if i understand it correctly i'll have to use: >>> >>> password_query = SELECT email as user, password, '%w' AS userdb_mail_crypt_private_password FROM >>> virtual_users WHERE email='%u' >>> >>> in my dovecot-sql.conf.ext file >>> >>> This query selects the user, the password, and %w >>> >>> if i run a little query myself: >>> MariaDB [mailserver]> SELECT email as user, password, '%w' AS userdb_mail_crypt_private_password >>> FROM virtual_users; >>> +------------------+----------------------------------+------------------------------------+ >>> | user | password | userdb_mail_crypt_private_password | >>> +------------------+----------------------------------+------------------------------------+ >>> | john(a)example.org | {SHA256-CRYPT}$5$M/GWzmtjsLroRWI | %w | >>> +------------------+----------------------------------+------------------------------------+ >>> >>> %w is a dovecot variable, and stands for the plaintext password, but the password is not stored as >>> plaintext in the DB, %w get filled with the actual plaintext password by dovecot upon the user that >>> is typing in the password when authenticating. >>> >>> is this correct? >>> >>> yes. >>> >>> so then i have the username the hashed password en the plaintext password as a result of the query. >>> >>> yes >>> >>> now userdb_mail_crypt_private_password = the plaintext password >>> do i need to reference it somewhere? or is userdb_mail_crypt_private_password autmatically used by >>> the dovecot mail_crypt plugin to encrypt the keys? or should it be mail_crypt_private_password? >>> >>> It gets injected into the mail process as 'mail_crypt_private_password', as if it was set in plugin >>> {} section. >>> >>> if i have this setup working i'm going to write a blog post on this topic to share this knowledge >>> >>> Thanks again and have a great weekend. >>> >>> Zjemm >>> >>> Aki >>> >>> Hi Aki, >>> >>> Cool i'm testing it right now. >>> I have set up a new mailserver (life is great with lxc containers :) ) >>> >>> postfix and dovecot are working like normal >>> >>> next i enable mail_crypt >>> >>> i did create a file: /etc/dovecot/conf.d/10-mailcrypt.conf >>> ========================== >>> mail_attribute_dict = file:%h/Maildir/dovecot-attributes >>> >>> mail_plugins = $mail_plugins mail_crypt >>> >>> plugin { >>> mail_crypt_curve = secp521r1 >>> mail_crypt_save_version = 2 >>> } >>> ========================== >>> >>> and then i changed the file: /etc/dovecot/dovecot-sql.conf.ext >>> >>> so the query is now the new query: >>> password_query = SELECT email as user, password, '%w' AS userdb_mail_crypt_private_password FROM >>> virtual_users WHERE email='%u'; >>> >>> then i restarted dovecot and postfix and send a test email to the one and only testuser that is in >>> there. >>> >>> when i open the mailbox with the tool mutt, i can see the new email, and when openening the email >>> the mutt client drops the connection. >>> >>> in the log i can see: >>> >>> May 19 13:34:48 mailserver1.example.local dovecot[600]: imap-login: Login: user=<john(a)example.org>, >>> method=PLAIN, rip=::1, lip=::1, mpid=713, TLS, session=<E3PnIY9sNM4AAAAAAAAAAAAAAAAAAAAB> >>> May 19 13:34:49 mailserver1.example.local dovecot[600]: imap(john(a)example.org): Error: read() >>> failed: >>> read(/var/vmail/example.org/john/Maildir/cur/1526736378.M161472P641.mailser…, >>> =571:2,) failed: Private key not available: Cannot decrypt key >>> bfc5bb25b1bf64290eea6dc14b516c6a0a25b64551b6e4f0f8677ba7274887cb: error:03070068:bignum >>> routines:BN_mpi2bn:encoding error (FETCH BODY[] for mailbox INBOX UID 8) >>> >>> i think i missed a step, but witch one? >>> >>> the userpassword hasnt been changed (that would be the next step in the testing process) >>> >>> should i've use doveadm first to encrypt the key with that userpassword? i thought it would do that >>> on the fly, because the initial keys where only just created when enabling the mail_crypt plugin >>> >>> please let me know your thougts >>> Zjemm >>> I noticed you replied directly to me, and not to the list, too... fixed that for you. >>> >>> mail_crypt_private_password is used when key is created, but if you have created it before using >>> password, you'll need to encrypt it before turning the setting on. >>> >>> Aki >>>> Hi, Ok i'm sorry about that, thank you for fixing that. i'm a bit new to mailing lists :) >>>> >>>> are you a dovecot devoloper? or a enthusiastic user? >>>> >>>> anyway, i managed to get it working now with all your help :) >>>> >>>> to start fresh i did a: >>>> rm -rf /var/vmail/example.org >>>> >>>> so all email is gone, and i assume all dovecot keys are gone that way. >>>> >>>> Then i tried to set a password first: >>>> >>>> root@mailserver1:/var/vmail# doveadm mailbox cryptokey password -u john(a)example.org -n summersun >>>> result: Changed password for 0 key(s) >>>> >>>> (summersun = the password for this user) >>>> >>>> but then it says there are 0 keys, so then i send the test user an email and try to open the >>>> mailbox, i'll get: >>>> >>>> imap(john(a)example.org): Error: read() failed: >>>> read(/var/vmail/example.org/john/Maildir/cur/1526827992.M149712P883.mailser…, >>>> =561:2,) failed: Private key not available: Cannot decrypt key >>>> 71849013a70b0c631c06112077e7c2fe39b0b2737b4933b219793841209d4e7f: error:03070068:bignum >>>> routines:BN_mpi2bn:encoding error >>>> >>>> but hey, now the key's are created, so i tried to set the password again: >>>> >>>> root@mailserver1:/var/vmail# doveadm mailbox cryptokey password -u john(a)example.org -n summersun >>>> result: dcrypt_key_load_private(787701bd677dd69a26842547a3926cbaa625b0b5a91751f06678c3e9708343d9) >>>> failed: password missing >>>> ========= >>>> >>>> Lets start over again, i did a new: >>>> rm -rf /var/vmail/example.org >>>> >>>> i disabled the mail_crypt_private_password in the sql query and send an email to the test user. >>>> now again new keys are generated. >>>> >>>> then i did set the password via doveadm: >>>> >>>> root@mailserver1:/var/vmail# doveadm mailbox cryptokey password -u john(a)example.org -n summersun >>>> result: Changed password for 1 key(s) >>>> >>>> i enabled the mail_crypt_private_password again in the sql query part and now it works :) >>>> >>>> YESSS!!! >>>> >>>> if i now change the password for the user, i cannot read the email anymore. that is what should >>>> happen. >>>> so now i changed the password for this user also with doveadm: >>>> - doveadm mailbox cryptokey password -u john(a)example.org -n qwerty -o summersun >>>> >>>> and now i'm able to read the emails again. so it all works now as expected. >>>> >>>> i have now only one thing remaining. >>>> >>>> when i want to add a new user, i have to somehow: >>>> - create the new user in the mysql DB >>>> - start with dovecot not using mail_crypt_private_password (so disabled) >>>> - send an initial email to let the users mailbox be created and generate the keys >>>> - set the users password with doveadm >>>> - restart dovecot again with mail_crypt_private_password (so enabled) >>>> >>>> but this would be disruptive to existing users, and i would have to script the whole thing as a >>>> "add-new-user" script to make it usable i guess. >>>> >>>> do you know of a more easy way of acomplishing this? >>>> could i use doveadm for all steps, and get around the mail_crypt_private_password disable part? >>>> >>>> or could i add a column in the mysql db called userdb_mail_crypt_private_password and fill that >>>> column with %w for users that allready exist, and empty for new users. >>>> when being empty, it might not set the mail_crypt_private_password for new users >>>> >>>> or is this the wrong way of thinking? >>>> >>>> let me know your thoughts on this. >>>> >>>> And last but not least, i really want to thank you for all your help. It is a really nice >>>> experience. >>>> Bless you! >>>> >>>> Zjemm >>> Hi Aki, >>> >>> You did fix the posting on the mail archive, i can see our conversation on there, all but the last >>> email i send to you. >>> Maybe you did not received the last email? >>> >>> would you be willing to take a look at my last question in the email See below: >>> Thank you very much. >>> >>> ================================ >>> i have now only one thing remaining. >>> >>> when i want to add a new user, i have to somehow: >>> - create the new user in the mysql DB >>> - start with dovecot not using mail_crypt_private_password (so disabled) >>> - send an initial email to let the users mailbox be created and generate the keys >>> - set the users password with doveadm >>> - restart dovecot again with mail_crypt_private_password (so enabled) >>> >>> but this would be disruptive to existing users, and i would have to script the whole thing as a >>> "add-new-user" script to make it usable i guess. >>> >>> do you know of a more easy way of acomplishing this? >>> could i use doveadm for all steps, and get around the mail_crypt_private_password disable part? >>> >>> or could i add a column in the mysql db called userdb_mail_crypt_private_password and fill that >>> column with %w for users that allready exist, and empty for new users. >>> when being empty, it might not set the mail_crypt_private_password for new users >>> >>> or is this the wrong way of thinking? >>> >>> let me know your thoughts on this. >>> >>> And last but not least, i really want to thank you for all your help. It is a really nice >>> experience. >>> Bless you! >>> >>> Zjemm >> If you have mail_crypt_private_password set *when* keys are generated, >> dovecot should use that password to encrypt the user key. >> >> Aki > > Hi Aki, > > well, if there is a new email user setup in the mysql DB, and no email has been send to that new user. at that point there are no keys. > > So trying to set a password on those key's wont work. see: > root@mailserver1:/var/vmail/example.org# doveadm mailbox cryptokey password -u john2(a)example.org -n qwerty > result: Changed password for 0 key(s) > > the keys need to be generated first. And that only happens when sending a mail to that new user. Also, at the point of creating the keys, the mail_crypt_private_password should be disabled otherwise the keys are generated and also encrypted with no user password, and then im unable to set a new pasword for that key > > > How can i set the password before the keys are generated? > or can i manually generate key's and then set the password? > > so at this point i have to do the following: You can use doveadm mailbox cryptokey generate -u user -U to generate a user key. Aki >>> - create the new user in the mysql DB >>> - start with dovecot not using mail_crypt_private_password (so disabled) >>> - send an initial email to let the users mailbox be created and generate the keys >>> - set the users password with doveadm >>> - restart dovecot again with mail_crypt_private_password (so enabled) > can i somehow enable the mail_crypt_private_password per user? > because this mysql query always returns: %w > and thus allways sets: userdb_mail_crypt_private_password > SELECT email as user, password, '%w' AS userdb_mail_crypt_private_password FROM virtual_users;

1 0

Re: Best mail encryption solution for per-user
by Aki Tuomi 23 May '18

23 May '18

On 23.05.2018 09:13, mail(a)sjemm.net wrote: > May 20, 2018 8:01 PM, mail(a)sjemm.net wrote: >> May 20, 2018 2:47 PM, "Aki Tuomi" <aki.tuomi(a)dovecot.fi> wrote: >> >>>> On 19 May 2018 at 16:40 mail(a)sjemm.net wrote: >>>> >>>> May 18, 2018 10:01 PM, "Aki Tuomi" <aki.tuomi(a)dovecot.fi> wrote: >>>> On 18 May 2018 at 21:44 mail(a)sjemm.net wrote: >>>> >>>> May 18, 2018 4:43 PM, "Aki Tuomi" <aki.tuomi(a)dovecot.fi> wrote: >>>> On 18 May 2018 at 17:38 mail(a)sjemm.net wrote: >>>> >>>> May 18, 2018 4:05 PM, "Aki Tuomi" <aki.tuomi(a)dovecot.fi> wrote: >>>> On 18 May 2018 at 16:43 mail(a)sjemm.net wrote: >>>> >>>> Hi Tai74 and Aki, >>>> I followed your conversation with interest on how to setup per user encryption in dovecot. >>>> I have setup my dovecot with the following in a conf file: >>>> >>>> ============== >>>> >>>> mail_attribute_dict = file:%h/Maildir/dovecot-attributes >>>> mail_plugins = $mail_plugins mail_crypt >>>> plugin { >>>> >>>> mail_crypt_curve = secp521r1 >>>> >>>> mail_crypt_save_version = 2 >>>> >>>> } >>>> >>>> ============== >>>> >>>> This works nice, all emails are being encrypted and every user/folder has keys. >>>> But as I understood from your conversation these keys are not protected. And I want them to be >>>> protected by the users password used by imap. >>>> >>>> Those passwords are stored in a mysql DB file. ( I used a guide from workaround [dot] org to set up >>>> the DB and postfix/dovecot) >>>> >>>> but how would i set it so, that the users password from the DB is used to encrypt the keys? >>>> >>>> should i use mail_crypt_private_password = ? >>>> how do i point it to the mysql db then? >>>> im unsure about this >>>> >>>> Do you have any hints on this? >>>> >>>> Kind regards, >>>> Zjemm >>>> >>>> The passwords in your MySQL database are, hopefully, not in plaintext. If you want to secure your >>>> user's keys using user's login password, you must have a TOOL that manages this. >>>> >>>> You can use mail_crypt_private_password = %w in (mysql) passdb fields to provide the user's login >>>> password as private password. You might want to run it thru some hash, so %{sha1:password} might be >>>> a good option. >>>> >>>> You can change the key password using 'doveadm mailbox cryptokey', this needs to be done every time >>>> user changes his password. >>>> >>>> Also note that if you go down this road, and the user forgets his password, you will not be able to >>>> recover the emails without backup copy of the private key. >>>> >>>> Aki >>>> >>>> Hi Aki >>>> >>>> I used the following command: >>>> dovecot pw -s SHA256-CRYPT >>>> >>>> the output on the chosen password looks like: {SHA256-CRYPT}$5$Rokc06a7In4SF3bO$OQpGQWqg........ >>>> >>>> This output is used to store in the password fields in the database. So no plain text passwords no >>>> :) >>>> >>>> You can use mail_crypt_private_password = %w in (mysql) passdb fields to provide the user's login >>>> password as private password. >>>> >>>> can you explain this a bit more for me? >>>> >>>> for now i have in the 10-auth.conf file the following: >>>> ============== >>>> passdb { >>>> driver = sql >>>> >>>> # Path for SQL configuration file, see example-config/dovecot-sql.conf.ext >>>> args = /etc/dovecot/dovecot-sql.conf.ext >>>> } >>>> >>>> and: >>>> >>>> userdb { >>>> driver = static >>>> args = uid=vmail gid=vmail home=/var/vmail/%d/%n >>>> } >>>> ============== >>>> >>>> then i have in dovecot-sql.conf.ext >>>> ============== >>>> driver = mysql >>>> connect = host=x.x.x.x dbname=mailserver user=mailuser password=mailpasswordexample >>>> default_pass_scheme = SHA256-CRYPT >>>> password_query = SELECT email as user, password FROM virtual_users WHERE email='%u'; >>>> ============== >>>> Where do i need to set : mail_crypt_private_password = %w ? >>>> >>>> password as private password. You might want to run it thru some hash, so %{sha1:password} might be >>>> a good option. >>>> >>>> the passwords are allready hashed in the DB using: dovecot pw -s SHA256-CRYPT to genereate the has. >>>> so this step isnt nesesary anymore am i right? >>>> >>>> Thank you for your quick response, very helpfull >>>> >>>> Zjemm >>>> >>>> You misunderstood a bit. The idea is to use the *plaintext* password as the password for the >>>> private key. Otherwise anyone could just decrypt it by looking at your database where the hashed >>>> password is.. >>>> >>>> So: >>>> >>>> password_query = SELECT email as user, password, '%w' AS userdb_mail_crypt_private_password FROM >>>> virtual_users WHERE email='%u' >>>> >>>> Aki >>>> >>>> Hi Aki, >>>> >>>> Thank you very much for your help, i realy appreciate that. >>>> >>>> Ok so if i understand it correctly i'll have to use: >>>> >>>> password_query = SELECT email as user, password, '%w' AS userdb_mail_crypt_private_password FROM >>>> virtual_users WHERE email='%u' >>>> >>>> in my dovecot-sql.conf.ext file >>>> >>>> This query selects the user, the password, and %w >>>> >>>> if i run a little query myself: >>>> MariaDB [mailserver]> SELECT email as user, password, '%w' AS userdb_mail_crypt_private_password >>>> FROM virtual_users; >>>> +------------------+----------------------------------+------------------------------------+ >>>> | user | password | userdb_mail_crypt_private_password | >>>> +------------------+----------------------------------+------------------------------------+ >>>> | john(a)example.org | {SHA256-CRYPT}$5$M/GWzmtjsLroRWI | %w | >>>> +------------------+----------------------------------+------------------------------------+ >>>> >>>> %w is a dovecot variable, and stands for the plaintext password, but the password is not stored as >>>> plaintext in the DB, %w get filled with the actual plaintext password by dovecot upon the user that >>>> is typing in the password when authenticating. >>>> >>>> is this correct? >>>> >>>> yes. >>>> >>>> so then i have the username the hashed password en the plaintext password as a result of the query. >>>> >>>> yes >>>> >>>> now userdb_mail_crypt_private_password = the plaintext password >>>> do i need to reference it somewhere? or is userdb_mail_crypt_private_password autmatically used by >>>> the dovecot mail_crypt plugin to encrypt the keys? or should it be mail_crypt_private_password? >>>> >>>> It gets injected into the mail process as 'mail_crypt_private_password', as if it was set in plugin >>>> {} section. >>>> >>>> if i have this setup working i'm going to write a blog post on this topic to share this knowledge >>>> >>>> Thanks again and have a great weekend. >>>> >>>> Zjemm >>>> >>>> Aki >>>> >>>> Hi Aki, >>>> >>>> Cool i'm testing it right now. >>>> I have set up a new mailserver (life is great with lxc containers :) ) >>>> >>>> postfix and dovecot are working like normal >>>> >>>> next i enable mail_crypt >>>> >>>> i did create a file: /etc/dovecot/conf.d/10-mailcrypt.conf >>>> ========================== >>>> mail_attribute_dict = file:%h/Maildir/dovecot-attributes >>>> >>>> mail_plugins = $mail_plugins mail_crypt >>>> >>>> plugin { >>>> mail_crypt_curve = secp521r1 >>>> mail_crypt_save_version = 2 >>>> } >>>> ========================== >>>> >>>> and then i changed the file: /etc/dovecot/dovecot-sql.conf.ext >>>> >>>> so the query is now the new query: >>>> password_query = SELECT email as user, password, '%w' AS userdb_mail_crypt_private_password FROM >>>> virtual_users WHERE email='%u'; >>>> >>>> then i restarted dovecot and postfix and send a test email to the one and only testuser that is in >>>> there. >>>> >>>> when i open the mailbox with the tool mutt, i can see the new email, and when openening the email >>>> the mutt client drops the connection. >>>> >>>> in the log i can see: >>>> >>>> May 19 13:34:48 mailserver1.example.local dovecot[600]: imap-login: Login: user=<john(a)example.org>, >>>> method=PLAIN, rip=::1, lip=::1, mpid=713, TLS, session=<E3PnIY9sNM4AAAAAAAAAAAAAAAAAAAAB> >>>> May 19 13:34:49 mailserver1.example.local dovecot[600]: imap(john(a)example.org): Error: read() >>>> failed: >>>> read(/var/vmail/example.org/john/Maildir/cur/1526736378.M161472P641.mailser…, >>>> =571:2,) failed: Private key not available: Cannot decrypt key >>>> bfc5bb25b1bf64290eea6dc14b516c6a0a25b64551b6e4f0f8677ba7274887cb: error:03070068:bignum >>>> routines:BN_mpi2bn:encoding error (FETCH BODY[] for mailbox INBOX UID 8) >>>> >>>> i think i missed a step, but witch one? >>>> >>>> the userpassword hasnt been changed (that would be the next step in the testing process) >>>> >>>> should i've use doveadm first to encrypt the key with that userpassword? i thought it would do that >>>> on the fly, because the initial keys where only just created when enabling the mail_crypt plugin >>>> >>>> please let me know your thougts >>>> Zjemm >>> I noticed you replied directly to me, and not to the list, too... fixed that for you. >>> >>> mail_crypt_private_password is used when key is created, but if you have created it before using >>> password, you'll need to encrypt it before turning the setting on. >>> >>> Aki >> Hi, Ok i'm sorry about that, thank you for fixing that. i'm a bit new to mailing lists :) >> >> are you a dovecot devoloper? or a enthusiastic user? >> >> anyway, i managed to get it working now with all your help :) >> >> to start fresh i did a: >> rm -rf /var/vmail/example.org >> >> so all email is gone, and i assume all dovecot keys are gone that way. >> >> Then i tried to set a password first: >> >> root@mailserver1:/var/vmail# doveadm mailbox cryptokey password -u john(a)example.org -n summersun >> result: Changed password for 0 key(s) >> >> (summersun = the password for this user) >> >> but then it says there are 0 keys, so then i send the test user an email and try to open the >> mailbox, i'll get: >> >> imap(john(a)example.org): Error: read() failed: >> read(/var/vmail/example.org/john/Maildir/cur/1526827992.M149712P883.mailser…, >> =561:2,) failed: Private key not available: Cannot decrypt key >> 71849013a70b0c631c06112077e7c2fe39b0b2737b4933b219793841209d4e7f: error:03070068:bignum >> routines:BN_mpi2bn:encoding error >> >> but hey, now the key's are created, so i tried to set the password again: >> >> root@mailserver1:/var/vmail# doveadm mailbox cryptokey password -u john(a)example.org -n summersun >> result: dcrypt_key_load_private(787701bd677dd69a26842547a3926cbaa625b0b5a91751f06678c3e9708343d9) >> failed: password missing >> ========= >> >> Lets start over again, i did a new: >> rm -rf /var/vmail/example.org >> >> i disabled the mail_crypt_private_password in the sql query and send an email to the test user. >> now again new keys are generated. >> >> then i did set the password via doveadm: >> >> root@mailserver1:/var/vmail# doveadm mailbox cryptokey password -u john(a)example.org -n summersun >> result: Changed password for 1 key(s) >> >> i enabled the mail_crypt_private_password again in the sql query part and now it works :) >> >> YESSS!!! >> >> if i now change the password for the user, i cannot read the email anymore. that is what should >> happen. >> so now i changed the password for this user also with doveadm: >> - doveadm mailbox cryptokey password -u john(a)example.org -n qwerty -o summersun >> >> and now i'm able to read the emails again. so it all works now as expected. >> >> i have now only one thing remaining. >> >> when i want to add a new user, i have to somehow: >> - create the new user in the mysql DB >> - start with dovecot not using mail_crypt_private_password (so disabled) >> - send an initial email to let the users mailbox be created and generate the keys >> - set the users password with doveadm >> - restart dovecot again with mail_crypt_private_password (so enabled) >> >> but this would be disruptive to existing users, and i would have to script the whole thing as a >> "add-new-user" script to make it usable i guess. >> >> do you know of a more easy way of acomplishing this? >> could i use doveadm for all steps, and get around the mail_crypt_private_password disable part? >> >> or could i add a column in the mysql db called userdb_mail_crypt_private_password and fill that >> column with %w for users that allready exist, and empty for new users. >> when being empty, it might not set the mail_crypt_private_password for new users >> >> or is this the wrong way of thinking? >> >> let me know your thoughts on this. >> >> And last but not least, i really want to thank you for all your help. It is a really nice >> experience. >> Bless you! >> >> Zjemm > Hi Aki, > > You did fix the posting on the mail archive, i can see our conversation on there, all but the last email i send to you. > Maybe you did not received the last email? > > would you be willing to take a look at my last question in the email See below: > Thank you very much. > > ================================ > i have now only one thing remaining. > > when i want to add a new user, i have to somehow: > - create the new user in the mysql DB > - start with dovecot not using mail_crypt_private_password (so disabled) > - send an initial email to let the users mailbox be created and generate the keys > - set the users password with doveadm > - restart dovecot again with mail_crypt_private_password (so enabled) > > but this would be disruptive to existing users, and i would have to script the whole thing as a "add-new-user" script to make it usable i guess. > > do you know of a more easy way of acomplishing this? > could i use doveadm for all steps, and get around the mail_crypt_private_password disable part? > > or could i add a column in the mysql db called userdb_mail_crypt_private_password and fill that column with %w for users that allready exist, and empty for new users. > when being empty, it might not set the mail_crypt_private_password for new users > > or is this the wrong way of thinking? > > let me know your thoughts on this. > > And last but not least, i really want to thank you for all your help. It is a really nice experience. > Bless you! > > Zjemm If you have mail_crypt_private_password set *when* keys are generated, dovecot should use that password to encrypt the user key. Aki

1 0

Cannot delete folder
by Yves Goergen 22 May '18

22 May '18

Hi there, I cannot delete IMAP folders in new mailboxes. When trying to delete a folder in Thunderbird I get the error message "renaming not supported across conflicting directory permissions". Looking up the error on the web led me to checking the mailbox directory's permissions. They're inconsistent in new mailboxes. While every single directory in an old mailbox has "drwx--S---", some of the directories in a new mailbox have "drwxr-sr-x" instead. I'm not sure what that means. The folders with the later permissions are "Drafts", "Sent" and "Trash". Folders with the first permissions are "Junk", "Archives" and "Archives.2018". All folders were created by Thunderbird automatically. Now I wanted to delete "Archives.2018". What's the issue here? Why do folders created by the same MUA in the same event on the same mail server have different permissions and why can't I delete one of them (which would probably move it into the trash folder first)? Dovecot version is 2.2.22 on Ubuntu 16.04, Thunderbird is 52.6.0 on Windows 10. -Yves

7 19