December 2014 - dovecot

Sieve permissions issue following update
by David Gessel 02 Feb '15

02 Feb '15

I recently updated dovecot and my sieve filters stopped working. Checking the logs I see: Dec 9 00:09:59 mailhost dovecot: lda(gessel(a)domain.com): Error: sieve: binary save: failed to create temporary file: open(/usr/local/etc/dovecot/sieve/10-move-spam.svbin.mailhost.domain.com.114.) failed: Permission denied (euid=5000(vmail) egid=5000(vmail) missing +w perm: /usr/local/etc/dovecot/sieve, we're not in group 6(mail), dir owned by 143:6 mode=0775) Dec 9 00:09:59 mailhost dovecot: lda(gessel(a)domain.com): Error: sieve: The LDA Sieve plugin does not have permission to save global Sieve script binaries; global Sieve scripts like `/usr/local/etc/dovecot/sieve/10-move-spam.sieve' need to be pre-compiled using the sievec tool However this fairly clear advice on the failure seems to be contradicted by: # id vmail uid=5000(vmail) gid=5000(vmail) groups=5000(vmail),6(mail) ? dovecot-pigeonhole-0.4.6 = up-to-date with index dovecot2-2.2.15_1 = up-to-date with index uname -a FreeBSD host.domain.com 9.3-RELEASE FreeBSD 9.3-RELEASE #0 r268932: Mon Jul 21 15:51:38 PDT 2014 gessel@host1.domain.com:/usr/obj/usr/src/sys/BARCELONA-13-08 amd64

8 22

Re: Maildir permissions on creation?
by Von Random 13 Jan '15

13 Jan '15

Yes, and it is not my use case, sadly. ACLs are meant for imap, not filesystem access and mail_access_groups is also useless for some reason. It just does not change anything. Probably because I don't use mail_location and variables when I provide path for home. (It's stored as is in a database on mailbox creation.) 26.12.2014, 12:07, "Tobi" <tobster(a)brain-force.ch>: > Have you checked the dovecot wiki for 'filepermissions in shared mailboxes' ? > Explains how dovecot set ACL when creating mailboxes > > Am 26. Dezember 2014 09:37:37 MEZ, schrieb Von Random <von(a)vdrandom.org>: >> Err, my bad, of course 0640 on files in case of setgid on directories. >> >> 26.12.2014, 11:36, "Von Random" <von(a)vdrandom.org>: >>> The main reason is that I don't want to provide backup user with >> unnecessary write permissions within maildirs and mail user within >> backup logs dir. I was talking about mail_user:mail_group 0750 on dirs >> and 0640 on files. (Or, possibly, mail_user:backup_group 2750 and >> 2640.) >>> 26.12.2014, 11:19, "Tobi" <tobster(a)brain-force.ch>: >>>> Whats the reason you do not want to use default dovecot user. Your >> idea would assume that at least the group must have write access. For >> me a no-go on mailboxes. >>>> Am 24. Dezember 2014 13:21:15 MEZ, schrieb Von Random >> <von(a)vdrandom.org>: >>>>> Hello. >>>>> >>>>> In my configuration dovecot reads home from mysql and uses no >> variables >>>>> within it. It uses Maildir++ storage with virtual users. I also >> happen >>>>> to use LMTP. >>>>> >>>>> I want to use a backup solution that does not involve running >> itself as >>>>> root. Neither do I want to run it as dovecot's mail user. >>>>> >>>>> And there lies the problem: dovecot creates maildirs with 0700 and >>>>> files within them inherit that set of permissions. And there seems >> to >>>>> be no sane way to control it. I think I've figured out what to >> patch in >>>>> order to change that default, but if possible, I'd like to avoid >> doing >>>>> that. >>>>> >>>>> tl;dr: is it possible to change the default set of permissions for >> new >>>>> maildirs created by dovecot? >>>> - -- >>>> Diese Nachricht wurde von meinem Android-Mobiltelefon mit K-9 Mail >> gesendet. >>>>>> -----BEGIN PGP SIGNATURE----- >>>>>> Version: APG v1.1.1 >>>>>> >>>>>> iQI7BAEBCgAlBQJUnRoiHhxUb2JpIDx0b2JzdGVyQGJyYWluLWZvcmNlLmNoPgAK >>>>>> CRA1HOYlqGik5L9iD/9FIE2JzWfB7fWJEbI3vVg+ar4LRGwW1xNIf8ahlytPbsmH >>>>>> D9dFP3kWpJH6TO41AksNjz/FxHcUqSrlsKYTFUsDZCyb9Zyxd8Jv+dH04FwUzw+y >>>>>> kq+ayoylnTN7Q8mQnqkUpWEuYd5ohWbbUUSguwzN8Zd1T4jCFR9/Lvu0cweE6meu >>>>>> mBGwvXBbfBP4El+mAM2lKnoMXQpMycS6aX7FwQ/fBaoWSkzg/2az69UtqG6LLF67 >>>>>> ZhJkbn17cpT3y/l/2nV5urdcFVh8RoSXNuYyMN4r7IDKQ6BPsneD+839LS9X/gP/ >>>>>> QMuo5nO5xdx4q1bT9gtv1zz5eKAJ1f3R2oPZyxdpiV5PruSY3J3kvu0cF0aJvQF6 >>>>>> +s0iDsoDBcueB6JEUnYAarteWvBvxRnqb8ytju1xbIEkKLZtaS8Gf2cpZ8eA+Ha/ >>>>>> D0zkYfq7bt+Ra7BY6Qh7XMfiN5z9eWe5RqOmVLZRLf9N75U6wWa+fmXpvlqEtGNV >>>>>> pKsgif/ivCHiA24+JSJ1PBRjwO36Tu4MsSlT2WnkvyFBQzFzg9T00fl+uTXzgNEz >>>>>> SBta2wmXk9XVJ9mPzfNrAaAA3+T6H90Sj1CbRt7NZx30UdwYoIL5XXEtnG0p1XdS >>>>>> moe91H2UE+NT+jgj7emAOLxJf86vIwiHCqI0Zl/7wVNJEnKBXJP5WIHcdEDEHg== >>>>>> =Tl/z >>>>>> -----END PGP SIGNATURE----- > > - -- > Diese Nachricht wurde von meinem Android-Mobiltelefon mit K-9 Mail gesendet. > -----BEGIN PGP SIGNATURE----- > Version: APG v1.1.1 > > iQI7BAEBCgAlBQJUnSVbHhxUb2JpIDx0b2JzdGVyQGJyYWluLWZvcmNlLmNoPgAK > CRA1HOYlqGik5GvTEACYhFfqS5hK4rAoHCzDd5vFwCLIE/ESheJhREbpewE4k7Nq > BGR1hKygYeAnj3w1CB9R4sgRBOTHSpRuIzk1ZMId5UuQOBxy8ukRzA5xiAoP22lw > AxB6Ek7e7VLz0998GmoN7uw1t5tczR1SkHscs0XfuBCBJrvo79DHYs7CP18oDTic > m5NVJS0MZzJGWPSDGwN6WPwRbLZMTZHc79h+WTmYz9Fzet2As71npvP0PiLd4hQP > xMlgUXCF1vXTUPUGf/NtQfy/xjaww4sEMqOxpigjLLMmnz+OFPo9Mar0uWvNBCgq > 3rTUqAUaMcLS8ANyvqzPXXba67dl+rNYuK33tWom+H17JzNf1rdYKxtc7IVQgm/E > RfYhIejH9yQR0/8CHw+ySF3mJdiQsZHMKL4PwXhRzp9OuOU8RZts1bve8pJEHGSr > ZQjqjiNB/DyE0s9uNh94U58mwGT8FKHQPR52EPF2WyNlyet1aYUCNQlXm2Qe+3FI > k4D4eJpRfWIHS5x7NALuwrki+/OqFvDphzKCTmhIC2Qa8UnKvxaS9VccW2Z5D9R9 > PHoOb2pgm5bIOUtsWUCykDiTwh5IA0jReoGPRlXmFK/tuhHawdrbfUlQ/YrVAX8w > p+FhchB5e5LNnBOjIXDB9c+viuobF3qo3uoOqjAwGTkEqIdwsiswCUPfjZJD+A== > =XfBH > -----END PGP SIGNATURE-----

2 1

Corrupted index cache after migrating from maildir to mdbox
by Tim 09 Jan '15

09 Jan '15

Hi guys, I'm running dovecot/postfix on my Debian Jessie maschine: # dovecot --version 2.2.13 doveconf -n output: http://p.bastelfreak.de/HsVwS/ today I migrated from maildir(located at /var/vmail) to mdbox with these commands: rsync -av -f"+ */" -f"- *" /var/vmail/ /home/vmail/ rm /home/vmail/*/*/Maildir -rf for i in $(doveadm user \*); do u=$(echo $i | cut -d@ -f1); d=$(echo $i |cut -d@ -f2); dsync -v -u $i mirror mdbox:/home/vmail/$d/$u/mdbox; done Then I changed the mail_location to mdbox:/home/vmail/%d/%n/mdbox and did the following commands: service dovecot restart for i in $(doveadm user \*); do u=$(echo $i | cut -d@ -f1); d=$(echo $i |cut -d@ -f2); dsync -v -u $i mirror maildir:/var/vmail/$d/$u/Mail; done doveadm index -A all INBOX for i in $(doveadm user \*); do doveadm -Dv fts rescan -u $i;done unfortunately I'm getting the following two kinds of error messages for all mail boxes in my mail.log: Error: Corrupted index cache file /home/vmail/%domain/%user/mdbox/mailboxes/%maildir/dbox-Mails/dovecot.index.cache: Broken virtual size for mail UID 2564 and: Error: read(/home/vmail/%domain/%user/mdbox/storage/m.108 ): FETCH BODY[] for mailbox %maildir UID 2564 got too little data: 2417 vs 6319 please let me know if you have any suggestions for fixing this issue or if you need more information. kind regards, Tim

6 19

Quota, doveadm, postfixadmin
by Ricardo 09 Jan '15

09 Jan '15

Hello all and happy holidays. I have Postfix+Dovecot+MySQL+Postfixadmin with CentOS 6.6, a virtual machines for testing, and then pass it to servers in production, my problem is the next: I add 30 MB for domain.local, then cast 10 MB for test1(a)domain.local and 20 MB for test2(a)domain.local, so far so good. Sending an attachment from one account to another, the example of test1(a)domain.local to test2(a)domain.local, test2(a)domain.local receive the email with the attachment. If I write in the shell doveadm quota get -u test2(a)domain.local I get the following: Quota name Type Value Limit % user STORAGE 3391 20000 16 user MESSAGE 3 10000 0 Informs me that I this consuming 16% of the 20 MB assigned to this account, but if I delete the file and again write doveadm quota get -u test2(a)domain.local I release this: Quota name Type Value Limit % user STORAGE 6782 20000 33 user MESSAGE 4 10000 0 Normal serious you continue using 16%, not 33%, when you go into the trash, because that happens from one place to another, right? These statistics the Postfixadmin Dame them so much as writing in the shell doveadm quota get -u test2(a)domain.local. I delete the file in the trash and to again write doveadm quota get -u test2(a)domain.local still see me. Quota name Type Value Limit % user STORAGE 6782 20000 33 user MESSAGE 4 10000 0 But I realize that so that it resets to 0%, I have to close the mail client, if not would follow using 33% and is when is 0% as shown here. Quota name Type Value Limit % user STORAGE 1 20000 0 user MESSAGE 2 10000 0 Is this normal? The client to send emails and exceed quota will having to always close the mail client, so you reset and stays at 0%? Can anyone help me? I have looked online but I can't find information about this. Has happened to someone? Thanks so much. Best regards.

2 1

Crashes with tracebacks
by Timothe Litt 05 Jan '15

05 Jan '15

Crashes, redux. I hope I have provided all the information required for a solution. Many thanks in advance for having a look. I have 71 core files for a user, that all happened in the space of about 6 hours. It appears that mail delivered to 'Junk E-mail' is being accessed. I suspect they're all the same issue. I saw the same syslog entry a while back; did a resync & enabled process dumps. Naturally, it went away -- until this cluster of crashes. File system is ext3. It is NFS mounted by other machines, but only the local machine should be touching the mail directories. The user does not have an interactive login - it's an e-mail only account. This user's IMAP client is AppleMail. The delivery agent is procmail; Junk is detected by spamassassin; clamav is also present. pop3 is configured, but I don't think anyone uses it. Typical syslog (time matches core.20063): Dec 17 18:06:22 overkill dovecot: imap(<user>): Error: Next message unexpectedly corrupted in mbox file /home/<user>/mail/Junk E-mail at 1021601 Dec 17 18:06:22 overkill dovecot: imap(<user>): Panic: file mbox-sync.c: line 152 (mbox_sync_read_next_mail): assertion failed: (sync_ctx->input->v_offset != mail_ctx->mail.from_offset || sync_ctx->input->eof) Dec 17 18:06:22 overkill dovecot: imap(<user>): Error: Raw backtrace: /usr/local/lib/dovecot/libdovecot.so.0 [0x274ecf] -> /usr/local/lib/dovecot/libdovecot.so.0 [0x274f4d] -> /usr/local/lib/dovecot/libdovecot.so.0 [0x27446b] -> /usr/local/lib/dovecot/libdovecot-storage.so.0 [0x16633e] -> /usr/local/lib/dovecot/libdovecot-storage.so.0(mbox_sync+0x6b6) [0x168146] -> /usr/local/lib/dovecot/libdovecot-storage.so.0(mbox_storage_sync_init+0x81) [0x169391] -> /usr/local/lib/dovecot/libdovecot-storage.so.0(mailbox_sync_init+0x40) [0x186270] -> /usr/local/lib/dovecot/libdovecot-storage.so.0(mailbox_sync+0x3d) [0x18715d] -> /usr/local/lib/dovecot/libdovecot-storage.so.0(index_storage_get_status+0x74) [0x1b6c44] -> /usr/local/lib/dovecot/libdovecot-storage.so.0(mailbox_get_status+0x5f) [0x1895bf] -> dovecot/imap(imap_status_get+0x7a) [0x806396a] -> dovecot/imap(cmd_status+0x128) [0x80588a8] -> dovecot/imap(command_exec+0x33) [0x805c8e3] -> dovecot/imap [0x805b63f] -> dovecot/imap [0x805b6c3] -> dovecot/imap(client_handl Dec 17 18:06:22 overkill dovecot: imap(<user>): Fatal: master: service(imap): child 20063 killed with signal 6 (core dumped) Tracebacks in attached archive were generated with: > cd ~<user>; for C in core.*; do gdb /usr/local/libexec/dovecot/imap $C > -x gdb -q ; mv gdb.log gdb.$C.log; done where 'gdb' is: > set pagination off > set logging overwrite > set logging file gdb.log > set logging on > bt full > q Note that there are unprintable characters in the log files (binary arguments). I have saved, but not attached the mail file & it's .lock file before doing a doveadm force-resync -u <user> 'Junk E-mail'. Let me know if you require a copy to debug this. I have also saved the core files. Here is the dovecot config (I have replaced the domain with example.net) dovecot -n # 2.2.15: /usr/local/etc/dovecot/dovecot.conf # OS: Linux 2.6.22.14-72.fc6 i686 Fedora Core release 6 (Zod) first_valid_gid = 4000 first_valid_uid = 4000 hostname = smtp.example.net login_greeting = Dovecot ready. Unauthorized access is prohibited. mail_access_groups = mail mail_location = mbox:~/mail:INBOX=/var/mail/%n mail_privileged_group = mail namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox "Train As Forgotten" { auto = subscribe } mailbox "Train As Ham" { auto = subscribe } mailbox "Train As Spam" { auto = subscribe } mailbox Trash { auto = subscribe special_use = \Trash } prefix = separator = / } passdb { driver = pam } service imap-login { inet_listener imap { address = imap.v4.example.net imap.v6.example.net port = 143 } inet_listener imaps { address = imap.v4.example.net imap.v6.example.net port = 993 ssl = yes } } service pop3-login { inet_listener pop3 { address = pop.v4.example.net pop.v6.example.net port = 110 } inet_listener pop3s { address = pop.v4.example.net pop.v6.example.net port = 995 ssl = yes } } ssl_ca = </etc/pki/tls/certs/litts_net_ca-cert-crl.pem ssl_cert = </etc/pki/tls/certs/servers-litts-net.pem ssl_key = </etc/pki/tls/private/servers-litts-net.pmk userdb { driver = passwd } protocol imap { imap_client_workarounds = tb-extra-mailbox-sep tb-lsub-flags mail_plugins = } protocol pop3 { mail_plugins = pop3_client_workarounds = outlook-no-nuls oe-ns-eoh pop3_uidl_format = %08Xu%08Xv } Finally, here is a list of all the core files showing their creation times. Note they're all the same size. ls -l core* | cut -d ' ' -f5- | sort 536576 Dec 17 18:01 core.20067 536576 Dec 17 18:06 core.20063 536576 Dec 17 18:11 core.20464 536576 Dec 17 18:16 core.20665 536576 Dec 17 18:21 core.20913 536576 Dec 17 18:26 core.21098 536576 Dec 17 18:31 core.21359 536576 Dec 17 18:36 core.21589 536576 Dec 17 18:41 core.21805 536576 Dec 17 18:46 core.22077 536576 Dec 17 18:51 core.22262 536576 Dec 17 18:56 core.22518 536576 Dec 17 19:01 core.22771 536576 Dec 17 19:06 core.22955 536576 Dec 17 19:11 core.23227 536576 Dec 17 19:16 core.23438 536576 Dec 17 19:21 core.23679 536576 Dec 17 19:26 core.23856 536576 Dec 17 19:31 core.24089 536576 Dec 17 19:36 core.24328 536576 Dec 17 19:41 core.24569 536576 Dec 17 19:46 core.24806 536576 Dec 17 19:51 core.24994 536576 Dec 17 19:56 core.25233 536576 Dec 17 20:01 core.25447 536576 Dec 17 20:06 core.25612 536576 Dec 17 20:11 core.25825 536576 Dec 17 20:16 core.26091 536576 Dec 17 20:21 core.26309 536576 Dec 17 20:26 core.26453 536576 Dec 17 20:31 core.26773 536576 Dec 17 20:36 core.27020 536576 Dec 17 20:41 core.27278 536576 Dec 17 20:46 core.27505 536576 Dec 17 20:51 core.27681 536576 Dec 17 20:56 core.27913 536576 Dec 17 21:01 core.28214 536576 Dec 17 21:06 core.28445 536576 Dec 17 21:11 core.28739 536576 Dec 17 21:16 core.28975 536576 Dec 17 21:21 core.29205 536576 Dec 17 21:26 core.29407 536576 Dec 17 21:31 core.29635 536576 Dec 17 21:36 core.29892 536576 Dec 17 21:41 core.30132 536576 Dec 17 21:46 core.30407 536576 Dec 17 21:51 core.30542 536576 Dec 17 21:56 core.30834 536576 Dec 17 22:01 core.31099 536576 Dec 17 22:06 core.31264 536576 Dec 17 22:11 core.31529 536576 Dec 17 22:16 core.31761 536576 Dec 17 22:21 core.31981 536576 Dec 17 22:26 core.32191 536576 Dec 17 22:31 core.32436 536576 Dec 17 22:36 core.32665 536576 Dec 17 22:41 core.449 536576 Dec 17 22:46 core.676 536576 Dec 17 22:51 core.877 536576 Dec 17 22:56 core.1134 536576 Dec 17 23:01 core.1332 536576 Dec 17 23:06 core.1516 536576 Dec 17 23:11 core.1757 536576 Dec 17 23:16 core.1935 536576 Dec 17 23:21 core.2175 536576 Dec 17 23:26 core.2380 536576 Dec 17 23:31 core.2625 536576 Dec 17 23:36 core.2871 536576 Dec 17 23:41 core.3141 536576 Dec 17 23:46 core.3460 536576 Dec 17 23:51 core.3631 -- Timothe Litt ACM Distinguished Engineer -------------------------- This communication may not represent the ACM or my employer's views, if any, on the matters discussed.

2 1

Designing an Object Storage Plugin for a specific platform
by Listas＠Adminlinux 02 Jan '15

02 Jan '15

Hi! I'm planning to develop a OSP (Object Storage Plugin) to support a specific platform of my company. Is there any API documentation or sample code of a simple plugin that can be used as a basis for an implementation? Thanks! -- Thiago Henrique

1 1

Postfix and Dovecot SASL - wiki update
by Dan Langille 01 Jan '15

01 Jan '15

I wanted to mention I updated the Postfix and Dovecot SASL wiki entry yesterday. http://wiki2.dovecot.org/HowTo/PostfixAndDovecotSASL The entry: submission inet n - - - - smtpd was incorrect. It should be: submission inet n - n - - smtpd By specifying n for chroot, it ensures that DNS lookups can occur. Otherwise, if you are using reject_unknown_recipient_domain the following error will occur: Recipient address rejected: Domain not found Hope that helps. — Dan Langille http://langille.org/

2 2

dovecot 2 low TCP speed (fetching big mail)
by Wojciech Puchar 01 Jan '15

01 Jan '15

i use dovecot 2 under FreeBSD (dovecot2-2.2.15 compiled from ports). tried both with kqueue enabled or not. everything works very fast, EXCEPT fetching big mail. tried multiple clients (thunderbird on windows, alpine on the same server, alpine on other unix server connected by 1Gb/s LAN) and fetching peaks at 1MB/s. NO SSL! could you please point me where to search for a problem. hints: writing over IMAP (eg. writing to Sent folder) works at full speed. Doesn't seem like a problem with unix server, every other service goes at speed 70-100MB/s both directions (like samba, ftp). tried to turn off "kqueue" compile time option, no difference. Please give me a hint at least what to check. Does dovecot use other way to sent data over TCP socket than other programs? thank you.

2 1

dovecot-auth only configuration
by Dan Langille 31 Dec '14

31 Dec '14

I am configuring a dovecot-auth only installation. Postfix will use dovecot for sasl auth. Here is the configuration I’ve settled upon. I welcome suggestions for improving this setup. Thanks. # doveconf -n # 2.2.15: /usr/local/etc/dovecot/dovecot.conf # OS: FreeBSD 9.3-RELEASE-p5 amd64 auth_mechanisms = plain login mail_max_userip_connections = 80 mail_privileged_group = mail passdb { args = scheme=SHA512-CRYPT /var/db/dovecot.users driver = passwd-file } protocols = none service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } user = root } userdb { args = /var/db/dovecot.users driver = passwd-file } verbose_proctitle = yes — Dan Langille http://langille.org/

1 0

Authenticating Virtual Users without domain
by Leon Kyneur 31 Dec '14

31 Dec '14

Hi, I'm trying to migrate a large number of users to a new Dovecot cluster. The existing mail system allows a user to authenticate with a bare username if they have connected to the correct local IP on the server. e.g. imap.somedomain.com = 1.1.1.1 imap.anotheromain.com = 2.2.2.2 charlie@somedomain can authnenticate as 'charlie' or 'charlie(a)somedomain.com' as long as he is connected to imap.somedomain.com (1.1.1.1) likewise for bare usernames if they connect to imap.anotherdomain.com. A previous colleague actually achieved this by hacking with the Dovecot source code and writing in a lookup table feature. The code is very old and won't patch cleanly to the latest 2.2.15 source. Another platform we are using (commercial product) also has this feature but we also need to migrate these users to Dovecot. I already have a Dovecot proxy layer for mailbox lookup - so ideally I would like to do this on my Dovecot proxies. I know I can also do this kind of thing if I swapped my dovecot proxy for Perdition, however I don't really want to do that. I've looked into checkpassword scripts and could possibly make something work (albeit ugly) - is this the right direction to take here? Thanks, Leon

2 1