January 2015 - dovecot

Outlook and TLSv.1
by Oliver Welter 20 Jan '15

20 Jan '15

Hi Folks, after adding TLSv1.2 to by TLS options a lot of Outlook users complaint about connection errors, openssl s_client and Thunderbird works fine. I found some posts about this but none of them had a real solution on this - I meanwhile disabled TLSv1.2 which made the Outlook users happy. I run dovecot 2.2.13, OpenSSL 1.0.1j 15 Oct 2014 ssl_cert = </var/qmail/control/servercert.pem ssl_cipher_list = ALL:!EXPORT:!LOW:!MEDIUM:!aNULL:+RC4:@STRENGTH ssl_dh_parameters_length = 2048 ssl_key = </var/qmail/control/servercert.pem ssl_protocols = !SSLv2 !TLSv1.2 The certificate is from Comodo using sha256. Any idea? Oliver -- Protect your environment - close windows and adopt a penguin!

5 6

Still receiving Quota warning: mailbox 95% full altough now 20% full
by ML mail 19 Jan '15

19 Jan '15

Hello I am using the quota warnings e-mail feature of dovecot to warn users at 80% and 95%. The issue here is that I have one use who his mailbox is now back down to 20% but he still receives the 95% mailbox full warning mail. Any ideas what could be wrong or what to do? My dovecot config of the mailbox server can be found here: http://article.gmane.org/gmane.mail.imap.dovecot/80823 Regards ML

2 1

pigeonhole - how to whitelist
by Cliff Hayes 19 Jan '15

19 Jan '15

Hello, When new users are added we start them with a spam rule that routes spam to their junk folder. I don't see a way to assign priority ... so how does a user whitelist a spam-flagged email? Are the rules applied in some order? Alphabetically perhaps? If so I can name the spam rule z-spam. Thanks in advance.

3 4

move imap mail to new server
by James 19 Jan '15

19 Jan '15

I tarred up my Maildir from one server and untarred it on another, I had hoped it would work, It partially does. It has all my messages but doesn't show the subdirectories in Thunderbird. Maildir# ls -l .INBOX.car total 44 drwx------ 2 rjl 1000 4096 Feb 15 2014 cur -rw------- 1 rjl users 17408 Jan 18 02:10 dovecot.index.cache -rw------- 1 rjl users 1040 Jan 18 02:10 dovecot.index.log -rw------- 1 rjl 1000 23 Aug 26 2011 dovecot-keywords -rw------- 1 rjl users 1683 Jan 18 00:20 dovecot-uidlist -rw------- 1 rjl 1000 0 Aug 4 2011 maildirfolder drwx------ 2 rjl 1000 4096 Aug 4 2011 new drwx------ 2 rjl 1000 4096 Feb 15 2014 tmp Maildir# ls -l .INBOX.car.Enterprise/ total 40 drwx------ 2 rjl 1000 4096 Jul 3 2013 cur -rw------- 1 rjl 1000 20480 Mar 20 2014 dovecot.index.cache -rw------- 1 rjl 1000 1824 Mar 20 2014 dovecot.index.log -rw------- 1 rjl 1000 212 Jul 10 2013 dovecot-uidlist -rw------- 1 rjl 1000 0 Jul 2 2013 maildirfolder drwx------ 2 rjl 1000 4096 Jul 2 2013 new drwx------ 2 rjl 1000 4096 Jul 5 2013 tmp Thunderbird displays the files under: .INBOX.car/cur/ but not .INBOX.car.Enterprise/cur Is there any way to rebuild the subdirectories?

1 0

Shared mailboxes not shown or accessible
by Tim ODriscoll 18 Jan '15

18 Jan '15

Dear All, I'm trying (and failing) to implement a shared mailbox folder. My goal is to share the inbox of a user 'invoices' to a test user 'rubbish'. My ACLs appear to be correct: # doveadm acl get -u invoices inbox ID Global Rights user=rubbish create delete expunge insert lookup post read write write-deleted write-seen The shared-dict is being generated: # cat /var/lib/dovecot/db/shared-mailboxes shared/shared-boxes/user/rubbish/invoices 1 Yet when I try to list the mailboxes, the shared namespace has no children: . login rubbish password . OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE SORT SORT=DISPLAY THREAD=REFERENCES THREAD=REFS THREAD=ORDEREDSUBJECT MULTIAPPEND URL-PARTIAL CATENATE UNSELECT CHILDREN NAMESPACE UIDPLUS LIST-EXTENDED I18NLEVEL=1 CONDSTORE QRESYNC ESEARCH ESORT SEARCHRES WITHIN CONTEXT=SEARCH LIST-STATUS SPECIAL-USE BINARY MOVE QUOTA ACL RIGHTS=texk] Logged in . list "" "*" * LIST (\HasNoChildren \Trash) "/" Trash * LIST (\HasNoChildren \Drafts) "/" Drafts * LIST (\HasNoChildren \Sent) "/" Sent * LIST (\Noselect \HasNoChildren) "/" shared * LIST (\HasNoChildren) "/" INBOX . OK List completed. I've gone through all the documentation I can find but still can't sort this out. Any help would be greatly appreciated. Tim My dovecot config: # 2.2.9: /etc/dovecot/dovecot.conf # OS: Linux 3.13.0-32-generic x86_64 Ubuntu 14.04 LTS xfs auth_mechanisms = plain login auth_username_format = %Ln default_vsz_limit = 384 M disable_plaintext_auth = no listen = * mail_access_groups = mail mail_location = maildir:/home/email/LHNET/%Lu/Maildir:INBOX=/home/email/LHNET/%Lu/Maildir mail_plugins = acl namespace { list = yes location = maildir:/home/email/LHNET/%%Lu/Maildir:INDEXPVT=/home/email/LHNET/%Lu/Maildir/shared/%%Lu:CONTROL=/home/email/LHNET/%Lu/Maildir/shared/%%Lu prefix = shared/%%u/ separator = / subscriptions = no type = shared } namespace inbox { inbox = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { auto = subscribe special_use = \Trash } prefix = separator = / type = private } passdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } plugin { acl = vfile:/etc/dovecot/global-acls:cache_secs=300 acl_shared_dict = file:/var/lib/dovecot/db/shared-mailboxes quota = maildir:User quota quota_grace = 10%% quota_rule = *:storage=3G quota_warning = storage=95%% quota-warning 95 %u quota_warning2 = storage=80%% quota-warning 80 %u sieve = ~/.dovecot.sieve sieve_dir = ~/sieve } protocols = " imap" service auth { unix_listener /var/spool/postfix/private/auth { group = mail mode = 0666 user = postfix } unix_listener auth-userdb { group = mail mode = 0640 user = vmail } } service imap-login { inet_listener imap { address = * port = 143 } inet_listener imaps { address = * port = 993 ssl = yes } } service imap { process_limit = 1024 vsz_limit = 384 M } ssl_cert = </etc/ssl/certs/dovecot.pem ssl_key = </etc/ssl/private/dovecot.pem userdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } protocol lda { mail_plugins = sieve acl quota postmaster_address = postmaster(a)lambrookschool.co.uk } protocol imap { mail_plugins = acl acl imap_acl quota imap_quota }

1 1

Initial development work on fts-elasticsearch
by Joshua Atkins 18 Jan '15

18 Jan '15

Hi all, I have started work on an ElasticSearch FTS plugin for Dovecot. It's available now on GitHub at: https://github.com/ascendantcom/fts-elasticsearch Please note that it is still in heavy development right now. It supports indexing, searching and expunging with some caveats (no multi-mailbox search or attachments). Pull requests, suggestions and bug reports very welcome! Cheers, Josh

2 1

dsync SSL fails since 2.2.15
by Martin Carlé 17 Jan '15

17 Jan '15

Hello list, dovecot ran rock-solid on OSX Mavericks for about 1 year replicating my mail between 2 servers via dsync with SSL as that is well described here: http://wiki2.dovecot.org/Replication After upgrading to 2.2.15, dsync gets stuck with the Error: "Received invalid SSL certificate" even though neither any of the dovecot configs nor the certs, keys or the CA have changed! When I simply outcomment SSL and switch dsync to use tcp (instead of tcps) everthing replications still works like a charm. Please help me to get SSL back working! I did a lot of testing and come up with a concrete QUESTION below, hopefully leading the way out of this trap. What happend ============= 2 days before I upgraded one of the machines to OSX Yosemite. Along with this, I also upgraded to dovecot 2.2.15 via homebrew (unfortunately on both machines at once). During this process, also openssl was updated to "OpenSSL 1.0.1k 8 Jan 2015". If checking the unchanged certs against the CA, however, the results are still "OK". 1st check: OK ========== sudo /usr/bin/openssl verify -CAfile /etc/ssl/ca/dovecotCA.pem /etc/ssl/certs/dovecot_on27_signed_cert.pem Password: /etc/ssl/certs/dovecot_on27_signed_cert.pem: OK 2nd check: OK (providing the CAfile and connecting to the doveadm_port) =========== openssl s_client -CAfile /etc/ssl/ca/dovecotCA.pem -connect on27.linkpc.net:8082 CONNECTED(00000003) depth=1 CN = dovecotCA2, O = dovecot, OU = dovecot, ST = dovecot, C = AF, L = dovecot, emailAddress = mc(a)aiguphonie.com verify return:1 depth=0 CN = on27.linkpc.net, O = dovecot, OU = dovecot, ST = dovecot, C = AF, L = dovecot, emailAddress = mc(a)aiguphonie.com verify return:1 --- Certificate chain 0 s:/CN=on27.linkpc.net/O=dovecot/OU=dovecot/ST=dovecot/C=AF/L=dovecot/emailA… i:/CN=dovecotCA2/O=dovecot/OU=dovecot/ST=dovecot/C=AF/L=dovecot/emailAddress=mc@aiguphonie.com --- Server certificate -----BEGIN CERTIFICATE----- dmVjb3RDQTIxEDAOBgNVBAoMB2RvdmVjb3QxEDAOBgNVBAsMB2RvdmVjb3QxEDAO [...] +g== -----END CERTIFICATE----- subject=/CN=on27.linkpc.net/O=dovecot/OU=dovecot/ST=dovecot/C=AF/L=dovecot/… issuer=/CN=dovecotCA2/O=dovecot/OU=dovecot/ST=dovecot/C=AF/L=dovecot/emailAddress=mc(a)aiguphonie.com --- No client certificate CA names sent --- SSL handshake has read 1709 bytes and written 487 bytes --- New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES256-GCM-SHA384 Server public key is 2048 bit Secure Renegotiation IS supported Compression: zlib compression Expansion: zlib compression SSL-Session: Protocol : TLSv1.2 Cipher : ECDHE-RSA-AES256-GCM-SHA384 Session-ID: C4DDBA1FA50039FA5D94EF2359BA037B3903D66B6B637CA0733A9216BFCC3996 Session-ID-ctx: Master-Key: 0495D21CA11AA54856D78B48C3DBE9B70EFFB65F13224B430D2B4B2F80F12BE5A89F31454F9577F22F5DDC26FDBAAFAC Key-Arg : None PSK identity: None PSK identity hint: None SRP username: None TLS session ticket lifetime hint: 300 (seconds) TLS session ticket: [...] 0090 - 2d 97 37 15 bd a9 be 68-c1 79 fa dd d8 75 76 3f -.7....h.y...uv? Compression: 1 (zlib compression) Start Time: 1421443766 Timeout : 300 (sec) Verify return code: 0 (ok) --- - Yet, testing dsync yields: ERROR ========================================================================================== sudo -u _vmail doveadm -v sync -u test tcps:on27.linkpc.net Password: doveadm(test): Info: Received invalid SSL certificate: certificate signature failure: /CN=on27.linkpc.net/O=dovecot/OU=dovecot/ST=dovecot/C=AF/L=dovecot/emailAddress=mc(a)aiguphonie.com doveadm(test): Error: doveadm server disconnected before handshake: Received invalid SSL certificate: certificate signature failure: /CN=on27.linkpc.net/O=dovecot/OU=dovecot/ST=dovecot/C=AF/L=dovecot/emailAddress=mc(a)aiguphonie.com doveadm(test): Fatal: Disconnected from remote: Received invalid SSL certificate: certificate signature failure: /CN=on27.linkpc.net/O=dovecot/OU=dovecot/ST=dovecot/C=AF/L=dovecot/emailAddress=mc(a)aiguphonie.com QUESTION ========= So the question clearly is, how does dovecot check the cert against the CA exactly? Is there a call to the openssl cmd or is the library linked into dovecotadm? If liked, what version is used and how can I possibly change it? or: What's wrong with my CA and cert(s) all of a sudden? How can I create new CA for two certs fitting the (new) needs of dovecotadm? THANK YOU! ========================================================================================== Here are my full but rather simple configs of both machines: ========================================================================================== 1st machine: Yosemite # 2.2.15: /usr/local/etc/dovecot/dovecot.conf # OS: Darwin 14.0.0 x86_64 base_dir = /var/run/dovecot/ default_internal_user = _dovecot default_login_user = _dovenull doveadm_password = secret doveadm_port = 8082 log_path = /usr/local/var/log/dovecot/error mail_home = /var/vmail/%n mail_location = maildir:~/mail mail_plugin_dir = /usr/local/lib/dovecot mail_plugins = " notify replication" namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = scheme=CRYPT username_format=%u /usr/local/etc/dovecot_authDBs/authDBs_on27/passwd.dovecot driver = passwd-file } plugin { mail_replica = tcps:nephelism.linkpc.net replication_full_sync_interval = 1 hour } protocols = imap service aggregator { fifo_listener replication-notify-fifo { user = _vmail } unix_listener replication-notify { user = _vmail } } service auth { unix_listener auth-userdb { group = _vmail mode = 0666 user = _vmail } } service doveadm { inet_listener { port = 8082 ssl = yes } } service replicator { process_min_avail = 1 unix_listener replicator-doveadm { mode = 0600 user = _vmail } } ssl = required ssl_cert = </etc/ssl/certs/dovecot_on27_signed_cert.pem ssl_client_ca_file = /etc/ssl/ca/dovecotCA.pem ssl_key = </etc/ssl/private/dovecot_on27_signed_key_noenc.pem userdb { args = username_format=%u /usr/local/etc/dovecot_authDBs/authDBs_on27/userdb.dovecot driver = passwd-file } protocol imap { mail_max_userip_connections = 40 } ========================================================================================== ========================================================================================== 2nd machine: Mavericks # 2.2.15: /usr/local/etc/dovecot/dovecot.conf # OS: Darwin 13.1.0 x86_64 base_dir = /var/run/dovecot/ default_internal_user = _dovecot default_login_user = _dovenull doveadm_password = secret doveadm_port = 8082 log_path = /usr/local/var/log/dovecot/error mail_home = /var/vmail/%n mail_location = maildir:~/mail mail_plugin_dir = /usr/local/lib/dovecot mail_plugins = " notify replication" namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = scheme=CRYPT username_format=%u /usr/local/etc/dovecot_authDBs/authDBs_nephelism/passwd.dovecot driver = passwd-file } plugin { mail_replica = tcps:on27.linkpc.net replication_full_sync_interval = 1 hour } protocols = imap service aggregator { fifo_listener replication-notify-fifo { user = _vmail } unix_listener replication-notify { user = _vmail } } service auth { unix_listener auth-userdb { group = _vmail mode = 0666 user = _vmail } } service doveadm { inet_listener { port = 8082 ssl = yes } } service replicator { process_min_avail = 1 unix_listener replicator-doveadm { mode = 0600 user = _vmail } } ssl = required ssl_cert = </etc/ssl/certs/dovecot_nephelism_signed_cert.pem ssl_client_ca_file = /etc/ssl/ca/dovecotCA.pem ssl_key = </etc/ssl/private/dovecot_nephelism_signed_key_noenc.pem userdb { args = username_format=%u /usr/local/etc/dovecot_authDBs/authDBs_nephelism/userdb.dovecot driver = passwd-file } protocol imap { mail_max_userip_connections = 40 } -- Fetch my gnupg key: gpg --keyserver pgp.mit.edu --recv-keys 7E3CA33F

1 0

dsync-remote: Error: Failed to set attribute
by Alexander Moisseev 16 Jan '15

16 Jan '15

1. I am looking for backup solution for mdbox with SIS and experimenting with dsync. I am planning to do it like that: doveadm backup [deSISing] => transmitting to remote host => dsync-server [SISing] Is there more convenient method? 2. I have dovecot 2.2.15 on both hosts. The local host is a mail server. Dovecot on the remote host neither running nor configured (I have created an empty dovecot.conf in the config dir). When I tried to back up mailbox from local to remote host with command doveadm backup -P -u user(a)domain.tld \ ssh -c blowfish -i /tmp/vmail/.ssh/id_dsa vmail@remotehost \ doveadm \ -o mail_location=mdbox:/tmp/vmail/domain.tld/user/mdbox \ -o mail_attachment_dir=/tmp/vmail/attachments \ dsync-server I got error messages: dsync-remote(vmail): Error: Mailbox INBOX: Failed to set attribute vendor/vendor.dovecot/pvt/server/sieve/files/roundcube: Internal attributes cannot be changed directly dsync-remote(vmail): Error: Mailbox INBOX: Failed to set attribute vendor/vendor.dovecot/pvt/server/sieve/files/main: Internal attributes cannot be changed directly dsync-remote(vmail): Error: Mailbox INBOX: Failed to set attribute vendor/vendor.dovecot/pvt/server/sieve/files/test: Internal attributes cannot be changed directly dsync-remote(vmail): Error: Mailbox INBOX: Failed to set attribute vendor/vendor.dovecot/pvt/server/sieve/default: Internal attributes cannot be changed directly What do that errors mean? Does dsync try to replicate sieve scripts? -- Alexander

1 0

[SERVERBUG] failed to send mail with SA and antispam plugin
by ML mail 16 Jan '15

16 Jan '15

Hello, I am using the antispam plugin of Dovecot with SpamAssassin and in some cases when users move back mails from the Spam folder to their INBOX (false positive) they get the following error message: [SERVERBUG] failed to send mail Does anyone have an idea what could be the issue here? It is quite annoying as the mail then stays in the Spam folder and can not been re-learnt has ham. Best regards ML

4 6

File locking issues
by Oliver Welter 16 Jan '15

16 Jan '15

Hi All, I upgrade my mail server from doveot 1.1.7 to 2.2.13 and encounter problems with file locking issues. The server has around 400 clients using IMAP and I get tons of "Warning: fscking index file .. dovecot.index" and "Error: Corrupted transaction log". Sometimes the transaction log problem is followed by "Panic: file mail-transaction-log.c: line 350 (mail_transaction_log_set_mailbox_sync_pos): assertion failed: (file_offset >= log->head->saved_tail_offset)" I tried all offered locking methods (fcntl, flock, dotlock) without success. The server runs inside a virtual guest (linux-vserver which is similar to LXC) using an overlay filesystem. I suspect the overlayfs but have no idea how to test this, besides - as I understand - dotlock should not rely on the fs locking at all :( I even wonder why the old dovecot worked for nearly 10 years without any problems, even under higher loads. The config is pretty straightforward: # 2.2.13: /etc/dovecot/dovecot.conf # OS: Linux 3.4.57-vs2.3.3.9-g67e6589-dirty x86_64 Gentoo Base System release 2.2 auth_cache_negative_ttl = 0 auth_cache_size = 50 M auth_mechanisms = plain cram-md5 debug_log_path = /var/log/dovecot-debug.log default_client_limit = 900 default_process_limit = 250 disable_plaintext_auth = no first_valid_gid = 89 first_valid_uid = 89 info_log_path = /var/log/dovecot.log last_valid_gid = 89 last_valid_uid = 89 listen = * lock_method = dotlock login_greeting = Serverpilot.net Mail Service mail_gid = 89 mail_location = maildir:~/.maildir mail_uid = 89 namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } protocols = imap pop3 service imap-login { process_min_avail = 5 service_count = 0 } ssl_cert = </var/qmail/control/servercert.pem ssl_cipher_list = ALL:!EXPORT:!LOW:!MEDIUM:!aNULL:+RC4:@STRENGTH ssl_dh_parameters_length = 2048 ssl_key = </var/qmail/control/servercert.pem ssl_protocols = !SSLv2 !TLSv1.2 userdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } protocol imap { mail_max_userip_connections = 25 } Any ideas are welcome. Oliver -- Protect your environment - close windows and adopt a penguin!

1 0