December 2015 - dovecot

Released Pigeonhole v0.4.10 for Dovecot v2.2.21
by Stephan Bosch 14 Dec '15

14 Dec '15

Hello Dovecot users, I got a bit stalled by our recent switch to Git, but here is the final v0.4.10 release of Pigeonhole for Dovecot v2.2.21. Nothing of consequence changed since the last RC. Changelog v0.4.10: + Implemented the Sieve mime and foreverypart extensions (RFC 5703). These are fully implemented. The interaction with the editheader extension needs some work, but this should not influence most uses; i.e., changes by the editheader extension are not always visible using foreverypart/mime. + Sieve body extension: Properly implemented the `:text' body transform. It now extracts text for HTML message parts. + Sieve enotify extension: mailto method: Implemented the sieve_notify_mailto_envelope_from setting. This allows configuring the source of the notification sender address for e-mail notifications. This is similar to what already can be configured for redirect. + Added a sieve_enabled (defaults to 'yes') setting that allows explicitly disabling Sieve processing for particular users. This used to be possible by setting `sieve=', but ever since the sieve_before, sieve_after and sieve_default settings were added, this method was not reliable anymore. - variables extension: Fixed handling of empty string by the `:length' set modifier. An empty string yielded an empty string rather than "0". - Fixed memory leak in the Sieve script byte code dumping facility. Extension contexts were never actually freed. - Fixed handling of implicit keep when the last Sieve script is a global one. In that case the implicit keep action was executed in global context, which could mean that trivial (quota) errors ended up in the system log file, rather than the user log file. - doveadm sieve plugin: Fixed crashes caused by incorrect context allocation in the sieve command implementations. The release is available as follows: http://pigeonhole.dovecot.org/releases/2.2/rc/dovecot-2.2-pigeonhole-0.4.10… http://pigeonhole.dovecot.org/releases/2.2/rc/dovecot-2.2-pigeonhole-0.4.10… Refer to http://pigeonhole.dovecot.org and the Dovecot v2.x wiki for more information. Have fun testing this release and don't hesitate to notify me when there are any problems. Regards, -- Stephan Bosch stephan(a)rename-it.nl

2 2

v2.2.21 released
by Timo Sirainen 13 Dec '15

13 Dec '15

http://dovecot.org/releases/2.2/dovecot-2.2.21.tar.gz http://dovecot.org/releases/2.2/dovecot-2.2.21.tar.gz.sig Due to a bit bad doveadm bugs in v2.2.20 here's a fixed v2.2.21. Also from this release forward we're finally using git with branches to make new releases. So new releases will have a bit more time to stabilize in the branch before they're being released (while still allowing new features to be developed in the master development branch). We already did something like this for the enterprise releases, but now it's done for community releases as well. - doveadm mailbox list (and some others) were broken in v2.2.20 - director: Fixed making backend changes when running with only a single director server. - virtual plugin: Fixed crash when trying to open nonexistent autocreated backend mailbox.

2 3

2.2.21: doveadm expunge is broken
by Alexander Moisseev 13 Dec '15

13 Dec '15

# doveadm expunge -u user(a)example.com MAILBOX Trash ALL Fatal: expunge: To avoid accidents, each branch in search query must contain something else besides MAILBOX (e.g. just add "all" if you want everything) -- Alexander

2 1

2.2.21: panic in stats-plugin.c: line 324 (stats_user_deinit): assertion failed: (stats_global_user == user)
by Jakub Jankowski 13 Dec '15

13 Dec '15

Hi, I've just upgraded dovecot to 2.2.21 (from 2.2.18), and I'm getting a crash when doing dsync backup: $ dsync -v -u user(a)domain.com backup maildir:/backup/maildirs/domain.com/user/Maildir dsync(user(a)domain.com): Panic: file stats-plugin.c: line 324 (stats_user_deinit): assertion failed: (stats_global_user == user) dsync(user(a)domain.com): Error: Raw backtrace: /usr/lib64/dovecot/libdovecot.so.0(+0x7e4b4) [0x7f543d3c74b4] -> /usr/lib64/dovecot/libdovecot.so.0(+0x7e529) [0x7f543d3c7529] -> /usr/lib64/dovecot/libdovecot.so.0(i_fatal+0) [0x7f543d372300] -> /usr/lib64/dovecot/lib90_stats_plugin.so(+0x4116) [0x7f543c95a116] -> /usr/lib64/dovecot/libdovecot-storage.so.0(mail_user_unref+0x35) [0x7f543d68efd5] -> /usr/bin/dsync [shasta(a)toxcorp.com done]() [0x420f90] -> /usr/bin/dsync [user(a)domain.com done](doveadm_mail_try_run+0x28c) [0x421edc] -> /usr/bin/dsync [user(a)domain.com done](main+0x2ff) [0x413a2f] -> /lib64/libc.so.6(__libc_start_main+0xf0) [0x7f543cd80870] -> /usr/bin/dsync [user(a)domain.com done](_start+0x29) [0x413bb9] Aborted This gets logged to syslog when it happens: Dec 13 02:12:33 host dovecot: imap-login: Login: user=<user(a)domain.com>, method=PLAIN, rip=A.B.C.D, lip=A.B.C.D, mpid=1576, TLS Dec 13 02:13:09 host dovecot: stats: Error: Mail server input error: CONNECT: Duplicate session ID 4rqRBSXGbFbDBgAAOpfmEQ for user user(a)domain.com service doveadm It definitely wasn't happening on 2.2.18 (I skipped .19 and .20). Here's my configuration (with some things sanitized): $ dovecot -n # 2.2.21 (5345f22): /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.9 (357ac0a0e68b+) # OS: Linux 4.3.2 x86_64 Slackware 14.2 auth_cache_negative_ttl = 1 mins auth_cache_size = 4 k auth_mechanisms = plain login auth_socket_path = /var/run/dovecot/auth-userdb auth_verbose = yes auth_verbose_passwords = sha1 default_vsz_limit = 512 M deliver_log_format = msgid=%m psize=%p vsize=%w: %$ first_valid_gid = 500 first_valid_uid = 500 hostname = host.domain.com last_valid_gid = 500 last_valid_uid = 500 listen = * login_greeting = IMAP server ready. login_log_format_elements = user=<%u> method=%m rip=%r lip=%l mpid=%e %c mail_location = mdbox:~/mdbox:ALT=/var/vmail/altmdbox/%Ld/%Ln/altmdbox mail_plugins = " stats" mailbox_list_index = yes managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Spam { special_use = \Junk } mailbox Trash { special_use = \Trash } prefix = separator = / type = private } passdb { args = scheme=CRYPT username_format=%Lu /etc/dovecot/users driver = passwd-file } plugin { mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename mail_log_fields = uid box msgid size recipient_delimiter = + sieve = ~/.dovecot.sieve sieve_default = /var/vmail/_sieve/default.sieve sieve_dir = ~/sieve stats_refresh = 30 secs stats_track_cmds = yes } pop3_client_workarounds = outlook-no-nuls postmaster_address = postmaster(a)domain.com protocols = imap pop3 lmtp sieve quota_full_tempfail = yes service auth-worker { user = $default_internal_user } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } } service dict { unix_listener dict { group = vmail mode = 0660 user = vmail } } service imap-login { inet_listener imap { port = 143 } inet_listener imaps { port = 993 ssl = yes } service_count = 1 } service imap { process_limit = 128 } service lmtp { inet_listener lmtp { address = 127.0.0.1 port = 2424 } unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0660 user = postfix } unix_listener lmtp-vmail { group = vmail mode = 0660 user = vmail } } service managesieve-login { inet_listener sieve { port = 4190 } service_count = 1 vsz_limit = 64 M } service managesieve { process_limit = 32 } service pop3-login { inet_listener pop3 { port = 110 } inet_listener pop3s { port = 995 ssl = yes } } service pop3 { process_limit = 64 } service stats { fifo_listener stats-mail { mode = 0600 user = vmail } } ssl_cert = </etc/ssl/certs/cert.pem ssl_key = </etc/ssl/private/key.pem stats_command_min_time = 1 days stats_domain_min_time = 1 days stats_ip_min_time = 1 days stats_memory_limit = 32 M stats_session_min_time = 1 days stats_user_min_time = 1 days userdb { args = uid=vmail gid=vmail home=/var/vmail/mdbox/%Ld/%Ln driver = static } verbose_proctitle = yes protocol lda { mail_plugins = " stats sieve" } protocol imap { mail_max_userip_connections = 20 mail_plugins = " stats imap_stats" } protocol lmtp { mail_plugins = " stats sieve" } $ Let me know if there's anything else that I can provide to help narrowing it down. Cheers, shasta -- Jakub Jankowski|shasta@toxcorp.com|http://toxcorp.com/ GPG: FCBF F03D 9ADB B768 8B92 BB52 0341 9037 A875 942D

2 1

System-user-controllable custom passwords and mail locations
by Michal Petrucha 12 Dec '15

12 Dec '15

Hello everyone, I'd like to set up dovecot so that it uses the standard system accounts, but with different passwords specific to email. Seems like a fairly common setup, but the catch is, I want the users to be able to set their passwords themselves, without needing any assistance from a server administrator. I'm wondering what's the easiest way of implementing this. From what I've understood, this requirement would probably rule out a separate passwd-file (since the standard Linux passwd doesn't seem to support using a custom passwd file), SQL, flat-file dict, and Redis (since you can't give users access only to their row, or dict key; it's either the entire database (or flat file), or nothing). (Of course, I could work around that limitation by writing a C program that I would install as SUID root, which would only change the invoking user's password, but I'd prefer not to start dumping arbitrary SUID binaries all over the place.) So, that would probably only leave me with LDAP, checkpassword, and the FS dict backend. I can imagine how I could get LDAP to do this -- add some extra attribute for each user, and put together a simple script to change passwords, say, in Python, that would bind as the user and write the new password. However, this would require me to store the system user account database in LDAP, which is kind of overkill on at least one of the servers I want this setup on, where I know for certain that there won't ever be more than a handful of users. Checkpassword would probably work, too; perhaps by looking into some file in the user's $HOME or such. I'm not entirely certain about the security, or performance implications of that approach. With the FS dict backend, I could probably point it to a directory, in which every user would own a file containing their password, that no one else could write to. I haven't been able to find any more details about the structure of this directory hierarchy, though, or the contents of the individual files, so I don't know whether this is a viable approach, or not. My questions are, then: Is there some other way of implementing separate passwords that the users can set themselves that I'm overlooking? Is one of the three approaches described above a bad idea for some reason I don't see? Is there some kind of “standard solution” to this problem? The other thing I wanted to ask about is marginally related; I'd like to be able to allow users to customize the layout in which they store their mail. For instance, some users like to have their INBOX as an mbox in /var/mail, and other maildirs in ~/Maildirs/, others prefer having everything as a mix maildirs and mboxes in ~/mail, etc. Looking at the MailLocation wiki page, it seems like the only option, if I want to customize the location per user, is to set it in the userdb, but since we only have system users everywhere, it seems we have to use the passwd userdb, which doesn't support this kind of per-user customization (even on servers where PAM/NSS are configured to use LDAP). Again, am I overlooking something here? Is there nothing similar to ~/.imaprc, which is supported by certain versions of some other IMAP servers? Thanks in advance for any insights, Michal

1 0

Dovecot 1.2.15 and Convert Password Schemes
by Chuck Peters 11 Dec '15

11 Dec '15

Can I convert the password hashes with the older Dovecot? http://wiki2.dovecot.org/HowTo/ConvertPasswordSchemes shows how it can potentially be done with Dovecot 2.1, but when I try it with Dovecot 1.2.15, I'm not seeing a way to make it work. Any suggestions? This is an old Debian 6 system that's overdue for an upgrade. In the test environment upgrading OpenLDAP to Debian 8 I discovered most of our users passwords probably won't work. The hashes appear to be a old Unix DES based hash, ie base64 decoded ldif shows something like the following: userPassword:: {crypt}Aipcuzoh3eiVE Passwords stored in the SSHA hash seem to work fine. If given the password, a shell script could create the hashes with slappasswd and/or a SHA512 hash (using doveadm or mkpasswd) for use on Debian 8. # cat /usr/local/bin/dovecot-environment.sh #!/bin/sh set > /tmp/dovecot-environment exec /usr/lib/dovecot/imap "$@" I can show the /tmp/dovecot-environment if you like, but it's not showing the password as a variable... This system is using Debian's Dovecot package 1.2.15-7+deb6u1. Dovecot 2.1.7-7~bpo60+1 is available as a backport, but I would prefer not to upgrade Dovecot on the production system if I don't need to, or have some other reason such as some features for using IMAP for the migration. https://packages.debian.org/search?keywords=dovecot-common Thanks, Chuck # dovecot -n # 1.2.15: /etc/dovecot/dovecot.conf # OS: Linux 2.6.32-5-686-bigmem i686 Debian 6.0.10 log_timestamp: %Y-%m-%d %H:%M:%S protocols: imap imaps pop3 pop3s ssl_cert_file: /etc/lfrr/ca/thishost.crt ssl_key_file: /etc/lfrr/ca/thishost.key disable_plaintext_auth: no verbose_ssl: yes login_dir: /var/run/dovecot/login login_executable(default): /usr/lib/dovecot/imap-login login_executable(imap): /usr/lib/dovecot/imap-login login_executable(pop3): /usr/lib/dovecot/pop3-login verbose_proctitle: yes mail_privileged_group: mail mail_location: mbox:%h:INBOX=/var/mail/%Lu mbox_write_locks: fcntl dotlock mail_executable(default): /usr/local/bin/dovecot-environment.sh mail_executable(imap): /usr/local/bin/dovecot-environment.sh mail_executable(pop3): /usr/lib/dovecot/pop3 mail_plugins(default): quota imap_quota mail_plugins(imap): quota imap_quota mail_plugins(pop3): mail_plugin_dir(default): /usr/lib/dovecot/modules/imap mail_plugin_dir(imap): /usr/lib/dovecot/modules/imap mail_plugin_dir(pop3): /usr/lib/dovecot/modules/pop3 pop3_reuse_xuidl(default): no pop3_reuse_xuidl(imap): no pop3_reuse_xuidl(pop3): yes auth default: mechanisms: plain login debug_passwords: yes passdb: driver: ldap args: /etc/dovecot/dovecot-ldap.conf passdb: driver: pam args: session=yes dovecot userdb: driver: passwd args: /etc/passwd userdb: driver: ldap args: /etc/dovecot/dovecot-ldap.conf plugin: quota: dirsize quota_rule: *:storage=204800 I should note, I think the default_pass_scheme = CRYPT doesn't do anything with auth_bind = yes. # grep -v '^ *$#.*$\?$' /etc/dovecot/dovecot-ldap.conf hosts = 127.0.0.1 sasl_bind = no auth_bind = yes auth_bind_userdn = uid=%u,ou=People,dc=ccil,dc=org ldap_version = 3 base = ou=People,dc=ccil,dc=org pass_attrs = uid=user,userPassword=password,homeDirectory=userdb_home,uidNumber=userdb_uid,gidNumber=userdb_gid pass_filter = (&(objectClass=posixAccount)(uid=%u)) default_pass_scheme = CRYPT

1 0

autoexpunge creates special_use folder
by Tom Sommer 11 Dec '15

11 Dec '15

namespace inbox { mailbox Spam { special_use = \Spam auto = create autoexpunge = 30d } } This creates the "Spam" folder in the filesystem on login/logout, even though it shouldn't. If I remove autoexpunge, the folder is not created. -- Tom Sommer

2 1

Have the Dovecot Enterprise Edition packages been discontinued?
by deoren 10 Dec '15

10 Dec '15

Hi, I've been using the Dovecot EE packages for Ubuntu for some time now and just recently started getting 404 errors. Have those packages been discontinued or is this just a temporary issue? Thanks.

3 3

Re: Autoexpunge and special user namespace
by Joseph Tam 10 Dec '15

10 Dec '15

On Wed, 9 Dec 2015, Timo Siraine wrote: >> I'm interested in replacing my cron script that expunges old >> deleted mail with the new feature announced in 2.2.20 >> >>> + Added mailbox { autoexpunge=<time> } setting. See >>> http://wiki2.dovecot.org/MailboxSettings for details. >> >> To use it, I need to specify which mailbox needs them using >> the namespace configuration. For example >> >> namespace inbox { >> mailbox Trash { >> auto = no >> special_use = \Trash >> autoexpunge = 7d >> mailbox_list_index = yes >> } >> ... > > mailbox_list_index=yes is a global setting. You can't have it here. Oh, yes. Thanks for pointing that out. By the way, what does it do? The wiki states mailbox_list_index=yes can help a lot by replying to IMAP STATUS (and similar) lookups from a single index without having to open each mailbox index separately. So it create an uber-index that combines information from individual indices? Are there any drawback to using this? > > 1) Do I need the special_user configuration at all? Will some > > clients start using different mailboxes to store deleted mail > > if I keep the special_use lines? > > special_use is independent of the autoexpunge. I guess it wouldn't > necessarily hurt.. but it's also somewhat better to have only a single > \Trash mailbox so clients don't become confused when more than one of > those mailboxes exist. Got it. Thanks, Timo. Joseph Tam <jtam.home(a)gmail.com>

2 1

Re: EVP_PKEY_get1_EC_KEY:expecting a ec key
by Oliver Riesen-Mallmann 09 Dec '15

09 Dec '15

Hi Teemu, > Could you post your doveconf -n output? # 2.2.20.rc1 (ed41702f14c2): /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.10.rc1 # OS: Linux 3.2.0-4-amd64 x86_64 Debian 7.9 auth_mechanisms = plain login log_timestamp = "%Y-%m-%d %H:%M:%S " login_greeting = Ready. login_log_format_elements = user=<%u> method=%m rip=%r lip=%l mpid=%e %c %k mail_location = maildir:%h/mails mail_plugins = zlib mail_privileged_group = mail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart namespace inbox { inbox = yes list = yes location = maildir:%h/mails mailbox Archiv { auto = subscribe special_use = \Archive } mailbox Archives { auto = no special_use = \Archive } mailbox Drafts { auto = create special_use = \Drafts } mailbox "Gelöschte Elemente" { auto = no special_use = \Trash } mailbox Gesendete { auto = no special_use = \Sent } mailbox "Gesendete Elemente" { auto = no special_use = \Sent } mailbox Junk-E-Mail { auto = no special_use = \Junk } mailbox Junk { auto = subscribe special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Messages" { auto = no special_use = \Sent } mailbox Trash { auto = create special_use = \Trash } prefix = type = private } passdb { driver = shadow } plugin { sieve = file:~/sieve;active=~/.dovecot.sieve zlib_save = gz zlib_save_level = 6 } postmaster_address = postmaster(a)langzeittest.de protocols = imap service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } user = root } ssl_cert = </etc/dovecot/ssl-cert-langzeittest-plus-cacert.crt ssl_cipher_list = ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA ssl_dh_parameters_length = 2048 ssl_key = </etc/dovecot/ssl-cert-langzeittest.key ssl_prefer_server_ciphers = yes ssl_protocols = !SSLv2 !SSLv3 userdb { driver = passwd } protocol lda { mail_plugins = zlib sieve } protocol imap { mail_max_userip_connections = 20 mail_plugins = zlib imap_zlib } protocol pop3 { pop3_uidl_format = %08Xu%08Xv } Regards Oliver

2 3