September 2015 - dovecot

sieve_extprograms - run any individual script?
by Hajo Locke 22 Sep '15

22 Sep '15

Hello, i use sieve extension sieve_extprograms to send incoming mail to some script. For security reasons it is needed that script-paths etc. are registered in dovecot.conf This is my current dovecot.conf plugin { sieve = ~/.dovecot.sieve sieve_plugins = sieve_extprograms sieve_extensions = +vnd.dovecot.pipe +vnd.dovecot.filter +vnd.dovecot.execute sieve_pipe_bin_dir = /usr/local/bin/ sieve_filter_bin_dir = /usr/local/bin/ } .dovecot.sieve example: if address "to" "test(a)example.com" { filter "myfilter"; } This is all working without problems. Is there a possibility to allow users the execution of individual scripts in own homepath? Some people need to pipe mails to scripts for immediately processing (some ticketsystems need this). Is there a way to make this possible with sieve? Thanks, Hajo

4 4

Multiple passwords for a user (SQL)
by Marco Fretz 22 Sep '15

22 Sep '15

Hi everyone, I'm not sure if this has been discuessed already as I coun't find anything in the archives - maybe I'm looking for the wrong thing. I want to build something similar to googles "app passwords" where your use a different password (strong, auto generated) for each device / app. In general I think this is pretty easy on the database side as I just need a password table and link say the passwords with an user_id to the corresponding user in the users table - one use has many passwords (1:n). for dovecot this means that it will get multiple rows with passwords back from the "password_query". is there a way to tell dovecot to check all those returned passwords and "pass" the request if one of those passwords match? thank you, best regards Marco

2 3

[Dovecot] Pigeonhole sieve re-filter extension?
by T.B. 22 Sep '15

22 Sep '15

Dear Stephan Bosch, dear Dovecot community, "sieve-filter" re-filtering of existing mails is already a great progress for everyone using sieve! But as far as I know this functionality is just accessible by the server administrator. In the meanwhile everyone knows the comfort of re-executing filter scripts on his own existing mailboxes - triggered by himself! This service is already very widespread. Examples are MUA's like Outlook or Thunderbird which provide this service just on the client side. Or almost every web-mail provider offers this. Is there already an managesieve protocol extension that allows client triggered server side re-filtering? If not, maybe you could design a RFC for this? What do you think? Best regards. T.B.

4 8

ssl_key_password loaded from file: 'Couldn't parse private ssl_key'
by B. R. 22 Sep '15

22 Sep '15

As this is my first message to this ML: Hello! I am using a password-protected SSL key for my dovecot MDA. When I tried to use the ssl_key_password configuration directive as follow: ssl_key_password = </path/to/passfile it did not work as I logged the following: dovecot: imap-login: Error: SSL: Stacked error: error:06065064:digital envelope routines:EVP_DecryptFinal_ex:bad decrypt dovecot: imap-login: Fatal: Couldn't parse private ssl_key: error:0906A065:PEM routines:PEM_do_header:bad decrypt However, not using the fille inclusion but directly configuring as follow: ssl_key_password = mypass did work... I am loading my certificate & key with the file inclusion trick... How come cannot I use that for the password file? It would avoid input the password directly into the dovecot configuraiton files, forcing me to change permissions and duplicating it... When renewing the private key I will be force to edit the password at every location. Is it a bug? or a feature? :D --- *B. R.*

3 3

Messages lost from imap folders
by Nikolaos Milas 19 Sep '15

19 Sep '15

Hello, We have one user who is complaining that he has lost mails from 3 imap folders, administered through squirrelmail. The folders suddenly appeared unregistered, and once manually registered they were empty. Has anyone observed something like this? We are running two servers (as VMs) with Dovecot v2.2.18, synced (two-way) using dsync. The configurations follow. Can you please help me understand what may have gone wrong? Can I try to find actions regarding these folders in the logs? What should I search for? Could this be an issue involving dsync? How can I trace back dsync activity in detail? Server configs follow (I have only altered the real domain name and the login greeting.) Thanks in advance, Nick ----------------------------------------------------------------------------- SERVER 1 ----------------------------------------------------------------------------- protocols = imap pop3 login_greeting = Hello World! mail_location = maildir:~/Maildir/ mail_gid = 500 mail_uid = 500 auth_mechanisms = plain login auth_username_format = %Lu auth_verbose = yes auth_debug = no mail_debug = no disable_plaintext_auth = no mail_plugins = quota notify replication protocol imap { imap_client_workarounds = "delay-newmail" mail_plugins = quota imap_quota notify replication } protocol pop3 { mail_max_userip_connections = 3 mail_plugins = quota notify replication pop3_client_workarounds = outlook-no-nuls oe-ns-eoh pop3_uidl_format = %08Xu%08Xv } protocol lda { auth_socket_path = /var/run/dovecot/auth-master info_log_path = log_path = mail_plugins = quota notify replication postmaster_address = sysadmin(a)example.com sendmail_path = /usr/lib/sendmail } userdb { args = /etc/dovecot/dovecot-usrdb-ldap.conf driver = ldap } passdb { args = /etc/dovecot/dovecot-passdb-ldap.conf driver = ldap } dsync_remote_cmd = ssh -l root vmail1.example.com doveadm dsync-server -u%u replication_dsync_parameters = -d -N -l 30 -U plugin { mail_replica = remote:vmail@vmail1.example.com } plugin { quota = maildir:User quota quota_rule = *:storage=5G quota_rule2 = Trash:storage=+3%% quota_warning = storage=75%% quota-warning 75 %u quota_warning2 = storage=90%% quota-warning 90 %u } service quota-warning { executable = script /opt/mail1.sh user = vmail unix_listener quota-warning { user = vmail } } service aggregator { fifo_listener replication-notify-fifo { user = vmail } unix_listener replication-notify { user = vmail } } service replicator { unix_listener replicator-doveadm { mode = 0600 } } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } unix_listener auth-master { group = vmail mode = 0660 user = vmail } user = root } service imap-login { service_count = 1 vsz_limit = 64 M } service pop3-login { service_count = 1 vsz_limit = 64 M } service replicator { process_min_avail = 1 } service imap { executable = imap postlogin } service pop3 { executable = pop3 postlogin } service postlogin { executable = script-login -d rawlog unix_listener postlogin { } } ssl_ca = </etc/pki/tls/certs/chain-1552.pem ssl_cert = </etc/pki/tls/certs/cert-1552.pem ssl_key = </etc/pki/tls/private/key-1552.pem ssl_protocols = !SSLv2 !SSLv3 syslog_facility = local1 ----------------------------------------------------------------------------- SERVER 2 ----------------------------------------------------------------------------- protocols = imap pop3 login_greeting = Hello World! mail_location = maildir:~/Maildir/ mail_gid = 5000 mail_uid = 5000 auth_mechanisms = plain login auth_username_format = %Lu auth_verbose = yes disable_plaintext_auth = no mail_plugins = quota notify replication protocol imap { imap_client_workarounds = "delay-newmail " mail_plugins = quota imap_quota notify replication } protocol pop3 { mail_max_userip_connections = 3 mail_plugins = quota notify replication pop3_client_workarounds = outlook-no-nuls oe-ns-eoh pop3_uidl_format = %08Xu%08Xv } protocol lda { auth_socket_path = /var/run/dovecot/auth-master info_log_path = log_path = mail_plugins = quota notify replication postmaster_address = sysadmin(a)example.com sendmail_path = /usr/lib/sendmail } userdb { args = /etc/dovecot/dovecot-usrdb-ldap.conf driver = ldap } passdb { args = /etc/dovecot/dovecot-passdb-ldap.conf driver = ldap } dsync_remote_cmd = ssh -l root vmail.example.com doveadm dsync-server -u%u replication_dsync_parameters = -d -N -l 30 -U plugin { mail_replica = remote:vmail@vmail.example.com } plugin { quota = maildir:User quota quota_rule = *:storage=5G quota_rule2 = Trash:storage=+3%% quota_warning = storage=75%% quota-warning 75 %u quota_warning2 = storage=90%% quota-warning 90 %u } service quota-warning { executable = script /opt/mail1.sh user = vmail unix_listener quota-warning { user = vmail } } service aggregator { fifo_listener replication-notify-fifo { user = vmail } unix_listener replication-notify { user = vmail } } service replicator { unix_listener replicator-doveadm { mode = 0600 } } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } unix_listener auth-master { group = vmail mode = 0660 user = vmail } user = root } service imap-login { service_count = 1 vsz_limit = 64 M } service pop3-login { service_count = 1 vsz_limit = 64 M } service replicator { process_min_avail = 1 } ssl_ca = </etc/pki/tls/certs/chain-2228.pem ssl_cert = </etc/pki/tls/certs/cert-2228.pem ssl_key = </etc/pki/tls/private/key-2228.pem syslog_facility = local1 ssl_protocols = !SSLv2 !SSLv3 -----------------------------------------------------------------------------

1 1

Re: concerning dovecot settings for high volume server
by Rajesh M 17 Sep '15

17 Sep '15

thanks very much urban. this was very helpful. i have around 12500 users spread over 3 independent servers each having around 4000+ users i am using qmailtoaster, vpopmail, spamassassin and dovecot. in future i am planning to consolidate all using a HA cluster. if it is ok with you could you kindly share some information about your email server configuration. if you do not wish to put it on the list then you can directly email me. 1) is your email volume high ? 2) server hardware to support 28000 users 3) mailserver software - exim or postfix ??. 4) antispam software like spamassassin if any also if you have faced any email re-download issues with dovecot sometimes randomly incase of pop3 users storing emails on the server ? thanks rajesh ----- Original Message ----- From: Urban Loesch [mailto:bind@enas.net] To: dovecot(a)dovecot.org Sent: Sun, 13 Sep 2015 09:33:14 +0200 Subject: Re: concerning dovecot settings for high volume server Hi, I have running dovecot with about 28k users. Here comes my relevant config for pop3 and imap from "doveconf -n". No problems so far. -- snip -- default_client_limit = 2000 ... service imap-login { inet_listener imap { port = 143 } process_limit = 256 process_min_avail = 50 service_count = 1 } service imap { process_limit = 2048 process_min_avail = 50 service_count = 1 vsz_limit = 512 M } ... service pop3-login { inet_listener pop3 { port = 110 } process_limit = 256 process_min_avail = 25 service_count = 1 } service pop3 { process_limit = 256 process_min_avail = 25 service_count = 1 } ... protocol imap { imap_client_workarounds = tb-extra-mailbox-sep imap_id_log = * imap_logout_format = bytes=%i/%o session=<%{session}> mail_max_userip_connections = 40 mail_plugins = " quota mail_log notify zlib imap_quota imap_zlib" } ... protocol pop3 { mail_plugins = " quota mail_log notify zlib" pop3_logout_format = bytes_sent=%o top=%t/%p, retr=%r/%b, del=%d/%m, \ size=%s uidl_hash=%u session=<%{session}> } -- snip -- Regards Urban Am 12.09.2015 um 20:53 schrieb Rajesh M: > hi > > centos 6 64 bit > > hex core processor with hyperthreading ie display shows 12 cores > 16 gb ram > 600 gb 15000 rpm drive > > we are having around 4000 users on a server > > > i wish to allow 1500 pop3 and 1500 imap connections simultaneously. > > need help regarding the settings to handle the above > > imap-login, pop3-login > imap pop3 service settings > > i recently i got an error > imap-login: Error: read(imap) failed: Remote closed connection (process_limit reached?) > > > my current dovecot config file > > # 2.2.7: /etc/dovecot/dovecot.conf > # OS: Linux 2.6.32-431.23.3.el6.x86_64 x86_64 CentOS release 6.5 (Final) > auth_cache_negative_ttl = 0 > auth_cache_ttl = 0 > auth_mechanisms = plain login digest-md5 cram-md5 > default_login_user = vpopmail > disable_plaintext_auth = no > first_valid_gid = 89 > first_valid_uid = 89 > log_path = /var/log/dovecot.log > login_greeting = ready. > mail_max_userip_connections = 50 > mail_plugins = " quota" > managesieve_notify_capability = mailto > managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave > namespace { > inbox = yes > location = > prefix = > separator = . > type = private > } > passdb { > args = cache_key=%u webmail=127.0.0.1 > driver = vpopmail > } > plugin { > quota = maildir:ignore=Trash > quota_rule = ?:storage=0 > } > protocols = imap pop3 > service imap-login { > client_limit = 256 > process_limit = 400 > process_min_avail = 4 > service_count = 0 > vsz_limit = 512 M > } > service pop3-login { > client_limit = 1000 > process_limit = 400 > process_min_avail = 12 > service_count = 0 > vsz_limit = 512 M > } > ssl_cert = </var/qmail/control/servercert.pem > ssl_dh_parameters_length = 2048 > ssl_key = </var/qmail/control/servercert.pem > userdb { > args = cache_key=%u quota_template=quota_rule=*:backend=%q > driver = vpopmail > } > protocol imap { > imap_client_workarounds = delay-newmail > mail_plugins = " quota imap_quota" > } > protocol pop3 { > pop3_client_workarounds = outlook-no-nuls oe-ns-eoh > pop3_fast_size_lookups = yes > pop3_lock_session = no > pop3_no_flag_updates = yes > } > > > thanks very much, > > rajesh >

3 2

restrict map-login by geoip?
by Terry Barnum 17 Sep '15

17 Sep '15

Is there a way to restrict my user logins from a set of IPs? For example, all my users are in the US so there shouldn't be any logins from other countries. Can I tell dovecot to restrict logins to a CIDR list of US IPs? Can someone point me to docs on how to set this up? I've searched but haven't found how to accomplish this. Thanks, -Terry Terry Barnum digital OutPost http://www.dop.com

4 5

New created users can not log in
by Ferdinand Gruber 17 Sep '15

17 Sep '15

Hi, I am using dovecot 2.2 for some time. All users on the system can log in using Horde Webmail. But now, after creating a new user on the server with <useradd -m username> this new user is not able to log in. Of course I have set a password for the new user. In the log file I can see: Sep 16 23:04:05 servername auth: gkr-pam: error looking up user information Sep 16 23:04:07 servername HORDE: [imp] [login] Authentication failed. [pid 1584 on line 730 of "/srv/www/htdocs/horde/imp/lib/Imap.php"] Sep 16 23:04:07 servername HORDE: [imp] FAILED LOGIN for calendar (93.82.157.132) to {imap://localhost/} [pid 1584 on line 157 of "/srv/www/htdocs/horde/imp/lib/Auth.php"] Sep 16 23:04:07 servername HORDE: [horde] FAILED LOGIN for calendar to horde (93.82.157.132) [pid 1584 on line 199 of "/srv/www/htdocs/horde/login.php"] Please give me a hint. -- Ferdinand

2 2

How to "Windows Authenticate"
by Mark Foley 17 Sep '15

17 Sep '15

I've been using Dovecot 2.2.15 as the IMAP server for Outlook (2010/2013) on Windows workstations for over 6 months with no problems. Dovecot is hosted on the office Samba4 AC/DC server. I have been using auth_mechanisms plain login, and passdb driver = shadow. What I'd like to do now is use the "Windows Authenticated" login so I don't have to have separate passwords for users logging into the Windows AD workstations and their Outlook clients. If anyone has actually done this I'd appreciate some tips. My various attempts have not been successful. Here is my current config: $ doveconf -n # 2.2.15: /usr/local/etc/dovecot/dovecot.conf # OS: Linux 3.10.17 x86_64 Slackware 14.1 auth_debug_passwords = yes auth_mechanisms = plain login auth_verbose = yes auth_verbose_passwords = plain disable_plaintext_auth = no info_log_path = /var/log/dovecot_info mail_location = maildir:~/Maildir passdb { driver = shadow } protocols = imap ssl_cert = </etc/ssl/certs/OHPRS/GoDaddy/Apache/c5fe0cc8242d6030.crt ssl_key = </etc/ssl/certs/OHPRS/GoDaddy/mail.ohprs.org.key userdb { driver = passwd } verbose_ssl = yes Thanks, Mark Foley

4 17

FreeBSD 10 & default_vsz_limit causing reboots?
by Rick Romero 15 Sep '15

15 Sep '15

Ok, So this is really more of an observation than anything else. I had a FreeBSD 10.1 server that was running great. Some SSL issue came up, or I upgrade Dovecot in ports - something occurred and the machine started rebooting randomly. It would run for 2 weeks, then reboot. It might run for 5 days and then reboot. So I started doing more FreeBSD upgrades, thinking it was a kernel issue. The reboots only increased. This weekend I started thinking I might actually be having hardware issues. But, since I don't have easy physical access to the box and it's REALLY under loaded, I figured what the hell and upraded to 10.2 on Sunday. I think it rebooted 4 times after that on Sunday, and then another 2 times Monday morning. Its worth noting that while I have crash dumps enabled, they don't seem to be occurring. So hardware is still a possibility. After the 2nd Monday morning reboot, I started to wonder if there was some sort of process issue. Besides the OS upgrades - I had been monitoring the Dovecot logs for when the process limits are reached, and increasing them. It's a 'big' box, and load is typically between .30 and .50. CPUs aren't overtaxed, and most of the memory is dedicated to ZFS. The reboots are so short, I've only received one 'down' alert due to them. So it's a conerning issue, but not really impacting production. On a whim I changed my default_vsz_limit (as I had been increasing every other limit but that) from 384M to 512M. The system hasn't rebooted in 24hours. Now that could be a coincidence, but I thought I'd at least put it out there. If you see anything weird in my dovecot config, let me know - My config was originally vpopmail, but over time I've migrated to SQL-only. root@romulus:/usr/local/etc/dovecot # dovecot -n # 2.2.18: /usr/local/etc/dovecot/dovecot.conf # OS: FreeBSD 10.2-RELEASE amd64 auth_master_user_separator = * auth_mechanisms = plain login auth_username_translation = %@ auth_verbose = yes default_login_user = dovecot default_vsz_limit = 512 M disable_plaintext_auth = no first_valid_gid = 89 first_valid_uid = 89 last_valid_gid = 89 last_valid_uid = 89 log_path = /dev/stderr login_greeting = Ready. login_trusted_networks = 172.16.100.0/24 mail_fsync = never mail_plugins = " quota zlib stats" mail_privileged_group = mail namespace compat { alias_for = hidden = yes inbox = no list = no location = prefix = INBOX. separator = . } namespace inbox { inbox = yes location = prefix = separator = . } passdb { args = /usr/local/etc/dovecot/dovecot-master-sql.conf driver = sql master = yes pass = yes } passdb { args = /usr/local/etc/dovecot/dovecot-sql.conf driver = sql } plugin { quota = maildir quota_rule = Trash:storage=+10%% stats_refresh = 30 secs stats_track_cmds = yes } protocols = imap pop3 service anvil { client_limit = 3175 } service auth { client_limit = 3684 unix_listener auth-master { mode = 0600 } } service imap-login { process_limit = 1536 process_min_avail = 25 service_count = 1 } service imap-postlogin { executable = script-login rawlog /usr/local/etc/dovecot/lastauth-imap.sh user = vpopmail } service imap { executable = /usr/local/libexec/dovecot/imap imap-postlogin process_limit = 1536 } service pop-postlogin { executable = script-login /usr/local/etc/dovecot/lastauth-pop.sh user = vpopmail } service pop3-login { process_limit = 1536 process_min_avail = 15 service_count = 1 } service pop3 { executable = /usr/local/libexec/dovecot/pop3 pop-postlogin } service stats { fifo_listener stats-mail { mode = 0600 user = vpopmail } } shutdown_clients = no ssl_cert = </etc/ssl/mail.pem ssl_key = </etc/ssl/mail.key ssl_key_password = na userdb { driver = prefetch } verbose_proctitle = yes protocol imap { imap_client_workarounds = delay-newmail tb-extra-mailbox-sep mail_max_userip_connections = 100 mail_plugins = " quota zlib stats imap_zlib quota imap_quota" } protocol pop3 { mail_max_userip_connections = 100 mail_plugins = quota pop3_client_workarounds = outlook-no-nuls oe-ns-eoh pop3_uidl_format = %08Xu%08Xv }

3 5