November 2016 - dovecot

post-delivery virus scan
by Brad Koehn 11 Nov '16

11 Nov '16

I have discovered that many times the virus definitions I use for scanning messages (ClamAV, with the unofficial signatures http://sanesecurity.com/usage/linux-scripts/) are updated some time after my server has received an infected email. It seems the virus creators are trying to race the virus definition creators to see who can deliver first; more than half of the infected messages are found after they’ve been delivered. Great. To help detect and remove the infected messages after they’ve been delivered to users’ mailboxes, I created a small script that iterates the INBOX and Junk mailbox directories, scans recent messages for viruses, and deletes them if found. The source of my script (run via cron) is here: https://gitlab.koehn.com/snippets/9 Unfortunately Dovecot doesn’t like it if messages are deleted (dbox) out from under it. I tried a doveadm force-resync on the folder containing the messages, but it seems Dovecot is still unhappy. At least on the new version (2.2.26.0) it doesn’t crash; 2.2.25 would panic and coredump when it discovered messages had been deleted. I’m wondering if there’s a better way to scan recent messages and eradicate them so the Dovecot isn’t upset when it happens. Maybe using doveadm search? Looking for suggestions. --- Brad

6 9

Re: How does one mark all messages as read (imap4flag "seen") with sieve?
by Ben Johnson 11 Nov '16

11 Nov '16

On 11/10/2016 2:02 AM, Aki Tuomi wrote: > Hi! > > Can you provide bt full from gbd? > > Install debug symbols and acquire core file > > Run gdb /path/to/bin /path/to/core > > Issue bt ful > > Send it to list. > > > Aki Tuomi > > Dovecot oy > > > > On November 10, 2016 at 2:42 AM Larry Rosenman <larryrtx(a)gmail.com> > wrote: > > looks to me from the coredump (although you pointed to the wrong binary) > that > deliver was PANIC()'ing with > > io_add(0x%x) called twice fd=%d, callback=%p -> %p > > I'm not sure what that message means, but maybe one of the dovecot folks > does. > > Are all the packages built together? > > Are you averse to compiling stuff yourself? Thanks so much for the assistance here, Larry and Aki. Aki, you had asked me to send this core-dump to the list when I asked about it back in September; I did post the "bt full" output at that time, but there were no further replies: http://www.dovecot.org/list/dovecot/2016-September/105428.html And for convenience, here is the "bt full" output I posted back then: http://pastebin.com/4xdGNXa6 So, this is where I'm confused: Larry, you mentioned "although you pointed to the wrong binary", which is a concern I had asked about back in September: http://www.dovecot.org/list/dovecot/2016-September/105424.html I still don't understand how this is pointing to the wrong binary: # gdb /usr/lib/dovecot/dovecot-lda /var/vmail/tmp/core-deliver-6-5000-5000-29125-1473732949 Is /usr/lib/dovecot/dovecot-lda not the binary that segfaulted here? Sure, the gdb output says, "Core was generated by `/usr/lib/dovecot/deliver ...", but on the system in question, that is a symlink pointing to /usr/lib/dovecot/dovecot-lda: # ls -lah /usr/lib/dovecot/deliver lrwxrwxrwx 1 root root 11 Sep 21 10:29 /usr/lib/dovecot/deliver -> dovecot-lda What am I missing here? The mismatch message does say something specific about this: warning: the debug information found in "/lib64/ld-2.23.so" does not match "/lib64/ld-linux-x86-64.so.2" (CRC mismatch). Is this the result of pointing to the wrong executable when calling "gdb"? If so, where is the correct executable to pass as the fist argument? Again, for convenience, the pipe script I'm using: http://pastebin.com/zXzBDcvG And the debug output from said pipe script: http://pastebin.com/rz2f4S4G My full "doveconf -n": http://pastebin.com/hCgpA009 Thanks! -Ben

1 0

service doveadm : ssl problems
by nerbrume＠free.fr 10 Nov '16

10 Nov '16

Hello, I'm using dovecot 2.2.13 on Debian stable. My users are authenticated through PAM, and stored in an LDAP backend I'm trying to set-up replication with ssl, following (mainly) this : http://wiki2.dovecot.org/Replication 1) I only diverted from the instructed setup by not setting "doveadm_port = 12345", as it would give me errors of the like: > Fatal: /var/run/dovecot/auth-userdb: Configured passdbs don't support crentials lookups (to see if user is proxied, because doveadm_port is set) but rather specifying the port in the mail_replica setting : "mail_replica = tcps:my.domain.com:1465" (following a mail from here : http://www.dovecot.org/list/dovecot/2016-September/105356.html) So far, this seems to be working for me. 2) However, I'm having ssl problems. I have a let's encrypt certificate, and have concatened the CA cert and my server cert in a fullchain.pem. Excerpt from my ssl config : > ssl = yes > ssl_cert = </etc/letsencrypt/live/my.domain.com/fullchain.pem > ssl_key = </etc/letsencrypt/live/my.domain.comi/privkey.pem doveadm return me these errors (sudo -u dovecot doveadm -v sync -u user tcps:my.domain.com:12345) : > doveadm(casoli): Info: Received invalid SSL certificate: unable to get local issuer certificate: /CN=my.domain.com > doveadm(casoli): Error: doveadm server disconnected before handshake: Received invalid SSL certificate: unable to get local issuer certificate: /CN=my.domain.com > doveadm(casoli): Fatal: Disconnected from remote: Received invalid SSL certificate: unable to get local issuer certificate: /CN=my.domain.com Which I can reproduce with openssl (openssl s_client -showcerts -CApath /etc/ssl/certs -connect my.domain.com:12345) : > (...) > Verify return code: 21 (unable to verify the first certificate) Indeed, in this case, dovecot only returns the local part of the certificate (my.domain.com) and not the full chain (with the intermediate CA). While testing regular IMAPS with openssl is ok (openssl s_client -showcerts -CApath /etc/ssl/certs -connect my.domain.com:993) > (...) > Verify return code: 0 (ok) And I can see the full chain. So, it's seems to me that doveadm is somehow wrongly serving my certificate, truncating it, but I can't see why, and if this is a misconfiguratin on my part. I can post more config files or message outputs if needed, I kept them redacted here for the sake of brevity. Regards, N

2 2

Dovecot 2 LDAP "unknown user"
by Peter Fraser 10 Nov '16

10 Nov '16

Hi All I am using Dovecot dovecot2-2.2.25_6 on FreeBSD 11. I am trying to set up LDAP authentication to Active Director as I had it in version 1 of Dovecot. My settings are at bottom. When I run doveadm auth test username, I get back root@BSD-11:/usr/local/etc/dovecot # doveadm auth test username Password: passdb: user auth succeeded extra fields: user=username root@BSD-11:/usr/local/etc/dovecot # But when I run telnet 127.0.0.1 110 and try to log in it says unknown user. Error below in maillog. BSD-11 dovecot: pop3: Error: Authenticated user not found from userdb, auth lookup id=2262958081 (client-pid=2273 client-id=1) Nov 1 15:15:41 BSD-11 dovecot: pop3-login: Internal login failure (pid=2273 id=1) (internal failure, 1 successful auths): user= root@BSD-11:/usr/local/etc/dovecot # doveconf -n # 2.2.25 (7be1766): /usr/local/etc/dovecot/dovecot.conf # OS: FreeBSD 11.0-RELEASE-p1 i386 auth_debug = yes auth_verbose = yes listen = * login_greeting = Mail Server ready. mail_location = maildir:~/Maildir namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = /usr/local/etc/dovecot/dovecot-ldap.conf.ext driver = ldap } ssl_cert = </usr/local/etc/certs/certs/dovecot.pem ssl_key = </usr/local/etc/certs/private/dovecot.pem userdb { args = /usr/local/etc/dovecot/dovecot-ldap.conf.ext driver = ldap } protocol lda { mail_plugins = } #Contents of dovecot-ldap.conf.ext hosts = 192.168.153.143 dn = user(a)domain.com dnpass = password auth_bind = yes auth_bind_userdn = domain\%u ldap_version = 3 base = dc=domain,dc=com pass_filter = (&(objectclass=person)(uid=%u)) user_attrs = homeDirectory=/home/vmail/%u,uid=1002,gid=1002 Amy help would be appreciated.

3 9

question concerning junk folder
by Rajesh M 10 Nov '16

10 Nov '16

hi using centos 6.5, qmailtoaster, dovecot, spamassassin. i found that junk folder is specified under /etc/dovecot/conf.d/15-mailboxes.conf the issue is that this folder is getting created automatically and genuine emails from both within the server and also from external domains are being routed to the Junk folder. all these emails are not scanned by spamassasin. i wish to disable to creation of Junk folder and also routing of emails to the Junk folder. help required please. ##################### # NOTE: Assumes "namespace inbox" has been defined in 10-mail.conf. namespace inbox { # These mailboxes are widely used and could perhaps be created automatically: mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Trash { special_use = \Trash } ##################### rajesh

2 1

search body with wildcards
by W. de Hoog 10 Nov '16

10 Nov '16

Hi, A question. We are using fts_solr. When searching for content in BODY I noticed that dovecot only supports full words. "BODY calibration" returns results but "BODY calibra" does not. Nor "BODY calibra*". Solr does support searching with wildcards so why is it that dovecot does not? regards, -- Willem-Jan de Hoog

1 2

tons of dovecot/config processes
by Arkadiusz Miśkiewicz 10 Nov '16

10 Nov '16

Hi. I've noticed that dovecot (using 2.2.26.0 here) starts dovecot/config processes that stay for long time. Example: [root@ixion-pld ~]# service dovecot restart Stopping Dovecot service.......................................................................................................................................[ DONE ] Starting Dovecot service.......................................................................................................................................[ DONE ] [root@ixion-pld ~]# ps aux|grep dovecot root 25333 0.0 0.0 13736 2480 ? Ss 09:40 0:00 /usr/sbin/dovecot dovecot 25336 0.0 0.0 9480 924 ? S 09:40 0:00 dovecot/anvil [0 connections] root 25337 0.0 0.0 9612 2416 ? S 09:40 0:00 dovecot/log root 25339 0.0 0.0 12496 3256 ? S 09:40 0:00 dovecot/config root 25341 0.0 0.0 132168 888 pts/1 S+ 09:40 0:00 grep dovecot [root@ixion-pld ~]# doveadm reload [root@ixion-pld ~]# ps aux|grep dovecot root 25333 0.0 0.0 13872 2720 ? Ss 09:40 0:00 /usr/sbin/dovecot dovecot 25336 0.0 0.0 9480 924 ? S 09:40 0:00 dovecot/anvil [0 connections] root 25344 0.0 0.0 9612 2428 ? S 09:40 0:00 dovecot/log root 25346 0.0 0.0 12496 3192 ? S 09:40 0:00 dovecot/config root 25348 0.0 0.0 132168 876 pts/1 S+ 09:40 0:00 grep dovecot so far good - only one dovecot/config. Lets connect to pop3 and keep connection [root@ixion-pld ~]# telnet localhost pop3 Trying 127.0.0.1.110... Connected to localhost. Escape character is '^]'. +OK Mail server ready. on the other console [root@ixion-pld ~]# ps aux|grep dovecot root 25333 0.0 0.0 13872 2720 ? Ss 09:40 0:00 /usr/sbin/dovecot dovecot 25336 0.0 0.0 9480 924 ? S 09:40 0:00 dovecot/anvil [2 connections] root 25344 0.0 0.0 9612 2428 ? S 09:40 0:00 dovecot/log root 25346 0.0 0.0 12496 3192 ? S 09:40 0:00 dovecot/config dovenull 25364 0.0 0.0 20908 4080 ? S 09:41 0:00 dovecot/pop3-login [127.0.0.1] dovecot 25365 0.0 0.0 100236 7776 ? S 09:41 0:00 dovecot/auth [0 wait, 0 passdb, 0 userdb] root 25368 0.0 0.0 132168 856 pts/1 S+ 09:41 0:00 grep dovecot so there is a client connected and one dovecot/config. Lets reload: [root@ixion-pld ~]# doveadm reload [root@ixion-pld ~]# ps aux|grep dovecot root 25333 0.0 0.0 13872 2752 ? Ss 09:40 0:00 /usr/sbin/dovecot dovecot 25336 0.0 0.0 9480 924 ? S 09:40 0:00 dovecot/anvil [2 connections] root 25344 0.0 0.0 9612 2428 ? S 09:40 0:00 dovecot/log root 25346 0.0 0.0 12920 3700 ? S 09:40 0:00 dovecot/config dovenull 25364 0.0 0.0 20908 4080 ? S 09:41 0:00 dovecot/pop3-login [127.0.0.1] dovecot 25365 0.0 0.0 100236 7776 ? S 09:41 0:00 dovecot/auth [0 wait, 0 passdb, 0 userdb] root 25371 0.0 0.0 9612 2196 ? S 09:41 0:00 dovecot/log root 25373 0.0 0.0 12496 3196 ? S 09:41 0:00 dovecot/config root 25375 0.0 0.0 132168 856 pts/1 S+ 09:41 0:00 grep dovecot now we have two dovecot/config processes. Second dovecot/config stays there until client disconnects (what for?). When clients disconnects we are back to single dovecot/config: [root@ixion-pld ~]# ps aux|grep dovecot root 25333 0.0 0.0 13872 2752 ? Ss 09:40 0:00 /usr/sbin/dovecot dovecot 25336 0.0 0.0 9480 924 ? S 09:40 0:00 dovecot/anvil [0 connections] root 25371 0.0 0.0 9612 2196 ? S 09:41 0:00 dovecot/log root 25373 0.0 0.0 12496 3196 ? S 09:41 0:00 dovecot/config root 25418 0.0 0.0 132168 852 pts/1 S+ 09:43 0:00 grep dovecot Now on production server where are tons of clients this looks more insane: # ps aux|grep dovecot/config | wc -l 56 Note that I'm running with shutdown_clients = no here (+ high performance auth/login variant). So looks like something is not right here. Obviously with shutdown_clients=yes this doesn't occur since clients are disconnected. doveadm reload can happen every 2 minutes (because dovecot requires reload when SSL certificates change; new domain gets added, new cert gets automatically created -> reload, certificate is renewed (every 2 months) -> reload etc) -- Arkadiusz Miśkiewicz, arekm / ( maven.pl | pld-linux.org )

1 0

Dovecot processes turning zombie
by Adrian POPA 10 Nov '16

10 Nov '16

Hi I am running Ubuntu 14.04 (plan to go to 16.04) with Postfix and Dovecot 2.2.9 from Ubuntu repository. Dovecot configuration has not changed dramatically since the days of Ubuntu 12.04 (can't remember Dovecot version). In the last months, connection to Dovecot IMAP service become more and more dificult. First Ubuntu Thunderbird refused to connect, than Android phones. The last one connecting regularly was an old XP laptop(!). Now it's facing problems too. Again, I did not make any configuration changes lately so only system upgrades (libraries) may have caused this. The first thing to notice was that some Dovecot processes are going zombie (defunct). At startup "ssl-params", then sometimes "auth", "imap-login" and rarely "config". Turning on debug logging in Dovecot show that offending process "is ignoring idle SIGINT". And "auth client limit (1000) reached". This behavior also impacts on Postfix delivery through Dovecot LDA with "status=deferred (temporary failure)" (I turned off mail sending with -e in lda invocation). Another thing is SLL connection. Attempts to test with openssl s_client show that Dovecot is not responding after ClientHelo when it should normally send server certificate. The very same certificate is used with Postfix and it works (I can send mails through Postfix) but IMAP connections to Dovecot do not. There is no protocol mismatch because I have try a local SSL connection (same computer). Initial messages are TLS1.2 but nothing in response. So my question is: did you faced such problems and found a cause (and maybe a fix)? Upgrading to Ubuntu 16.04 with whatever Dovecot version it provides may resolve the issues? Thanks

1 0

<-FIN <-RST ->FIN,ACK <-RST on SSL connection shutdown
by Heiko Schlittermann 09 Nov '16

09 Nov '16

Hello, a typical connection close, tcpdump'ed on the server side, looks as follows: 21:44:01.168131 IP xxx.xxx.3.101.143 > xxx.xxx.3.96.35518: Flags [FP.], seq 3982457856:3982457959, ack 1570044906, win 243, options [nop,nop,TS val 138698279 ecr 159494908], length 103 21:44:01.172405 IP xxx.xxx.3.101.143 > xxx.xxx.3.96.35518: Flags [R], seq 3982457960, win 0, length 0 21:44:01.172442 IP xxx.xxx.3.96.35518 > xxx.xxx.3.101.143: Flags [F.], seq 32, ack 104, win 342, options [nop,nop,TS val 159494909 ecr 138698279], length 0 21:44:01.172471 IP xxx.xxx.3.101.143 > xxx.xxx.3.96.35518: Flags [R], seq 3982457960, win 0, length 0 The server closes (FIN) the connection, and already 4.274 ms later the server sends a RST to the client. The clients response to FIN arrives some μs later. (On the client side the order of the packages is different (FIN from Server, FIN,ACK from client, RST from Server, RST from Server) This behaviour seems to be odd (the client side firewall complains about the unexpected packages). I can reproduce it using openssl -connect … -starttls imap .. on the client side. It happens on IMAP+STARTTLS as well as on IMAPS. It does not happen on plaintext IMAP. There I see the expected shudown handshake FIN - FIN,ACK - ACK. Dovecot version is 2.2.24 (a82c823) Best regards from Dresden/Germany Viele Grüße aus Dresden Heiko Schlittermann -- SCHLITTERMANN.de ---------------------------- internet & unix support - Heiko Schlittermann, Dipl.-Ing. (TU) - {fon,fax}: +49.351.802998{1,3} - gnupg encrypted messages are welcome --------------- key ID: F69376CE - ! key id 7CBF764A and 972EAC9F are revoked since 2015-01 ------------ -

1 0

Backing up dovecot mailboxes
by Jerry 09 Nov '16

09 Nov '16

Does anyone have a working solution as to how I can use "doveadm backup" to back up a virtual users mailbox to a removable USB device. I keep receiving numerous errors and no files are backed up although the directories are created. -- Jerry

3 2