November 2016 - dovecot

Re: logging TLS SNI hostname
by Arkadiusz Miśkiewicz 08 Nov '16

08 Nov '16

On Tuesday 08 of November 2016, Aki Tuomi wrote: > > On November 8, 2016 at 4:08 PM Arkadiusz Miśkiewicz <arekm(a)maven.pl> > > wrote: > > > > On Thursday 20 of October 2016, Arkadiusz Miśkiewicz wrote: > > > On Thursday 20 of October 2016, Aki Tuomi wrote: > > > > On 20.10.2016 15:52, Arkadiusz Miśkiewicz wrote: > > > > > > ... -servername something > > > > > > > > If you want to try out, try applying this patch... > > > > > > Works, thanks! > > > > But... it's easy to log fake things > > > > Nov 8 15:04:01 mbox dovecot: pop3-login: Aborted login (no auth attempts > > in 1 secs): user=<>, rip=127.0.0.1, lip=127.0.0.1, > > local_name=whitehouse.gov, i_can=put_anything, here=etc, TLS, > > session=<26rEnMpAPMtb6rD0> > > > > by using > > > > openssl s_client -connect 127.0.0.1:110 -starttls pop3 -servername > > "whitehouse.gov, i_can=put_anything, here=etc" > > > > so some escaping here would also be needed. > > > > conf: > > login_log_format_elements = user=<%u> method=%m rip=%r lip=%l mpid=%e > > local_name=%{local_name} %c session=<%{session}> > > > > > > From 066edb5e5c14a05c90e9ae63f0b76fcfd9c1149e Mon Sep 17 00:00:00 > > > > 2001 From: Aki Tuomi <aki.tuomi(a)dovecot.fi> > > > > Date: Thu, 20 Oct 2016 16:06:27 +0300 > > > > Subject: [PATCH] login-common: Include local_name in > > > > login_var_expand_table > > > > > > > > This way it can be used in login_log_format > > There is escaping in the final code in 2.2.26.0. This is on 2.2.26.0. Escaping was only added to auth code, not logging one, right? -- Arkadiusz Miśkiewicz, arekm / ( maven.pl | pld-linux.org )

1 0

logging TLS SNI hostname
by Arkadiusz Miśkiewicz 08 Nov '16

08 Nov '16

Is there a way to log SNI hostname used in TLS session? Info is there in SSL_CTX_set_tlsext_servername_callback, dovecot copies it to ssl_io->host. Unfortunately I don't see it expanded to any variables ( http://wiki.dovecot.org/Variables ). Please consider this to be a feature request. The goal is to be able to see which hostname client used like: May 30 08:21:19 xxx dovecot: pop3-login: Login: user=<abc>, method=PLAIN, rip=1.1.1.1, lip=2.2.2.2, mpid=17135, TLS, SNI=pop3.somehost.org, session=<hfS9Qwk03sBTBnrN> -- Arkadiusz Miśkiewicz, arekm / ( maven.pl | pld-linux.org )

3 11

build failure --without-ssl
by Eray Aslan 08 Nov '16

08 Nov '16

dovecot-2.2.26.0: $ ./configure --without-ssl && make [...] libtool: error: cannot find the library '../lib-ssl-iostream/libssl_iostream_openssl.la' or unhandled argument '../lib-ssl-iostream/libssl_iostream_openssl.la' make[3]: *** [Makefile:738: test-http-client] Error 1 Had a quick look. When configured without ssl, the tests were failing at run time for dovecot-2.2.25. So, this change is good but not enough. Apparently, some people do use dovecot without ssl. https://bugs.gentoo.org/show_bug.cgi?id=599024 -- Eray

1 0

Dovecot and zlib
by Peter Fraser 07 Nov '16

07 Nov '16

HI All I have a dovecot 1 server up and running without zlib and I am setting up a new Dovecot 2 Server and I want to use zlib. What is the proper way to do this? Should I set up the new server, copy the mail across and then enable zlib or do I compress the current mail in place and then copy across? Thanks for any help.

1 0

sieve sending vacation message from vmail@ns1.domain.tld
by Matthew Broadhead 07 Nov '16

07 Nov '16

I have a server running centos-release-7-2.1511.el7.centos.2.10.x86_64 with dovecot version 2.2.10. I am also using roundcube for webmail. when a vacation filter (reply with message) is created in roundcube it adds a rule to managesieve.sieve in the user's mailbox. everything works fine except the reply comes from vmail(a)ns1.domain.tld instead of user(a)domain.tld. ns1.domain.tld is the fully qualified name of the server. it used to work fine on my old CentOS 6 server so I am not sure what has changed. Can anyone point me in the direction of where I can configure this behaviour?

2 17

virtual mailbox: any way to include.....
by Larry Rosenman 06 Nov '16

06 Nov '16

a namespace that starts with # in a dovecot-virtual file? \# and plain # does NOT work. -- Larry Rosenman http://www.lerctr.org/~ler Phone: +1 214-642-9640 (c) E-Mail: larryrtx(a)gmail.com US Mail: 17716 Limpia Crk, Round Rock, TX 78664-7281

2 2

dovecot-antispam plugin not work
by basti 04 Nov '16

04 Nov '16

Hello, I try to use the plugin for my dovecot in debian. It seem that the /usr/bin/sa-learn-pipe.sh is not execute. When I run /usr/bin/sa-learn-pipe.sh from commandline logfiles are created. I also read https://johannes.sipsolutions.net/files/antispam.html In syslog you can see fist move a mail from "z_SPAM" to INBOX and then move a mail from INBOX to "z_SPAM". Can you please help? Best regards Config and log's are append. dpkg -l | grep dovecot ii dovecot-antispam 2.0+20130912-2 amd64 Dovecot plugins for training spam filters ii dovecot-core 1:2.2.13-12~deb8u1 amd64 secure POP3/IMAP server - core files ii dovecot-imapd 1:2.2.13-12~deb8u1 amd64 secure POP3/IMAP server - IMAP daemon ii dovecot-pgsql 1:2.2.13-12~deb8u1 amd64 secure POP3/IMAP server - PostgreSQL support ### log root@vsrv78105:/etc/dovecot# /etc/init.d/dovecot restart [ ok ] Restarting dovecot (via systemctl): dovecot.service. root@vsrv78105:/etc/dovecot# tail -f /var/log/syslog | grep imap Nov 3 20:02:45 vsrv78105 dovecot: imap-login: Warning: Killed with signal 15 (by pid=1 uid=0 code=kill) Nov 3 20:02:48 vsrv78105 dovecot: master: Dovecot v2.2.13 starting up for imap (core dumps disabled) Nov 3 20:03:03 vsrv78105 dovecot: imap-login: Login: user=<xxx>, method=PLAIN, rip=xxx, lip=xxx, mpid=14954, TLS, session=<pqb/NGpAvgBP8o1u> Nov 3 20:03:03 vsrv78105 imap: antispam: plugin initialising (2.0-notgit) Nov 3 20:03:03 vsrv78105 imap: antispam: verbose debug enabled Nov 3 20:03:03 vsrv78105 imap: antispam: "Spam" is exact match spam folder Nov 3 20:03:03 vsrv78105 imap: antispam: "SPAM" is exact match spam folder Nov 3 20:03:03 vsrv78105 imap: antispam: "z_SPAM" is exact match spam folder Nov 3 20:03:03 vsrv78105 imap: antispam: no unsure folders Nov 3 20:03:03 vsrv78105 imap: antispam: "Trash" is exact match trash folder Nov 3 20:03:03 vsrv78105 imap: antispam: "trash" is exact match trash folder Nov 3 20:03:03 vsrv78105 imap: antispam: pipe backend tmpdir /tmp Nov 3 20:03:13 vsrv78105 imap: antispam: mailbox_is_unsure(INBOX): 0 Nov 3 20:03:13 vsrv78105 imap: antispam: mailbox_is_trash(z_SPAM): 0 Nov 3 20:03:13 vsrv78105 imap: antispam: mailbox_is_trash(INBOX): 0 Nov 3 20:03:13 vsrv78105 imap: antispam: mail copy: from trash: 0, to trash: 0 Nov 3 20:03:13 vsrv78105 imap: antispam: mailbox_is_spam(z_SPAM): 0 Nov 3 20:03:13 vsrv78105 imap: antispam: mailbox_is_spam(INBOX): 0 Nov 3 20:03:13 vsrv78105 imap: antispam: mailbox_is_unsure(z_SPAM): 0 Nov 3 20:03:13 vsrv78105 imap: antispam: mail copy: src spam: 0, dst spam: 0, src unsure: 0 Nov 3 20:03:14 vsrv78105 dovecot: imap-login: Login: user=<xxx>, method=PLAIN, rip=xxx, lip=xxx, mpid=14959, TLS, session=<KxqnNWpAvwBP8o1u> Nov 3 20:03:14 vsrv78105 imap: antispam: plugin initialising (2.0-notgit) Nov 3 20:03:14 vsrv78105 imap: antispam: verbose debug enabled Nov 3 20:03:14 vsrv78105 imap: antispam: "Spam" is exact match spam folder Nov 3 20:03:14 vsrv78105 imap: antispam: "SPAM" is exact match spam folder Nov 3 20:03:14 vsrv78105 imap: antispam: "z_SPAM" is exact match spam folder Nov 3 20:03:14 vsrv78105 imap: antispam: no unsure folders Nov 3 20:03:14 vsrv78105 imap: antispam: "Trash" is exact match trash folder Nov 3 20:03:14 vsrv78105 imap: antispam: "trash" is exact match trash folder Nov 3 20:03:14 vsrv78105 imap: antispam: pipe backend tmpdir /tmp Nov 3 20:04:05 vsrv78105 imap: antispam: mailbox_is_unsure(z_SPAM): 0 Nov 3 20:04:05 vsrv78105 imap: antispam: mailbox_is_trash(INBOX): 0 Nov 3 20:04:05 vsrv78105 imap: antispam: mailbox_is_trash(z_SPAM): 0 Nov 3 20:04:05 vsrv78105 imap: antispam: mail copy: from trash: 0, to trash: 0 Nov 3 20:04:05 vsrv78105 imap: antispam: mailbox_is_spam(INBOX): 0 Nov 3 20:04:05 vsrv78105 imap: antispam: mailbox_is_spam(z_SPAM): 0 Nov 3 20:04:05 vsrv78105 imap: antispam: mailbox_is_unsure(INBOX): 0 Nov 3 20:04:05 vsrv78105 imap: antispam: mail copy: src spam: 0, dst spam: 0, src unsure: 0 ^C root@vsrv78105:/etc/dovecot# ls -la /tmp/ insgesamt 8864 drwxrwxrwt 8 root root 12288 Nov 3 20:07 . drwxr-xr-x 22 root root 4096 Jun 17 14:41 .. drwxrwxrwt 2 root root 4096 Nov 1 14:16 .font-unix drwxrwxrwt 2 root root 4096 Nov 1 14:16 .ICE-unix drwxrwxrwt 2 root root 4096 Nov 1 14:16 .Test-unix drwxrwxrwt 2 root root 4096 Nov 1 14:16 .X11-unix drwxrwxrwt 2 root root 4096 Nov 1 14:16 .XIM-unix root@vsrv78105:/etc/dovecot# ls -la /etc/dovecot/sa-learn-pipe.sh -rwxr-xr-x 1 root root 769 Nov 3 19:38 /etc/dovecot/sa-learn-pipe.sh ######################### config ### 90-plugin.conf plugin { #setting_name = value antispam_backend = pipe antispam_debug_target = syslog antispam_verbose_debug = 1 # antispam_mail_sendmail_args= --username=%u antispam_mail_spam_arg = --spam antispam_mail_notspam_arg = --ham antispam_mail_program = /etc/dovecot/sa-learn-pipe.sh antispam_spam = Spam;SPAM;z_SPAM antispam_trash = Trash;trash } ### sa-learn-pipe.sh #!/bin/bash set -x pid=$$ # remove the # from next line to background learner #( { echo "$(date) ${pid}-start ($*) /tmp/sendmail-msg-$$.txt" set -x #id -a #env cat > /tmp/sendmail-msg-${pid}.txt /usr/bin/sa-learn "$@" /tmp/sendmail-msg-${pid}.txt echo "$(date) $$-end rc=$?" } >/tmp/antispam.${pid}.log 2>&1 echo "cat antispam.${pid}.log" cat /tmp/antispam.${pid}.log >>/tmp/sa-learn-pipe.log rm -f /tmp/antispam.${pid}.log /tmp/sendmail-msg-${pid}.txt true # remove the # from next line to background learner #) & exit 0

2 2

Errors with count:User quota and NFS
by Tom Sommer 04 Nov '16

04 Nov '16

I upgraded to 2.2.26.0 and enabled count as quota backend, expecting the recent fixes to allow me to use the backend, however I get the following errors: Oct 31 10:52:13 imap(xxxx(a)xxxx.xx): Error: Transaction log file /mnt/nfs/xxxx.xx/xxx/indexes/dovecot.list.index.log: marked corrupted Oct 31 10:52:15 imap(xxx(a)xxxx.xx): Error: Transaction log file /mnt/nfs/xxxx.xx/xxx/indexes/dovecot.list.index.log: marked corrupted Oct 31 10:52:37 imap(xxx(a)xxxx.xx): Warning: Locking transaction log file /mnt/nfs/xxx.xx/xxx/indexes/dovecot.list.index.log took 31 seconds (syncing) Oct 31 10:52:37 imap(xxx(a)xxx.xx): Warning: Locking transaction log file /mnt/nfs/xxx.xx/xxx/indexes/dovecot.list.index.log took 31 seconds (syncing) Oct 31 10:52:43 imap(xxx(a)xxx.xx): Error: Transaction log file /mnt/nfs/xxx.xx/xx/indexes/dovecot.list.index.log: marked corrupted Oct 31 10:52:52 imap(xxx(a)xxx.xx): Warning: Locking transaction log file /mnt/nfs/xxx.xx/xxx/indexes/dovecot.list.index.log took 31 seconds (syncing) Oct 31 10:53:04 imap(xxx(a)xxx.x): Warning: Locking transaction log file /mnt/nfs/xxx.xx/xxx/indexes/dovecot.list.index.log took 60 seconds (syncing) Oct 31 10:53:06 imap(xxx(a)xxx.xx): Warning: Locking transaction log file /mnt/nfs/xxx.xxx/xxx/indexes/dovecot.list.index.log took 31 seconds (syncing) (all different accounts) If I disable count as backend, there are no errors. I'm running my mail-storage on NFS, so I suspect the errors are due to locking? So is there no way to run count as quota backend with NFS? Thanks. -- Tom

2 4

deleting indices
by cheese＠nosuchhost.net 04 Nov '16

04 Nov '16

hi i have dovecot 2.0.9 - the version from rhel6 - and the following setup: two imap-servers with distinct /var/indices. those directory is local only, no sharing. the users mailboxes life on a shared nfs-storage. the two servers are setup active/passive: only one server is active and in case of a problem or maintenance the second server jumps in. no director in place. we would like to upgrade to rhel7 and add a director. there would be dovecot 2.2.10, but will take some time. one application (horde + activesync which use imap to access emails) seems to have troubles during the second server being active. horde relies according to their deveolpers heavily on modseq/qresync and if we switch to the seconds side there is another set of index-files. my knowledge was that deletion/corruption of index-files would be never a problem, as dovecot recreates them automatically. is this true for QRESNC, too? * is it a problem to have a old set of index-files on the second server, as this system is only in use every 3-4 weeks? * would it be better to start with empty indices? but there we have trouble with horde. and as it seems only with horde. "normal" imap-clients seem to be fine. yours josef

1 0

Forcibly terminated after 10 milliseconds
by Doug Luce 03 Nov '16

03 Nov '16

After an OS upgrade (to FreeBSD 11 with pkg Dovecot 2.2.26) I'm getting this sort of thing in my logs: Nov 3 12:15:16 toma dovecot: lda(doug): Error: program `/usr/local/lib/dovecot/sieve-pipe/growlmail' was forcibly terminated with signal 15 Debugging gives a little more info: Nov 3 12:05:51 toma dovecot: lda(doug): Debug: waiting for program `/usr/local/lib/dovecot/sieve-pipe/growlmail' to finish after 0 msecs Nov 3 12:05:51 toma dovecot: lda(doug): Debug: program `/usr/local/lib/dovecot/sieve-pipe/growlmail'(11794) execution timed out after 10 milliseconds: sending TERM signal growlmail is specified via a sieve rule: pipe :try :copy "growlmail"; This would seem to be a function of input_idle_timeout_msecs in lib-program-client/program-client-local.c, but it's not clear where this is set (or why it would be 10 milliseconds by default). Is there a way to up this timeout? Thanks, Doug # 2.2.26 (54d6540): /usr/local/etc/dovecot/dovecot.conf # Pigeonhole version 0.4.15 (97b3da0) # OS: FreeBSD 11.0-RELEASE-p2 amd64 auth_debug = yes auth_debug_passwords = yes auth_mechanisms = plain login auth_verbose = yes auth_verbose_passwords = plain base_dir = /var/dovecot/ debug_log_path = /var/log/dovecot-debug.log default_login_user = nobody mail_debug = yes mail_fsync = never mail_location = maildir:~/Maildir:INDEX=/var/indexes/%u mail_plugins = " fts fts_solr" maildir_very_dirty_syncs = yes managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext vnd.dovecot.pipe vnd.dovecot.execute mbox_write_locks = fcntl passdb { args = failure_show_msg=yes dovecot driver = pam } plugin { fts = solr fts_autoindex = yes fts_solr = url=http://localhost:4949/solr/dovecot/ fts_tika = http://localhost:9998/tika sieve = ~/.dovecot.sieve sieve_dir = ~/sieve sieve_execute_bin_dir = /usr/local/lib/dovecot/sieve-execute sieve_extensions = +vnd.dovecot.pipe +vnd.dovecot.execute sieve_pipe_bin_dir = /usr/local/lib/dovecot/sieve-pipe sieve_plugins = sieve_extprograms sieve_vacation_dont_check_recipient = yes } protocols = imap sieve lmtp service auth { service_count = 0 unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } user = root } service imap-login { idle_kill = 0 inet_listener imap { address = 127.0.0.1 port = 143 } inet_listener imaps { address = 0.0.0.0 127.0.0.1 port = 993 } service_count = 0 user = dovecot } service lmtp { service_count = 0 unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } service managesieve-login { group = dovecot inet_listener sieve { port = 4190 } user = dovecot } ssl_cert = </usr/local/etc/nginx/ssl/con.crt ssl_key = # hidden, use -P to show it userdb { driver = passwd } protocol imap { imap_client_workarounds = delay-newmail tb-extra-mailbox-sep mail_max_userip_connections = 20 } protocol lda { mail_plugins = " fts fts_solr sieve" } protocol lmtp { mail_plugins = " fts fts_solr sieve" }

2 1