March 2016 - dovecot - dovecot.org

Dovecort-2.2.22
by Ralf Zimmermann 08 Mar '16

08 Mar '16

With Dovecot-2.2.22 and enabled virtual plugin I get following error messages: Error: Raw backtrace: /usr/local/lib/dovecot/libdovecot.so.0(+0x819f0) [0x7f12330bf9f0] -> /usr/local/lib/dovecot/libdovecot.so.0(+0x81adc) [0x7f12330bfadc] -> /usr/local/lib/dovecot/libdovecot.so.0(i_fatal+0) [0x7f123306833d] -> /usr/local/lib/dovecot/lib20_virtual_plugin.so(virtual_backend_box_close+0x178) [0x7f12320599f8] -> /usr/local/lib/dovecot/lib20_virtual_plugin.so(+0x9f94) [0x7f1232059f94] -> /usr/local/lib/dovecot/lib20_virtual_plugin.so(+0x9fe9) [0x7f1232059fe9] -> /usr/local/lib/dovecot/libdovecot-storage.so.0(mailbox_close+0x1a) [0x7f12333825da] -> /usr/local/lib/dovecot/libdovecot-storage.so.0(mailbox_free+0x13) [0x7f1233382663] -> dovecot/imap() [0x41870f] -> dovecot/imap() [0x423ce4] -> /usr/local/lib/dovecot/libdovecot.so.0(io_loop_handle_timeouts+0xda) [0x7f12330d28aa] -> /usr/local/lib/dovecot/libdovecot.so.0(io_loop_handler_run_internal+0x9c) [0x7f12330d3cbc] -> /usr/local/lib/dovecot/libdovecot.so.0(io_loop_handler_run+0x25) [0x7f12330d2a65] -> /usr/local/lib/dovecot/libdovecot.so.0(io_loop_run+0x38) [0x7f12330d2c08] -> /usr/local/lib/dovecot/libdovecot.so.0(master_service_run+0x13) [0x7f123306da23] -> dovecot/imap(main+0x2d7) [0x40c3c7] -> /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xf5) [0x7f1232cb4b45] -> dovecot/imap() [0x40c530] I test it with this configuration on Debian Jessie 64-bit: # dovecot.conf mail_plugins = $mail_plugins acl quota zlib virtual namespace { prefix = virtual/ separator = / location = virtual:~/Maildir/virtual } # ~/Maildir/virtual/unseen/dovecot-virtual INBOX unseen Mit freundlichen Grüßen Ralf Zimmermann Senior Security Engineer State Certified Engineer SIEGNETZ.IT GmbH Einheitsstrasse 2, D-57076 Siegen Telefon: +4927168193130 Fax: +492716819329 Mobil : +491735360015 http://www.siegnetz.de http://rz.siegnetz.de Amtsgericht Siegen HRB4838 Geschäftsführer: Oliver Seitz Sitz der Gesellschaft ist Siegen

2 3

[PATCH] imapc: Accept strings in FLAGS responses
by Richard Laager 08 Mar '16

08 Mar '16

While non-standard, the IMAP server we are replacing returns non-system flags as strings instead of atoms. Prior to this change, imapc would abort processing on the first message with a string flag. --- src/lib-storage/index/imapc/imapc-mailbox.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/lib-storage/index/imapc/imapc-mailbox.c b/src/lib-storage/index/imapc/imapc-mailbox.c index c3e12d1..91333dc 100644 --- a/src/lib-storage/index/imapc/imapc-mailbox.c +++ b/src/lib-storage/index/imapc/imapc-mailbox.c @@ -310,7 +310,8 @@ static void imapc_untagged_fetch(const struct imapc_untagged_reply *reply, t_array_init(&keywords, 8); seen_flags = TRUE; for (j = 0; flags_list[j].type != IMAP_ARG_EOL; j++) { - if (!imap_arg_get_atom(&flags_list[j], &atom)) + if (!imap_arg_get_atom(&flags_list[j], &atom) && + !imap_arg_get_string(&flags_list[j], &atom)) return; if (atom[0] == '\\') flags |= imap_parse_system_flag(atom); -- 2.1.4

1 0

segfault in imap and doveadm
by Joe Beaubien 07 Mar '16

07 Mar '16

Hi everyone, Dovecot keeps on segfaulting on me and I am unsure why. This setup has been running for 5 years and has given me very little trouble. I am running Dovecot 2.1.7, setup with mdbox. The imap process keeps on segfaulting for the same account (makes me think maybe an email or folder of that account is problematic). My big issue is that force-resync also causes doveadm to segfault. Here is the mail.err file I am getting: Mar 7 12:34:36 mba kernel: [ 1955.486324] imap[5663]: segfault at 0 ip 00007ff1c1bd0b5e sp 00007fffd8599a40 error 4 in libdovecot-storage.so.0.0.0[7ff1c1b51000+fb000] Mar 7 12:34:36 mba dovecot: imap(document): Error: /mba_data/emails/document/mailboxes/INBOX/Sara/dbox-Mails/dovecot.index reset, view is now inconsistent Mar 7 12:34:36 mba dovecot: imap(document): Error: /mba_data/emails/document/mailboxes/INBOX/Lucie/dbox-Mails/dovecot.index reset, view is now inconsistent Mar 7 12:34:37 mba dovecot: imap(document): Error: mdbox map /mba_data/emails/document/storage/dovecot.map.index corrupted: map_uid=284393 refcount too low Mar 7 12:34:37 mba dovecot: imap(document): Error: /mba_data/emails/document/mailboxes/Templates/dbox-Mails/dovecot.index reset, view is now inconsistent Mar 7 12:34:39 mba dovecot: imap(document): Error: /mba_data/emails/document/mailboxes/Sent/dbox-Mails/dovecot.index reset, view is now inconsistent Mar 7 12:34:40 mba dovecot: imap(document): Error: /mba_data/emails/document/mailboxes/INBOX/dbox-Mails/dovecot.index reset, view is now inconsistent Mar 7 12:34:40 mba dovecot: imap(document): Error: /mba_data/emails/document/mailboxes/INBOX/dbox-Mails/dovecot.index reset, view is now inconsistent Mar 7 12:34:41 mba dovecot: imap(document): Error: /mba_data/emails/document/mailboxes/INBOX/dbox-Mails/dovecot.index reset, view is now inconsistent Mar 7 12:34:41 mba dovecot: imap(document): Error: /mba_data/emails/document/mailboxes/INBOX/dbox-Mails/dovecot.index reset, view is now inconsistent Mar 7 12:34:41 mba dovecot: imap(document): Error: /mba_data/emails/document/mailboxes/INBOX/dbox-Mails/dovecot.index reset, view is now inconsistent Mar 7 12:34:42 mba dovecot: imap(document): Error: /mba_data/emails/document/mailboxes/INBOX/_EE - a verifier/dbox-Mails/dovecot.index reset, view is now inconsistent Mar 7 12:34:43 mba dovecot: imap(document): Error: /mba_data/emails/document/mailboxes/INBOX/dbox-Mails/dovecot.index reset, view is now inconsistent Mar 7 12:34:48 mba kernel: [ 1967.972883] imap[5688]: segfault at 0 ip 00007f058ebc9b5e sp 00007fff9baa7c00 error 4 in libdovecot-storage.so.0.0.0[7f058eb4a000+fb000] Mar 7 12:34:49 mba dovecot: imap(document): Error: /mba_data/emails/document/mailboxes/INBOX/Lucie/dbox-Mails/dovecot.index reset, view is now inconsistent Mar 7 12:43:44 mba dovecot: imap(document): Error: indexer disconnected unexpectedly Mar 7 12:43:44 mba dovecot: indexer: Error: Indexer worker disconnected, discarding 119 requests for document Mar 7 12:48:31 mba kernel: [ 2790.363755] doveadm[6586]: segfault at 0 ip 00007f1b2023fb5e sp 00007fff4e8ce200 error 4 in libdovecot-storage.so.0.0.0[7f1b201c0000+fb000] Mar 7 12:49:10 mba kernel: [ 2829.203900] doveadm[6604]: segfault at 0 ip 00007fa0d16e4b5e sp 00007fff1b89f480 error 4 in libdovecot-storage.so.0.0.0[7fa0d1665000+fb000] First line is imap segfaulting. Last lines are doveadm segfaulting when I try to run force-resync. Does anyone have any clue what to do in this situation? Regards, -Joe

1 1

Compilation fails: SSL_TXT_SSLV2 not defined
by Muffinman 07 Mar '16

07 Mar '16

Hello all, I'm trying to compile dovecot 2.2.21 on OS-X 10.11.3 and I'm running a bit of trouble with OpenSSL. I've cloned OpenSSL (OpenSSL 1.1.0-pre4-dev) from github and in openssl/ssl.h SSL_TXT_SSLV2 is not defined anymore. Compilation fails with: libtool: compile: gcc -DHAVE_CONFIG_H -I. -I../.. -I../../src/lib -I../../src/lib-test -DMODULE_DIR=\"/usr/local/lib/dovecot\" -std=gnu99 -g -O2 -Wall -W -Wmissing-prototypes -Wmissing-declarations -Wpointer-arith -Wchar-subscripts -Wformat=2 -Wbad-function-cast -Wno-duplicate-decl-specifier -Wstrict-aliasing=2 -MT iostream-openssl-common.lo -MD -MP -MF .deps/iostream-openssl-common.Tpo -c iostream-openssl-common.c -fno-common -DPIC -o .libs/iostream-openssl-common.o iostream-openssl-common.c:34:24: error: use of undeclared identifier 'SSL_TXT_SSLV2' if (strcasecmp(name, SSL_TXT_SSLV2) == 0) ^ 1 error generated. make[3]: *** [iostream-openssl-common.lo] Error 1 make[2]: *** [all-recursive] Error 1 make[1]: *** [all-recursive] Error 1 make: *** [all] Error 2 In openssl/ssl.h the following is defined: # define SSL_TXT_SSLV3 "SSLv3" # define SSL_TXT_TLSV1 "TLSv1" # define SSL_TXT_TLSV1_1 "TLSv1.1" # define SSL_TXT_TLSV1_2 "TLSv1.2" # define SSL_TXT_ALL "ALL" Any suggestions on how to fix this? Kind regards, Maarten

2 3

questions regarding zlib plugin
by Götz Reinicke - IT Koordinator 07 Mar '16

07 Mar '16

Hi, faced with a current space problem on our dovecot 2.2.18 server, I thought about using the zlib plugin. My questions: - is it really as simple as adding the options to the conf files as described in the docs :) ? http://wiki2.dovecot.org/Plugins/Zlib - As this just compresses new messages; dose anybody has a sort of simple cron or whatever script or best practice how to compress existing maildir mails? The doc is a bit complicated to me at that point... Thanks a lot and regards . Götz

3 3

Ubuntu packages
by Peter Chiochetti 07 Mar '16

07 Mar '16

Since dovecot put up packages on their own repo, bigmichi stopped providing his'. I guess this is not Stephan; Would the kind person update ppa.launchpad.net/bigmichi1 ? Thank You -- peter

11 18

VS: Re: v2.2.22 release candidate released
by Aki Tuomi 06 Mar '16

06 Mar '16

In future release we will add master authentication too. Now you can use api key or doveadm password which are essentially same thing. ---Aki TuomiDovecot oy-------- Alkuperäinen viesti --------Lähettäjä: Peter Chiochetti <pch(a)myzel.net> Päivämäärä: 4.3.2016 20.20 (GMT+02:00) Saaja: dovecot(a)dovecot.org Aihe: Re: v2.2.22 release candidate released Am 2016-03-04 um 14:33 schrieb Timo Sirainen: > + Added doveadm HTTP API: See > http://wiki2.dovecot.org/Design/DoveadmProtocol/HTTP Hmm, so anybody who has the API key can send any doveadm commands? I guess something like /etc/sudoers for API keys would be good? Did I miss something? -- peter

3 2

Re: Dovecot stops responding when I update SSL certificate
by Joseph Tam 06 Mar '16

06 Mar '16

HotSlots Webmaster <webmaster(a)hotslots132.com> writes: > I have had Dovecot working fine with SSL for nearly two years now. It's > time to renew the SSL certificate, so I did (same CA). The new > certificate works fine in Apache and Postfix. But when I update Dovecot > to use the same certificate, and restart the server, Dovecot stops > responding to connects. > ... > Here is the end of the dovecot -n file that mentions SSL: > ... > ssl_dh_parameters_length = 2048 When you start dovecot, does CPU load of dovecot/ssl-params roof to 100%? It's possible it's generating ephemeral DH keys. In a previous post to this list, I note that the run time to generate these keys can vary wildly, and gets worse with longer keys. Sometimes you get lucky, and you'll generate then quickly, sometimes it takes a long while (minutes). http://dovecot.org/pipermail/dovecot/2015-November/102447.html Try running openssl dhparam -noout 2048 to see how it varies for you. If what I suspect is true, you can try using shorter keys. A followup post suggest a way you can precompute the key Joseph Tam <jtam.home(a)gmail.com>

3 2

VS: Re: Implementation of TLS OCSP Stapling
by Aki Tuomi 06 Mar '16

06 Mar '16

Luckily ocsp stapling is an SSL extension and clients not supporting it won't be asking for it either. ---Aki TuomiDovecot oy -------- Alkuperäinen viesti --------Lähettäjä: Andrew McGlashan <andrew.mcglashan(a)affinityvision.com.au> Päivämäärä: 6.3.2016 10.36 (GMT+02:00) Saaja: dovecot(a)dovecot.org Aihe: Re: Implementation of TLS OCSP Stapling On 3/03/2016 11:58 PM, aki.tuomi(a)dovecot.fi wrote: > We will take this feature under consideration and see if it can be implemented > in future release. Thank you for your suggestion! As much as I hate Outlook (Look Out!), there are loads of people using really old versions; 2003 is no longer supported, but loads of people use 2007. Thunderbird can be expected to be far more up to date. Implementing features to work with older clients will always be a problem. Just a simple example, almost unrelated here, but this is either wrong by TB or wrong by Outlook (versions 2007, 2010 and 2013 that I know of). When the IMAP server sends a message, OL will pop up a window that requires the user to acknowledge the message via a popup. TB just pops up the message in the normal 'new mail' notify if that is configured and it might be lost if notify isn't set to show. Either way, the implementation is different b/w the two client products. Is OL right or is TB right... IMAP doco says that the message should be made to be acknowledged by the client; OL's version can't easily be ignored or missed, but TB's can easily be missed. But TB's implementation is more user friendly if the server wants to keep sending messages from time to time. I considered using this for MOTD type stuff and maybe random inspirational or motivational messages; even to remind or inform users to do certain things [one example in the dovecot wiki is to advise that the vacation message is still active]. A TB notification is next to harmless, but an OL one needs to be acknowledged every time, which would be very painful. Anyway, the point is that if a feature is added for OCSP stabling support, you couldn't really expect older versions of Look Out to comply with it (even though M$ could patch it easily, they care less about older versions than getting people to subscribe to Office 365 these days). Cheers A.

1 0

Implementation of TLS OCSP Stapling
by dovecot＠flut.demon.nl 06 Mar '16

06 Mar '16

Hi all, About a year ago, Torsten already asked for OCSP stapling (http://dovecot.org/pipermail/dovecot/2015-April/100632.html) Unfortunately, there was no answer to his question. Now RFC 7633 ("TLS Feature Extension", https://tools.ietf.org/html/rfc7633, a.k.a. "Must Staple") has landed, revocation is getting serious! I personally would like to embed all my TLS certificates with the must-staple extension. The great project Let's Encrypt already supports it: https://github.com/letsencrypt/boulder/pull/1224 I'm aware most MTAs don't really care about the certificate, but big players as Google take TLS encryption very seriously: https://googleblog.blogspot.nl/2016/02/building-safer-web-for-everyone.html So I would like to know if Dovecot is planning to feature OCSP stapling. That way I know for sure my "must staple" certificates can be used by Dovecot. And in my opinion, every TLS offering daemon should be up to par to the capabilities of TLS.. Not lag behind :) What's your opinion on this matter? Thanks in advance for any anwser! Greets, Osiris

7 11