March 2016 - dovecot - dovecot.org

Dovecot stops responding when I update SSL certificate
by HotSlots Webmaster 05 Mar '16

05 Mar '16

Dovecot 2.2.18 CentOS 6.7 (x86_64) Plesk 12.5.30 I have had Dovecot working fine with SSL for nearly two years now. It's time to renew the SSL certificate, so I did (same CA). The new certificate works fine in Apache and Postfix. But when I update Dovecot to use the same certificate, and restart the server, Dovecot stops responding to connects. I have triple-checked that the ssl_cert and ssl_key files are correct - all I did was change the names in the conf file. There's nothing in the log. I have tried various SSL tests but either they don't work (unspecific error) or they tell me nothing is wrong (and show the correct certificate.) I am running out of time to find a solution to this - what else can I look for? The one difference for the certificates is that I opted for one with a SHA256 root rather than SHA1 root. I have separately used a tool to verify that the certificate and private key match. Here is the end of the dovecot -n file that mentions SSL: ssl = required ssl_cert = </etc/pki/tls/certs/hotslots-cert.pem ssl_cipher_list = EECDH+AESGCM+AES128:EECDH+AESGCM+AES256:EDH+AESGCM+AES128:EDH+AESGCM+AES256:EECDH+SHA256+AES128:EECDH+SHA384+AES256:EDH+SHA256+AES128:EDH+SHA256+AES256:EECDH+SHA1+AES128:EECDH+SHA1+AES256:EDH+SHA1+AES128:EDH+SHA1+AES256:EECDH+HIGH:EDH+HIGH:AESGCM+AES128:AESGCM+AES256:SHA256+AES128:SHA256+AES256:SHA1+AES128:SHA1+AES256:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!KRB5:!aECDH:!EDH+3DES ssl_dh_parameters_length = 2048 ssl_key = </etc/ssl/private/hotslots-private.pem ssl_protocols = TLSv1.1 TLSv1.2 !TLSv1 userdb { args = uid=popuser gid=popuser driver = static } protocol imap { mail_plugins = " quota imap_quota" } protocol pop3 { pop3_uidl_format = UID%u-%v } protocol lda { mail_plugins = " quota sieve" } (The !TLSv1 doesn't seem to be honored - I tried it with and without that. A problem for later.) Thanks for any help. Steve L

1 0

Deliver to Public Mailbox
by Chris 03 Mar '16

03 Mar '16

Dear All, I'd like dovecot-lda (deliver) to post a message to a public mailbox. It doesn't seem to work when I just use the -m parameter with the IMAP-Mailbox path, e.g. Public/info . What parameters are required? Do I have to change the headers with formail in any way? TIA! - Chris

1 1

Dovecot 2.2.21 - segfault
by Robert Blayzor 03 Mar '16

03 Mar '16

pid 31943 (dovecot), uid 0: exited on signal 11 (core dumped) dovecot --version 2.2.21 (5345f22) uname -a FreeBSD 10.3-BETA2 #0 r295966M: amd64 bt full #0 0x00000008008eb037 in t_push (marker=0x0) at data-stack.c:133 133 data-stack.c: No such file or directory. in data-stack.c (gdb) bt full #0 0x00000008008eb037 in t_push (marker=0x0) at data-stack.c:133 frame_block = (struct stack_frame_block *) 0x7fffffffb4e0 #1 0x000000080086a5ec in master_service_env_clean () at master-service.c:534 _data_stack_cur_id = 32767 value = 0x801471056 "TZ CORE_OUTOFMEM CORE_ERROR" #2 0x000000000040df88 in service_process_setup_environment (service=0x8014b11e0, uid=58537, hostdomain=0x801419960 “mta3.xxx.net") at service-process.c:234 No locals. #3 0x000000000040dd6d in service_process_create (service=0x8014b11e0) at service-process.c:322 uid_counter = 58537 process = (struct service_process *) 0x8008eb2f3 uid = 58537 hostdomain = 0x801419960 “mta3.xxx.net" pid = 0 process_forked = true #4 0x000000000040d7ff in service_accept (l=0x8014b1378) at service-monitor.c:299 service = (struct service *) 0x8014b11e0 #5 0x000000080090e57f in io_loop_call_io (io=0x80144e7e0) at ioloop.c:559 ioloop = (struct ioloop *) 0x801421080 t_id = 2 #6 0x0000000800911497 in io_loop_handler_run_internal (ioloop=0x801421080) at ioloop-kqueue.c:151 ctx = (struct ioloop_handler_context *) 0x801419880 events = (struct kevent *) 0x8014b9000 event = (const struct kevent *) 0x8014b9000 tv = {tv_sec = 42682, tv_usec = 705349} ts = {tv_sec = 42682, tv_nsec = 705349000} io = (struct io_file *) 0x80144e7e0 events_count = 67 ret = 1 i = 0 #7 0x000000080090eb0e in io_loop_handler_run (ioloop=0x801421080) at ioloop.c:607 No locals. #8 0x000000080090e92f in io_loop_run (ioloop=0x801421080) at ioloop.c:583 No locals. #9 0x000000080086a8bb in master_service_run (service=0x80141b140, callback=0) at master-service.c:640 No locals. #10 0x0000000000406558 in main (argc=3, argv=0x7fffffffb4c0) at main.c:888 set = (struct master_settings *) 0x801429110 error = 0x800ca9283 "H\203Ä ]Ã\017\037\200" doveconf_arg = 0x0 orig_info_callback = (failure_callback_t *) 0x8008ee880 <i_syslog_error_handler> orig_debug_callback = (failure_callback_t *) 0x8008ee880 <i_syslog_error_handler> foreground = false ask_key_pass = false i = 3 c = -1 doubleopts = 0x7fffffffb3a0 Current language: auto; currently minimal

2 2

Dovecot error symbol mysql_options, version libmysqlclient_16 not defined in file libmysqlclient.so.18
by Condor 03 Mar '16

03 Mar '16

Hello, Im using Dovecot version: 2.2.21 (5345f22) Here is my conf file: auth_debug = yes auth_mechanisms = plain login auth_socket_path = /usr/local/var/run/dovecot/auth-userdb auth_verbose = yes base_dir = /usr/local/var/run/dovecot/ debug_log_path = /var/log/dovecot.log default_login_user = nobody default_process_limit = 200 dict { driver = sql quota = mysql:/usr/local/etc/dovecot/dovecot-dict-sql.conf.ext } mail_debug = yes mail_location = maildir:/var/mailq/postmail/%d/%n/Maildir mail_privileged_group = vmail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify envir onment mailbox date index ihave duplicate mime foreverypart extracttext namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = /usr/local/etc/dovecot/dovecot-sql.conf.ext driver = sql } passdb { args = /usr/local/etc/dovecot/dovecot-sql.conf.ext driver = sql } plugin { autocreate = Trash autocreate2 = Junk autocreate3 = Sent autocreate4 = Drafts autosubscribe = Trash autosubscribe2 = Junk autosubscribe3 = Sent autosubscribe4 = Drafts sieve = /var/mailq/postmail/%d/%n/.dovecot.sieve sieve_dir = /var/mailq/postmail/%d/%n/sieve/ sieve_global_dir = /usr/local/var/lib/dovecot/sieve sieve_global_path = /usr/local/var/lib/dovecot/sieve/default.sieve sieve_max_actions = 32 sieve_max_redirects = 15 sieve_quota_max_scripts = 20 } protocols = pop3 imap sieve service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0666 user = postfix } } service imap-login { inet_listener imap { port = 143 } inet_listener imaps { port = 993 } } service managesieve-login { inet_listener sieve { port = 4190 } service_count = 1 vsz_limit = 64 M } ssl_cert = </etc/postfix/ssl/certs/dovecot.pem ssl_key = </etc/postfix/ssl/private/dovecot.pem userdb { args = uid=1003 gid=1001 home=/var/mailq/postmail/%d/%n allow_all_users=yes driver = static } userdb { args = /usr/local/etc/dovecot/dovecot-sql.conf.ext driver = sql } protocol pop3 { pop3_uidl_format = %08Xu%08Xv } protocol lmtp { mail_plugins = " sieve" } protocol lda { mail_plugins = " sieve" } protocol imap { imap_max_line_length = 64 k mail_max_userip_connections = 200 mail_plugins = " autocreate" } protocol sieve { managesieve_implementation_string = Dovecot Pigeonhole } dovecot-sql. conf grep -v '^ *$#.*$\?$' dovecot-sql.conf.ext driver = mysql connect = host=localhost dbname=postfix user=xxx password=xxx default_pass_scheme = CRYPT password_query = SELECT username AS user, password FROM mailbox WHERE username = '%u'; I get follow error: dovecot: auth-worker: Error: dovecot/auth: relocation error: dovecot/auth: symbol mysql_options, version libmysqlclient_16 not defined in file libmysqlclient.so.18 with link time reference I delete all binary and libs and source code, download again and compile with option with-mysql and always got the same error when I start it: dovecot: auth-worker: Error: dovecot/auth: relocation error: dovecot/auth: symbol mysql_options, version libmysqlclient_16 not defined in file libmysqlclient.so.18 with link time reference Mar 3 16:50:56 mailcontrol dovecot: master: Error: service(auth-worker): command startup failed, throttling for 60 secs Mar 3 16:50:56 mailcontrol dovecot: auth-worker(3276): Fatal: master: service(auth-worker): child 3276 returned error 127 Mar 3 16:50:56 mailcontrol dovecot: auth: Error: auth worker: Aborted PASSV request for xxx@xxx: Worker process died unexpectedly I even check with ldd is there any banary that use libmysqlclient.16.so but did not found. ldd auth is linked libmysqlclient.so.18 => /usr/lib64/libmysqlclient.so.18 (0x00007fad84696000) I use kernel 4.4.3, gcc 5.3.0 $ gcc -v Reading specs from /usr/lib64/gcc/x86_64-slackware-linux/5.3.0/specs COLLECT_GCC=gcc COLLECT_LTO_WRAPPER=/usr/libexec/gcc/x86_64-slackware-linux/5.3.0/lto-wrapper Target: x86_64-slackware-linux Configured with: ../gcc-5.3.0/configure --prefix=/usr --libdir=/usr/lib64 --mandir=/usr/man --infodir=/usr/info --enable-shared --enable-bootstrap --enable-languages=ada,c,c++,fortran,go,java,lto,objc --enable-threads=posix --enable-checking=release --enable-objc-gc --with-system-zlib --with-python-dir=/lib64/python2.7/site-packages --enable-libstdcxx-dual-abi --with-default-libstdcxx-abi=gcc4-compatible --disable-libunwind-exceptions --enable-__cxa_atexit --enable-libssp --enable-lto --enable-install-libiberty --with-gnu-ld --verbose --enable-java-home --with-java-home=/usr/lib64/jvm/jre --with-jvm-root-dir=/usr/lib64/jvm --with-jvm-jar-dir=/usr/lib64/jvm/jvm-exports --with-arch-directory=amd64 --with-antlr-jar=/tmp/gcc/antlr-runtime-3.4.jar --enable-java-awt=gtk --disable-gtktest --disable-multilib --target=x86_64-slackware-linux --build=x86_64-slackware-linux --host=x86_64-slackware-linux Thread model: posix gcc version 5.3.0 (GCC) Mysql version: mysql Ver 15.1 Distrib 10.0.24-MariaDB, for Linux (x86_64) using readline 5.1 Glibc version 2.23 any one can help me to understand whats happaened ? HS

1 0

Found bug in quota-status + patch
by Thierry Coppey 03 Mar '16

03 Mar '16

Hello, I've found a bug in the quota-status util (Dovecot 2.2.21, and probably below): it always return OK (sufficient quota) because it fails to load the user properly. More specifically, the branch " if (quser == NULL) return 1; " in src/plugins/quota/quota-status.c:59 is always taken. (at least with postgresql backend, test your config with the (adapted) command below: printf "recipient=mailbox(a)example.com\nsize=10000000000\n\n" | nc inet:mailstore.example.com 12340 it should reject, unless you have no quota, or more than 10G). Therefore it is pointless to configure the quota-status service as described in http://wiki2.dovecot.org/Quota because of that bug: the mail would be always accepted from the client and rejected at the end of the (Postfix) processing by lda. It is possible to reject directly at SMTP level when the mailbox is full using Postfix and main.cf: smtpd_recipient_restrictions = ... reject_unauth_destination, ... check_policy_service inet:mailstore.example.com:12340 smtpd_end_of_data_restrictions = check_policy_service inet:mailstore.example.com:12340 However there remain a *small inconsistency* as lda will count the size of message including headers whereas smtpd_end_of_data_restrictions seems not to count them towards the message size (or additional headers might be added by other preprocessing e.g. antispam etc...) I propose the patch below to fix quota-status. Could an expert double-check that it doesn't have memory leaks? (it shouldn't but I'm not yet comfortable enough with Dovecot memory management). Best regards, Thierry C.

3 3

Dual certificate
by Jean-Baptiste Vignaud 03 Mar '16

03 Mar '16

Hello all; Is anyone knows if it's possible to have a dual certificate setup on dovecot like in postfix or apache ? i tried to add several crts in local name section : local_name imap.server.tdl { ssl_cert = <server_rsa_crt.pem ssl_key = <server_rsa_key.pem ssl_cert = <server_ecdsa_crt.pem ssl_key = <server_ecdsa_key.pem } but it seems that dovecot takes the last one (ecdsa) and that rsa cert is not used. to check if booth are working, i check with openssl: openssl s_client openssl s_client -connect imap.server.tdl:143 -starttls imap -servername imap.server.tdl -cipher ECDHE-RSA-AES128-GCM-SHA256 for rsa and openssl s_client openssl s_client -connect imap.server.tdl:143 -starttls imap -servername imap.server.tdl -cipher ECDHE-ECDSA-AES128-GCM-SHA256 for ecdsa In apache we have to duplicate the cert / key lines one for rsa, one for edcda. In postfix, we have some specific ecdsa conf keys. So is there a way to do the same in dovecot ?

3 3

Deleting / Removing users
by John Krug 03 Mar '16

03 Mar '16

i have a list of users that I’ve removed from LDAP and I want to delete their mail storage. sdbox Dovecot 2.2.15.8 I have mail messages in one location and indexes in another. Should I just rm -rf /messages/<username> rm -rf /indexes/<username> Thanks, JK ----------------------------------------------------------------------- John "JK" Krug System Administrator The University of Chicago | Laboratory Schools 1362 East 59th Street | Chicago, IL 60637 Phone: (773) 834-4476 jk(a)ucls.uchicago.edu <mailto:jkallo@ucls.uchicago.edu> | http://helpdesk.ucls.uchicago.edu _______________________________________________

2 3

Get mailbox from its guid through IMAP
by Peter Chiochetti 02 Mar '16

02 Mar '16

In the shell I'do: doveadm fetch -u bob mailbox mailbox-guid $box uid 1 Is there a way through IMAP to get the same? -- peter

2 1

user configuration question
by Eric Abrahamsen 02 Mar '16

02 Mar '16

I've been using mbsync to sync this email account to a local Dovecot installation. I used to use Gmail, through Google Apps, and a while ago switched the account to self-hosting. I didn't want to upload years' worth of old email to my old server, so I've had two accounts in my MUA: one talking to the local Dovecot account for the old emails, and a second talking directly to the server for the new emails. I'd like to sync the new account to Dovecot as well, and I'm having trouble wrapping my brain around how to configure the two side-by-side accounts in Dovecot (I know there are other solutions to this, but I'm also just trying to figure out how this works). What I don't grok is the exact effect of the different username fields in the passdb file, and how they combine with username_format. Right now my dovecot.conf has this: passdb { driver = passwd-file args = username_format=%u /etc/dovecot/passwd } userdb { driver = static args = uid=eric gid=users home=/home/eric/.mail/%d/%n username_format=%u default_fields = mail=maildir:/home/eric/.mail/%d/%n/mail } And /etc/dovecot/passwd: eric@ericabrahamsen.net:{PLAIN}password:eric@ericabrahamsen.net Say I want to keep my existing mail where it is, and have all the new mail go into ~/.mail/ericabrahamsen.net/eric-new/mail. Ie, when mbsync connects to the local Dovecot, it does so with the username eric-new(a)ericabrahamsen.net. Now, in Dovecot's conf, do I change the email address in the first field of /etc/dovecot/passwd, or the third field, or both? And, if it isn't too much trouble, what is the difference between the two? Thanks! Eric

1 0

Dsync induces redundant mail after rapid append/expunge repeatedly
by 潘信傑 02 Mar '16

02 Mar '16

I meet the problem about dsync with expunge. The problems is expunged mail would reappear after dsyncing and it is easily to reproduce. Environment Settings: - Two servers(serverA, serverB) both enabled plugin "*replication"* - And more detail get by "dovecot -n" show below Reproduce flow: - Run two processes pA and pB both would run in while loop - pA(All behavior is on Draft mailbox and all on serverA): - Clean "Draft" mailbox of userA - Run the following imap command of userA - imap save (save new mail to Draft) - imap delete (delete old mail on Draft) - imap expunge * - Check if draft only have one email (it would be failed in about 50 loops)* - pB(Send mail to serverB): - Send new mail to userA (which would be save in INBOX) It would be easier reproduce by increasing server loading. I have found something - T he expunge changes from server A in dsync connection don't send immediately, these expunge changes appear after 1~2 dsync connection over. - The replicated mail is generated from serverB and sync back to serverA so expunged mail reappeared. dovecot -n (ServerA) # 2.2.19: /etc/dovecot/dovecot.conf # OS: Linux 3.10.77 x86_64 ext4 auth_mechanisms = plain login default_internal_user = root default_login_user = dovecot default_vsz_limit = 0 disable_plaintext_auth = no doveadm_password = # hidden, use -P to show it dsync_remote_cmd = ssh -l%{login} %{host} doveadm dsync-server -u%u dsync_target_servers = tcps:10.13.23.139:24245 lda_mailbox_autocreate = yes mail_debug = yes mail_fsync = never mail_location = maildir:/var/spool/mail/%d/%-4.04i/%i/Maildir mail_max_userip_connections = 30 mail_never_cache_fields = * mail_plugins = " notify replication mail_log" managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave duplicate namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { driver = pam } plugin { fts = lucene fts_autoindex = yes fts_lucene = whitespace_chars=@._/\~&,()[]" mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename flag_change append mail_log_fields = uid box msgid size flags from subject } postmaster_address = postmaster@localhost protocols = imap pop3 lmtp imap pop3 sieve replication_dsync_parameters = -N -l 30 -U service aggregator { fifo_listener replication-notify-fifo { group = users mode = 0666 user = admin } unix_listener replication-notify { group = users mode = 0666 user = admin } } service doveadm { inet_listener { address = 10.13.23.136,127.0.0.1 port = 24245 ssl = yes } } service imap-login { inet_listener imap { address = 10.13.23.136,127.0.0.1 port = 143 } inet_listener imaps { address = 10.13.23.136,127.0.0.1 port = 993 ssl = yes } process_limit = 256 service_count = 0 } service indexer-worker { process_limit = 8 } service pop3-login { inet_listener pop3 { address = 10.13.23.136,127.0.0.1 port = 110 } inet_listener pop3s { address = 10.13.23.136,127.0.0.1 port = 995 ssl = yes } process_limit = 256 service_count = 0 } service replicator { unix_listener replicator-doveadm { mode = 0666 } } userdb { driver = passwd } protocol lda { mail_plugins = " notify replication mail_log sieve" } dovecot -n (ServerB) $ ./sbin/dovecot -n # 2.2.19: /etc/dovecot/dovecot.conf # OS: Linux 3.10.77 x86_64 auth_mechanisms = plain login default_internal_user = root default_login_user = dovecot default_vsz_limit = 0 disable_plaintext_auth = no doveadm_password = # hidden, use -P to show it dsync_remote_cmd = ssh -l%{login} %{host} doveadm dsync-server -u%u dsync_target_servers = tcps:10.13.23.136:24245 lda_mailbox_autocreate = yes mail_debug = yes mail_fsync = always mail_location = maildir:/var/spool/mail/%d/%-4.04i/%i/Maildir mail_max_userip_connections = 30 mail_never_cache_fields = * mail_plugins = " notify replication mail_log" managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational reg ex imap4flags copy include variables body enotify environment mailbox date ihave duplicate namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { driver = pam } plugin { fts = lucene fts_autoindex = yes fts_lucene = whitespace_chars=@._/\~&,()[]" mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename flag_change append mail_log_fields = uid box msgid size flags from subject } postmaster_address = postmaster@localhost protocols = imap pop3 lmtp imap pop3 sieve replication_dsync_parameters = -N -l 30 -U service aggregator { fifo_listener replication-notify-fifo { group = users mode = 0666 user = admin } unix_listener replication-notify { group = users mode = 0666 user = admin } } service doveadm { inet_listener { address = 10.13.23.139,127.0.0.1 port = 24245 ssl = yes } } service imap-login { inet_listener imap { address = 10.13.23.139,127.0.0.1 port = 143 } inet_listener imaps { address = 10.13.23.139,127.0.0.1 port = 993 ssl = yes } process_limit = 256 service_count = 0 } service indexer-worker { process_limit = 4 } service pop3-login { inet_listener pop3 { address = 10.13.23.139,127.0.0.1 port = 110 } inet_listener pop3s { address = 10.13.23.139,127.0.0.1 port = 995 ssl = yes } process_limit = 256 service_count = 0 } service replicator { unix_listener replicator-doveadm { mode = 0666 } } userdb { driver = passwd } protocol lda { mail_plugins = " notify replication mail_log sieve" } Regards, Jay Pan

2 2