April 2016 - dovecot - dovecot.org

[Dovecot] Dovecot LDA/LMTP vs postfix virtual delivery agent and the x-original-to header
by Charles Marcus 19 Apr '19

19 Apr '19

On 2012-04-05 4:18 AM, Thomas Leuxner <tlx(a)leuxner.net> wrote: > Also with 2.x you may want to use LMTP rather than the LDA Piping. > > http://wiki2.dovecot.org/HowTo/PostfixDovecotLMTP I am preparing to convert my main client's postfix_courier-imap setup to dovecot 2.1, which currently just uses the postfix virtual delivery agent... Does anyone know if the use of LMTP (or even the dovecot LDA) still loses the x-original-to header that the postfix vda adds and that I rely heavily on (since I use a lot of aliases), and if it does, is there any solution to get the original recipient added back in before final delivery? Everything I'm reading says that LMTP is better, but I really do need this header (or one like it) to be there so I know who the original recipient was (for filtering and other purposes). Thanks, -- Best regards, Charles

8 16

Set X-Original-To based an ORCPT?
by Peer Heinlein 09 Aug '18

09 Aug '18

Since http://dovecot.org/pipermail/dovecot-cvs/2014-November/025241.html Dovecot's LMTP does support ORCPT. Is it possible to set X-Original-To-Header based on that ORCPT? Peer -- Heinlein Support GmbH Schwedter Str. 8/9b, 10119 Berlin http://www.heinlein-support.de Tel: 030 / 405051-42 Fax: 030 / 405051-19 Zwangsangaben lt. §35a GmbHG: HRB 93818 B / Amtsgericht Berlin-Charlottenburg, Geschäftsführer: Peer Heinlein -- Sitz: Berlin

5 5

[Dovecot] quota-status not working in distributed environment
by Benoit Panizzon 30 Jul '18

30 Jul '18

Hello List Quick overview of our set-up: Postfix / Dovecot (2.2.2.1) / MySQL Cluster on (at the moment) three Servers to create a HA environment where you could easily add additional servers as the demand or load grows. Circular dovecot replication is used so each server uses another one as replication partner and allowing one server to fail. Dovecot Proxy Feature being used, so we can use round-robin DNS and each server can forward the connecting user to the correct 'master' for his mailbox. So far, everything works as expected. Now we want to reject emails to 'full' mailboxes during SMTP to prevent backscatter and use the quota-status policy service from within postfix. That works fine, if the mailbox or it's replica is present on the machine where quota-status is called, but it fails if it's run on a machine where neither the mailbox or the replica is present. In our case, we get a correct SMTP 550 'Mailbox Full' Reject in two cases and a LMTP generated bounce in the later case. Also `doveadm quota get -u user(a)example.com` return the correct quota if run on the two machines which have the mailbox and it's copy locale, but return 0% used if run on the other machine. Is there a way to get quota-status to also use the proxy feature to request the quota information from the correct machine? Or is the postfix policy daemon call to the quota-status socket documented somewhere (it must be, but where?) so we could implement it from within the Milter? (we use the sendmail Milter API from postfix to filter spam and viruses, do sender/recipient rewriting, forward bounce matching, rate limmiting, login/IP statistics to block botnets abusing phished addresses and legal intercept stuff anyway) Kind regards Benoit Panizzon -- I m p r o W a r e A G - ______________________________________________________ Zurlindenstrasse 29 Tel +41 61 826 93 07 CH-4133 Pratteln Fax +41 61 826 93 02 Schweiz Web http://www.imp.ch ______________________________________________________

5 6

Looking for NTLM config example
by Mark Foley 26 Oct '17

26 Oct '17

Now that I am running Thunderbird on Linux and away from Windows/Outlook, I'd like to take another run at setting up NTLM authentication from Thunderbird to my Samba4 AC/DC. With the help of the samba maillist folks I was able to set up NTLM authentication for domain user login. I should be able to do the same for email! But, I need help. I went to http://wiki2.dovecot.org/Authentication/Mechanisms/NTLM and got lost immediately. Are "authenticaion submethods" synonymous with "password schemes"? The 7th line down says, "NTLM password scheme is required for NTLM, NTLM2 and NTLMv2.", but in the referenced link I found no reference to "NTLM password scheme". The links http://wiki2.dovecot.org/Authentication/Mechanisms/NTLM and http://wiki2.dovecot.org/Authentication/PasswordSchemes, tell you what the 4 NTLM authentication submethods are, tells you what password schemes are, tells you what the NTLM client/server handshake is, but doesn't actually tell you how to configure dovecot config files. I'm much more interested in the "how to" than in: "NTLMv2: server and client nonce, MITM can't force downgrade" ... whatever that means. Anyway, probably it's my lack of understanding terminology. I don't even know what a "nonce" is. But, I learn well from examples! Can somone please give me a sample 10-auth.conf for NTML and any other supporting settings or configs I need? My current/working dovecot settings, which have been running perfectly for well over a year now, are: $ dovecot -n # 2.2.15: /usr/local/etc/dovecot/dovecot.conf # OS: Linux 3.10.17 x86_64 Slackware 14.1 auth_debug_passwords = yes auth_mechanisms = plain login auth_verbose = yes auth_verbose_passwords = plain disable_plaintext_auth = no info_log_path = /var/log/dovecot_info mail_location = maildir:~/Maildir passdb { driver = shadow } protocols = imap ssl_cert = </etc/ssl/certs/OHPRS/GoDaddy/Apache/2015-08-14/57aa6ed6ae98b4c7.crt ssl_key = </etc/ssl/certs/OHPRS/GoDaddy/my.server.name.key userdb { driver = passwd } verbose_ssl = yes Here's what I've tried so far as 10-auth.conf: disable_plaintext_auth = no auth_use_winbind = yes info_log_path = /var/log/dovecot_info auth_verbose = yes auth_debug_passwords = yes auth_verbose_passwords= plain auth_winbind_helper_path = /usr/bin/ntlm_auth auth_mechanisms = ntlm plain login userdb { driver = passwd args = username_format=%n allow_all_users=yes } Which gives me a dovecot -n of: $ dovecot -n # 2.2.15: /usr/local/etc/dovecot/dovecot.conf # OS: Linux 3.10.17 x86_64 Slackware 14.1 auth_debug_passwords = yes auth_mechanisms = ntlm plain login auth_use_winbind = yes auth_verbose = yes auth_verbose_passwords = plain disable_plaintext_auth = no info_log_path = /var/log/dovecot_info mail_location = maildir:~/Maildir protocols = imap ssl_cert = </etc/ssl/certs/OHPRS/GoDaddy/Apache/2015-08-14/57aa6ed6ae98b4c7.crt ssl_key = </etc/ssl/certs/OHPRS/GoDaddy/my.server.name.key userdb { args = username_format=%n allow_all_users=yes driver = passwd } verbose_ssl = yes I configured Thunderbird for NTLM authentication, then tried sending a message, I got the following in /var/log/dovecot_info: Apr 22 01:37:57 imap-login: Debug: SSL: elliptic curve secp384r1 will be used for ECDH and ECDHE key exchanges Apr 22 01:37:57 imap-login: Debug: SSL: elliptic curve secp384r1 will be used for ECDH and ECDHE key exchanges Apr 22 01:37:57 auth: Debug: Loading modules from directory: /usr/local/lib/dovecot/auth Apr 22 01:37:57 imap-login: Info: Disconnected: Auth process broken (disconnected before auth was ready, waited 0 secs): user=<>, rip=192.168.0.58, lip=98.102.63.107, session=<xFuyOgwx9wDAqAA6> On Thunderbird I got the error, "Sending of the message failed. The Outlgoing server (SMTP) my.server.name does not support the selected authentication method. Please change the 'Autnentication method' in 'Account Settings | Outgoing Server (SMTP)'." Clearly, something is configured wrong, but I've no clue what. Can I get some advice? THX --Mark

8 19

Quota-status service on Director
by Michael Kliewe 27 Sep '17

27 Sep '17

Hello, I'm trying to configure the quota-status service, but it seems I'm not successful with my director setup (2.2.9). I activate the quota-status service like this on my director server: $ cat 91-quota-status.conf ## ## Quota-Status configuration. ## # Load Module quota-status and listen on TCP/IP Port for connections. service quota-status { executable = quota-status -p postfix inet_listener { address = 10.0.1.44 port = 12340 } client_limit = 1 } # Plugin configuration. # Return messages for requests by quota status: success, nouser and overquota. plugin { quota_status_success = DUNNO quota_status_nouser = DUNNO quota_status_overquota = "552 5.2.2 Mailbox is over quota" } After restarting the director service I try to query the quota status service: printf "recipient=user(a)domain.de\nsize=100000\n\n" | nc 10.0.1.44 12340 The output is: action=DEFER_IF_PERMIT Invalid user settings. Refer to server log for more information. In the debug log of the director I see this: Feb 23 03:03:09 director01 dovecot: auth: Debug: userdb out: USER 1 user(a)domain.de mail=mdbox:/mnt/data01/domain.de/user/maildir home=/mnt/data01/domain.de/user proxy=Y master=<hidden> pass=<hidden> uid=5000 gid=1 quota_rule=*:storage=60593 quota_rule2=*:messages=100000 Feb 23 03:03:09 director01 dovecot: quota-status(user(a)domain.de): Error: user user(a)domain.de: Initialization failed: Namespace '': mkdir(/mnt/data01/domain.de/user/maildir/mailboxes) failed: Permission denied (euid=5000(vmail) egid=1(daemon) missing +w perm: /mnt, dir owned by 0:0 mode=0755) So the quota status service tries to access the mailbox of the user ON THE DIRECTOR. But the director has not mounted the mailboxes of the users, that's what the backend dovecots are for (proxy=Y). So the quota-status query is not proxied to the dovecot backend server I would assume. Does that mean I have to start the quota-status service on the dovecot backend servers and access it from the Postfix server directly? Currently the Postfixes can only reach the directors, not the backend servers. Is it possible to use the quota-status service on the director? Thanks for any hints and help Michael

3 4

[Dovecot] [PATCH, RFC] add APOP authentication mechanism
by Andrey Panin 14 Aug '17

14 Aug '17

Hello all, this patch add APOP authentication mechanism to dovecot 1.0-test23. Please take a look. Best regards. -- Andrey Panin | Linux and UNIX system administrator pazke(a)donpac.ru | PGP key: wwwkeys.pgp.net

3 2

[Dovecot] Dovecot stops with "Fatal: kevent(): Invalid argument"
by Henrik Larsson 09 Jun '17

09 Jun '17

# 2.0.11: /usr/local/etc/dovecot/dovecot.conf # OS: FreeBSD 8.2-STABLE amd64 Dovecot stops with the following logged: - master: Fatal: kevent(): Invalid argument I have found that a diff was created for "src/lib/ioloop-kqueue.c" for a similar issue: http://dovecot.org/pipermail/dovecot/2010-November/054855.html I have patched my system with this and haven't seen the problem since, but I don't know if this is a coincidence. Could you please explain if the diff should actually fix anything or just add some more logging in case it stops again? Best regards Henrik Larsson

4 9

antispam plugin pipe backend error when moving multiple emails
by Stéphane Cottin 12 Feb '17

12 Feb '17

Hi, I've got some trouble with the dovecot antispam plugin and the pipe backend. I'm using dovecot 2.2.18 with maildirs and zlib compression enabled. When moving 2 or more emails at once from the Junk folder to another one, I always have the following error : "Failed to copy to temporary file" In the server logs : imap(vvv(a)vvv.vvv): Error: read(zlib(/data/Maildir/.test/tmp/1446974366.M123890P936.vvv)) failed: Cached message size smaller than expected (13553 < 13562, box=test, UID=0) The same operation with one email at a time, on the same emails, works as expected. Stéphane

2 2

Reappearing emails
by Ron Cleven 17 Jan '17

17 Jan '17

We have been running Dovecot 2.2.10 with a pair of CentOS 7 boxes with replications for the past year. We have been quite happy with the performance and reliability. Recently we received a report from an Android IMAP user that emails that he deleted without reading would often reappear in his INBOX. At first I thought it might be some quirky incompatibility with his email client, but I found that I could easily reproduce it in Roundcube by dragging an unread email to Trash. I have been monitoring this forum fairly religiously and don't recall seeing any similar reports. I plan to capture the IMAP wire interactions, but before doing that, I thought I would submit this to the IMAP gods to see if anyone had heard of this and/or if there is some newer version that might resolve the problem. This particular customer contacted his email vendor and asked them to analyze the problem. The actual log data is gigantic, so I just pasted in the vendor's narrative below in case it helps. Otherwise, as I said, I will capture a similar interaction at the wire level and follow up here. Vendor's narrative: You had 8 messages in the Inbox, and moved two to Trash. The server notified the app on the push connection (for Inbox) that there are now 6 messages. By the time the app got around to catch up with that (it did the Trash folder first), the server said "oh wait, there are 8 messages, not 6" (in the Inbox), and so the app synced them in, just as reported. app selecting the Inbox, server saying there are 8 messages there app moving UID 729 and 730 to Trash (push) server saying Trash now has 34 messages (push) server saying two messages gone from Inbox, 6 left (push) 6 messages left in Inbox becoming 8 (push) and here they are (the two new ones) Thanks, Ron

3 3

imapc fetch optimization
by Nagy, Attila 27 Sep '16

27 Sep '16

Hi, imapc does a lot of UID FETCH $UID (BODY.PEEK[]), which is nice, because it works even with the dumbest IMAP server, altough it really kills performance, especially on high latency lines. I wonder: if IMAP servers can effectively handle boundless fetches (like a list with all wanted UIDs, or simply 1:* if all are needed), do you see this as a good addition to develop? This could be a new imapc_features setting afterall... Thanks,

2 8