August 2016 - dovecot

specifying elliptic curve
by İhsan Doğan 22 Aug '16

22 Aug '16

Hi, I've noticed that Dovecot is using per default the elliptic curve sect571r1. Because not all clients might support sect571r1, I would like to set the elliptic curve manually. Is that possible? -Ihsan -- ihsan(a)dogan.ch http://blog.dogan.ch/

3 2

a question about certificates from letsencrypt
by Andreas Meyer 22 Aug '16

22 Aug '16

Hello! Certificates from letsencrypt are renewed every three months. Does that mean a MUA has to accept the renewed certificates manually everytime it is renewed? Sorry if this is OT! Greetings Andreas

6 6

Crash on opening mailbox
by Ladislav Laska 22 Aug '16

22 Aug '16

Hi! I'm currently experiencing a crash of dovecot 2.2.25 on Gentoo, upon opening mailbox. The crash only triggers on opening inbox, other mailboxes seem to work fine. It happens every time, and can be reproduced on request. I also briefly tried 2.2.19, and it behaves the same. The bug seems to be triggered by some mail, as I encountered it previously and fixed by removing some spam. I guess it might be malformed header of some kind. I can open the mailbox locally using mutt, but fail to do so remotely (using mutt or K-9 mail on android). Unforunately, I haven't been able to isolate the specific mail, as when I create a new mailbox, dovecot refuses to open it: [CANNOT] Mailbox isn't a valid mbox file (0.000 + 0.000 secs). I'm not really sure what's going on and will investigate further once I find some time to do so. I also experienced a similar problem on opening a specific mail, but it's much harder to reproduce and I currently don't have an example. The crash looks very similar, and only happens on first attempt to open a specific mail, it always works later on. I'm attaching a stack trace and dovecot -n. I'm also willing to send the binary and core dump, but not publicly, as I'm not eager to share whatever's inside with the whole world. Other than what I mentioned, I'm running pretty standard setup, with postfix on Gentoo x86_64, ext4 fs, quota and disk space is plentiful. The delivery agent is dovecot itself, in postfix/main.cf I have: mailbox_command = /usr/libexec/dovecot/deliver I'm using sieve script to file my mail, but the problem manifested even before when I was still using procmail to deliver my mail (I migrated because I had doubts about procmail and dovecot lock cooperation) I'll keep my mailbox corrupted for a few more days, and access the mail only locally, hoping to test a potential fix. Let me know if you need any more info/experimentation. Also, if you know a good way to find the mail that causes the trouble out of the core, let me know, I'd be glad to forward it for testing. Thanks and I hope we can find (and fix) the problem! -- S pozdravem Ladislav Láska <laska(a)kam.mff.cuni.cz> Katedra Aplikované Matematiky, MFF UK tel.: +420 739 464 167

2 8

Re: Change dovecot hostname
by Joseph Tam 22 Aug '16

22 Aug '16

"Scott W. Sander" writes: > I have noticed that the name of my private server running dovecot appears > in email headers rather than the public-friendly name of my server. Which headers are you taking about? If you're talking about Received: headers, that's usually inserted by your MTA, not dovecot. Joseph Tam <jtam.home(a)gmail.com>

3 2

LMTP doing passdb queries ?
by Peter Mogensen 22 Aug '16

22 Aug '16

Hi, I can see dovecot is doing a passdb query when handling the LMTP RCPT command. That's kinda unexpected for me. I would have thought it only did a userdb lookup. I have disabled lmtp_proxy to be sure it didn't do a passdb lookup to check the proxy field. Is this expected? Doesn't the LDA only do userdb lookups? /Peter

1 2

Catch-all with LMTP and Postfix
by Michael Starks 22 Aug '16

22 Aug '16

Hidy-ho, I'm having a difficult time getting catch-all working when using Dovecot LMTP. I would like *(a)example.com (everything) to go to virtual(a)example.com, where virtual is a valid virtual user. It seems that things are getting as far as LMTP, but then the mail gets bounced. To wit: Aug 21 08:02:50 hostname postfix/lmtp[4914]: 8DF8E9AFE6: to=<test(a)example.com>, relay=mail.example.com[private/dovecot-lmtp], delay=0.07, delays=0.04/0.01/0.01/0.01, dsn=5.1.1, status=bounced (host mail.example.com[private/dovecot-lmtp] said: 550 5.1.1 <test(a)example.com> User doesn't exist: test(a)example.com (in reply to RCPT TO command)) In the previous log example, test(a)example.com should have been forwarded (aliased) to the virtual mail user. Some config details: [root@hostname postfix]# cat /etc/postfix/virtual ######################################### #### Postmap this file after editing #### ######################################### # Person who should get root's mail. Don't receive mail as root! #root you # Basic system aliases -- these MUST be present MAILER-DAEMON postmaster postmaster root # General redirections for pseudo accounts bin root daemon root named root nobody root uucp root www root ftp-bugs root postfix root # Put your local aliases here. @example.com virtual(a)example.com # Well-known aliases manager root dumper root operator root abuse postmaster # trap decode to catch security attacks decode root [root@hostname postfix]# cat /etc/postfix/virtual_mailbox_domains ################################################ #### Do NOT postmap this file after editing #### ################################################ example.com [root@hostname postfix]# cat /etc/postfix/virtual_mailbox_maps ######################################### #### Postmap this file after editing #### ######################################### # From: http://wiki.dovecot.org/LDA/Postfix # Info: if you use the Dovecot LDA or LMTP it doesn't matter what you use behind the recipient address. Use "OK", the full name of the user or else. # I am using the Dovecot LMTP @example.com OK [root@hostname postfix]# dovecot --version 2.2.10 [root@hostname postfix]# dovecot -n # 2.2.10: /etc/dovecot/dovecot.conf # OS: Linux 3.10.0-327.22.2.el7.x86_64 x86_64 CentOS Linux release 7.2.1511 (Core) auth_verbose = yes login_greeting = What's crackalackin? mail_debug = yes mail_home = /var/mail/%d/%n mail_location = maildir:~/mail maildir_very_dirty_syncs = yes mbox_write_locks = fcntl namespace inbox { hidden = no inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = separator = / type = private } passdb { args = scheme=SSHA512 /etc/dovecot/passdb driver = passwd-file } protocols = imap lmtp service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } unix_listener auth-userdb { group = vmail mode = 0600 user = vmail } } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } ssl_cert = </etc/pki/tls/certs/hostname.com.crt ssl_cipher_list = EDH+CAMELLIA:EDH+aRSA:EECDH+aRSA+AESGCM:EECDH+aRSA+SHA256:EECDH:+CAMELLIA128:+AES128:+SSLv3:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!DSS:!RC4:!SEED:!IDEA:!ECDSA:kEDH:CAMELLIA128-SHA:AES128-SHA ssl_dh_parameters_length = 2048 ssl_key = </etc/pki/tls/certs/example.com.key ssl_prefer_server_ciphers = yes ssl_protocols = !SSLv3 !SSLv2 userdb { args = /etc/dovecot/userdb driver = passwd-file } [root@hostname postfix]# postconf -d mail_version mail_version = 2.10.1 [root@talyn postfix]# postconf -n alias_database = hash:/etc/aliases alias_maps = hash:/etc/aliases body_checks = pcre:/etc/postfix/body_checks.pcre broken_sasl_auth_clients = no command_directory = /usr/sbin config_directory = /etc/postfix daemon_directory = /usr/libexec/postfix data_directory = /var/lib/postfix debug_peer_level = 2 debugger_command = PATH=/bin:/usr/bin:/usr/local/bin:/usr/X11R6/bin ddd $daemon_directory/$process_name $process_id & sleep 5 disable_vrfy_command = yes header_checks = pcre:/etc/postfix/header_checks.pcre html_directory = no inet_protocols = all mail_owner = postfix mail_spool_directory = /var/spool/mail mailq_path = /usr/bin/mailq.postfix manpage_directory = /usr/share/man message_size_limit = 20480000 mydestination = $myhostname, localhost.$mydomain, localhost myhostname = mail.example.com mynetworks_style = host newaliases_path = /usr/bin/newaliases.postfix notify_classes = resource, software, bounce queue_directory = /var/spool/postfix readme_directory = /usr/share/doc/postfix-2.10.1/README_FILES relay_domains = $mydestination sample_directory = /usr/share/doc/postfix-2.10.1/samples sendmail_path = /usr/sbin/sendmail.postfix setgid_group = postdrop smtp_header_checks = pcre:/etc/postfix/smtp_header_checks.pcre smtp_tls_note_starttls_offer = yes smtp_use_tls = yes smtpd_banner = $myhostname Microsoft ESMTP MAIL Service, Version: 6.0.3790.1830 ready. smtpd_data_restrictions = reject_unauth_pipelining, reject_multi_recipient_bounce permit smtpd_helo_required = yes smtpd_recipient_restrictions = permit_sasl_authenticated, permit_mynetworks, permit_sasl_authenticated, reject_invalid_hostname, reject_invalid_helo_hostname, reject_non_fqdn_helo_hostname, reject_non_fqdn_hostname, reject_non_fqdn_sender, reject_non_fqdn_recipient, reject_unknown_sender_domain, reject_unknown_recipient_domain, reject_unauth_destination, check_recipient_access hash:/etc/postfix/recipient_access.hash, check_recipient_access pcre:/etc/postfix/recipient_access.pcre, check_sender_access hash:/etc/postfix/sender_access.hash, check_sender_access pcre:/etc/postfix/sender_access.pcre, reject_rbl_client b.barracudacentral.org, reject_rbl_client zen.spamhaus.org, reject_rbl_client bl.spamcop.net permit smtpd_sasl_auth_enable = yes smtpd_sasl_local_domain = smtpd_sasl_path = private/auth smtpd_sasl_security_options = noanonymous smtpd_sasl_type = dovecot smtpd_tls_auth_only = yes smtpd_tls_cert_file = /etc/pki/tls/certs/example.com.crt smtpd_tls_key_file = /etc/pki/tls/certs/example.com.key smtpd_tls_loglevel = 1 smtpd_tls_received_header = yes smtpd_tls_security_level = may smtpd_tls_session_cache_timeout = 3600s tls_random_source = dev:/dev/urandom unknown_local_recipient_reject_code = 550 virtual_alias_maps = hash:/etc/postfix/virtual virtual_mailbox_domains = /etc/postfix/virtual_mailbox_domains virtual_mailbox_maps = hash:/etc/postfix/virtual_mailbox_maps virtual_transport = lmtp:unix:private/dovecot-lmtp Thank you in advance for your assistance.

2 1

Field Return-Path contains twice the domain
by Quaquaraquà 21 Aug '16

21 Aug '16

Dear exim & dovecot users, posting on both mailing lists as I am not sure who has the ultimate responsability for this field. I am trying to set up a mail server for multiple domains in my VPS. So I managed to set up the authentication through a dovecot authenticator, which relies to a sqlite database. I would like that, from the database perspective, a query has, as input parameters, both the username and the domain to check the password. For this purpose, I am requesting that the SMTP account is in the full form username(a)domain.com. When forwarded to the dovecot authenticator, I can extract the user with %n and %d. This works, but it has a utter drawback: emails are sent repeating twice the domain in the Return-Path field, e.g. : Return-Path: <"user(a)domain.net"@domain.net> Subject: Re: Hello To: nuquaquaraqua(a)gmail.com From: user <user(a)domain.net> How do I properly fix the field Return-Path now? dovecot --version: 2.2.25 (7be1766) Exim version 4.87 #1 built 28-Jul-2016 18:38:04 Kind regards, Quaquaraqua

1 0

Port 143 is no SSL; no client auth; plain password auth. But port 993 is SSL; client cert auth.
by UK Universal Support Limited 21 Aug '16

21 Aug '16

I am experiencing the error "Error: BUG: Authentication client sent unknown handshake command:" My goal is Port 143: no SSL; no client auth; plain password auth. Port 993: SSL; client cert auth. I found the archive http://www.dovecot.org/list/dovecot/2016-February/103067.html and followed it, but does not work, I see the following log in /var/log/maillog Aug 21 15:36:42 vps0 dovecot: master: Dovecot v2.2.25 (7be1766) starting up for imap (core dumps disabled) Aug 21 15:37:51 vps0 dovecot: auth: Error: BUG: Authentication client sent unknown handshake command: REQUEST?1997012993?3734?1?e067999d43eebcecf0c9d44a1c108d75?session_pid=3741?r... Aug 21 15:37:51 vps0 dovecot: imap: Error: Authentication server didn't send valid SPID as expected: MECH#011PLAIN#011plaintext Aug 21 15:37:51 vps0 dovecot: imap: Error: Disconnected from auth server, aborting (client-pid=3734 client-id=1) Aug 21 15:37:51 vps0 dovecot: imap-login: Internal login failure (pid=3734 id=1) (internal failure, 1 successful auths): user=<contact>, method=PLAIN, rip=212.104.147.161, lip=46.30.14.36, mpid=3741, TLS, session=<UkXhtpY6W8XUaJOh> Aug 21 15:37:51 vps0 dovecot: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=212.104.147.161, lip=46.30.14.36, TLS handshaking: SSL_accept() failed: error:140D9115:SSL routines:SSL_GET_PREV_SESSION:session id context uninitialized, session=<nkrktpY6XMXUaJOh> Can anyone advice any solution? Dovecot version: 2.2.25 (7be1766) Operating system:CentOS 7, 64bit, selinux is off. CPU architecture: Intel x86 64bit. Filesystem: xfs # /usr/local/bin/doveconf -n # 2.2.25 (7be1766): /usr/local/etc/dovecot/dovecot.conf # OS: Linux 3.10.0-327.28.2.el7.x86_64 x86_64 CentOS Linux release 7.2.1511 (Core) auth_mechanisms = plain login auth_ssl_username_from_cert = yes disable_plaintext_auth = no mail_location = maildir:~/Maildir namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { driver = pam } protocols = imap service auth-ssl { executable = auth -o auth_ssl_require_client_cert=yes unix_listener auth-master-ssl { mode = 0666 } unix_listener login/login-ssl { mode = 0666 } } service imap-login-ssl { chroot = login executable = imap-login -l imap-ssl login-ssl inet_listener imaps { port = 993 ssl = yes } user = $default_login_user } service imap-login { inet_listener imaps { port = 0 } } service imap-ssl { executable = imap -a auth-master-ssl unix_listener login/imap-ssl { user = $default_login_user } } ssl_ca = </etc/SslCert/dovecot/2016080505CAcert.WithCrl.pem ssl_cert = </etc/SslCert/dovecot/2016080506cert.pem ssl_key = </etc/SslCert/dovecot/2016080506PrivateKey.NoPassPhrase.pem userdb { driver = passwd } protocol imap { auth_ssl_require_client_cert = no ssl_require_crl = no ssl_verify_client_cert = no } protocol imaps { auth_ssl_require_client_cert = yes ssl_require_crl = yes ssl_verify_client_cert = yes } #

1 0

Re: Crash on opening mailbox
by Aki Tuomi 21 Aug '16

21 Aug '16

So it seems. Sorry must've missed them. ---Aki TuomiDovecot oy -------- Original message --------From: Ladislav Laska <laska(a)kam.mff.cuni.cz> Date: 21/08/2016 13:59 (GMT+02:00) To: Aki Tuomi <aki.tuomi(a)dovecot.fi> Cc: dovecot(a)dovecot.org Subject: Re: Crash on opening mailbox Hi! dovecot -n and backtrace are both attached in my original email, due to their size. Did the attachments not arrive? The relevant log does not contain much more than the trace, but here it is: Aug 21 12:58:28 ibex dovecot: imap-login: Login: user=<krakonos>, method=PLAIN, rip=77.48.73.189, lip=78.108.107.19, mpid=17785, TLS, session=<Q5igz5I66sxNMEm9> Aug 21 12:58:28 ibex dovecot: imap(krakonos): Debug: Effective uid=1000, gid=100, home=/home/krakonos Aug 21 12:58:28 ibex dovecot: imap(krakonos): Debug: Namespace inbox: type=private, prefix=, sep=, inbox=yes, hidden=no, list=yes, subscriptions=yes location=mbox:~/.mbox Aug 21 12:58:28 ibex dovecot: imap(krakonos): Debug: mbox: INBOX defaulted to /home/krakonos/.mbox/inbox Aug 21 12:58:28 ibex dovecot: imap(krakonos): Debug: fs: root=/home/krakonos/.mbox, index=, indexpvt=, control=, inbox=/home/krakonos/.mbox/inbox, alt= Aug 21 12:58:29 ibex dovecot: imap(krakonos): Panic: file ../../../src/lib/array.h: line 219 (array_idx_i): assertion failed: (idx * array->element_size < array->buffer->used) Aug 21 12:58:29 ibex dovecot: imap(krakonos): Error: Raw backtrace: /usr/lib64/dovecot/libdovecot.so.0(+0x8d91e) [0x7fa68fb6a91e] -> /usr/lib64/dovecot/libdovecot.so.0(+0x8da0a) [0x7fa68fb6aa0a] -> /usr/lib64/dovecot/libdovecot.so.0(i_fatal+0) [0x7fa68fb08fce] -> /usr/lib64/dovecot/libdovecot-storage.so.0(+0x79e56) [0x7fa68fe6ae56] -> /usr/lib64/dovecot/libdovecot-storage.so.0(index_mail_get_first_header+0xd6) [0x7fa68fe6b2a6] -> /usr/lib64/dovecot/libdovecot-storage.so.0(mail_get_first_header+0x3d) [0x7fa68fe1e93d] -> /usr/lib64/dovecot/libdovecot-storage.so.0(+0x8de70) [0x7fa68fe7ee70] -> /usr/lib64/dovecot/libdovecot-storage.so.0(+0x8e062) [0x7fa68fe7f062] -> /usr/lib64/dovecot/libdovecot.so.0(i_stream_read+0x53) [0x7fa68fb74e03] -> /usr/lib64/dovecot/libdovecot.so.0(i_stream_read_data+0x3d) [0x7fa68fb7583d] -> /usr/lib64/dovecot/libdovecot.so.0(message_parse_header_next+0x72) [0x7fa68fb56042] -> /usr/lib64/dovecot/libdovecot.so.0(+0x736c1) [0x7fa68fb506c1] -> /usr/lib64/dovecot/libdovecot.so.0(i_stream_read+0x53) [0x7fa68fb74e03] -> /usr/lib64/dovecot/libdovecot.so.0(i_stream_read_data+0x3d) [0x7fa68fb7583d] -> /usr/lib64/dovecot/libdovecot.so.0(message_parse_header_next+0x72) [0x7fa68fb56042] -> /usr/lib64/dovecot/libdovecot.so.0(+0x736c1) [0x7fa68fb506c1] -> /usr/lib64/dovecot/libdovecot.so.0(i_stream_read+0x53) [0x7fa68fb74e03] -> /usr/lib64/dovecot/libdovecot.so.0(i_stream_read_data+0x3d) [0x7fa68fb7583d] -> /usr/lib64/dovecot/libdovecot.so.0(message_get_header_size+0x74) [0x7fa68fb59d64] -> /usr/lib64/dovecot/libdovecot-storage.so.0(imap_msgpart_open+0x317) [0x7fa68fea7ff7] -> dovecot/imap() [0x41d4ae] -> dovecot/imap() [0x41b9fc] -> dovecot/imap(imap_fetch_more+0x3a) [0x41ca0a] -> dovecot/imap(cmd_fetch+0x32c) [0x40f57c] -> dovecot/imap(command_exec+0x9c) [0x41a29c] -> dovecot/imap() [0x418772] -> dovecot/imap() [0x418800] -> dovecot/imap(client_handle_input+0x175) [0x418b95] Aug 21 12:58:29 ibex dovecot: imap(krakonos): Fatal: master: service(imap): child 17785 killed with signal 6 (core dumped) On Sat, Aug 20, 2016 at 01:25:01AM +0300, Aki Tuomi wrote: > > > On August 19, 2016 at 10:00 PM Ladislav Laska <laska(a)kam.mff.cuni.cz> wrote: > > > > > > Hi! > > > > I'm currently experiencing a crash of dovecot 2.2.25 on Gentoo, upon opening > > mailbox. The crash only triggers on opening inbox, other mailboxes seem to > > work fine. It happens every time, and can be reproduced on request. I also > > briefly tried 2.2.19, and it behaves the same. > > > > The bug seems to be triggered by some mail, as I encountered it previously > > and fixed by removing some spam. I guess it might be malformed header of > > some kind. I can open the mailbox locally using mutt, but fail to do so > > remotely (using mutt or K-9 mail on android). Unforunately, I haven't been > > able to isolate the specific mail, as when I create a new mailbox, dovecot > > refuses to open it: > > > > [CANNOT] Mailbox isn't a valid mbox file (0.000 + 0.000 secs). > > > > I'm not really sure what's going on and will investigate further once I find > > some time to do so. > > > > I also experienced a similar problem on opening a specific mail, but it's > > much harder to reproduce and I currently don't have an example. The crash > > looks very similar, and only happens on first attempt to open a specific > > mail, it always works later on. > > > > I'm attaching a stack trace and dovecot -n. I'm also willing to send the > > binary and core dump, but not publicly, as I'm not eager to share whatever's > > inside with the whole world. > > > > Other than what I mentioned, I'm running pretty standard setup, with postfix > > on Gentoo x86_64, ext4 fs, quota and disk space is plentiful. The delivery > > agent is dovecot itself, in postfix/main.cf I have: > > > > mailbox_command = /usr/libexec/dovecot/deliver > > > > I'm using sieve script to file my mail, but the problem manifested even > > before when I was still using procmail to deliver my mail (I migrated > > because I had doubts about procmail and dovecot lock cooperation) > > > > I'll keep my mailbox corrupted for a few more days, and access the mail only > > locally, hoping to test a potential fix. Let me know if you need any more > > info/experimentation. Also, if you know a good way to find the mail that > > causes the trouble out of the core, let me know, I'd be glad to forward it > > for testing. > > > > Thanks and I hope we can find (and fix) the problem! > > > > -- S pozdravem Ladislav Láska > > <laska(a)kam.mff.cuni.cz> > > Katedra Aplikované Matematiky, MFF UK tel.: +420 739 464 167 > > Hi! > > Please provide > > doveconf -n > > relevant log files (or at least anything you care to share) > > gdb /path/to/binary /path/to/core > bt full > > --- > Aki Tuomi > Dovecot Oy -- S pozdravem Ladislav Láska <laska(a)kam.mff.cuni.cz> Katedra Aplikované Matematiky, MFF UK tel.: +420 739 464 167

1 0

Dovecot & Thunderbird on shared mbox
by Ruga 19 Aug '16

19 Aug '16

Occasional error from TB when selecting a dovecot's shared mbox: "Unable to open the summary file for [shared]" "Perhaps there was an error on disk, or the full path is too long." The server's disk is clear, and the longest full path is [a-zA-Z\/\.]{46}. The error occurs occasionally.

2 2