January 2017 - dovecot

Virtual POP3 namespaces and quota-status
by Aurélien Beaujean 09 Jan '17

09 Jan '17

Hi, I've tried to do configure Virtual POP3 INBOX (dovecot version 2.2.18) as explained here http://wiki.dovecot.org/Plugins/Virtual with a static userdb and nopassword=y so I dont have any database on the dovecot server without the possibility to distinguish POP3 or IMAP in the userdb extra field to change the namespace on the fly. So I've put the namespace virtual informations inside the protocol pop3 { ... }, I did the same for the protocol imap { }: protocol pop3 { mail_plugins = $mail_plugins last_login virtual namespace inbox { prefix = separator = / list = yes } namespace virtual { inbox = yes prefix = virtual/ separator = / location = virtual:/etc/dovecot/virtual:INDEX=MEMORY list = no hidden = yes } namespace real { prefix = RealMails/ separator = / list = no hidden = yes } } protocol imap { mail_plugins = $mail_plugins imap_quota last_login namespace inbox { inbox = yes } } protocol lda { mail_plugins = " quota sieve" namespace inbox { inbox = yes } } passdb { args = nopassword=y uid=vmail gid=vmail home=/var/mail/%2Mn/%2.2Mn/%n driver = static } userdb { args = nopassword=y uid=vmail gid=vmail home=/var/mail/%2Mn/%2.2Mn/%n driver = static } service quota-status { executable = quota-status -p postfix inet_listener { port = 12340 } process_min_avail = 8 } But the service quota-status getting lost with a message: namespace configuration error: inbox=yes namespace missing I didn't find a way to tell quota-status which namespace to use as you can't setup a default one. If I declare a "global" namespace inbox pop3 deamon fails because of duplicated namespace inbox in the configuration files: pop3(xxx): Error: User initialization failed: namespace configuration error: There can be only one namespace with inbox=yes Any idea before I will patch some piece of code to disable the unique restriction of inbox namespace ? Thanks, -- Auré

1 2

dsync for subscription on public/shared folder
by Mike Fröhner 09 Jan '17

09 Jan '17

Hello, I already wrote regarding that, but maybe it sounded too complex. I will write it a bit softer now. The replication through dsnyc works perfectly with one exception. I am having an issue with the replication of the subscriptions file on shared folder. We have a public mailbox defined: namespace public-test { location = maildir:/opt/mail/_public/test prefix = public/test/ separator = / subscriptions = no type = public } There 2 subfolder .Test1 and .Test2 which I would like to subscribe on my user "ldaptestuser" which is part of the group "ldaptestgroup" The dovecot-acl file on /opt/mail/_public/test and /opt/mail/_public/test/.Test{1,2} are the same and are containing: group=ldaptestgroup lrwstipekxa Now if I login through my client (Thunderbird or Roundcubemail) I can see the following debug log: dovecot: imap(ldaptestuser): Debug: acl: acl username = ldaptestuser dovecot: imap(ldaptestuser): Debug: acl: owner = 0 dovecot: imap(ldaptestuser): Debug: acl: group added: domain users dovecot: imap(ldaptestuser): Debug: acl: group added: ldaptestgroup dovecot: imap(ldaptestuser): Debug: acl: group added: all_mailuser I created one new private folder on the mailbox of my test user and also subscribed it. This subscription is successfully replicated. After that I am trying to subscribe the public folder. I can see the folder in my client after I subscribed them. But on the 2nd dovecot server the subscription file is not updated. imap-1 # cat subscription Private1 public/test/Test1 imap-2 # cat subscription Private1 The debug log on both dovecot server tells me: dovecot: doveadm(<ip>,ldaptestuser): Debug: Effective uid=834603987, gid=991, home=/opt/mail/ldaptestuser dovecot: doveadm(<ip>,ldaptestuser): Debug: acl: No acl_shared_dict setting - shared mailbox listing is disabled dovecot: doveadm(<ip>,ldaptestuser): Debug: maildir++: root=/opt/mail/_public/test, index=, indexpvt=, control=, inbox=, alt= dovecot: doveadm(<ip>,ldaptestuser): Debug: acl: initializing backend with data: vfile dovecot: doveadm(<ip>,ldaptestuser): Debug: acl: acl username = ldaptestuser dovecot: doveadm(<ip>,ldaptestuser): Debug: acl: owner = 0 dovecot: doveadm(<ip>,ldaptestuser): Debug: acl vfile: Global ACLs disabled It looks like the doveadm() cannot find the group or is not checking/initalizing the groups. Anybody any idea if I missconfigured something or is this just a bug? I really would appreciate some help. kind regards, Mike;

1 1

Auth-policy: auth_policy_server_url and https support
by gregc＠olypensupport.com 08 Jan '17

08 Jan '17

When using Auth policy server it doesn’t currently doesn’t support https. In version 2.2.27: Policy server HTTP error: 9002 Couldn't initialize SSL context: Can't verify remote server certs without trusted CAs (ssl_client_ca_* settings) and in version 2.3.devel Policy server HTTP error: 9002 Requested https connection, but no SSL settings given dovecot.conf does have “ssl_client_ca_dir = /etc/ssl/certs” set. Looking around the source, http-client-settings are not given the ssl_ca_dir or ssl_ca_file setting from the config. Admittedly SSL tear up/down is little expensive per auth, but I think it maybe it should still work?

2 1

.dovecot.sieve location issue
by Jibeji 08 Jan '17

08 Jan '17

Hello, I am trying to set sieve up on a Centos 7 server. It's a configuration with postfix, Maildir, MySQL and virtual domains which works fine. I have created a simple .dovecot.sieve in the user's directory: # cat /home/mail/domain.com/user/.dovecot.sieve require "fileinto"; redirect "other_address(a)other_domain.com"; Here are the logs: dovecot: lda(user(a)domain.com): Debug: sieve: Pigeonhole version 0.4.2 initializing lda(user(a)domain.com): Debug: sieve: include: sieve_global_dir is not set; it is currently not possible to include `:global' scripts. dovecot: lda(user(a)domain.com): Debug: sieve: script file /home/mail/ domain.com/.dovecot.sieve not found dovecot: lda(user(a)domain.com): Debug: sieve: user's script ~/.dovecot.sieve doesn't exist (trying default script location instead) lda(user(a)domain.com): Debug: sieve: no default script configured for user lda(user(a)domain.com): Debug: sieve: user has no valid location for a personal script lda(user(a)domain.com): Debug: sieve: no scripts to execute: reverting to default delivery. dovecot: lda(user(a)domain.com): msgid=<005b01d269ca$f287ebf0$d797c3d0$@fr>: saved mail to INBOX It tells that user's script ~/.dovecot.sieve doesn't exis However, on the troubleshooting guide, I can see these logs: dovecot: lda(hendrik): Debug: sieve: using sieve path for user's script: /home/hendrik/.dovecot.sieve dovecot: lda(hendrik): Debug: sieve: opening script /home/hendrik/.dovecot.sieve As you can see, it refers to "lda(hendrik)" but not "lda(user(a)domain.com" I am wondering whether Sieve looks for the file elsewhere than /home/mail/ domain.com/user/.dovecot.sieve Do you have any idea?

3 3

Dovecot Selinux Setting
by Günther J. Niederwimmer 08 Jan '17

08 Jan '17

Hello, can any tell me the correct selinux Settings for the Maildir Setting ? in the Moment I have this setting Jan 8 15:04:52 2017 from 192.168.100.100 [root@mx03 ~]# ls -Z /srv/vmail drwx------. vmail vmail unconfined_u:object_r:mail_home_rw_t:s0 example.com drwx------. vmail vmail unconfined_u:object_r:mail_home_rw_t:s0 example.at drwx------. vmail vmail unconfined_u:object_r:mail_home_rw_t:s0 eu-example.at drwx------. vmail vmail unconfined_u:object_r:mail_home_rw_t:s0 example1.com -rw-rw----. vmail vmail unconfined_u:object_r:mail_home_rw_t:s0 shared- mailboxes I mean this not correct, I have problems with sieve to enable the Link and with Sync ? I can't found the correct setting with goo..... Thanks for Help and a answer, -- mit freundlichen Grüssen / best regards Günther J. Niederwimmer

2 1

auth: Error: BUG: Authentication client sent unknown handshake command
by Marcus Endberg 08 Jan '17

08 Jan '17

Hello! I run dovecot for many years now, but today it ran into a bug I've never seen before. Searching the archives, this bug seems to occur very seldom. The current server installation & configuration is running since mid 2015, uptime of the server today is more than two months. It is a virtual machine in a data center, debian 7 / reiserfs, 'dovecot -n' output below. Just within normal operation, suddenly my users could no longer check their IMAP accounts, log shows lots of entries like this: ----------------------- /var/log/mail.log excerpt --------------------- 2017-01-08 08:15:23 dovecot: auth: Error: BUG: Authentication client sent unknown handshake command: REQUEST?3484549121?11364?1?74fa603b892f9a262605ae6c2ce1d9a1 2017-01-08 08:15:23 dovecot: imap: Error: Authentication server didn't send valid SPID as expected: MECH#011PLAIN#011plaintext 2017-01-08 08:15:23 dovecot: imap: Error: Disconnected from auth server, aborting (client-pid=11364 client-id=1) 2017-01-08 08:15:23 dovecot: imap-login: Internal login failure (pid=11364 id=1) (internal failure, 1 succesful auths): user=<USER_NAME>, method=PLAIN, rip=<USER_IP>, lip=85.214.143.57, mpid=11368, TLS, session=<0oiwA5BFmQBQhoL1> ----------------------------------------------------------------------- Strangely, sending mails still worked fine (postfix uses dovecot SASL authentification). I could not find any hint what might have caused the error in any logfile. After restarting dovecot everything is back to normal operation. Is there any other information I can / should provide? Thanks for your efforts, Marcus ----------------------- output of 'dovecot -n' ------------------------ # 2.1.7: /etc/dovecot/dovecot.conf # OS: Linux 3.2.41-042stab120.16 i686 Debian 7.11 mail_location = maildir:~/Maildir namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { driver = pam } protocols = " imap" service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } } ssl_cert = </correct_path_to/mailbox.endberg.net-chain.cert ssl_cipher_list = ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA ssl_key = </home/sslcerts/keys/mailbox.endberg.net.key ssl_protocols = !SSLv2 !SSLv3 userdb { driver = passwd } -----------------------------------------------------------------------

1 0

OP/PSA: Net Systems Research mail port diddlers
by lists＠lazygranch.com 06 Jan '17

06 Jan '17

http://netsystemsresearch.com/ dovecot.log.1.bz2:Jan 05 17:28:15 pop3-login: Info: Disconnected (no auth attempts in 3 secs): user=<>, rip=169.54.233.124, lip=MYIP, TLS handshaking: Disconnected, session=<z/L0OVxFetOpNul8> Their "research" pokes your email ports. Block if you want or participate in the (cough cough) research. IP addresses and opt-out email address on webpage.

2 1

Dovecot dsync tcps sends incomplete certificate chain
by Juri 06 Jan '17

06 Jan '17

Hi, I'm trying to configure a Dovecot dsync service between two servers, using a tcp+ssl connection and a valid Let's Encrypt certificate. I followed the guide on the wiki (http://wiki.dovecot.org/Replication) using the tcps method, but when I launch the replication it fails writing on the log (/var/log/mail.err): (Server 1 - sync "client" )| Error: sync: Disconnected from remote: Received invalid SSL certificate: unable to get local issuer certificate: /CN=mail.dividebyzero.it (Server 2 - sync "server")| Error: doveadm client disconnected before handshake: <no error> If I try to connect to the server using openssl s_client, on the port 993 (imaps) the server correctly sends the full chain: $ openssl s_client -connect server1.fqdn:993 CONNECTED(00000003) depth=2 O = Digital Signature Trust Co., CN = DST Root CA X3 verify return:1 depth=1 C = US, O = Let's Encrypt, CN = Let's Encrypt Authority X3 verify return:1 depth=0 CN = mail.dividebyzero.it verify return:1 --- Certificate chain 0 s:/CN=mail.dividebyzero.it i:/C=US/O=Let's Encrypt/CN=Let's Encrypt Authority X3 1 s:/C=US/O=Let's Encrypt/CN=Let's Encrypt Authority X3 i:/O=Digital Signature Trust Co./CN=DST Root CA X3 ... while on the doveadm port it fails: $ openssl s_client -connect server1.fqdn:7557 CONNECTED(00000003) depth=0 CN = mail.dividebyzero.it verify error:num=20:unable to get local issuer certificate verify return:1 depth=0 CN = mail.dividebyzero.it verify error:num=21:unable to verify the first certificate verify return:1 --- Certificate chain 0 s:/CN=mail.dividebyzero.it i:/C=US/O=Let's Encrypt/CN=Let's Encrypt Authority X3 ... I run Dovecot 2.2.13 on Debian 8.6: $ dovecot -n # 2.2.13: /etc/dovecot/dovecot.conf # OS: Linux 3.16.0-4-amd64 x86_64 Debian 8.6 auth_default_realm = dividebyzero.it auth_mechanisms = plain login doveadm_password = (redacted) doveadm_port = 7557 mail_location = maildir:~/Maildir mail_plugins = " notify replication" namespace inbox { (removed) } passdb { driver = pam } passdb { args = username_format=%n /etc/vmail/%d/passwd driver = passwd-file } plugin { mail_replica = tcps:otherserver.fqdn } protocols = " imap lmtp" service aggregator { fifo_listener replication-notify-fifo { user = dovecot } unix_listener replication-notify { user = dovecot } } service auth { unix_listener auth-client { group = Debian-exim mode = 0660 } unix_listener auth-userdb { user = vmail } } service doveadm { inet_listener { port = 7557 ssl = yes } } service imap-login { inet_listener imap { port = 143 } inet_listener imaps { port = 993 ssl = yes } } service replicator { process_min_avail = 1 unix_listener replicator-doveadm { mode = 0666 } } ssl = required ssl_cert = </etc/letsencrypt/live/mail.dividebyzero.it/fullchain.pem ssl_client_ca_file = /etc/letsencrypt/live/mail.dividebyzero.it/chain.pem ssl_key = </etc/letsencrypt/live/mail.dividebyzero.it/privkey.pem userdb { driver = passwd } userdb { args = uid=vmail gid=vmail home=/var/local/vmail/%d/%n driver = static } Is it a known problem, or has it been resolved in a subsequent version? If it is not, can you suggest me a workaround in the meantime? Thank you.

3 5

IMAP proxy for Exchange - encrypted backend Communication?
by tom 06 Jan '17

06 Jan '17

Hello, I try to setup a IMAP proxy for my old Exchange server. Running Dovecot v2.x on Centos 7. So far I follow http://wiki2.dovecot.org/HowTo/ImapcProxy and it seem to work. The only but major thing is with this setup - the communication between proxy and backend is not encrypted. :( To fix this, I changed the config and add: imapc_ssl=imaps imapc_port=993 but it doesnt work, because of verify failure of the self signed backend certificate: Jan 5 21:48:55 imap dovecot: imap(user1): Error: imapc(192.168.1.1:993): Couldn't initialize SSL context: Can't verify remote server certs without trusted CAs (ssl_client_ca_* settings) Jan 5 21:48:55 imap dovecot: imap(user1): Error: imapc(192.168.1.1:993): No SSL context Jan 5 21:48:55 imap dovecot: imap(user1): Error: imapc: Command failed: Disconnected from server Jan 5 21:48:55 imap dovecot: imap(user1): Error: user tkoenig: Initialization failed: Initializing mail storage from mail_location setting failed: Mailbox list driver imapc: Failed to access imapc backend Jan 5 21:48:55 imap dovecot: imap(user1): Error: Invalid user settings. Refer to server log for more information. I didnt found anything in the documentation which tells dovcot not verify the backend certificate. Is there a know way to get it runing? Many thanks for any hint! regrds, Tom

3 2

dovecot-pigeonhole running external script ends with signal 11
by Tobi 06 Jan '17

06 Jan '17

Hi, I'm running a dovecot 2.2.26 (self compiled) on a Centos 7. I have a sieve script which should run an external script (in filter mode) that encrypts the mail using the users pub key. I configured 90-plugin.conf as follows plugin { sieve_plugins = sieve_extprograms sieve_extensions = +vnd.dovecot.filter sieve_filter_bin_dir = /etc/dovecot/sieve-filters sieve_filter_exec_timeout = 10000 } The script is named SCRIPT and is called in my sieve script require "vnd.dovecot.filter"; if blabla { filter "SCRIPT" ["me(a)example.com"]; } the script returns the encrypted mail. I can call this SCRIPT without any error manually on the console as dovecot user (vmail). Also sieve-test "says" that the script called sucessfully su vmail sieve-test -e -t - -Tlevel=commands -r me(a)example.com -l /home/vmail/example.com/me/.Maildir /home/vmail/example.com/me/.dovecot.sieve /tmp/test.mail ... 23: filter action 23: execute program `SCRIPT' 23: executed program successfully 23: changed message ... info: msgid=<B5OEuIEvrCZzcoJ7A6fCF-ka2Nwz-Ze2UCO840Panvw.w7zr1vruaJMbDBwK63natps3v__yOgbhHy3ntACTU0s@redacted>: stored mail into mailbox 'INBOX'. sieve-test(vmail): Info: final result: success and I get the encrpted message in my mailbox. Just when it's called upon delivery via lmtp the script ends with signal 11 Jan 3 15:59:48 mbox2 dovecot: lmtp(me(a)example.com): Error: program `/etc/dovecot/sieve-filters/SCRIPT' terminated abnormally, signal 11 And in ~/.dovecot.sieve.log I can find the following .dovecot: line 23: error: filter action: failed to execute to program `SCRIPT': refer to server log for more information. [2017-01-03 15:59:48]. I have no idea why the manual call runs perfect and the call from sieve file ends up in this error. Does anyone have an idea how I could narrow down the source of this error? Or even better how to fix it? :-) Thanks for any answer tobi

4 8