February 2017 - dovecot

Changes to userdb not picked up
by Tom Sommer 08 Feb '17

08 Feb '17

I have my quota limits stored in userdb and auth_cache enabled (default settings). When I change the quota limit the old limit is still cached for the user for another hour. Is there any way to prevent this from happening? Thanks -- Tom

3 3

Filenames and flags
by Carsten Czichos 08 Feb '17

08 Feb '17

Hi list, where can I find the meaning of lowercase file flags ? I found this information: http://cr.yp.to/proto/maildir.html <http://cr.yp.to/proto/maildir.html> But what does the lowercase a & d mean as in ...,S=2364,W=2411:2,Sad ? Thanx for your help !

2 1

Re: Dovecot dsync 'ssl_client_ca'
by Aki Tuomi 08 Feb '17

08 Feb '17

Please keep responses in list. rm -f /var/lib/dovecot/ssl-parameters.dat, i think it was in that dir. On 2017-02-03 17:00, Thierry wrote: > Hi, > > I have removed the '<' : > > ssl_client_ca_file = /etc/ssl/certs/GandiCA2.pem > > But now: > > doveadm: Error: Corrupted SSL parameters file in state_dir: ssl-parameters.dat - disabling SSL 360 > doveadm: Error: Couldn't initialize SSL parameters, disabling SSL > doveadm: Error: Corrupted SSL parameters file in state_dir: ssl-parameters.dat - disabling SSL 360 > doveadm: Error: Couldn't initialize SSL parameters, disabling SSL > > Any idea ? > > Thx > >> Yes. The ssl_client_ca_file is not actually expecting <, just file name. >> Aki > >> On 2017-02-03 15:13, Thierry wrote: >>> Hi, >>> >>> I have made change: >>> >>> ssl_protocols = !SSLv2 !SSLv3 >>> ssl = required >>> verbose_ssl = no >>> ssl_key = </etc/ssl/private/private.key >>> ssl_cert = </etc/ssl/certs/key.crt >>> ssl_client_ca_file = </etc/ssl/certs/GandiCA2.pem >>> >>> >>> # Create a listener for doveadm-server >>> service doveadm { >>> user = vmail >>> inet_listener { >>> port = 12345 >>> ssl= yes >>> } >>> } >>> >>> and doveadm_port = 12345 // mail_replica = tcps:server2.domain.ltd # use doveadm_port >>> >>> And now: >>> >>> Feb 03 14:11:16 doveadm(user1(a)domain.ltd): Error: sync: Couldn't initialize SSL context: Can't load CA certs from directory : error:02001024:system library:fopen:File name too long >>> Feb 03 14:11:17 doveadm: Error: Corrupted SSL parameters file in state_dir: ssl-parameters.dat - disabling SSL 360 >>> Feb 03 14:11:17 doveadm: Error: Couldn't initialize SSL parameters, disabling SSL >>> >>> Thx for your support >>> >>> >>> >>> >>> Le vendredi 3 février 2017 à 11:34:43, vous écriviez : >>> >>>> Hello, >>>> On 02/03/2017 08:51 AM, Thierry wrote: >>>>> Hello, >>>>> >>>>> Still working with my dsync pb. >>>>> I have done a clone (vmware) of my email server. >>>>> Today I have two strictly identical emails servers (server1 >>>>> (main) and server2 (bck) (except IP, hostname and mail_replica). >>>>> >>>>> The ssl config on my both server: >>>>> >>>>> ssl_protocols = !SSLv2 !SSLv3 >>>>> ssl = required >>>>> verbose_ssl = no >>>>> ssl_key = </etc/ssl/private/private.key >>>>> ssl_cert = </etc/ssl/certs/key.crt >>>>> ssl_ca = </etc/ssl/certs/GandiStandardSSLCA2.pem >>>> I think it should be ssl_client_ca_file = >>>> </etc/ssl/certs/GandiStandardSSLCA2.pem for you. >>>>> This config is working for my email client and my email web >>>>> interface ... >>>>> >>>>> Are they on the right order ? >>>>> >>>>> mail_replica = tcps:server1@domain.ltd and tcps:server2@domain.ltd >>>>> >>>>> There is trafic on my iptables rules on my both servers: >>>>> >>>>> 60 3600 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:4711 >>>>> >>>>> >>>>> >>>>> My error message from server1 (main server): >>>>> >>>>> Feb 03 08:38:08 doveadm(user1(a)domain.ltd): Error: sync: Couldn't initialize SSL context: Can't verify remote server certs without trusted CAs (ssl_client_ca_* settings) >>>>> Feb 03 08:42:35 doveadm(user2(a)domain.ltd): Error: sync: Couldn't initialize SSL context: Can't verify remote server certs without trusted CAs (ssl_client_ca_* settings) >>>>> Feb 03 08:42:35 doveadm(user3(a)domain.ltd): Error: sync: Couldn't initialize SSL context: Can't verify remote server certs without trusted CAs (ssl_client_ca_* settings) >>>>> Feb 03 08:42:35 doveadm(user4(a)domain.ltd): Error: sync: Couldn't initialize SSL context: Can't verify remote server certs without trusted CAs (ssl_client_ca_* settings) >>>>> >>>>> No logs from server2 >>>>> >>>>> Any ideas ? >>>>> >>>>> Thx for your support >>>>> >>>>> >>>

3 6

Sieve LDA Errors (Improper Saving?)
by Richard Laager 08 Feb '17

08 Feb '17

I'm getting lots of errors like this (possibly on every message delivery): imap2 dovecot: lmtp(rlaager(a)wiktel.com): Error: OU02K+gQmFhUAwAAVtfydQ : sieve: binary save: failed to create temporary file: open(/var/lib/dovecot/sieve/junk-mail.svbin.ima p2.852.) failed: Permission denied (euid=500(vmail) egid=500(vmail) missing +w perm: /var/lib/dovecot/ sieve, dir owned by 0:0 mode=0755) imap2 dovecot: lmtp(rlaager(a)wiktel.com): Error: OU02K+gQmFhUAwAAVtfydQ: sieve: The LDA Sieve plugin does not have permission to save global Sieve script binaries; global Sieve scripts like `/var/lib/dovecot/sieve/junk-mail.sieve' need to be pre-compiled using the sievec tool It's intentional in my setup that the vmail user can't write to the global sieve script directory. But it shouldn't need to, as those are already pre-compiled: rlaager@imap2:/var/lib/dovecot/sieve$ ls -la total 12 drwxr-xr-x 2 root root 4096 Nov 29 22:27 . drwxr-xr-x 3 root root 4096 Feb 6 20:39 .. lrwxrwxrwx 1 root root 53 Sep 12 01:35 junk-mail.sieve -> /usr/share/wiktel-server-mail-backend/junk-mail.sieve -rw-r--r-- 1 root root 254 Nov 29 22:27 junk-mail.svbin rlaager@imap2:/var/lib/dovecot/sieve$ ls -la /usr/share/wiktel-server-mail-backend/junk-mail.sieve -rw-r--r-- 1 root root 124 Oct 31 09:34 /usr/share/wiktel-server-mail-backend/junk-mail.sieve Note that the .svbin is from November, while the text version is from October. Even if something is looking at the date of the symlink, that's from September. So the first question is... why is Dovecot trying to write the binary file? I dug into the Pigeonhole code... I think, but am certainly not sure, that lda_sieve_open() in pigeonhole/src/plugins/lda-sieve/lda-sieve-plugin.c is the relevant function calling lda_sieve_binary_save(). At the end of the function, it has: if (!recompile) lda_sieve_binary_save(srctx, sbin, script); This seems odd to me. Why is it trying to save in the "!recompile" case? It seems like it should be saving in the "recompile" case. If I'm reading this code right, recompile is set when it loads a corrupt sieve binary script and needs to recompile from text. I could be completely off, though. Any thoughts? -- Richard

2 2

Migrating to sieve
by Adam Shostack 08 Feb '17

08 Feb '17

Hi, As I migrate to sieve, I would like to carry over the logic I had in procmail rules, which let me take all mail where I'd never sent email to that address into a final spam catchall, which I called "neversent." I see that sieve can't run external programs, and I wonder if that means I'm SOL, or is there an alternate approach that does roughly the same thing? (I understand the general security logic for that decision. I have root access on the server in question if that helps.) Thank you for any help you can provide! Adam The procmail code was: # a bunch of complex shell script to extract From: into a variable of that # name. :0: * ^TO_$ME * !? fgrep -q --ignore-case -e "$FROM" $HOME/.lbdb/m_inmail.list neversent along with a procmail-outbound setup of: :0hc | lbdb-fetchaddr -a :0 ! "$@"

2 2

Dovecot with dsync
by Nick Lekkas 07 Feb '17

07 Feb '17

Hello to all !!! I am trying to setup dsync on CentOS latest with dovecot 2.2.10 ...but does not seem to work !! I have tried to follow many guides i have found but none seem to work ! Before i mention my issues please clear me something: 1. dsynch to work needs for sure mysql ..? or can work with the default linux user scheme ..? 2. if mysql is required please where can i a working working user schema ? thanks in advance for your time ... __________ Information from ESET Endpoint Antivirus, version of virus signature database 14893 (20170206) __________ The message was checked by ESET Endpoint Antivirus. Email message - is OK http://www.eset.com

1 0

Dsync migration with shared folders
by George Dimakopoulos 06 Feb '17

06 Feb '17

Hi everyone, We discovered that the migration path from a VPS to our 2XHP replication server environment with shared folders should be: 1) Rsync all domains from the VPS to serverA. Then rsync all domains from ServerA to ServerB. ServerA & ServerB are in a identical state. 2) Create an empty directory for the shared indexes 3) Start dovecot on both machines. If we did not sync both machines then dsync could not replicate the domains that contained shared folders. What is the right migration process for domains with shared folders ? Regards, George dovecot -n ------------------------- # 2.2.27 (c0f36b0): /usr/local/etc/dovecot/dovecot.conf # Pigeonhole version 0.4.16 (fed8554) # OS: FreeBSD 11.0-RELEASE-p2 amd64 zfs auth_mechanisms = plain login auth_verbose = yes default_client_limit = 2560 default_process_limit = 512 dict { acl = mysql:/usr/local/etc/dovecot/dovecot-shared-sql.conf.ext quota = mysql:/usr/local/etc/dovecot/dovecot-dict-sql.conf.ext } doveadm_password = # hidden, use -P to show it doveadm_port = 12345 log_path = /var/log/dovecot.log mail_debug = yes mail_home = /usr/local/vhosts/mail/%d/%n mail_location = maildir:/usr/local/vhosts/mail/%d/%n:LAYOUT=fs mail_max_userip_connections = 70 mail_plugins = quota acl notify replication mail_privileged_group = vmail mail_shared_explicit_inbox = yes managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext mbox_write_locks = fcntl namespace { inbox = no list = children location = maildir:/usr/local/vhosts/mail/%%d/%%n:LAYOUT=fs:INDEX=/usr/local/vhosts/indexes/%d/%n/shared/%%u:INDEXPVT=/usr/local/vhosts/indexes/%d/%n/shared/%%u prefix = shared/%%d/%%n/ separator = / subscriptions = no type = shared } namespace inbox { inbox = yes list = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk { auto = subscribe special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox Trash { auto = subscribe special_use = \Trash } prefix = separator = / type = private } passdb { args = /usr/local/etc/dovecot/dovecot-sql.conf.ext driver = sql } plugin { acl = vfile acl_shared_dict = proxy::acl mail_replica = tcp:mx1 quota = dict:User quota::proxy::quota quota_rule2 = Trash:storage=+100M sieve = /usr/local/vhosts/mail/%d/%n/.dovecot.sieve sieve_before = /usr/local/vhosts/sieve/before.d/ sieve_dir = /usr/local/vhosts/mail/%d/%n sieve_global_dir = /usr/local/vhosts/sieve/%d sieve_global_path = /usr/local/vhosts/sieve/%d/default.sieve } protocols = imap lmtp sieve sieve service aggregator { fifo_listener replication-notify-fifo { mode = 0666 user = vmail } unix_listener replication-notify { mode = 0666 user = vmail } } service auth-worker { user = vmail } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0666 user = postfix } unix_listener auth-userdb { mode = 0600 user = vmail } user = dovecot } service config { unix_listener config { user = vmail } } service dict { unix_listener dict { mode = 0600 user = vmail } } service doveadm { inet_listener { port = 12345 } user = vmail } service imap-login { inet_listener imap { port = 143 } } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } service managesieve-login { inet_listener sieve { port = 4190 } process_min_avail = 0 service_count = 1 vsz_limit = 64 M } service replicator { unix_listener replicator-doveadm { mode = 0666 } } userdb { args = /usr/local/etc/dovecot/dovecot-sql.conf.ext driver = sql } protocol lmtp { mail_plugins = quota acl notify replication sieve } protocol lda { mail_plugins = quota acl notify replication sieve acl postmaster_address = root } protocol imap { imap_client_workarounds = tb-extra-mailbox-sep mail_plugins = quota acl notify replication imap_quota imap_acl } ssl_cert = ssl_key =

1 0

Dsync migration with shared folders
by Γιώργος Δημακόπουλος 06 Feb '17

06 Feb '17

Hi everyone, We discovered that the migration path from a VPS to our 2XHP replication server environment with shared folders should be: 1) Rsync all domains from the VPS to serverA. Then rsync all domains from ServerA to ServerB. ServerA & ServerB are in a identical state. 2) Create an empty directory for the shared indexes 3) Start dovecot on both machines. If we did not sync both machines then dsync could not replicate the domains that contained shared folders. What is the right migration process for domains with shared folders ? Regards, George g.dimakopoulos(a)sophimail.com dovecot -n ------------------------- # 2.2.27 (c0f36b0): /usr/local/etc/dovecot/dovecot.conf # Pigeonhole version 0.4.16 (fed8554) # OS: FreeBSD 11.0-RELEASE-p2 amd64 zfs auth_mechanisms = plain login auth_verbose = yes default_client_limit = 2560 default_process_limit = 512 dict { acl = mysql:/usr/local/etc/dovecot/dovecot-shared-sql.conf.ext quota = mysql:/usr/local/etc/dovecot/dovecot-dict-sql.conf.ext } doveadm_password = # hidden, use -P to show it doveadm_port = 12345 log_path = /var/log/dovecot.log mail_debug = yes mail_home = /usr/local/vhosts/mail/%d/%n mail_location = maildir:/usr/local/vhosts/mail/%d/%n:LAYOUT=fs mail_max_userip_connections = 70 mail_plugins = quota acl notify replication mail_privileged_group = vmail mail_shared_explicit_inbox = yes managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext mbox_write_locks = fcntl namespace { inbox = no list = children location = maildir:/usr/local/vhosts/mail/%%d/%%n:LAYOUT=fs:INDEX=/ usr/local/vhosts/indexes/%d/%n/shared/%%u:INDEXPVT=/usr/ local/vhosts/indexes/%d/%n/shared/%%u prefix = shared/%%d/%%n/ separator = / subscriptions = no type = shared } namespace inbox { inbox = yes list = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk { auto = subscribe special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox Trash { auto = subscribe special_use = \Trash } prefix = separator = / type = private } passdb { args = /usr/local/etc/dovecot/dovecot-sql.conf.ext driver = sql } plugin { acl = vfile acl_shared_dict = proxy::acl mail_replica = tcp:mx1 quota = dict:User quota::proxy::quota quota_rule2 = Trash:storage=+100M sieve = /usr/local/vhosts/mail/%d/%n/.dovecot.sieve sieve_before = /usr/local/vhosts/sieve/before.d/ sieve_dir = /usr/local/vhosts/mail/%d/%n sieve_global_dir = /usr/local/vhosts/sieve/%d sieve_global_path = /usr/local/vhosts/sieve/%d/default.sieve } protocols = imap lmtp sieve sieve service aggregator { fifo_listener replication-notify-fifo { mode = 0666 user = vmail } unix_listener replication-notify { mode = 0666 user = vmail } } service auth-worker { user = vmail } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0666 user = postfix } unix_listener auth-userdb { mode = 0600 user = vmail } user = dovecot } service config { unix_listener config { user = vmail } } service dict { unix_listener dict { mode = 0600 user = vmail } } service doveadm { inet_listener { port = 12345 } user = vmail } service imap-login { inet_listener imap { port = 143 } } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } service managesieve-login { inet_listener sieve { port = 4190 } process_min_avail = 0 service_count = 1 vsz_limit = 64 M } service replicator { unix_listener replicator-doveadm { mode = 0666 } } userdb { args = /usr/local/etc/dovecot/dovecot-sql.conf.ext driver = sql } protocol lmtp { mail_plugins = quota acl notify replication sieve } protocol lda { mail_plugins = quota acl notify replication sieve acl postmaster_address = root } protocol imap { imap_client_workarounds = tb-extra-mailbox-sep mail_plugins = quota acl notify replication imap_quota imap_acl } ssl_cert = ssl_key =

1 0

Compiling Dovecot on Solaris 10
by Mantas Gegužis 06 Feb '17

06 Feb '17

Hello, I am tying to compile Dovecot 2.2.27 on Solaris 10, and I get this error: test-ioloop.c: In function `test_ioloop_pending_io': test-ioloop.c:188: error: size of array `type name' is negative My configuration is like this: Install prefix . : /usr/local File offsets ... : 64bit I/O polling .... : poll I/O notifys .... : none SSL ............ : yes (OpenSSL) GSSAPI ......... : no passdbs ........ : static passwd passwd-file shadow pam checkpassword dcrypt ..........: yes : -bsdauth -sia -ldap -sql -vpopmail userdbs ........ : static prefetch passwd passwd-file checkpassword : -ldap -sql -vpopmail -nss SQL drivers .... : : -pgsql -mysql -sqlite -cassandra Full text search : squat : -lucene -solr Last version that I have compiled was 2.2.24, version 2.2.25 failed with error: In file included from guid.c:6: sha1.h:80: error: static or type qualifiers in abstract declarator Is there anyone who can help me? -- Pagarbiai Mantas Gegužis VU Informacinių technologijų taikymo centras tel. 8 5 236 6208

6 10

Dsync migration with shared folders
by George Dimakopoulos 06 Feb '17

06 Feb '17

Hi everyone, We discovered that the migration path from a VPS to our 2XHP replication server environment with shared folders should be: 1) Rsync all domains from the VPS to serverA. Then rsync all domains from ServerA to ServerB. ServerA & ServerB are in a identical state. 2) Create an empty directory for the shared indexes 3) Start dovecot on both machines. If we did not sync both machines then dsync could not replicate the domains that contained shared folders. What is the right migration process for domains with shared folders ? Regards, George dovecot -n ------------------------- # 2.2.27 (c0f36b0): /usr/local/etc/dovecot/dovecot.conf # Pigeonhole version 0.4.16 (fed8554) # OS: FreeBSD 11.0-RELEASE-p2 amd64 zfs auth_mechanisms = plain login auth_verbose = yes default_client_limit = 2560 default_process_limit = 512 dict { acl = mysql:/usr/local/etc/dovecot/dovecot-shared-sql.conf.ext quota = mysql:/usr/local/etc/dovecot/dovecot-dict-sql.conf.ext } doveadm_password = # hidden, use -P to show it doveadm_port = 12345 log_path = /var/log/dovecot.log mail_debug = yes mail_home = /usr/local/vhosts/mail/%d/%n mail_location = maildir:/usr/local/vhosts/mail/%d/%n:LAYOUT=fs mail_max_userip_connections = 70 mail_plugins = quota acl notify replication mail_privileged_group = vmail mail_shared_explicit_inbox = yes managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext mbox_write_locks = fcntl namespace { inbox = no list = children location = maildir:/usr/local/vhosts/mail/%%d/%%n:LAYOUT=fs:INDEX=/usr/local/vhosts/indexes/%d/%n/shared/%%u:INDEXPVT=/usr/local/vhosts/indexes/%d/%n/shared/%%u prefix = shared/%%d/%%n/ separator = / subscriptions = no type = shared } namespace inbox { inbox = yes list = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk { auto = subscribe special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox Trash { auto = subscribe special_use = \Trash } prefix = separator = / type = private } passdb { args = /usr/local/etc/dovecot/dovecot-sql.conf.ext driver = sql } plugin { acl = vfile acl_shared_dict = proxy::acl mail_replica = tcp:mx1 quota = dict:User quota::proxy::quota quota_rule2 = Trash:storage=+100M sieve = /usr/local/vhosts/mail/%d/%n/.dovecot.sieve sieve_before = /usr/local/vhosts/sieve/before.d/ sieve_dir = /usr/local/vhosts/mail/%d/%n sieve_global_dir = /usr/local/vhosts/sieve/%d sieve_global_path = /usr/local/vhosts/sieve/%d/default.sieve } protocols = imap lmtp sieve sieve service aggregator { fifo_listener replication-notify-fifo { mode = 0666 user = vmail } unix_listener replication-notify { mode = 0666 user = vmail } } service auth-worker { user = vmail } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0666 user = postfix } unix_listener auth-userdb { mode = 0600 user = vmail } user = dovecot } service config { unix_listener config { user = vmail } } service dict { unix_listener dict { mode = 0600 user = vmail } } service doveadm { inet_listener { port = 12345 } user = vmail } service imap-login { inet_listener imap { port = 143 } } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } service managesieve-login { inet_listener sieve { port = 4190 } process_min_avail = 0 service_count = 1 vsz_limit = 64 M } service replicator { unix_listener replicator-doveadm { mode = 0666 } } userdb { args = /usr/local/etc/dovecot/dovecot-sql.conf.ext driver = sql } protocol lmtp { mail_plugins = quota acl notify replication sieve } protocol lda { mail_plugins = quota acl notify replication sieve acl postmaster_address = root } protocol imap { imap_client_workarounds = tb-extra-mailbox-sep mail_plugins = quota acl notify replication imap_quota imap_acl } ssl_cert = ssl_key =

1 0