February 2017 - dovecot

sieve file backend: invalid option `active=~/.dovecot.sieve'
by Ben 25 Feb '17

25 Feb '17

Hi, I am seeing the followin error in my logs (doveconf -n at the bottom of this mail): Feb 13 16:59:59 mxf dovecot: lmtp(45560, bp(a)example.com) Error: cs3NOQ7moVj4sQXXXXX: sieve: sieve file backend: invalid option `active=~/.dovecot.sieve' Feb 13 16:59:59 mxf dovecot: lmtp(45560, bp(a)example.com) Error: cs3NOQ7moVj4sQXXXXX: sieve: failed to access user's Sieve script file:~/sieve;active=~/.dovecot.sieve (temporary failure) Looking at http://wiki2.dovecot.org/Pigeonhole/Sieve/Configuration, the syntax "sieve = file:~/sieve;active=~/.dovecot.sieve" in my config is correct ? Is this a false error that is only appearing because this is a newly created user with no sieve file ? If this is the case, how do I tell dovecot not to error out and allow the mail ? Thanks ! # 2.2.10: /etc/dovecot/dovecot.conf # OS: Linux 3.10.0-514.6.1.el7.x86_64 x86_64 CentOS Linux release 7.3.1611 (Core) auth_mechanisms = plain login auth_verbose = yes auth_verbose_passwords = sha1 first_valid_uid = 1000 mail_location = maildir:~/Maildir managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body environment mailbox date ihave enotify mbox_write_locks = fcntl namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { driver = pam } passdb { driver = pam } passdb { args = scheme=CRYPT username_format=%u /etc/dovecot/users driver = passwd-file } plugin { sieve = file:~/sieve;active=~/.dovecot.sieve sieve_dir = ~/sieve } protocols = imap lmtp service auth { unix_listener /var/spool/postfix/private/dovecot-auth { group = postfix mode = 0660 user = postfix } unix_listener auth-userdb { group = its_virtmail mode = 0660 user = its_virtmail } } service imap-login { process_min_avail = 3 } service lmtp { process_min_avail = 5 unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } user = its_virtmail } service managesieve-login { inet_listener sieve { port = 4190 } inet_listener sieves { address = port = 5190 ssl = yes } } ssl = required ssl_cert = <REMOVED ssl_cipher_list = REMOVED ssl_dh_parameters_length = 2048 ssl_key = </REMOVED ssl_prefer_server_ciphers = yes ssl_protocols = !SSlv2 !SSLv3 userdb { driver = passwd } userdb { args = username_format=%u /etc/dovecot/users driver = passwd-file } protocol lmtp { mail_plugins = sieve postmaster_address = me(a)example.com } protocol lda { deliver_log_format = msgid=%m: %$ mail_plugins = sieve postmaster_address = postmaster quota_full_tempfail = yes rejection_reason = Your message to <%t> was automatically rejected:%n%r } protocol imap { imap_client_workarounds = delay-newmail mail_max_userip_connections = 20 }

2 4

Users with multiple password
by Eirik Rye 24 Feb '17

24 Feb '17

Hi! ~ dovecot --version 2.2.22 (fe789d2) I am wondering if there is a way to set up virtual users with multiple valid passwords. We want to be able to provide users with device/app-specific passwords for their email accounts, as well as being able to create temporary "access tokens" for technical support when required. I quickly found out that passdb using passwd-file or an sql-backend does not support returning multiple entries ("Error: passwd-file /etc/dovecot/virtual.passwd: User rye exists more than once"). The documentation mentions that you can pass the plain-text password on to the MySQL-server for verification, and I suppose multiple passwords could could work, given a query like this (pseudo-SQL): `SELECT password FROM account WHERE user = '%u' AND domain = '%d' AND password = TO_BASE64((SHA2('%w', 512));` However, having Dovecot pass the plain-text password and letting the database deal with the hashing and encoding doesn't seem like a very "clean" solution. Preferably, dovecot should be the only piece of software touching the plain-text. Ideally, I would like the following behavior: 1. passdb results multiple possible hashed passwords for the user 2. dovecot attempts the passwords in order 3. login fails normally if none of the passdb results match Does anyone have any experience, or tips for setting up this type of behavior? Other ideas we have touched upon are: 1. Different usernames (eg. 'user_device' or 'user_application') 2. Multiple passdbs(?) Best regards, Eirik Rye

2 2

doveadm "-v" optoin doesn't do anything ?
by Ben 24 Feb '17

24 Feb '17

Hi, On 2.2.10, running the following doveadm -v -o mail_fsync=never backup -R -u my(a)example.com imapc: There is zero output ? Running -D instead of -v it spews out debug messages. Any ideas ? Ben

1 0

Re: Problem with Let's Encrypt Certificate
by Joseph Tam 23 Feb '17

23 Feb '17

yacinechaouche(a)yahoo.com writes: > Interesting. Is there any particular benefit in having only one file > for both certificate and private key ? I find that putting private key > in a separate file feels more secure. It's convenient to have key and cert in one place if you don't need the certificate to be publically readable. Keeping it in separate files would add slightly more security (defense in depth), that would protect from, for example, an admin fumble or bug in the SSL library. "Michael A. Peters" <mpeters(a)domblogger.net> writes: >> I use dehydrated (with Cloudflare DNS challenges) and as far as I know, >> it seems to generate a new private key every time. > > Yeah that would be a problem for me because I implement DANE. It's on my to-do list, but I think you can use dehydrated in signing mode. --signcsr (-s) path/to/csr.pem Sign a given CSR, output CRT on stdout (advanced usage) In this way, you can reuse private key, as well as making it more secure by removing a privileged operations (private key acces) allowing dehydrated to be run as a non-privilged/separate user. Joseph Tam <jtam.home(a)gmail.com>

2 2

Pigeonhole External pipe script going zombie?
by Matt Simpson 23 Feb '17

23 Feb '17

I’m running dovecot 2.2.27 and pigeonhole 0.4.16 on FreeBSD 11. I’m using the pigeonhole/sieve external pipe plugin to run a Perl program to send a Pushover notification when certain messages are received. The Perl script is executed, and the notification is sent. But then the script task seems to go zombie until it is killed after a timeout. In the user’s sieve log, I get a message like error: msgid=<20170112191921.66140.qmail(a)v1.redhorse.me>: pipe action: failed to pipe message to program `sievepush.pl': refer to server log for more information. [2017-01-12 14:19:36]. (even though the message really was piped to the program successfully) In the dovecot server log, I see Jan 12 14:19:21 v1 dovecot: lda(matt): Debug: sieve: Executing script from `/usr/home/matt/maildoms/.dovecot.svbin' Jan 12 14:19:21 v1 dovecot: lda(matt): Debug: sieve: action pipe: running program: sievepush.pl Jan 12 14:19:21 v1 dovecot: lda(matt): Debug: Mailbox stdin: Opened mail UID=1 because: mail stream Jan 12 14:19:21 v1 dovecot: lda(matt): Debug: waiting for program `/usr/local/lib/dovecot/sieve-pipe/sievepush.pl' to finish after 0 msecs Jan 12 14:19:31 v1 dovecot: lda(matt): Debug: program `/usr/local/lib/dovecot/sieve-pipe/sievepush.pl'(66145) execution timed out after 10000 milliseconds: sending TERM signal Jan 12 14:19:36 v1 dovecot: lda(matt): Debug: program `/usr/local/lib/dovecot/sieve-pipe/sievepush.pl' (66145) did not die after 5000 milliseconds: sending KILL signal In the process list during that 10 second interval, I see matt 66142 29972 801 801 0 S - 0:00.00 bin/qmail-local -- matt /home/matt/maildoms jmn-matt - jmn-m matt 66143 66142 801 801 0 S - 0:00.00 /var/qmail/bin/preline -f /usr/local/libexec/dovecot/dovecot matt 66144 66143 801 801 0 S - 0:00.01 /usr/local/libexec/dovecot/dovecot-lda matt 66145 66144 801 801 0 Z - 0:00.65 <defunct> I’m not a Unix programming ace, but from what I’ve been able to find out, this seems to mean that the lda process is forking another process to run the pipe script, and not getting the proper notification when it finishes (not issuing a wait?). So after 10 seconds, it sends a TERM to the task which is no longer running, and when that doesn’t work, it sends a KILL. Anybody know what’s happening here? doveconf -n # 2.2.27 (c0f36b0): /usr/local/etc/dovecot/dovecot.conf # Pigeonhole version 0.4.16 (fed8554) # OS: FreeBSD 11.0-RELEASE-p2 amd64 auth_verbose = yes default_vsz_limit = 128 M lock_method = flock mail_debug = yes mail_location = maildir:~/Maildir mail_privileged_group = mail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext vnd.dovecot.pipe vnd.dovecot.execute namespace inbox { inbox = yes location = prefix = } passdb { args = imap driver = pam } plugin { recipient_delimiter = - sieve = file:~/sieve;active=~/.dovecot.sieve sieve_execute_bin_dir = /usr/local/lib/dovecot/sieve-pipe sieve_extensions = +vnd.dovecot.pipe +vnd.dovecot.execute sieve_pipe_bin_dir = /usr/local/lib/dovecot/sieve-pipe sieve_pipe_exec_timeout = 10s sieve_plugins = sieve_extprograms } protocols = imap service auth { unix_listener auth-master { group = qnofiles mode = 0660 user = alias } user = root } service imap-login { process_min_avail = 3 vsz_limit = 94 M } ssl_cert = </usr/local/etc/letsencrypt/live/dummy.redhorse.me/cert.pem ssl_key = # hidden, use -P to show it syslog_facility = local0 userdb { driver = passwd } verbose_proctitle = yes protocol lda { mail_plugins = " sieve" }

2 3

How to add Ubuntu 16.04.2 server to join and authenticate with domain controller windows2012r2
by Basdove 23 Feb '17

23 Feb '17

Hi, 1. I have Ubuntu 16.0.4.2 server edition 2. I have windows server 2012R2 domain controller (Active directory installed) 3. I want to join and Authenticate Ubuntu with windows server 2012 domain controller 4. Please provide the clean document Thank you, Baskaranand

3 2

imap/pop3-login assertion failed in dovecot 2.2.27 (c0f36b0)
by Edgaras Lukoševičius 23 Feb '17

23 Feb '17

Hello, I have noticed few errors like this. I don't recall seeing that with version 2.2.10 Feb 23 05:20:03 mail21 dovecot[6569]: imap-login: Panic: file login-proxy-state.c: line 77 (login_proxy_state_deinit): assertion failed: (rec->num_waiting_connections == 0) Feb 23 05:50:03 mail21 dovecot[15044]: pop3-login: Panic: file login-proxy-state.c: line 77 (login_proxy_state_deinit): assertion failed: (rec->num_waiting_connections == 0) Feb 23 05:50:03 mail21 dovecot[15044]: imap-login: Panic: file login-proxy-state.c: line 77 (login_proxy_state_deinit): assertion failed: (rec->num_waiting_connections == 0) Feb 23 06:30:04 mail21 dovecot[13266]: imap-login: Panic: file login-proxy-state.c: line 77 (login_proxy_state_deinit): assertion failed: (rec->num_waiting_connections == 0) Feb 23 06:30:04 mail21 dovecot[13266]: pop3-login: Panic: file login-proxy-state.c: line 77 (login_proxy_state_deinit): assertion failed: (rec->num_waiting_connections == 0) Feb 23 07:10:04 mail21 dovecot[14298]: pop3-login: Panic: file login-proxy-state.c: line 77 (login_proxy_state_deinit): assertion failed: (rec->num_waiting_connections == 0) Feb 23 07:10:04 mail21 dovecot[14298]: pop3-login: Panic: file login-proxy-state.c: line 77 (login_proxy_state_deinit): assertion failed: (rec->num_waiting_connections == 0) Feb 23 07:10:04 mail21 dovecot[14298]: pop3-login: Panic: file login-proxy-state.c: line 77 (login_proxy_state_deinit): assertion failed: (rec->num_waiting_connections == 0) Feb 23 08:00:04 mail21 dovecot[13138]: pop3-login: Panic: file login-proxy-state.c: line 77 (login_proxy_state_deinit): assertion failed: (rec->num_waiting_connections == 0) Feb 23 08:00:04 mail21 dovecot[13138]: pop3-login: Panic: file login-proxy-state.c: line 77 (login_proxy_state_deinit): assertion failed: (rec->num_waiting_connections == 0) Feb 23 08:00:04 mail21 dovecot[13138]: pop3-login: Panic: file login-proxy-state.c: line 77 (login_proxy_state_deinit): assertion failed: (rec->num_waiting_connections == 0) Feb 23 08:00:04 mail21 dovecot[13138]: pop3-login: Panic: file login-proxy-state.c: line 77 (login_proxy_state_deinit): assertion failed: (rec->num_waiting_connections == 0) Feb 23 08:00:04 mail21 dovecot[13138]: pop3-login: Panic: file login-proxy-state.c: line 77 (login_proxy_state_deinit): assertion failed: (rec->num_waiting_connections == 0)

1 0

Problem with Let's Encrypt Certificate
by Bastian Sebode 23 Feb '17

23 Feb '17

Hello Folks, my StartCom SSL-Certificate expires soon and so I wanted to switch to Let's Encrypt Certificates instead. Unfortunatelly Thunderbird seems not to like it, although all -tested- other Clients work without any problems. When I connect with Thunderbird it sends an "Encrypted Alert" directly after the TLS handshake although Dovecot wants to continue the session. In the Dovecot Log it says: Feb 17 17:27:17 imap-login: Debug: SSL: where=0x20, ret=1: SSL negotiation finished successfully [82.100.242.26] Feb 17 17:27:17 imap-login: Debug: SSL: where=0x2002, ret=1: SSL negotiation finished successfully [82.100.242.26] Feb 17 17:27:17 imap-login: Warning: SSL alert: where=0x4004, ret=554: fatal bad certificate [82.100.242.26] But the certificate is okay, cause it works with other Mailclients and openssl also says so. What certificate is Thunderbird complaining about? Thunderbird says something like "There's no supported authentication method". I don't use any Certificates for Client Authentication, neither in Dovecot nor in Thunderbird. When I do, it fails the same way. Weirdly my friend uses the same Dovecot Version with Let's Encrypt on his Server and it works with Thunderbird without any flaws. Mine fails the same way in his Thunderbird and also in a fresh installation. After two weeks of investigating I still have no clue why it behaves like this. I uploaded two Wireshark tracefiles, further logs and dovecot -n, may be someone sees any possible reasons for this weird behavior or has any further tips on solving this issue. https://sebode-online.de/dovecot-letsencrypt/ Every hint is highly appreciated! Best Regards Bastian -- Bastian Sebode Fachinformatiker Systemintegration LINET Services GmbH | Cyriaksring 10a | 38118 Braunschweig Tel. 0531-180508-0 | Fax 0531-180508-29 | http://www.linet-services.de LINET in den sozialen Netzwerken: www.twitter.com/linetservices | www.facebook.com/linetservices Wissenswertes aus der IT-Welt: www.linet-services.de/blog/ Geschäftsführung: Timo Springmann, Mirko Savic und Moritz Bunkus HR B 9170 Amtsgericht Braunschweig USt-IdNr. DE 259 526 516

15 27

Scaling to 10 Million IMAP sessions on a single server
by KT Walrus 22 Feb '17

22 Feb '17

I just read this blog: https://mrotaru.wordpress.com/2013/10/10/scaling-to-12-million-concurrent-c… <https://mrotaru.wordpress.com/2013/10/10/scaling-to-12-million-concurrent-c…> about scaling to 12 Million Concurrent Connections on a single server and it got me thinking. Would it be possible to scale Dovecot IMAP server to 10 Million IMAP sessions on a single server? I think the current implementation of having a separate process manage each active IMAP session (w/ the possibility of moving idling sessions to a single hibernate process) will never be able to deploy a single server managing 10 Million IMAP sessions. But, would it be possible to implement a new IMAP server plugin that uses a fixed configurable pool of “worker” processes, much like NGINX or PHP-FPM does. These servers can probably scale to 10 Million TCP connections, if the server is carefully tuned and has enough cores/memory to support that many active sessions. I’m thinking that the new IMAP server could use some external database (e.g., Redis or Memcached) to save all the sessions state and have the “worker” processes poll the TCP sockets for new IMAP commands to process (fetching the session state from the external database when it has a command that is waiting on a response). The Dovecot IMAP proxies could even queue incoming commands to proxy many incoming requests to a smaller number of backend connections (like ProxySQL does for MySQL requests). That might allow each Dovecot proxy to support 10 Million IMAP sessions and a single backend could support multiple front end Dovecot proxies (to scale to 100 Million concurrent IMAP connections using 10 proxies for 100 Million connections and 1 backend server for 10 Million connections). Of course, the backend server may need to be beefy and have very fast NVMe SSDs for local storage, but changing the IMAP server to manage a pool of workers instead of requiring a process per active session, would allow bigger scale up and could save large sites a lot of money. Is this a good idea? Or, am I missing something? Kevin

8 15

v2.2.28 release candidate 2 released
by Timo Sirainen 22 Feb '17

22 Feb '17

http://dovecot.org/releases/2.2/rc/dovecot-2.2.28.rc2.tar.gz http://dovecot.org/releases/2.2/rc/dovecot-2.2.28.rc2.tar.gz.sig I'm assuming that most of the bugs are now found and fixed, so the final 2.2.28 should be out in a day or two. Changes since rc1: * Reverted [UNKNOWN-CTE] -> [PARSE] change + pop3c: Added pop3c_features=no-pipelining setting to prevent using PIPELINING extension even though it's advertised. - lmtp_user_concurrency_limit didn't work if userdb changed username - Fixed various bugs that were introduced in rc1 Here's the full list of changes again: * director: "doveadm director move" to same host now refreshes user's timeout. This allows keeping user constantly in the same backend by just periodically moving the user there. * When new mailbox is created, use initially INBOX's dovecot.index.cache caching decisions. * Expunging mails writes GUID to dovecot.index.log now only if the GUID is quickly available from index/cache. * pop3c: Increase timeout for PASS command to 5 minutes. * Mail access errors are no longer ignored when searching or sorting. With IMAP the untagged SEARCH/SORT reply is still sent the same as before, but NO reply is returned instead of OK. + Make dovecot.list.index's filename configurable. This is needed when there are multiple namespaces pointing to the same mail root (e.g. lazy_expunge namespace for mdbox). + Add size.virtual to dovecot.index when folder vsizes are accessed (e.g. quota=count). This is mainly a workaround to avoid slow quota recalculation performance when message sizes get lost from dovecot.index.cache due to corruption or some other reason. + auth: Support OAUTHBEARER and XOAUTH2 mechanisms. Also support them in lib-dsasl for client side. + auth: Support filtering by SASL mechanism: passdb { mechanisms } + Shrink the mail processes' memory usage by not storing settings duplicated unnecessarily many times. + imap: Add imap_fetch_failure setting to control what happens when FETCH fails for some mails (see example-config). + imap: Include info about last command in disconnection log line. + imap: Created new SEARCH=X-MIMEPART extension. It's currently not advertised by default, since it's not fully implemented. + fts-solr: Add support for basic authentication. + Cassandra: Support automatically retrying failed queries if execution_retry_interval and execution_retry_times are set. + doveadm: Added "mailbox path" command. + mail_log plugin: If plugin { mail_log_cached_only=yes }, log the wanted fields only if it doesn't require opening the email. + mail_vsize_bg_after_count setting added (see example-config). + mail_sort_max_read_count setting added (see example-config). + pop3c: Added pop3c_features=no-pipelining setting to prevent using PIPELINING extension even though it's advertised. - Index files: day_first_uid wasn't updated correctly since v2.2.26. This caused dovecot.index.cache to be non-optimal. - imap: SEARCH/SORT may have assert-crashed in client_check_command_hangs - imap: FETCH X-MAILBOX may have assert-crashed in virtual mailboxes. - imap: Running time in tagged command reply was often wrongly 0. - search: Using NOT n:* or NOT UID n:* wasn't handled correctly - director: doveadm director kick was broken - director: Fix crash when using director_flush_socket - director: Fix some bugs when moving users between backends - imapc: Various error handling fixes and improvements - master: doveadm process status output had a lot of duplicates. - autoexpunge: If mailbox's rename timestamp is newer than mail's save-timestamp, use it instead. This is useful when autoexpunging e.g. Trash/* and an entire mailbox is deleted by renaming it under Trash to prevent it from being autoexpunged too early. - autoexpunge: Multiple processes may have been trying to expunge the same mails simultaneously. This was problematic especially with lazy_expunge plugin. - auth: %{passdb:*} was empty in auth-worker processes - auth-policy: hashed_password was always sent empty. - dict-sql: Merge multiple UPDATEs to a single statement if possible. - fts-solr: Escape {} chars when sending queries - fts: fts_autoindex_exclude = \Special-use caused crashes - doveadm-server: Fix leaks and other problems when process is reused for multiple requests (service_count != 1) - sdbox: Fix assert-crash on mailbox create race - lda/lmtp: deliver_log_format values weren't entirely correct if Sieve was used. especially %{storage_id} was broken. - lmtp_user_concurrency_limit didn't work if userdb changed username

1 0