January 2018 - dovecot

Save login's to a table
by Jorge Bastos 12 Jan '18

12 Jan '18

Hi, I'd like to have the logins that the accounts do, saved in a *sql table, with login name | IP | datetime, for audit porposes. How could I achieve that, if possible? Thanks in advanced,

3 3

Client Identification
by spaceman 12 Jan '18

12 Jan '18

I have two seperate clients (using fetchmail) on two seperate machines that use the same login and the same ip address as each other fetching their mail over IMAP using IMAP idle. Naturally Dovecot assumes that they are the same machine but they are not so messages only get downloaded to one of the machines rather than both which is what I want. How do I get Dovecot to recognize them as two individual clients so that mail downloads to both of them? Regards, spaceman

2 1

login failure "reason" not returned (dovecot-2.2.32)
by Pedro Ribeiro 11 Jan '18

11 Jan '18

Hello, In the past (older dovecot versions) I've tuned the SQL "password_query" of our mail server so that when the user has the account blocked for some reason (expired, need password change, etc.) the query returns nologin=1 and a verbose reason like reason="Your account is expired please change the password" and it worked very well with IMAP clients. I'm now seeing that despite the message returned by the SQL, the IMAP server always returns a generic error "NO [AUTHENTICATIONFAILED] Authentication failed." I've setup an "always fail" query in a test installation (see below) and with that, a simple openssl/telnet login simulation fails without reporting the "ERRORDEBUG" reason. > password_query = SELECT '%n' AS username, '%d' AS domain, 'ERRORDEBUG' > AS reason, '1' AS nologin, CONCAT('{PLAIN}',RAND()) AS password; Tested with: > imapsrv# openssl s_client -connect imap2:993 > --- > * OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE > IDLE AUTH=PLAIN] IPLNet IMAP ready. > a login "someouser@dom" "password" > a NO [AUTHENTICATIONFAILED] Authentication failed. Also using doveadm auth: > imapsrv# doveadm auth test someuser@dom > Password: > passdb: someuser@dom auth failed > extra fields: > user=someuser@dom I've already done some source digging without conclusions, the code to return the reason seem to be in place in the function "imap_client_auth_result" at src/imap-login/client-authenticate.c What am I doing wrong? Should the behaviour now be done in another way? Best regards, keep the good work in this fine software! -- Best regards, =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Pedro Ribeiro Politécnico de Lisboa, Serviços da Presidência Departamento de Sistemas de Informação e Comunicações Phone: +351 210 464 700 (general) / VoIP: 80100 Helpdesk: helpdesk(a)net.ipl.pt / https://www.net.ipl.pt =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

1 0

Dovecot 2.3.0 imap-login using 100% CPU
by Jason Kiniry 11 Jan '18

11 Jan '18

When in the process of testing out the 2.3.0 version of Dovecot, we noticed that on a busy server, imap-login can sometimes take 100% CPU and remain there indefinitely. We grabbed a gdb trace while it was happening: dovenull 36053 31.2 0.0 60460 17316 ? R 04:38 11:55 dovecot/imap-login root@server [~]# strace -p 36053 Process 36053 attached ^CProcess 36053 detached root@server [~]# gdb atGNU gdb (GDB) Red Hat Enterprise Linux (7.2-92.el6) Copyright (C) 2010 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html> This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type "show copying" and "show warranty" for details. This GDB was configured as "x86_64-redhat-linux-gnu". For bug reporting instructions, please see: <http://www.gnu.org/software/gdb/bugs/>. (gdb) attach 36053 Attaching to process 36053 Reading symbols from /usr/libexec/dovecot/imap-login...done. Reading symbols from /usr/lib64/dovecot/libdovecot-login.so.0...done. Loaded symbols for /usr/lib64/dovecot/libdovecot-login.so.0 Reading symbols from /usr/lib64/dovecot/libdovecot.so.0...done. Loaded symbols for /usr/lib64/dovecot/libdovecot.so.0 Reading symbols from /lib64/libc.so.6...(no debugging symbols found)...done. Loaded symbols for /lib64/libc.so.6 Reading symbols from /usr/lib64/libssl.so.10...(no debugging symbols found)...done. Loaded symbols for /usr/lib64/libssl.so.10 Reading symbols from /usr/lib64/libcrypto.so.10...(no debugging symbols found)...done. Loaded symbols for /usr/lib64/libcrypto.so.10 Reading symbols from /lib64/librt.so.1...(no debugging symbols found)...done. Loaded symbols for /lib64/librt.so.1 Reading symbols from /lib64/libdl.so.2...(no debugging symbols found)...done. Loaded symbols for /lib64/libdl.so.2 Reading symbols from /lib64/ld-linux-x86-64.so.2...(no debugging symbols found)...done. Loaded symbols for /lib64/ld-linux-x86-64.so.2 Reading symbols from /lib64/libgssapi_krb5.so.2...(no debugging symbols found)...done. Loaded symbols for /lib64/libgssapi_krb5.so.2 Reading symbols from /lib64/libkrb5.so.3...(no debugging symbols found)...done. Loaded symbols for /lib64/libkrb5.so.3 Reading symbols from /lib64/libcom_err.so.2...(no debugging symbols found)...done. Loaded symbols for /lib64/libcom_err.so.2 Reading symbols from /lib64/libk5crypto.so.3...(no debugging symbols found)...done. Loaded symbols for /lib64/libk5crypto.so.3 Reading symbols from /lib64/libz.so.1...(no debugging symbols found)...done. Loaded symbols for /lib64/libz.so.1 Reading symbols from /lib64/libpthread.so.0...(no debugging symbols found)...done. [Thread debugging using libthread_db enabled] Loaded symbols for /lib64/libpthread.so.0 Reading symbols from /lib64/libkrb5support.so.0...(no debugging symbols found)...done. Loaded symbols for /lib64/libkrb5support.so.0 Reading symbols from /lib64/libkeyutils.so.1...(no debugging symbols found)...done. Loaded symbols for /lib64/libkeyutils.so.1 Reading symbols from /lib64/libresolv.so.2...(no debugging symbols found)...done. Loaded symbols for /lib64/libresolv.so.2 Reading symbols from /lib64/libselinux.so.1...(no debugging symbols found)...done. Loaded symbols for /lib64/libselinux.so.1 Reading symbols from /usr/lib64/dovecot/libssl_iostream_openssl.so...done. Loaded symbols for /usr/lib64/dovecot/libssl_iostream_openssl.so 0x00007f758fb8dd18 in client_notify_auth_ready@plt () from /usr/lib64/dovecot/libdovecot-login.so.0 Missing separate debuginfos, use: debuginfo-install dovecot-2.3.0-4.cp1162.x86_64 (gdb) back #0 0x00007f758fb8dd18 in client_notify_auth_ready@plt () from /usr/lib64/dovecot/libdovecot-login.so.0 #1 0x00007f758fb90af0 in clients_notify_auth_connected () at client-common-auth.c:837 #2 0x00007f758f8cfc04 in auth_server_input_done (conn=0x7f7591911838) at auth-server-connection.c:127 #3 auth_server_connection_input_line (conn=0x7f7591911838) at auth-server-connection.c:229 #4 auth_server_connection_input (conn=0x7f7591911838) at auth-server-connection.c:281 #5 0x00007f758f8f5e35 in io_loop_call_io (io=0x7f759277e2a0) at ioloop.c:614 #6 0x00007f758f8f7d3f in io_loop_handler_run_internal (ioloop=<value optimized out>) at ioloop-epoll.c:222 #7 0x00007f758f8f5f25 in io_loop_handler_run (ioloop=0x7f75918e4d00) at ioloop.c:666 #8 0x00007f758f8f6148 in io_loop_run (ioloop=0x7f75918e4d00) at ioloop.c:639 #9 0x00007f758f875ab3 in master_service_run (service=0x7f75918e4b90, callback=<value optimized out>) at master-service.c:767 #10 0x00007f758fb96156 in login_binary_run (binary=<value optimized out>, argc=1, argv=0x7f75918e4890) at main.c:549 #11 0x00007f758f4a2d1d in __libc_start_main () from /lib64/libc.so.6 #12 0x00007f758ffc4469 in _start () (gdb) run The program being debugged has been started already. Start it from the beginning? (y or n) n Program not restarted. (gdb) continue Continuing. ^C Program received signal SIGINT, Interrupt. client_notify_auth_ready (client=0x7f7592775140) at client-common.c:1031 1031 client-common.c: No such file or directory. in client-common.c (gdb) back #0 client_notify_auth_ready (client=0x7f7592775140) at client-common.c:1031 #1 0x00007f758fb90af0 in clients_notify_auth_connected () at client-common-auth.c:837 #2 0x00007f758f8cfc04 in auth_server_input_done (conn=0x7f7591911838) at auth-server-connection.c:127 #3 auth_server_connection_input_line (conn=0x7f7591911838) at auth-server-connection.c:229 #4 auth_server_connection_input (conn=0x7f7591911838) at auth-server-connection.c:281 #5 0x00007f758f8f5e35 in io_loop_call_io (io=0x7f759277e2a0) at ioloop.c:614 #6 0x00007f758f8f7d3f in io_loop_handler_run_internal (ioloop=<value optimized out>) at ioloop-epoll.c:222 #7 0x00007f758f8f5f25 in io_loop_handler_run (ioloop=0x7f75918e4d00) at ioloop.c:666 #8 0x00007f758f8f6148 in io_loop_run (ioloop=0x7f75918e4d00) at ioloop.c:639 #9 0x00007f758f875ab3 in master_service_run (service=0x7f75918e4b90, callback=<value optimized out>) at master-service.c:767 #10 0x00007f758fb96156 in login_binary_run (binary=<value optimized out>, argc=1, argv=0x7f75918e4890) at main.c:549 #11 0x00007f758f4a2d1d in __libc_start_main () from /lib64/libc.so.6 #12 0x00007f758ffc4469 in _start () (gdb) Anyone have any thoughts? Regards, Jason Kiniry

3 4

Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset): assertion failed: (offset < 0x40000000)
by Stefan Neben 11 Jan '18

11 Jan '18

Hello, i have a problem with a very huge mail account. The INBOX of this account has ~1.1 - ~1.7 million mails inside. And from time to time the index cache make problems and i got the following in the logs: --- Snip --- Jan 10 20:43:04 XXXXX dovecot: imap(XXXXX): Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset): assertion failed: (offset < 0x40000000) --- Snap --- I skip the raw backtrace to keep the post "small", but can hand it in later if needed. Got this for UID FETCH, UID SEARCH, UID SORT, ... The size of the file dovecot.index.cache of INBOX was in the last seen problem situations between 1.1GB to 2.3GB. To solve the problem the last times was to reduce the amount of mails to under 1.7 million (seems to be the limit to trigger the problem), delete the index cache and let him rebuild with a controled request. But this is a odd situation (because it confused 3rd party tooling, which access this mailbox) and i cannot find any helpful informations to solve this problem. Sharding it into several folders to keep the amount of mails in INBOX small is not an option currently. If further informations are needed, just let me know. Thanks for any help! Kind regards Stefan

3 5

Managesieve cannot access script store
by dovelist 11 Jan '18

11 Jan '18

Hi, I am trying to get sieve working on a new OpenSuse leap 42.2 install. On my 'old' OpenSuse 13.2 machine it worked fine. The problem is that Managesieve can't access the script store and won't let me create any script. It says permission denied on ~/sieve directory. See log below. I 've activated debug logging, but that doesn't give any clues to me. Also, I've set the directory accessible to all, but Managesieve still complains. > cd ~ > ls -l drwx------ 1 rogier users 8340 5 feb 16:54 Maildir drwxrwxrwx 1 rogier users 24 5 feb 18:38 sieve To rule out client issues (kmail) I tested also with Manual TLS Login as described in: http://wiki2.dovecot.org/Pigeonhole/ManageSieve/Troubleshooting Same result. I am puzzled. I can't find anything wrong in the dovecot configuration. The output of dovecot -n is shown below. Hope someone has a solution. A lot of mail is waiting to get sorted... Best Regards, Rogier The log: feb 05 20:22:18 p150 dovecot[12120]: managesieve-login: Login: user=<rogier>, method=PLAIN, rip=192.168.0.18, lip=192.168.0.20, mpid=12135, TLS, session=<gmb0bs1H5q/AqAAS> feb 05 20:22:18 p150 dovecot[12120]: managesieve(rogier): Debug: Effective uid=1000, gid=100, home=/home/rogier feb 05 20:22:18 p150 dovecot[12120]: managesieve(rogier): Debug: Namespace inbox: type=private, prefix=, sep=, inbox=yes, hidden=no, list=yes, subscriptions=yes location=maildir:~/Maildir feb 05 20:22:18 p150 dovecot[12120]: managesieve(rogier): Debug: maildir++: root=/home/rogier/Maildir, index=, indexpvt=, control=, inbox=/home/rogier/Maildir, alt= feb 05 20:22:18 p150 dovecot[12120]: managesieve(rogier): Debug: sieve: Pigeonhole version 0.4.15 (97b3da0) initializing feb 05 20:22:18 p150 dovecot[12120]: managesieve(rogier): Debug: sieve: include: sieve_global is not set; it is currently not possible to include `:global' scripts. feb 05 20:22:18 p150 dovecot[12120]: managesieve(rogier): Debug: sieve: file storage: Using active Sieve script path: /home/rogier/.dovecot.sieve feb 05 20:22:18 p150 dovecot[12120]: managesieve(rogier): Debug: sieve: file storage: Using script storage path: /home/rogier/sieve/ feb 05 20:22:18 p150 dovecot[12120]: managesieve(rogier): Debug: sieve: file storage: Using permissions from /home/rogier/sieve/: mode=0777 gid=-1 feb 05 20:22:18 p150 dovecot[12120]: managesieve(rogier): Debug: sieve: file storage: Relative path to sieve storage in active link: sieve/ feb 05 20:22:18 p150 dovecot[12120]: managesieve(rogier): Debug: sieve: file storage: sync: Synchronization active feb 05 20:22:18 p150 dovecot[12120]: managesieve(rogier): Error: sieve: file storage: Failed to list scripts: opendir(/home/rogier/sieve) failed: Permission denied Output of dovecot -n: # 2.2.25 (7be1766): /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.15 (97b3da0) # OS: Linux 4.4.36-8-default x86_64 openSUSE 42.2 (x86_64) auth_username_format = %Ln base_dir = /var/run/dovecot/ mail_debug = yes mail_location = maildir:~/Maildir managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { driver = pam } plugin { sieve = file:~/sieve/;active=~/.dovecot.sieve sieve_trace_debug = yes } protocols = imap lmtp sieve service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } ssl = required ssl_cert = </etc/ssl/private/dovecot.crt ssl_dh_parameters_length = 2048 ssl_key = </etc/ssl/private/dovecot.pem ssl_options = no_compression ssl_prefer_server_ciphers = yes userdb { driver = passwd } verbose_ssl = yes protocol lmtp { mail_plugins = sieve postmaster_address = postmaster@xxxxxxxxxxxxxx }

5 14

Doveadm field for message body without attachments
by Athanasios Viennas 11 Jan '18

11 Jan '18

Happy new year to all, what is the message field in doveadm data model representing the body without attachments? I need to dump the message body without the attachments so as to avoid unnecessary size of the exported files and while I am also not interested in this part of the message. with kind regards Athanasios

2 2

Ignored mount points forgotten on reboot
by Kenneth Porter 11 Jan '18

11 Jan '18

<https://wiki2.dovecot.org/Mountpoints> The list of ignored mount points are stored in a directory (/var/run) that's cleared on reboot. (On CentOS it's a RAM disk.) It seems this should be stored in /etc/dovecot to remain persistent across reboots. <https://en.wikipedia.org/wiki/Filesystem_Hierarchy_Standard> I discovered this when I saw a dovecot error message in /var/log/maillog that some of my automounts (that don't contain mail directories) were missing. Latest dovecot from this distro is dovecot-2.2.10-8.el7.x86_64. Does the new release fix this? (I haven't seen any real problems from it, just log noise.)

1 0

Can Dovecot reject unencrypted mail?
by David Seaward 10 Jan '18

10 Jan '18

Hi, Is it possible to configure Dovecot to reject mail that is not encrypted. In other words: 1. If the user tries to send an unencrypted message from their MUA, the server rejects it. 2. If a third-party tries to send an unencrypted message to the user, the server rejects it. The end result would be that no mail stored on the server can be decrypted by the administrator. I am aware that: * "Encrypted" could mean a lot of things. I'm imagining GPG encryption, but am open to other supported methods. * This configuration would not suit everyone, e.g. someone posting to a public mailing list :) Regards, David

3 2

Re: Can Dovecot reject unencrypted mail?
by Ryan Beethe 10 Jan '18

10 Jan '18

Hi David, I don't know how to do what you want with dovecot, but what you are asking is easy and straightforward with Postfix. Postfix can easily be configured to feed mail through a milter ("mail filter") interface. You would just need to write a milter (there is a nice python library) that checks if the messages is "encrypted" to your specifications and tells Postfix to bounce the message if its not. This would be a nice backscatter-free solution. After you have the milter written, you specify it with the "smtpd_milters" option for Postfix. Ryan On Wed, Jan 10, 2018 at 02:08:38PM +0200, David Seaward wrote: > Hi, > > Is it possible to configure Dovecot to reject mail that is not > encrypted. In other words: > > 1. If the user tries to send an unencrypted message from their MUA, > the server rejects it. > > 2. If a third-party tries to send an unencrypted message to the user, > the server rejects it. > > The end result would be that no mail stored on the server can be > decrypted by the administrator. > > I am aware that: > > * "Encrypted" could mean a lot of things. I'm imagining GPG > encryption, but am open to other supported methods. > > * This configuration would not suit everyone, e.g. someone posting to > a public mailing list :) > > Regards, > David >

1 0