October 2018 - dovecot

[sieve] Restrict redirects to only own domain
by Yassine Chaouche 26 Oct '18

26 Oct '18

Hello list, I'd like to let my colleagues redirect mail automatically (via a sieve filter) to other mailboxes within the same domain, but deny redirects to outside mailboxes (gmail, yahoo etc.) since this is considered bad practice and could lead to blacklisting (forwarding spam for example). If I set sieve_max_redirect to 0 then no redirect is allowed, at all. I wish to let redirects to internal mailboxes still possible. Ideas ? Yassine.

3 5

SIGABRT when fetching encrypted mail with getmail
by Peter Nabbefeld 26 Oct '18

26 Oct '18

Hello, I'm stuck with receiving an encrypted email from IMAP server. My getmail configuration is (getmail --dump): getmail configuration: getmail version 5.6 Python version 2.7.15 (default, Jun 27 2018, 13:05:28) [GCC 8.1.1 20180531] retriever: SimpleIMAPSSLRetriever(ca_certs="None", certfile="None", getmaildir="/home/peter/.getmail/", keyfile="None", mailboxes="('ALL',)", move_on_delete="None", password="*", password_command="()", port="993", record_mailbox="True", server="imap.gmx.net", ssl_cert_hostname="None", ssl_ciphers="None", ssl_fingerprints="()", ssl_version="None", timeout="180", use_cram_md5="False", use_kerberos="False", use_peek="True", use_xoauth2="False", username="peter.nabbefeld(a)gmx.de") destination: MDA_external(allow_root_commands="False", arguments="('-e', '-d', 'peter.nabbefeld(a)gmx.de')", command="deliver", group="vmail", ignore_stderr="False", path="/usr/lib/dovecot/deliver", unixfrom="False", user="vmail") options: delete : True delete_after : 0 delete_bigger_than : 0 delivered_to : False fingerprint : False logfile : logfile(filename="~/.getmail/log") max_bytes_per_session : 0 max_message_size : 0 max_messages_per_session : 0 message_log : ~/.getmail/log message_log_syslog : False message_log_verbose : False read_all : True received : False verbose : 1 dovecot.log: Oct 26 07:41:20 lda(peter.nabbefeld(a)gmx.de)<24607><UvPzGACp0lsfYAAA7IIYzw>: Panic: file istream-crlf.c: line 24 (i_stream_crlf_read_common): assertion failed: (ret != -2) Oct 26 07:41:20 lda(peter.nabbefeld(a)gmx.de)<24607><UvPzGACp0lsfYAAA7IIYzw>: Error: Raw backtrace: /usr/lib/dovecot/libdovecot.so.0(+0xe8374) [0x7f9ae5706374] -> /usr/lib/dovecot/libdovecot.so.0(+0xe83b1) [0x7f9ae57063b1] -> /usr/lib/dovecot/libdovecot.so.0(+0x44312) [0x7f9ae5662312] -> /usr/lib/dovecot/libdovecot.so.0(+0x4693f) [0x7f9ae566493f] -> /usr/lib/dovecot/libdovecot.so.0(+0xf98b6) [0x7f9ae57178b6] -> /usr/lib/dovecot/libdovecot.so.0(i_stream_read_memarea+0x81) [0x7f9ae5713a31] -> /usr/lib/dovecot/libdovecot.so.0(i_stream_read+0x36) [0x7f9ae5713c56] -> /usr/lib/dovecot/libdovecot.so.0(+0xfebf8) [0x7f9ae571cbf8] -> /usr/lib/dovecot/libdovecot.so.0(i_stream_read_memarea+0x81) [0x7f9ae5713a31] -> /usr/lib/dovecot/libdovecot.so.0(i_stream_read+0x36) [0x7f9ae5713c56] -> /usr/lib/dovecot/libdovecot.so.0(i_stream_read_data+0x4c) [0x7f9ae57146ec] -> /usr/lib/dovecot/libdovecot.so.0(io_stream_copy+0x8a) [0x7f9ae572ec2a] -> /usr/lib/dovecot/libdovecot.so.0(+0x112c12) [0x7f9ae5730c12] -> /usr/lib/dovecot/libdovecot.so.0(o_stream_send_istream+0x4f) [0x7f9ae572e8bf] -> /usr/lib/dovecot/libdovecot-storage.so.0(index_storage_save_continue+0x2e) [0x7f9ae58a965e] -> /usr/lib/dovecot/libdovecot-storage.so.0(maildir_save_continue+0x27) [0x7f9ae58480f7] -> /usr/lib/dovecot/libdovecot-storage.so.0(mailbox_save_continue+0x44) [0x7f9ae5819fb4] -> /usr/lib/dovecot/libdovecot-storage.so.0(mail_storage_copy+0xf8) [0x7f9ae580b488] -> /usr/lib/dovecot/libdovecot-storage.so.0(maildir_copy+0x59) [0x7f9ae5843ea9] -> /usr/lib/dovecot/libdovecot-lda.so.0(+0x3dfc) [0x7f9ae593bdfc] -> /usr/lib/dovecot/modules/lib20_fts_plugin.so(+0x10d7c) [0x7f9ae53b0d7c] -> /usr/lib/dovecot/libdovecot-storage.so.0(+0x58541) [0x7f9ae581a541] -> /usr/lib/dovecot/libdovecot-sieve.so.0(+0x4e745) [0x7f9ae3136745] -> /usr/lib/dovecot/libdovecot-sieve.so.0(sieve_result_execute+0x50d) [0x7f9ae312c0ad] -> /usr/lib/dovecot/libdovecot-sieve.so.0(+0x57139) [0x7f9ae313f139] -> /usr/lib/dovecot/libdovecot-sieve.so.0(sieve_multiscript_run+0xa2) [0x7f9ae3140302] -> /usr/lib/dovecot/modules/lib90_sieve_plugin.so(+0x3d49) [0x7f9ae5609d49] -> /usr/lib/dovecot/libdovecot-lda.so.0(mail_deliver+0xf9) [0x7f9ae593d219] dovecot --version 2.3.3 (dcead646b) For me, it semms like there's a CRLF expected, but probably it cannot be detected correctly, since the mail is encrypted - but that's only my guess ... Any idea how to fix that? Kind regards Peter

1 0

Shared mailboxes - Can't open mailbox shared-boxes/user/name.lastname: Character not allowed in mailbox name: '.'
by Marcio Vogel Merlone dos Santos 25 Oct '18

25 Oct '18

Hi, I am trying to make shared folders work on my server (Ubuntu 18.04, Dovecot 1:2.2.33.2-1ubuntu4.1). Mails are on Maildir++ local filesystem with '.' as layout separator and ALL 100+ users logins fits a template name.lastname, with a dot in the middle. I set up listescape but no luck. When I test with doveadm: root@mail:/etc/dovecot/conf.d# doveadm acl debug -u marcio.merlone(a)a1.ind.br shared-boxes/user/name.lastname doveadm(marcio.merlone(a)a1.ind.br): Error: Can't open mailbox shared-boxes/user/name.lastname: Character not allowed in mailbox name: '.' root@mail:/etc/dovecot/conf.d# Is there something I can do besides changing layout separator? Full dovecot -n output: # 2.2.33.2 (d6601f4ec): /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.21 (92477967) # OS: Linux 4.15.0-36-generic x86_64 Ubuntu 18.04.1 LTS ext4 auth_gssapi_hostname = $ALL auth_krb5_keytab = /etc/dovecot/dovecot.keytab auth_master_user_separator = * auth_mechanisms = plain ntlm login gssapi auth_username_chars = abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ01234567890.@ auth_username_format = %Ln dict { acl = mysql:/etc/dovecot/acl-dict-sql.conf } disable_plaintext_auth = no dotlock_use_excl = no first_valid_uid = 3000 hostname = smtp.a1.ind.br imap_client_workarounds = tb-extra-mailbox-sep delay-newmail last_valid_uid = 3000 lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes lda_original_recipient_header = X-Original-To mail_access_groups = vmail dovecot mail_fsync = always mail_gid = 3000 mail_location = maildir:/mnt/maildirs/%u/Maildir:INDEX=/mnt/maildirs/%u/index mail_plugins = acl mail_privileged_group = vmail mail_server_admin = mailto:postmaster@a1.ind.br mail_uid = 3000 mailbox_list_index = yes mailbox_list_index_very_dirty_syncs = yes managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext mmap_disable = yes namespace { list = yes location = maildir:%%h/Maildir:INDEX=~/Maildir/shared/%%u:INDEXPVT=~/Maildir/shared/%%u prefix = shared/%%u/ separator = / subscriptions = no type = shared } namespace inbox { hidden = no inbox = yes list = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk { auto = subscribe special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox Trash { auto = subscribe special_use = \Trash } prefix = separator = / subscriptions = yes type = private } passdb { args = /etc/dovecot/master-users driver = passwd-file master = yes pass = yes } passdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } plugin { acl = vfile:/etc/dovecot/global-acls:cache_secs=300 acl_shared_dict = proxy::acl listescape_char = \ mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename mail_log_fields = uid box msgid size sieve = file:~/Maildir/sieve/;active=~/.dovecot.sieve sieve_before = /etc/dovecot/global.sieve sieve_max_actions = 32 sieve_max_redirects = 4 } postmaster_address = postmaster(a)a1.ind.br protocols = " imap lmtp sieve sieve" quota_full_tempfail = yes service auth-worker { user = $default_internal_user } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0666 user = postfix } unix_listener auth-userdb { mode = 0666 } } service dict { unix_listener dict { group = vmail mode = 0660 user = vmail } } service imap-login { inet_listener imap { port = 143 } inet_listener imaps { port = 993 ssl = yes } process_min_avail = 1 service_count = 0 } service imap { process_limit = 1024 } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } unix_listener lmtp { mode = 0666 } } service managesieve-login { inet_listener sieve { port = 4190 } process_min_avail = 1 service_count = 0 } service managesieve { process_limit = 1024 } ssl_cert = </etc/letsencrypt/live/imap.a1.ind.br/fullchain.pem ssl_cipher_list = ALL:!LOW:!SSLv2:!EXP:!aNULL:!RC4::!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS ssl_client_ca_dir = /etc/ssl/certs ssl_key = # hidden, use -P to show it submission_host = localhost syslog_facility = local1 userdb { args = uid=3000 gid=3000 home=/mnt/maildirs/%Ln mail=maildir:/mnt/maildirs/%Ln/Maildir:INBOX=/mnt/maildirs/%Ln/Maildir allow_all_users=yes driver = static } protocol lmtp { info_log_path = /var/log/dovecot-lmtp.log mail_plugins = acl } protocol lda { mail_plugins = acl quota sieve acl listescape } protocol imap { mail_max_userip_connections = 300 mail_plugins = acl quota imap_quota acl imap_acl listescape } Thanks, best regards. -- *Marcio Merlone*

1 0

Exclude userdb from iterate users
by Ángel L. Mateo 25 Oct '18

25 Oct '18

Hi, I have a system with various userdbs defined, mostly all of them based on ldap (and a few passwd-files). I want one of my ldap userdbs not to be used in "doveadm user -A" commands, that is to be excluded in iterate searchs. I have no iterate_filter neither iterate_attrs configured in that userdb, but it is still used. Is it possible? How? -- Angel L. Mateo Martínez Sección de Telemática Área de Tecnologías de la Información y las Comunicaciones Aplicadas (ATICA) http://www.um.es/atica Tfo: 868889150 Fax: 868888337

1 1

Disable logging for localhost
by André Rodier 24 Oct '18

24 Oct '18

Hello Everyone, I am using Zabbix to monitor my Dovecot server, and my logs are filled with lines like this: > Oct 21 15:04:46 osaka dovecot[1256]: pop3-login: Aborted login (no auth > attempts in 0 secs): user=<>, rip=127.0.0.1, lip=127.0.0.1, secured, > session=<bWd0nr14SuF/AAAB> > Oct 21 15:05:29 osaka dovecot[1256]: imap-login: Aborted login (no auth > attempts in 0 secs): user=<>, rip=127.0.0.1, lip=127.0.0.1, secured, > session=<MlAGob147Jd/AAAB> How can I disable logging these actions from 127.0.0.1? Thanks, André -- https://github.com/progmaticltd/homebox

4 5

doveadm backup: Error: Both source and destination mail_location points to same directory
by Martin Johannes Dauser 24 Oct '18

24 Oct '18

Hello! I'm using 2 namespaces, "inbox" for INBOX and it's subfolders and "special" containing folders like Sent, Junk or Drafts. Though both use mdbox I decided to represent those namespaces in different locations "mdbox:~/mail" and "mdbox:~/mail_special_folders". The main reason to use 2 namespaces was to keep special_use folders out of INBOX by using the prefix attribute -- it's rather cosmetic. ├── INBOX │ ├── SubFolder1 │ ├── SubFolder2 │ └── SubFolder3 ├── Sent ├── Trash ├── Drafts ├── Junk ├── Templates ├── This is Ham └── Report Spam Now I want to export the emails of some former users to common known maildir or mbox format to be able to hand them over on CD. The problem is that a conversion with doveadm backup fails. I guess this is due to namespace special which is configured with a manual location attribute instead of utilising mail_location. But even telling doveadm to backup only one namespace leads to the identical error (extract of debug message at bottom). As this is a RHEL7 server, the dovecot version is an old 2.2.10 and I don't expect software debugging -- I just ask if I did some misconfiguration or a failure in the command. I already thought of merging the locations of both namespaces. Yet, I'm not sure how to achieve this. >From /etc/dovecot/conf.d/10-mail.conf mail_location = mdbox:~/mail namespace inbox { type = private hidden = no ignore_on_failure = no inbox = yes list = yes location = prefix = INBOX/ separator = / subscriptions = yes } namespace special { type = private hidden = no ignore_on_failure = no inbox = no list = yes location = mdbox:~/mail_special_folders prefix = separator = / subscriptions = yes } HOME is set by LDAP user_attrs = =home=/srv/mail/%Ld/%Ln,=uid=20000,=gid=20000,imapQuota=quota_rule=*:st orage=%$G Identical debug messages of following commands: # dsync -Dv backup -u bob(a)cs.sbg.ac.at maildir:/home/Mailexport/bob or # doveadm -Dv backup -u bob(a)cs.sbg.ac.at maildir:/home/Mailexport/bob or # doveadm -Dv backup -u bob(a)cs.sbg.ac.at -n inbox maildir:/home/Mailexport/bob or # doveadm -Dv backup -u bob(a)cs.sbg.ac.at -n special maildir:/home/Mailexport/bob ... doveadm(bob(a)cs.sbg.ac.at): Debug: Namespace inbox: type=private, prefix=INBOX/, sep=/, inbox=yes, hidden=no, list=yes, subscriptions=yes location=mdbox:~/mail doveadm(bob(a)cs.sbg.ac.at): Debug: fs: root=/srv/mail/cs.sbg.ac.at/bob/mail, index=, indexpvt=, control=, inbox=, alt= doveadm(bob(a)cs.sbg.ac.at): Debug: Namespace special: type=private, prefix=, sep=/, inbox=no, hidden=no, list=yes, subscriptions=yes location=mdbox:~/mail_special_folders doveadm(bob(a)cs.sbg.ac.at): Debug: fs: root=/srv/mail/cs.sbg.ac.at/bob/mail_special_folders, index=, indexpvt=, control=, inbox=, alt= doveadm(bob(a)cs.sbg.ac.at): Debug: Namespace INBOX/: Using permissions from /srv/mail/cs.sbg.ac.at/bob/mail: mode=0774 gid=default dsync(bob(a)cs.sbg.ac.at): Debug: Effective uid=20000, gid=20000, home=/srv/mail/cs.sbg.ac.at/bob dsync(bob(a)cs.sbg.ac.at): Debug: Quota root: name=User quota backend=dict args=:file:/srv/mail/cs.sbg.ac.at/bob/dovecot-quota ... dsync(bob(a)cs.sbg.ac.at): Debug: Namespace inbox: type=private, prefix=INBOX/, sep=/, inbox=yes, hidden=no, list=yes, subscriptions=yes location=maildir:/home/Mailexport/bob dsync(bob(a)cs.sbg.ac.at): Debug: maildir++: root=/home/Mailexport/bob, index=, indexpvt=, control=, inbox=/home/Mailexport/bob, alt= dsync(bob(a)cs.sbg.ac.at): Debug: Namespace special: type=private, prefix=, sep=/, inbox=no, hidden=no, list=yes, subscriptions=yes location=mdbox:~/mail_special_folders dsync(bob(a)cs.sbg.ac.at): Debug: fs: root=/srv/mail/cs.sbg.ac.at/bob/mail_special_folders, index=, indexpvt=, control=, inbox=, alt= dsync(bob(a)cs.sbg.ac.at): Error: Both source and destination mail_location points to same directory: /srv/mail/cs.sbg.ac.at/bob/mail_special_folders/mailboxes Many thanks for any hint Martin

1 0

Bug: 'noreplicate' database extra field ingnored
by Phil 22 Oct '18

22 Oct '18

The 'noreplicate' user database field described in the wiki appears to make no difference as to whether an account gets replicated or not. My sql user query returns a 'noreplicate' field and I can confirm that this is getting set using 'doveadm user', however when I add a new account with noreplicate=true it gets replicated regardless. User query: user_query = SELECT home, uid, gid, noreplicate FROM mail_accounts WHERE address = '%u' # doveadm user user1(a)mydomain.com field value uid 1000 gid 1000 home /mail/domains/mydomain.com/user1/Maildir mail maildir:/mail/domains/mydomain.com/user1/Maildir noreplicate t # 2.3.3 (dcead646b): /usr/local/etc/dovecot/dovecot.conf # Pigeonhole version 0.5.3 (f018bbab) # OS: FreeBSD 11.2-RELEASE-p4 amd64 # Hostname: mx doveadm_password = # hidden, use -P to show it doveadm_port = 2727 imap_client_workarounds = delay-newmail tb-extra-mailbox-sep listen = * mail_location = maildir:%h managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = /usr/local/etc/dovecot/dovecot-sql.conf.ext driver = sql } plugin { mail_replica = tcps:mail2.<mydomain>.com } protocols = imap lmtp submission replication_full_sync_interval = 6 hours service aggregator { fifo_listener replication-notify-fifo { user = vmail } unix_listener replication-notify { user = vmail } } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } unix_listener auth-userdb { user = vmail } user = root } service doveadm { inet_listener { port = 2727 ssl = yes } } service imap-login { inet_listener imaps { address = xxx.xxx.xxx.xxx port = 993 } process_limit = 256 process_min_avail = 6 service_count = 1 vsz_limit = 64 M } service replicator { process_min_avail = 1 unix_listener replicator-doveadm { mode = 0600 user = vmail } } ssl = required ssl_cert = </etc/ssl/certs/mail.<mydomain>.com.pem ssl_client_ca_dir = /etc/ssl/ ssl_client_ca_file = /etc/ssl/cert.pem ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { args = /usr/local/etc/dovecot/dovecot-sql.conf.ext driver = sql } verbose_proctitle = yes protocol imap { mail_max_userip_connections = 100 } protocol lda { postmaster_address = postmaster@<mydomain>.com sendmail_path = /usr/sbin/sendmail }

2 2

Calendar function ?
by mca＠caloro.ch 22 Oct '18

22 Oct '18

Hello I running no long time with me Email System Postfix/Dovecot/mysql and i'am whery happy the feature to synchroize Calendar, or view the calender entry from me workpartner i will miss this feature, how do you handle this ? isn't possible to insert this to Dovecot or Postfix? Are this question out of topic ? or how do you implement this in our envirement ? Regards Mauri

15 19

Dovecot 2.2.13 error message
by Albert Whale 19 Oct '18

19 Oct '18

In attempting to reactivate my IMAP communications with my Email Spool (NFS Mounted), I have gotten the following while attempting to download the Emails via POP3. Oct 18 08:00:45 ns4 dovecot: pop3-login: Login: user=<aewhale>, method=PLAIN, rip=74.109.213.194, lip=66.207.133.232 Oct 18 08:02:40 ns4 dovecot: pop3(aewhale): Error: Timeout (180s) while waiting for dotlock for transaction log file /home/aewhale/Maildir/dovecot.index.log Oct 18 08:02:40 ns4 dovecot: pop3(aewhale): Disconnected: Storage error during logout. top=0/0, retr=11511/1566975544, del=11511/11511, size=1566691807 Oct 18 08:02:58 ns4 dovecot: pop3(aewhale): Connection closed top=0/0, retr=0/0, del=0/11520, size=1566929900 This is significantly more information than what I can receive from 2.1.15, but still does not resolve the communications issues. Any help is certainly appreciated. -- Albert E. Whale, CEH CHS CISA CISSP President - Chief Security Officer IT Security, Inc. <http://www.it-security-inc.com/> - A Service Disabled Veteran Owned Company - (SDVOSB) HUBZone Certified LinkedIn <https://www.linkedin.com/in/albertwhale> Profile Phone: 412-515-3010 | Email: Albert.Whale(a)IT-Security-inc.com<br> Cell: 412-889-6870

2 5

Fatal: setgid, imap connections dropped.
by J. de Meijer 19 Oct '18

19 Oct '18

Hi, I'm getting errors with my IMAP setup. Basically, everything seems to work. Mail is delivered nicely from Postfix to Dovecot via LMTP. Dovecot does the authentication to LDAP (also for Postfix). Users are able to send mail via authenticated submission (Postfix) and login into IMAP and POP. However, IMAP connections are dropped frequently with an "ERROR: Connection dropped by IMAP server.". After pressing reload on the webmail, or refreshing in the client might help for a short period. So it fails intermittently. The errors in the maillog are below. It seems to be mixing up users kind of randomly. I think when multiple connections are made at the same time. Did a lot of searching, put couldn't find an answer to this problem. All I can find is related to LDA, which I'm not using. Any help would be appreciated. Errors from the log: Sep 28 00:03:24 mailserver dovecot: imap(userD)<14864><WT8DguF2MspUUoaT>: Fatal: setgid(1012(userD) from userdb lookup) failed with euid=1011(userA), gid=1011(userA), egid=1011(userA): Operation not permitted (This binary should probably be called with process group set to 1012(userD) instead of 1011(userA)) Sep 28 00:03:24 mailserver dovecot: imap(userD)<17009><recJguF2NMpUUoaT>: Fatal: setgid(1012(userD) from userdb lookup) failed with euid=1011(userA), gid=1011(userA), egid=1011(userA): Operation not permitted (This binary should probably be called with process group set to 1012(userD) instead of 1011(userA)) Sep 28 00:03:26 mailserver dovecot: imap(userD)<12807><8T0iguF2NspUUoaT>: Fatal: setgid(1012(userD) from userdb lookup) failed with euid=1011(userA), gid=1011(userA), egid=1011(userA): Operation not permitted (This binary should probably be called with process group set to 1012(userD) instead of 1011(userA)) Sep 28 00:06:59 mailserver dovecot: imap(userD)<15661><UcfOjuF2OcpUUoaT>: Fatal: setgid(1012(userD) from userdb lookup) failed with euid=1011(userA), gid=1011(userA), egid=1011(userA): Operation not permitted (This binary should probably be called with process group set to 1012(userD) instead of 1011(userA)) Sep 28 00:07:54 mailserver dovecot: imap(userA)<45614><NVkakuF2xO5UUoaT>: Fatal: setgid(1011(userA) from userdb lookup) failed with euid=1012(userD), gid=1012(userD), egid=1012(userD): Operation not permitted (This binary should probably be called with process group set to 1011(userA) instead of 1012(userD)) Sep 28 00:08:08 mailserver dovecot: imap(userF)<45055><AWjtkuF2J/ptSCYM>: Fatal: setgid(1033(userF) from userdb lookup) failed with euid=1012(userD), gid=1012(userD), egid=1012(userD): Operation not permitted (This binary should probably be called with process group set to 1033(userF) instead of 1012(userD)) Sep 28 00:08:08 mailserver dovecot: imap(userF)<46412><87ntkuF2JvptSCYM>: Fatal: setgid(1033(userF) from userdb lookup) failed with euid=1011(userA), gid=1011(userA), egid=1011(userA): Operation not permitted (This binary should probably be called with process group set to 1033(userF) instead of 1011(userA)) Sep 28 00:08:08 mailserver dovecot: imap(userF)<44858><0nXzkuF2KfptSCYM>: Fatal: setgid(1033(userF) from userdb lookup) failed with euid=1012(userD), gid=1012(userD), egid=1012(userD): Operation not permitted (This binary should probably be called with process group set to 1033(userF) instead of 1012(userD)) Sep 28 00:08:14 mailserver dovecot: imap(userF)<36517><v/NHk+F2K/ptSCYM>: Fatal: setgid(1033(userF) from userdb lookup) failed with euid=1017(userC), gid=1017(userC), egid=1017(userC): Operation not permitted (This binary should probably be called with process group set to 1033(userF) instead of 1017(userC)) Sep 28 00:08:36 mailserver dovecot: imap(userF)<10531><wpKdlOF2MfptSCYM>: Fatal: setgid(1033(userF) from userdb lookup) failed with euid=1011(userA), gid=1011(userA), egid=1011(userA): Operation not permitted (This binary should probably be called with process group set to 1033(userF) instead of 1011(userA)) # dovecot --version 2.3.2.1 (0719df592) # 2.3.2.1 (0719df592): /usr/local/etc/dovecot/dovecot.conf # Pigeonhole version 0.5.2 (7704de5e) # OS: FreeBSD 11.2-RELEASE amd64 # Hostname: callisto auth_cache_size = 10 M auth_debug = yes imap_idle_notify_interval = 29 mins mail_debug = yes mail_fsync = never mail_location = maildir:~/Maildir mail_plugins = " fts fts_solr" managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext namespace inbox { inbox = yes location = mailbox Archive { auto = subscribe special_use = \Archive } mailbox Drafts { auto = create special_use = \Drafts } mailbox Sent { auto = subscribe special_use = \Sent } mailbox Spam { auto = subscribe special_use = \Junk } mailbox Trash { auto = subscribe special_use = \Trash } prefix = separator = / } passdb { args = /usr/local/etc/dovecot/dovecot-ldap.conf.ext driver = ldap } plugin { fts = solr fts_autoindex = yes fts_solr = url=http://127.0.0.1:8983/solr/dovecot/ recipient_delimiter = + sieve = file:~/sieve;active=~/.dovecot.sieve sieve_after = /usr/local/etc/dovecot/sieve-after.d sieve_before = /usr/local/etc/dovecot/sieve-before.d sieve_quota_max_storage = 50M } protocols = imap pop3 lmtp sieve service auth { client_limit = 1600 unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } } service imap-login { inet_listener imap { address = 127.0.0.1, ::1 } process_min_avail = 3 service_count = 1 } service imap { process_min_avail = 3 service_count = 256 } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } service pop3-login { inet_listener pop3 { address = 127.0.0.1, ::1 } service_count = 1 } ssl = required ssl_cert = </usr/local/etc/ssl/mail.demeijer.com.dovecot.crt ssl_cipher_list = ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256 ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it ssl_min_protocol = TLSv1.2 ssl_prefer_server_ciphers = yes userdb { args = /usr/local/etc/dovecot/dovecot-ldap-user.conf.ext driver = ldap } protocol lda { mail_fsync = optimized mail_plugins = " fts fts_solr sieve" } protocol imap { mail_max_userip_connections = 50 mail_plugins = " fts fts_solr imap_sieve" } protocol lmtp { lmtp_save_to_detail_mailbox = yes mail_fsync = optimized mail_plugins = " fts fts_solr quota sieve" postmaster_address = webmaster(a)example.com } In /usr/local/etc/dovecot/dovecot-ldap.conf.ext: hosts = localhost dn = cn=reader,ou=Roles,dc=example,dc=com dnpass = secretpassword auth_bind = yes base = ou=People,dc=example,dc=com deref = never scope = subtree user_attrs = uid=uid,homeDirectory=home,uidNumber=uid,gidNumber=gid user_filter = (&(objectClass=posixAccount)(uid=%n)) pass_attrs = uid=user,userPassword=password pass_filter = (&(objectClass=posixAccount)(uid=%u)) default_pass_scheme = SSHA dovecot-ldap-user.conf.ext is the same as dovecot-ldap.conf.ext # freebsd-version 11.2-RELEASE-p3 Everything is installed from ports.

2 6