October 2018 - dovecot

trouble with ssl disable in centos 7 with version 1.0 1.2 and 3.10
by Joseph Harth 19 Oct '18

19 Oct '18

I am trying to use dovecot without ssl in centos 7. It works with imap but I am not able to make it work with pop3. Pop3 only works with ssl=yes. I can use dovecot in centos 4 ok. I get the same error with thunderbird and outlook. But for some reason it works when I telnet to port 110 and do retr 1. I was able to work pam and shadow passwords. this is the output that does not work with tls disabled Oct 18 13:30:17 auth: Debug: Loading modules from directory: /usr/lib64/dovecot/authOct 18 13:30:17 auth: Debug: Module loaded: /usr/lib64/dovecot/auth/lib20_auth_var_expand_crypt.soOct 18 13:30:17 auth: Debug: Module loaded: /usr/lib64/dovecot/auth/libdriver_sqlite.soOct 18 13:30:17 auth: Debug: Read auth token secret from /var/run/dovecot/auth-token-secret.datOct 18 13:30:17 auth: Debug: auth client connected (pid=22513)Oct 18 13:30:17 auth: Debug: client in: AUTH 1 PLAIN service=pop3 session=WXv1I4R4FOXAqAAK lip=192.168.0.37 rip=192.168.0.10 lport=110 rport=58644Oct 18 13:30:17 auth: Debug: client passdb out: CONT 1Oct 18 13:30:17 auth: Debug: client in: CONT 1 == (previous base64 data may contain sensitive data)Oct 18 13:30:17 auth-worker(22515): Debug: Loading modules from directory: /usr/lib64/dovecot/authOct 18 13:30:17 auth-worker(22515): Debug: Module loaded: /usr/lib64/dovecot/auth/lib20_auth_var_expand_crypt.soOct 18 13:30:17 auth-worker(22515): Debug: Module loaded: /usr/lib64/dovecot/auth/libdriver_sqlite.soOct 18 13:30:17 auth-worker(22515): Debug: shadow(joe2,192.168.0.10,<WXv1I4R4FOXAqAAK>): lookupOct 18 13:30:17 auth: Debug: client passdb out: OK 1 user=joe2Oct 18 13:30:17 auth: Debug: master in: REQUEST 2718302209 22513 1 05eac7a2917ce3bc1f0f359b21b138e6 session_pid=22516Oct 18 13:30:17 auth-worker(22515): Debug: passwd(joe2,192.168.0.10,<WXv1I4R4FOXAqAAK>): lookupOct 18 13:30:17 auth: Debug: master userdb out: USER 2718302209 joe2 system_groups_user=joe2 uid=660 gid=661 home=/home/joe2Oct 18 13:30:17 pop3(joe2)<22516><WXv1I4R4FOXAqAAK>: Debug: Effective uid=660, gid=661, home=/home/joe2Oct 18 13:30:17 pop3(joe2)<22516><WXv1I4R4FOXAqAAK>: Debug: Namespace inbox: type=private, prefix=, sep=, inbox=yes, hidden=no, list=yes, subscriptions=yes location=mbox:~/mail/:INBOX=/var/mail/joe2Oct 18 13:30:17 pop3(joe2)<22516><WXv1I4R4FOXAqAAK>: Debug: fs: root=/home/joe2/mail, index=, indexpvt=, control=, inbox=/var/mail/joe2, alt=Oct 18 13:30:17 pop3(joe2)<22516><WXv1I4R4FOXAqAAK>: Debug: Mailbox INBOX: Mailbox opened because: POP3 INBOXOct 18 13:30:17 pop3(joe2)<22516><WXv1I4R4FOXAqAAK>: Debug: Mailbox INBOX: UID 30: Opened mail because: accessOct 18 13:30:17 pop3(joe2)<22516><WXv1I4R4FOXAqAAK>: Debug: Mailbox INBOX: UID 30: Opened mail because: RETR This is the output with TLS and it works Oct 18 13:30:32 auth: Debug: auth client connected (pid=22542)Oct 18 13:30:33 auth: Debug: client in: AUTH 1 PLAIN service=pop3 secured=tls session=44feJIR4FeXAqAAK lip=192.168.0.37 rip=192.168.0.10 lport=110 rport=58645 ssl_cipher=ECDHE-RSA-AES128-GCM-SHA256 ssl_cipher_bits=128 ssl_pfs=ECDH ssl_protocol=TLSv1.2Oct 18 13:30:33 auth: Debug: client passdb out: CONT 1Oct 18 13:30:33 auth: Debug: client in: CONT 1 == (previous base64 data may contain sensitive data)Oct 18 13:30:33 auth-worker(22515): Debug: shadow(joe2,192.168.0.10,<44feJIR4FeXAqAAK>): lookupOct 18 13:30:33 auth: Debug: client passdb out: OK 1 user=joe2Oct 18 13:30:33 auth: Debug: master in: REQUEST 4165992449 22542 1 cb03b70f92c0c5c030e25a39ea4b8518 session_pid=22543Oct 18 13:30:33 auth-worker(22515): Debug: passwd(joe2,192.168.0.10,<44feJIR4FeXAqAAK>): lookupOct 18 13:30:33 auth: Debug: master userdb out: USER 4165992449 joe2 system_groups_user=joe2 uid=660 gid=661 home=/home/joe2Oct 18 13:30:33 pop3(joe2)<22543><44feJIR4FeXAqAAK>: Debug: Effective uid=660, gid=661, home=/home/joe2Oct 18 13:30:33 pop3(joe2)<22543><44feJIR4FeXAqAAK>: Debug: Namespace inbox: type=private, prefix=, sep=, inbox=yes, hidden=no, list=yes, subscriptions=yes location=mbox:~/mail/:INBOX=/var/mail/joe2Oct 18 13:30:33 pop3(joe2)<22543><44feJIR4FeXAqAAK>: Debug: fs: root=/home/joe2/mail, index=, indexpvt=, control=, inbox=/var/mail/joe2, alt=Oct 18 13:30:33 pop3(joe2)<22543><44feJIR4FeXAqAAK>: Debug: Mailbox INBOX: Mailbox opened because: POP3 INBOXOct 18 13:30:33 pop3(joe2)<22543><44feJIR4FeXAqAAK>: Debug: Mailbox INBOX: UID 30: Opened mail because: accessOct 18 13:30:33 pop3(joe2)<22543><44feJIR4FeXAqAAK>: Debug: Mailbox INBOX: UID 30: Opened mail because: RETROct 18 13:30:33 pop3(joe2)<22543><44feJIR4FeXAqAAK>: Debug: Mailbox INBOX: UID 31: Opened mail because: accessOct 18 13:30:33 pop3(joe2)<22543><44feJIR4FeXAqAAK>: Debug: Mailbox INBOX: UID 31: Opened mail because: RETR

2 1

doveadm expunge with static users
by azurit＠pobox.sk 18 Oct '18

18 Oct '18

Hi, is it possible to use 'doveadm expunge' with static user database? Or can i, somehow, tell dovecot the directory location where i need to do an expunge? Thank you. azur

2 3

Ass(et) protection for mobile users
by Rupert Gallagher 18 Oct '18

18 Oct '18

Hello! Is it possible to hide the public folder when the user is on its mobile phone?

2 6

Problems recovering IMAP Data
by Albert Whale 18 Oct '18

18 Oct '18

HELP, I have experience an issue with the long running IMAP service using Dovecot 2.1.15. I have replaced the interface cards (suspected failure), and I have only recently been able to retrieve my Inbox (1.45GB) via POP3 protocol (I normally run IMAP) I am suspecting a corrupted dovecot.index, but which one? I have counted 260 files in my IMAP tree with the word dovecot. I cannot determine which folder is corrupted with 2.1.5 even with the Mail Debug option. How can I recover the use of my IMAP configuration? Thank you.

2 1

dovecot passdb driver=checkpassword as external script for block ip
by bes 18 Oct '18

18 Oct '18

Refer to https://dovecot.org/pipermail/dovecot/2015-March/099971.html https://wiki.dovecot.org/PasswordDatabase I tried to repeat the same thing. Set these passdb: passdb { args = /myscript.sh ip=%r driver = checkpassword result_failure = return-fail result_success = continue } passdb { args = /etc/dovecot/dovecot-sql.conf.ext ( my working auth method ) driver = sql } Created executable /myscript.sh: #!/bin/sh exit 1 But I saw in the logs: dovecot[15111]: auth: Error: checkpassword(techdept(a)nestormedia.com,192.168.99.128,<Mos6jW94XNzAqGOA>): Child 15115 exited with status 1 dovecot[18016]: imap-login: Login: user=....[successful login] Why result_failure=return-fail from first passdb does not work?

2 2

"Broken MIME parts for mail"
by Poliman - Serwis 18 Oct '18

18 Oct '18

I have many lines like below in error.log file: Oct 16 10:03:22 s1 dovecot: imap(artur(a)firmastanaszek.pl): Error: unlink(/var/vmail/firmastanaszek.pl/artur/Maildir/dovecot.index.cache) failed: No such file or directory (in mail-cache.c:28) Oct 16 10:03:22 s1 dovecot: imap(artur(a)firmastanaszek.pl): Error: Corrupted index cache file /var/vmail/firmastanaszek.pl/artur/Maildir/dovecot.index.cache: Broken MIME parts for mail UID 1019 in mailbox INBOX: Cached MIME parts don't match message during parsing: Cached header size mismatch (parts=) Oct 16 10:03:23 s1 dovecot: imap(artur(a)firmastanaszek.pl): Error: unlink(/var/vmail/firmastanaszek.pl/artur/Maildir/dovecot.index.cache) failed: No such file or directory (in mail-cache.c:28) Oct 16 10:03:23 s1 dovecot: imap(artur(a)firmastanaszek.pl): Error: Corrupted index cache file /var/vmail/firmastanaszek.pl/artur/Maildir/dovecot.index.cache: Broken MIME parts for mail UID 1052 in mailbox INBOX: Cached MIME parts don't match message during parsing: Cached header size mismatch (parts=) Oct 16 10:03:23 s1 dovecot: imap(artur(a)firmastanaszek.pl): Error: unlink(/var/vmail/firmastanaszek.pl/artur/Maildir/dovecot.index.cache) failed: No such file or directory (in mail-cache.c:28) Oct 16 10:03:23 s1 dovecot: imap(artur(a)firmastanaszek.pl): Error: Corrupted index cache file /var/vmail/firmastanaszek.pl/artur/Maildir/dovecot.index.cache: Broken MIME parts for mail UID 1098 in mailbox INBOX: Cached MIME parts don't match message during parsing: Cached header size mismatch (parts=) I didn't do anything with Dovecot neither update in last time nor move files or something. Does anybody could tell me what above means and how to fix it?

1 0

Replication 'noreplicate' field usage
by Phil 17 Oct '18

17 Oct '18

I've set up replication as per the wiki under 2.3.3 and in my SQL user query I am returning a 'noreplicate' field, this is a boolean and returns true for all users at the moment. However when I do "doveadm replicator status '*'" it lists all users in my database suggesting it is trying to sync all users regardless of the noreplicate field. ``` user_query = SELECT home, uid, gid, noreplicate FROM users WHERE address = '%u' ``` It seems that the noreplicate field is being ignored, am I using it correctly?

1 0

: Re: Corrupted dbox file/index
by Raymond Sellars 16 Oct '18

16 Oct '18

>On Mon, Oct 15, 2018 at 08:50:21AM +0000, Raymond Sellars wrote: > > Hi > > Looking for some insight into mdbox index file management and recovery from corruptions. > What version of dovecot and what OS are you running? Is NFS linux/bsd/netapp/etc? [Raymond] Linux 2.6.32-279.19.1.el6.x86_64 Red Hat Enterprise Linux Server release 6.7 (Santiago) - its selectively patched a little higher than this. nfs-utils-1.2.3-64.el6.x86_64 nfs-utils-lib-1.1.5-11.el6.x86_64 NFS is provided by SAN array. Either Isilon SAN or VNX SAN. I believe the older Isilon with NFS. [Raymond Sellars] fstab: <ip removed>:/ mailshare-isi /mailshare nfs _netdev,noatime,vers=3,rsize=32768,wsize=32768,bg,intr,tcp 0 0 Thanks Raymond

1 0

Corrupted dbox file/index
by Raymond Sellars 15 Oct '18

15 Oct '18

Hi Looking for some insight into mdbox index file management and recovery from corruptions. I have a two node cluster on NFS with proxy director in front for user stickness. One node (a nominated master) bidirectionally replicates to a 3rd node on a DR site. We periodically get index file corruptions resulting in rebuilds. However the user experience is poor as messages read/deleted from months/years ago all reappear as unread again. We've seen corruption because of NFS NTP time sync problems, proxy not being stick, but also the DR node being off line for a while and then tripping corruption within production when it comes back on. Error message example (1 of): Error: Corrupted dbox file /mailshare/.. (removed) ../home/mail/storage/m.4 (around offset=993548): EOF reading msg header (got 0/30 bytes) https://wiki2.dovecot.org/MailboxFormat/dbox- i've read up on all the documentation I can find and understand " you must not lose the dbox index files, they can't be regenerated without data loss." Questions: #1 Any additional tips for avoiding mdbox index corruptions with dsync? Or should I revert to maildir format? I like the performance premise of the mdbox but these index corruptions are a reliability issue. #2 I'm guessing read status is one of the meta data items lost. But its seems it can't recover it from dovecot.index.backup files either. Any technique to preserve that item as its key to the user experience? #3 If index/transaction logs are so critical is there some kind of check point backups I can take? Native dovecot feature or do I need to script something. #4 I've noticed that rebuilding the index does not work if the dovecot.index.log file is lost (deleted as a hard test). The dovecot.index.cache can be but once the log file i gone messages are not automatically (or manually that i can find) recovered from the storage directory. I've not seen any dovecot.index.log file corruptions but that file seems very high risk. If rebuilding the index only from the log file or a combination process from storage directory? Is there perhaps an option to just use the transaction log and not the index? Although that doesn't sound wise for performance. #5 In additional to status UNREAD we also notice files moved to the trash reappear. Is that expected behavior? Thanks Raymond

2 1

Problems with qouta_clone plugin
by Christian Ejlertsen 15 Oct '18

15 Oct '18

Hello I'm having troubles getting the quota_clone plugin to work for me. iø, trying to put the quota values into to to fields, messages and usage_in_bytes, in the mysql database. The quotas are getting written to the maildirsize file and can be updated with the doveadm quota recalc -A or -u "*" command But i can't seem to get it to trigger the quota_clone plugin, not even an error or a warning.. At this point a crash would be preferred since it might yield some information :) It is probably something simple but apparantly i'm failing to see it :) Hope someone can help. ------------- dovecot --version 2.3.2.1 (0719df592) cat dovecot-quota-clone-sql.conf.ext connect = **** map { pattern = priv/quota/storage table = virtual_users value_field = usage_in_bytes username_field = email } map { pattern = priv/quota/messages table = virtual_users value_field = messages username_field = email } # 2.3.2.1 (0719df592): /etc/dovecot/dovecot.conf # OS: Linux 3.10.0-862.11.6.el7.x86_64 x86_64 CentOS Linux release 7.5.1804 (Core) nfs4 # Hostname: imap01.ltmail.dk auth_debug = yes dict { lastlogin = mysql:/etc/dovecot/dovecot-dict-sql.conf.ext quotaclone = mysql:/etc/dovecot/dovecot-dict-sql.conf.ext } doveadm_password = # hidden, use -P to show it lock_method = dotlock login_trusted_networks = 192.168.100.11/32 192.168.100.16/32 mail_fsync = always mail_location = maildir:/storage/vmail/%d/%n mail_nfs_index = yes mail_nfs_storage = yes mail_plugins = " quota notify replication" mmap_disable = yes namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } plugin { last_login_dict = proxy::lastlogin last_login_key = last-login/%u mail_replica = tcp:imapb01.litmail.dk:12345 quota = maildir:User quota quota_clone_dict = proxy::quotaclone quota_grace = 10%% quota_status_nouser = DUNNO quota_status_overquota = 552 5.2.2 Mailbox is full quota_status_success = DUNNO } protocols = imap replication_max_conns = 100 service aggregator { fifo_listener replication-notify-fifo { mode = 0666 user = vmail } unix_listener replication-notify { mode = 0666 user = vmail } } service auth-worker { user = $default_internal_user } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0666 user = postfix } unix_listener auth-userdb { group = vmail mode = 0666 user = vmail } user = $default_internal_user } service config { unix_listener config { user = vmail } } service dict { unix_listener dict { group = vmail mode = 0600 user = vmail } } service doveadm { group = vmail inet_listener { port = 12345 } user = vmail } service imap-login { inet_listener imap { port = 143 } process_min_avail = 10 service_count = 0 } service quota-status { client_limit = 1 executable = /usr/libexec/dovecot/quota-status -p postfix inet_listener { port = 12340 } } service replicator { process_min_avail = 1 unix_listener replicator-doveadm { mode = 0666 } } service stats { unix_listener stats-writer { mode = 0600 user = vmail } } ssl_cert = </etc/pki/dovecot/certs/dovecot.pem ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } protocol imap { mail_max_userip_connections = 1000 mail_plugins = " quota notify replication imap_quota last_login quota_clone" } protocol submission { mail_max_userip_connections = 1000 } -- Christian Ejlertsen

2 5