November 2018 - dovecot

Multi-server but small scale
by Daniel Miller 21 Nov '18

21 Nov '18

I have a small but critical server that supports our group. As a single server - it's obviously a single-point-of-failure for lots of things. As I just experienced...again. It was a lot more fun building systems from components when I was younger... Previously 3rd-party hosted solutions didn't look attractive for several reasons...but I'm seeing prices now for cloud virtual machines that are stupid cheap. Even if they wind up being limited speed & availability - it would seem they'd be a lot better than nothing! So I'm considering having at least one backup server for various services - obviously that includes mail. So now I have to wonder about the backend. And while I think I'm reasonably current with networked file systems (not distributed or cluster) I haven't played with replication for a quite a while. For this particular usage (I'm envisioning two servers total) - is there a need/reason to use any form of networked/distributed/cluster file storage? Or would this be accomplished via "pure" Dovecot - dsync replication would keep things updated between the servers and director would handle the connections? So with identically configured SMTP servers, passing to the local LMTP agents, the file system would be "purely local" with no NFS or other interconnection? -- Daniel

2 1

analysing of dmarc report
by Poliman - Serwis 21 Nov '18

21 Nov '18

I have a problem with understanding dmarc reports and some features. I attach two reports. First one come from google.com, second one from tumieszkamy.pl. On my server is dns zone of domain kamir-transport.pl but whole mail service is deployed on Google - in dns zone MX points to Google and there are all mailboxes, aliases etc. Last time I have configured dkim and dmarc policies and I got two reports. Honestly I don't know why two, from two different providers - google.com and tumieszkamy.pl. Moreover in report originating from google I see IP of my server [which fails spf and dkim policies] and I don't understand why this IP is evaluated? Second thing which I don't understand is second report which I got from tumieszkamy.pl. SPF record in dns zone of domain kamir-transport.pl was looking like below (now I changed it to slightly different): *v=spf1 mx include:_spf.google.com <http://spf.google.com> -all* Does anybody could help uderstand these things? -- *Pozdrawiam / Best Regards* *Piotr Bracha*

1 0

Quota in MySql Dict not recalculate automatic
by SUnsin＠gv-bayern.de 20 Nov '18

20 Nov '18

Hi, I have a working Installation with: Ubuntu 16.04 LTS Dovecot 2.2.22 MySql 5.7.24 Postfixadmin 3.2 Apache 2.4.18 Rainloop 1.12.1 I manage the E-Mail Accounts with postfixadmin in a MySql-DB. Also I use quotas with Quota Backend postfixadmin-DB (dict). Everything works fine. Now I installed a new Server with the following Versions and migrate the Configs to the new System. Ubuntu 18.04 LTS Doveot 2.2.33 MySQL 5.7.24 Postfixadmin 3.2 Apache 2.4.18 Rainloop 1.12.1 The Problem is now: When I receive a E-Mail, the quota will not Update (recalculate) automatical in the MySql-DB from Dovecot. In the old System there execute the SQL Statement after receiving a E-Mail, for example: UPDATE quota2 SET bytes=bytes+3076,messages=messages+1 WHERE username = <E-Mail Address> On the new System with the newer Dovecot Version, the Statement never comes after receive an E-Mail. With Dovecot Version 2.3 on the old System with Ubuntu 16.04, everything works fine with the same config. Is a BUG in the Dovecot Version 2.2.33 possible? Can everbody help me? Kind regards Stephan dovecot -n # 2.2.33.2 (d6601f4ec): /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.21 (92477967) # OS: Linux 4.15.0-39-generic x86_64 Ubuntu 18.04.1 LTS auth_debug = yes auth_debug_passwords = yes auth_master_user_separator = * auth_mechanisms = plain login auth_verbose_passwords = yes dict { sqldomainquota = mysql:/etc/dovecot/dovecot-dict-sql-domain.conf.ext sqluserquota = mysql:/etc/dovecot/dovecot-dict-sql-user.conf.ext } disable_plaintext_auth = no login_greeting = Dovecot ready. mail_debug = yes mail_location = maildir:~/Maildir mail_plugins = " quota" managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = separator = / } passdb { args = /etc/dovecot/master-users driver = passwd-file master = yes pass = yes } passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } plugin { quota = dict:User Quota::noenforcing:proxy::sqluserquota quota_grace = 10%% quota_status_nouser = DUNNO quota_status_overquota = 552 5.2.2 Mailbox is over quota / Mailbox ist voll quota_status_success = DUNNO quota_warning = storage=95%% quota-warning 95 %u quota_warning2 = storage=80%% quota-warning 80 %u } postmaster_address = postmaster@xxx protocols = " imap lmtp sieve pop3 sieve" service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0666 user = postfix } } service dict { unix_listener dict { group = vmail mode = 0660 user = vmail } } service lmtp { inet_listener lmtp { address = localhost port = 24 } } service managesieve-login { inet_listener sieve { port = 4190 } } service quota-status { client_limit = 1 executable = quota-status -p postfix inet_listener { port = 12340 } } service quota-warning { executable = script /usr/local/bin/quota-warning.sh unix_listener quota-warning { group = vmail mode = 0660 user = vmail } user = vmail } ssl_cert = xxx ssl_key = # hidden, use -P to show it userdb { driver = prefetch } userdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } protocol lmtp { mail_plugins = " quota" } protocol imap { mail_max_userip_connections = 10 mail_plugins = " quota imap_quota" } grep -v '^ *$#.*$\?$' dovecot-sql.conf : driver = mysql connect = host=localhost dbname=postfixadmin user=pfadmin password=UCLGXEb9rEEOTAO default_pass_scheme = SHA512-CRYPT password_query = \ SELECT username as user, password, '/var/vmail/%Ld/%Ln' as userdb_home, \ 'maildir:/var/vmail/%Ld/%Ln' as userdb_mail, 5000 as userdb_uid, 5000 as userdb_gid \ FROM mailbox WHERE username = '%Lu' AND active = '1' user_query = \ SELECT '/var/vmail/%Ld/%Ln' as home, \ 'maildir:/var/vmail/%Ld/%Ln' as mail, \ 5000 AS uid, \ 5000 AS gid, \ concat('*:bytes=', \ if(mailbox.quota = 0, domain.maxquota*1024000, mailbox.quota)) \ as quota_rule \ FROM mailbox, domain \ WHERE username = '%Lu' AND mailbox.active = '1' AND \ domain.domain = '%d' AND domain.active = '1' iterate_query = SELECT username as user FROM mailbox WHERE active = '1' Ref. Systeme / Bereich Digitalisierung und Informationstechnik (IT) Telefon: 089 2868-3280 Telefax: 089 2868-3275 Internet-E-Mail: SUnsin(a)gv-bayern.de Notes-E-Mail: Stephan Unsin@GVB http://www.gv-bayern.de Genossenschaftsverband Bayern e.V. Türkenstrasse 22-24, 80333 München Es gelten die jeweils aktuellen Allgemeinen Auftragsbedingungen des Genossenschaftsverbands Bayern e.V.

2 5

Update virtual folders via doveadm?
by Daniel Miller 20 Nov '18

20 Nov '18

I'm trying to have my server maintain it's FTS indexes reasonably current at all times. From prior threads, and based on my namespace configuration, I have the following hourly cronjob: doveadm index -A -q '*' doveadm index -A -q 'shared/*' doveadm index -A -q 'virtual/*' This seems to work just fine to maintain the FTS (Solr). However - as I understand it Dovecot's virtual folders are not updated with new mails until they are accessed by a client. Therefore the above command sequence would work fine for my default namespace and the shared - but the virtual namespace won't actually be current. So... Would a command such as: doveadm mailbox status -A messages virtual/* Be appropriate to run prior to the virtual/* FTS indexing? -- Daniel

2 1

IMAP Limitations with Outlook 2013?
by Robert Adkins 19 Nov '18

19 Nov '18

Good Day! I have a fairly new user on my network that has, over about 10 months, created in root inbox and nested sub-folders totaling over 900 individual folders. In the past few weeks, newly created folders will be visible in Outlook 2013, but when an email is moved into that folder, it is no longer visible. I can ssh into the server, drill down to that sub-folder and see the email in the folder AND it is also available to be seen without issue in Thunderbird. I know this is a longshot, but if there is some feature that I haven't found in Dovecot to force Outlook to synchronize with all the folders/sub-folders, please let me know. Beyond that. With this particular users habits, over the next 5 years, there could be nearly 10,000 folders/sub-folders. Does anyone know if this will create any problems with Dovecot or is this JUST a Microsoft software problem? -- Best Regards, Robert Adkins IT Manager/Tool Designer Impel Industries, Inc. 586-254-5800

3 2

"Group doesn't exist: dovecot"
by James Brown 19 Nov '18

19 Nov '18

No matter what I do, I always get this error when trying to start Dovecot: $ sudo /usr/local/opt/dovecot/sbin/dovecot Warning: fd limit (ulimit -n) is lower than required under max. load (256 < 1000), because of default_client_limit Fatal: service(stats) Group doesn't exist: dovecot (See service stats { unix_listener /usr/local/var/run/dovecot/stats-writer { group } } setting) The user and group it should be using are _dovecot. Config: $ sudo /usr/local/opt/dovecot/sbin/dovecot -n # 2.3.2.1 (0719df592): /usr/local/etc/dovecot/dovecot.conf # OS: Darwin 18.2.0 x86_64 apfs # Hostname: mailbordocomau-dr.local doveconf: Error: t_readlink(/usr/local/var/run/dovecot/dovecot.conf) failed: readlink() failed: No such file or directory default_internal_user = _dovenull default_login_user = _dovecot first_valid_gid = 0 first_valid_uid = 102 last_valid_gid = 500 last_valid_uid = 105 mail_gid = 102 mail_location = maildir:/usr/local/virtual/%d/%u mail_uid = 102 namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = /usr/local/etc/dovecot/dovecot-sql.conf.ext driver = sql } protocols = imap pop3 service auth { unix_listener /var/spool/postfix/private/auth { group = _postfix mode = 0660 user = _postfix } unix_listener auth-userdb { mode = 0660 user = _vmail } } ssl_cert = </usr/local/etc/dovecot/cert.pem ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { driver = passwd } userdb { driver = prefetch } userdb { args = /usr/local/etc/dovecot/dovecot-sql.conf.ext driver = sql } Not sure why it’s looking for dovecot.conf in the wrong place. Any suggestions? thanks, James.

1 0

Solr 7.5.0 managed-schema
by Daniel Miller 19 Nov '18

19 Nov '18

The attached is the Dovecot schema I am now using for Solr 7.5.0 - no "deprecated" warnings! -- Daniel

2 1

macOS Mojave: setgroups(501) failed: Too many extra groups
by Heiko W. Rupp 18 Nov '18

18 Nov '18

Hello, I have recently upgraded to macOS 10.14 (Mojave) and am running into an issue where one use can no longer log into dovecot via imap. Log shows Oct 11 08:10:27 imap(hwr)<12659><YpC/0+133+EAAAAAAAAAAAAAAAAAAAAB>: Fatal: setgroups(501) failed: Too many extra groups and indeed, the user is in 17 groups, which is more than NGROUPS_MAX (16). Another user with << 16 groups can log in fine. Unfortunately it is not (easily) doable to reduce the number of groups, as macOS seems to set them internally. Is there a config option that I am missing to work around this? Looking at the source, I see this is handled in src/lib/restrict-access.c::fix_groups_list(), where above the call to setgroups() a gid_list2 is constructed. I wonder if one could have a config option to prevent adding all those extra groups, which then make the call to setgroups() fail Any help appreciated Heiko -- hwr(a)pilhuhn.de m:0179/207 4919 b:http://pilhuhn.blogspot.com

4 6

Re: Issue sharing folders with Thunderbird
by Jason Perry 17 Nov '18

17 Nov '18

Hi Aki I see what you are saying, and no I don’t believe so. I’m using typical /etc/passwd for the user db. I reviewed https://wiki.dovecot.org/UserDatabase/ExtraFields <https://wiki.dovecot.org/UserDatabase/ExtraFields> but I’m not clear on how to actually return system_user userdb attribute. I also have set mail_user_groups = sharedusers in dovecot.conf and then in /etc/group put all the users with mailboxes into the sharedusers group. I can see why that wouldn’t work if the above is not set. Can you point me in the right direction on how to pass that information? Thanks! > On Aug 28, 2018, at 12:40 AM, Aki Tuomi <aki.tuomi(a)dovecot.fi> wrote: > > Are you returning system_user userdb attribute? Extra groups from /etc/group are not applied without this. > > --- > Aki Tuomi > Dovecot oy > > -------- Original message -------- > From: Jason Perry <jason.perry(a)dtainc.us> > Date: 28/08/2018 04:27 (GMT+02:00) > To: Aki Tuomi <aki.tuomi(a)dovecot.fi> > Cc: dovecot(a)dovecot.org > Subject: Re: Issue sharing folders with Thunderbird > > Hi Aki, they are. > >> 3. The permissions for the file are: >> root@dal-notify-01 Maildir]# ls -la /var/lib/dovecot/db/shared-mailboxes.db >> -rw-rw-r--. 1 operations sharedusers 197 Aug 26 20:33 /var/lib/dovecot/db/shared-mailboxes.db >> 4. Users I'm testing with are part of the sharedusers group in /etc/group > > The dir /var/lib/dovecot/db has this for permissions: > drwsrwsrwx. 2 root sharedusers 33 Aug 27 21:12 db > > the user operations is a member of “sharedusers” in /etc/group. I even chmod’ed the permissions after to rw for global and I get the same error/result. > > The file does appear to get written to. For example, lets say user u2.name creates a folder called “starbucks” and uses the IMAP commands to share it out to user operations. It seems to write to the acl_shared_dict file in /var/lib/dovecot/db/shared-mailboxes.db with an entry like >> shared/shared-boxes/user/u2.name/operations >> 1 > > And it writes to the ~/Maildir/.starbucks/dovecot-acl file for u2.user with an entry like: > user=operations lrw > > So it appears to be working. However, if I log into Thunderbird with the user operations account and go to subscribe, I do not see “starbucks” in the list of available folders. And I still get the nfs_flush_chown error. > > Is there anything else I can be doing with the file/dir permissions? > > Thanks. > > >> On Aug 27, 2018, at 10:50 AM, Aki Tuomi <aki.tuomi(a)dovecot.fi <mailto:aki.tuomi@dovecot.fi>> wrote: >> >> acl_shared_dict file & folder must be readwritable by user performing the sharing as stated in wiki. >> >> https://wiki.dovecot.org/SharedMailboxes/Shared <https://wiki.dovecot.org/SharedMailboxes/Shared> >> --- >> Aki Tuomi >> Dovecot oy >> >> -------- Original message -------- >> From: Jason Perry <jason.perry(a)dtainc.us <mailto:jason.perry@dtainc.us>> >> Date: 27/08/2018 17:01 (GMT+02:00) >> To: dovecot(a)dovecot.org <mailto:dovecot@dovecot.org> >> Subject: Issue sharing folders with Thunderbird >> >> Trying to share folder "JasonAlerts" within mailbox operations to user u1.name >> >> Issues: >> 1. Shared mailboxes do not appear under subscriptions in Thunderbird for another user >> 2. When I try to set permissions via IMAP commands I get in /var/log/dovecot.log >> Aug 26 20:33:24 imap(operations): Error: nfs_flush_chown_uid: chown(/var/lib/dovecot/db) failed: Permission denied >> 3. The permissions for the file are: >> root@dal-notify-01 Maildir]# ls -la /var/lib/dovecot/db/shared-mailboxes.db >> -rw-rw-r--. 1 operations sharedusers 197 Aug 26 20:33 /var/lib/dovecot/db/shared-mailboxes.db >> 4. Users I'm testing with are part of the sharedusers group in /etc/group >> 5. IMAP commands DO write to the file: >> [root@dal-notify-01 Maildir]# cat /var/lib/dovecot/db/shared-mailboxes.db >> shared/shared-boxes/user/u1.name/u2.name >> 1 >> shared/shared-boxes/user/operations/u2.name >> 1 >> shared/shared-boxes/user/u1.name/operations >> 1 >> shared/shared-boxes/user/u1.name/operations >> 1 >> 6. It will also write to the user's /home/operations/Maildir/.JasonAlert/dovecot-acl file >> user=u1.name ilrw >> >> However if I got into Thunderbird and try to subscribe, none of the shared folders are listed. Can anyone help?? Thanks!! >> >> Dovecot version = 2.2.10 >> >> dovecot -n >> [root@server]# dovecot -n >> # 2.2.10: /etc/dovecot/dovecot.conf >> # OS: Linux 3.10.0-693.17.1.el7.x86_64 x86_64 CentOS Linux release 7.4.1708 (Core) >> first_valid_uid = 100 >> listen = * >> log_path = /var/log/dovecot.log >> mail_debug = yes >> mail_location = maildir:~/Maildir >> mail_plugins = acl >> mail_privileged_group = mail >> mbox_write_locks = fcntl >> namespace Private { >> hidden = no >> inbox = no >> list = no >> location = >> prefix = Private/ >> separator = / >> type = private >> } >> namespace Public { >> hidden = no >> inbox = no >> list = no >> location = maildir:/var/mail/public >> prefix = Public/ >> separator = / >> subscriptions = yes >> type = public >> } >> namespace Shared { >> hidden = no >> inbox = no >> list = yes >> location = maildir:/var/mail/%u:INDEXPVT=~/Maildir/%u >> prefix = shared/%u/ >> separator = / >> subscriptions = yes >> type = shared >> } >> namespace inbox { >> inbox = yes >> location = >> mailbox Drafts { >> special_use = \Drafts >> } >> mailbox Junk { >> special_use = \Junk >> } >> mailbox Sent { >> special_use = \Sent >> } >> mailbox "Sent Messages" { >> special_use = \Sent >> } >> mailbox Trash { >> special_use = \Trash >> } >> prefix = >> separator = / >> } >> passdb { >> driver = pam >> } >> passdb { >> driver = pam >> } >> plugin { >> acl = vfile >> acl_shared_dict = file:/var/lib/dovecot/db/shared-mailboxes.db <file:///var/lib/dovecot/db/shared-mailboxes.db> >> } >> protocols = imap >> ssl_cert = </etc/pki/dovecot/certs/dovecot.pem >> ssl_key = </etc/pki/dovecot/private/dovecot.pem >> syslog_facility = local2 >> userdb { >> driver = passwd >> } >> userdb { >> driver = passwd >> } >> protocol imap { >> mail_plugins = acl imap_acl >> } >

1 1

RSA+ECC certificates
by Alex Hautequest 17 Nov '18

17 Nov '18

Any way of using both a RSA and an ECC certificates, letting the client pick the one to use? Alex

2 1