December 2018 - dovecot

"no shared cypher", no matter what I try
by Marco Fioretti 11 Dec '18

11 Dec '18

Greetings, I have had to reinstall my email server on another Linux (centos 7.6) VPS, with a newer version of dovecot, other software and a brand new letsencrypt certificate just for email withpostfix and dovecot (that certificate works fine with postfix). Output of dovecot --version and dovecot -n on the new server is below. Now, messages ARE delivered in the right IMAP mailboxes, but when I try to connect with Mutt from my home computer, mutt says, before prompting for a password: gnutls_handshake: A TLS fatal alert has been received.(Handshake failed) the corresponding output of dovecot in /var/log/maillog is below. The gist of it **seems** to me to be the "no shared cipher" part, but I may be wrong. In any case, I have already tried to search online for that string, and other relevant parts of the log, without success. All I have found is suggestions to change the values of ssl_protocols and/or ssl_cipher_list to some non-default value, but I have tried all those tips without success. Current values of those variables are these: grep -v ^# /etc/dovecot/conf.d/10-ssl.conf ssl_cert = </etc/letsencrypt/live/MYSERVERNAME/fullchain.pem ssl_key = </etc/letsencrypt/live/MYSERVERNAME/privkey.pem ssl_protocols = !SSLv2 !SSLv3 ssl_cipher_list = ALL:!ADH:!LOW:!EXP:!aNULL:+HIGH:+MEDIU any pointer to what to check or change next is VERY welcome. Thanks in advance, Marco ################################################# Dec 8 10:53:43 MYSERVERNAME dovecot: imap-login: Debug: SSL: where=0x10, ret=1: before/accept initialization [47.53.159.60] Dec 8 10:53:43 MYSERVERNAME dovecot: imap-login: Debug: SSL: where=0x2001, ret=1: before/accept initialization [47.53.159.60] Dec 8 10:53:43 MYSERVERNAME dovecot: imap-login: Warning: SSL alert: where=0x4008, ret=552: fatal handshake failure [47.53.159.60] Dec 8 10:53:43 MYSERVERNAME dovecot: imap-login: Debug: SSL: where=0x2002, ret=-1: error [47.53.159.60] Dec 8 10:53:43 MYSERVERNAME dovecot: imap-login: Debug: SSL: where=0x2002, ret=-1: error [47.53.159.60] Dec 8 10:53:43 MYSERVERNAME dovecot: imap-login: Debug: SSL error: SSL_accept() failed: error:1408A0C1:SSL routines:ssl3_get_client_hello:no shared cipher Dec 8 10:53:43 MYSERVERNAME dovecot: imap-login: Disconnected (disconnected before auth was ready, waited 0 secs): user=<>, rip=47.53.159.60, lip=116.202.20.216, TLS handshaking: SSL_accept() failed: error:1408A0C1:SSL routines:ssl3_get_client_hello:no shared cipher, session=<knICtX98UK4vNZ88> Dec 8 10:53:43 MYSERVERNAME dovecot: auth: Debug: Loading modules from directory: /usr/lib64/dovecot/auth Dec 8 10:53:43 MYSERVERNAME dovecot: auth: Debug: Module loaded: /usr/lib64/dovecot/auth/lib20_auth_var_expand_crypt.so Dec 8 10:53:43 MYSERVERNAME dovecot: auth: Debug: Module loaded: /usr/lib64/dovecot/auth/libdriver_sqlite.so Dec 8 10:53:43 MYSERVERNAME dovecot: auth: Debug: Read auth token secret from /var/run/dovecot/auth-token-secret.dat Dec 8 10:53:43 MYSERVERNAME dovecot: auth: Debug: passwd-file /etc/imap.v_users: Read 1 users in 0 secs ################################################# dovecot --version 2.2.36 (1f10bfa63) # 2.2.36 (1f10bfa63): /etc/dovecot/dovecot.conf # OS: Linux 3.10.0-957.1.3.el7.x86_64 x86_64 CentOS Linux release 7.6.1810 (Core) ext4 # Hostname: MYSERVERNAME auth_debug = yes auth_mechanisms = plain login auth_verbose = yes mail_location = maildir:/var/mail//base/ passdb { args = /etc/imap.v_users driver = passwd-file } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } } service imap-login { inet_listener imap { port = 0 } inet_listener imaps { port = 993 } } ssl = required userdb { args = /etc/imap.v_users driver = passwd-file } verbose_ssl = yes

6 12

Log sync error
by Jakobus Schürz 11 Dec '18

11 Dec '18

Hi there! I get a lot of errormessages. My dovecot is: dovecot-core 2:2.3.2.1-1~stretch from Debian stable. I found this: https://www.dovecot.org/list/dovecot/2013-July/091648.html So the bug came back... The Log is attached Thanks Jakob

1 1

Replication Error - Trying to Interate Users
by Antonino Sidoti 11 Dec '18

11 Dec '18

HI, My first post to this list; I am trying to configure replication between two host, both hosts are having the same errors. Using ‘dovecot log errors’ gives the following errors; Dec 11 18:05:12 Error: auth: Trying to iterate users, but userdbs don't support it (created 0 msecs ago, handshake 0 msecs ago) Dec 11 18:05:12 Error: replicator: User listing returned failure Dec 11 18:05:12 Error: replicator: listing users failed, can't replicate existing data My version of Dovecot version = 2.2.36 My Configuration is attached. Any help is greatly appreciated. Thanks

2 1

Indexer worker small bug
by André Rodier 10 Dec '18

10 Dec '18

Hello, I think I submitted this before, but I am not sure this has been addressed I am using AppArmor with Dovecot, without any issue. However, I think there is a bug in the indexer working, from what I can see, a missing trailing slash. See: ------------ Dec 09 14:35:53 portal2 kernel: audit: type=1400 audit(1544366153.379:3035): apparmor="DENIED" operation="file_mmap" info="Failed name lookup - disconnected path" error=-13 profile="/usr/lib/dovecot/indexer-worker" name="var/cache/nscd/hosts" pid=10540 comm="indexer-worker" requested_mask="r" denied_mask="r" fsuid=1001 ouid=0 ------------ The indexer worker is trying to open the file "var/cache/nscd/hosts" instead of "/var/cache/nscd/hosts", which of course fails. Can someone double check the code of the indexer worker, or this has been fixed? Thanks, André -- https://github.com/progmaticltd/homebox

3 5

QUERY string clarification
by Ralf Hildebrandt 10 Dec '18

10 Dec '18

The manpage https://wiki.dovecot.org/Tools/Doveadm/SearchQuery specifies: BODY string Matches messages, which contain string in the body part. and a bit further down: TEXT string Matches messages, which contain string in the message body. Where's the difference? -- Ralf Hildebrandt Geschäftsbereich IT | Abteilung Netzwerk Charité - Universitätsmedizin Berlin Campus Benjamin Franklin Hindenburgdamm 30 | D-12203 Berlin Tel. +49 30 450 570 155 | Fax: +49 30 450 570 962 ralf.hildebrandt(a)charite.de | https://www.charite.de

2 1

Replication fatal error
by admin 10 Dec '18

10 Dec '18

Dear suscribers. I just dont understand this error. Don't know where to look first. If someone have already meet this problem... Dec 10 16:06:17 prudence dovecot: dsync-server(address(a)domain.fr): Panic: file dsync-brain-mailbox.c: line 370 (dsync_brain_sync_mailbox_deinit): assertion failed: (brain->failed) Dec 10 16:06:17 prudence dovecot: dsync-server(address(a)domain.fr): Error: Raw backtrace: /usr/lib/dovecot/libdovecot.so.0(+0xa0112) [0x7f2c66f62112] -> /usr/lib/dovecot/libdovecot.so.0(+0xa020a) [0x7f2c66f6220a] -> /usr/lib/dovecot/libdovecot.so.0(i_fatal+0) [0x7f2c66ef21d8] -> dovecot/doveadm-server(dsync_brain_sync_mailbox_deinit+0x1b0) [0x5587f89936b0] -> dovecot/doveadm-server(dsync_brain_slave_recv_mailbox+0x417) [0x5587f8994447] -> dovecot/doveadm-server(dsync_brain_run+0x286) [0x5587f8991a86] -> dovecot/doveadm-server(+0x430d9) [0x5587f89920d9] -> dovecot/doveadm-server(+0x595cf) [0x5587f89a85cf] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_call_io+0x52) [0x7f2c66f781a2] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run_internal+0x12e) [0x7f2c66f7984e] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run+0x36) [0x7f2c66f78236] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_run+0x38) [0x7f2c66f783e8] -> dovecot/doveadm-server(+0x27eed) [0x5587f8976eed] -> dovecot/doveadm-server(+0x298cd) [0x5587f89788cd] -> dovecot/doveadm-server(+0x3f30b) [0x5587f898e30b] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_call_io+0x52) [0x7f2c66f781a2] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run_internal+0x12e) [0x7f2c66f7984e] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run+0x36) [0x7f2c66f78236] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_run+0x38) [0x7f2c66f783e8] -> /usr/lib/dovecot/libdovecot.so.0(master_service_run+0x13) [0x7f2c66efc9f3] -> dovecot/doveadm-server(main+0x1b5) [0x5587f89691c5] -> /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xe7) [0x7f2c66af2b97] -> dovecot/doveadm-server(_start+0x2a) [0x5587f896928a] Dec 10 16:06:17 prudence dovecot: dsync-server(address(a)domain.fr): Fatal: master: service(doveadm): child 22362 killed with signal 6 (core dumped) server 1 dovecot configuration (version 2.2.9): default_client_limit = 2048 default_process_limit = 2048 disable_plaintext_auth = no doveadm_password = xxxxxxxxxxx doveadm_port = 11225 hostname = xxxxxxxxxxxx listen = 127.0.0.1,XX.XX.XX.XX mail_location = maildir:/srv/mail/%d/%n/Maildir mail_plugins = " notify replication" managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave namespace inbox { inbox = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk { auto = subscribe special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { auto = subscribe special_use = \Trash } prefix = } passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } plugin { mail_replica = tcp:xxxxxxxxx:11225 sieve = ~/.dovecot.sieve sieve_default = /etc/dovecot/sieve/Ingenie.sieve sieve_default_name = Ingenie sieve_dir = ~/sieve sieve_max_redirects = 0 sieve_vacation_dont_check_recipient = yes } postmaster_address = admin(a)ingenie.fr protocols = " imap lmtp sieve pop3" service aggregator { fifo_listener replication-notify-fifo { user = vmail } unix_listener replication-notify { user = vmail } } service auth { unix_listener /var/spool/postfix-submission/private/dovecot-auth { group = postfix mode = 0600 user = postfix } } service doveadm { inet_listener { address = XX.XX.XX.XX port = 11225 } vsz_limit = 100 M } service lmtp { inet_listener lmtp { address = 127.0.0.1 port = 11125 } } service replicator { process_min_avail = 1 unix_listener replicator-doveadm { group = vmail mode = 0600 user = vmail } } ssl_ca = </etc/ssl/ingenie.fr/cacrt.pem ssl_cert = </etc/ssl/ingenie.fr/crt.pem ssl_key = </etc/ssl/ingenie.fr/key.pem submission_host = 127.0.0.1:10025 userdb { driver = prefetch } userdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } protocol lmtp { mail_plugins = " sieve" } protocol imap { mail_max_userip_connections = 500 } protocol sieve { mail_max_userip_connections = 500 } protocol pop3 { mail_max_userip_connections = 50 } server 2 configuration (2.2.33.2 (d6601f4ec)) disable_plaintext_auth = no doveadm_password = # hidden, use -P to show it doveadm_port = 11225 hostname = xxxxxxxxxx listen = XX.XX.XX.XX mail_location = maildir:/srv/mail/%d/%n/Maildir mail_plugins = " notify replication" mail_privileged_group = mail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave namespace inbox { inbox = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk { auto = subscribe autoexpunge = 30 days special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { auto = subscribe autoexpunge = 30 days special_use = \Trash } prefix = } passdb { args = /etc/dovecot/sql.conf driver = sql } plugin { mail_replica = tcp:xxxxxxxx:11225 sieve = ~/.dovecot.sieve sieve_default = /etc/dovecot/sieve/Ingenie.sieve sieve_default_name = Ingenie sieve_dir = ~/sieve sieve_max_redirects = 0 sieve_vacation_dont_check_recipient = yes } postmaster_address = admin(a)ingenie.fr protocols = " imap lmtp sieve pop3 sieve" service aggregator { fifo_listener replication-notify-fifo { user = vmail } unix_listener replication-notify { user = vmail } } service auth { unix_listener /var/spool/postfix-submission/private/dovecot-auth { group = postfix mode = 0600 user = postfix } } service doveadm { inet_listener { address = XX.XX.XX.XX port = 11225 } vsz_limit = 100 M } service lmtp { inet_listener lmtp { address = 127.0.0.1 port = 11125 } } service replicator { process_min_avail = 1 unix_listener replicator-doveadm { group = vmail mode = 0600 user = vmail } } ssl_ca = </etc/ssl/ingenie.fr/cacrt.pem ssl_cert = </etc/ssl/ingenie.fr/crt.pem ssl_client_ca_dir = /etc/ssl/certs ssl_key = # hidden, use -P to show it userdb { driver = prefetch } userdb { args = /etc/dovecot/sql.conf driver = sql } protocol lmtp { mail_plugins = " sieve" } Thanks for considering my request.

3 2

set seen flag and junk moving a mail manually to JUNK
by Jakobus Schürz 10 Dec '18

10 Dec '18

Hi there! I want to set the \seen and the Junk Flag to an email, which i move manually to my Junk-Folder. I tried a lot... but nothing worked like expected. I have a sieve-filter, which takes an email and copy it to a pipe to rspamc. This filter is working correctly, i get a debug-message from the script, which is called through the sieve-filter. But adding another rule (addflag "Junk"; setflag "\\seen";) to this rule is getting ignored... Here is my sieve-rule: require ["imap4flags", "vnd.dovecot.pipe", "copy", "imapsieve", "environment", "variables"]; if environment :matches "imap.email" "*" { set "email" "${1}"; } addflag "Junk"; setflag "\\seen"; pipe :copy "learn-spam.sh" [ "${email}" ]; How said before, the script learn-spam.sh is called, when i move a Message via drag&drop in thunderbird from the INBOX to the Junk-Folder. But the message in the Junk-Folder is unseen, recent and has no Junk-Flag... What's wrong? BR Jakob

8 37

Sieve notify variables not working with body?
by Bambero 09 Dec '18

09 Dec '18

Hi, I want to send notification like this: if body :text :matches "*" { notify :importance "3" :message "[NOTIFY] ${1}" "mailto:test@example,com"; } The notification works but the variable ${1} seems to be empty. But in this case: if header :matches "Subject" "*" { notify :importance "3" :message "[NOTIFY] ${1}" "mailto:test@example,com"; } Everything works correct. Regards, Bambero

2 3

Mail aliases plugin not honouring namespace?
by Marc Roos 08 Dec '18

08 Dec '18

I have namespace { disabled = no hidden = no ignore_on_failure = no inbox = yes list = yes location = prefix = separator = / subscriptions = yes type = private } namespace Archive { disabled = no hidden = no ignore_on_failure = no inbox = no list = yes location = mbox:/home/mail-archive/%u/ prefix = Archive/ separator = / subscriptions = yes type = private } Without aliases, folders are created at /home/mail-archive/%u/ which is expected When I am adding these mailbox aliases mailbox_alias_old = Archive mailbox_alias_new = Archives These folders are created in the default namespace .Archive .Archives.2018 .Archives Is this as expected? I am at least not expecting it.

1 0

Plugins/MailboxAlias configuration not working when not successive
by Marc Roos 08 Dec '18

08 Dec '18

This is not working because the numbering is not successive. This whole configuration implementation is of course nothing to be proud of. plugin { #setting_name = value # archive folder mailbox_alias_old = Archive mailbox_alias_new = Archief mailbox_alias_old2 = Archive mailbox_alias_new2 = Archief mappen mailbox_alias_old3 = Archive mailbox_alias_new3 = Archived messages mailbox_alias_old4 = Archive mailbox_alias_new4 = Archived mail mailbox_alias_old5 = Archive mailbox_alias_new5 = Archives # spam folder mailbox_alias_old10 = Spam mailbox_alias_new10 = Junk mailbox_alias_old11 = Spam mailbox_alias_new11 = Junk E-mail mailbox_alias_old12 = Spam mailbox_alias_new12 = Ongewenste e-mail # drafst folder mailbox_alias_old20 = Drafts mailbox_alias_new20 = Concepten } https://wiki2.dovecot.org/Plugins/MailboxAlias

2 1