December 2018 - dovecot

doveadm proxy list repeats header line
by Michael Goth 20 Jan '19

20 Jan '19

Hi all, just a minor thing: Why does `doveadm proxy list` repeat the header line after each entry? Too me, that just makes the output harder to read. So instead of this: root@mail1 ~ # doveadm proxy list username proto src ip dest ip port info(a)domain1.de imap 80.152.196.98 222.133.127.53 993 username service src-ip dest-ip dest-port info(a)domain1.de imap 80.152.196.98 222.133.127.53 993 username service src-ip dest-ip dest-port info(a)domain1.de imap 80.152.196.98 222.133.127.53 993 username service src-ip dest-ip dest-port tj(a)domain1.de imap 83.149.131.71 222.133.127.53 993 username service src-ip dest-ip dest-port tj(a)domain1.de imap 83.149.131.71 222.133.127.53 993 I'd prefer this: root@mail1 ~ # doveadm proxy list username proto src ip dest ip port info(a)domain1.de imap 80.152.196.98 222.133.127.53 993 info(a)domain1.de imap 80.152.196.98 222.133.127.53 993 info(a)domain1.de imap 80.152.196.98 222.133.127.53 993 tj(a)domain1.de imap 83.149.131.71 222.133.127.53 993 tj(a)domain1.de imap 83.149.131.71 222.133.127.53 993 The repeated header lines also happen with other formatters. Regards, Michael

3 3

Panic…
by SH Development 20 Jan '19

20 Jan '19

I have started getting these in my log. What does this mean and what do I need to do? Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset): assertion failed: (offset < 0x40000000) Dec 12 23:29:44 mail dovecot: imap(jeff(a)stariontech.com): Error: Raw backtrace: /usr/lib64/dovecot/libdovecot.so.0(+0x3cafa) [0x7f38c5a2cafa] -> /usr/lib64/dovecot/libdovecot.so.0(+0x3cb46) [0x7f38c5a2cb46] -> /usr/lib64/dovecot/libdovecot.so.0(+0x16e2a) [0x7f38c5a06e2a] -> /usr/lib64/dovecot/libdovecot-storage.so.0(mail_index_uint32_to_offset+0x74) [0x7f38c5d0d3f4] -> /usr/lib64/dovecot/libdovecot-storage.so.0(+0x81abd) [0x7f38c5cf3abd] -> /usr/lib64/dovecot/libdovecot-storage.so.0(mail_cache_compress+0x77) [0x7f38c5cf4247] -> /usr/lib64/dovecot/libdovecot-storage.so.0(mail_index_sync_commit+0x1d2) [0x7f38c5d08012] -> /usr/lib64/dovecot/libdovecot-storage.so.0(+0x5fd88) [0x7f38c5cd1d88] -> /usr/lib64/dovecot/libdovecot-storage.so.0(+0x570a0) [0x7f38c5cc90a0] -> /usr/lib64/dovecot/libdovecot-storage.so.0(maildir_storage_sync_force+0x52) [0x7f38c5cc94c2] -> /usr/lib64/dovecot/libdovecot-storage.so.0(maildir_file_do+0x99) [0x7f38c5cc9f49] -> /usr/lib64/dovecot/libdovecot-storage.so.0(+0x59b7f) [0x7f38c5ccbb7f] -> /usr/lib64/dovecot/libdovecot-storage.so.0(index_mail_set_seq+0x112) [0x7f38c5cb64f2] -> /usr/lib64/dovecot/libdovecot-storage.so.0(index_storage_search_next_nonblock+0x16b) [0x7f38c5cbae9b] -> /usr/lib64/dovecot/libdovecot-storage.so.0(mailbox_search_next_nonblock+0x20) [0x7f38c5ca2240] -> /usr/lib64/dovecot/libdovecot-storage.so.0(mailbox_search_next+0x26) [0x7f38c5ca2296] -> dovecot/imap(imap_fetch_more+0x2bf) [0x41221f] -> dovecot/imap(cmd_fetch+0x42c) [0x40a33c] -> dovecot/imap() [0x40f90d] -> dovecot/imap() [0x40f9fa] -> dovecot/imap(client_handle_input+0x135) [0x40fc25] -> dovecot/imap(client_input+0x5f) [0x41054f] -> /usr/lib64/dovecot/libdovecot.so.0(io_loop_call_io+0x48) [0x7f38c5a37e98] -> /usr/lib64/dovecot/libdovecot.so.0(io_loop_handler_run+0x9f) [0x7f38c5a38e0f] -> /usr/lib64/dovecot/libdovecot.so.0(io_loop_run+0x28) [0x7f38c5a37e28] -> /usr/lib64/dovecot/libdovecot.so.0(master_service_run+0x13) [0x7f38c5a26293] -> dovecot/imap(main+0x2f9) [0x418849] -> /lib64/libc.so.6(__libc_start_main+0x10 Dec 12 23:29:44 mail dovecot: master: Error: service(imap): child 11157 killed with signal 6 (core dumps disabled)

6 5

I never touched nuthin'
by mick crane 20 Jan '19

20 Jan '19

hello, do you mind if I ask before I start poking about ? suddenly I notice that gmail is ignoring or because there is an error getmail is not sending the delete request. Mails are sent and received but not deleted gmail so I keep getting them. mick@rapunzel:~/.getmail$ getmail --rcfile getmailrc1 Delivery error (command deliver 1363 wrote to stderr: lda(mick,)Error: net_connect_unix(/var/run/dovecot//stats-writer) failed: Permission denied) I think is apt install dovecot on debian buster probably I updated yesterday but was working OK since so I dunno what happened. is log full or something ? advices appreciated mick -- Key ID C7D6E24C

4 6

2.3.4 doesnt compile on FreeBSD 11.2 using clang
by Chris 20 Jan '19

20 Jan '19

extract below, this has already been reported a while back but still no new patch, so this email is to serve as a reminder, if someone manually fixes it for the ports tree, I dont consider that a fix, ideally we need this fixed in the source code, as not everyone will install it from ports. Chris "clang40 -DHAVE_CONFIG_H -I. -I../.. -I../../src/lib -I../../src/lib-dns -I../../src/lib-test -I../../src/lib-settings -I../../src/lib-ssl-iostream -DPKG_RUNDIR=\""/var/run/dovecot"\" -DPKG_STATEDIR=\""/var/lib/dovecot"\" -DSYSCONFDIR=\""/etc/dovecot"\" -DBINDIR=\""/usr/bin"\" -I/usr/local/include -std=gnu99 -fdiagnostics-color -Wl,-rpath=/usr/local/llvm40/lib -O2 -pipe -march=native -fno-strict-aliasing -fstack-protector-strong -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=2 -Wall -W -Wmissing-prototypes -Wmissing-declarations -Wpointer-arith -Wchar-subscripts -Wformat=2 -Wbad-function-cast -Wno-duplicate-decl-specifier -Wstrict-aliasing=2 -I/usr/local/include -MT test-event-stats.o -MD -MP -MF .deps/test-event-stats.Tpo -c -o test-event-stats.o test-event-stats.c clang-4.0: warning: -Wl,-rpath=/usr/local/llvm40/lib: 'linker' input unused [-Wunused-command-line-argument] test-event-stats.c:101:8: warning: implicit declaration of function 'kill' is invalid in C99 [-Wimplicit-function-declaration] (void)kill(stats_pid, SIGKILL); ^ test-event-stats.c:101:24: error: use of undeclared identifier 'SIGKILL' (void)kill(stats_pid, SIGKILL); ^ 1 warning and 1 error generated. gmake[2]: *** [Makefile:656: test-event-stats.o] Error 1 gmake[2]: Leaving directory '/usr/local/directadmin/custombuild/dovecot-2.3.4/src/lib-master' gmake[1]: *** [Makefile:565: install-recursive] Error 1 gmake[1]: Leaving directory '/usr/local/directadmin/custombuild/dovecot-2.3.4/src' gmake: *** [Makefile:683: install-recursive] Error 1"

7 7

Re: Localhost imap server fails after upgrade from 2.2.33.2-1 to 1:2.3.2.1 (fwd)
by Chris BL 20 Jan '19

20 Jan '19

Hi Aki, Oops; I did not think carefully enough about your instructions. Here is the output from $ dovecot -n -c /home/meuser/dotfiles/auto-stanford-dovecot.conf # 2.3.2.1 (0719df592): /home/meuser/dotfiles/auto-stanford-dovecot.conf # Pigeonhole version 0.5.2 () # OS: Linux 4.18.0-13-generic x86_64 Ubuntu 18.10 ext4 # Hostname: cpbl-t450s doveconf: Warning: please set ssl_dh=</etc/dovecot/dh.pem doveconf: Warning: You can generate it with: dd if=/var/lib/dovecot/ssl-parameters.dat bs=1 skip=88 | openssl dhparam -inform der > /etc/dovecot/dh.pem mail_location = maildir:/home/meuser/imap/gmailStanford:LAYOUT=fs:INBOX=/home/meuser/imap/gmailStanford/INBOX service stats { unix_listener stats-writer { mode = 0666 } } ssl_dh = # hidden, use -P to show it verbose_proctitle = yes I then followed the instructions in the Warning lines above and now I get: dovecot -n -c /home/meuser/dotfiles/auto-stanford-dovecot.conf # 2.3.2.1 (0719df592): /home/meuser/dotfiles/auto-stanford-dovecot.conf # Pigeonhole version 0.5.2 () # OS: Linux 4.18.0-13-generic x86_64 Ubuntu 18.10 ext4 # Hostname: cpbl-t450s mail_location = maildir:/home/meuser/imap/gmailStanford:LAYOUT=fs:INBOX=/home/meuser/imap/gmailStanford/INBOX service stats { unix_listener stats-writer { mode = 0666 } } ssl_dh = # hidden, use -P to show it verbose_proctitle = yes However, this does not help my primary symptom: $ /usr/lib/dovecot/imap -c /home/meuser/dotfiles/auto-stanford-dovecot.conf imap(meuser,)Error: net_connect_unix(/var/run/dovecot/stats-writer) failed: Permission denied * PREAUTH [CAPABILITY IMAP4rev1 SASL-IR LOGIN-REFERRALS ID ENABLE IDLE SORT SORT=DISPLAY THREAD=REFERENCES THREAD=REFS THREAD=ORDEREDSUBJECT MULTIAPPEND URL-PARTIAL CATENATE UNSELECT CHILDREN NAMESPACE UIDPLUS LIST-EXTENDED I18NLEVEL=1 CONDSTORE QRESYNC ESEARCH ESORT SEARCHRES WITHIN CONTEXT=SEARCH LIST-STATUS BINARY MOVE SNIPPET=FUZZY LITERAL+ NOTIFY] Logged in as meuser Thanks! Chris On Mon, Dec 31, 2018 at 10:27 AM Aki Tuomi <aki.tuomi(a)open-xchange.com> wrote: Did you remove the service section before taking doveconf -n? 'cos I can't see it here.. Also, did you restart dovecot after config change? Aki > On 31 December 2018 at 16:54 Chris BL <cpblpublic+dovecot(a)gmail.com> wrote: > > > Hi Aki, > > Yes, the same connect error: imap(meuser,)Error: net_connect_unix(/var/run/dovecot/stats-writer) failed: Permission denied > > The mail location in "doveconf -n" (belo) does not reflect my preferences. > > In Alpine, if I acknowledge the error I get, which tells me to add > novalidate-cert in my pinerc file, it prompts me for my POSIX username and > password. After that, I get my /var/spool/mail inbox, which is not what I > want. > > > doveconf -n > # 2.3.2.1 (0719df592): /etc/dovecot/dovecot.conf > # Pigeonhole version 0.5.2 () > # OS: Linux 4.18.0-13-generic x86_64 Ubuntu 18.10 > # Hostname: myhost-t450s > mail_location = mbox:~/mail:INBOX=/var/mail/%u > mail_privileged_group = mail > namespace inbox { > inbox = yes > location = > mailbox Drafts { > special_use = \Drafts > } > mailbox Junk { > special_use = \Junk > } > mailbox Sent { > special_use = \Sent > } > mailbox "Sent Messages" { > special_use = \Sent > } > mailbox Trash { > special_use = \Trash > } > prefix = > } > passdb { > driver = pam > } > protocols = " imap" > ssl_cert = </etc/dovecot/private/dovecot.pem > ssl_client_ca_dir = /etc/ssl/certs > ssl_dh = # hidden, use -P to show it > ssl_key = # hidden, use -P to show it > userdb { > driver = passwd > } > > > > On Mon, 31 Dec 2018, Aki Tuomi wrote: > > > You are still getting the connect error? > > > > Can you share your doveconf -n? > > > > Aki > > > > > On 31 December 2018 at 16:42 cpblpublic+dovecot(a)gmail.com wrote: > > > > > > > > > Hi Aki, > > > > > > Thanks. I put that in the .conf file I mentioned, and it made no > > > difference. > > > > > > Chris > > > > > > > Hi! > > > > > > > > In your case it's probably easiest to change > > > > > > > > service stats { > > > > unix_listener stats-writer { > > > > mode = 0666 > > > > } > > > > } > > > > > > > > Aki > > > > > > > > > On 31 December 2018 at 16:05 cpblpublic+dovecot(a)gmail.com wrote: > > > > > > > > > > > > > > > > > > > > I use a localhost dovecot imap server in order to access maildir folders from Alpine (see 2009 instructions for my set up here > > > > > https://cpbl.wordpress.com/2009/11/07/alpine-offlineimap-and-gmail-under-ub… ) > > > > > > > > > > My configuration has worked nicely since 2009, but failed after a recent upgrade of dovecot (during basic upgrade from Ubuntu 18.04 to 18.10). > > > > > > > > > > The version of Alpine did not change. Uninstalling dovecot-core and dovecot-imapd, and reinstalling the older versions, fully fixes the problem. > > > > > > > > > > I would like to know how to get my configuration working with the new version of dovecot. > > > > > > > > > > Here's what the problem looks like: > > > > > > > > > > I have a file auto-dovecot.conf with only the following two lines. > > > > > > > > > > verbose_proctitle = yes > > > > > mail_location = maildir:/home/meuser/imap/gmailStanford:LAYOUT=fs:INBOX=/home/meuser/imap/gmailStanford/INBOX > > > > > > > > > > Other /etc/ files are unchanged from installation defaults. > > > > > > > > > > Alpine calls imapd when it starts, with the following command: > > > > > > > > > > /usr/lib/dovecot/imap -c /home/meuser/dotfiles/auto-dovecot.conf > > > > > > > > > > > > > > > When I run that command, I get: > > > > > > > > > > imap(meuser,)Error: net_connect_unix(/var/run/dovecot/stats-writer) failed: Permission denied > > > > > * PREAUTH [CAPABILITY IMAP4rev1 SASL-IR LOGIN-REFERRALS ID ENABLE IDLE > > > > > SORT SORT=DISPLAY THREAD=REFERENCES THREAD=REFS THREAD=ORDEREDSUBJECT > > > > > MULTIAPPEND URL-PARTIAL CATENATE UNSELECT CHILDREN NAMESPACE UIDPLUS > > > > > LIST-EXTENDED I18NLEVEL=1 CONDSTORE QRESYNC ESEARCH ESORT SEARCHRES WITHIN > > > > > CONTEXT=SEARCH LIST-STATUS BINARY MOVE SNIPPET=FUZZY LITERAL+ NOTIFY] > > > > > Logged in as meuser > > > > > > > > > > > > > > > > > > > > > > > > > so I am guessing that the first line is the issue, since when the older version I get instead: > > > > > > > > > > * PREAUTH [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE > > > > > IDLE SORT SORT=DISPLAY THREAD=REFERENCES THREAD=REFS THREAD=ORDEREDSUBJECT > > > > > MULTIAPPEND URL-PARTIAL CATENATE UNSELECT CHILDREN NAMESPACE UIDPLUS > > > > > LIST-EXTENDED I18NLEVEL=1 CONDSTORE QRESYNC ESEARCH ESORT SEARCHRES WITHIN > > > > > CONTEXT=SEARCH LIST-STATUS BINARY MOVE] Logged in as meuser > > > > > > > > > > > > > > > Can anyone help me? I cannot find documentation for using a localhost server for Alpine, except my own from 2009. > > > > > > > > > > Many thanks! > > > > > > > > > > Chris > > > > > >

3 6

Request: Pigeonhole - strip CWFS from message-id logs
by Lee Maguire 20 Jan '19

20 Jan '19

Normally for a log line containing the contents of a Message-Id, it is logged like the following Nov 29 11:41:27 xxx dovecot[211]: lmtp(lee)<30167><XXXXX>: sieve: msgid=<xxxx(a)example.net>: stored mail into mailbox 'Notifications' However, if there is CFWS other than a space, it changes the format of the log line (potentially making the logs harder to process - eg via “logcheck" rules) Nov 29 11:50:09 xxx dovecot[401]: lmtp(lee)<55724><XXXXX>: sieve: msgid=? <xxxx(a)example.com>: stored mail into mailbox ‘Notifications' A message-id line broken up is valid per RFC 5322 and header whitespace shouldn’t be significant for logging purposes https://tools.ietf.org/html/rfc5322#section-3.6.4 https://tools.ietf.org/html/rfc5322#section-3.2.2

2 2

Re: Dovecot 2.3.4 crash
by Timo Sirainen 20 Jan '19

20 Jan '19

On 2 Dec 2018, at 22.22, Guillaume via dovecot <dovecot(a)dovecot.org> wrote: > > I also have this kind of segfault since the update : > > Dec 2 21:12:11 xxxxxxx dovecot: auth-worker: Error: *** Error in `dovecot/auth': double free or corruption (fasttop): 0x000055573bb99f70 Is this easy to reproduce? Can you try with valgrind? It will slow down the logins a bit though. service auth-worker { executable = /usr/bin/valgrind -q --vgdb=no /usr/lib/dovecot/auth -w } At least one good thing about this crash is that it seems to happen only at deinit, so it's not impacting users.

4 6

Localhost imap server fails after upgrade from 2.2.33.2-1 to 1:2.3.2.1
by cpblpublic+dovecot＠gmail.com 20 Jan '19

20 Jan '19

I use a localhost dovecot imap server in order to access maildir folders from Alpine (see 2009 instructions for my set up here https://cpbl.wordpress.com/2009/11/07/alpine-offlineimap-and-gmail-under-ub… ) My configuration has worked nicely since 2009, but failed after a recent upgrade of dovecot (during basic upgrade from Ubuntu 18.04 to 18.10). The version of Alpine did not change. Uninstalling dovecot-core and dovecot-imapd, and reinstalling the older versions, fully fixes the problem. I would like to know how to get my configuration working with the new version of dovecot. Here's what the problem looks like: I have a file auto-dovecot.conf with only the following two lines. verbose_proctitle = yes mail_location = maildir:/home/meuser/imap/gmailStanford:LAYOUT=fs:INBOX=/home/meuser/imap/gmailStanford/INBOX Other /etc/ files are unchanged from installation defaults. Alpine calls imapd when it starts, with the following command: /usr/lib/dovecot/imap -c /home/meuser/dotfiles/auto-dovecot.conf When I run that command, I get: imap(meuser,)Error: net_connect_unix(/var/run/dovecot/stats-writer) failed: Permission denied * PREAUTH [CAPABILITY IMAP4rev1 SASL-IR LOGIN-REFERRALS ID ENABLE IDLE SORT SORT=DISPLAY THREAD=REFERENCES THREAD=REFS THREAD=ORDEREDSUBJECT MULTIAPPEND URL-PARTIAL CATENATE UNSELECT CHILDREN NAMESPACE UIDPLUS LIST-EXTENDED I18NLEVEL=1 CONDSTORE QRESYNC ESEARCH ESORT SEARCHRES WITHIN CONTEXT=SEARCH LIST-STATUS BINARY MOVE SNIPPET=FUZZY LITERAL+ NOTIFY] Logged in as meuser so I am guessing that the first line is the issue, since when the older version I get instead: * PREAUTH [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE SORT SORT=DISPLAY THREAD=REFERENCES THREAD=REFS THREAD=ORDEREDSUBJECT MULTIAPPEND URL-PARTIAL CATENATE UNSELECT CHILDREN NAMESPACE UIDPLUS LIST-EXTENDED I18NLEVEL=1 CONDSTORE QRESYNC ESEARCH ESORT SEARCHRES WITHIN CONTEXT=SEARCH LIST-STATUS BINARY MOVE] Logged in as meuser Can anyone help me? I cannot find documentation for using a localhost server for Alpine, except my own from 2009. Many thanks! Chris

5 9

Issue with LMTP proxying and port number
by Steven Craig 20 Jan '19

20 Jan '19

Hello there, Everything was working fine on Dovecot 2.2.10 (on CentOS 7), but after updating to version 2.2.36, our director servers are not able to proxy LMTP. We are sending mail from exim to the local Dovecot LMTP socket, which then used to send it to our internal mail servers on port 24. Besides the update, nothing has changed in the config files. The configuration has been working great for months … Then we had a great idea of doing holiday maintenance. (Currently, we are working around this issue by having exim send mail to the IP and port, instead of the socket.) Doing a tcpdump capture shows no TCP traffic either. The logs seem to say that it is trying to go to port 0, so my guess is that it’s not getting the port directive from either static or sql — since the docs state that if these settings aren't specified, it will always use the same connection type for the proxy that it received the connection on. Any thoughts? I can share config if necessary.

2 5

Authentication/Penalty disabled (socket mode=0) introduces constant 5 sec delays (2.27 on debian 9)
by Ludovic Pouzenc 20 Jan '19

20 Jan '19

Hi, I hit a bizare problem with dovecot 2.2.7 on debian 9 with LMTP enabled and auth/penalty disabled as documented here : https://wiki.dovecot.org/Authentication/Penalty Use case : I run a swaks command to send an email to an exim4 that tries to make a callout to dovecot-lmtp. At RCPT TO: swaks hangs 5.0<something-small> seconds then process normally (exim is waiting for callout completion). with strace, I see 5 second delay with many tries to socket connection. (PID 9652 was an auth process freshly forked) [pid 9652] socket(AF_UNIX, SOCK_STREAM, 0) = 14 [pid 9652] fcntl(14, F_GETFL) = 0x2 (flags O_RDWR) [pid 9652] fcntl(14, F_SETFL, O_RDWR|O_NONBLOCK) = 0 [pid 9652] connect(14, {sa_family=AF_UNIX, sun_path="anvil-auth-penalty"}, 110) = -1 ECONNREFUSED (Connection refused) [pid 9652] close(14) = 0 [pid 9652] nanosleep({tv_sec=0, tv_nsec=20000000}, NULL) = 0 [pid 9652] socket(AF_UNIX, SOCK_STREAM, 0) = 14 [pid 9652] fcntl(14, F_GETFL) = 0x2 (flags O_RDWR) [pid 9652] fcntl(14, F_SETFL, O_RDWR|O_NONBLOCK) = 0 [pid 9652] connect(14, {sa_family=AF_UNIX, sun_path="anvil-auth-penalty"}, 110) = -1 ECONNREFUSED (Connection refused) [pid 9652] close(14) = 0 [pid 9652] nanosleep({tv_sec=0, tv_nsec=50000000}, NULL) = 0 [pid 9652] socket(AF_UNIX, SOCK_STREAM, 0) = 14 [pid 9652] fcntl(14, F_GETFL) = 0x2 (flags O_RDWR) [pid 9652] fcntl(14, F_SETFL, O_RDWR|O_NONBLOCK) = 0 [pid 9652] connect(14, {sa_family=AF_UNIX, sun_path="anvil-auth-penalty"}, 110) = -1 ECONNREFUSED (Connection refused) [pid 9652] close(14) = 0 [pid 9652] nanosleep({tv_sec=0, tv_nsec=90000000}, NULL) = 0 with ddd I get to: src/lib-master/anvil-client.c: int anvil_client_connect(struct anvil_client *client, bool retry) { //[...] fd = retry ? net_connect_unix_with_retries(client->path, 5000) : net_connect_unix(client->path); //[...] and retry is forced to TRUE by the caller and net_connect_unix_with_retries retries in case of ECONNREFUSED. How I get into it : ssh -X root@telegraphe-test apt install dovecot-dbg cd /dev/shm apt source dovecot cd dovecot-2.2.27 pidof dovecot ddd /usr/sbin/dovecot set follow-fork-mode child attach 11833 cont # Send an e-mail from swaks to exim that use transport=smtp in LMTP mode to dovecot-lmtp, press interrupt while exim is blocking after RCPT TO: (gdb) bt #0 0x00007f81528af270 in __nanosleep_nocancel () at ../sysdeps/unix/syscall-template.S:84 #1 0x00007f81528d8b84 in usleep (useconds=<optimized out>) at ../sysdeps/posix/usleep.c:32 #2 0x00007f815329368e in net_connect_unix_with_retries (path=0x562dc200ce10 <error: Cannot access memory at address 0x562dc200ce10>, msecs=msecs@entry=5000) at net.c:347 #3 0x00007f815320ce0d in anvil_client_connect (client=0x562dc200cda0, retry=retry@entry=true) at anvil-client.c:136 #4 0x0000562dc1429f5d in auth_penalty_init (path=0x562dc1451846 <error: Cannot access memory at address 0x562dc1451846>) at auth-penalty.c:37 #5 0x0000562dc1424166 in main_preinit () at main.c:202 #6 main (argc=<optimized out>, argv=<optimized out>) at main.c:396 (gdb) bt full #1 0x00007f81528d8b84 in usleep (useconds=<optimized out>) at ../sysdeps/posix/usleep.c:32 ts = {tv_sec = 0, tv_nsec = 80000000} #2 0x00007f815329368e in net_connect_unix_with_retries (path=0x562dc200ce10 <error: Cannot access memory at address 0x562dc200ce10>, msecs=msecs@entry=5000) at net.c:347 start = {tv_sec = 1545319486, tv_usec = 241864} now = {tv_sec = 1545319490, tv_usec = 198061} fd = -1 #3 0x00007f815320ce0d in anvil_client_connect (client=0x562dc200cda0, retry=retry@entry=true) at anvil-client.c:136 fd = <optimized out> __FUNCTION__ = <error reading variable __FUNCTION__ (Cannot access memory at address 0x7f81532a8260)> #4 0x0000562dc1429f5d in auth_penalty_init (path=0x562dc1451846 <error: Cannot access memory at address 0x562dc1451846>) at auth-penalty.c:37 No locals. #5 0x0000562dc1424166 in main_preinit () at main.c:202 mod_set = <error reading variable mod_set (Cannot access memory at address 0x7ffda885db80)> #6 main (argc=<optimized out>, argv=<optimized out>) at main.c:396 c = <optimized out> Backtrace stopped: Cannot access memory at address 0x7ffda885dbf8 (gdb) Code I've read : src/auth/main.c: static void main_preinit(void) if (!worker) auth_penalty = auth_penalty_init(AUTH_PENALTY_ANVIL_PATH); auth_request_stats_init(); src/auth/auth-penalty.c: struct auth_penalty *auth_penalty_init(const char *path) if (anvil_client_connect(penalty->client, TRUE) < 0) penalty->disabled = TRUE; else { src/lib-master/anvil-client.c: int anvil_client_connect(struct anvil_client *client, bool retry) fd = retry ? net_connect_unix_with_retries(client->path, 5000) : net_connect_unix(client->path); src/lib/net.c : int net_connect_unix_with_retries(const char *path, unsigned int msecs) { struct timeval start, now; int fd; if (gettimeofday(&start, NULL) < 0) i_panic("gettimeofday() failed: %m"); do { fd = net_connect_unix(path); if (fd != -1 || (errno != EAGAIN && errno != ECONNREFUSED)) // <------------------ HERE, I go into ECONNREFUSED case during 5 seconds break; /* busy. wait for a while. */ usleep(((rand() % 10) + 1) * 10000); if (gettimeofday(&now, NULL) < 0) i_panic("gettimeofday() failed: %m"); } while (timeval_diff_msecs(&now, &start) < (int)msecs); return fd; } Additionnal environment infos (mailboxes are NFS-backed) : lsb_release -a No LSB modules are available. Distributor ID: Debian Description: Debian GNU/Linux 9.2 (stretch) Release: 9.2 Codename: stretch mount | grep ^/ /dev/sda1 on / type ext4 (rw,relatime,errors=remount-ro,data=ordered) mount | grep nfs nfs1:/mail/maildir on /var/maildir type nfs (rw,relatime,vers=3,rsize=65536,wsize=65536,namlen=255,hard,proto=tcp,timeo=600,retrans=2,sec=sys,mountaddr=172.16.2.28,mountvers=3,mountport=635,mountproto=udp,local_lock=none,addr=172.16.2.28) nfs1:/mail on /var/mail type nfs (rw,relatime,vers=3,rsize=65536,wsize=65536,namlen=255,hard,proto=tcp,timeo=600,retrans=2,sec=sys,mountaddr=172.16.2.28,mountvers=3,mountport=635,mountproto=udp,local_lock=none,addr=172.16.2.28) cifs1:/homepermanents/info/lpouzenc on /home/lpouzenc type nfs (rw,nosuid,nodev,relatime,vers=3,rsize=65536,wsize=65536,namlen=255,hard,proto=tcp,timeo=600,retrans=2,sec=sys,mountaddr=172.16.2.29,mountvers=3,mountport=635,mountproto=udp,local_lock=none,addr=172.16.2.29) telegraphe-test:~# apt-cache policy dovecot-core dovecot-core: Installé : 1:2.2.27-3+deb9u2 Candidat : 1:2.2.27-3+deb9u2 Table de version : *** 1:2.2.27-3+deb9u2 500 500 http://miroir/debian stretch/main amd64 Packages 500 http://security.debian.org/debian-security stretch/updates/main amd64 Packages 100 /var/lib/dpkg/status telegraphe-test:~# dovecot -n # 2.2.27 (c0f36b0): /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.16 (fed8554) doveconf: Warning: service auth { client_limit=10000 } is lower than required under max. load (10240) # OS: Linux 4.9.0-4-amd64 x86_64 Debian 9.2 nfs auth_verbose = yes default_client_limit = 10000 default_process_limit = 2048 lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes mail_debug = yes mail_fsync = always mail_location = maildir:/var/mail/maildir/%u managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext mmap_disable = yes namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = separator = / } passdb { driver = pam } plugin { sieve = file:/var/mail/mailconf/%1u/%u/sieve;active=/var/mail/mailconf/%1u/%u/.dovecot.sieve sieve_before = /var/mail/mailconf/global/sieve/before.d sieve_global = /var/mail/mailconf/global/sieve sieve_vacation_dont_check_recipient = yes } protocols = " imap lmtp sieve sieve" service anvil { unix_listener anvil-auth-penalty { mode = 00 } } service lmtp { inet_listener lmtp { port = 24 } } service managesieve { process_limit = 16 } ssl_cert = </etc/ssl/certs/telegraphe7_cert.pem ssl_key = # hidden, use -P to show it syslog_facility = local0 userdb { driver = passwd } verbose_proctitle = yes protocol lmtp { auth_username_format = %n mail_plugins = " sieve" } protocol imap { mail_max_userip_connections = 20 } Could you see a config tuning that keeps auth-penalty out of the way (it seems to behaves badly here, because we have perdition IMAP proxy in front, and it keeps track only of his IP and adds 2/4/8/15s delays to "random" legit clients. Could it be saved with a dedicated config entry to disable auth-penalty ? Is there solution to have auth-penalty working while having perdition IMAP proxy ? Regards, Ludovic Pouzenc -- Ludovic POUZENC - Ingénieur Système IMT Mines Albi (http://www.imt-mines-albi.fr) 81013 ALBI CT Cedex 09 - Tel : 05 63 49 33 56

2 3