November 2019 - dovecot

Doveadm replicator ssl issues
by Miro Igov 20 Nov '19

20 Nov '19

Hello, I have 2 Dovecot 2.3.8 servers running SSL with valid wildcard certificates. Email clients connect fine, https://www.immuniweb.com/ssl/ tests show certificates are ok. However I can't make replication work when I add ssl = yes. Without ssl it works ok. I added verbose_ssl in config and error log shows: dovecot: doveadm(149.x.x.x): Error: SSL handshake failed: SSL_accept() failed: error:140760FC:SSL routines:SSL23_GET_CLIENT_HELLO:unknown protocol >From the other server 149.x.x.x I tested with openssl: openssl s_client -connect 188.x.x.x:12333 -crlf -CAfile /etc/pki/tls/cert.pem CONNECTED(00000003) depth=2 C = US, ST = New Jersey, L = Jersey City, O = The USERTRUST Network, CN = USERTrust RSA Certification Authority verify return:1 depth=1 C = GB, ST = Greater Manchester, L = Salford, O = Sectigo Limited, CN = Sectigo RSA Organization Validation Secure Server CA verify return:1 depth=0 C = FR, postalCode = 34980, ST = Occitanie, L = Montpellier, street = 123 Main str, O = My Company, OU = PremiumSSL Wildcard, CN = *.domain.com verify return:1 . . SSL-Session: Protocol : TLSv1.2 Cipher : ECDHE-RSA-AES256-SHA384 Session-ID: 95CF7F07702A50CB7CDC5D478986B5A4682EA945C487E770550EE48BFEA53EBC Session-ID-ctx: Master-Key: ECC14F2EE03C04474992A651B3695D78A27A0B07529DB35F61F6FB5F5A5D51395432BDFF37F2 41BD4B3C4B9E1AB6A929 Key-Arg : None Krb5 Principal: None PSK identity: None PSK identity hint: None Start Time: 1574108251 Timeout : 300 (sec) Verify return code: 0 (ok) The configuration of the 2 servers below. 188.x.x.x # 2.3.8 (9df20d2db): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.8 (b7b03ba2) # OS: Linux 2.6.32-754.6.3.el6.x86_64 x86_64 CentOS release 6.10 (Final) # Hostname: login.domain.com default_vsz_limit = 512 M doveadm_password = # hidden, use -P to show it mail_plugins = " notify replication" managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext mbox_write_locks = fcntl namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { driver = pam } plugin { mail_replica = tcp:149.x.x.x:12333 sieve = file:~/sieve;active=~/.dovecot.sieve } protocols = imap pop3 replication_full_sync_interval = 10 mins service aggregator { fifo_listener replication-notify-fifo { mode = 0666 } unix_listener replication-notify { mode = 0666 } } service doveadm { inet_listener { port = 12333 ssl = yes } } service replicator { process_min_avail = 1 unix_listener replicator-doveadm { mode = 0666 } } ssl_cert = </etc/dovecot/ssl_chain.pem ssl_cipher_list = ECDHE-RSA-AES256-SHA384:AES256-SHA256:AES256-SHA256:HIGH:MEDIUM:+TLSv1:+TLSv 1.1:+TLSv1.2:!RC4:!IDEA:!3DES:!MD5:!ADH:!aNULL:!eNULL:!NULL:!DH:!ADH:!EDH:!A ESGCM:!CAMELLIA:!SEED ssl_client_ca_file = /etc/pki/tls/cert.pem ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { driver = passwd } verbose_ssl = yes local 91.x.x.x { protocol imap { ssl_cert = </etc/dovecot/ssl_chain.pem ssl_key = # hidden, use -P to show it } } local 91.x.x.x { protocol pop3 { ssl_cert = </etc/dovecot/ssl_chain.pem ssl_key = # hidden, use -P to show it } } 149.x.x.x # 2.3.8 (9df20d2db): /etc/dovecot/dovecot.conf # OS: Linux 2.6.32-754.6.3.el6.x86_64 x86_64 CentOS release 6.10 (Final) # Hostname: prime.domain.com auth_mechanisms = plain login default_vsz_limit = 1 G disable_plaintext_auth = no doveadm_password = # hidden, use -P to show it mail_location = maildir:~/Maildir mail_plugins = " notify replication" mbox_write_locks = fcntl namespace inbox { inbox = yes location = mailbox Archive { auto = subscribe special_use = \Archive } mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Spam { auto = subscribe special_use = \Junk } mailbox Trash { special_use = \Trash } prefix = } passdb { args = session=yes setcred=yes failure_show_msg=yes dovecot driver = pam } plugin { mail_replica = tcp:188.x.x.x:12333 } protocols = imap pop3 replication_full_sync_interval = 10 mins replication_max_conns = 11 service aggregator { fifo_listener replication-notify-fifo { mode = 0666 } unix_listener replication-notify { mode = 0666 } } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0666 user = postfix } } service doveadm { inet_listener { port = 12333 ssl = yes } } service replicator { process_min_avail = 1 unix_listener replicator-doveadm { mode = 0666 } } ssl_cert = </etc/dovecot/ssl_chain.pem ssl_cipher_list = ECDHE-RSA-AES256-SHA384:AES256-SHA256:AES256-SHA256:HIGH:MEDIUM:+TLSv1:+TLSv 1.1:+TLSv1.2:!RC4:!IDEA:!3DES:!MD5:!ADH:!aNULL:!eNULL:!NULL:!DH:!ADH:!EDH:!A ESGCM:!CAMELLIA:!SEED ssl_client_ca_file = /etc/pki/tls/cert.pem ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { driver = passwd } protocol imap { mail_max_userip_connections = 50 } protocol pop3 { pop3_uidl_format = %08Xu%08Xv } local 178.x.x.x { protocol imap { ssl_cert = </etc/dovecot/ssl_chain.pem ssl_key = # hidden, use -P to show it } } local 178.x.x.x { protocol pop3 { ssl_cert = </etc/dovecot/ssl_chain.pem ssl_key = # hidden, use -P to show it } } Your help will be great appreciated.

2 2

[SOLVED] Doveadm replicator ssl issues
by Miro Igov 20 Nov '19

20 Nov '19

Solved, thank you. TCPS was the issue. From: Aki Tuomi <aki.tuomi(a)open-xchange.com> Sent: Wednesday, November 20, 2019 08:54 To: Miro Igov <miro.igov(a)gmail.com>; dovecot(a)dovecot.org Subject: Re: Doveadm replicator ssl issues On 18.11.2019 22.30, Miro Igov via dovecot wrote: Hello, I have 2 Dovecot 2.3.8 servers running SSL with valid wildcard certificates. Email clients connect fine, https://www.immuniweb.com/ssl/ tests show certificates are ok. However I can't make replication work when I add ssl = yes. Without ssl it works ok. I added verbose_ssl in config and error log shows: dovecot: doveadm(149.x.x.x): Error: SSL handshake failed: SSL_accept() failed: error:140760FC:SSL routines:SSL23_GET_CLIENT_HELLO:unknown protocol >From the other server 149.x.x.x I tested with openssl: openssl s_client -connect 188.x.x.x:12333 -crlf -CAfile /etc/pki/tls/cert.pem CONNECTED(00000003) depth=2 C = US, ST = New Jersey, L = Jersey City, O = The USERTRUST Network, CN = USERTrust RSA Certification Authority verify return:1 depth=1 C = GB, ST = Greater Manchester, L = Salford, O = Sectigo Limited, CN = Sectigo RSA Organization Validation Secure Server CA verify return:1 depth=0 C = FR, postalCode = 34980, ST = Occitanie, L = Montpellier, street = 123 Main str, O = My Company, OU = PremiumSSL Wildcard, CN = *.domain.com verify return:1 . . SSL-Session: Protocol : TLSv1.2 Cipher : ECDHE-RSA-AES256-SHA384 Session-ID: 95CF7F07702A50CB7CDC5D478986B5A4682EA945C487E770550EE48BFEA53EBC Session-ID-ctx: Master-Key: ECC14F2EE03C04474992A651B3695D78A27A0B07529DB35F61F6FB5F5A5D51395432BDFF37F2 41BD4B3C4B9E1AB6A929 Key-Arg : None Krb5 Principal: None PSK identity: None PSK identity hint: None Start Time: 1574108251 Timeout : 300 (sec) Verify return code: 0 (ok) The configuration of the 2 servers below. 188.x.x.x # 2.3.8 (9df20d2db): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.8 (b7b03ba2) # OS: Linux 2.6.32-754.6.3.el6.x86_64 x86_64 CentOS release 6.10 (Final) # Hostname: login.domain.com default_vsz_limit = 512 M doveadm_password = # hidden, use -P to show it mail_plugins = " notify replication" managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext mbox_write_locks = fcntl namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { driver = pam } plugin { mail_replica = tcp:149.x.x.x:12333 sieve = file:~/sieve;active=~/.dovecot.sieve <file://~/sieve;active=~/.dovecot.sieve> } protocols = imap pop3 replication_full_sync_interval = 10 mins service aggregator { fifo_listener replication-notify-fifo { mode = 0666 } unix_listener replication-notify { mode = 0666 } } service doveadm { inet_listener { port = 12333 ssl = yes } } service replicator { process_min_avail = 1 unix_listener replicator-doveadm { mode = 0666 } } ssl_cert = </etc/dovecot/ssl_chain.pem ssl_cipher_list = ECDHE-RSA-AES256-SHA384:AES256-SHA256:AES256-SHA256:HIGH:MEDIUM:+TLSv1:+TLSv 1.1:+TLSv1.2:!RC4:!IDEA:!3DES:!MD5:!ADH:!aNULL:!eNULL:!NULL:!DH:!ADH:!EDH:!A ESGCM:!CAMELLIA:!SEED ssl_client_ca_file = /etc/pki/tls/cert.pem ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { driver = passwd } verbose_ssl = yes local 91.x.x.x { protocol imap { ssl_cert = </etc/dovecot/ssl_chain.pem ssl_key = # hidden, use -P to show it } } local 91.x.x.x { protocol pop3 { ssl_cert = </etc/dovecot/ssl_chain.pem ssl_key = # hidden, use -P to show it } } 149.x.x.x # 2.3.8 (9df20d2db): /etc/dovecot/dovecot.conf # OS: Linux 2.6.32-754.6.3.el6.x86_64 x86_64 CentOS release 6.10 (Final) # Hostname: prime.domain.com auth_mechanisms = plain login default_vsz_limit = 1 G disable_plaintext_auth = no doveadm_password = # hidden, use -P to show it mail_location = maildir:~/Maildir mail_plugins = " notify replication" mbox_write_locks = fcntl namespace inbox { inbox = yes location = mailbox Archive { auto = subscribe special_use = \Archive } mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Spam { auto = subscribe special_use = \Junk } mailbox Trash { special_use = \Trash } prefix = } passdb { args = session=yes setcred=yes failure_show_msg=yes dovecot driver = pam } plugin { mail_replica = tcp:188.x.x.x:12333 } protocols = imap pop3 replication_full_sync_interval = 10 mins replication_max_conns = 11 service aggregator { fifo_listener replication-notify-fifo { mode = 0666 } unix_listener replication-notify { mode = 0666 } } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0666 user = postfix } } service doveadm { inet_listener { port = 12333 ssl = yes } } service replicator { process_min_avail = 1 unix_listener replicator-doveadm { mode = 0666 } } ssl_cert = </etc/dovecot/ssl_chain.pem ssl_cipher_list = ECDHE-RSA-AES256-SHA384:AES256-SHA256:AES256-SHA256:HIGH:MEDIUM:+TLSv1:+TLSv 1.1:+TLSv1.2:!RC4:!IDEA:!3DES:!MD5:!ADH:!aNULL:!eNULL:!NULL:!DH:!ADH:!EDH:!A ESGCM:!CAMELLIA:!SEED ssl_client_ca_file = /etc/pki/tls/cert.pem ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { driver = passwd } protocol imap { mail_max_userip_connections = 50 } protocol pop3 { pop3_uidl_format = %08Xu%08Xv } local 178.x.x.x { protocol imap { ssl_cert = </etc/dovecot/ssl_chain.pem ssl_key = # hidden, use -P to show it } } local 178.x.x.x { protocol pop3 { ssl_cert = </etc/dovecot/ssl_chain.pem ssl_key = # hidden, use -P to show it } } Hi! You need to use tcps in mail_replica. Aki

1 0

[SOLVED] Doveadm replicator ssl issues
by Miro Igov 20 Nov '19

20 Nov '19

Solved, thank you! TCPS was the problem. Hi! You need to use tcps in mail_replica. Aki

1 0

http API for IMAP
by Thomas Güttler 20 Nov '19

20 Nov '19

10 22

Panic: file smtp-client-connection.c: line 1142 (smtp_client_connection_established)
by Dirk 20 Nov '19

20 Nov '19

I'm using dovecot in a multi server setup. Two directors forward pop3, imap and smtp to backend dovecots with their central storage on NFS. Yesterday I stumbled upon these log lines: 2019-11-18 20:17:51 lmtp(17274): Info: Connect from 172.22.1.6 2019-11-18 20:17:51 lmtp(17274): Panic: file smtp-client-connection.c: line 1142 (smtp_client_connection_established): assertion failed: (!conn->connect_succeeded) 2019-11-18 20:17:51 lmtp(17274): Fatal: master: service(lmtp): child 17274 killed with signal 6 (core not dumped - https://dovecot.org/bugreport.html#coredumps - set /proc/sys/fs/suid_dumpable to 2) Is a core dump required to find the source of that error? Thanks for any help! $ doveconf -n # 2.3.4.1 (f79e8e7e4): /etc/dovecot/dovecot.conf # OS: Linux 4.9.0-8-amd64 x86_64 # Hostname: m03.company.com auth_cache_negative_ttl = 65 secs auth_cache_ttl = 3 mins auth_cache_verify_password_with_worker = yes auth_mechanisms = plain login auth_verbose = yes debug_log_path = /dev/stdout default_client_limit = 10400 default_process_limit = 1024 default_vsz_limit = 1 G deliver_log_format = msgid=%m: %s %{session_time} %$ director_mail_servers = 10.10.10.2 10.10.10.3 director_servers = 10.10.1.2 10.10.1.3 imap_id_log = * imap_max_line_length = 2 M import_environment = TZ CORE_OUTOFMEM CORE_ERROR info_log_path = /dev/stdout instance_name = dovecot_director listen = 10.10.1.3,:: lmtp_proxy = yes log_path = /dev/stderr log_timestamp = "%Y-%m-%d %H:%M:%S " login_log_format_elements = user=<%u> method=%m rip=%r lip=%l mpid=%e %c %k session=<%{session}> mail_max_userip_connections = 250 passdb { args = /etc/dovecot/sql/dovecot-dict-sql-passdb.conf driver = sql result_failure = return-fail result_internalfail = return-fail result_success = continue-ok } passdb { args = proxy=y starttls=any-cert master=director(a)m03.company.com pass=#hidden_use-P_to_show# nopassword=y driver = static skip = unauthenticated } pop3_logout_format = top=%t/%p, retr=%r/%b, del=%d/%m, size=%s, uidl=%u protocols = imap lmtp pop3 service auth-worker { user = $default_internal_user } service director { fifo_listener login/proxy-notify { mode = 0600 user = $default_login_user } inet_listener { port = 9090 } unix_listener director-userdb { mode = 0600 user = vmail } unix_listener login/director { mode = 0666 } } service imap-login { executable = imap-login director process_min_avail = 2 vsz_limit = 1 G } service lmtp { inet_listener lmtp { port = 24 } process_min_avail = 2 unix_listener lmtp { mode = 00 } user = vmail vsz_limit = 1 G } service log { user = dovenull } service pop3-login { executable = pop3-login director process_min_avail = 2 vsz_limit = 1 G } service pop3 { user = vmail } ssl_cert = </etc/ssl/mail/cert.pem ssl_client_ca_dir = /etc/ssl/certs/ ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it ssl_prefer_server_ciphers = yes submission_host = postfix:588 protocol lmtp { auth_socket_path = director-userdb }

2 1

Sieve and recipient_delimiter
by ＠lbutlr 17 Nov '19

17 Nov '19

I use recipient_delimiter addresseses quiet a bit, and I want to put several of them into a mailbox if anyof (header :contains ["to"] [ “FOO", “foo", “bar", “florin"]) { fileinto :create “later"; stop; } When I get an email addressed to me+FOO(a)example.com or me_florin(a)example.com, the messages end up in my inbox (Yes, I have both + and _ defined as delimiters in postfix and in dovecot). Is this because sieve is not seeing the delimiter? I am wondering this because I have another rule that seems to be working fine that is largely the same, but operates on domains: if anyof ( header :contains ["From"] [“kreme.com", “localdomain1.tld”, "localdomain2.tld", "localdomain3.tld", “covisp.net” ]){ fileinto :create "priority"; } -- She'd always tried to face towards the light. But the harder you stared into the brightness the harsher it burned into you until, at last, the temptation picked you up and bid you turn around to see how long, rich, strong and dark, streaming away behind you, your shadow had become- --Carpe Jugulum

2 2

Auto expunge log
by Michael Ludwig 16 Nov '19

16 Nov '19

Hi, I'm just setting up a new dovecot system and wonder why I get this error. On another dovecot system this works with no problems. Log entry when exiting MUA Thunderbird: =========================== Nov 16 20:16:35 myhostname dovecot: imap(info(a)mydomain.de): Error: autoexpunge: Couldn't create dovecot.autoexpunge.lock lock: file_create_locked(/var/mail/vmail/mydomain.de/info//dovecot.autoexpunge.lock) failed: safe_mkstemp(/var/mail/vmail/mydomain.de/info//dovecot.autoexpunge.lock) failed: No such file or directory =========================== Is this double slash between /info//dovecot.auto... okay? I believe there should be a "Mailbox" in between? Configuration in /etc/dovecot/conf.d/15-mailboxed.conf =========================== namespace inbox { mailbox Junk { auto = subscribe special_use = \Junk autoexpunge = 90d } =========================== Maybe you can help me a bit. ;-) Michael

2 1

Feature request: ssl-cert config
by Marc Roos 16 Nov '19

16 Nov '19

I am not sure why this </ is used in the configuration. But I hoped it would concatenate the ssl_cert to have multiple certificates. So one could use it multiple times, as needed. It would be nice to be able to specify the intermediate certificate (bundle) separate from the certificate, so when updating the certificate I just have to replace this file. Something like local_name mail.xxxxxx.xxx { ssl_key = </etc/pki/tls/private/mail.xxxxxx.xxx.key ssl_cert = </etc/pki/tls/certs/mail.xxxxxx.xxx.crt ssl_cert = </etc/pki/tls/certs/SectigoIntermediate.crt } Or local_name mail.xxxxxx.xxx { ssl_key = </etc/pki/tls/private/mail.xxxxxx.xxx.key ssl_cert = </etc/pki/tls/certs/mail.xxxxxx.xxx.crt ssl_int = </etc/pki/tls/certs/SectigoIntermediate.crt } dovecot-2.2.36-3.el7_7.1.x86_64

1 0

SCRAM-SHA-1-PLUS / SCRAM-SHA-224(-PLUS) / SCRAM-SHA-256(-PLUS), SCRAM-SHA-384(-PLUS) and SCRAM-SHA-512(-PLUS) supports
by - Neustradamus - 15 Nov '19

15 Nov '19

Dear all, I send you a new email to know what is the progress of SCRAM-SHA-***(-PLUS) supports? Currently there is only SCRAM-SHA-1: https://doc.dovecot.org/configuration_manual/authentication/password_scheme…. - RFC6331: Moving DIGEST-MD5 to Historic: https://tools.ietf.org/html/rfc6331 - RFC5802: Salted Challenge Response Authentication Mechanism (SCRAM) SASL and GSS-API Mechanisms: https://tools.ietf.org/html/rfc5802 - RFC7677: SCRAM-SHA-256 and SCRAM-SHA-256-PLUS Simple Authentication and Security Layer (SASL) Mechanisms: https://tools.ietf.org/html/rfc7677 - since 2015-11-02 I have seen several months ago, commits about SCRAM-SHA-256. For your information, Cyrus SASL supports: - SCRAM-SHA-1(-PLUS) - SCRAM-SHA-224(-PLUS) - SCRAM-SHA-256(-PLUS) - SCRAM-SHA-384(-PLUS) - SCRAM-SHA-512(-PLUS) -> https://cyrusimap.org/sasl/sasl/authentication_mechanisms.html You can see more and more informations here: https://github.com/scram-xmpp/info/issues/1 Thanks in advance. Regards, Neustradamus

1 0

ACL's with SQL/from mysql table
by Jorge Bastos 15 Nov '19

15 Nov '19

Howdy, Would someone point me to a good howto on how to implement ACL from an sql table? Thanks in advanced,

1 0