December 2019 - dovecot

Dovecot Postfix MySQL Authentication Issues
by jason hirsh 29 Dec '19

29 Dec '19

I am I a situation where I have to wipe my remote server and reinstall, Its been a while since I built a server and I am not as sharp as I use to be I am running FreeBSD 12.1. well at least the server is... I am getting constant authentication errors like Dec 28 22:10:18 triggerfish dovecot[21809]: imap-login: Aborted login (auth failed, 1 attempts in 6 secs): user=<jason(a)example.com>, method=PLAIN, rip=73.150.178.106, lip=x.x.x.x, TLS, session=<QFSvEM+aA8lJlrJq> Dec 28 22:10:19 triggerfish dovecot[21809]: imap-login: Aborted login (client didn't finish SASL auth, waited 4 secs): user=<>, method=LOGIN, rip=73.150.178.106, lip=x.x.x.x, TLS, session=<FNjXEM+aBMlJlrJq> Dec 28 22:10:19 triggerfish dovecot[21809]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=73.150.178.106, lip=x,x,x,x, TLS: Connection closed, session=<pNccEc+aBslJlrJq> Dec 28 22:10:24 triggerfish dovecot[21809]: imap-login: Aborted login (auth failed, 1 attempts in 6 secs): user=<jason(a)example.com>, method=LOGIN, rip=73.150.178.106, lip=x,x,x,x, TLS, session=<hukLEc+aBclJlrJq> results of postconf -n are broken_sasl_auth_clients = yes command_directory = /usr/local/sbin compatibility_level = 2 daemon_directory = /usr/local/libexec/postfix data_directory = /var/db/postfix debug_peer_level = 2 debugger_command = PATH=/bin:/usr/bin:/usr/local/bin:/usr/X11R6/bin ddd $daemon_directory/$process_name $process_id & sleep 5 dovecot_destination_recipient_limit = 1 html_directory = /usr/local/share/doc/postfix inet_protocols = ipv4 mail_owner = postfix mailq_path = /usr/local/bin/mailq manpage_directory = /usr/local/man message_size_limit = 25600000 meta_directory = /usr/local/libexec/postfix mydestination = localhost mydomain = example.com myhostname = mail.example.com mynetworks_style = host newaliases_path = /usr/local/bin/newaliases queue_directory = /var/spool/postfix readme_directory = /usr/local/share/doc/postfix relay_recipient_maps = mysql:/usr/local/etc/postfix/mysql-virtual-mailbox-maps.cf sample_directory = /usr/local/etc/postfix sendmail_path = /usr/local/sbin/sendmail setgid_group = maildrop shlib_directory = /usr/local/lib/postfix smtp_tls_note_starttls_offer = yes smtp_use_tls = yes smtpd_delay_reject = yes smtpd_helo_required = yes smtpd_helo_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_invalid_hostname, reject_unknown_hostname, reject_non_fqdn_hostname, reject_non_fqdn_helo_hostname, reject_invalid_helo_hostname, permit smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_non_fqdn_hostname, reject_non_fqdn_sender, reject_non_fqdn_recipient, reject_unauth_destination, reject_unauth_pipelining, reject_rbl_client bl.spamcop.net, reject_rbl_client sbl-xbl.spamhaus.org, reject_rbl_client zen.spamhaus.org, reject_rbl_client dnsbl.sorbs.net, reject_rbl_client rhsbl.sorbs.net, reject_rbl_client db.wpbl.info, reject_rbl_client cbl.abuseat.org, reject_rbl_client proxies.blackholes.wirehub.net, reject_rbl_client query.bondedsender.org permit smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated defer_unauth_destination smtpd_sasl_auth_enable = yes smtpd_sasl_path = private/auth smtpd_sasl_type = dovecot smtpd_sender_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_non_fqdn_sender, reject_unknown_sender_domain, reject_unlisted_sender, permit smtpd_tls_auth_only = yes smtpd_tls_cert_file = /usr/local/etc/ssl/more/server.crt smtpd_tls_key_file = /usr/local/etc/ssl/more/server.key smtpd_tls_loglevel = 0 smtpd_tls_mandatory_protocols = !SSLv2,!SSLv3 smtpd_tls_received_header = yes smtpd_tls_session_cache_timeout = 3600s smtpd_use_tls = yes soft_bounce = no tls_random_source = dev:/dev/urandom unknown_local_recipient_reject_code = 550 virtual_alias_maps = mysql:/usr/local/etc/postfix/mysql-virtual-alias-maps.cf virtual_mailbox_domains = mysql:/usr/local/etc/postfix/mysql-virtual-domains-maps.cf virtual_mailbox_limit = 51200000 virtual_mailbox_maps = mysql:/usr/local/etc/postfix/mysql-virtual-mailbox-maps.cf virtual_transport = lmtp:unix:private/dovecot-lmtp Not sure if I need to post main.cf. I have been beating my head against the screen for a week and thought I'd try here. Probably some stupid typo or stupid action on my part. Feel free to slap me around

2 1

Using "doveadm pw" as unpriviledged user
by Ralf Jung 29 Dec '19

29 Dec '19

Hi all, Some time ago, I wrote a small CGI script to let users change their IMAP password. The script runs as www-data user and uses "doveadm pw" to check if a password hash matches a password. Unfortunately, this means that I have to make large parts of my dovecot config world-readable, as otherwise I get errors like this: doveconf: Fatal: Error in configuration file /etc/dovecot/conf.d/10-auth.conf line 123: Couldn't open include file /etc/dovecot/conf.d/auth-sql.conf.ext: Permission denied I understand doveadm also does plenty of things that interact with the running dovecot instance and thus need access to the config, but for generating hashes or comparing hashes with passwords, it should not be necessary to read the dovecot config. This shouldn't require a properly setup dovecot on this machine at all, in fact. I'd prefer to make the config not world-readable, and indeed the Debian packaging sometimes makes those files not-world-readable on upgrades, breaking my setup. Is there any way to call "doveadm pw" as a users that cannot read the dovecot config on the current machine? This happens with the following versions of the dovecot debian package: 1:2.3.4.1-5+deb10u1~bpo9+1, 1:2.3.4.1-5+deb10u1 Thanks! Ralf PS: Please keep me in Cc, as I am not subscribed to the list.

1 0

Packages missing from repo
by Jon Geerars 29 Dec '19

29 Dec '19

Hi, Since a couple of weeks the Dovecot packages for Debian Jessie and Ubuntu Trusty have disappeared from the repo. According to https://repo.dovecot.org/ they should be in https://repo.dovecot.org/ce-2.3-latest/debian/jessie and https://repo.dovecot.org/ce-2.3-latest/ubuntu/trusty, but that leads to a 404. Where can I find them? Jon

2 3

Dovecot proxy: authentication best practices
by William Edwards 28 Dec '19

28 Dec '19

Hi! I have a few questions regarding Dovecot proxy: 1. 1.1 If I understand correctly, setting 'nopassword' in the proxy passdb file, authentication is completely up to the destination host. Setting 'nopassword' in no way means the proxy becomes an open relay. Is this correct? 1.2 Are there any security implications when using 'nopassword' on the proxy? 2. 2.1 I would like to avoid having to store all users in a passdb file on the proxy. I would much rather specify a domain for which Dovecot proxy will route all users to a specific host. Is there a way to let Dovecot proxy route to a destination host based on domain, so individual users don't have to be specified in the proxy passdb? 2.2 Is it correct that userdb does not have any effect on proxying and it can be left out of the config? Source: https://dovecot.org/pipermail/dovecot/2013-October/093138.html (point 2) Met vriendelijke groeten, William Edwards T. 040 - 711 44 96 E. wedwards(a)cyberfusion.nl

2 2

Move mailbox/folder tree?
by Marc Roos 27 Dec '19

27 Dec '19

What would be the adviced method of moving a complete mailbox/folder tree? Eg. to a different namespace. Is this possible with 'doveadm move -u test'

1 0

Setting up expunge rules on a per user basis?
by Peter Reinhold 27 Dec '19

27 Dec '19

Hi all, I was wondering, is it possible to setup for instance expunge rules on a per user basis, when I am using userdb SQL lookups (or, possibly via post-login scripts) Reading the docs it seems like its possible, but I am not entirely sure about the data I should return, so have any of you done something like this, and could maybe post an example? -- Peter Reinhold

1 0

Saving Attachments
by ＠lbutlr 26 Dec '19

26 Dec '19

I have an account that mostly receives automated emails with attachments. I would like to save those attachments outside of the mail/IMAP area and then add a link (in the headers) to the saved attachment in the original mail. I do not need to strip the attachment from the email. I’ve looked at 10-mail.conf. but I am using Maildir and I do not want to alter the email other than adding a header like X-Local-link: URL://server/path/to/file If mdbox or sdbox are the only options for this, can I specify that for a single user account instead of for all my users? My other idea was to break out my old ripmime script that I wrote for procmail and do something in sieve like if anyof (header :contains [“content-type"] [ “multiupart”, “other types”]) { fileinto :create “TempAttach”; } And then let ripmime loose on .TempAttach/new/ via a periodic cron job knowing the message would end up being filed in whatever default mailbox after the copy was dropped in the temp mail, but that doesn’t get me the added header with the link to the attachment without a lot of work. I suppose I could generate a second mail with the details of the attachment (size, name, sender, date). Not ideal. Suggestions? -- No one ever thinks of themselves as one of Them. We're always one of Us. It's Them that do the bad things.

1 0

Thunderbird, server side filtering (sieve) and new email not in "inbox"
by Jesus Cea 25 Dec '19

25 Dec '19

Migrating my extensive thunderbird filtering rules to sieve has the unfortunate effect that thunderbird doesn't realize that there is new email in other mailboxes beside "inbox". According to ancient documentation, <http://kb.mozillazine.org/How_do_I_check_for_new_messages_in_other_folders#…>, I could configure Thunderbird to check each mailbox periodically, but I have >500 mailboxes and I rather prefer the server to notify the client when new email is avaliable somewhere. Reading between lines in that document, looks like Thunderbird would support STATUS updates while in "IDLE". Is that the case?. Do you know how could I configure dovecot to provide that kind of information to thunderbird?. Maybe some extension? I am aware of "notify", but thunderbird is not "notify" compatible. I can write an IMAP4 proxy to "inject" replies to thunderbird side-fetched via "notify", but I need to know what thunderbird expect. Do you have any idea?. Thanks for your time and expertise. -- Jesús Cea Avión _/_/ _/_/_/ _/_/_/ jcea(a)jcea.es - http://www.jcea.es/ _/_/ _/_/ _/_/ _/_/ _/_/ Twitter: @jcea _/_/ _/_/ _/_/_/_/_/ jabber / xmpp:jcea@jabber.org _/_/ _/_/ _/_/ _/_/ _/_/ "Things are not so easy" _/_/ _/_/ _/_/ _/_/ _/_/ _/_/ "My name is Dump, Core Dump" _/_/_/ _/_/_/ _/_/ _/_/ "El amor es poner tu felicidad en la felicidad de otro" - Leibniz

1 0

Is there a way to hide the top level virtual IMAP folder when using the virtual plugin?
by Robert L Mathews 24 Dec '19

24 Dec '19

I'm experimenting with the Virtual plugin to give users access to folders like "All Mail", "Recent" and so on, similar to Gmail. Something like this works properly: mail_location = maildir:~/ namespace { inbox = yes location = prefix = INBOX. separator = . type = private } namespace { prefix = INBOX.virtual. separator = . location = virtual:virtual list = children ignore_on_failure = yes } I can then create "virtual/All Mail/dovecot-virtual" and "virtual/Recent/dovecot-virtual" in the maildir directory, and it works. However, when accessed using IMAP, an IMAP folder named "virtual" shows in the folder hierarchy, with "All Mail" and "Recent" descended from "virtual". It looks like: INBOX Drafts Sent Trash virtual All Mail Recent I'd prefer the virtual folders to be a level up the hierarchy without the "virtual" parent visible, like: INBOX All Mail Drafts Recent Sent Trash Is that possible? I've tried changing the "prefix = INBOX.virtual." on the virtual namespace to just "prefix = INBOX.", but that causes a "Duplicate namespace prefix" error. I also tried using "alias_for" to merge the namespaces, but that causes "namespace configuration error: Namespace virtual. can't have alias_for=INBOX. to a different storage type (virtual vs maildir)". -- Robert L Mathews

1 1

When is a new mail not unseen?
by Philip Colmer 24 Dec '19

24 Dec '19

I'm trying to diagnose a really strange situation where certain emails, when submitted to the mailbox by Postfix, are not considered to be unseen by Dovecot. During testing, I've shut down anything else on the server that might want to access the mailbox. I submit the email to the local postfix instance which then says it has delivered it to the mailbox: Dec 23 09:51:35 ip-10-35-194-108 postfix/smtpd[3283]: connect from localhost[127.0.0.1] Dec 23 09:51:35 ip-10-35-194-108 postfix/smtpd[3283]: 5A0BF40261: client=localhost[127.0.0.1] Dec 23 09:51:35 ip-10-35-194-108 postfix/cleanup[3286]: 5A0BF40261: message-id=<20191223095135.5A0BF40261(a)servicedesk.linaro.org> Dec 23 09:51:35 ip-10-35-194-108 postfix/smtpd[3283]: disconnect from localhost[127.0.0.1] ehlo=1 mail=1 rcpt=1 data=1 quit=1 commands=5 Dec 23 09:51:35 ip-10-35-194-108 postfix/qmgr[1660]: 5A0BF40261: from=< philip.colmer(a)linaro.org>, size=702, nrcpt=1 (queue active) Dec 23 09:51:35 ip-10-35-194-108 postfix/local[3287]: 5A0BF40261: to=<local-it-support@localhost>, relay=local, delay=0.06, delays=0.04/0.02/0/0, dsn=2.0.0, status=sent (delivered to mailbox) Dec 23 09:51:35 ip-10-35-194-108 postfix/qmgr[1660]: 5A0BF40261: removed I then use this command to query the state of the mailbox: sudo doveadm mailbox status -u local-it-support all INBOX and get this response: INBOX messages=142 recent=0 uidnext=5596 uidvalidity=1455577845 unseen=0 highestmodseq=1163 vsize=11315688 guid=2a997739f55ac2560d180000e171d23e firstsaved=1577094051 What can be happening that means that Dovecot doesn't treat a newly delivered message as unseen? Installation details: # 2.2.33.2 (d6601f4ec): /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.21 (92477967) # OS: Linux 4.15.0-1041-aws x86_64 Ubuntu 18.04.3 LTS auth_verbose = yes auth_verbose_passwords = yes disable_plaintext_auth = no listen = 127.0.0.1 mail_location = mbox:~/mail:INBOX=/var/mail/%u mail_privileged_group = mail namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { driver = pam } protocols = " imap" ssl = no ssl_cert = </etc/dovecot/private/dovecot.pem ssl_client_ca_dir = /etc/ssl/certs ssl_key = # hidden, use -P to show it userdb { driver = passwd } Note that we are not using SSL because Dovecot is only accessible locally within the server. Thank you for any suggestions or comments. Regards Philip

4 10