March 2019 - dovecot - dovecot.org

testing dovecot LMTP with postfix/spamassassin
by Marek Kozlowski 17 Mar '19

17 Mar '19

:-) My postfix configuration is quite complex with a lot of special cases and rules. However I'd like to make an anti-spam configuration as simple and lightweight as possible (KISS). /etc/postfix/master.cf ------------------------------------------------------------------------ smtp inet n - n - - smtpd -o content_filter=spamassassin spamassassin unix - n n - - pipe user=nobody argv=/usr/bin/vendor_perl/spamc -e /usr/sbin/sendmail -oi -f ${sender} ${recipient} ------------------------------------------------------------------------ then the simplest sieve rule I can think of: ------------------------------------------------------------------------ require "fileinto"; if header :contains "X-Spam-Flag" "YES" { fileinto "Spam"; } ------------------------------------------------------------------------ I'd like to make this rule active for only local deliveries via dovecot LMTP with sieve plugin and setting postfix `mailbox_transport' to dovecot LMTP. I believe it is so simple it should work (am I wrong?). But... It would be more convenient to do some tests before applying changes to a production environment config. The problem is: I have no separate testing environment with my strange configuration I'm able to test a spamassassin score for an e-mail manually. How about dovecot LMTP? Can I test local mail delivery by dovecot LMTP manually? I mean: to simulate "I'm the Postfix" and produce for some testing e-mail the same effect as postfix granting it via `local_transport' to dovecot? Best regards, Marek

4 6

LMTP: Undelivered Mail Returned to Sender: User doesn't exist! :-(
by Marek Kozlowski 17 Mar '19

17 Mar '19

:-) I'm using postfix for mail delivery and dovecot for mailbox access imaps pop3s. Postfix resolves, verifies and overwrites users' addresses by numerous subtle LDAP queries. However users are visible as local ones (openldap, pam, nss) in the sense I can run `id' or `finger' queries and receive replies. Dovecot handles all mailboxes over imap/pop correctly with no additional configuration for LDAP. Just (10-mail.conf): mail_location = maildir:/mailboxes/%u and it works fine. Because I'd like to use pigeonhole I'm trying to make local delivery via dovecot LMTP (https://wiki2.dovecot.org/HowTo/PostfixDovecotLMTP) I've configured the socket and added to `/etc/postfix/main.cf' the line: mailbox_transport = lmtp:unix:/var/spool/postfix/private/dovecot-lmtp I think that id dovecot handles mailboxes correctly over imap/pop it can easily find the users and their mailboxes so it doesn't need any additional configuration for LDAP. Unfortunately it doesn't work and results in: Undelivered Mail Returned to Sender: User doesn't exist! :-( What's the thing I've missed? Best regards, Marek

2 2

How to create sent items, drafts and so on
by Sakuma, Koshiro 17 Mar '19

17 Mar '19

Hello, I've setup Dovecot and Postfix mailing systems. The protocol is imap. Now, I've realized that there are no "sent items, drafts" boxed under Maildir for each users. I would like to take back up Inbox, sent items, draft boxes. For sent items box, it seems to be stored in outlook client file which is "ost". The configuration parameters and version is as follows. I can see that "namespace" has been configured. How can I setup to see these folders? Thank you for your support! 1. Dovecot version ->2.2.36 2. dovecot -n ----------------------------------------------------------------------------------------------------------- #2.2.36 (1f10bfa63): /etc/dovecot/dovecot.conf # OS: Linux 3.10.0-957.5.1.el7.x86_64 x86_64 CentOS Linux release 7.6.1810 (Core) # Hostname: mail.corp-associe.com auth_mechanisms = plain login auth_verbose = yes disable_plaintext_auth = no first_valid_uid = 1000 listen = * log_path = /var/log/dovecot.log mail_debug = yes mail_location = maildir:~/Maildir mbox_write_locks = fcntl namespace inbox { inbox = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk { auto = subscribe special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { auto = subscribe special_use = \Trash } prefix = } passdb { args = scheme=CRAM-MD5 username_format=%u /etc/dovecot/users driver = passwd-file } protocols = imap service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } } service imap-login { inet_listener imap { port = 0 } inet_listener imaps { port = 993 ssl = yes } } service pop3-login { inet_listener pop3 { port = 0 } inet_listener pop3s { port = 995 ssl = yes } } ssl_cert = </etc/letsencrypt/fullchain1.pem ssl_key = # hidden, use -P to show it userdb { args = username_format=%u /etc/dovecot/users driver = passwd-file } userdb { args = uid=vmail gid=vmail home=/var/spool/virtual/%d/%n driver = static }

4 9

Re: Unable to set quota-fs plugin
by Eric Grammatico 17 Mar '19

17 Mar '19

Hi there, Well.. I didn't find a way to strace imap. If I well understood, the faulty IMAP is launched by dovecot from or after a succesfull imap-login process. I have executed manually '/usr/libexec/dovecot/imap -u eric' and typed getquotaroot "INBOX" which didn't reproduce the error seen in the dovecot logs and reported the correct quota. Any idea how to find the imap command generating the error imap(eric)<3085></M5VXfCBwJejrKVa>: Error: Failed to get quota resource STORAGE: quota-fs: quotactl(Q_GETQUOTA, /dev/vda1) failed: No such file or directory Thanks and regards, - Eric Grammatico _/) 14 mars 2019 11:46 "Eric Grammatico" <e.grammatico(a)gmail.com> a écrit: > I use sendmail and quota-status is not running in background. > > Fully aligned with you about focusing on imap... will try to get other strace and report there. > > thanks and regards, > > - > Eric Grammatico _/) > > 14 mars 2019 11:37 "Yassine Chaouche via dovecot" <dovecot(a)dovecot.org> a écrit: > >> On 3/14/19 9:53 AM, Yassine Chaouche via dovecot wrote: >> >>> On 3/13/19 2:10 PM, Eric Grammatico via dovecot wrote: >>>> Thanks Aki, >>>> >>>> Please find attached strace for imap and quota-status which report an >> error at the end. >>>> >>>> Regards, >>> >>> write(2, "/usr/libexec/dovecot/quota-statu"..., > 57/usr/libexec/dovecot/quota-status: invalid >>> option -- 'u' >>> >>> Please retry with the good options (-u is invalid) >>> >>> Yassine. >> >> Ah, that seems to be the service that is called by the MTA before delivering the mail to the LDA, >> in case the user is over quota, so that the MTA may bounce the e-mail right away instead of >> accepting it first then bouncing afterwards (after the LDA refuses the message). >> >> But according to the error message you posted on your first e-mail, the error happens with imap, I >> don't know if quota-status is involved here (might be) ? >> >> In any case, I would concentrate on imap and not quota-status. Nothing in the imap strace shows any >> trace of errors. Particulary, I was looking for a quotactl line in the strace, but I couldn't find >> it. >> >> In the other hand, it is present in the doveadm quota strace, and has completed successfully >> >> dovecot.strace:quotactl(QCMD(Q_GETQUOTA, USRQUOTA), "/dev/vda1", 1000, {dqb_bhardlimit=4194304, >> dqb_bsoftlimit=3170304, dqb_curspace=638853120, dqb_ihardlimit=0, dqb_isoftlimit=0, >> dqb_curinodes=12784, ...}) = 0 >> >> Someone has to tell us under what conditions will the imap daemon check for quota (at login ? at >> delivery or any other action involving moving mail around like copying or expunging ?) >> >> For the quota-status libexec, I have set it to run with quota-status -f postfix but your setup may >> vary (if it's every configured). If it is running, you can just grep it's pid with pgrep >> quota-status then strace -p $PID and see how it behaves (wait until a quota operation is needed). >> >> Yassine.

2 6

ssl_dh
by sergio 16 Mar '19

16 Mar '19

https://wiki.dovecot.org/SSL/DovecotConfiguration says: "Since v2.3.3+ Diffie-Hellman parameters have been made optional, and you are encouraged to disable non-ECC DH algorithms completely." and a bit later: "From version 2.3, you must specify path to DH parameters file using ssl_dh=</path/to/dh.pem" So. 1. Is ssl_dh an optional or a must? 2. I've disabled ssl_dh in my config. Dovecot works fine except it shows warnings: doveconf: Warning: please set ssl_dh=</etc/dovecot/dh.pem doveconf: Warning: You can generate it with: dd ... I'm using dovecot version 2.3.4.1-1~bpo9+1 from debian stretch-backports -- sergio.

3 5

regarding ssl certificates
by mick crane 15 Mar '19

15 Mar '19

Excuse dopey question. I'm not exactly clear about certificates. Apache2 default install has this snake oil certificate Can make a new one for apache Can make one for dovecot Can make one for ssl Is there supposed to be the one (self signed ) certificate pair in one place for the machine that each process hands out ? Can they be moved to another machine ? mick -- Key ID C7D6E24C

12 16

lua policy for Weakforce and web mail failed login attempts
by Robert Kudyba 15 Mar '19

15 Mar '19

The good news is I believe I got Weakforce running 1) curl -X GET http://127.0.0.1:8084/?command=ping -u wforce:ourpassword {"status":"ok"}[ 2) after running the sample for loop: for a in {1..101}; do curl -X POST -H "Content-Type: application/json" --data '{"login":"ahu", "remote": "127.0.0.1", "pwhash":"1234'$a'", "success":"false"}' http://127.0.0.1:8084/?command=report -u wforce:ourpassword; done The result is: {"status":"ok"}{"status":"ok"}{"status":"ok"}{ 3) So checking the stats: curl -X POST -H "Content-Type: application/json" --data '{"ip":"127.0.0.1"}' http://127.0.0.1:8084/?command=getDBStats -u wforce:ourpassword {"bl_expire": "", "bl_reason": "", "blacklisted": false, "ip": "127.0.0.1", "stats": {"OneHourDB": {"diffFailedPasswords": 93}}} Notice the 93. 4) the reset works but I believe there's a bug in Getdbstats v2.0.0 where "blacklisted" is always shown: curl -X POST -H "Content-Type: application/json" --data '{"ip":"127.0.0.1"}' http://127.0.0.1:8084/?command=getDBStats -u wforce:ourpassword {"bl_expire": "", "bl_reason": "", "blacklisted": false, "ip": "127.0.0.1", "stats": {"OneHourDB": {"diffFailedPasswords": 0}}}[ 5) wforce -c Read configuration from '/usr/local/etc/wforce.conf' Connecting to 127.0.0.1:4004 > stats() 101 reports, 0 allow-queries (0 denies) The 3 big questions I have: a: how do I know IP's are being banned/rejected? Is there an alert creation or a way to see in the logs that the rules are in affect? b: since I installed via Git and ran "make" how to I get wforce --daemon to start on reboot? Is there a systemd file available? c: How do I create a lua policy that would catch these web dovecot login attempts? Feb 27 08:19:53 ourserver auth[15085]: pam_unix(dovecot:auth): check pass; user unknown Feb 27 08:19:53 ourserver auth[15085]: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser= user(a)ourserver.ourdomain.edu rhost=177.72.0.158 Feb 27 08:20:35 ourserver auth[15085]: pam_unix(dovecot:auth): check pass; user unknown Feb 27 08:20:35 ourserver auth[15085]: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=user rhost=213.156.111.236 Feb 27 08:27:07 ourserver auth[16831]: pam_unix(dovecot:auth): check pass; user unknown Feb 27 08:27:07 ourserver auth[16831]: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser= nobody(a)ourserver.ourdomain.edu rhost=79.106.35.59 Feb 27 08:27:27 ourserver auth[16831]: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=nobody rhost=95.38.212.65 user=nobody Feb 27 08:27:27 ourserver auth[16831]: pam_succeed_if(dovecot:auth): requirement "uid >= 1000" not met by user "nobody" Feb 27 08:31:12 ourserver auth[17875]: pam_unix(dovecot:auth): check pass; user unknown Feb 27 08:31:12 ourserver auth[17875]: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser= ouruser(a)ourserver.ourdomain.edu rhost=80.78.70.1 Feb 27 08:31:33 ourserver auth[17875]: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=ouruser rhost=45.225.236.198 user=ouruser Feb 27 09:32:22 ourserver auth[32689]: pam_unix(dovecot:auth): check pass; user unknown Feb 27 09:32:22 ourserver auth[32689]: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser= nobody(a)ourserver.ourdomain.edu rhost=37.205.81.41 Feb 27 09:32:42 ourserver auth[32689]: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=nobody rhost=201.148.100.198 user=nobody Feb 27 09:32:42 ourserver auth[32689]: pam_succeed_if(dovecot:auth): requirement "uid >= 1000" not met by user "nobody" Feb 27 09:44:09 ourserver auth[3271]: pam_unix(dovecot:auth): check pass; user unknown Feb 27 09:44:09 ourserver auth[3271]: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser= otheruser(a)ourserver.ourdomain.edu rhost=177.69.145.193 Feb 27 09:44:35 ourserver auth[3271]: pam_unix(dovecot:auth): check pass; user unknown Feb 27 09:44:35 ourserver auth[3271]: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=otheruser rhost=175.143.51.221 Feb 27 09:47:32 ourserver auth[4048]: pam_unix(dovecot:auth): check pass; user unknown Feb 27 09:47:32 ourserver auth[4048]: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser= yetanotheruser(a)ourserver.ourdomain.edu rhost=162.245.81.231 Feb 27 09:47:56 ourserver auth[4048]: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=yetanotheruser rhost=83.243.88.236 user=yetanotheruser Feb 27 20:44:41 ourserver auth[5828]: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=ouruser rhost=166.171.184.200 user=ouruser

1 0

Re: ACL Folders are open but not being displayed ? [2.3.3]
by Aki Tuomi 15 Mar '19

15 Mar '19

It's a file, `touch subscriptions` Aki On 15.3.2019 11.36, Kunal A. wrote: > Oh okay. How do correct this? Create the file/folder for this? ie > mkdir suscriptions ? > > > On Fri, Mar 15, 2019 at 5:29 AM Aki Tuomi <aki.tuomi(a)open-xchange.com > <mailto:aki.tuomi@open-xchange.com>> wrote: > > Nevertheless, the subscriptions file needs to be there. > > Aki > > On 15.3.201911.28, Kunal A. wrote: >> Dear Aki, >> Got it corrected. Many thanks for pointing it out. There is >> another error about suscriptions. I don't have any folder with >> subscriptions. See the error below :- >> >> Mar 15 05:22:10 machine dovecot[4804]: imap(email1(a)example.com >> <mailto:email1@example.com>)<4970><XjWwkh6EBsAAAAAAAAAAAAAAAAAAAAAB>: >> Error: stat(/mnt/computer/Email/fastmail/subscriptions) failed: >> Permission denied >> >> dr-xr-xr-x root root / >> drwxr-xr-x root root mnt >> drwxr-xr-x vmail vmail computer >> drwxrwxr-x vmail vmail Email >> drwxrwxr-x vmail vmail fastmail >> subscriptions - No such file or directory >> >> Best Regards >> >> >> On Fri, Mar 15, 2019 at 3:02 AM Aki Tuomi >> <aki.tuomi(a)open-xchange.com <mailto:aki.tuomi@open-xchange.com>> >> wrote: >> >> >> On 15.3.2019 8.40, Kunal A. via dovecot wrote: >>> Hey, >>> Could someone help figure out whats wrong with my config >>> based on the debug below? >>> >>> What I am trying to achieve is to get email1(a)example.com >>> <mailto:email1@example.com> to read emails in the Public >>> directory that is stored on >>> /run/media/computer/Storage/Email/fastmail/Archive with the >>> preface Public/Archive . >>> >>> The ACL has been set for anyone with permissions to >>> lookup,read,write as shown below:- >>> >>> doveadm acl get -u email1(a)example.com >>> <mailto:email1@example.com> Public/Archive >>> ID Global >>> Rights >>> anyone lookup read write >>> >>> But when I try to access the emails for email1(a)example.com >>> <mailto:email1@example.com> , there are no folders. >>> Could someone here help review my debug log and advise what >>> could be causing this (dovecot -n output is provided below >>> the debug message) >>> >>> Many thanks for assistance. >>> Thanks >>> >> >>> Mar 15 01:29:28 machine dovecot[2100]: >>> imap(email1(a)example.com >>> <mailto:email1@example.com>)<5167><i8fdSBuE8uMAAAAAAAAAAAAAAAAAAAAB>: >>> Error: >>> open(/run/media/computer/Storage/Email/fastmail/dovecot-acl-list) >>> failed: Permission denied >> >>> Mar 15 01:29:28 machine dovecot[2100]: >>> imap(email1(a)example.com >>> <mailto:email1@example.com>)<5167><i8fdSBuE8uMAAAAAAAAAAAAAAAAAAAAB>: >>> Error: stat(/run/media/computer/Storage/Email/fastmail) >>> failed: Permission denied (euid=5000(vmail) egid=5000(vmail) >>> missing +w perm: /run/media/computer/Storage/Email/fastmail >>> stat(/run/media/computer/Storage/Email/fastmail) failed: >>> Permission denied, dir owned by 0:0 mode=0775) >> >>> Mar 15 01:29:28 machine dovecot[2100]: >>> imap(email1(a)example.com >>> <mailto:email1@example.com>)<5167><i8fdSBuE8uMAAAAAAAAAAAAAAAAAAAAB>: >>> Error: >>> stat(/run/media/computer/Storage/Email/fastmail/.temp.e480machine.5167.a6506e27bd37a68a) >>> failed: Permission denied >> >>> Mar 15 01:30:14 machine dovecot[2100]: >>> imap(email1(a)example.com >>> <mailto:email1@example.com>)<5167><i8fdSBuE8uMAAAAAAAAAAAAAAAAAAAAB>: >>> Error: mkdir(/run/media/computer/Storage/Email/fastmail) >>> failed: Permission denied (euid=5000(vmail) egid=5000(vmail) >>> missing +w perm: /run/media/computer, we're not in group >>> 0(root), dir owned by 0:0 mode=0775) >>> >> >> Maybe try fix these? >> >> >> Aki >>

2 1

Double quota calulation when special folder is present
by Bernd Wurst 15 Mar '19

15 Mar '19

Hello, we're operating dovecot on a small server. Some years ago, we migrated from courier IMAP to dovecot. Therefore, we defined our default Namespace "inbox" with prefix "INBOX." to have this compatible. I found this in some migration docs those days. Generally, everything worked as expected. Our only namespace is configured like this: namespace inbox { separator = . prefix = INBOX. inbox = yes } Regularly, there is no folder named INBOX or .INBOX in the file system, I suppose this is correct. But I found a special corner case today when it comes to quota calculation. When - for whatever reason - a folder .INBOX.foo (for arbitrary values of foo) exists, the whole mailbox is counted twice in quota recalculation. Just creating .INBOX does nothing but a subfolder triggers the problem. This is my shell view (replaced username and file path and deleted unnecessary debug output) $ cat maildirsize 268435456S 14697 17 $ maildirmake .INBOX.foo $ sudo doveadm -D quota recalc -u <user> [...] doveadm(<user>): Debug: Namespace inbox: type=private, prefix=INBOX., sep=., inbox=yes, hidden=no, list=yes, subscriptions=yes location=maildir:/home/.../test doveadm(<user>): Debug: maildir++: root=/home/.../test, index=, indexpvt=, control=, inbox=/home/.../test, alt= doveadm(<user>): Debug: Namespace : type=private, prefix=, sep=, inbox=no, hidden=yes, list=no, subscriptions=no location=fail::LAYOUT=none doveadm(<user>): Debug: none: root=, index=, indexpvt=, control=, inbox=, alt= doveadm(<user>): Debug: quota: quota_over_flag check: quota_over_script unset - skipping doveadm(<user>): Debug: Quota root User quota: Recalculated relative rules with bytes=268435456 count=0. Now grace=26843545 doveadm(<user>): Debug: Namespace INBOX.: Using permissions from /home/.../test: mode=0700 gid=default $ cat maildirsize 268435456S 29394 34 So the used quota has exactly been doubled by just creating an empty subfolder. Do you have any pointers for fixing my configuration or is this a bug in dovecot? regards, Bernd

2 1

Upgrading to 2.3
by ＠lbutlr 15 Mar '19

15 Mar '19

I haven't upgraded to dovecot 2.3 yet, but am looking into doing it. I thought there was a link to some of the issues and changes you needed to make to your configuration to go from 2.2 to 2.3, but now I cannot find it. -- Science is the foot that kicks magic square in the nuts.

4 4