May 2019 - dovecot - dovecot.org

Potfix+Dovecot with dsync replication problem
by Zeljko Dokman 10 Jun '19

10 Jun '19

Hi all, I am in need of some help. Straggling to make something work, trying to configure postfix and dovecote imap server with dovecote replication. Can’t figure out what is wrong with my configuration. Replication is working only for vmail user account, I am getting this error on my secondary server for all other users… dovecot: doveadm: Fatal: setgid(4015(zdokman) from userdb lookup) failed with euid=5000(vmail), gid=5000(vmail), egid=5000(vmail): Operation not permitted (This binary should probably be called with process group set to 4015(zdokman) instead of 5000(vmail)) primary server reports this error: dovecot: doveadm(zdokman): Error: doveadm server disconnected before handshake: EOF dovecot: doveadm(zdokman): Error: sync: Disconnected from remote: EOF doveadm replicator status '*' username priority fast sync full sync success sync failed vmail none 01:58:13 02:05:25 01:58:13 - zdokman none 00:00:25 02:55:26 - y test none 00:01:00 21:48:13 - y doveadm sync * doveadm(root): Fatal: execvp(Maildir) failed: Permission denied dsync-local(root): Error: read(remote) failed: EOF (version not received) I am attaching my dovecot.conf main.cf and master.cf. I think my problem is with permissions but I can figure out how to workaround it. Best regards

2 3

sieve setup. no svbin ?
by Voytek Eymont 09 Jun '19

09 Jun '19

since moving/upgrading system I've noticed I no longer get sieve script compiled, there is no dovecot.svbin created in /var/vmail/vmail1/sbt.net.au/voytek(a)tld.au/sieve what am I missing, how to check ? also, looking at sieve.log, I see a lot of May 31 06:32:50 lda(voytek(a)sbt.net.au)<1234><c4aVBfI98FzSBAAAyLbbsQ>: Error: sieve: Failed to initialize script execution: Invalid postmaster_address: invalid address `root' specified for the postmaster_address setting # grep root dovecot.conf postmaster_address = root what should I have ? # dovecot --version 2.3.6 (7eab80676)

2 5

macOS Notes.app IMAP Syncing Not Working
by Steven Smith 01 Jun '19

01 Jun '19

I’m requesting help getting macOS’s Notes.app to sync notes with a new dovecot IMAP server. Thanks to dovecot’s excellent online documentation and help from this list, I have a new perfectly functioning IMAP server. The issue is that macOS Note.app does not sync with this server. However, iOS Notes.app *does* sync and work well with this IMAP server, and the differences between macOS and iOS Notes apps are well known. (Thanks, Apple.) https://apple.stackexchange.com/questions/265579/notes-wont-sync-via-imap-i… <https://apple.stackexchange.com/questions/265579/notes-wont-sync-via-imap-i…> https://jpmens.net/2015/09/28/experiments-using-imap-for-notes/ <https://jpmens.net/2015/09/28/experiments-using-imap-for-notes/> … I am migrating from a working Server.app system in which Notes.app syncing does work across all devices, and therefore have a working dovecot configuration from Server.app, although it does not contain an explicit configuration for the “Notes” mailbox. I would greatly appreciate any help or pointers for these questions: Does anyone have a working template for dovecot that works with macOS Notes.app? I’ve posted doveconf -n of both the new server and the old Server.app server below. Would you all be able to provide advice on TO-DO’s and NOT-TO-DO’s for mailbox/name-space reconfiguration as I try to muck around with a nicely working, deployed IMAP server? I believe that the solution has something to do with name spaces and separators, and I’ve already changed the separator from the original ‘/’ to ‘.’ on the working server without success or obvious changes. All the mail boxes on the new IMAP server look like this, *without* a prefix ‘.’: > ls -1 /var/mail/tld.domain.mail/username/mdbox/mailboxes/ > Archive/ > Deleted Messages/ > Drafts/ > INBOX/ > Junk/ > Notes/ > Sent/ > Trash/ All the mailboxes on the working Server.app mailserver look like this, *with* a prefix ‘.’: > $ sudo ls -1 /Library/Server/Mail/Data/mail/users/username > .Archive > .Deleted Messages > .Drafts > .Junk > .Notes > .Sent Messages > cur > … > new > subscriptions > tmp Here are the `doveconf -n` of the new server that doesn’t sync macOS Notes.app, and the old Server.app IMAP server that does: New server `dovecot -n` [Note: original separator was set to ‘/’, now changed to ‘.’ in config.d/10-mail.conf]: > # 2.3.6 (): /opt/local/etc/dovecot/dovecot.conf > # Pigeonhole version 0.5.6 () > # OS: Darwin 18.6.0 x86_64 apfs > # Hostname: newhost.domain.tld > auth_cache_size = 10 M > auth_gssapi_hostname = $ALL > auth_krb5_keytab = /opt/local/etc/dovecot/imap.keytab > auth_mechanisms = plain gssapi > auth_realms = newhost.domain.tld > auth_socket_path = /opt/local/var/run/dovecot/auth-userdb > auth_username_format = %Ln > debug_log_path = /opt/local/var/log/mail/mail-debug.log > disable_plaintext_auth = no > first_valid_gid = 6 > first_valid_uid = 6 > imap_id_log = * > imap_id_send = "name" * "version" * > imap_idle_notify_interval = 29 mins > imap_urlauth_submit_user = submit > info_log_path = /opt/local/var/log/mail/mail-info.log > last_valid_gid = 100 > lda_mailbox_autocreate = yes > log_path = /opt/local/var/log/mail/mail-err.log > login_log_format_elements = user=<%u> method=%m rip=%r lip=%l mpid=%e %c > mail_access_groups = mail > mail_attachment_dir = /private/var/mail/tld.domain.mail/attachments > mail_attachment_fs = sis posix:mode=0666 > mail_debug = yes > mail_gid = mail > mail_home = /private/var/mail/tld.domain.mail > mail_location = mdbox:/private/var/mail/tld.domain.mail/%Ln/mdbox > mail_log_prefix = "%s(pid %p user %u): " > mail_plugins = quota zlib acl fts fts_solr fts_lucene > mail_privileged_group = mail > mail_uid = _dovecot > managesieve_notify_capability = mailto > managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext imapsieve vnd.dovecot.imapsieve > mdbox_rotate_size = 200 M > namespace inbox { > inbox = yes > location = > mailbox Archive { > auto = subscribe > special_use = \Archive > } > mailbox Drafts { > auto = subscribe > special_use = \Drafts > } > mailbox Junk { > auto = create > special_use = \Junk > } > mailbox Notspam_train { > auto = create > special_use = \Junk > } > mailbox Sent { > auto = subscribe > special_use = \Sent > } > mailbox "Sent Messages" { > special_use = \Sent > } > mailbox Spam_train { > auto = create > special_use = \Junk > } > mailbox Trash { > auto = create > special_use = \Trash > } > prefix = > separator = . > } > passdb { > driver = pam > name = pam > } > plugin { > fts = solr > fts_autoindex = yes > fts_autoindex_exclude = \Junk > fts_solr = url=http://127.0.0.1:8983/solr/dovecot/ > imapsieve_mailbox1_before = file:/opt/local/etc/dovecot/sieve/report-spam.sieve > imapsieve_mailbox1_causes = COPY APPEND > imapsieve_mailbox1_name = Spam_train > imapsieve_mailbox2_before = file:/opt/local/etc/dovecot/sieve/report-ham.sieve > imapsieve_mailbox2_causes = COPY APPEND > imapsieve_mailbox2_name = Notspam_train > mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename > mail_log_fields = uid box msgid from subject size flags > quota_grace = 10%% > quota_rule = *:storage=16G > quota_rule2 = Trash:storage=+256M > quota_warning = storage=100%% quota-exceeded %u > quota_warning2 = storage=80%% quota-warning %u > recipient_delimiter = + > sieve = /private/var/mail/tld.domain.mail/rules/%Ln/dovecot.sieve > sieve_after = /opt/local/etc/dovecot/sieve-after.d > sieve_before = /opt/local/etc/dovecot/sieve-before.d > sieve_dir = /private/var/mail/tld.domain.mail/rules/%Ln/%u > sieve_global_extensions = +vnd.dovecot.pipe +vnd.dovecot.environment > sieve_pipe_bin_dir = /opt/local/etc/dovecot/sieve > sieve_plugins = sieve_imapsieve sieve_extprograms > sieve_quota_max_storage = 50M > } > postmaster_address = postmaster(a)domain.tld > protocols = imap lmtp sieve > quota_full_tempfail = yes > sendmail_path = /opt/local/sbin/sendmail > service auth-worker { > group = mail > user = root > } > service auth { > extra_groups = _keytabusers > idle_kill = 15 mins > unix_listener /opt/local/var/spool/postfix/private/auth { > group = mail > mode = 0660 > user = _postfix > } > } > service imap-login { > inet_listener imap { > address = 127.0.0.1, ::1 > port = 143 > } > inet_listener imaps { > port = 993 > ssl = yes > } > process_min_avail = 6 > service_count = 0 > vsz_limit = 2 G > } > service imap { > process_limit = 200 > process_min_avail = 6 > } > service lmtp { > unix_listener /opt/local/var/spool/postfix/private/dovecot-lmtp { > group = mail > mode = 0660 > user = _postfix > } > } > ssl = required > ssl_ca = </etc/certificates/newhost.domain.tld.SHA1.chain.pem > ssl_cert = </etc/certificates/newhost.domain.tld.SHA1.cert.pem > ssl_cipher_list = ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256 > ssl_dh = # hidden, use -P to show it > ssl_key = # hidden, use -P to show it > ssl_min_protocol = TLSv1.2 > ssl_prefer_server_ciphers = yes > userdb { > driver = passwd > name = passwd > } > verbose_proctitle = yes > protocol lda { > mail_fsync = optimized > mail_plugins = quota zlib acl fts fts_solr fts_lucene sieve > } > protocol imap { > mail_max_userip_connections = 50 > mail_plugins = quota zlib acl fts fts_solr fts_lucene imap_acl imap_quota imap_zlib imap_sieve > } > protocol lmtp { > mail_fsync = optimized > mail_plugins = quota zlib acl fts fts_solr fts_lucene sieve > } Old Server.app server `dovecot -n`: > # 2.2.30.2 (c0c463e): /Library/Server/Mail/Config/dovecot/dovecot.conf > # Pigeonhole version 0.4.18 (29cc74d) > # OS: Darwin 17.7.0 x86_64 apfs > aps_topic = com.apple.mail.XServer.d7d6581e-37ed-4a8a-8775-92c4c5a4bf28 > auth_gssapi_hostname = $ALL > auth_mechanisms = cram-md5 plain login gssapi > auth_realms = host.domain.tld > auth_socket_path = /var/run/dovecot/auth-userdb > auth_username_format = %n > debug_log_path = /Library/Logs/Mail/mail-debug.log > default_internal_user = _dovecot > default_login_user = _dovenull > disable_plaintext_auth = no > first_valid_gid = 6 > first_valid_uid = 6 > imap_id_log = * > imap_id_send = "name" * "version" * > imap_urlauth_submit_user = submit > info_log_path = /Library/Logs/Mail/mail-info.log > log_path = /Library/Logs/Mail/mail-err.log > login_log_format_elements = user=<%u> method=%m rip=%r lip=%l mpid=%e %c > mail_access_groups = mail > mail_attribute_dict = file:/Library/Server/Mail/Data/attributes/attributes.dict > mail_location = maildir:/Library/Server/Mail/Data/mail/%u > mail_log_prefix = "%s(pid %p user %u): " > mail_plugins = quota zlib acl fts fts_sk > managesieve_notify_capability = mailto > managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext > mdbox_rotate_size = 200 M > namespace acl-mailboxes { > list = children > location = maildir:/Library/Server/Mail/Data/mail/users/%%u:INDEX=/Library/Server/Mail/Data/mail/shared/%%u > prefix = shared.%%u. > separator = . > subscriptions = no > type = shared > } > namespace inbox { > inbox = yes > location = > mailbox Drafts { > special_use = \Drafts > } > mailbox Junk { > special_use = \Junk > } > mailbox Sent { > special_use = \Sent > } > mailbox "Sent Messages" { > special_use = \Sent > } > mailbox Trash { > special_use = \Trash > } > prefix = > } > namespace list-archives { > list = children > location = maildir:/Library/Server/Mail/Data/listserver/messages/archive/lists/%%u:INDEX=/Library/Server/Mail/Data/listserver/messages/archive/shared/%%u > prefix = archives.%%u. > separator = . > subscriptions = no > type = shared > } > passdb { > driver = od > } > passdb { > args = /Library/Server/Mail/Config/dovecot/submit.passdb > driver = passwd-file > } > plugin { > acl = vfile:/Library/Server/Mail/Config/dovecot/global-acls:cache_secs=300 > acl_shared_dict = file:/Library/Server/Mail/Data/shared/shared-mailboxes > fts = sk > quota = maildir:User quota > quota_warning = storage=100%% quota-exceeded %u > quota_warning2 = storage=80%% quota-warning %u > sieve = /Library/Server/Mail/Data/rules/%u/dovecot.sieve > sieve_dir = /Library/Server/Mail/Data/rules/%u > stats_refresh = 30 secs > stats_track_cmds = yes > } > postmaster_address = postmaster(a)host.domain.tld > protocols = imap pop3 lmtp sieve > quota_full_tempfail = yes > service auth { > extra_groups = _keytabusers > idle_kill = 15 mins > unix_listener auth-userdb { > user = _dovecot > } > } > service dns_client { > unix_listener dns-client { > mode = 0600 > } > } > service imap-login { > inet_listener imap { > port = 143 > } > inet_listener imaps { > port = 993 > ssl = yes > } > service_count = 0 > } > service imap { > client_limit = 5 > process_limit = 200 > service_count = 0 > } > service indexer-worker { > user = _dovecot > } > service lmtp { > unix_listener lmtp { > mode = 0600 > } > } > service managesieve-login { > inet_listener sieve { > port = 4190 > } > } > service pop3-login { > inet_listener pop3 { > port = 110 > } > inet_listener pop3s { > port = 995 > ssl = yes > } > } > service pop3 { > client_limit = 5 > process_limit = 200 > service_count = 0 > } > service quota-exceeded { > executable = script /Applications/Server.app/Contents/ServerRoot/usr/libexec/dovecot/quota-exceeded.sh > unix_listener quota-exceeded { > group = mail > mode = 0660 > user = _dovecot > } > user = _dovecot > } > service quota-warning { > executable = script /Applications/Server.app/Contents/ServerRoot/usr/libexec/dovecot/quota-warning.sh > unix_listener quota-warning { > group = mail > mode = 0660 > user = _dovecot > } > user = _dovecot > } > service stats { > fifo_listener stats-mail { > mode = 0600 > user = _dovecot > } > } > ssl = required > ssl_ca = </etc/certificates/host.domain.tld.SHA1.chain.pem > ssl_cert = </etc/certificates/host.domain.tld.SHA1.cert.pem > ssl_cipher_list = ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA > ssl_key = # hidden, use -P to show it > ssl_key_path = # hidden, use -P to show it > ssl_protocols = !SSLv2 !SSLv3 > userdb { > args = partition=/Library/Server/Mail/Config/dovecot/partition_map.conf global_quota=8192 enforce_quotas=yes > driver = od > } > userdb { > args = /Library/Server/Mail/Config/dovecot/submit.passdb > driver = passwd-file > } > verbose_proctitle = yes > protocol lmtp { > mail_plugins = quota zlib acl fts fts_sk sieve push_notify > } > protocol lda { > mail_plugins = quota zlib acl fts fts_sk sieve push_notify > } > protocol imap { > mail_max_userip_connections = 20 > mail_plugins = quota zlib acl fts fts_sk imap_acl imap_quota imap_zlib > } > protocol pop3 { > mail_max_userip_connections = 6 > }

3 6

[mail-crypt-plugin] Private key location in Folder Key Mode
by emordin 01 Jun '19

01 Jun '19

Hi, So I am trying to locate the private key in dovecot-attributes but I can't seem to find it. I have went thru the strings in the file with the lib-dcrypt document as a guide but the private key doesn't seem to be in there. I'm guessing the private key is an internal attribute located here '/private/vendor/vendor.dovecot/pvt' , but according to the mail-attribute.h file that location is not accessible. Is this true? Or is there a way to see the private key? Thanks. Sent with [ProtonMail](https://protonmail.com) Secure Email.

2 1

[mail-crypt-plugin] Password Query for Folder Keys questions
by emordin 31 May '19

31 May '19

> Can you try rm dovecot-attributes file? Okay it worked. I kinda did that by 'rm -rf' the entire /var/vmail/domain, and then I ran the following: doveadm -o plugin/mail_crypt_private_password=desired_password mailbox cryptokey generate -u user -UR And I got the check mark and the ID string of characters. I sent a new email to the server, and was able to open and read the email =) I got confused on the docs... So only if using unencrypted folder keys, could I open a CRYPTED email and read it right away. But if using encrypted folder keys, first I would have to set a password for the key before I could open the CRYPTED email ? I thought logging in to the mailbox would connect the password to the key automatically. Thanks again. Sent with [ProtonMail](https://protonmail.com) Secure Email.

1 0

[mail-crypt-plugin] Password Query for Folder Keys questions
by emordin 31 May '19

31 May '19

So when I tried this way I got the following output: user'@'host:~$ doveadm -o plugin/mail_crypt_private_password=desired_password mailbox > cryptokey generate -u user -UR user'@'host:~$ And when I tried this way I got the following output: user'@'host:~$doveadm -o plugin/mail_crypt_private_password=desired_password mailbox cryptokey generate -u user -UR Folder Public ID user'@'host:~$ In both cases I sent a new email to the server, and I got errors stating the mailbox can't be opened Sent with [ProtonMail](https://protonmail.com) Secure Email.

2 1

(4) [mail-crypt-plugin] Password Query for Folder Keys questions
by emordin 31 May '19

31 May '19

>> Can you try >> >> doveadm -o plugin/mail_crypt_private_password=desired_password mailbox > cryptokey generate -u user -UR >> >> Aki > > I tried that and got the following: > > [user at host](https://dovecot.org/mailman/listinfo/dovecot) :~$ doveadm -o plugin/mail_crypt_private_password=desired_password mailbox > cryptokey generate -u user -UR > > Folder Public ID > > [user at host](https://dovecot.org/mailman/listinfo/dovecot) :~$ > > Then I sent a new email to the mail server, and I checked it with mutt but got 'Internal Error' 'error opening mailbox' and I > > checked the email with Roundcube and I can see the subject header but when I open the email its just blank. I apologize I forgot to add the '>', in the last one, so I added it and got this output: [user at host](https://dovecot.org/mailman/listinfo/dovecot):~$ doveadm -o plugin/mail_crypt_private_password=desired_password mailbox > cryptokey generate -u user -UR [user at host](https://dovecot.org/mailman/listinfo/dovecot):~$ However it still didn't work. I sent a new email and tried to access it with mutt and Roundcube and I still can't access the body message. Sent with [ProtonMail](https://protonmail.com) Secure Email.

1 0

[mail-crypt-plugin] Password Query for Folder Keys questions
by emordin 31 May '19

31 May '19

> Can you try > > doveadm -o plugin/mail_crypt_private_password=desired_password mailbox > cryptokey generate -u user -UR > > Aki I tried that and got the following: user@host:~$ doveadm -o plugin/mail_crypt_private_password=desired_password mailbox > cryptokey generate -u user -UR Folder Public ID user@host:~$ Then I sent a new email to the mail server, and I checked it with mutt but got 'Internal Error' 'error opening mailbox' and I checked the email with Roundcube and I can see the subject header but when I open the email its just blank. Sent with [ProtonMail](https://protonmail.com) Secure Email.

2 1

[mail-crypt-plugin] Password Query for Folder Keys questions
by emordin 31 May '19

31 May '19

So I believe I generated a key successfully with: 'doveadm mailbox cryptokey generate -u user -UR' because I got the output with the check mark and the Public ID string of characters. However I still can't read the CRYPTED emails when logging in with IMAP.. i'm still getting the following error in the mail log: Error: read() failed: read(/var/vmail/[domain . com/user/Maildir/cur/](http://domain.com/user/Maildir/cur/)<email_index>) failed: Private key not available: Cannot decrypt key ... : error:03070068:big num routines:BN_mpi2bn:encoding error I've tried to list the key with 'doveadm mailbox cryptokey list -u user' but I'm only getting the following output: Folder Active Public ID And I've tried to create a password with 'doveadm mailbox cryptokey password -u user -n Password1' and I'm getting the following output: result: dcrypt_key_load_private(...) failed: password missing Also my settings in conf.d: 10-mail.conf - mail_attribute_dict = file:%h/Maildir/dovecot-attributes mail_plugins = $mail_plugins mail_crypt plugins{ mail_crypt_curve = secp512r1 mail_crypt_save_version = 2 mail_crypt_require_encrypted_user_key = yes } 20-lmtp.conf - protocol lmtp{ mail_plugins = $mail_plugins sieve } And my settings in dovecot-sql.conf.ext: driver = mysql connect = host=127.0.0.1 dbname=mailserver user=mailuser password=1234 password_query = SELECT email as user,password, '%w' AS userdb_mail_crypt_private_password FROM virtual_users WHERE email='%u'; In the virtual_users table I have: id, domain_id, email, password Any ideas what the issue may be? Also am I suppose to add the 'userdb_mail_crypt_private_password' into the table and put the virtual users email login password in there? Or is it suppose to be a temporary query? Thanks. Sent with [ProtonMail](https://protonmail.com) Secure Email.

2 1

Problem SSL entrust certificate
by Il Neofita 31 May '19

31 May '19

Hi I have compiled dovecot 2.3.6 on RH 8, and I copied the configuration from dovecot 2.0.9 however, when I try to connect the new machine the certificate is not recognized The same certificate is working with apache CONNECTED(00000004) depth=0 ... verify error:num=20:unable to get local issuer certificate verify return:1 depth=0 ... verify error:num=21:unable to verify the first certificate verify return:1 ... --- No client certificate CA names sent Peer signing digest: SHA256 Peer signature type: RSA-PSS Server Temp Key: X25519, 253 bits --- SSL handshake has read 2311 bytes and written 404 bytes Verification error: unable to verify the first certificate

1 0