May 2019 - dovecot - dovecot.org

lmtp report permission denied on delivery to multiple recipients
by Patrick Cernko 22 May '19

22 May '19

Hello, when receiving mails for multiple recipients via LMTP, I often see the following messages on our servers: > May 22 11:06:10 sinon dovecot[44304]: lmtp(119718): Connect from $IP$ > May 22 11:06:11 sinon dovecot[44304]: lmtp($USER1$)<119718><2HnmOgIR5Vym0wEA22L5Rg>: msgid=<$MSGID$>: saved mail to INBOX > May 22 11:06:11 sinon dovecot[44304]: lmtp($USER2$)<119718><2HnmOgIR5Vym0wEA22L5Rg:2>: Error: stat(/IMAP/mail/mailboxes/$USER1$/mdbox/mailboxes/INBOX/dbox-Mails/dovecot.index.cache) failed: Permission denied (euid=$UID2$($USER2$) egid=$GID2$(rbg) missing +x perm: /IMAP/mail/mailboxes/$USER1$, dir owned by $UID1$:$GID2$ mode=0700) > May 22 11:06:11 sinon dovecot[44304]: lmtp($USER2$)<119718><2HnmOgIR5Vym0wEA22L5Rg:2>: Error: open(/IMAP/mail/mailboxes/$USER1$/mdbox/mailboxes/INBOX/dbox-Mails/dovecot.index.cache) failed: Permission denied (euid=$UID2$($USER2$) egid=$GID2$(rbg) missing +x perm: /IMAP/mail/mailboxes/$USER1$, dir owned by $UID1$:$GID2$ mode=0700) > May 22 11:06:11 sinon dovecot[44304]: lmtp($USER2$)<119718><2HnmOgIR5Vym0wEA22L5Rg:2>: Error: lstat(/IMAP/mail/mailboxes/$USER1$/mdbox/mailboxes/INBOX/dbox-Mails/dovecot.index.cache.lock) failed: Permission denied > May 22 11:06:11 sinon dovecot[44304]: lmtp($USER2$)<119718><2HnmOgIR5Vym0wEA22L5Rg:2>: Error: file_dotlock_open(/IMAP/mail/mailboxes/$USER1$/mdbox/mailboxes/INBOX/dbox-Mails/dovecot.index.cache) failed: Permission denied (euid=$UID2$($USER2$) egid=$GID2$(rbg) missing +x perm: /IMAP/mail/mailboxes/$USER1$, dir owned by $UID1$:$GID2$ mode=0700) > May 22 11:06:11 sinon dovecot[44304]: lmtp($USER2$)<119718><2HnmOgIR5Vym0wEA22L5Rg:2>: Error: open(/IMAP/mail/mailboxes/$USER1$/mdbox/mailboxes/INBOX/dbox-Mails/dovecot.index.cache) failed: Permission denied (euid=$UID2$($USER2$) egid=$GID2$(rbg) missing +x perm: /IMAP/mail/mailboxes/$USER1$, dir owned by $UID1$:$GID2$ mode=0700) > May 22 11:06:11 sinon dovecot[44304]: lmtp($USER2$)<119718><2HnmOgIR5Vym0wEA22L5Rg:2>: 2HnmOgIR5Vym0wEA22L5Rg:2: sieve: msgid=<$MSGID$>: stored mail into mailbox 'INBOX' > May 22 11:06:11 sinon dovecot[44304]: lmtp(119718): Disconnect from $IP$: Successful quit (usernames, uids, gids and IP addresses anonymized) So far, I was not able to reproduce this issue on a simple test setup, but I have the strong impression, that is has something to do with the fact, if some of the affected users have a active sieve script and others do not use sieve. In the example above $USER1$ did not have a sieve script configured but $USER2$ had one, as you can see. As a workaround, I configured an empty sieve script for all users with out sieve configured. This seems to work but actually I do not want to have users with empty sieve scripts. This bug seems to be related to https://dovecot.org/list/dovecot/2013-February/088540.html where Timo stated: "LMTP always delivers the mail to the first user. Then it tries to copy the first mail to the second user, because in some setups this can be done using hard links. With mbox that of course doesn't work, but looks like instead of failing silently it logs an error. So everything is working as it should, except there are these unnecessary errors logged. I'll see about getting rid of them." Is it possible to get rid of these error messages, either by a config setting that prevents if they do not lead to a real problem or by changing the code to avoid the behaviour described by Timo? Attached you can find doveconf -n output and the used ldap.conf (both anonymized), the referenced /etc/dovecot/passdb.deny and /etc/dovecot/userdb.overrides are usually empty files and only used during mailbox migrations. Best regards, -- Patrick Cernko <pcernko(a)mpi-klsb.mpg.de> +49 681 9325 5815 Joint Administration: Information Services and Technology Max-Planck-Institute fuer Informatik & Softwaresysteme

1 0

Integrity check mdbox?
by Marc Roos 22 May '19

22 May '19

Is it possible to do some sort of integrity check on mdbox's

2 1

Converting user mailboxes from maildir to sdbox
by David Mehler 22 May '19

22 May '19

Hello, I've got a Postfix/Dovecot server setup. Currently Dovecot is version 2.3.6, and it's using Maildir storage. The mailbox is: mail_home = /home/vmail/mailboxes/%d/%n mail_location = maildir:~/mail:LAYOUT=fs I'm wanting to convert from Maildir to sdbox. I looked at: https://wiki2.dovecot.org/MailboxFormat I was initially thinking mdbox but that's multiple messages per file, which I do not believe is what I want. Am I correct that in the sdbox format if a single message file is corrupted only that message is corrupt and not the rest of the messages as would be the case in a mdbox setup? On the page: https://wiki2.dovecot.org/Migration/MailFormat " maildir -> sdbox migration. Set mail_location=sdbox:~/sdbox and run dsync -u username mirror maildir:~/Maildir " If I set mail_location=sdbox:~/sdbox will that put the user mailboxes in mail_home/sdbox? So it would be: /home/vmail/mailboxes/example.com/username/sdbox I am needing to do this migration, but am paranoid about loosing mail or corrupting mailboxes. All of my users are virtual users and they are stored in a mysql database. Thanks. Dave.

2 1

[mail-crypt-plugin] How to decrypt mailbox?
by emordin 22 May '19

22 May '19

How do I enable the mail-crypt-plugin globally? Do I have to place 'mail_plugins = $mail_plugins mail_crypt' inside ever conf.d file where there is a protocol code block? Like for example the protocol lda codeblock in 15-lda.conf and the protocol imap codeblock in 20-imap.conf I placed 'mail_plugins = $mail_plugins mail_crypt' in 20-lmtp.conf inside the protocol lmtp code block, and the actual plugin settings are inside 90-plugin.conf inside the plugin codeblock. And I was able to get CRYPTED mail with this config. If I place 'mail_plugins = $mail_plugins mail_crypt' inside 90-plugin.conf, I get an error telling me to put 'mail_plugins = $mail_plugins mail_crypt' in 20-lmtp.conf Sent with [ProtonMail](https://protonmail.com) Secure Email.

2 1

Problems after upgrade from 2.2 to 2.3
by Lampa 21 May '19

21 May '19

Hello, i was using dovecot version 2.2 on debian server. After upgrade to debian version 2.3 i have problems. After some time imap doesn't work. There are lot of messages in log 2019-05-21T10:27:49.186373+02:00 hermes dovecot: imap-login: Error: master(imap): net_connect_unix(imap) failed: Resource temporarily unavailable - http://wiki2.dovecot.org/SocketUnavailable (client-pid=24810, client-id=148, rip=2.2.2.2, created 551 msecs ago, received 0/4 bytes) 2019-05-21T10:27:50.808136+02:00 hermes dovecot: imap-login: Error: master(imap): net_connect_unix(imap) failed: Resource temporarily unavailable - http://wiki2.dovecot.org/SocketUnavailable (client-pid=24810, client-id=169, rip=2.2.2.2, created 531 msecs ago, received 0/4 bytes) Tried client_limit set to 1 , service_count to 1 or 0 , still same results. It's imap server for 3k users. Any suggestions, please let me know. Thank you very much. Regards -- Lampa

1 0

Dovecot with LDAP Proxy
by Federico Bartolucci 21 May '19

21 May '19

Hello, configuring Dovecot with LDAP authentication, adding the parameter in ther sql config file: pass_attrs = \ =proxy=y I see then backend connections always addressed to localhot port 143: /user=utente1(a)domanin.com proxy lip=127.0.0.1 lport=143 / while I expect that connections would be managed by the director and then addressed to my backend IPs and specific port. Is there a way to configure ldap proxy to get that behavior? Thanks in advance. -federico

2 3

Dovecot documentation
by ＠lbutlr 21 May '19

21 May '19

the make config options for dovecot on FreeBSD list list [x] ICU Use libicu for FTS unicode normalization but https://wiki2.dovecot.org/Plugins/FTS makes no mention of libicu (nor of icu at all). is linicu simply in addition to the four options of Solar, Lucene, fts-xapian, and fts-dovecot? Also, the link to fts-dovecot goes to https://wiki2.dovecot.org/Plugins/FTS/Dovecot which is a 404. -- Man is born free, but is everywhere in chains.

1 0

[mail-crypt-plugin] How to decrypt mailbox?
by emordin 21 May '19

21 May '19

Hi, So I am able to encrypt email using the crypt plugin, but when I try to access the email by logging in thru mutt or roundcube the email is still encrypted. Is the decryption process automatic or do I have to create a custom program with the decrypt.rb code? Thanks. Sent with [ProtonMail](https://protonmail.com) Secure Email.

2 1

Further issues on FTS engine
by Joan Moreau 20 May '19

20 May '19

Hi, Additionally to the long list of problem on the FTS previously discussed, here a new: WHen I reset the indexes, the indexer-worker seems paralelleizing the indexing (which is good), however, the number available in "ps aux | grep dove" shows that it does not move: dovecot 28549 0.0 0.0 8620 3920 ? S 06:20 0:00 dovecot/indexer [0 clients, 3 requests] mailuse+ 28550 98.6 0.1 167412 86916 ? R 06:20 5:28 dovecot/indexer-worker [jom(a)grosjo.net XXXX - 800/37755] Looking further, if I put a tracer in teh backend, it treats the *same* message several times in parallel, and therefore does not move very fast on the global indexing of the box ANy clue ? THanks

2 1

enforcing multiple per-mailbox quotas for shared mailboxes
by Jost-Philip Matysik 20 May '19

20 May '19

Hi! I'm trying to get quotas for shared mailboxes set up on my server. It's not working, and I fail to understand why. Documentation for setup of this complexity is rather scarce on the web, and the discussions I found either don't directly apply or terminate with "I got it working" but no explanation. Can someone please help? The setup is rather lengthy and complicated, so I'll try to give a summary first for easier understanding. All help is appreciated! Please respond if you need more info! Thanks! Best regards, Jost Basic setup (where am I coming from?): ====================================== - This is a Debian 9 system with a more recent version of dovecot installed from https://repo.dovecot.org/ce-2.3-latest/debian/stretch - users have individual mailboxes with individual quotas -- this works great! - users can share mailboxes with other users through ACLs. To achieve this, there exists a wildcarded namespace with prefix="ZZZ_Freigaben/%%u" --this also works great! ==> up to here it's pretty much following the examples from the Wiki to the letter. Configuration goal (what do I want to achieve?): ================================================ - attach quotas to mailboxes, not logins - when copying/moving mails across shared mailboxes during imap sessions, enforce quota based on target mailbox, not logged-in user doing the copying. To clarify: ==> so if Bob has a quota of 500MB, all messages in Bob's mailbox should count against (and only against!) Bob's quota, regardless of who put them there. ==> if Alice has access to her own mailbox (directly), as well as Bob's mailbox and Dave's mailbox (through sharing), she should see 3 individual quotas when logging in: her own quota (200MB) for everything in her mailbox, bob's quota (300MB) for everything in Bob's mailbox, and Dave's quota (10GB) for everything in Dave's mailbox. These 3 quotas should be completely independant and neither block, nor override each other. Setup Idea (how I tried to get there): ====================================== - "quota=..." "quota_rule" and "quota_rule2" always refer to the user's own mailbox (with an additional rule for Trash). Everyone has those, so these are loaded statically from dovecot config file. - "quota_rule" is overwritten from userdb with the user's individual mailbox quota (the more I like you, the more space you get...) - since the number of different additional quotas required per user depends on how many mailboxes are shared with that user, individual "quota2=...", "quota3=...", "quotaN=..." fields are dynamically generated by the MySQL backend and loaded from userdb upon login. - consequently, for each "quotaN=..." entry, a corresponding "quotaN_rule=*:storage=XXX" is generated and returned from userdb (substitute N=1,2,3,4,... accordingly) Observations: ============= 1. enforcing quota for the user's personal mailbox works as expected, both through IMAP and when delivering incoming mail 2. overriding "quota_rule=..." from userdb for the user's personal mailbox works great. Individual quota is recognized and enforced both through IMAP and when delivering incoming mail. 3. dynamically loading "quota2=...", "quota3=..." etc. from userdb doesn't seem to work at all! I can see them being added as extra fields in the logs upon user login, but the quota-plugin seems to completely ignore them. They are not enforces, and tools like 'doveadm quota' list the userdb fields in the debug messages, but do not interpret them in any way. They do not throw errors either, the additional quota roots are just silently ignored. 4. the end result is that in an IMAP session the logged-in user's quota is enforced for their individual mailbox, but as soon as they write to someone else's mailbox (move a mail to /ZZZFreigaben/bob/Some-Subfolder), no quota is enforced at all! Additional debugging done: ========================== if I hardcode a "quota2=" and/or "quota3=" in the config file, I can observe the following: - If I hardcode "quota2=count:some_name:ns=ZZZ_Freigaben/", dovecot and doveadm will recognize the additional quota root. But since the folder "ZZZ_Freigaben/" on its own isn't a mailbox (it's just a path CONTAINING mailboxes), the quota is neither displayed in clients, nor enforced. It has no real-word effect, other than 'doveadm quota' showing an additional line. - If I hardcode "quota2=count:other_name:ns=ZZZ_Freigaben/postmaster/" in the config file (with that path being the real IMAP path to a shared mailbox), dovecot will complain in the log saying Error: quota: Unknown namespace: ZZZ_Freigaben/postmaster/ dovecot will start and work for the most part, but again completely ignore settings for the additional quota. - additionally, trying to override "quota2_rule=..." from userdb doesn't work as it does with "quota_rule=..."! If I have both "quota_rule=..." and "quota2_rule=..." in the config file as well as returned from userdb (with different values), dovecot will use "quota_rule" from userdb, but "quota2_rule" from config file. This behavior seems inconsistent! - I tried both maildir and count backends (seperately or mixed). Both show the same behavior. - I tried appending or removing an empty "ns=" to the first "quota=..." entry (the wiki shows some examples with it, some without). Makes no difference... Configuration Dumps below (slightly redacted to remove complete email addresses or IPs) ========================== output of dovecot -n: # 2.3.6 (7eab80676): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.6 (92dc263a) # OS: Linux 4.9.0-9-amd64 x86_64 Debian 9.9 # Hostname: [censored] auth_failure_delay = 10 secs auth_mechanisms = plain login default_vsz_limit = 512 M dict { acl = mysql:/etc/dovecot/dovecot-dict-sql.conf.ext } listen = * lmtp_rcpt_check_quota = yes login_greeting = Mail system ready. mail_gid = vmail mail_location = maildir:~/Maildir mail_plugins = " quota acl" mail_uid = vmail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext imapsieve vnd.dovecot.imapsieve namespace Freigaben { list = children location = maildir:%%h/Maildir:INDEXPVT=%h/Maildir/Freigaben/%%u prefix = ZZZ_Freigaben/%%u/ separator = / subscriptions = no type = shared } namespace inbox { inbox = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk { auto = subscribe autoexpunge = 61 days special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { auto = subscribe autoexpunge = 61 days special_use = \Trash } prefix = separator = / subscriptions = yes type = private } passdb { args = /etc/dovecot/dovecot-sql.conf.username driver = sql } plugin { acl = vfile:/etc/dovecot/dovecot-acl acl_defaults_from_inbox = yes acl_shared_dict = proxy::acl imapsieve_mailbox1_before = file:/etc/dovecot/sieve/learn-spam.sieve imapsieve_mailbox1_causes = COPY imapsieve_mailbox1_name = Junk imapsieve_mailbox2_before = file:/etc/dovecot/sieve/learn-ham.sieve imapsieve_mailbox2_causes = COPY imapsieve_mailbox2_from = Junk imapsieve_mailbox2_name = * quota = count:User quota:ns= quota_grace = 1%% quota_rule = *:storage=5G quota_rule2 = Trash:storage=+100M quota_status_nouser = DUNNO quota_status_overquota = 552 5.2.2 Mailbox is full quota_status_success = DUNNO quota_vsizes = yes sieve = file:~/sieve;active=~/.dovecot.sieve sieve_after = /etc/dovecot/sieve-after sieve_global_extensions = +vnd.dovecot.pipe +vnd.dovecot.environment sieve_max_script_size = 10M sieve_pipe_bin_dir = /etc/dovecot/sieve sieve_plugins = sieve_imapsieve sieve_extprograms sieve_quota_max_storage = 50M } postmaster_address = postmaster(a)matysik-ingenieurwesen.de protocols = " imap lmtp sieve" service auth-worker { user = vmail } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } unix_listener auth-userdb { mode = 0666 } } service dict { unix_listener dict { group = vmail mode = 0660 user = dovecot } } service imap-login { inet_listener imap { port = 0 } inet_listener imaps { address = [censored] port = 993 ssl = yes } } service imap { process_limit = 1024 } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } service managesieve-login { inet_listener sieve { address = [censored] port = 4190 } service_count = 1 } service managesieve { process_limit = 64 } ssl_cert = </etc/letsencrypt/live/fullchain.pem ssl_cipher_list = ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!MD5:!DSS ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it ssl_min_protocol = TLSv1.2 ssl_options = no_compression ssl_prefer_server_ciphers = yes # comment: since imap logins differ from email-addresses I have 2 # userdb queries. One will return fields for %u='login', the other will # return fields for %u='email(a)domain.tld'. # no %u will ever make BOTH userdbs return rows (they are mutually exclusive) userdb { args = /etc/dovecot/dovecot-sql.conf.email driver = sql } userdb { args = /etc/dovecot/dovecot-sql.conf.username driver = sql } protocol lmtp { mail_plugins = " quota acl sieve" } protocol imap { mail_plugins = " quota acl imap_sieve imap_quota imap_acl" } example userdb output: ======================= root@server:/# doveadm -Dv user jost Debug: Loading modules from directory: /usr/lib/dovecot/modules Debug: Module loaded: /usr/lib/dovecot/modules/lib01_acl_plugin.so Debug: Module loaded: /usr/lib/dovecot/modules/lib10_quota_plugin.so Debug: Loading modules from directory: /usr/lib/dovecot/modules/doveadm Debug: Module loaded: /usr/lib/dovecot/modules/doveadm/lib10_doveadm_acl_plugin.so Debug: Skipping module doveadm_expire_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/lib10_doveadm_expire_plugin.so: undefined symbol: expire_set_deinit (this is usually intentional, so just ignore this message) Debug: Module loaded: /usr/lib/dovecot/modules/doveadm/lib10_doveadm_quota_plugin.so Debug: Module loaded: /usr/lib/dovecot/modules/doveadm/lib10_doveadm_sieve_plugin.so Debug: Skipping module doveadm_fts_lucene_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/lib20_doveadm_fts_lucene_plugin.so: undefined symbol: lucene_index_iter_deinit (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_fts_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/lib20_doveadm_fts_plugin.so: undefined symbol: fts_user_get_language_list (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_mail_crypt_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/libdoveadm_mail_crypt_plugin.so: undefined symbol: mail_crypt_box_get_pvt_digests (this is usually intentional, so just ignore this message) field valuedoveadm(jost)<25290><>: Debug: auth USER input: jost home=/var/vmail/matysik.it/jost-philip uid=5000 gid=5000 acl_groups=matysik,admin quota_rule=*:storage=10G quota_rule2 = Trash:storage=+100M quota2 = count:shared quota for maschinen:ns=ZZZ_Freigaben/maschinen/ quota2_rule = *:storage=500M quota3 = count:shared quota for matysik:ns=ZZZ_Freigaben/matysik/ quota3_rule = *:storage=10G quota4 = count:shared quota for postmaster:ns=ZZZ_Freigaben/postmaster/ quota4_rule = *:storage=1G uid 5000 gid 5000 home /var/vmail/matysik.it/jost-philip mail maildir:~/Maildir acl_groups matysik,admin quota_rule *:storage=10G quota_rule2 Trash:storage=+100M quota2 count:shared quota for maschinen:ns=ZZZ_Freigaben/maschinen/ quota2_rule *:storage=500M quota3 count:shared quota for matysik:ns=ZZZ_Freigaben/matysik/ quota3_rule *:storage=10G quota4 count:shared quota for postmaster:ns=ZZZ_Freigaben/postmaster/ quota4_rule *:storage=1G

1 0