March 2020 - dovecot - dovecot.org

doveadm backup from gmail with imapc
by Ben Mulvihill 11 Apr '20

11 Apr '20

I am trying to backup a gmail account (not the one I am writing from) to dovecot, using doveadm-backup and imapc, but am having ssl connection problems. ted@expectation:~# doveadm backup -D -R -u ted imapc: dsync(ted): Info: imapc(imap.gmail.com:993): Connected to 74.125.71.108:993 (local 10.7.1.179:53852) dsync(ted): Warning: imapc(imap.gmail.com:993): Server disconnected unexpectedly: SSL_connect() failed: error:14094410:SSL routines:ssl3_read_bytes:sslv3 alert handshake failure: SSL alert number 40 - reconnecting (delay 0 ms) dsync(ted): Info: imapc(imap.gmail.com:993): Connected to 74.125.71.109:993 (local 10.7.1.179:59052) dsync(ted): Error: imapc(imap.gmail.com:993): Server disconnected unexpectedly: SSL_connect() failed: error:14094410:SSL routines:ssl3_read_bytes:sslv3 alert handshake failure: SSL alert number 40 - disconnecting dsync(ted): Error: User initialization failed: imapc: Login to imap.gmail.com failed: Disconnected from serv I am using dovecot version 2.2.33.2 on ubuntu, with the configuration below. I have also enabled "allow access from unsecure apps" in my gmail settings. My first thought looking at the error messages was has that perhaps doveadm-backup was trying to connect with ssl3, which is no longer supported by gmail or anyone else nowadays. But apparently the ssl3_read_bytes function in openssl also handles tls, so the reference to ssl3 in the message is misleading, and the real problem must be elsewhere. If anyone can help me debug this I'd be grateful. Many thanks, Ben root@expectation:/etc/dovecot# doveconf -N # 2.2.33.2 (d6601f4ec): /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.21 (92477967) # OS: Linux 4.15.0-91-generic x86_64 Ubuntu 18.04.4 LTS auth_mechanisms = plain imapc_features = rfc822.size gmail-migration fetch-headers imapc_host = imap.gmail.com imapc_password = # hidden, use -P to show it imapc_port = 993 imapc_ssl = imaps imapc_ssl_verify = no imapc_user = MY_GMAIL_ADDRESS mail_location = maildir:~/Maildir mail_prefetch_count = 20 mail_privileged_group = mail namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { driver = pam name = } protocols = " imap" ssl = yes ssl_cert = </etc/dovecot/private/dovecot.pem ssl_cipher_list = ALL:!LOW:!SSLv2:!SSLv3:!EXP:!aNULL ssl_client_ca_dir = /etc/ssl/certs ssl_key = # hidden, use -P to show it ssl_prefer_server_ciphers = yes ssl_protocols = !SSLv3 userdb { driver = passwd name = }

6 13

Warning: Failed to do incremental sync
by Laura Smith 08 Apr '20

08 Apr '20

Setup dovecot sync along the lines of (https://wiki2.dovecot.org/Replication) I am doing one way replication. The initial full replication happened without issue, but now I'm seeing these errors on the slave server: doveadm: Warning: /data/mail/foo/bar/Maildir/dovecot-uidlist: Duplicate file entry at line 26397: 1562173159.M215923P17350.mxp,S=2290,W=2339 (uid 143128 -> 143142) Warning: Failed to do incremental sync for mailbox Sent Messages, retry with a full sync (Modseq 1766 no longer in transaction log (highest=17617, last_common_uid=17559, nextuid=17560)) Warning: Failed to do incremental sync for mailbox INBOX, retry with a full sync (Modseq 2540 no longer in transaction log (highest=13870, last_common_uid=19912, nextuid=19913)) I guess dovecot automatically tries a full replication because eventually the messages get pushed and "sync failed" status changes from 'y' to '-'

2 1

Query change mdbox_rotate_size & mdbox_rotate_interval after sometime
by Durga Prasad Malyala 06 Apr '20

06 Apr '20

Hello All, If I change the mdbox_rotate_size to 100 MB & mdbox_rotate_interval to say 3 days after a year of usage what would be the impact on existing mails and new mails? Thanks/DP

1 1

replication and spam removal ("doveadm expunge")
by Olaf Hopp 06 Apr '20

06 Apr '20

Hello everybody, since now I did no replication and spam is delivered into users folder "spambox" Every night there is a cronjob which deletes spam older than 30 days via something like "find .... -ctime +30 -delete" Now I'm going to set up replication (two way) and I thought that doing "rm" is not a good idea. So I modified the job to something like /usr/bin/doveadm expunge -u test1 mailbox INBOX.spambox BEFORE 30d which works like intended, but I see that on the replication partner the spam isn't deleted. Even if I do a doveadm force-resync -u test1 '*' or log in via imap to the replication partner I still see the old spam. So my question is: is this the intended behaviour and I have to run the "doveadm expunge" on both replication partners or should the deletion via "expunge" being replicated to the partner and I have a misconfiguration or maybe I hit a bug ? Regards, Olaf /etc/dovecot/conf.d/12-replication.conf: mail_plugins = $mail_plugins notify replication service aggregator { fifo_listener replication-notify-fifo { mode = 0666 } unix_listener replication-notify { mode = 0666 } } service replicator { process_min_avail = 1 unix_listener replicator-doveadm { mode = 0666 } } service doveadm { inet_listener { port = 1109 } } doveadm_password = XXXXX plugin { mail_replica = tcp:X.Y.Z.X:1109 } -- Karlsruher Institut für Technologie (KIT) ATIS - Abt. Technische Infrastruktur, Fakultät für Informatik Dipl.-Geophys. Olaf Hopp - Leitung IT-Dienste - Am Fasanengarten 5, Gebäude 50.34, Raum 009 76131 Karlsruhe Telefon: +49 721 608-43973 Fax: +49 721 608-46699 E-Mail: Olaf.Hopp(a)kit.edu www.atis.informatik.kit.edu www.kit.edu KIT - Die Forschungsuniversität in der Helmholtz-Gemeinschaft Das KIT ist seit 2010 als familiengerechte Hochschule zertifiziert.

2 4

net_connect_unix(imap) failed
by Philipp Ewald 06 Apr '20

06 Apr '20

Hello everyone, we have a huge problem with dovecot and IMAP connections. we got the following errors: 39665 today dovecot: imap-login: Error: master(imap): net_connect_unix(imap) failed: Resource temporarily unavailable - http://wiki2.dovecot.org/SocketUnavailable (client-pid=29066, client-id=1755, rip=IP, created 562 msecs ago, received 0/4 bytes) we thinks this may be a problem with authorization take too long? Authorization is not local and with SQL. i found the following in source code of Dovecot: #define SOCKET_CONNECT_RETRY_MSECS 500 #define SOCKET_CONNECT_RETRY_WARNING_INTERVAL_SECS 2 [...] i_error("master(%s): %s (client-pid=%u, client-id=%u, rip=%s, created %u msecs ago, received %u/%zu bytes)", This is no process limit problem: ps auxf | grep -c "[d]ovecot/imap$" 688 ps auxf | grep -c "[d]ovecot/imap-login$" 100 cat /proc/`pidof dovecot`/limits Limit Soft Limit Hard Limit Units Max cpu time unlimited unlimited seconds Max file size unlimited unlimited bytes Max data size unlimited unlimited bytes Max stack size 8388608 unlimited bytes Max core file size 0 unlimited bytes Max resident set unlimited unlimited bytes Max processes 64053 64053 processes Max open files 65535 65535 files Max locked memory 65536 65536 bytes Max address space unlimited unlimited bytes Max file locks unlimited unlimited locks Max pending signals 64053 64053 signals Max msgqueue size 819200 819200 bytes Max nice priority 0 0 Max realtime priority 0 0 Max realtime timeout unlimited unlimited us ulimit -n 1024 dovecot --version 2.3.4.1 (f79e8e7e4) protocols = imap pop3 service imap-login { process_min_avail = 4 service_count = 0 } service imap { process_limit = 4096 } service pop3-login { process_min_avail = 4 service_count = 0 } service pop3 { process_limit = 4096 } Can someone explain why we got this error and how to fix? If you need another information please tell me. -- Philipp Ewald Administrator DigiOnline GmbH, Probsteigasse 15 - 19, 50670 Köln E-Mail: philipp.ewald(a)digionline.de Web: www.digionline.de, www.webweaver.de AG Köln HRB 27711, St.-Nr. 5215 5811 0640 Geschäftsführer: Werner Grafenhain Informationen zum Datenschutz: www.digionline.de/ds

2 2

Disable Dovecot LDA
by Adam Raszkiewicz 02 Apr '20

02 Apr '20

Hi, Is there any way to disable Dovecot LDA? I want to always send email via postfix and relay server even it will be a local delivery within the Dovecot server Thanks, Adam

6 9

[Dovecot] Postfixadmin/MySQL/Dovecot 2 and quota
by Matt 01 Apr '20

01 Apr '20

Hi all, I'm setting up a new email server based on the softwares list below: * Postfix * Dovecot 2.0.9 * MySQL * Postfixadmin 2.3.6 My current problem is I'm unsure whether quota feature is well configured or not. In order to test and validate, I use Roundcubemail GUI which provides percentage of the space used by the mailbox (quota should be applied per mailbox). Here, my dovecot configuration: dovecot.conf: dict { quotadict = mysql:/etc/dovecot/dovecot-dict-quota.conf } dovecot-dict-quota.conf: connect = host=localhost dbname=postfix user=postfix password=postfix map { pattern = priv/quota/storage table = quota2 username_field = username value_field = bytes } map { pattern = priv/quota/messages table = quota2 username_field = username value_field = messages } dovecot-sql.conf.ext: driver = mysql connect = host=localhost dbname=postfix user=postfix password=postfix default_pass_scheme = PLAIN-MD5 password_query = SELECT username AS user, password, \ CONCAT('*:storage=', CAST(quota AS CHAR), 'b') AS quota_rule \ FROM mailbox WHERE username = '%u' AND active='1' user_query = SELECT maildir, 89 AS uid, 12 AS gid, \ concat('dict:storage=',floor(quota/1000),'::proxy::quotadict') AS quota, \ CONCAT('*:storage=', CAST(quota AS CHAR), 'b') AS quota_rule \ FROM mailbox WHERE username = '%u' AND active='1' conf.d/90-quota.conf: plugin { quota = dict:user::proxy::quotadict quota_rule2 = Trash:storage=+10%% } conf.d/20-imap.conf: protocol imap { mail_plugins = $mail_plugins imap_quota } When I check postfixadmin GUI, I can see that quota in realtime in quota2 table, no problem. But Roundcubemail cannot get this information and shows a unknown quota. If I add this line: quota_rule = *:storage=1G in conf.d/90-quota.conf file, it works, I mean roundcubemail gets and shows information (but not the one stored in db of course). I think I'm close to the right configuration but I need your help to complete this setup. Thank you in advance for your help. Best, Matt

7 20

Re: limit for user exceeded
by Maciej Milaszewski 31 Mar '20

31 Mar '20

Hi I Dont understand or I im thinking wrong: process_limit = 25000 Older: #fs.inotify.max_user_watches= 8192 #fs.inotify.max_user_instances = 16384 New: fs.inotify.max_user_instances = 8192 fs.inotify.max_user_watches= process_limit x 2 + fs.inotify.max_user_instances fs.inotify.max_user_watches= 58192 On 31.03.2020 13:44, Aki Tuomi wrote: > I would prefer replies on the list... =) > > no. the idea is to *increase* the *current* value of fs.inotify.max_user_watches and fs.inotify.max_user_instances with 50000 > > fs.inotify.max_user_watches = 8192 + 50000 = 58192 > > Aki > >> On 31/03/2020 14:21 Maciej Milaszewski <maciej.milaszewski(a)iq.pl> wrote: >> >> >> Hi >> How I understood it correctly >> >> service imap { >> process_limit = 25000 >> } >> >> fs.inotify.max_user_watches= 50000 >> fs.inotify.max_user_instances = 50000 >> >> ? >> >> >> On 31.03.2020 12:14, Aki Tuomi wrote: >>> Sorry, ment that we *increase* the current value with twice the process limit for IMAP. >>> >>> Aki >>> >>>> On 31/03/2020 13:12 Aki Tuomi <aki.tuomi(a)open-xchange.com> wrote: >>>> >>>> >>>> We usually set them to twice the number of process_limit for imap. >>>> >>>> Aki >>>> >>>>> On 31/03/2020 12:29 Maciej Milaszewski <maciej.milaszewski(a)iq.pl> wrote: >>>>> >>>>> >>>>> Hi >>>>> System debian 8.11 dovecot-2.2.36.4 and I have some warnings in log likes: >>>>> >>>>> Warning: Inotify watch limit for user exceeded, disabling. Increase >>>>> /proc/sys/fs/inotify/max_user_watches >>>>> >>>>> >>>>> cat /proc/sys/fs/inotify/max_user_watches >>>>> 8192 >>>>> >>>>> in sysctl i change >>>>> >>>>> #fs.inotify.max_user_watches= 8192 >>>>> #fs.inotify.max_user_instances = 16384 >>>>> >>>>> fs.inotify.max_user_watches= 16384 >>>>> fs.inotify.max_user_instances = 24576 >>>>> >>>>> One questions - should these values be equal?

1 0

mail_crypt crashing randomly during LMTP
by Andi Krischer 31 Mar '20

31 Mar '20

Hello everybody, hope you’re all well! We have a really strange bug with our dovecot setup. After weeks and month of debugging we’re finally reached the point when we ask you for help. Our basic setup is quite simple: a single dovecot 2.3.10 (0da0eff44) install on Debian 10 with LDAP as user/passdb and sieve, imap_sieve and mail_crypt as mail_plugins. For the mail_crypt we have a special rule which allows us to enable crypting for each user individually. See this line from dovecot-ldap.conf.ext: pass_attrs = userPassword=password,=userdb_mail_plugins=%{if;%{real_lport};eq;993;imap_sieve;} %{if;%{real_lport};eq;143;imap_sieve;} notify mail_log %{if;%{ldap:encryptMail};eq;TRUE;mail_crypt; },=userdb_mail_crypt_private_password=%w As you can see for IMAP connections we enable imap_sieve and if the LDAP attribute “encryptMail” is set to TRUE we enable “mail_crypt” as mail_plugin. This works fine except that around 5-10 times a day the dovecot server crashes during a LMTP connection. It crashes in the last steps of LMTP which result that the mail get delivered to Maildir but Postfix doesn’t get a positive response and delivers the mail again after a few minutes. So all of our users get some mails twice or even more times. This is what the log says in the moment of crashing: dovecot: lmtp(53852): Panic: Module context mail_crypt_user_module missing *** backtrace *** (see: https://pastebin.com/YCiFtxmy) dovecot: lmtp(53852): Fatal: master: service(lmtp): child 53852 killed with signal 6 (core dumps disabled - https://dovecot.org/bugreport.html#coredumps) Here I’ve pasted the LTMP session in mail.log: https://pastebin.com/A4ughNUF Obviously it looks like it has something to do with our mail_crypt setup. But the thing is that although we’re monitoring this for months we cannot find a condition which cause this. It seems to happen more frequent for mails with lot of people in To or CC (large headers), but definitively not all of them… Some more things we’ve already thought on: First my guess was that the mail_crypt plugin isn’t loaded in some case but in the backtrace are things from “lib10_mail_crypt_plugin.so”, so it should be loaded, right? On the other hand a non-crashing LTMP session looks exactly the same in log except it has three additional lines in mail.log: Debug: Loading modules from directory: /usr/lib/dovecot/modules Debug: Module loaded: /usr/lib/dovecot/modules/lib15_notify_plugin.so Debug: Module loaded: /usr/lib/dovecot/modules/lib20_mail_log_plugin.so My college already had a look in the source code, but this didn’t make us much smarter. Here his references: mail context is defined here: https://github.com/dovecot/core/blob/81b5b188c478ec36bea8bda8fcad1e5f32ac61… and removed again here: https://github.com/dovecot/core/blob/81b5b188c478ec36bea8bda8fcad1e5f32ac61… Does any of the experts on this list have an idea what could cause these crashes and how to fix them? Thanks in advance! Best, Andi

2 5

limit for user exceeded
by Maciej Milaszewski 31 Mar '20

31 Mar '20

Hi System debian 8.11 dovecot-2.2.36.4 and I have some warnings in log likes: Warning: Inotify watch limit for user exceeded, disabling. Increase /proc/sys/fs/inotify/max_user_watches cat /proc/sys/fs/inotify/max_user_watches 8192 in sysctl i change #fs.inotify.max_user_watches= 8192 #fs.inotify.max_user_instances = 16384 fs.inotify.max_user_watches= 16384 fs.inotify.max_user_instances = 24576 One questions - should these values be equal?

2 2