April 2020 - dovecot - dovecot.org

Headsup on feature removal
by Aki Tuomi 17 Apr '20

17 Apr '20

Hi! Dovecot is now a nearly 20 year old product, and during that time it has accumulated many different features and plugins in its core repository. We are starting to gradually remove some of these parts, which are unused, untested or deprecated. We will provide advance notification before removing anything. To start, the following features are likely to be removed in next few releases of Dovecot. - Authentication drivers: vpopmail, checkpassword, bsdauth, shadow, sia - Password schemes: HMAC-MD5, RPA, SKEY, PLAIN-MD4, LANMAN, NTLM, SMD5 - Authentication mechanisms: ntlm, rpa, skey - Dict drivers: memcached, memcached-ascii (use redis instead) - postfix postmap support - autocreate & autosubscribe plugins (use built-in auto=create/subscribe setting instead) - expire plugin (use built-in autoexpunge setting) - fts-squat plugin - mailbox alias plugin - mail-filter plugin - snarf plugin - xz compression algorithm For the authentication drivers that are being removed, we suggest using Lua as a replacement. See https://doc.dovecot.org/configuration_manual/authentication/lua_based_authe… For information about converting between password schemes, see https://wiki2.dovecot.org/HowTo/ConvertPasswordSchemes If you are using any of these features, please start preparing for their removal in the near future. Features will begin to be dropped as of v2.3.11. Additionally, the mbox format will no longer receive new development. It will still be maintained, however its use beyond migrations and other limited use cases will be discouraged. Please contact us via the mailing list if you have any questions. Regards, Dovecot Team

15 23

Bug maybe already resolved? Sieve rule does not accept special use folder names
by Marc Roos 16 Apr '20

16 Apr '20

Sieve rule fileinto Spam fails, while fileinto Junk succeeds mailbox Spam { special_use = \Junk auto = no } dovecot-pigeonhole-2.2.36-3.el7_7.1.x86_64 dovecot-2.2.36-3.el7_7.1.x86_64 CentOS Linux release 7.7.1908 (Core

2 7

Dovecot Failed to initialize SSL server context
by Adam Raszkiewicz 16 Apr '20

16 Apr '20

I'm trying to configure TLS for Dovecot 2.3 but after setting all things up I'm not able to start Dovecot: Apr 16 20:56:02 master: Info: Dovecot v2.3.9.3 (9f41b88fa) starting up for imap, pop3, lmtp (core dumps disabled) Apr 16 20:56:25 auth: Debug: Loading modules from directory: /usr/lib/dovecot/auth Apr 16 20:56:25 auth: Debug: Module loaded: /usr/lib/dovecot/auth/lib20_auth_var_expand_crypt.so Apr 16 20:56:25 auth: Debug: Read auth token secret from /usr/var/run/dovecot/auth-token-secret.dat Apr 16 20:56:25 auth: Debug: auth client connected (pid=30750) Apr 16 20:56:25 imap-login: Error: Failed to initialize SSL server context: Can't load SSL private key: Key is for a different cert than ssl_cert: user=<>, rip=::1, lip=::1, secured, session=<JKh/qm6j/rMAAAAAAAAAAAAAAAAAAAAB> Apr 16 20:56:25 imap-login: Info: Disconnected: TLS initialization failed. (no auth attempts in 0 secs): user=<>, rip=::1, lip=::1, secured, session=<JKh/qm6j/rMAAAAAAAAAAAAAAAAAAAAB> Apr 16 20:57:47 master: Fatal: Dovecot is already running with PID 30727 (read from /usr/var/run/dovecot/master.pid) Apr 16 20:57:47 master: Warning: Killed with signal 15 (by pid=30823 uid=0 code=kill) I have created a brand new key pair, csr and the cert but still it complains to start. Any thoughts on that? Thanks, Adam

2 1

How to specify pattern for share folder using ACL vfile
by Adam Raszkiewicz 15 Apr '20

15 Apr '20

My `90-acl.conf` file looks like: plugin { #acl = vfile:/etc/dovecot/global-acls:cache_secs=300 #acl = mysql:/etc/dovecot/dovecot-dict-sql.conf.ext acl = vfile } # To let users LIST mailboxes shared by other users, Dovecot needs a # shared mailbox dictionary. For example: plugin { #acl_shared_dict = file:/var/lib/dovecot/shared-mailboxes acl_shared_dict = proxy::acl } When ACLs were set for particular mailbox I can see that dovecot-acl file were created but I have no idea how to specify a pattern for shared folder like is in the `dovecot-dict-sql.conf.ext` map { pattern = shared/shared-boxes/user/$to/$from table = user_shares value_field = dummy fields { from_user = $from to_user = $to } } My goal is to control how it appears on the client site. As for now is as `shared/user@domain/folder/` but I have no idea where it is defined. Thanks, Adam

1 0

Removal of metrics.dovecot.org
by Aki Tuomi 15 Apr '20

15 Apr '20

Hi! metrics.dovecot.org will be removed by end of April. It's not really used that much and it's not compatible with new style metrics. --- Aki Tuomi Open-Xchange oy

1 0

got a listener on 993
by David Mehler 14 Apr '20

14 Apr '20

Hello, Before I get in to my question is ssl on 993 or starttls on 143 better from a security perspective? I've noticed that I've got a dovecot listener on port 993, below is my doveconf -n output I don't have an imaps listener uncommented should I do so and set it's port to 0? Will that disable the 993 listener? Thanks. Dave. # 2.3.10 (0da0eff44): /usr/local/etc/dovecot/dovecot.conf # Pigeonhole version 0.5.10 (bf8ef1c2) # OS: FreeBSD 12.1-RELEASE-p2 amd64 # Hostname: hostname.example.com auth_cache_size = 10 M auth_default_realm = example.com auth_mechanisms = plain login auth_realms = example.com dict { lastlogin = mysql:/usr/local/etc/dovecot/dovecot-last-login.conf } first_valid_gid = 2100 first_valid_uid = 2100 hostname = hostname.example.com imap_client_workarounds = delay-newhostname tb-extra-hostnamebox-sep tb-lsub-flags imap_idle_notify_interval = 1 mins last_valid_gid = 2100 last_valid_uid = 2100 lda_hostnamebox_autocreate = yes lda_hostnamebox_autosubscribe = yes lda_original_recipient_header = X-Original-To listen = xxx.xxx.xxx.xxx lmtp_rcpt_check_quota = yes log_timestamp = "%Y-%m-%d %H:%M:%S " hostname_access_groups = vhostname hostname_fsync = never hostname_gid = vhostname hostname_home = /var/vhostname/hostnameboxes/%d/%n hostname_location = dbox:~/hostname hostname_plugins = acl fts fts_lucene mail_log notify quota trash virtual welcome zlib mail_crypt hostname_privileged_group = vhostname hostname_server_admin = hostnameto:postmaster@example.com hostname_uid = vhostname managesieve_notify_capability = hostnameto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment hostnamebox date index ihave duplicate mime foreverypart extracttext spamtest spamtestplus virustest editheader imapflags notify imapsieve vnd.dovecot.imapsieve namespace { location = sdbox:/var/vhostname/public/:CONTROL=~/hostname/public:INDEX=~/hostname/public prefix = Public/ separator = / subscriptions = yes type = public } namespace { hidden = no list = yes location = hostnamedir:/var/vhostname/shared/office/.hostnamedir:CONTROL=~/.hostnamedir/control/office:INDEX=~/.hostnamedir/index/office prefix = shared/%%u/ separator = / subscriptions = yes type = shared } namespace inbox { inbox = yes location = hostnamebox Drafts { auto = subscribe special_use = \Drafts } hostnamebox Sent { auto = subscribe special_use = \Sent } hostnamebox Spam { auto = subscribe autoexpunge = 30 days special_use = \Junk } hostnamebox Trash { auto = subscribe autoexpunge = 30 days special_use = \Trash } prefix = separator = / type = private } passdb { args = /usr/local/etc/dovecot/dovecot-sql.conf.ext driver = sql } plugin { acl = vfile:/usr/local/etc/dovecot/global-acls:cache_secs=300 fts = lucene fts_autoindex = yes fts_autoindex_exclude = \Junk fts_autoindex_exclude2 = \Trash fts_autoindex_exclude3 = \Spam fts_autoindex_max_recent_msgs = 80 fts_index_timeout = 90 fts_lucene = whitespace_chars=@. normalize no_snowball imapsieve_hostnamebox1_before = file:/var/vhostname/sieve/global/learn-spam.sieve imapsieve_hostnamebox1_causes = COPY imapsieve_hostnamebox1_name = Spam imapsieve_hostnamebox2_before = file:/var/vhostname/sieve/global/learn-ham.sieve imapsieve_hostnamebox2_causes = COPY imapsieve_hostnamebox2_from = Spam imapsieve_hostnamebox2_name = * last_login_dict = proxy::lastlogin last_login_key = # hidden, use -P to show it hostname_crypt_curve = prime256v1 hostname_crypt_global_private_key = # hidden, use -P to show it hostname_crypt_global_public_key = # hidden, use -P to show it hostname_crypt_save_version = 2 hostname_log_events = delete undelete expunge copy hostnamebox_delete hostnamebox_rename hostname_log_fields = uid box msgid size quota = count:User quota quota_exceeded_message = Storage quota for this account has been exceeded, please try again later. quota_grace = 10%% quota_rule2 = Trash:ignore quota_status_nouser = DUNNO quota_status_overquota = 552 5.2.2 hostnamebox is full quota_status_success = DUNNO quota_vsizes = true quota_warning = storage=100%% quota-exceeded 100 %u quota_warning2 = storage=95%% quota-warning 95 %u quota_warning3 = storage=90%% quota-warning 90 %u quota_warning4 = storage=85%% quota-warning 85 %u quota_warning5 = storage=75%% quota-warning 75 %u sieve = file:/var/vhostname/sieve/%d/%n/scripts;active=/var/vhostname/sieve/%d/%n/active-script.sieve sieve_before = /var/vhostname/sieve/global/spam-global.sieve sieve_extensions = +notify +imapflags +spamtest +spamtestplus +virustest +editheader sieve_global_extensions = +vnd.dovecot.pipe +vnd.dovecot.execute +vnd.dovecot.environment sieve_max_redirects = 30 sieve_max_script_size = 1M sieve_pipe_bin_dir = /usr/bin sieve_plugins = sieve_imapsieve sieve_extprograms sieve_spamtest_max_header = X-Spamd-Result: default: [[:alnum:]]+ \[-?[[:digit:]]+\.[[:digit:]]+ / (-?[[:digit:]]+\.[[:digit:]]+)\] sieve_spamtest_status_header = X-Spamd-Result: default: [[:alnum:]]+ \[(-?[[:digit:]]+\.[[:digit:]]+) / -?[[:digit:]]+\.[[:digit:]]+\] sieve_spamtest_status_type = score sieve_user_log = /var/vhostname/sieve/sieve_error.log sieve_virustest_status_header = X-Virus-Scan: Found to be (.+)\. sieve_virustest_status_type = text sieve_virustest_text_value1 = clean sieve_virustest_text_value5 = infected trash = /usr/local/etc/dovecot/trash.conf welcome_script = welcome %n postmaster@%d welcome_wait = yes } postmaster_address = postmaster(a)example.com protocols = imap lmtp sieve sendhostname_path = /usr/local/sbin/sendhostname service auth-worker { user = vhostname } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } unix_listener auth-userdb { group = vhostname mode = 0666 user = vhostname } } service dict { unix_listener dict { mode = 0600 user = vhostname } user = root } service imap-login { inet_listener imap { port = 143 } process_min_avail = 1 } service imap { executable = imap } service lmtp { executable = lmtp unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0660 user = postfix } } service managesieve-login { inet_listener sieve { address = 172.16.21.3 port = 4190 } } service quota-status { client_limit = 1 executable = quota-status -p postfix unix_listener /var/spool/postfix/private/dovecot-quota { group = postfix mode = 0660 user = postfix } } service quota-warning { executable = script /usr/local/etc/dovecot/quota-warning.sh unix_listener quota-warning { group = vhostname mode = 0660 user = vhostname } user = vhostname } service stats { unix_listener stats-reader { group = vhostname mode = 0660 user = vhostname } unix_listener stats-writer { group = vhostname mode = 0660 user = vhostname } } service welcome { executable = script /usr/local/etc/dovecot/welcome.sh unix_listener welcome { user = vhostname } user = vhostname } ssl = required ssl_cert = </usr/local/etc/ssl/acme.sh/example.com/fullchain.crt ssl_cipher_list = EECDH+AESGCM:EDH+AESGCM ssl_curve_list = P-256 ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it ssl_min_protocol = TLSv1.2 ssl_options = no_ticket ssl_prefer_server_ciphers = yes userdb { args = /usr/local/etc/dovecot/dovecot-sql.conf.ext driver = sql } protocol lmtp { hostname_fsync = optimized hostname_plugins = acl fts fts_lucene hostname_log notify quota trash virtual welcome zlib hostname_crypt sieve } protocol lda { hostname_fsync = optimized hostname_plugins = acl fts fts_lucene hostname_log notify quota trash virtual welcome zlib hostname_crypt sieve } protocol imap { hostname_max_userip_connections = 20 hostname_plugins = acl fts fts_lucene hostname_log notify quota trash virtual welcome zlib hostname_crypt imap_acl imap_quota imap_sieve imap_zlib last_login quota welcome } protocol sieve { info_log_path = /var/log/dovecot/dovecot-sieve.log log_path = /var/log/dovecot/dovecot-sieve-errors.log }

6 6

replication_full_sync_interval
by Ivo 14 Apr '20

14 Apr '20

Default value for replication_full_sync_interval is 24 hours. How is it then possible to get doveadm replicator status results like this one username priority fast sync full sync success sync failed someuser none 24:23:39 24:23:39 24:23:37 - # doveconf -a | grep replication_full_sync_interval replication_full_sync_interval = 1 days # dovecot --version 2.2.33.2 (d6601f4ec)

2 2

Variable expansion in password field
by Simone Lazzaris 14 Apr '20

14 Apr '20

Hi list! I've recently updated a small dovecot cluster from 2.2.29 to 2.3.10. I've found an issue with variable expansion. My user/password database is on a mysql table, with password saved in plain text field. The cluster receives mail via lmpt and users fetch them via imap. On the 2.2.29 version, no issues. After the upgrade, I've found some lines in the log: Apr 14 14:36:05 archive-front1 dovecot: lmtp(19671, fakeusername(a)fakedomain.com) Error: lmtp-server: conn 212.183.164.212:34642 [4]: rcpt fakeusername(a)fakedomain.com: Failed to initialize user: Failed to expand plugin setting password = 'sd78F6aS9%Lggxf': Unknown variable '%g' (I've faked /some/ information for obvious reasons, but I've kept the password after the '%' sign). Apparently, dovecot 2.3.10 is trying to expand some variables IN the password field. I'm trying to fool him expanding the '%' into '%%' on the password query, but without luck... I can also contact the user and make him choose a different password, without '%'. Anyway, I feel that this behaviour should be seen as a bug. Am I missing something? -- Simone Lazzaris QCom SpA

2 1

%d ignored from auth-passwdfile.conf.ext configuration file
by Andrei Petru Mura 13 Apr '20

13 Apr '20

I try to configure dovecot with virtual users. I put my users file in folder /etc/dovecot/my_domain_name/users. My auth-passwdfile.conf.ext file looks like this: passdb { driver = passwd-file args = username_format=%n /etc/dovecot/%d/users } When I try to log in, I get this: dovecot: auth: Error: passwd-file(test,some.ip.addr.here,<rQT+ziijGE1tpoAB>): stat(/etc/dovecot//users) failed: No such file or directory As you can see, %d isn't interpreted. Why is this happening? Any hints? Thanks, Mura Andrei

2 3

Missing permissions
by Andrei Petru Mura 13 Apr '20

13 Apr '20

Hi, Dovecot version 2.2.36 In log files I get this error: dovecot: imap(test): Namespace '': mkdir(/home/mail/domain/test/Maildir) failed: Permission denied (euid=1005(vmail) egid=1005(vmail) missing +w perm: /home/mail/domain, UNIX perms appear ok (ACL/MAC wrong?)) My authentication configuration is this: passdb { driver = passwd-file args = username_format=%n /etc/dovecot/users } userdb { driver = static args = uid=vmail gid=vmail home=/home/mail/domain/%n username_format=%n /etc/dovecot/users } /home/mail/domain/test directory is owned by vmail user. How to fix this? Mura Andrei

4 12