May 2020 - dovecot - dovecot.org

IMAP session hangs on 8k-long commands if COMPRESS=DEFLATE is enabled
by Guilhem Moulin 21 Apr '21

21 Apr '21

Hi there, Dovecot 2.3.7 appears to hang when the client sends a long command after enabling the IMAP COMPRESS extension [RFC 4978]. PoC script attached along with the doveconf(1) output. Without COMPRESS=DEFLATE, and with the default ‘imap_max_line_length’ value (64k) I'm able send commands up to 65539 bytes long (that's 3 bytes more than 2¹⁶, so maybe the leading tag and the trailing CRLF aren't counted), after which Dovecot rightfully replies with tagged BAD responses. $ COMPRESS=n /tmp/many-fetch.pl 65539 […] C: x UID FETCH 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,… [65539 bytes] S: x OK Fetch completed (0.005 + 0.001 + 0.004 secs). C: x UID FETCH 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,… [65540 bytes] S: x BAD Error in IMAP command UID FETCH: IMAP command line too large (0.001 + 0.001 secs). C: x UID FETCH 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,… [65541 bytes] S: x BAD Error in IMAP command UID FETCH: IMAP command line too large (0.001 + 0.001 secs). With COMPRESS=DEFLATE however, the server never sends anything back when the command size exceeds 8192 bytes: $ COMPRESS=y /tmp/many-fetch.pl 8192 […] S: x OK [READ-ONLY] Examine completed (0.001 + 0.000 secs). C: x UID FETCH 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,… [8191 bytes] S: x OK Fetch completed (0.001 + 0.000 secs). C: x UID FETCH 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,… [8192 bytes] S: x OK Fetch completed (0.001 + 0.000 secs). C: x UID FETCH 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,… [8193 bytes] [ _hangs until the server terminates the session for inactivity_ ] S: * BYE Disconnected for inactivity. strace(1) show that Dovecot didn't send the response, even though the server log indicates that it's able to fully read the command. Interestingly, when setting ‘imap_max_line_length’ to 4096, the server also hangs after receiving a command of size >4096 bytes (instead of replying with a tagged BAD response). $ COMPRESS=y /tmp/many-fetch.pl 4096 C: x UID FETCH 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,… [4095 bytes] S: x OK Fetch completed (0.001 + 0.000 secs). C: x UID FETCH 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,… [4096 bytes] S: x OK Fetch completed (0.001 + 0.000 secs). C: x UID FETCH 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,… [4097 bytes] [ _hangs until the server terminates the session for inactivity_ ] I'm also able to reproduce the buggy behavior against Dovecot versions found in other Debian releases. It's identical with 2.3.4 (Buster), the server also hang past 8192 bytes. 2.2.27 (Stretch) and 2.2.13 (Jessie) are able to send replies to 8k-long commands, but hang past 65536 bytes. For all 3 releases, without COMPRESS=DEFLATE Dovecot doesn't hang and rightfully sends tagged BAD responses to commands of size >65539 bytes. So while the hanging behavior appears to be a long-standing bug, the fact that's it's now hit at min($imap_max_line_length, 8192) instead of $imap_max_line_length seems to be a regression from somewhere between 2.2.27 and 2.3.4. Cheers, -- Guilhem.

3 2

Repo for ubuntu focal 20.04 LTS
by Sébastien Riccio 27 Nov '20

27 Nov '20

Hello Dovecot, As the new ubuntu LTS 20.04 seems to be out, I would like to ask if there are any plans to add a repo like it already exists for 18.04 LTS. We planned to upgrade our 18.04 LTS boxes to 20.04. It has it’s own dovecot packages (2.3.7 at the time of writing this), but I would prefer we use your repositories like we do with 18.04. Kind regards, Sébastien

4 4

Dovecot SASL
by Jorge Bastos 22 Sep '20

22 Sep '20

Howdy, I know i've asked this before, but i think i got really no answer. I'd like to have dovecot SASL, to check AUTH against an SQL table, instead of dovecot SASL use the AUTH MECH for imap/pop3. I want this, to have the same behavior as I have now, where i use postfix with cyrus SASL on a different table (with the same login details), and when i have an user that his accounts was hacked for sending spam, i just block the send and allow the user to keep receiving emails, for example to warn him. Would this be possible? Dovecot SASL against a SQL table? Havent found much info about it, Thanks in advanced,

2 2

LMTP-Process stays in RCPT TO state
by Pascal Christen 07 Sep '20

07 Sep '20

Hi We tried to update our Dovecot Director-Ring to 2.3 (latest version) and had one problem/bug. When we try to deliver an email from Exim to a receiving Dovecot (2.3 latest) via the LMTP-Proxy the LMTP process stays open forever and never closes. So after a few hours, we hit the LMPT-Process limit. The problem only exists if the receiving Dovecot reports "Quota exceeded (mailbox for user is full)" back to the Exim. If this is the case the state on the LMPT process stays at "lmtp: [_IP_ RCPT TO] (lmtp) and never closes. The TCP-Connection to the Exim is then in CLOSE_WAIT state on the Proxy. On the receiving Dovecot we set the "lmtp_rcpt_check_quota=yes" option. For me, it sounds similar to this bug: https://dovecot.org/list/dovecot/2018-January/110697.html but without the SEGFAULT which makes it harder to debug it. May you guys know why it doesn't change the state to IDLE or READY after reporting the quota issue or see something fishy in the commit above. If not I try to get a trace of the hanging process. Greetings Pascal

2 6

How to backup maildir
by Robert Moskowitz 04 Sep '20

04 Sep '20

I have been thinking, and reading, on how to back up my mailserver. I have not found any approach that seems ready to use. I have run years without any backup, but would really like to have something in place. I figure I can attach a USB drive and backup to that, then from there rsync to something elsewhere. Further if that USB drive is a full mailserver image, I actually have a 'hot backup' where I only have to put the backup drive into a system and boot up at the last backup. But this means properly copying all of /home/vmail and probably /home/sieve plus the /var/lib/mysql Are there good tools that nicely does this? Or do I choose a time late at night (only I am sometimes in non-US timezones) to shut down all services and just use rsync? And stopping services itself is thought provoking. What if Dovecot, amavis, mysql, or whatelse is in the middle of writing out a mail file what happens to that file and restart. Just scary stuff and, in part, why I have never tackled this in the past. thanks for all feedback

4 6

Rootless wiki page is not up to date?
by Marc Roos 20 Aug '20

20 Aug '20

If I run a docker image with the mesos containerizer and altering the dovecot config mentioned here[1] I think the root detection is incorrect because it looks like dovecot is still thinking it is root. I still get errors like: >> log(829825): Fatal: We couldn't drop root group privileges (wanted=10053(dovecot), gid=0(root), egid=0(root)) Why does it want to drop to root, if we are not even running as root? >> Error: service(ipc): chown(/var/dovecot/login/ipc-proxy, 91, 4294967295) failed: Operation not permitted Why does it want to chown, when it is not root? pop3-login: Fatal: setgid(101(dovenull)) failed with euid=10053(dovecot), gid=10053(dovecot), egid=10053(dovecot): Operation not permitted (This binary should probably be called with process group set to 101(dovenull) instead of 10053(dovecot)) [1] https://wiki.dovecot.org/HowTo/Rootless?action=edit&editor=text

2 2

Can't move/delete folder "Renaming not supported across conflicting directory permissions"
by Johannes Rohr 12 Aug '20

12 Aug '20

Dear all, several users have reported that they were unable to move/delete folders using Thunderbird and they got the message "Renaming not supported across conflicting directory permissions". When I google for this message, I see hints like "your mail may not be all on the same volume", but here this is definitely not the case. All mail is in /var/mail/virtual and owned by mail:mail Curiously, when I tried the same operation in Roundcube, there was no error reported, so something about the combination of Thunderbird and Dovecot seems to be causing the error. Does anyone have advise on how I should go about tracking down the cause of the error? Thanks a lot in advance! Johannes

3 2

imap doesn't like my passwd
by James 31 Jul '20

31 Jul '20

I spent days on this problem. I have dovecot setup to use SSL and IMAP. I also have a pop account that I had no trouble getting working. Both use PAM authentication on Linux. openssl s_client -connect localhost:993 a login test_user test_secure_password The response I got back was: a BAD Invalid characters in atom I changed the password to "abc" and it worked. The secure password used to work but it was a different architecture (x86_64 I think). The current architecture is armhf. It may be different versions of the software too. Dovecot v2.1.7

5 7

INBOX folders disappeared after upgrading
by Dave 12 Jul '20

12 Jul '20

Hi, tried to Google/etc to see what to tweak.. not finding anything helpful. So.. I've been running my private mail through a Linux server since approx year 2000. The OS has been various flavors of Fedora or CentOS, since for work, I have to spend all day supporting some sort of Red Hat flavor. So I run SquirrelMail on top of Dovecot and Postfix on CentOS 7, things have been great for like forever. I recently ran updates and all my INBOX folders disappeared. I have made no configuration changes in at least 5 years. I can't seem to resolve/figure out what's going on. I have backups to see everything before the update. I've noticed that my subscriptions file is missing all the folders, which are all in this file in the backups. If I repopulate this file with the names, the next time I access mail, they are all removed. Most of my mail is in folders, therefore I have access to almost none of it (can see new stuff coming in, but can't sort it anywhere). k, for the details.. I was running dovecot-2.2.10 (2.2.10-8.el7.x86_64) and was updated to dovecot-2.2.36 (2.2.36-3.el7_7.1.x86_64) with yum updates. # dovecot --version 2.2.36 (1f10bfa63) # dovecot -n # 2.2.36 (1f10bfa63): /etc/dovecot/dovecot.conf # OS: Linux 3.10.0-1062.18.1.el7.x86_64 x86_64 CentOS Linux release 7.7.1908 (Core) # Hostname: vm1.tech...com auth_mechanisms = plain login login_greeting = IMAP ready. mail_location = maildir:~/Maildir mbox_write_locks = fcntl namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { driver = pam } service auth { unix_listener /var/spool/postfix/private/auth { mode = 0600 user = postfix } } service imap-login { inet_listener imap { address = 127.0.0.1,68.139.25.150 } inet_listener imaps { address = 127.0.0.1,68.139.25.150 } } service pop3-login { inet_listener pop3 { port = 0 } inet_listener pop3s { address = 127.0.0.1,68.139.25.150 } } ssl = required ssl_cert = </etc/pki/tls/certs/mail.tech...com.crt ssl_cipher_list = ALL:!aNULL:!eNULL:!LOW:!EXP:!RC4 ssl_key = # hidden, use -P to show it ssl_prefer_server_ciphers = yes userdb { driver = passwd } Regards, -Dave

2 4

Ms Exchange vs dovecot
by Marc Roos 10 Jul '20

10 Jul '20

I have recently been working/testing with exchange 2016 and started thinking if I should even migrate to this platform. I assume more people here have experience with exchange and this idea. I was wondering if this is possible with a dovecot setup 1. public folder can be implemented with a public mailbox? 2. authorize users via groups access to mailboxes/folders of the public folder/mailbox. I think I saw ACL's with dovecot, does this compare to 'folder permissions' 3. is it possible with sieve to apply a rule on any mailbox/folder? Thus if I 'drag' a message to a folder, the sieve rule is activated?

18 25