June 2020 - dovecot - dovecot.org

Cannot log in to IMAP server and logs are unclear as to why
by Scott A. Wozny 07 Jun '20

07 Jun '20

I’m trying a super basic config based upon https://wiki.dovecot.org/HowTo/PostfixDovecotLMTP but before I work on shipping mail through Postfix to DoveCot, I wanted to make sure IMAP is working first, but I can’t even get a basic login to so I thought I’d see if the gurus on the list might be able to point out I’m doing wrong. The documentation is pretty good, but there were some gaps I had to guess at and I’m presuming that’s where I went wrong. I’ve turned SELinux to permissive mode, for now. Here’s the doveconf -n: # 2.2.36 (1f10bfa63): /etc/dovecot/dovecot.conf # OS: Linux 3.10.0-1062.12.1.el7.x86_64 x86_64 CentOS Linux release 7.7.1908 (Core) # Hostname: imap first_valid_uid = 1000 listen = 192.168.1.207 mail_gid = vmail mail_home = /var/vmail/%d/%n mail_location = sdbox:~/mail mail_uid = vmail mbox_write_locks = fcntl namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = separator = / } passdb { args = scheme=PLAIN username_format=%u /etc/dovecot/users driver = passwd-file } protocols = imap lmtp service lmtp { group = vmail unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } user = vmail } ssl = no ssl_cert = </etc/pki/dovecot/certs/dovecot.pem ssl_key = # hidden, use -P to show it userdb { args = username_format=%u /etc/dovecot/users driver = passwd-file } I wasn’t sure how to set rights on the users file: [sawozny@imap var]$ cat /etc/dovecot/users test@test.com:{plain}test [sawozny@imap var]$ ls -la /etc/dovecot/users -rw-r--r--. 1 root root 26 Jun 3 23:31 /etc/dovecot/users Also, didn’t know what rights to set on the /var/vmail directoy so I did this: drwxrwx---. 3 vmail vmail 4096 Jun 3 20:52 vmail This directory is also empty except for the lost+fond directory that comes with a disk mount point. My understanding is that the mail home and maildir will manifest automagically on first login, but if I need to prime the pump, please let me know what I need to do. For my test, I did: [sawozny@imap var]$ telnet 192.168.1.207 143 Trying 192.168.1.207... Connected to 192.168.1.207. Escape character is '^]'. * OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE AUTH=PLAIN] Dovecot ready. 01 LOGIN test(a)test.com test 01 NO [UNAVAILABLE] Internal error occurred. Refer to server log for more information. Connection closed by foreign host. And the results in the /var/log/maillog file are: Jun 3 23:35:34 imap dovecot: auth: Error: passwd-file /etc/dovecot/users: User test(a)test.com is missing userdb info Jun 3 23:35:44 imap dovecot: auth: Error: passwd-file(test(a)test.com,192.168.1.207,<DBqafDan7ODAqAHP>): user not found from userdb Jun 3 23:35:44 imap dovecot: imap: Error: Authenticated user not found from userdb, auth lookup id=843055105 (auth connected 0 msecs ago, handshake 0 msecs ago, request took 0 msecs, client-pid=12047 client-id=1) Jun 3 23:35:44 imap dovecot: imap-login: Internal login failure (pid=12047 id=1) (internal failure, 1 successful auths): user=<test(a)test.com>, method=PLAIN, rip=192.168.1.207, lip=192.168.1.207, mpid=12049, secured, session=<DBqafDan7ODAqAHP> I’m not sure where I’ve gone wrong. From my understanding of the documentation, all I need in the userdb is name and password. UID, GID and HOME are also indicated as required, but I set them at the system level, so why is the system telling me the user was not found? This definitely isn’t my first rodeo with Linux, but I know almost nothing about messaging so in that regard I’m a totally n00b and would really appreciate some guidance. Thanks, Scott

3 5

Only show mails within 30 days or 60 days?
by hfh＠cndns.com 05 Jun '20

05 Jun '20

How to display emails within 30 days or 60 days in inbox, sent box, etc. For example, in the mail client tool, the user clicks the inbox button and only sees the mail within 30 days. The virtual mailbox plugin will only generate a new mailbox. Thank you！！！

4 3

manual mdbox lock
by rudolf＠padaru.de 05 Jun '20

05 Jun '20

Good Morning, i have a question about the mdbox dotlock technique. We create a new backup strategy for our mailservers because we want to switch the mailformat from mbox to mdbox. Our recent backup plan works mainly with rsync and the inbuild tar function. We want to hande the backups with mdbox similar. Is there a way, how i can write-lock a mail user via the doveadm command or with dotlock files? I have searched the doveadm-sync code but i cant make out the point where the command lock the mailbox for write access. We work with Ubuntu 18, dovecot 2.33.2 Mit freundlichen Grüßen Yours sincerely <https://padaru.de/> Pascal Rudolf | Geschäftsführer PADARU-IT | Bielebohstraße 10 | 02736 Beiersdorf @: rudolf(a)padaru.de | www: <http://padaru.de/> padaru.de mobil: +49 (0) 17 772 595 32

1 0

Mailbox & Server Down
by Andrea Miconi 04 Jun '20

04 Jun '20

My mailboxes are on a Dovecot (IMAP) server.On DNS there is an MX record pointing to the server.To read the mail I use Roundcube.If the server is down, I lose the new mail. I would like to do two things, alternatively. First option.1) I keeep the mail on the provider's server, restoring the original MX record.2) Dovecot does not receive the mail, but should go to download it.3) I can access the server with Roundcube to read the downloaded mail, but if the server is down I can always go to read the mail on the provider's server with its webmail Second optionI install a second mail server and the two have to replicate the mail.But I don't know how to do it, so I need a guide with instructions.Furthermore Roundcube would always access only one server and if this is down, how can I connect to the second one?This is a typical situation for webmail like Yahoo, Outlook or GMail, but I'm not Yahoo, Microsoft and Google ;) Thanks in advance for any advice.

5 7

Error deleting INBOX when doing an imap sync
by Des Magner 04 Jun '20

04 Jun '20

Hi I am trying to set up a new mail server with dovecot. I got it all installed and set up successfully but am running into problems trying to migrate from my current email server. I tried the following command: doveadm -Dv -o imapc_host=[current-imap-host] -o imapc_user=[current-user] -o imapc_password=[password] -o imapc_features=rfc822.size -o mail_fsync=never backup -R -u [user] imapc: It connects fine but eventually fails with the following errors: dsync([user]): Error: Mailbox INBOX sync: mailbox_delete failed: INBOX can't be deleted. dsync([user]): Debug: brain S: Remote mailbox tree: INBOX guid=[xxx] uid_validity=1591096439 uid_next=1 subs=no last_change=0 last_subs=0 dsync([user] Debug: imapc([current-imap-host]:143): Disconnected I am guessing the new INBOX is not compatible with the Inbox on my current mail server so it is trying to delete it. If so is there a way I can change my configuration to allow it to be deleted?

3 2

I can no longer use TLS for Windows7 and Outlook
by Mark Constable 03 Jun '20

03 Jun '20

I currently use Ubuntu 20.04 with Dovecot 2.3.7.2 and OpenSSL 1.1.1f. A few months ago there was an update to all these systems and since then I've had to talk W7 and old Mac clients through disabling ports 993/995 with TLS enabled back to ports 143/110 without SSL or they could not pick up email. Thunderbird users (ie; me) were unaffected. Could anyone share a set of port 993/995 SSL settings known to work with Windows7 and Outlook16 using "dovecot -n|grep ^ssl_" please ? Mine is currently... ssl_ca = </etc/ssl/certs/ca-certificates.crt ssl_cert = </etc/ssl/example.com/fullchain.pem ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it ssl_options = no_compression no_ticket ssl_prefer_server_ciphers = yes I have commented out ssl_cipher_list, ssl_min_protocol and others to get back to whatever the defaults are so I am not simply guessing what the optimal settings would be to cover Win7 and up. Yes I know Win7 is no longer supported but that does not help the 100s of older users I have that can't/won't upgrade their computers.

7 6

Packages for CentOS 8
by Peter 01 Jun '20

01 Jun '20

I've now successfully built Dovecot packages for CentOS 8 that do not have the quota support stripped out. I was able to do this because CentOS has now finally shipped the quota-devel package as well as the other -devel packages that were previously missing from CentOS 8. For those of you who are interested they are in the GhettoForge Testing repo for el8 at: http://mirror.ghettoforge.org/distributions/gf/el/8/testing/x86_64/ These are untested so let me know if anyone experiences any issues with them. Peter

3 6

locking question
by Tom Lieuallen 01 Jun '20

01 Jun '20

We're running dovecot 2.3.10 on two different servers (two different environments). Both very similarly configured (sendmail and procmail for mail delivery); same OS and patch levels. One environment has nearly 10,000 users and hasn't seen problems. The other environment has just a handful of users, but one user is very active with email and has a fairly complicated procmail configuration. I'm having ongoing mail file locking problems with that one user... Procmail says it's using dotlocking and fcntl: procmail v3.22 2001/09/10 Locking strategies: dotlocking, fcntl() I'm using defaults for dovecot: #mbox_read_locks = fcntl #mbox_write_locks = dotlock fcntl I have seen this a number of times in dovecot's logs. This signifies a start of locking problems with a mailbox. Mailbox aa_checkme_second: fcntl() failed with mbox: No locks available Procmail's logs show this: procmail: Locking "mail/aa_checkme_second.lock" procmail: Assigning "LASTFOLDER=mail/aa_checkme_second" procmail: Opening "mail/aa_checkme_second" procmail: Acquiring kernel-lock procmail: Kernel-lock failed procmail: Unlocking "mail/aa_checkme_second.lock" These errors were not concurrent; dovecot's errors happened first. I've been suspicious that there was a locking conflict of some kind. My only remaining question on that front is about the read locks. Is it worth trying dotlock for it instead of fcntl? If that's not the problem, then could we be running into some system limitations or a bug in the kernel or mailbox storage? The server running dovecot is Centos 6.10. The mailbox storage is on Isilon OneFS 8.1.2.0. I should probably increase dovecot's logging to see if anything else jumps out at me. thank you for any suggestions. Tom Lieuallen Oregon State Univesity

1 0

Problems with userdb and mail deliveribility
by Chris Bennett 01 Jun '20

01 Jun '20

I briefly got some mails delivered, but not anymore. Attached are dovecot-info.log, dovecot-debug.log, dovecot.log, maillog, /etc/mail/passwd smtpd.conf, vaddr, vusers, vdomains Thanks for any help. Chris Bennett

3 4

auth_policy_server vs client_id and x-originating-ip
by Zdeněk Zámečník 01 Jun '20

01 Jun '20

I run into troubles when trying to set up auth_policy_server in Dovecot 2.3.10.1. It works almost as expected but I cannot get client ID in this process. By setting up "imap_id_log=*" I see in log that Dovecot gets details about mail client like name and version: May 31 14:20:58 mail dovecot: imap(xxx(a)example.xxx)<24796><ft7ytfCmjdZWMSZQ>: ID sent: name=Thunderbird, version=68.8.1 But the auth_policy_server is getting all details except this ID, it's empty: May 31 14:20:58 mail auth-policy[10357]: { May 31 14:20:58 mail auth-policy[10357]: device_id: '', May 31 14:20:58 mail auth-policy[10357]: login: 'xxx(a)example.xxx', May 31 14:20:58 mail auth-policy[10357]: protocol: 'imap', May 31 14:20:58 mail auth-policy[10357]: pwhash: '097a', May 31 14:20:58 mail auth-policy[10357]: remote: '1.2.3.4', May 31 14:20:58 mail auth-policy[10357]: tls: true May 31 14:20:58 mail auth-policy[10357]: } However in some cases I see that client_id is passed to auth_policy_server: May 31 14:27:41 mail auth-policy[10357]: { May 31 14:27:41 mail auth-policy[10357]: device_id: '"name" "Outlook-iOS-Android" "version" "2.0"', May 31 14:27:41 mail auth-policy[10357]: login: 'yyy(a)example.xxx', May 31 14:27:41 mail auth-policy[10357]: protocol: 'imap', May 31 14:27:41 mail auth-policy[10357]: pwhash: '0b63', May 31 14:27:41 mail auth-policy[10357]: remote: '3.4.5.6', May 31 14:27:41 mail auth-policy[10357]: tls: true May 31 14:27:41 mail auth-policy[10357]: } I think I am missing some important point. Maybe IMAP command ID and client_id are totally different. Can you please advise? Is it possible to pass details about mail client to auth_policy_server? Second question is: how I can get "x-originating-ip" from ID command to auth_policy_server? Below is my config file: # 2.3.10.1 (a3d0e1171): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.10 (67bf5bd7) # OS: Linux 5.3.18-2-pve x86_64 Debian 10.4 # Hostname: mail.z-technics.com auth_cache_size = 2 M auth_cache_ttl = 5 mins auth_master_user_separator = * auth_mechanisms = plain login auth_policy_check_before_auth = no auth_policy_hash_nonce = # hidden, use -P to show it auth_policy_report_after_auth = no auth_policy_server_timeout_msecs = 1500 auth_policy_server_url = http://127.0.0.1:8090/ dict { acl = pgsql:/etc/dovecot/dovecot-dict-sql.conf.ext quota = pgsql:/etc/dovecot/dovecot-dict-sql.conf.ext } disable_plaintext_auth = no imap_client_workarounds = delay-newmail imap_hibernate_timeout = 5 secs imap_id_log = * imap_id_retain = yes login_trusted_networks = 127.0.0.1 mail_gid = 2000 mail_home = /var/vmail/%d/%n mail_location = mdbox:~/mdbox:ALT=/var/vmail-archive/%d/%n/mdbox mail_max_userip_connections = 60 mail_plugins = acl zlib fts quota mail_uid = 2000 managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext vacation-seconds editheader imapsieve vnd.dovecot.imapsieve mdbox_rotate_interval = 1 days mdbox_rotate_size = 16 M passdb { args = /etc/dovecot/dovecot-ldap.conf driver = ldap } passdb { args = /etc/dovecot/masters.db driver = passwd-file master = yes pass = yes } plugin { acl = vfile acl_shared_dict = proxy::acl imapsieve_mailbox1_before = file:/var/vmail/sieve/report-spam.sieve imapsieve_mailbox1_causes = COPY imapsieve_mailbox1_name = Spam imapsieve_mailbox2_before = file:/var/vmail/sieve/report-ham.sieve imapsieve_mailbox2_causes = COPY imapsieve_mailbox2_from = Spam imapsieve_mailbox2_name = * imapsieve_mailbox3_before = file:/var/vmail/sieve/report-spam.sieve imapsieve_mailbox3_causes = COPY imapsieve_mailbox3_name = Junk imapsieve_mailbox4_before = file:/var/vmail/sieve/report-ham.sieve imapsieve_mailbox4_causes = COPY imapsieve_mailbox4_from = Junk imapsieve_mailbox4_name = * mailbox_alias_new = Sent Messages mailbox_alias_new2 = Sent Items mailbox_alias_new3 = Deleted Items mailbox_alias_old = Sent mailbox_alias_old2 = Sent mailbox_alias_old3 = Trash quota = dict:User quota::proxy::quota quota_grace = 10%% quota_rule2 = Trash:ignore quota_rule3 = Junk:ignore quota_warning = storage=80%% quota-warning 90 %u quota_warning2 = storage=85%% quota-warning 95 %u quota_warning3 = storage=95%% quota-warning 105 %u sieve = /var/vmail/%d/%n/sieve/.sieve sieve_after = /var/vmail/%d/%n/sieve/autoreply.sieve sieve_before = /var/vmail/sieve/global.sieve sieve_dir = /var/vmail/%d/%n/sieve sieve_extensions = +editheader +vacation-seconds sieve_global_dir = /var/vmail/sieve/ sieve_global_extensions = +vnd.dovecot.pipe +vnd.dovecot.environment sieve_max_redirects = 20 sieve_pipe_bin_dir = /usr/lib/dovecot sieve_plugins = sieve_imapsieve sieve_extprograms sieve_vacation_send_from_recipient = yes } protocols = imap sieve lmtp pop3 service auth-worker { unix_listener auth-worker { user = vmail } user = $default_internal_user } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } unix_listener auth-userdb { mode = 0600 user = vmail } user = vmail } service dict { unix_listener dict { mode = 0600 user = vmail } } service imap-hibernate { unix_listener imap-hibernate { group = $default_internal_group mode = 0660 } } service imap-login { process_min_avail = 10 service_count = 0 vsz_limit = 512 M } service imap { executable = imap process_limit = 3500 unix_listener imap-master { user = $default_internal_user } vsz_limit = 2 G } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } service managesieve-login { inet_listener sieve { port = 4190 } process_min_avail = 0 service_count = 1 vsz_limit = 64 M } service managesieve { process_limit = 400 } service pop3-login { process_min_avail = 3 service_count = 0 vsz_limit = 320 M } service pop3 { process_limit = 200 vsz_limit = 320 M } service quota-warning { executable = script /etc/dovecot/quota_warning.sh unix_listener quota-warning { mode = 0666 user = vmail } user = vmail } ssl_cert = </etc/ssl/private/multi.z-technics.cz.dovecot.pem ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it stats_writer_socket_path = userdb { args = /etc/dovecot/dovecot-ldap.conf driver = ldap } protocol sieve { managesieve_implementation_string = Dovecot Pigeonhole managesieve_max_compile_errors = 5 } protocol imap { mail_plugins = quota imap_quota fts mailbox_alias imap_acl acl imap_zlib imap_sieve } protocol lda { mail_fsync = optimized } protocol lmtp { mail_fsync = optimized mail_plugins = quota sieve acl }

2 1