June 2020 - dovecot - dovecot.org

I can no longer use TLS for Windows7 and Outlook
by Mark Constable 03 Jun '20

03 Jun '20

I currently use Ubuntu 20.04 with Dovecot 2.3.7.2 and OpenSSL 1.1.1f. A few months ago there was an update to all these systems and since then I've had to talk W7 and old Mac clients through disabling ports 993/995 with TLS enabled back to ports 143/110 without SSL or they could not pick up email. Thunderbird users (ie; me) were unaffected. Could anyone share a set of port 993/995 SSL settings known to work with Windows7 and Outlook16 using "dovecot -n|grep ^ssl_" please ? Mine is currently... ssl_ca = </etc/ssl/certs/ca-certificates.crt ssl_cert = </etc/ssl/example.com/fullchain.pem ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it ssl_options = no_compression no_ticket ssl_prefer_server_ciphers = yes I have commented out ssl_cipher_list, ssl_min_protocol and others to get back to whatever the defaults are so I am not simply guessing what the optimal settings would be to cover Win7 and up. Yes I know Win7 is no longer supported but that does not help the 100s of older users I have that can't/won't upgrade their computers.

7 6

Packages for CentOS 8
by Peter 01 Jun '20

01 Jun '20

I've now successfully built Dovecot packages for CentOS 8 that do not have the quota support stripped out. I was able to do this because CentOS has now finally shipped the quota-devel package as well as the other -devel packages that were previously missing from CentOS 8. For those of you who are interested they are in the GhettoForge Testing repo for el8 at: http://mirror.ghettoforge.org/distributions/gf/el/8/testing/x86_64/ These are untested so let me know if anyone experiences any issues with them. Peter

3 6

locking question
by Tom Lieuallen 01 Jun '20

01 Jun '20

We're running dovecot 2.3.10 on two different servers (two different environments). Both very similarly configured (sendmail and procmail for mail delivery); same OS and patch levels. One environment has nearly 10,000 users and hasn't seen problems. The other environment has just a handful of users, but one user is very active with email and has a fairly complicated procmail configuration. I'm having ongoing mail file locking problems with that one user... Procmail says it's using dotlocking and fcntl: procmail v3.22 2001/09/10 Locking strategies: dotlocking, fcntl() I'm using defaults for dovecot: #mbox_read_locks = fcntl #mbox_write_locks = dotlock fcntl I have seen this a number of times in dovecot's logs. This signifies a start of locking problems with a mailbox. Mailbox aa_checkme_second: fcntl() failed with mbox: No locks available Procmail's logs show this: procmail: Locking "mail/aa_checkme_second.lock" procmail: Assigning "LASTFOLDER=mail/aa_checkme_second" procmail: Opening "mail/aa_checkme_second" procmail: Acquiring kernel-lock procmail: Kernel-lock failed procmail: Unlocking "mail/aa_checkme_second.lock" These errors were not concurrent; dovecot's errors happened first. I've been suspicious that there was a locking conflict of some kind. My only remaining question on that front is about the read locks. Is it worth trying dotlock for it instead of fcntl? If that's not the problem, then could we be running into some system limitations or a bug in the kernel or mailbox storage? The server running dovecot is Centos 6.10. The mailbox storage is on Isilon OneFS 8.1.2.0. I should probably increase dovecot's logging to see if anything else jumps out at me. thank you for any suggestions. Tom Lieuallen Oregon State Univesity

1 0

Problems with userdb and mail deliveribility
by Chris Bennett 01 Jun '20

01 Jun '20

I briefly got some mails delivered, but not anymore. Attached are dovecot-info.log, dovecot-debug.log, dovecot.log, maillog, /etc/mail/passwd smtpd.conf, vaddr, vusers, vdomains Thanks for any help. Chris Bennett

3 4

auth_policy_server vs client_id and x-originating-ip
by Zdeněk Zámečník 01 Jun '20

01 Jun '20

I run into troubles when trying to set up auth_policy_server in Dovecot 2.3.10.1. It works almost as expected but I cannot get client ID in this process. By setting up "imap_id_log=*" I see in log that Dovecot gets details about mail client like name and version: May 31 14:20:58 mail dovecot: imap(xxx(a)example.xxx)<24796><ft7ytfCmjdZWMSZQ>: ID sent: name=Thunderbird, version=68.8.1 But the auth_policy_server is getting all details except this ID, it's empty: May 31 14:20:58 mail auth-policy[10357]: { May 31 14:20:58 mail auth-policy[10357]: device_id: '', May 31 14:20:58 mail auth-policy[10357]: login: 'xxx(a)example.xxx', May 31 14:20:58 mail auth-policy[10357]: protocol: 'imap', May 31 14:20:58 mail auth-policy[10357]: pwhash: '097a', May 31 14:20:58 mail auth-policy[10357]: remote: '1.2.3.4', May 31 14:20:58 mail auth-policy[10357]: tls: true May 31 14:20:58 mail auth-policy[10357]: } However in some cases I see that client_id is passed to auth_policy_server: May 31 14:27:41 mail auth-policy[10357]: { May 31 14:27:41 mail auth-policy[10357]: device_id: '"name" "Outlook-iOS-Android" "version" "2.0"', May 31 14:27:41 mail auth-policy[10357]: login: 'yyy(a)example.xxx', May 31 14:27:41 mail auth-policy[10357]: protocol: 'imap', May 31 14:27:41 mail auth-policy[10357]: pwhash: '0b63', May 31 14:27:41 mail auth-policy[10357]: remote: '3.4.5.6', May 31 14:27:41 mail auth-policy[10357]: tls: true May 31 14:27:41 mail auth-policy[10357]: } I think I am missing some important point. Maybe IMAP command ID and client_id are totally different. Can you please advise? Is it possible to pass details about mail client to auth_policy_server? Second question is: how I can get "x-originating-ip" from ID command to auth_policy_server? Below is my config file: # 2.3.10.1 (a3d0e1171): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.10 (67bf5bd7) # OS: Linux 5.3.18-2-pve x86_64 Debian 10.4 # Hostname: mail.z-technics.com auth_cache_size = 2 M auth_cache_ttl = 5 mins auth_master_user_separator = * auth_mechanisms = plain login auth_policy_check_before_auth = no auth_policy_hash_nonce = # hidden, use -P to show it auth_policy_report_after_auth = no auth_policy_server_timeout_msecs = 1500 auth_policy_server_url = http://127.0.0.1:8090/ dict { acl = pgsql:/etc/dovecot/dovecot-dict-sql.conf.ext quota = pgsql:/etc/dovecot/dovecot-dict-sql.conf.ext } disable_plaintext_auth = no imap_client_workarounds = delay-newmail imap_hibernate_timeout = 5 secs imap_id_log = * imap_id_retain = yes login_trusted_networks = 127.0.0.1 mail_gid = 2000 mail_home = /var/vmail/%d/%n mail_location = mdbox:~/mdbox:ALT=/var/vmail-archive/%d/%n/mdbox mail_max_userip_connections = 60 mail_plugins = acl zlib fts quota mail_uid = 2000 managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext vacation-seconds editheader imapsieve vnd.dovecot.imapsieve mdbox_rotate_interval = 1 days mdbox_rotate_size = 16 M passdb { args = /etc/dovecot/dovecot-ldap.conf driver = ldap } passdb { args = /etc/dovecot/masters.db driver = passwd-file master = yes pass = yes } plugin { acl = vfile acl_shared_dict = proxy::acl imapsieve_mailbox1_before = file:/var/vmail/sieve/report-spam.sieve imapsieve_mailbox1_causes = COPY imapsieve_mailbox1_name = Spam imapsieve_mailbox2_before = file:/var/vmail/sieve/report-ham.sieve imapsieve_mailbox2_causes = COPY imapsieve_mailbox2_from = Spam imapsieve_mailbox2_name = * imapsieve_mailbox3_before = file:/var/vmail/sieve/report-spam.sieve imapsieve_mailbox3_causes = COPY imapsieve_mailbox3_name = Junk imapsieve_mailbox4_before = file:/var/vmail/sieve/report-ham.sieve imapsieve_mailbox4_causes = COPY imapsieve_mailbox4_from = Junk imapsieve_mailbox4_name = * mailbox_alias_new = Sent Messages mailbox_alias_new2 = Sent Items mailbox_alias_new3 = Deleted Items mailbox_alias_old = Sent mailbox_alias_old2 = Sent mailbox_alias_old3 = Trash quota = dict:User quota::proxy::quota quota_grace = 10%% quota_rule2 = Trash:ignore quota_rule3 = Junk:ignore quota_warning = storage=80%% quota-warning 90 %u quota_warning2 = storage=85%% quota-warning 95 %u quota_warning3 = storage=95%% quota-warning 105 %u sieve = /var/vmail/%d/%n/sieve/.sieve sieve_after = /var/vmail/%d/%n/sieve/autoreply.sieve sieve_before = /var/vmail/sieve/global.sieve sieve_dir = /var/vmail/%d/%n/sieve sieve_extensions = +editheader +vacation-seconds sieve_global_dir = /var/vmail/sieve/ sieve_global_extensions = +vnd.dovecot.pipe +vnd.dovecot.environment sieve_max_redirects = 20 sieve_pipe_bin_dir = /usr/lib/dovecot sieve_plugins = sieve_imapsieve sieve_extprograms sieve_vacation_send_from_recipient = yes } protocols = imap sieve lmtp pop3 service auth-worker { unix_listener auth-worker { user = vmail } user = $default_internal_user } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } unix_listener auth-userdb { mode = 0600 user = vmail } user = vmail } service dict { unix_listener dict { mode = 0600 user = vmail } } service imap-hibernate { unix_listener imap-hibernate { group = $default_internal_group mode = 0660 } } service imap-login { process_min_avail = 10 service_count = 0 vsz_limit = 512 M } service imap { executable = imap process_limit = 3500 unix_listener imap-master { user = $default_internal_user } vsz_limit = 2 G } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } service managesieve-login { inet_listener sieve { port = 4190 } process_min_avail = 0 service_count = 1 vsz_limit = 64 M } service managesieve { process_limit = 400 } service pop3-login { process_min_avail = 3 service_count = 0 vsz_limit = 320 M } service pop3 { process_limit = 200 vsz_limit = 320 M } service quota-warning { executable = script /etc/dovecot/quota_warning.sh unix_listener quota-warning { mode = 0666 user = vmail } user = vmail } ssl_cert = </etc/ssl/private/multi.z-technics.cz.dovecot.pem ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it stats_writer_socket_path = userdb { args = /etc/dovecot/dovecot-ldap.conf driver = ldap } protocol sieve { managesieve_implementation_string = Dovecot Pigeonhole managesieve_max_compile_errors = 5 } protocol imap { mail_plugins = quota imap_quota fts mailbox_alias imap_acl acl imap_zlib imap_sieve } protocol lda { mail_fsync = optimized } protocol lmtp { mail_fsync = optimized mail_plugins = quota sieve acl }

2 1

2.3.10 + lazy expunge
by Matt Bryant 01 Jun '20

01 Jun '20

Hi, so currently run dovecot 2.2.x on CentOS 7 box and was looking to upgrade to 2.3.10. I use lazy expunge atm into a different namespace but saw on the new doco pages that is is depracted in 2.3.0. Have tested and still seems to work so question is more around why ? Why would this be deprecated given using a different namespace allows 2 things a) the folder where message is located is taken accross so if I want to restore and know where it went b) namespace allows me to specify an alternate location for storing the messages. Also given it does still work is there any indication as to what version the deprecation basically equates to it not working. rgds Matt ------ 8< --------- namespace Deprecated since version v2.3.0.

1 0

identify 143 vs 993 clients
by mj 01 Jun '20

01 Jun '20

Hi, I am trying to find a nice way to identify dovecot clients that are still configured to use port 143 to connect to our mailserver, from the dovecot logs. I would then ask them to move over to 993, and finally disable port 143 altogether. When looking at the dovecot logs, it seems this is not logged in any obvious way. Of course I could use netflow etc, but that would not give us usernames, but IP's, etc. So, is there a nice way to somehow indicate in the dovecot logs, if a client connected on 143 or on 993? Thanks!

13 25