October 2021 - dovecot

stats events for use with prometheus
by Marc 12 Oct '21

12 Oct '21

I am struggling a bit with getting some basic metrics into prometheus. Is there some sample metrics file that has most common metrics configured? [@ conf.d]# cat 05-metrics.conf # https://doc.dovecot.org/admin_manual/event_design/#event-design metric imap_command { filter = event=imap_command_finished group_by = cmd_name tagged_reply_state }

3 7

Containerize dovecot?
by MRob 12 Oct '21

12 Oct '21

Hello, anyone here has containerized dovecot? Can I ask general advice and experience please? are there any recommended articles/tutorial for containerize deploymnt and auto-scaling? Thank you.

9 12

Dovecot-2.3.15 ignores imaps inet_listener
by David Favor 12 Oct '21

12 Oct '21

Processes that show up, only imap, no imaps... # service dovecot restart && netstat -pluten | egrep dovecot tcp 0 0 51.222.96.234:143 0.0.0.0:* LISTEN 0 3017752730 285711/dovecot Someone let me know what I've done wrong. Thanks! Changing conf.d/10-ssl.conf ssl=yes seems to have no effect, thus ssl=no shows up in the config, so maybe that's the problem. Data follows... _______ # dovecot -n -c /etc/dovecot/dovecot.conf # 2.3.15 (0503334ab1): /etc/dovecot/dovecot.conf # OS: Linux 5.4.0-56-generic x86_64 Ubuntu 20.04.3 LTS # Hostname: net15-david-favor-mail mail_location = mbox:~/mail:INBOX=/var/mail/%u namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { driver = pam } protocols = " imap lmtp" service imap-login { inet_listener imap { address = 51.222.96.234 port = 143 } inet_listener imaps { address = 51.222.96.234 port = 993 ssl = yes } } ssl = no userdb { driver = passwd }

1 0

two different mail_location
by Gabx 12 Oct '21

12 Oct '21

Hi everybody, my mail system has all users in usual path ~ . Only one user is in /var/%u . This user doesn't receive emails. I guess it is because its $HOME is on a different path than the one specified in dovecot mail_location which is: > mail_location = maildir:~/%u/Maildir What's the best way to solve this issue ? Namespaces ? If so could someone explain me how ? Best Regards Gabriel -- GPG fingerprint: 5A6A F742 ACEA C9A7 93A8 8D5E 7AEF 5A02 D080 89F7 Contact: xmpp://gabx@jabber.tcpreset.net

2 4

Dovecot Replica one user at a time
by Claudio Corvino 12 Oct '21

12 Oct '21

Hi all, I have two IMAP/LMTP Dovecot server in replica (version 2.3.4.1) for testing purposes, both connected through an IPsec tunnel, I use LDAP/AD for /userdb, /all seems to work fine. Now I would like to go in production where at the moment I have only one server active and setup the replica too ... but! I need to know how I can exclude all the users from replication (help/examples appreciated!) and doing replication one user at a time, in order to not saturate bandwidth on the IPsec tunnel. I read https://wiki.dovecot.org/Replication: "Since v2.3.1 you can disable replication for a user by providing 'noreplicate' user database field <https://wiki.dovecot.org/UserDatabase/ExtraFields>. Another way to disable replication for some users is to return mail_replica field from userdb for users you want to replicate." but I can't figure out how to do it. One last question: since I have to deal with huge mailboxes, if prior to activate replication I do an rsync between the two Dovecot filesystems, does the replication will work? Thanks in advance! Cheers -- *Claudio Corvino IT Systems Administrator*

2 3

Authentication problems due to file ownership issue.
by C. Petro 12 Oct '21

12 Oct '21

I am getting: Oct 03 20:19:52 auth: Error: net_connect_unix(auth-worker) in directory /run/dovecot failed: Permission denied (euid=5000(vmail) egid=5000(vmail) missing +r perm: /run/dovecot/auth-worker, dir owned by 0:0 mode=0755) Because: root@mailserver:/run/dovecot# ls -l auth-worker srw------- 1 dovecot root 0 Oct 3 20:09 auth-worker When it really needs to be "vmail" (I think). I have set: service auth-worker { # Auth worker process is run as root by default, so that it can access # /etc/shadow. If this isn't necessary, the user should be changed to # $default_internal_user. user = vmail group = vmail } in 10-master.conf (because I'm using postfixadmin/mariadb to store user information, I don't *want* access to /etc/shadow) I set this about an hour ago, then applied some security patches and restarted (ubuntu 20.04 system) and it didn't change. I then manually did a "chown vmail: of that file, and I got further. I had a different problem that I resolved, and then restarted dovecot, and /run/dovecot/auth-worker reverted. I'm not sure where I need to set this. Thanks. Petro. :wq

2 2

haproxy config manual update for multiple ports
by Marc 09 Oct '21

09 Oct '21

https://wiki2.dovecot.org/HAProxy Maybe update this to having multiple ports (if this is even possible) frontend ft_imap bind :110 << bind :143 mode tcp default_backend bk_imap backend bk_imap mode tcp balance leastconn stick store-request src stick-table type ip size 200k expire 30m server s1 backend.example.com:10143 send-proxy-v2 <<< how to put more ports here?

3 7

SNI via lookup?
by Felipe Gasper 08 Oct '21

08 Oct '21

Hello, How (if at all) might I configure a Dovecot server to read its SNI configuration dynamically? Right now I’ve got thousands of domains all served from a quite-large static config file that has to be rebuilt every time a domain is added or removed. It would be much simpler if there were a way to make Dovecot call out to some external service to fetch a given domain’s certificate. Thank you in advance! cheers, -Felipe Gasper

3 5

writing Maildir subscriptions file outside of dovecot
by David Mandelberg 08 Oct '21

08 Oct '21

Hi, Is it safe to write to the Maildir subscriptions file directly? I'm trying to figure out a way to make sure the subscriptions match the actual folders exactly. I know how to subscribe to existing mailboxes with `doveadm mailbox list` and `doveadm mailbox subscribe`, but the latter seems to only accept mailboxes on the command line, and any local user can see the command line of any other user's commands. Also, that doesn't handle unsubscribing from non-existent mailboxes. I think unsubscribing from any mailboxes listed in `doveadm mailbox list -s` but not in `doveadm mailbox list` would work, but it has the same issue of mailboxes on the command line. It looks like I could do what I want with something like this command, but I'm not sure if it's safe to write directly to the subscriptions file: { echo INBOX; ls -1A | grep '^\.' | cut -c 2-; } > subscriptions (I was also thinking about using `doveadm mailbox list` to write the subscriptions file directly, but it looks like they use different separators and encodings.)

2 2

reconsidering my (your?) current setup
by Marc 07 Oct '21

07 Oct '21

With redhat 'dumping' the support for centos and the availability of containers. I thought about reconsidering my default dovecot setup. Since the concept of having a lts distribution that is supported by redhat/centos is more or less 'unavailable'. I thought about using the repo of dovecot with centos8stream. os == For now I stick with centos8stream, just because the rest is still on centos7 support and the ceph development team is using it as a default. (And can't yet let go of the idea this closest to professional distro ;)) auth uid gid os =============== I am not really convinced that storing users in mysql/postgres is a better alternative than having linux do auth. I also think it is good to have mailbox files stored with different uid's (no idea if this is even the case when dovecot is using mysql/maria/postgres) Normally I would use a synced ldap server on the vm for authentication. But I was thinking of using now an external ldap task from the container environment. To de-duplicate services/data and make the environment simple. Since rh is moving to a different ldap server, it would be good to have this seperated in the future. New to me is the sssd, used nscd/nslcd for decades without issues. I guess the best solution is to have the os uid/gid coming from sssd, configure sssd to have a huge timeout if the backend ldap auth is not available. What is your thought about this? auth uid gid dovecot ==================== I do not really have an idea if I should have dovecot use ldap directly or use this sssd pam? The advantage of using ldap directly is you could maybe skip identifying users in the os. But maybe then tools like dovadm that require a user are not working anymore. From the keep it simple perspective it is probably better to use sssd. However centos8stream and sssd are not really known to me. So any ideas/advice about this?

7 7