November 2021 - dovecot

test-file-cache.c needs #ifdef HAVE_RLIMIT_AS
by Rupert Gallagher 07 Feb '22

07 Feb '22

test-file-cache.c:259:24: error: use of undeclared identifier 'RLIMIT_AS' test_assert(getrlimit(RLIMIT_AS, &rl_cur) == 0); ^ test-file-cache.c:267:24: error: use of undeclared identifier 'RLIMIT_AS' test_assert(setrlimit(RLIMIT_AS, &rl_new) == 0); ^ test-file-cache.c:270:24: error: use of undeclared identifier 'RLIMIT_AS' test_assert(setrlimit(RLIMIT_AS, &rl_cur) == 0); ^ test-file-cache.c:276:24: error: use of undeclared identifier 'RLIMIT_AS' test_assert(setrlimit(RLIMIT_AS, &rl_new) == 0); ^ test-file-cache.c:279:24: error: use of undeclared identifier 'RLIMIT_AS' test_assert(setrlimit(RLIMIT_AS, &rl_cur) == 0); ^

3 9

Dsync replication - delayed replication (Sync lock)
by Daniel Botting 31 Jan '22

31 Jan '22

Hi, *Our setup:* Two Debian 10 machines that are setup to replicate mail between them, we have round robin DNS setup so a user can connect to either server. *What should happen:* Mail is delivered to either server and replicated across straight away to their mailbox on the other server so it does not matter which one they are connected to they will receive it fairly soon after delivery. *What actually happens:* In some instances the user will experience a delayed receipt of messages if they are not connected to the server that the message is initially delivered to, sometimes the delay is 5/10 minutes, we had a recent support ticket submitted where it was over an hour. Error message seen in mail.err: Sep 1 10:16:15 <host name> dovecot: dsync-local(<username>)<WELSGEERTl8FEAAAZJ7A9A>: Error: Couldn't lock /path/to/mailbox/.dovecot-sync.lock: fcntl(/path/to/mailbox/.dovecot-sync.lock, write-lock, F_SETLKW) locking failed: Timed out after 30 seconds (WRITE lock held by pid 3697) Process 3697 is dovecot/doveadm-server. *Doveconf -n output:* # 2.3.10.1 (a3d0e1171): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.10 (67bf5bd7) # OS: Linux 4.19.0-10-amd64 x86_64 Debian 10.5 # Hostname: <server hostname> auth_verbose = yes default_vsz_limit = 0 doveadm_password = # hidden, use -P to show it first_valid_gid = 8 first_valid_uid = 8 last_valid_gid = 8 last_valid_uid = 8 lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes mail_gid = 8 mail_location = maildir:~/Maildir mail_plugins = " notify replication" mail_uid = 8 managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex im ap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext editheader imapfla gs namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } plugin { mail_replica = tcps:<server being replicated to>:<port being used> sieve = ~/.dovecot.sieve sieve_dir = ~/sieve sieve_extensions = +editheader +imapflags } postmaster_address = postmaster@<domain address> protocols = " imap sieve pop3" replication_max_conns = 12 service aggregator { fifo_listener replication-notify-fifo { user = mail } unix_listener replication-notify { user = mail } } service auth { unix_listener /var/run/dovecot-exim-bridge { mode = 0660 user = Debian-exim } } service doveadm { inet_listener { port = <port being used for replication> ssl = yes } } service imap-login { inet_listener imap { port = 143 } } inet_listener imaps { port = 993 ssl = yes } process_limit = 512 process_min_avail = 4 service_count = 1 } service imap { process_limit = 1024 } service managesieve-login { inet_listener sieve { port = <sieve port> } process_min_avail = 1 service_count = 8 vsz_limit = 256 M } service managesieve { process_limit = 1024 } service replicator { process_min_avail = 1 unix_listener replicator-doveadm { mode = 0666 } } ssl = required ssl_cert = </path/to/ssl/cert/fullchain.pem ssl_cipher_list = ALL:!LOW:!SSLv2:!EXP:!aNULL ssl_client_ca_dir = /etc/ssl/certs ssl_key = # hidden, use -P to show it ssl_min_protocol = TLSv1.2 userdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap override_fields = home=/var/mail/%u uid=mail gid=mail } protocol lda { mail_plugins = " notify replication sieve" } protocol imap { mail_max_userip_connections = 32 mail_plugins = " notify replication" } protocol sieve { mail_max_userip_connections = 10 managesieve_logout_format = bytes=%i/%o managesieve_max_line_length = 65536 } Kind regards Daniel

3 3

dovecot-2.3.17: "Panic: file ioloop.c: line 865"
by Piper Andreas 14 Dec '21

14 Dec '21

Hello, since the upgrade from dovecot-2.3.16 to 2.3.17 I get 'Panic'-errors in the system-log of my replicator hosts. See below for log messages, doveconf-output and gdb-backtrace. Storage filesystem is ZFS. The error seems to be correlated with exactly one user-mailbox, this user is repeatedly noted as 'failed' in replication status, although replication of this mailbox seems to work, as the mailbox status shows always the identical size on both replicators. The error can be produced by forcing replication of this individual mailbox. Is there anything I can do to repair this mailbox? Thanks for any hints, Andreas Example log-messages: Nov 11 07:17:50 vhrz311 dovecot: doveadm(119455): Error: write(<local>) failed: Timed out after 60 seconds Nov 11 07:17:50 vhrz311 dovecot: doveadm(119455): Panic: file ioloop.c: line 865 (io_loop_destroy): assertion failed: (ioloop == cur rent_ioloop) Nov 11 07:17:50 vhrz311 dovecot: doveadm(119455): Error: Raw backtrace: /usr/lib/dovecot/libdovecot.so.0(backtrace_append+0x42) [0x7 f4e59419182] -> /usr/lib/dovecot/libdovecot.so.0(backtrace_get+0x1e) [0x7f4e5941929e] -> /usr/lib/dovecot/libdovecot.so.0(+0xf8a5e) [0x7f4e59427a5e] -> /usr/lib/dovecot/libdovecot.so.0(+0xf8b01) [0x7f4e59427b01] -> /usr/lib/dovecot/libdovecot.so.0(i_fatal+0) [0x7f 4e593744a7] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_destroy+0x2dc) [0x7f4e5944121c] -> dovecot/doveadm-server(+0x46fb6) [0x563d0 150ffb6] -> dovecot/doveadm-server(doveadm_print+0x27) [0x563d01508fb7] -> dovecot/doveadm-server(+0x2b427) [0x563d014f4427] -> dove cot/doveadm-server(+0x2da44) [0x563d014f6a44] -> dovecot/doveadm-server(doveadm_cmd_ver2_to_mail_cmd_wrapper+0x2cf) [0x563d014f7c6f] -> dovecot/doveadm-server(doveadm_cmd_run_ver2+0x43b) [0x563d01508c1b] -> dovecot/doveadm-server(+0x44612) [0x563d0150d612] -> /usr /lib/dovecot/libdovecot.so.0(io_loop_call_io+0x69) [0x7f4e594406d9] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run_internal +0x134) [0x7f4e59442034] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run+0x50) [0x7f4e594407e0] -> /usr/lib/dovecot/libdovec ot.so.0(io_loop_run+0x38) [0x7f4e59440a18] -> /usr/lib/dovecot/libdovecot.so.0(master_service_run+0x13) [0x7f4e593a6a23] -> dovecot/ doveadm-server(main+0x102) [0x563d014e6922] -> /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xe7) [0x7f4e58bc1bf7] -> dovecot/d oveadm-server(_start+0x2a) [0x563d014e69aa] Nov 11 07:17:50 vhrz311 dovecot: doveadm(119455): Fatal: master: service(doveadm): child 119455 killed with signal 6 (core dumped) 'doveconf -n': # 2.3.17 (e2aa53df5b): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.17 (054dddfa) # OS: Linux 4.15.0-162-generic x86_64 Ubuntu 18.04.6 LTS # Hostname: vhrz311.HRZ.Uni-Marburg.DE auth_cache_negative_ttl = 0 auth_cache_size = 10 M auth_master_user_separator = * auth_worker_max_count = 1024 base_dir = /var/run/dovecot/ default_client_limit = 10000 default_vsz_limit = 6 G doveadm_password = # hidden, use -P to show it doveadm_port = 12345 first_valid_gid = 10000 first_valid_uid = 10000 imap_max_line_length = 640 k last_valid_gid = 10000 last_valid_uid = 10000 mail_attribute_dict = file:%h/mdbox/dovecot-attributes mail_gid = 10000 mail_location = mdbox:%h/mdbox mail_plugins = " mail_log notify zlib notify replication" mail_privileged_group = mail mail_uid = 10000 managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext namespace inbox { hidden = no inbox = yes list = yes location = prefix = separator = / subscriptions = yes type = private } passdb { args = /etc/dovecot.deny deny = yes driver = passwd-file } passdb { args = /etc/dovecot/private/passwd.masterusers driver = passwd-file master = yes } passdb { args = /etc/dovecot/dovecot-ldap.hrz.conf.ext driver = ldap name = passdb_ldap_hrz } passdb { args = /etc/dovecot/dovecot-ldap.staff.conf.ext driver = ldap name = passdb_ldap_staff } passdb { args = /etc/dovecot/dovecot-ldap.students.conf.ext driver = ldap name = passdb_ldap_students } plugin { mail_replica = tcp:172.25.1.95 sieve = file:~/sieve;active=~/.dovecot.sieve sieve_default = /var/lib/dovecot/default.sieve sieve_max_actions = 55 sieve_max_redirects = 50 } pop3_uidl_format = %08Xv%08Xu postmaster_address = postmaster(a)hrz.uni-marburg.de protocols = imap pop3 lmtp sieve replication_dsync_parameters = -d -n INBOX -l 30 -U replication_max_conns = 20 service aggregator { fifo_listener replication-notify-fifo { user = vmail } unix_listener replication-notify { user = vmail } } service auth-worker { user = $default_internal_user } service auth { client_limit = 10000 } service config { process_min_avail = 8 } service doveadm { inet_listener { port = 12345 } vsz_limit = 6 G } service imap-login { process_min_avail = 64 service_count = 0 } service imap { process_limit = 8192 } service lmtp { inet_listener lmtp { port = 24 } } service managesieve-login { inet_listener sieve { port = 4190 } process_min_avail = 8 service_count = 0 } service pop3-login { process_min_avail = 8 service_count = 0 } service replicator { process_min_avail = 1 unix_listener replicator-doveadm { mode = 0600 user = vmail } } service submission-login { service_count = 0 } ssl = required ssl_ca = </etc/ssl/certs/umr-chain.pem ssl_cert = </etc/ssl/certs/vhrz311.hrz.uni-marburg.de.pem ssl_client_ca_dir = /etc/ssl/certs ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it ssl_require_crl = no userdb { args = /etc/dovecot/dovecot-ldap-userdb.conf.ext driver = ldap name = userdb_ldap } protocol imap { imap_metadata = yes mail_max_userip_connections = 25 mail_plugins = " mail_log notify zlib notify replication imap_zlib" } protocol lmtp { mail_plugins = " mail_log notify zlib notify replication sieve" } gdb: gdb /usr/lib/dovecot/doveadm-server /var/vmail/system-cores/core GNU gdb (Ubuntu 8.1.1-0ubuntu1) 8.1.1 Copyright (C) 2018 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html> This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type "show copying" and "show warranty" for details. This GDB was configured as "x86_64-linux-gnu". Type "show configuration" for configuration details. For bug reporting instructions, please see: <http://www.gnu.org/software/gdb/bugs/>. Find the GDB manual and other documentation resources online at: <http://www.gnu.org/software/gdb/documentation/>. For help, type "help". Type "apropos word" to search for commands related to "word"... Reading symbols from /usr/lib/dovecot/doveadm-server...(no debugging symbols found)...done. [New LWP 119455] [Thread debugging using libthread_db enabled] Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1". Core was generated by `dovecot/doveadm-server'. Program terminated with signal SIGABRT, Aborted. #0 __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:51 51 ../sysdeps/unix/sysv/linux/raise.c: No such file or directory. (gdb) bt #0 __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:51 #1 0x00007f4e58be0921 in __GI_abort () at abort.c:79 #2 0x00007f4e59427a11 in ?? () from /usr/lib/dovecot/libdovecot.so.0 #3 0x00007f4e59427b01 in ?? () from /usr/lib/dovecot/libdovecot.so.0 #4 0x00007f4e593744a7 in i_panic () from /usr/lib/dovecot/libdovecot.so.0 #5 0x00007f4e5944121c in io_loop_destroy () from /usr/lib/dovecot/libdovecot.so.0 #6 0x0000563d0150ffb6 in ?? () #7 0x0000563d01508fb7 in doveadm_print () #8 0x0000563d014f4427 in ?? () #9 0x0000563d014f6a44 in ?? () #10 0x0000563d014f7c6f in doveadm_cmd_ver2_to_mail_cmd_wrapper () #11 0x0000563d01508c1b in doveadm_cmd_run_ver2 () #12 0x0000563d0150d612 in ?? () #13 0x00007f4e594406d9 in io_loop_call_io () from /usr/lib/dovecot/libdovecot.so.0 #14 0x00007f4e59442034 in io_loop_handler_run_internal () from /usr/lib/dovecot/libdovecot.so.0 #15 0x00007f4e594407e0 in io_loop_handler_run () from /usr/lib/dovecot/libdovecot.so.0 #16 0x00007f4e59440a18 in io_loop_run () from /usr/lib/dovecot/libdovecot.so.0 #17 0x00007f4e593a6a23 in master_service_run () from /usr/lib/dovecot/libdovecot.so.0 #18 0x0000563d014e6922 in main ()

4 5

public folders, ACLs
by Stefan G. Weichinger 06 Dec '21

06 Dec '21

greetings ... I got the following request from a customer where we run dovecot-2.3.15 on a debian server: They have a public folder with all their project-related subfolders inside: namespace { location = maildir:/home/vmail/oeffentlich prefix = Oeffentlich/ separator = / subscriptions = yes type = public } So far we don't have the mail_plugin ACL enabled. They want to be able to create projectfolders that aren't move/delete/rename-able by the users, only by some admins. But the users should be allowed to move mails between different projectfolders etc As far as I understand we can do that with Dovecot ACLs (although I am still figuring out how to properly design them ...). My questions: * if I enable the mail_plugin for ACLs, does that in any way change the behavior of existing mailboxes? afai understand: no. Only if ACL-lists exist in the various mailboxes, these get applied, right? I don't want to break things, and I want to avoid additional complexity for the non-public user mailboxes etc Maybe I can enable the plugin only for that public namespace? * maybe someone has a link to a similar setup? thanks in advance, Stefan

2 8

Searching 30 GB mailbox
by Einar Bjarni Halldórsson 03 Dec '21

03 Dec '21

Hi, We're migrating our mailboxes from Zimbra to dovecot, running on FreeBSD 12.2. We're using mdbox and solr for fts. dovecot version 2.3.17. One of our mailboxes gets a bcc of every outgoing mail from our system and it currently holds ~4.5 million messages taking 30 GB. One of the ways we use the mailbox is that when outgoing mail is sent, we store the Message-ID in our database, and in our admin interface we can open the mail and it's fetched from IMAP by doing a 'SEARCH HEADER Message-ID <MSG_ID>'. In Zimbra this was reasonably fast, but after migrating the mailbox to dovecot it's 30 seconds which I think we can reduce. After turning on mail_debug I see this in our log https://pastebin.com/kP9H7gSB Looks like solr finishes searching instantly, then there's ~30 seconds of silence in the logs, and then more log lines about fetching data from mail cache. The same thing happens if I use telnet and just issue a 'SEARCH HEADER...' command. How can I find out what dovecot is doing in those 30 seconds? .einar

5 14

Strategies for protecting IMAP (e.g. MFA)
by Tyler Montney 02 Dec '21

02 Dec '21

With the world of ransomware as it is today (aka attacks seem more vicious and commonplace), anything I expose to WAN must have additional protection. I've seen a few posts to this list on it. The only thing that helped was that Dovecot supports OAuth. Through OAuth I figure I could implement MFA. However, I'd have to host my own identity server. From there, Thunderbird supports OAuth so that should work. Since this is getting increasingly complicated, I wanted to ask before going further. What do you all do? Any recommendations?

14 20

Strange errors with Dovecot replication
by Claudio Corvino 01 Dec '21

01 Dec '21

Hi, I have two IMAP/LMTP Dovecot server in replica (version 2.3.4.1) for testing purposes, both connected through an IPsec tunnel, I use LDAP/AD for /userdb, /all seems to work fine except for these errors present in logs every day: NODE A: /doveadm: Error: sieve: file storage: utime(/var/www/html/ooo/its-test) failed: Operation not permitted: 28 Time(s) dsync-local(its-test)<TxExKuQgeWHlTAAA045Smw>: Error: read(xxx) failed: Connection reset by peer (last sent=mailbox_delete, last recv=handshake): 1 Time(s) dsync-local(its-test)<fXcyHCd3eWGHXwAA045Smw>: Error: sieve: file storage: utime(/var/www/html/ooo/its-test) failed: Operation not permitted: 2 Time(s) dsync-local(its-test)<fZ2LISh3eWGOXwAA045Smw>: Error: read(xxx) failed: Connection reset by peer (last sent=mailbox_delete, last recv=handshake): 1 Time(s) dsync-local(its-test2)<PqNdGCd3eWGGXwAA045Smw>: Error: read(xxx) failed: Connection reset by peer (last sent=mailbox_delete, last recv=handshake): 1 Time(s)/ NODE B: /doveadm: Error: Couldn't lock /mnt/mail-storage-dev/its-test/.dovecot-sync.lock: fcntl(/mnt/mail-storage-dev/its-test/.dovecot-sync.lock, write-lock, F_SETLKW) locking failed: Timed out after 30 seconds: 2 Time(s) doveadm: Error: Couldn't lock /mnt/mail-storage-dev/its-test2/.dovecot-sync.lock: fcntl(/mnt/mail-storage-dev/its-test2/.dovecot-sync.lock, write-lock, F_SETLKW) locking failed: Timed out after 30 seconds: 1 Time(s) doveadm: Error: sieve: file storage: utime(/var/www/html/ooo/its-test) failed: Operation not permitted: 28 Time(s) dsync-local(its-test)<QtV8HSh3eWHFDgAA/HgeEQ>: Error: sieve: file storage: utime(/var/www/html/ooo/its-test) failed: Operation not permitted: 2 Time(s)/ What I have to do? Do I have to worry about this or I can ignore it? Thanks Regards

2 3

sieve - segmentation fault
by kjonca＠o2.pl 01 Dec '21

01 Dec '21

I tried to experiment with "index" extension and I found that, in case "0" sieve-filter segfaults. example code was: --8<---------------cut here---------------start------------->8--- if header :index 0 :last :regex "received" "some regex here" { fileinto "dedicated mailbox" ; } --8<---------------cut here---------------end--------------->8--- KJ -- http://stopstopnop.pl/stop_stopnop.pl_o_nas.html I dote on his very absence. -- William Shakespeare, "The Merchant of Venice"

2 2

/var/run/dovecot/stats-writer) failed: No such file or directory
by Brent Clark 01 Dec '21

01 Dec '21

Good day Guys I am getting this error message in the logs. dovecot: imap-login: Error: net_connect_unix(/var/run/dovecot/stats-writer) failed: No such file or directory Running Debian Buster. With a bit of googling, I tried the suggestions of: https://forum.iredmail.org/post67042.html#p67042 https://git.ispconfig.org/ispconfig/ispconfig3/-/issues/5343 But still this problem is persisting. Here is the config. ~ # cat /etc/dovecot/conf.d/20-dovecot-stats.conf service stats { unix_listener stats-writer { user = dovecot group = mail mode = 0660 } } ~ # ls -la /var/run/dovecot/stats-writer srw-rw---- 1 dovecot mail 0 Nov 21 17:00 /var/run/dovecot/stats-writer Could anyone please shed an idea or tip of where more too can I look. Many thanks Regards Brent Clark

3 3

Fatal: master: service(imap): child 1288 killed with signal 6
by fugee ohu 01 Dec '21

01 Dec '21

This error appears in mail.log repeatedly after dovecot startup Notice the 777 mode for service auth I set that myself # doveconf -n # 2.3.7.2 (3c910f64b): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.7.2 () # OS: Linux 5.14.17-x86_64-linode150 x86_64 Ubuntu 20.04.3 LTS # Hostname: mail.servicemouse.com auth_verbose = yes mail_privileged_group = mail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { driver = pam } plugin { sieve = file:~/sieve;active=~/.dovecot.sieve } protocols = " imap lmtp sieve pop3 submission" service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0777 user = postfix } } ssl_cert = </etc/letsencrypt/live/mail.servicemouse.com/fullchain.pem ssl_client_ca_dir = /etc/letsencrypt/live/mail.servicemouse.com ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it submission_relay_host = 127.0.0.1 submission_relay_ssl = starttls submission_relay_trusted = yes userdb { driver = passwd }

2 3