February 2021 - dovecot

doveadm sync different local vs remote account/mailbox name
by Gregory Sloop 22 Feb '21

22 Feb '21

I'm, trying to sync/backup mailboxes from a current dovecot instance to a new server. But the old server has real system accounts. The new server has virtual users. And the account/user-name is different. Example: Joe Sixpack is joes (on the old system) but is joes(a)sixpack.org (on the new system.) I'm using something like this to attempt the sync doveadm -o mail_fsync=never backup -R -u joes(a)sixpack.org imapc: This works from the new system, as it recognizes the user with a full @domain.com username - but the old system doesn't know who joes(a)sixpack.org is - and just wants joes. I don't see a way to specify the remote account username independently from the local one. What's the best way to handle this? TIA -Greg

1 1

BUG report
by Oleg Pyzin 22 Feb '21

22 Feb '21

Hello! I've compiled Dovecot on a macmini G4 PPC from ports, but couldn't launch it. When Dovecot is trying to launch it's stop launching because got an error. ------------- The error is: Feb 09 19:22:50 master: Panic: kevent(EV_ADD, READ, 21) failed: Invalid argument Feb 09 19:22:50 master: Error: Raw backtrace: 0 libdovecot.0.dylib 0x00216d58 askpass + 136 -> 1 libdovecot.0.dylib 0x00216e78 backtrace_get + 36 -> 2 libdovecot.0.dylib 0x00221fe8 i_set_debug_file + 248 -> 3 libdovecot.0.dylib 0x002220fc default_fatal_handler + 56 -> 4 dovecot 0x000039a0 dup2_append + 1884 -> 5 libdovecot.0.dylib 0x00221a8c i_panic + 120 -> 6 libdovecot.0.dylib 0x0022c13c io_loop_handle_add + 244 -> 7 libdovecot.0.dylib 0x0022f2c8 timeout_add_short + 416 -> 8 libdovecot.0.dylib 0x0022f574 io_add_to + 76 -> 9 dovecot 0x00007dd4 service_monitor_stop_close + 288 -> 10 dovecot 0x00008cdc services_monitor_start + 840 -> 11 dovecot 0x00004aa4 main + 3336 -> 12 dovecot 0x00003048 start + 68 ------------- dovecot -n: admin.MacPPC[/opt/local/var/log/dovecot] <467-7> $ sudo dovecot -n # 2.3.11.3 (): /opt/local/etc/dovecot/dovecot.conf # OS: Darwin 9.8.0 Power Macintosh hfs # Hostname: MacPPC.Dlink default_client_limit = 50 default_internal_group = _dovecot default_process_limit = 10 default_vsz_limit = 128 M info_log_path = /opt/local/var/log/dovecot/info listen = * log_path = /opt/local/var/log/dovecot/error login_plugin_dir = /opt/local/lib/dovecot mail_location = maildir:/private/srv/mail/%u namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } protocols = imap pop3 service imap { process_limit = 32 } service pop3 { process_limit = 32 } service submission { process_limit = 32 } ssl_cert = </etc/ssl/certs/dovecot.pem ssl_key = # hidden, use -P to show it userdb { driver = passwd }

2 1

Policy on folder's name and path's length
by Rupert Gallagher 22 Feb '21

22 Feb '21

Hello, Users can be really good at hanging everybody when you give them enough roope. I spotted a number of problems that I think are of interest to everybody and need mitigation. # length of path A busy Windows user wrote enough mail subfolders, and folder names with soo many characters, that exceed Windows maximum path length. To avoid taxing the mail server, their mail client (Thunderbird) is configured to keep a local copy of emails. I need to enforce a policy on the maximum path length they can create, and the maximum number of characters on any given folder name. # forbidden characters Another problem folder names was the presence of white spaces, note the plural, on both the beginning and end of folder names. For example, to emphasize the importance of folders, the user added white spaces in front of names: > Must be at the top > Very important > A bit less important >Normal stuff And to add insult to injury they wrote spaces at the end of folder names: > This is a folder name with two hidden spaces I need to enfoce a policy that forbids the use white spaces at the beginning and end of folder names, as well as the use of repeated characters: > ____ I spotted your policy and found this new trick # subfolders, everywhere... A user confused their IMAP account for a file system and mind map tool, so they created folders everywhere, including root folders at the same level of inbox, draft, junk, trash, and huge directories under inbox. I need to enforce a policy that allows the creation of folders only under /Archive. I think such policies make good sense on any dovecot server and should be enforced by default.

2 2

Dovecot dsync certificate errors
by Stephan Mending 22 Feb '21

22 Feb '21

Hi *, I've setup two dovecot instances. As soon as i send the syncing part of dovecot to work I see the following errors in my maillogs. $ cat /var/log/mail.log doveadm(inbox(a)sec-level.domain): Error: doveadm server disconnected before handshake: SSL certificate doesn't match expected host name fqdn.of.system: No match to 1 SubjectAltNames doveadm(inbox(a)sec-level.domain): Error: Disconnected from remote: SSL certificate doesn't match expected host name fqdn.of.system: No match to 1 SubjectAltNames A little context: The certificates on the servers are issued by a private CA. The public CA-Certificate has been added to the keystore, though. Shouldn't be a problem. I can confirm that by connecting using s_client -> $ openssl s_client -connect <hostname-of-dovecot-A>:12345 .. ... .... Verify return code: 0 (ok) So far the certificate seems to be ok. **BUT**: As soon as i start dovecot (on the very same machine I issued the s_client command above) ... I am receiving the error messages: doveadm(inbox(a)sec-level.domain): Error: doveadm server disconnected before handshake: SSL certificate doesn't match expected host name fqdn.of.system: No match to 1 SubjectAltNames doveadm(inbox(a)sec-level.domain): Error: Disconnected from remote: SSL certificate doesn't match expected host name fqdn.of.system: No match to 1 SubjectAltNames And yes the SubjectAlternativeName in the certificate matches the configured FQDN in 30-dsync.conf. My 30-dsync.conf: $ cat /etc/dovecot/conf.d/30-dsync.conf service aggregator { fifo_listener replication-notify-fifo { user = dovecot mode = 0666 } unix_listener replication-notify { user = dovecot mode = 0666 } } # Configuring the replicator service service replicator { process_min_avail = 1 unix_listener replicator-doveadm { user = dovecot mode = 0666 } } service doveadm { user = dovecot inet_listener { port = 12345 ssl = yes } } doveadm_port = 12345 doveadm_password = <password> replication_max_conns = 1 plugin { mail_replica = tcps:fqdn.of.system } service config { unix_listener config { user = dovecot } } I'd love to here the answer to this. Thanks alot ! Best regards, Stephan

2 1

Possible minor issue with ~ vs %h
by Marc Delling 21 Feb '21

21 Feb '21

Hi there! The documentation states one should prefer "~" over "%h" as placeholder for mail_home, nevertheless, in an official example for mail_attribute_dict "%h" was used like this: mail_home = /var/vmail/mailboxes/%d/%n mail_location = maildir:~/mail:LAYOUT=fs # this works mail_attribute_dict = file:%h/mail/dovecot-attributes # this works I thought I would be clever and replace "%h" with "~" but if I do this, it does not behave as expected. Instead it creates a new directory named "~" inside mail_home. mail_home = /var/vmail/mailboxes/%d/%n mail_location = maildir:~/mail:LAYOUT=fs # this still works mail_attribute_dict = file:~/mail/dovecot-attributes # this does not work I just wanted to bring it up, maybe I misinterpreted the documentation. I abolished the tilde for now, even if it is the preferred way. All the best Marc

1 0

Messages sent to alias+detail end up in INBOX
by ml＠shadrinden.ru 21 Feb '21

21 Feb '21

Hi, everyone! I have seemingly correct settings for details to work: when I send a message to user+detail(a)mydomain.tld, it goes into the "detail" folder of user(a)mydomain.tld. Also I have working aliases, so when I send a message to alias(a)mydomain.tld, it goes into the INBOX folder of user(a)mydomain.tld. I expected that when I send a message to alias+detail(a)mydomain.tld, it would go into the "detail" folder of user(a)mydomain.tld. However, it goes into the INBOX folder of user(a)mydomain.tld. Is it the intended behavior? Pertinent settings: recipient_delimiter·=·+ lda_mailbox_autocreate·=·yes Or are these settings not the only ones pertinent to the case? -- Respectfully, Denis Shadrin

7 21

Sieve by the addressee
by ml＠shadrinden.ru 21 Feb '21

21 Feb '21

Hi, everyone! I have a sieve that is supposed to put all messages addressed to this mailing list into a separate folder: if anyof (address :is "to" "ml(a)shadrinden.ru", address :is "to" "dovecot(a)dovecot.org") { fileinto "mail_list"; stop; } Generally, it's working, but today I have got two mailing list messages that weren't put in that folder, they arrived straight into INBOX. I suppose that was because they were replies and were addressed to the person who asked the questions, so they had his address in "To:", and only in "Cc:" they had dovecot(a)dovecot.org. So, am I right that, when filtering messages by the addressee, it's generally a good idea to use not just "to", but ["to", "cc', "bcc"] ? -- Respectfully, Denis Shadrin

6 5

mail_crypt_global_private_key: Couldn't parse private key: Unknown/invalid PEM key type
by Antti Antinoja 20 Feb '21

20 Feb '21

Version: Dovecot 2.3.13 (89f716dc2) Issue: Dovecot states it can't parse the private key = Background = == Creating private EC key == * Curve: secp521r1 * Encryption: aes-256-ctr * Format: pkey * Enacapsulation: Base64 # openssl ecparam -name secp521r1 -genkey | openssl pkey |\ openssl ec -aes-256-ctr | base64 -w0 > test_keys_remove/private_key_encrypted.pem == Extract public key == # cat test_keys_remove/private_key_encrypted.pem | base64 -d |\ openssl ec -pubout | base64 -w0 > test_keys_remove/public_key.pem == Checking keys == * 592 Feb 20 07:27 private_key_encrypted.pem: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tClByb2MtVHlwZTogNCxFTkNSWVBURUQKREVLLUluZm86IEFFUy0yNTYtQ1RSLEY3QzRCMUU3MDQxRDBBNDU1QjFGOUUwODA0NkRBNDAxCgpQdGE4T0F0QTN1anYwdlNNY3RpSGlUZDJqMEdTU2R6VjU3UUdtVXdDTU1RcDdRb3FCSHQvZERNRVBiUEY1bEcxCmowUER1NS9GVnVUdFVsUlpTMTYrTlNXaW9yZ2t2VkhUaDMrNDd0eC91dmlRd1FQLzQzdEVhRnBmNzdTQVpsRHcKeEIyU2pNNFp2MWhkU3BqeFdER0dKRkJEdi8yL2RqOVVwVHh3a0F3dVgrUVFoUmxWelN5cjBCQVhHOXlPcS9HVAp3czhRNUdldnp2SEdoMVl5UGdwTDlqdGJpekdJYTRVUzBmN2hFZkdHSGZKLzNSSWR6MHhlaWh2OEdhMGh1ajQ4CmRTL1FTY0U3QnYrWW16emNnMmRsdlk5Nkc1eFJJT3dCOEFEd1IvbHdidz09Ci0tLS0tRU5EIEVDIFBSSVZBVEUgS0VZLS0tLS0K * 360 Feb 20 07:28 public_key.pem: LS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0tLS0KTUlHYk1CQUdCeXFHU000OUFnRUdCU3VCQkFBakE0R0dBQVFBK2w2M0ZIckpuT0dPZ1lDTG5PRVpOaHpSdW5YWgpoMHd5dTNPS1VzSEozUDJPVWxNWmxKOFFjZTF0SExUTWFxMWxkOTIwbkdJQmo1TGNYUklVdWRweElTd0I2Tld0Ck1TWncrZFBEUVRjc0hQMFRqWUh5Njl4d25BZHV4ZHZYdnh0Uk5TRzZGNlJPUnR0L2t2ekk3bWRPM0NpQ1FyMTQKTjZWalZyYWVpaXZkR2dPQ250bz0KLS0tLS1FTkQgUFVCTElDIEtFWS0tLS0tCg== == Notes == * The keys are then saved in database and fetched to userdb by Dovecot via passdb lookup (Details in the logs) * mail-crypt settings: mail_plugins = $mail_plugins mail_crypt plugin { mail_crypt_curve = secp521r1 mail_crypt_save_version = 0 } * Note: User record on database has mail_crypt_save_version = 2 as can be seen from the log extract below. = Dovecot log on client IMAP message retrieval = Feb 20 07:45:01 pf1 dovecot[19612]: auth: Debug: sql(test1(a)g1.fi,x.x.x.x,<wFzVEb67CMQKZgkb>): Performing passdb lookup Feb 20 07:45:02 pf1 dovecot[19612]: auth: Debug: sql(test1(a)g1.fi,x.x.x.x,<wFzVEb67CMQKZgkb>): Finished passdb lookup Feb 20 07:45:02 pf1 dovecot[19612]: auth: Debug: auth(test1(a)g1.fi,x.x.x.x,<wFzVEb67CMQKZgkb>): Auth request finished Feb 20 07:45:02 pf1 dovecot[19612]: auth: Debug: client passdb out: OK 1 user=test1(a)g1.fi Feb 20 07:45:02 pf1 dovecot[19612]: auth: Debug: sql(test1(a)g1.fi,x.x.x.x,<wFzVEb67CMQKZgkb>): Performing userdb lookup Feb 20 07:45:02 pf1 dovecot[19612]: auth: Debug: sql(test1(a)g1.fi,x.x.x.x,<wFzVEb67CMQKZgkb>): Finished userdb lookup Feb 20 07:45:02 pf1 dovecot[19612]: auth: Debug: master userdb out: USER 1609957377 test1(a)g1.fi mail_crypt_global_private_password=key_pass_we_know_this_is_correct mail_crypt_global_private_key=LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tClByb2MtVHlwZTogNCxFTkNSWVBURUQKREVLLUluZm86IEFFUy0yNTYtQ1RSLEY3QzRCMUU3MDQxRDBBNDU1QjFGOUUwODA0NkRBNDAxCgpQdGE4T0F0QTN1anYwdlNNY3RpSGlUZDJqMEdTU2R6VjU3UUdtVXdDTU1RcDdRb3FCSHQvZERNRVBiUEY1bEcxCmowUER1NS9GVnVUdFVsUlpTMTYrTlNXaW9yZ2t2VkhUaDMrNDd0eC91dmlRd1FQLzQzdEVhRnBmNzdTQVpsRHcKeEIyU2pNNFp2MWhkU3BqeFdER0dKRkJEdi8yL2RqOVVwVHh3a0F3dVgrUVFoUmxWelN5cjBCQVhHOXlPcS9HVAp3czhRNUdldnp2SEdoMVl5UGdwTDlqdGJpekdJYTRVUzBmN2hFZkdHSGZKLzNSSWR6MHhlaWh2OEdhMGh1ajQ4CmRTL1FTY0U3QnYrWW16emNnMmRsdlk5Nkc1eFJJT3dCOEFEd1IvbHdidz09Ci0tLS0tRU5EIEVDIFBSSVZBVEUgS0VZLS0tLS0K mail_crypt_global_public_key=LS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0tLS0KTUlHYk1CQUdCeXFHU000OUFnRUdCU3VCQkFBakE0R0dBQVFBK2w2M0ZIckpuT0dPZ1lDTG5PRVpOaHpSdW5YWgpoMHd5dTNPS1VzSEozUDJPVWxNWmxKOFFjZTF0SExUTWFxMWxkOTIwbkdJQmo1TGNYUklVdWRweElTd0I2Tld0Ck1TWncrZFBEUVRjc0hQMFRqWUh5Njl4d25BZHV4ZHZYdnh0Uk5TRzZGNlJPUnR0L2t2ekk3bWRPM0NpQ1FyMTQKTjZWalZyYWVpaXZkR2dPQ250bz0KLS0tLS1FTkQgUFVCTElDIEtFWS0tLS0tCg== mail_crypt_save_version=2 quota_rule=*:bytes=0 home=/var/vmail/g1.fi/test1 uid=10000 gid=10000 auth_mech=PLAIN auth_token=66d2d0f66bcce2758235fb53dbfe821804c6e79c Feb 20 07:45:02 pf1 dovecot[19612]: imap-login: Login: user=<test1(a)g1.fi>, method=PLAIN, rip=x.x.x.x, lip=y.y,y,y, mpid=19618, TLS, session=<wFzVEb67CMQKZgkb> Feb 20 07:45:02 pf1 dovecot[19612]: imap(test1(a)g1.fi)<19618><wFzVEb67CMQKZgkb>: Debug: Added userdb setting: plugin/mail_crypt_global_private_key=LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tClByb2MtVHlwZTogNCxFTkNSWVBURUQKREVLLUluZm86IEFFUy0yNTYtQ1RSLEY3QzRCMUU3MDQxRDBBNDU1QjFGOUUwODA0NkRBNDAxCgpQdGE4T0F0QTN1anYwdlNNY3RpSGlUZDJqMEdTU2R6VjU3UUdtVXdDTU1RcDdRb3FCSHQvZERNRVBiUEY1bEcxCmowUER1NS9GVnVUdFVsUlpTMTYrTlNXaW9yZ2t2VkhUaDMrNDd0eC91dmlRd1FQLzQzdEVhRnBmNzdTQVpsRHcKeEIyU2pNNFp2MWhkU3BqeFdER0dKRkJEdi8yL2RqOVVwVHh3a0F3dVgrUVFoUmxWelN5cjBCQVhHOXlPcS9HVAp3czhRNUdldnp2SEdoMVl5UGdwTDlqdGJpekdJYTRVUzBmN2hFZkdHSGZKLzNSSWR6MHhlaWh2OEdhMGh1ajQ4CmRTL1FTY0U3QnYrWW16emNnMmRsdlk5Nkc1eFJJT3dCOEFEd1IvbHdidz09Ci0tLS0tRU5EIEVDIFBSSVZBVEUgS0VZLS0tLS0K Feb 20 07:45:02 pf1 dovecot[19612]: imap(test1(a)g1.fi)<19618><wFzVEb67CMQKZgkb>: Debug: Added userdb setting: plugin/mail_crypt_global_private_password=<hidden> Feb 20 07:45:02 pf1 dovecot[19612]: imap(test1(a)g1.fi)<19618><wFzVEb67CMQKZgkb>: Debug: Added userdb setting: plugin/mail_crypt_global_public_key=LS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0tLS0KTUlHYk1CQUdCeXFHU000OUFnRUdCU3VCQkFBakE0R0dBQVFBK2w2M0ZIckpuT0dPZ1lDTG5PRVpOaHpSdW5YWgpoMHd5dTNPS1VzSEozUDJPVWxNWmxKOFFjZTF0SExUTWFxMWxkOTIwbkdJQmo1TGNYUklVdWRweElTd0I2Tld0Ck1TWncrZFBEUVRjc0hQMFRqWUh5Njl4d25BZHV4ZHZYdnh0Uk5TRzZGNlJPUnR0L2t2ekk3bWRPM0NpQ1FyMTQKTjZWalZyYWVpaXZkR2dPQ250bz0KLS0tLS1FTkQgUFVCTElDIEtFWS0tLS0tCg== Feb 20 07:45:02 pf1 dovecot[19612]: imap(test1(a)g1.fi)<19618><wFzVEb67CMQKZgkb>: Debug: Added userdb setting: plugin/=2 Feb 20 07:45:02 pf1 dovecot[19612]: imap(test1(a)g1.fi)<19618><wFzVEb67CMQKZgkb>: Debug: Added userdb setting: plugin/quota_rule=*:bytes=0 Feb 20 07:45:02 pf1 dovecot[19612]: imap(test1(a)g1.fi)<19618><wFzVEb67CMQKZgkb>: Error: mail_crypt_plugin: mail_crypt_global_private_key: Couldn't parse private key: Unknown/invalid PEM key type == Question == Any idea why Dovecot can't parse the private key? I tested this with several keys. Even with some without encryption -> Always same error. According to the debug messages the private key is correctly loaded (and indeed matches the one created on command line). Thank you for your time. Cheers, Antti -- Antti Antinoja <reader(a)fennosys.fi>

2 4

Monitoring Dovecot Replication
by MK 19 Feb '21

19 Feb '21

Hello, I have a cluster with two dovecot nodes with dovecot replication between them. The setup works fine and now I'm searching for a way to monitor the users so that I can get an information if the replication fails for one user for a longer time and I have to trigger the replication manually. Most of the time if I see a replication failure the self healing of dovecot replication repairs this in max. 10 min. I have tried different combinations of querying " doveadm replicator status '*' " and search for failed users and then send an alarm if one of fast sync, full sync or success sync reaches a threshold. But there is no combination that seems to be working if I only want to trigger this if I have to fix the replication manualy. Can someone tell me what I have to query to get only the user who's replication failed for a longer time (10 min +) and that I have to fix manually? Thank you. Oliver

4 6

Sieve regex error "invalid preceding regular expression"
by ml＠shadrinden.ru 19 Feb '21

19 Feb '21

Hi, everyone! I'm trying to get the detail part of the address (i.e. anything that comes between + and @ in the address of this type: alias+detail(a)mydomain.tld) in this sieve: if address :regex :localpart "to" "\+(.*)" { fileinto :create "${1}"; stop; } However, when I try to compile it with sievec, I get this error: error: invalid regular expression '+(.*)' for regex match: invalid preceding regular expression. Why is that? Shouldn't I escape the plus sign? Itried also not escaping it, but I get the same error. (A note why I don't use "envelope :detail" for that purpose: because the detail part of the address is not preserved in the "Envelope-To" after the message is redirected from alias to user. After that redirection the "Envelope-To" contain only user(a)mydomain.tld, not user+detail(a)mydomain.tld.) -- Respectfully, Denis Shadrin

2 2