May 2021 - dovecot - dovecot.org

mail-crypt-plugin: encrypted user keys
by Daniel Schuermann 28 May '21

28 May '21

Hi, I tried to enable encrypted folder keys using mail-crypt-plugin. It works as expected when using unencrypted folder keys. When I add mail_crypt_require_encrypted_user_key = yes as shown below, I somehow manage to crash dovecot: dovecot: lmtp(82060): Fatal: master: service(lmtp): child 82060 killed with signal 6 (core not dumped - https://dovecot.org/bugreport.html#coredumps - set service lmtp { drop_priv_before_exec=yes }) dovecot: lmtp(67814): Panic: file mail-user.c: line 229 (mail_user_deinit): assertion failed: ((*user)->refcount== 1) lmtp(root): Info: msgid=<07e3a23b2aaea60b(a)mx.2718282.net>: save failed to INBOX: generate_keypair(INBOX) failed: mail_crypt_require_encrypted_user_key set, cannot generate user keypair without password or key My config files: # 2.3.14 (cee3cbc0d): /etc/mail/imap.conf # OS: OpenBSD 6.9 amd64 auth_verbose = yes debug_log_path = /var/log/dovecot info_log_path = /var/log/dovecot mail_attribute_dict = file:%h/Maildir/dovecot-attributes mail_debug = yes namespace inbox { ... } passdb { args = /etc/mail/imap-sqlite.conf driver = sql } plugin { mail_crypt_curve = secp521r1 mail_crypt_require_encrypted_user_key = yes mail_crypt_save_version = 2 } protocols = imap lmtp service imap-login { ... } ssl = required ssl_cert = </etc/ssl/rsa.crt ssl_key = # hidden, use -P to show it ssl_min_protocol = TLSv1.2 ssl_prefer_server_ciphers = yes userdb { args = /etc/mail/imap-sqlite.conf driver = sql override_fields = uid=vmail gid=vmail } # file: /etc/mail/imap-sqlite.conf driver = sqlite connect = /etc/mail/sqlite.db default_pass_scheme = BLF-CRYPT user_query = SELECT '/home/vmail/'||destination AS home FROM virtuals WHERE email = '%u' password_query = SELECT email as user, password, '%w' AS \ userdb_mail_crypt_private_password FROM credentials WHERE email = '%u'

2 1

missing +w perm
by Jeff Abrahamson 28 May '21

28 May '21

I've started seeing the following error in mail.err for precisely one user on precisely one domain: Error: mkdir(/var/mail/vmail//jeff/mail) failed: Permission denied (euid=1000(jeff) egid=1001(jeff) missing +w perm: /var/mail/vmail/, dir owned by 4000:4000 mode=0755) Error: Mailbox INBOX: Failed to autocreate mailbox: Internal error occurred. In mail.log I see a bit more: Warning: Failed to parse address from `From_'-line: Missing domain Error: mkdir(/var/mail/vmail//jeff/mail) failed: Permission denied (euid=1000(jeff) egid=1001(jeff) missing +w perm: /var/mail/vmail/, dir owned by 4000:4000 mode=0755) Error: mkdir(/var/mail/vmail//jeff/mail) failed: Permission denied (euid=1000(jeff) egid=1001(jeff) missing +w perm: /var/mail/vmail/, dir owned by 4000:4000 mode=0755) Error: Mailbox INBOX: Failed to autocreate mailbox: Internal error occurred. Refer to server log for more information. save failed to open mailbox INBOX: Mailbox INBOX: Failed to autocreate mailbox: Internal error occurred. And yet there's no apparent problem sending and receiving mail for user jeff, for all domains handled by the server. Other users have no issues. The /var/mail/vmail/ hierarchy is all owned by vmail:vmail (4000:4000) and directories are all 0755. I suspect a red herring except it's been continuing for a week now. I was reading this page (following some searching), but it doesn't seem pertinent in the end. https://wiki2.dovecot.org/MailLocation/mbox#A.2BAC8-var.2BAC8-mail.2BAC8_do… Any suggestions what this might be? -- Jeff Abrahamson +33 6 24 40 01 57 +44 7920 594 255 http://p27.eu/jeff/ http://mobilitains.fr/

2 2

backup v rsync
by Jeff Abrahamson 27 May '21

27 May '21

I've been migrating from a dovecot 2.2.22 instance to a dovecot 2.3.7.2 instance. (Said differently, from an ubuntu 16.04 host to a 20.04 host.) It's a tiny site: only a handful of users actually had to migrate, most either died on the old one or were born on the new one. The main user in need of migration was me. After fiddling with dsync and not getting it working, I threw in the towel. This is a migration I had to do once for precisely one user. I had been using the old host exclusively, so it was easy to shut down both dovecot instances the time it took me to rsync my data from one to the other. Now that seems to work, almost. Mail is being delivered to my inbox, anyway. Most other folders are looking inaccessible to my mail client (thunderbird, for this test). The main difference between the two servers, aside from the above, is a switch from mail_location = maildir:~/Maildir to mail_home = /var/mail/vmail/%d/%n mail_location = maildir:/var/mail/vmail/%d/%n/mail:LAYOUT=fs mail_privileged_group = mail I corrected permissions and ownership when I copied the data. Now I think the problem is that LAYOUT=fs means that I should have a slightly different folder hierarchy now. The question is how best to fix this. I have things like this .Archives.2020 .Archives.2020/new .Archives.2020/tmp .Archives.2020/cur when I think I should have things like this Archives Archives/2021 Archives/2021/new Archives/2021/tmp Archives/2021/cur And, again, this is one-off, so a manual fix seems most appropriate. I'm quite tempted simply to shut down the dovecot instance for a minute at a quiet moment (mail retries...) and rename directories as indicated above. I only have to rename five directories. Having gotten myself in a bit of a muddle on this, I thought perhaps a reality check that I'm not about to make it worse would be appropriate. Many thanks. -- Jeff Abrahamson +33 6 24 40 01 57 +44 7920 594 255 https://www.p27.eu/jeff/ https://www.mobilitains.fr/

2 2

API command for ACL Delete
by Rhodri Jones 27 May '21

27 May '21

I asked previously for info about the API options for doveadm acl delete but I think my question was misunderstood. I want to know the command I would use (with curl for instance) that corresponds with: doveadm acl delete -u <targetmailbox> INBOX user=<targetuser> Using the python client for doveadm http API I can see the valid parameters but I don't seem to be able to get the correct syntax. (doveadm) aclDelete ? invalid parameter: ? valid parameters for aclDelete: - userFile (string) - allUsers (boolean) - mailbox (string) - user (string) - socketPath (string) - id (string) --

2 2

API command for ACL Delete
by Rhodri Jones 26 May '21

26 May '21

Can anyone tell me how to do the following using the API. doveadm acl get -u <targetmailbox> INBOX doveadm acl delete -u <targetmailbox> INBOX user=$user Are the ACL API options documented somewhere? Thanks --

2 1

Re: [EXT] Re: Dovecot Stats for Logwatch
by Plutocrat 26 May '21

26 May '21

On 26/05/2021 14.33, Aki Tuomi wrote: > I am not sure what is not working for you... > does `doveadm stats dump` work? a) Before any stats config it works without error, but gives no output. doveadm stats dump metric_name field count sum min max avg median stddev %95 b) If I then enable conf.d/95-stats.conf containing service stats { inet_listener http { port = 9900 } } metric client_connections { filter = event=client_connection_finished } metric auth_success { filter = (event=auth_request_finished AND success=yes) } metric mail_delivery { filter = event=mail_delivery_finished } ... it works but doesn't seem to collect any data, even if left for 24 hours doveadm stats dump metric_name field count sum min max avg median stddev %95 client_connections duration 0 0 0 0 0.00 0 0.00 0 auth_success duration 0 0 0 0 0.00 0 0.00 0 mail_delivery duration 0 0 0 0 0.00 0 0.00 0 c) If I then enable the bits of config that I'm informed will populate the data repository: # In 10-master.conf mail_plugins = stats # In 20-imap.conf protocol imap { mail_plugins = $mail_plugins quota imap_quota } # In 20-pop.conf protocol pop3 { mail_plugins = $mail_plugins quota } ... it then complains doveadm stats dump Fatal: Plugin 'stats' not found from directory /usr/lib/dovecot/modules d) I just changed the in in 10-master-conf to reference old-stats instead of stats, based on my new knowledge and it doesn't complain about the missing module any more. But I'm still not collecting data after 30 mins. doveadm stats dump metric_name field count sum min max avg median stddev %95 client_connections duration 0 0 0 0 0.00 0 0.00 0 auth_success duration 0 0 0 0 0.00 0 0.00 0 mail_delivery duration 0 0 0 0 0.00 0 0.00 0 I can do wget http://localhost:9900/metrics and I just get a file that says VERSION stats-reader-server 2 0 At this point I'm thinking I'll just write a bash script to parse the logs, but thought I'd see it through as it might help other intrepid dovecot users. P.

2 3

Problem with per-user \Seen flag on public folder
by Bartek Szady 26 May '21

26 May '21

Hello I have noticed that when per-user \Seen flag is configured dovecot do not respond properly to 'store' command. eg.: =============== 42 uid store 6 +Flags (\Seen) 42 OK Store completed (0.001 + 0.000 secs). 43 IDLE + idling DONE 43 OK Idle completed (3.204 + 3.203 + 3.203 secs). =============== Thunderbird is confused by this and read emails turns into unread after a while. When global flag is stored dovecot responds as it should, I think: =============== 32 uid store 3 -Flags (\Flagged) * 2 FETCH (UID 3 FLAGS ()) 32 OK Store completed (0.002 + 0.000 + 0.001 secs). 33 IDLE + idling DONE 33 OK Idle completed (5.362 + 5.362 + 5.361 secs). =============== When per-user \Seen flag is not configured: =============== 25 uid store 6 +Flags (\Seen) * 4 FETCH (UID 6 FLAGS (\Seen)) 25 OK Store completed (0.002 + 0.000 + 0.001 secs). 26 IDLE + idling * OK Still here DONE 26 OK Idle completed (65.076 + 65.076 + 65.076 secs). =============== # doveconf -n # 2.3.14 (cee3cbc0d): dovecot-int.conf # OS: Linux 5.1.16 x86_64 # Hostname: #hidden auth_mechanisms = plain login base_dir = /var/run/dovecot-int default_internal_group = dovecot1 default_internal_user = dovecot1 default_login_user = dovenull1 disable_plaintext_auth = no login_log_format = int %$: %s mail_debug = yes mail_location = maildir:~/Mail/Maildir mail_log_prefix = "int-%s(%u)<%{pid}><%{session}>: " namespace { inbox = yes location = prefix = separator = / type = private } passdb { args = scheme=MD5-CRYPT /etc/dovecot/passwd-int driver = passwd-file } passdb { args = scheme=MD5-CRYPT /etc/dovecot/virtual-int driver = passwd-file } passdb { driver = pam } plugin { acl = vfile } protocols = pop3 imap service auth { user = root } service imap-login { group = dovenull1 inet_listener imap { address = <ips> } user = dovecot1 } service pop3-login { group = dovenull1 inet_listener pop3 { address = <ips> } } service stats { unix_listener stats-writer { mode = 0660 user = pubmail } } ssl_cert = </var/lib/openssl/certs/imap-int.crt ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { args = /etc/dovecot/virtual-int driver = passwd-file } userdb { driver = passwd } protocol imap { mail_plugins = acl imap_acl namespace { location = maildir:/srv/mail/public:LAYOUT=fs:INDEXPVT=~/Mail/public prefix = publiczne/ separator = / subscriptions = no type = public } ssl = yes } Bartek

2 1

What am I doing wrong?
by Ron Garret 26 May '21

26 May '21

I’m trying to run an imapsieve script when a user sends a message (this is part of a spam filter and I want to use outgoing messages to train the filter on good content). This is my config: plugin { sieve_plugins = sieve_imapsieve sieve_extprograms sieve = file:/var/mail/sieve/incoming.sieve # From elsewhere to Junk imapsieve_mailbox1_name = Junk imapsieve_mailbox1_causes = COPY imapsieve_mailbox1_before = file:/var/mail/sieve/spam.sieve # From Junk to elsewhere imapsieve_mailbox2_name = * imapsieve_mailbox2_from = Junk imapsieve_mailbox2_causes = COPY imapsieve_mailbox2_before = file:/var/mail/sieve/ham.sieve # Sent imapsieve_mailbox3_name = 'Sent Messages' imapsieve_mailbox3_causes = APPEND imapsieve_mailbox3_before = file:/var/mail/sieve/sent.sieve sieve_pipe_bin_dir = /var/mail/sieve sieve_global_extensions = +vnd.dovecot.pipe +vnd.dovecot.environment } The first two scripts (for training spam and ham respectively) both work. Once upon a time I had the third one working as well, but apparently I changed something that made it break and I have no idea what that could be. (Yes, I need to get my code into revision control. I’ve already beaten myself up over that more than once.) The problem appears to be in the config, not the sieve script, because the script is never compiled into a .svbin while the other scripts in the same directory are compiled. But just for the record, this is the sieve script: > ➔ cat /var/mail/sieve/sent.sieve > require ["vnd.dovecot.pipe", "copy", "imapsieve", "environment", "variables"]; > > if environment :matches "imap.user" "*" { > set "username" "${1}"; > } > > pipe :copy "train.py" [ "sent", "${username}" ]; Does anyone here see the problem that I’m missing? Thanks, rg

1 1

sqlite + IMAP Authentication issues - user unknown
by Scott Edwards 26 May '21

26 May '21

Hello, I'm not on the maillist, please reply all. It's been a few years since I've setup a mail server (I feel like a noob!). The following syslog message is isolating the auth issues. I have sqlite, and want to keep it this way. I don't see more than a few mailboxes to setup until sometime later, but if it does grow, I'll stand up PostgreSQL. FQDN is 'localcar.repair'. May 24 21:01:45 localcar dovecot: auth: Debug: client in: AUTH#0116#011PLAIN#011service=imap#011secured=tls#011session=Rb8dshnD/Gwv2Ixo#011lip=45.33.2.221#011rip=47.216.140.104#011lport=993#011rport=27900#011local_name=localcar.repair#011ssl_cipher=TLS_AES_128_GCM_SHA256#011ssl_cipher_bits=128#011ssl_pfs=KxANY#011ssl_protocol=TLSv1.3#011resp=<hidden> May 24 21:01:49 localcar dovecot: auth-worker(20614): Debug: sql(webmaster-foo(a)localcar.repair,47.216.140.104,<Rb8dshnD/Gwv2Ixo>): query: SELECT password, userid as user FROM users WHERE userid = 'webmaster-foo' AND domain = 'localcar.repair' May 24 21:01:49 localcar dovecot: auth-worker(20614): sql(webmaster-foo(a)localcar.repair,47.216.140.104,<Rb8dshnD/Gwv2Ixo>): unknown user (given password: topsecret) May 24 21:01:51 localcar dovecot: auth: Debug: client passdb out: FAIL#0116#011user=webmaster-l5buyjuxao8@localcar.repair#011original_user=webmaster-foo@localcar.repair May 24 21:01:51 localcar dovecot: imap-login: Debug: Ignoring unknown passdb extra field: original_user root@localcar:/etc/dovecot# sqlite3 users SQLite version 3.27.2 2019-02-25 16:06:06 Enter ".help" for usage hints. sqlite> .schema CREATE TABLE users ( userid VARCHAR(128) NOT NULL, domain VARCHAR(128) NOT NULL, password VARCHAR(64) NOT NULL, home VARCHAR(255) NOT NULL, uid INTEGER NOT NULL, gid INTEGER NOT NULL ); sqlite> select * from users; webmaster-foo|localcar.repair|topsecret|/tmp|1000|1000 Thunderbird naturally says "Login to server localcar.repair with username webmaster-foo(a)localcar.repair failed. [ ok ] Restarting dovecot (via systemctl): dovecot.service. root@localcar:/etc/dovecot# dovecot -n # 2.3.4.1 (f79e8e7e4): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.4 () # OS: Linux 4.19.0-16-amd64 x86_64 Debian 10.9 # Hostname: localcar.repair auth_debug = yes auth_verbose = yes auth_verbose_passwords = yes mail_location = mbox:~/mail:INBOX=/var/mail/%u mail_privileged_group = mail namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } protocols = " imap lmtp" ssl_cert = </etc/dovecot/private/dovecot.pem ssl_client_ca_dir = /etc/ssl/certs ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } Thank you, Scott

2 2

Help with "doveadm" - Socket ?
by White, Daniel E. (GSFC-770.0)[NICS] 25 May '21

25 May '21

doveadm [-f formatter] mailbox status [-A|-u user] [-S socket_path] [-t] fields mailbox ... Where do I find this "socket_path", please ? I am trying to untangle a very old CentOS 6 instance. Thanks in advance.

4 7