January 2022 - dovecot

Sync via ssh fails when ssl is active
by Johan 31 Jan '22

31 Jan '22

I have computers at two different locations and one computer running dovecot at each place. I sync my emails between these two servers using ssh and I haven't had any problems with this lately until I upgraded dovecot recently. I now get the following error at location "alfa" when trying to sync with dovecot at location "delta" Jan 20 16:13:09 doveadm: Error: doveconf: Fatal: Error in configuration file /etc/dovecot/conf.d/10-ssl.conf line 16: ssl_cert: Can't open file /etc/letsencrypt/live/delta.oxyl.net/fullchain.pem: Permission denied Jan 20 16:13:09 dsync-local(johan(a)oxyl.net)<FWBVNQN86WH52iQA1AGq6A>: Error: read(vmail(a)192.168.119.12) failed: EOF (version not received) Jan 20 16:13:09 dsync-local(johan(a)oxyl.net)<FWBVNQN86WH52iQA1AGq6A>: Error: Remote command returned error 89: ssh -q -p 22 -o StrictHostKeyChecking=no -i /datastorage/epost/vmail/.ssh/id_ecdsa -lvmail 192.168.119.12 doveadm dsync-server -ujohan(a)oxyl.net Trying to sync from "delta" i get the same error but the domain is changed in the error-message to 'alfa.oxyl.net' I can read mail at both locations using STARTTLS. There is no error in dovecot.log when I restart the service. If I disable ssl and comment out ssl_cert/ssl_key in 10-ssl.conf I have no trouble performing sync between servers. If I run the ssh-command in the error-message as user vmail I get the same ssl-error as above. Any ideas how to solve this? /Johan Pålsson

4 6

Dsync replication - delayed replication (Sync lock)
by Daniel Botting 31 Jan '22

31 Jan '22

Hi, *Our setup:* Two Debian 10 machines that are setup to replicate mail between them, we have round robin DNS setup so a user can connect to either server. *What should happen:* Mail is delivered to either server and replicated across straight away to their mailbox on the other server so it does not matter which one they are connected to they will receive it fairly soon after delivery. *What actually happens:* In some instances the user will experience a delayed receipt of messages if they are not connected to the server that the message is initially delivered to, sometimes the delay is 5/10 minutes, we had a recent support ticket submitted where it was over an hour. Error message seen in mail.err: Sep 1 10:16:15 <host name> dovecot: dsync-local(<username>)<WELSGEERTl8FEAAAZJ7A9A>: Error: Couldn't lock /path/to/mailbox/.dovecot-sync.lock: fcntl(/path/to/mailbox/.dovecot-sync.lock, write-lock, F_SETLKW) locking failed: Timed out after 30 seconds (WRITE lock held by pid 3697) Process 3697 is dovecot/doveadm-server. *Doveconf -n output:* # 2.3.10.1 (a3d0e1171): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.10 (67bf5bd7) # OS: Linux 4.19.0-10-amd64 x86_64 Debian 10.5 # Hostname: <server hostname> auth_verbose = yes default_vsz_limit = 0 doveadm_password = # hidden, use -P to show it first_valid_gid = 8 first_valid_uid = 8 last_valid_gid = 8 last_valid_uid = 8 lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes mail_gid = 8 mail_location = maildir:~/Maildir mail_plugins = " notify replication" mail_uid = 8 managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex im ap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext editheader imapfla gs namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } plugin { mail_replica = tcps:<server being replicated to>:<port being used> sieve = ~/.dovecot.sieve sieve_dir = ~/sieve sieve_extensions = +editheader +imapflags } postmaster_address = postmaster@<domain address> protocols = " imap sieve pop3" replication_max_conns = 12 service aggregator { fifo_listener replication-notify-fifo { user = mail } unix_listener replication-notify { user = mail } } service auth { unix_listener /var/run/dovecot-exim-bridge { mode = 0660 user = Debian-exim } } service doveadm { inet_listener { port = <port being used for replication> ssl = yes } } service imap-login { inet_listener imap { port = 143 } } inet_listener imaps { port = 993 ssl = yes } process_limit = 512 process_min_avail = 4 service_count = 1 } service imap { process_limit = 1024 } service managesieve-login { inet_listener sieve { port = <sieve port> } process_min_avail = 1 service_count = 8 vsz_limit = 256 M } service managesieve { process_limit = 1024 } service replicator { process_min_avail = 1 unix_listener replicator-doveadm { mode = 0666 } } ssl = required ssl_cert = </path/to/ssl/cert/fullchain.pem ssl_cipher_list = ALL:!LOW:!SSLv2:!EXP:!aNULL ssl_client_ca_dir = /etc/ssl/certs ssl_key = # hidden, use -P to show it ssl_min_protocol = TLSv1.2 userdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap override_fields = home=/var/mail/%u uid=mail gid=mail } protocol lda { mail_plugins = " notify replication sieve" } protocol imap { mail_max_userip_connections = 32 mail_plugins = " notify replication" } protocol sieve { mail_max_userip_connections = 10 managesieve_logout_format = bytes=%i/%o managesieve_max_line_length = 65536 } Kind regards Daniel

3 3

NTLM fails: dovecot: auth: Fatal: Unknown authentication mechanism 'NTLM'
by David Koski 31 Jan '22

31 Jan '22

After upgrading Debian to 11 I found Dovecot at version 2.3.13 (89f716dc2). Now auth method NTLM fails and is not even listed: # doveadm pw -l SHA1 SSHA512 SCRAM-SHA-256 BLF-CRYPT PLAIN HMAC-MD5 OTP SHA512 SHA DES-CRYPT CRYPT SSHA MD5-CRYPT PLAIN-MD4 PLAIN-MD5 SCRAM-SHA-1 SHA512-CRYPT CLEAR CLEARTEXT ARGON2I ARGON2ID SSHA256 MD5 PBKDF2 SHA256 CRAM-MD5 PLAIN-TRUNC SHA256-CRYPT SMD5 DIGEST-MD5 LDAP-MD5 /var/log/dovecot.log Jan 22 16:20:32 auth: Fatal: Unknown authentication mechanism 'NTLM' Jan 22 16:20:32 master: Error: service(auth): command startup failed, throttling for 2.000 secs Jan 22 16:20:34 auth: Fatal: Unknown authentication mechanism 'NTLM' Jan 22 16:20:34 master: Error: service(auth): command startup failed, throttling for 4.000 secs Jan 22 16:20:38 auth: Fatal: Unknown authentication mechanism 'NTLM' Jan 22 16:20:38 master: Error: service(auth): command startup failed, throttling for 8.000 secs Jan 22 16:20:46 auth: Fatal: Unknown authentication mechanism 'NTLM' Jan 22 16:20:46 master: Error: service(auth): command startup failed, throttling for 16.000 secs # doveconf -n # 2.3.13 (89f716dc2): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.13 (cdd19fe3) # OS: Linux 5.10.0-11-amd64 x86_64 Debian 11.2 # Hostname: imail.khmfdbyekekelj1rmytwnfh1bc.dx.internal.cloudapp.net auth_mechanisms = plain login ntlm debug_log_path = /var/log/dovecot-debug.log info_log_path = /var/log/dovecot-info.log log_path = /var/log/dovecot.log maildir_stat_dirs = yes managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext namespace compat { alias_for = hidden = yes inbox = no list = no location = prefix = INBOX. separator = . } namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = separator = . } passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } plugin { mail_plugins = " quota trash sieve" sieve = file:~/sieve;active=~/.dovecot.sieve } protocols = " imap sieve" service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0666 user = postfix } unix_listener auth-client { mode = 0660 } } service stats { unix_listener stats-reader { group = vmail mode = 0660 user = vmail } unix_listener stats-writer { group = vmail mode = 0660 user = vmail } } ssl_cert = </etc/letsencrypt/live/imail1.sutinen.com/fullchain.pem ssl_client_ca_dir = /etc/ssl/certs ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } protocol lmtp { mail_plugins = " quota trash sieve" postmaster_address = admin-kosmosisland.com(a)kosmosisland.com } protocol lda { mail_plugins = " quota trash sieve" } Regards, David Koski

3 4

LMTP error on trying to find passwd-file for Postfix recipient validation
by Narcis Garcia 28 Jan '22

28 Jan '22

Hello everyone, I have following configurations (and more) at /etc/dovecot/local.conf in a "/VirtualUserFlatFilesPostfix/" setup : [partial file content begins] protocols = imap pop3 lmtp sieve mail_location = maildir:~/data:INBOX=~/data/.INBOX service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { user = vmail group = vmail mode = 0660 } } protocol lmtp { postmaster_address = postmaster(a)example.net mail_plugins = $mail_plugins sieve } userdb { driver = passwd-file args = username_format=%u /srv/vmail/domains.d/%d/users.d/%n/etc/passwd } passdb { driver = passwd-file args = username_format=%u /srv/vmail/domains.d/%d/users.d/%n/etc/shadow.%Ls } service auth { unix_listener /var/spool/postfix/private/auth { user = postfix group = postfix mode = 0660 } } [/partial file content ends] Everyting works (IMAP mail is stored, IMAP/POP3 mail is retrieved, incoming SMTP mail from Postfix is delivered, Outgoing SMTP senders are authenticated from Postfix~SASL) BUT: When incoming mail goes to a mailbox that does not exist, an error is logged by Dovecot, letter remains at Postfix queue, and no rejection message to sender (here host is /mail.example.net/): [partial]$ cat /var/log/mail.log 2022-01-28T08:52:00.851751+01:00 correo postfix/smtpd[1853]: CFDA63A174B: client=mail.example.com[1.2.3.4] 2022-01-28T08:52:00.872248+01:00 correo postfix/cleanup[1881]: CFDA63A174B: message-id=<83c79ee1-6e2e-4e15-307e-17cdc7e2b814(a)example.com> 2022-01-28T08:52:00.884100+01:00 correo postfix/qmgr[1529]: CFDA63A174B: from=<johndoe(a)example.com>, size=854, nrcpt=1 (queue active) 2022-01-28T08:52:00.884507+01:00 correo postfix/smtpd[1853]: disconnect from mail.example.com[1.2.3.4] ehlo=2 starttls=1 mail=1 rcpt=1 data=1 quit=1 commands=7 2022-01-28T08:52:00.969275+01:00 correo postfix/lmtp[1882]: CFDA63A174B: to=<wronguser(a)example.net>, relay=mail.example.net[private/dovecot-lmtp], delay=0.43, delays=0.35/0.02/0.02/0.05, dsn=4.3.0, status=deferred (host mail.example.net[private/dovecot-lmtp] said: 451 4.3.0 <wronguser(a)example.net> Temporary internal error (in reply to RCPT TO command)) [partial]$ cat /var/log/dovecot.log 2022-01-28 08:52:00 lmtp(1883): Info: Connect from local 2022-01-28 08:52:00 auth: Error: passwd-file(wronguser(a)example.net): stat(/srv/vmail/domains.d/example.net/users.d/wronguser/etc/passwd) failed: Address family not supported by protocol 2022-01-28 08:52:00 lmtp(wronguser(a)example.net)<1883><xbrsNqCg82FbBwAAzZSvjA>: Error: user wronguser(a)example.net: Auth USER lookup failed 2022-01-28 08:52:00 lmtp(1883): Error: Failed to lookup user wronguser(a)example.net: Internal error occurred. Refer to server log for more information. 2022-01-28 08:52:00 lmtp(1883): Info: Disconnect from local: Client has quit the connection (state=READY) Thank you for any help in debugging configuration or suggestion to enhance Postfix/Dovecot parameters. Postfix 3.4 Dovecot 2.3 -- Narcis Garcia __________ I'm using this dedicated address because personal addresses aren't masked enough at this mail public archive. Public archive administrator should fix this against automated addresses collectors.

2 2

Non-unique Message ID in mail messages
by Daniel Ryšlink 28 Jan '22

28 Jan '22

Hello! I apologize for bringing perhaps trivial/well-known matter, but I am interested in your opinion. RFC 5322 clearly states that mail messages SHOULD contain a Message ID identifier, but if the do contain it, it MUST be globally unique. Despite this requirement, I have encountered senders (namely Spamcop) that sends obviously different (albeit related) messages called "Alert" and "Summary" (they are always related to the same incident and have the same Message ID). This creates all sorts of problems when processing these mails, namely with users that have local forwards from one domain to another (our mailserver hosts multiple domains), because for example Dovecot refuses to forward the second message, flagging it as a duplicate. My question to you is - did you also encounter similar incorrect (according to RFC standards) problem, and if so, is there a way to persuade dovecot to perhaps determine the uniqueness of a message by other means than just checking the message ID (i.e. look at other identifiers, Subject, perhaps)? Because according to the log records, Spamcop does not seem to be the only offender. Thanks in advance for any reactions, and if I did something wrong by writing this message, I apologize again in advance. If required, I can provide samples of the Spamcop messages. -- --===============-- --== Best Regards! ==-- --===============-- Daniel Ryšlink Sysadmin @ Quantcom.cz Czech Republic

4 3

Re: dovecot Digest, Vol 225, Issue 71
by David Matthews 28 Jan '22

28 Jan '22

hi Christian >Did the password hash algorithm change between devuan 3 and 4? >You can check that in your /etc/shadow file. As I understand, devuan is pretty much debian without systemd? And that if you were prepared to do a fair bit of work you could start with debian installed, hack it about and end up with something like devuan? I doubt devuan has done anything to deviate from debian at this level and both machines were recently dist-upgraded. Dovecot needed no tinkering with at all on the debian machine. >The start of the password field should be the same something like $6$... > Yes it is on devuan 4. I no longer have anything with devuan 3 to check that, but it shouldn't have changed in a dist-upgrade? Interestingly, although it's the same user and password on both machines, I notice that the hashes in /etc/shadow are not identical after the commencing $6$. But then I don't know how these hashes are derived, so maybe that is not unexpected? -- David Matthews mail(a)dmatthews.org

2 1

Errors: Failed to map transaction log, Corrupted transaction log, imeout (180s) while waiting for lock for transaction log
by absolutely_free＠libero.it 28 Jan '22

28 Jan '22

Hi, no, it is a single mail server, no replication at all. Thank you > Hello > > We only saw such errors with replication between two machines, when new > emails where errornously deliverd to both of them or clients connected > to both simultaniously. > > Do you have such a setup? > Kind regards, > Christian Mack

1 0

doveadm backup : Warning: Deleting mailbox GUID= is missing locally
by Laura Smith 28 Jan '22

28 Jan '22

Hi, As per the docs (https://wiki.dovecot.org/Tools/Doveadm/Sync) I'm presently running doveadm backup multiple times with a view to eventual server migration. I am seeing messages such as this: Warning: Deleting mailbox 'Junk': UID=1826 GUID= is missing locally Is it anything to worry about ? If so, how should I be dealing with it. I also have a further question. It is not clear from the docs what the role of the "-R" flag is in relation to "doveadm backup" ? Surely by definition backup = remote -> local ? Thanks ! Laura

2 3

Question regarding delivery from Postfix via LMTP proxy
by Vlad Sedov 28 Jan '22

28 Jan '22

Hello, I'm using Postfix with Dovecot 2.3.13, and trying to get LMTP proxy to work for authentication and delivery in the following scenario: Incoming Mail -> Postfix (server A) -> LMTP to Dovecot (server A) -> LMTP to Dovecot (server B) I'm using MySQL for authentication. I've created a user on both server A and server B, test(a)domain.tld On server A, host parameter in password_query for test(a)domain.tld is set to server B's address, and proxy_maybe is enabled. Delivery and authentication to Server A works fine. Authentication and IMAP proxy to server B works fine as well. I can connect to IMAP on server A with credentials for test(a)domain.tld and access the maildir on server B. This works surprisingly well, and is about half the battle for me.. What I can't figure out, is how can I get Postfix to deliver mail using LMTP via server A to server B.. Currently, mail still gets delivered to the user's maildir on server A. Is this possible with Dovecot alone, or do I need to use another method to get messages to hop to server B via server A? Any help would be appreciated.. cheers, Vlad

1 0

Re: dovecot Digest, Vol 225, Issue 70
by David Matthews 27 Jan '22

27 Jan '22

hi Christian Same user and password on both machines, users with shell accounts; exactly the same; in fact I'm struggling to see anything different that might be relevant. On one machine dovecot just works on the other, it stopped working after a dist-upgrade. One machine (where it works) is a debian 11 VPS, the other is real PC hardware running devuan 4, but their dovecot is a debian package. I can't see why either of that should matter and dovecot also just worked on the PC with devuan 3. I've tried purging dovecot-core and dovecot-imapd and reinstalling to no effect. > > 1. Re: can't authenticate (Christian Mack) > > >---------------------------------------------------------------------- > >Message: 1 >Date: Thu, 27 Jan 2022 11:42:22 +0100 >From: Christian Mack >christian.mack(a)uni-konstanz.de> >To: dovecot(a)dovecot.org >Subject: Re: can't authenticate >Message-ID: >a2fbca25-75c7-4e19-a084-5e8d4d8cc645(a)uni-konstanz.de> >Content-Type: text/plain; charset="utf-8" > >Hello > >> passdb { >> driver = pam >> } > >Is user fred defined on your development machine? >Does the password match the one from the production machine? > > >Kind regards, >Christian Mack > >On 26.01.22 21:14, David Matthews wrote: >> My live mail exchanger and development machines have identical dovecot setups, yet I cannot login on the development machine:- >> >> dovecot --version >> 2.3.13 (89f716dc2) >> >>> telnet localhost 143 >> Trying 127.0.0.1... >> Connected to bulawayo. >> Escape character is '^]'. >> * OK [CAPABILITY IMAP4rev1 SASL-IR LOGIN-REFERRALS ID ENABLE IDLE LITERAL+ STARTTLS AUTH=PLAIN] Dovecot (Debian) ready. >> a login fred xxxxxxxxxxx >> a NO [UNAVAILABLE] Temporary authentication failure. [bulawayo:2022-01-26 20:02:14] >> >> same if I try openssl s_client to 993 >> >>> tail /var/log/mail.log >> Jan 26 20:03:28 bulawayo dovecot: imap-login: Disconnected (auth service reported temporary failure): user=>fred>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, secured, session=>1MRorYHWwOp/AAAB> >> >> doveconf -n >> # 2.3.13 (89f716dc2): /etc/dovecot/dovecot.conf >> # Pigeonhole version 0.5.13 (cdd19fe3) >> # OS: Linux 5.10.0-10-amd64 x86_64 Debian 11.1 >> # Hostname: bulawayo >> mail_location = mbox:~/mail:INBOX=/var/mail/%u >> mail_privileged_group = mail >> namespace inbox { >> inbox = yes >> location = >> mailbox Drafts { >> special_use = \Drafts >> } >> mailbox Junk { >> special_use = \Junk >> } >> mailbox Sent { >> special_use = \Sent >> } >> mailbox "Sent Messages" { >> special_use = \Sent >> } >> mailbox Trash { >> special_use = \Trash >> } >> prefix = >> } >> passdb { >> driver = pam >> } >> protocols = " imap" >> service imap-login { >> inet_listener imap { >> port = 143 >> } >> inet_listener imaps { >> port = 993 >> ssl = yes >> } >> } >> ssl_cert = >/etc/dovecot/private/dovecot.pem >> ssl_client_ca_dir = /etc/ssl/certs >> ssl_dh = # hidden, use -P to show it >> ssl_key = # hidden, use -P to show it >> userdb { >> driver = passwd >> } >> >> -- >> David Matthews >> mail(a)dmatthews.org >> > > >-- >Christian Mack >Universit?t Konstanz >Kommunikations-, Informations-, Medienzentrum (KIM) >Abteilung IT-Dienste Forschung und Lehre >78457 Konstanz >+49 7531 88-4416 > >

2 1