October 2022 - dovecot

how to configure imapsieve to be used per user
by Marc 29 Oct '22

29 Oct '22

I only see configurations that are active for all users, how to configure this in the user sieve rules. I only need this for specific users.

7 11

oauth2 + postgres = Panic: file http-client.c: line 646 (http_client_context_close)
by Sebastiano Degan 27 Oct '22

27 Oct '22

I could to reply to the original thread: https://www.mail-archive.com/dovecot@dovecot.org/msg85204.html But I managed to get a stack trace of the error: root@mail:~ # lldb /usr/local/libexec/dovecot/auth (lldb) target create "/usr/local/libexec/dovecot/auth" Current executable set to '/usr/local/libexec/dovecot/auth' (x86_64). (lldb) run Process 54354 launched: '/usr/local/libexec/dovecot/auth' (x86_64) Error: stats: open(old-stats-user) failed: No such file or directory Panic: file http-client.c: line 646 (http_client_context_close): assertion failed: (cctx->clients_list == NULL) Process 54354 stopped * thread #1, name = 'auth', stop reason = signal SIGABRT frame #0: 0x000000080159f33a libc.so.7`__sys_thr_kill + 10 libc.so.7`__sys_thr_kill: -> 0x80159f33a <+10>: jb 0x80159d498 0x80159f340 <+16>: retq 0x80159f341: int3 0x80159f342: int3 (lldb) bt all * thread #1, name = 'auth', stop reason = signal SIGABRT * frame #0: 0x000000080159f33a libc.so.7`__sys_thr_kill + 10 frame #1: 0x0000000801517c74 libc.so.7`__raise + 52 frame #2: 0x00000008015c9109 libc.so.7`abort + 73 frame #3: 0x00000008012e606b libdovecot.so.0`default_fatal_finish(type=LOG_TYPE_PANIC, status=0) at failures.c:465:3 frame #4: 0x00000008012e3f7c libdovecot.so.0`fatal_handler_real(ctx=0x00007fffffffe610, format="file %s: line %d (%s): assertion failed: (%s)", args=0x00007fffffffe5f0) at failures.c:477:2 frame #5: 0x00000008012e3f14 libdovecot.so.0`default_fatal_handler(ctx=0x00007fffffffe610, format="file %s: line %d (%s): assertion failed: (%s)", args=0x00007fffffffe5f0) at failures.c:485:2 frame #6: 0x00000008012e4253 libdovecot.so.0`i_panic(format="file %s: line %d (%s): assertion failed: (%s)") at failures.c:530:2 frame #7: 0x000000080124f2ed libdovecot.so.0`http_client_context_close(cctx=0x000000080205c048) at http-client.c:646:2 frame #8: 0x000000080124ef22 libdovecot.so.0`http_client_global_context_ioloop_switched(prev_ioloop=0x0000000802030640) at http-client.c:710:3 frame #9: 0x00000008013102e4 libdovecot.so.0`io_loop_set_current(ioloop=0x0000000000000000) at ioloop.c:982:4 frame #10: 0x00000000010aa0be auth`driver_pgsql_set_state(db=0x0000000802092200, state=SQL_DB_STATE_IDLE) at driver-pgsql.c:103:3 frame #11: 0x00000000010a9ff0 auth`connect_callback(db=0x0000000802092200) at driver-pgsql.c:206:3 frame #12: 0x000000080130f3b2 libdovecot.so.0`io_loop_call_io(io=0x00000008020105c0) at ioloop.c:737:2 frame #13: 0x0000000801313e0b libdovecot.so.0`io_loop_handler_run_internal(ioloop=0x0000000802030640) at ioloop-kqueue.c:164:4 frame #14: 0x000000080130fa15 libdovecot.so.0`io_loop_handler_run(ioloop=0x0000000802030640) at ioloop.c:789:2 frame #15: 0x000000080130f8fa libdovecot.so.0`io_loop_run(ioloop=0x0000000802030640) at ioloop.c:762:3 frame #16: 0x00000000010a7eef auth`driver_pgsql_wait(_db=0x0000000802092200) at driver-pgsql.c:1279:3 frame #17: 0x00000000010a4c59 auth`sql_wait(db=0x0000000802092200) at sql-api.c:820:3 frame #18: 0x00000000010a7fc0 auth`driver_pgsql_get_flags(db=0x0000000802092200) at driver-pgsql.c:306:3 frame #19: 0x00000000010a2fa9 auth`sql_get_flags(db=0x0000000802092200) at sql-api.c:171:10 frame #20: 0x00000000010a585e auth`driver_sqlpool_get_flags(_db=0x0000000802092000) at driver-sqlpool.c:450:9 frame #21: 0x00000000010a2fa9 auth`sql_get_flags(db=0x0000000802092000) at sql-api.c:171:10 frame #22: 0x000000000108c675 auth`passdb_sql_init(_module=0x0000000802041ca8) at passdb-sql.c:281:10 frame #23: 0x000000000107d577 auth`passdb_init(passdb=0x0000000802041ca8) at passdb.c:247:3 frame #24: 0x0000000001052a89 auth`auth_passdb_init(passdb=0x0000000802041ba8) at auth.c:308:2 frame #25: 0x0000000001051dbc auth`auth_init(auth=0x0000000802041b70) at auth.c:322:3 frame #26: 0x0000000001051d21 auth`auths_init at auth.c:427:3 frame #27: 0x0000000001050610 auth`main_init at main.c:242:2 frame #28: 0x00000000010503ad auth`main(argc=1, argv=0x00007fffffffeaf8) at main.c:391:2 frame #29: 0x000000000104ff7d auth`_start(ap=<unavailable>, cleanup=<unavailable>) at crt1_c.c:75:7

1 0

Mailing list IMAP archive.
by dovecot＠ptld.com 27 Oct '22

27 Oct '22

I am trying to use the IMAP mailing list archive described on https://www.dovecot.org/mailing-lists/ Is this feature still functioning? Using Thunderbird i get an error message that the connection was refused. I don't know if Thunderbird isn't functioning properly (with handling no password) or if the service is down. My end goal is i want to search the archive for solutions before asking the list. Is there a browser based option to search the archives? I didn't see a search option on https://dovecot.org/pipermail/dovecot/

3 3

Re: The end of Dovecot Director?
by William Edwards 27 Oct '22

27 Oct '22

> Op 27 okt. 2022 om 04:25 heeft Timo Sirainen <timo(a)sirainen.com> het volgende geschreven: > > Director never worked especially well, and for most use cases it's just unnecessarily complex. I think usually it could be replaced with: > > * Database (sql/ldap/whatever) containing user -> backend table. > * Configure Dovecot proxy to use this database as passdb. > * For HA change dovemon to update the database if backend is down to move users elsewhere > * When backend comes up, move users into it. Set delay_until extra field for user in passdb to 5 seconds into future and kick the user in its old backend (e.g. via doveadm HTTP API). > > All this can be done with existing Dovecot. Should be much easier to build a project doing this than forking director. This is my train of thought as well. I believe the following would suffice for most setups. A database with: - Current vhost count per backend server. Alternatively, count the temporary user mappings. - Backend servers. - Temporary user mappings between user - backend server. This database is accessible by all Dovecot proxies in case there’s multiple. Steps when receiving a login: - Check if a temporary user mapping exists. - If so, proxy to the backend server in the temporary mapping. (To do: clean up mappings.) - If not, pick the backend server with the lowest vhost count, create a temporary mapping, then increase the vhost count of the chosen backend server. A monitoring service up/downs backend servers. E.g. by checking the port that we proxy to for each backend server. When a backend server is set to down, kick the user to force a reconnection. (Is that how Director ‘moves’ users?)

2 2

Catch all for Metadata storage in SQL database
by Steffen Kaiser 27 Oct '22

27 Oct '22

Hi, the https://doc.dovecot.org/configuration_manual/imap_metadata/ sample uses mail_attribute_dict = file:%h/Maildir/dovecot-attributes which stores all keys=value pairs in the file. http://dovecot.2317879.n4.nabble.com/Dovecot-v2-3-9-3-HTTP-API-Endpoint-for… uses a SQL dict, however very specific ones. How can I use a SQL dict to store _all_ keys, as with a file based storage? I cannot find a documentation for "pattern" specification, that works as "catch all", in order to store anything not catched by patterns into the database. https://wiki.dovecot.org/Dictionary does not give any hint (in my eyes). -- Steffen Kaiser

3 4

Dynamically set LDAP user namespace using two attributes
by Thomas Leuxner 26 Oct '22

26 Oct '22

Hi, I’m looking for a way to use two LDAP attributes to create a user-specific namespace to be expunged e.g. mailExpungeTrash=namespace/inbox/mailbox/%{ldap:mailTrashMailbox}/autoexpunge I can create the namespace fine returning the full string to be expunged: mailExpungeTrash=namespace/inbox/mailbox/Deleted\_Messages/autoexpunge However I want to alter the namespace using a second LDAP attribute like: mailExpungeTrash=namespace/inbox/mailbox/%{ldap:mailTrashMailbox}/autoexpunge Regards Thomas

1 0

Re: ot: how to t/s TBird problems ?
by Joseph Tam 26 Oct '22

26 Oct '22

Voytek Eymont) wrote: > yesterday it was > --------------- > I'm still experiencing a 40 second delay to retrieve emails for > xxx If *this* is the problem you saw (and not the 2 hour delay mentioned further in the thread), you can get a hint where the problem lies if you see a 40s gap in the session logs: it will tell you who was doing what when the pause happened (e.g. during authentication? During LIST fetch? During message fetch?) For example, if dovecot was busy mulching through a large INBOX rebuilding indices, I can see how it can chew up 40s under some circumstances. Joseph Tam <jtam.home(a)gmail.com>

2 1

how to clean virtual users correctly
by Henry R 26 Oct '22

26 Oct '22

Hello I removed the user in static userdb file, and deleted /var/mail/vhosts/$domain/$user dir. when I recreated the user, the system dirs (sent, draft etc) disappeared. Anything wrong here? Thank you. -- Henry R https://openmbox.net/

2 1

Re: ot: how to t/s TBird problems ?
by Joseph Tam 23 Oct '22

23 Oct '22

Voytek Eymont writes: > I've enabled logging as per your suggestion: > > -rw------- 1 vmail vmail 127 Oct 16 21:38 20221016-213738.25640.1.in > -rw------- 1 vmail vmail 8546603 Oct 16 21:38 20221016-213738.25640.1.out > -rw------- 1 vmail vmail 96 Oct 16 21:58 20221016-215757.26075.1.in > -rw------- 1 vmail vmail 8343463 Oct 16 21:58 20221016-215757.26075.1.out > > # cat 20221016-213738.25640.1.in > 1665916659.491025 STAT > 1665916659.550829 LIST > 1665916676.430794 UIDL > 1665916693.761281 RETR 114437 > 1665916694.440965 QUIT > # cat 20221016-215757.26075.1.in > 1665917878.786953 STAT > 1665917878.863136 LIST > 1665917905.610805 UIDL > 1665917924.491198 QUIT > # > > what should I look in the .out file ? > > some of the file is like: > .... > 1665916661.234807 114436 70097 > 1665916661.234814 114437 154498 > 1665916661.234821 . > 1665916676.430870 +OK > 1665916676.981415 1 000024b95283283a > 1665916676.981459 2 000024ba5283283a > .... > > 1665916679.434297 114436 00033fcf5283283a > 1665916679.434327 114437 00033fd05283283a > 1665916679.434349 . > 1665916694.048139 +OK 154498 octets > 1665916694.048199 Return-Path: <buyer-notice14.g(a)mail.aliexpress.com> > .... I haven't seen anyone else replying, but there doesn't seem anything anomalous with the output. The session commands-repliesd is is more or less what I expect, although to make sense of this, you'll have to splice the input and output files together using timestamps to see the sequential flow of data. I forget what the symptoms you originally reported, but theoretically, you could simulate either client or server by feeding in the above data and see how the other end behaves. If dovecot is serving out the correct data, then TB is somehow misinterpreting it. > on an uneducated guess, the mailbox is just 'too large' ? > POP has difficulty handling so many files ? Typically, if some resource limit is hit, one side or the other will create a log or notification. Your INBOX is large, but not outrageous. You can test it directly by creating smaller subsets of the INBOX messages and see if the problem goes away. Joseph Tam <jtam.home(a)gmail.com>

5 4

Office 365 SSL issue
by Ervin Hegedüs 23 Oct '22

23 Oct '22

Hi there, I have a bit old Dovecot instance (Ubuntu 14.04 - there is no chance to upgrade it), with these versions of packages: * Dovecot: 2.2.9 * OpenSSL: 1.0.1f Few days ago a client noticed me, that he can't reach his mails through his Office 365. He uses POP3S. I tried to set up a same client for this Dovecot server, but when I configured the POP3 protocoll, after the settings check Office says: Your server does not support the connection encryption type you have specified. Try changing the encryption method. Contact your mail server ... While the client was trying, I see these lines in the log: Oct 21 16:12:18 mail dovecot: pop3-login: Debug: SSL: where=0x10, ret=1: before/accept initialization [192.168.8.133] Oct 21 16:12:18 mail dovecot: pop3-login: Debug: SSL: where=0x2001, ret=1: before/accept initialization [192.168.8.133] Oct 21 16:12:18 mail dovecot: pop3-login: Debug: SSL: where=0x2001, ret=1: SSLv3 read client hello A [192.168.8.133] Oct 21 16:12:18 mail dovecot: pop3-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write server hello A [192.168.8.133] Oct 21 16:12:18 mail dovecot: pop3-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write certificate A [192.168.8.133] Oct 21 16:12:18 mail dovecot: pop3-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write key exchange A [192.168.8.133] Oct 21 16:12:18 mail dovecot: pop3-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write server done A [192.168.8.133] Oct 21 16:12:18 mail dovecot: pop3-login: Debug: SSL: where=0x2001, ret=1: SSLv3 flush data [192.168.8.133] Oct 21 16:12:18 mail dovecot: pop3-login: Debug: SSL: where=0x2002, ret=-1: SSLv3 read client certificate A [192.168.8.133] Oct 21 16:12:18 mail dovecot: pop3-login: Debug: SSL: where=0x2002, ret=-1: SSLv3 read client certificate A [192.168.8.133] Oct 21 16:12:18 mail dovecot: pop3-login: Warning: SSL failed: where=0x2002: SSLv3 read client certificate A [192.168.8.133] Oct 21 16:12:18 mail dovecot: pop3-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=192.168.8.133, lip=192.168.8.21, TLS handshaking: Disconnected, session=<9sWMB4zr+ADAqAiF> Which is weird, because I disabled SSLv3. Here is the (relevant) config: ssl_cert = </etc/dovecot/dovecot.crt ssl_key = </etc/dovecot/dovecot.key ssl_dh_parameters_length = 2048 ssl_protocols = !SSLv2 !SSLv3 ssl_cipher_list = ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA verbose_ssl = yes When I check the supported encryption type with nmap, I get this: $ nmap --script ssl-enum-ciphers -p 995 192.168.8.21 Starting Nmap 7.80 ( https://nmap.org ) at 2022-10-22 10:20 CEST Nmap scan report for 192.168.8.21 Host is up (0.021s latency). PORT STATE SERVICE 995/tcp open pop3s | ssl-enum-ciphers: | TLSv1.0: | ciphers: | TLS_DHE_RSA_WITH_AES_128_CBC_SHA (dh 2048) - A | ... | TLSv1.1: | ciphers: | TLS_DHE_RSA_WITH_AES_128_CBC_SHA (dh 2048) - A | ... | TLSv1.2: | ciphers: | TLS_DHE_RSA_WITH_AES_128_CBC_SHA (dh 2048) - A | ,,, |_ least strength: C When I check the traffic with tcpdump, I see that client uses TLSv1.2: https://www.dropbox.com/s/k8wqzg5xzki5p23/pop3_traffic.png Only the one client who reported the problem, and my test client can't reach the server - other (about) 400 users can (but I don't know with what kind of types of clients - most use Thunderbird). What can I do? How can I fix this problem? As I wrote, this problem has came few days ago suddenly... Thanks, a.

4 5