February 2022 - dovecot

v2.3.17 quota-dict related sql errors
by Pascal Volk 06 Feb '22

06 Feb '22

Hi there, I've updated Dovecot from v2.3.14 (cee3cbc0d) to v2.3.17 (e2aa53df5b). Right after the update, dovecot begun flooding the mail.log and PostgreSQL's log. My dict sql configuration: ,--[ .../dovecot/dovecot-dict-sql.conf.ext ]-- | map { | pattern = priv/quota/storage | table = userquota | username_field = uid | value_field = bytes | } | map { | pattern = priv/quota/messages | table = userquota | username_field = uid | value_field = messages | } `-- This worked for decades. Since the update dovecot is passing the user's email address, instead the user's UID to the query. And therefor I have lots of errors in the log files: see attached `mail.log' and `postgresql-14-main.log' excerpts. The `userquota' table looks like this: Table "public.userquota" Column | Type | Collation | Nullable | Default ----------+---------+-----------+----------+--------- uid | bigint | | not null | bytes | bigint | | not null | 0 messages | integer | | not null | 0 ... Foreign-key constraints: "fkey_userquota_uid_users" FOREIGN KEY (uid) REFERENCES users(uid) ON DELETE CASCADE (full database structure: https://bitbucket.org/pvo/vmm/src/vmm-0.7.0/pgsql/create_tables.pgsql) Regards, Pascal -- Ubuntu is an ancient African word meaning “I can’t install Debian.” -- unknown

3 4

Can't get it to work with conf.d files
by Ruben Safir 06 Feb '22

06 Feb '22

I am trying to set up dovecot to be a sasl auithenticator for postfix but it can't get it to function even on the most fundemental level /usr/bin/dovecot -a -F -c /etc/dovecot/dovecot.conf # 2.3.16 (7e2e900c1a): /etc/dovecot/dovecot.conf doveconf: Fatal: Error in configuration file /etc/dovecot/conf.d/15-mailboxes.conf line 48: Unknown setting: service { namespace { namespace and before this, when I tried to get 10-ssl to work it said the same thing - unknonw setting Somewhere it is messed up in the syntax of the config files and I don't know where or how to run it down in a debugger. Here is the config file mail2:[root]:/etc/dovecot# grep "^#" -v /etc/dovecot/dovecot.conf|grep -v "^$" protocols = pop3 submission base_dir = /var/run/dovecot/ dict { #quota = mysql:/etc/dovecot/dovecot-dict-sql.conf.ext } !include conf.d/*.conf !include_try local.conf mail2:[root]:/etc/dovecot# -- So many immigrant groups have swept through our town that Brooklyn, like Atlantis, reaches mythological proportions in the mind of the world - RI Safir 1998 http://www.mrbrklyn.com DRM is THEFT - We are the STAKEHOLDERS - RI Safir 2002 http://www.nylxs.com - Leadership Development in Free Software http://www.brooklyn-living.com Being so tracked is for FARM ANIMALS and extermination camps, but incompatible with living as a free human being. -RI Safir 2013

1 0

Can't get it to work with conf.d files
by Ruben Safir 06 Feb '22

06 Feb '22

I am trying to set up dovecot to be a sasl auithenticator for postfix but it can't get it to function even on the most fundemental level /usr/bin/dovecot -a -F -c /etc/dovecot/dovecot.conf # 2.3.16 (7e2e900c1a): /etc/dovecot/dovecot.conf doveconf: Fatal: Error in configuration file /etc/dovecot/conf.d/15-mailboxes.conf line 48: Unknown setting: service { namespace { namespace and before this, when I tried to get 10-ssl to work it said the same thing - unknonw setting Somewhere it is messed up in the syntax of the config files and I don't know where or how to run it down in a debugger. -- So many immigrant groups have swept through our town that Brooklyn, like Atlantis, reaches mythological proportions in the mind of the world - RI Safir 1998 http://www.mrbrklyn.com DRM is THEFT - We are the STAKEHOLDERS - RI Safir 2002 http://www.nylxs.com - Leadership Development in Free Software http://www.brooklyn-living.com Being so tracked is for FARM ANIMALS and extermination camps, but incompatible with living as a free human being. -RI Safir 2013

1 0

Received invalid SSL certificate: unable to get certificate CRL
by Laura Smith 06 Feb '22

06 Feb '22

I'm having a frustrating problem trying to use "doveadm sync" to pull mails off a server for migration purposes. # 2.3.17.1 (476cd46418): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.17.1 (a1a0b892) # OS: Linux 5.10.0-11-amd64 x86_64 Debian 11.2 I have tried both explicit "ssl_client_ca_dir = /etc/ssl/certs" and commenting it out (i.e. relying on OpenSSL default per the docs) I always get the same: Info: Received invalid SSL certificate: unable to get issuer certificate: /C=US/O=Internet Security Research Group/CN=ISRG Root X1 (check ssl_client_ca_* se ttings?) Received invalid SSL certificate: unable to get issuer certificate: /C=US/O=Internet Sec urity Research Group/CN=ISRG Root X1 (check ssl_client_ca_* settings?) - disconnecting openssl s_client -starttls imap -servername $name -connect $name:143 is happy though: --- Certificate chain 0 s:CN = <REDACTED> i:C = US, O = Let's Encrypt, CN = R3 1 s:C = US, O = Let's Encrypt, CN = R3 i:C = US, O = Internet Security Research Group, CN = ISRG Root X1 2 s:C = US, O = Internet Security Research Group, CN = ISRG Root X1 i:O = Digital Signature Trust Co., CN = DST Root CA X3 --- --- No client certificate CA names sent Peer signing digest: SHA256 Peer signature type: RSA-PSS Server Temp Key: X25519, 253 bits --- SSL handshake has read 4954 bytes and written 412 bytes Verification: OK --- New, TLSv1.3, Cipher is TLS_AES_256_GCM_SHA384 Server public key is 2048 bit Secure Renegotiation IS NOT supported Compression: NONE Expansion: NONE No ALPN negotiated Early data was not sent Verify return code: 0 (ok) ---

4 10

How to "activate" a mail directory?
by Peter Nabbefeld 06 Feb '22

06 Feb '22

Hello, as I need a mailbox locally only just for filtering, I've tried to manually create it (using Maildir as backend): 1. Created a folder in the appropriate location under /home/vmail with subfolders cur, new, tmp. 2. Set the same user:group as for the other folders (i.e. vmail:vmail). 3. Restarted Dovecot and Email-Client (Thunderbird). However, I cannot subscribe to the new folder. What am I missing here? Kind regards, Peter

2 2

Re: [EXT] AW: Re: Dovecot installation problem (libssl_iostream_openssl.so is not portable!)
by Aki Tuomi 04 Feb '22

04 Feb '22

I am not able to reproduce your issue, which makes it very hard to fix this.. Please keep responses on the list. Aki > On 04/02/2022 20:21 Dimitri <dimitri_emich(a)protonmail.com> wrote: > > > Hi Aki, > > yes, i even have reinstalled the whole OS, but still the same error. > > > Sent with ProtonMail Secure Email. > > ------- Original Message ------- > > Aki Tuomi <aki.tuomi(a)open-xchange.com> schrieb am Freitag, 4. Februar 2022 um 19:17: > > > On 04/02/2022 20:14 Dimitri dimitri_emich(a)protonmail.com wrote: > > > > No One? > > > > Nobody there who can help me? > > Did you ensure you cleaned up openssl 3.0 files before trying again? > > Aki

1 0

Dovecot installation problem (libssl_iostream_openssl.so is not portable!)
by Dimitri 04 Feb '22

04 Feb '22

No One? Nobody there who can help me?

2 1

Password Mismatch when connecting from Email Client
by Dr Francis Greaves 04 Feb '22

04 Feb '22

Dear All I have Postfix version 3.3.0, Dovecot Version 2.2.33.2 and PostfixAdmin version 3.3.10 using MySQL on a small device running Ubuntu VERSION="18.04.6 LTS (Bionic Beaver)" for my internal LAN Mail. I have a user mailto:admin@fsoft.nnet with a mailbox setup in PostfixAdmin with a password as 'Test75?' Everything is running fine, but I cannot get my Email Client Thunderbird to connect. I have setup the debugging to see that the correct password is being used, which it is, but I have this error: dovecot: auth-worker(26468): sql(mailto:admin@fsoft.nnet,10.6.10.10,<gB77wjLXGLsKBgoK>): Password mismatch (given password: Test75?) showing that dovecot disagrees!!! Why is this? Is it something to do with the permissions in PostfixAdmin? I did find https://serverfault.com/questions/696715/password-mismatch-in-dovecot-with-… where someone had the same problem. He just tried various passwords until he found one that worked!!!! I have not found any other post about this exact problem. Any help much appreciated. Regards Francis

7 12

Problem with chrooted user, manage-sieve plugin, lmtp and Thunderbird manage sieve extension: wrong symbolic link to active script
by Lev Serebryakov 04 Feb '22

04 Feb '22

I'm not sure, is it dovecot-managesieve plugin or Thunderbird extension. I have virtual users which are "chrooted" to their Maildirs, like this: user_query = SELECT '/usr/home/hosted/v-mail/%d/%n' AS chroot, \ '/' AS home, 'maildir:~/' AS mail, email.uid AS uid, email.gid AS gid FROM \ <snipped> It works perfectly. I'm using sieve and manage-sieve plugins for dovecot. `.dovecot.sieve` link is relative, like this: v-mail@onlyone:~/serebryakov.spb.ru/lev # ls -l .dovecot.sieve lrwxr-xr-x 1 root v-mail 17 Feb 4 18:19 .dovecot.sieve -> sieve/TOTAL.sieve It works. But when I deactivate/activate script via Manage sieve extension in Thunderbird link becomes absolute (with respect to chroot): v-mail@onlyone:~/serebryakov.spb.ru/lev # ls -l .dovecot.sieve lrwxr-xr-x 1 root v-mail 17 Feb 4 18:19 .dovecot.sieve -> /sieve/TOTAL.sieve and delivery agent (LMTP) start to complain: v-mail@onlyone:~/serebryakov.spb.ru/lev # grep .dovecot.sieve /var/log/dovecot.log Feb 04 18:18:42 lmtp(lev(a)serebryakov.spb.ru)<36054><iPQqEtJD/WHWjAAAlMIKZw>: Warning: sieve: file storage: Active sieve script symlink /usr/home/hosted/v-mail/serebryakov.spb.ru/lev/.dovecot.sieve is broken: Invalid/unknown path to storage (points to /sieve). I'm not sure, is it problem of manage-sieve plugin, lmtp sieve plugin or Thunderbird Sieve extension... -- // Black Lion AKA Lev Serebryakov

1 0

Feature request: use`openid_configuration_url` to guess OIDC endpoints and keys
by Éloi Rivard 04 Feb '22

04 Feb '22

Since version 2.3.16 dovecot has a openid_configuration_url [1] configuration parameter. Here is the documentation about this parameter: > Support for RFC 7628 OpenID Discovery (OIDC) can be achieved with > openid_configuration_url setting. Setting this causes Dovecot to report OIDC > configuration URL as openid-configuration element in error JSON. After reading the RFC I understand this brings some context to the error messages, but at first glance I would have expected more from this parameter. - Dovecot could read the userinfo_endpoint option [2] in the OIDC discovery endpoint to guess the IDP userinfo endpoint [3], and make the dovecot introspection_url parameter optional. - Dovecot could read the introspection_endpoint option [4] in the OIDC discovery endpoint to guess the IDP introspection endpoint [5], and make the dovecot tokeninfo_url parameter optional. RFC8414 is still a draft though, but there seems to be a convention about this parameter be called either token_introspection_endpoint or introspection_endpoint. Maybe both could be checked? - Dovecot could read the jwks_uri [4] option in the OIDC discovery endpoint to guess the IDP public keys, and make the local_validation_key_dict dovecot parameter optional. I would suggest to keep the values in introspection_url, tokeninfo_url and local_validation_key_dict if defined, but use the values found in the OIDC discovery endpoint by default. I think this would really help using OAUTH with dovecot. What do you think? [1] https://doc.dovecot.org/configuration_manual/authentication/oauth2/#openid-… [2] https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata [3] https://openid.net/specs/openid-connect-core-1_0.html#UserInfo [4] https://datatracker.ietf.org/doc/html/rfc8414#section-2 [5] https://datatracker.ietf.org/doc/html/rfc7662

1 0