March 2022 - dovecot - dovecot.org

bug report: lmtp fails on root-squashed NFS filesystem
by Anne Bennett 09 Oct '23

09 Oct '23

Hi, all. I'm trying to set up Postfix with dovecot LTMP delivery on a host where the user files (/var/spool/mail as well as home directories) are on NFS filesystems, which are exported root-squashed to the mail server. I definitely don't want to give the mail server root permissions on the user files. LMTP delivery fails with this logged message (e.g.): Nov 16 17:51:36 lust dovecot: lmtp(anne)<16830><mkkzEPg1lGG+QQAAs/mAJw>: msgid=<202111162229.1AGMTfAO024765(a)vindemiatrix.encs.concordia.ca>: save failed to INBOX: Read-only mbox I found this posting where someone else had a similar problem and traced it in some detail back in 2019: https://dovecot.org/list/dovecot/2019-February/114611.html but apparently no one answered the fellow. In order to check that this is indeed the same problem, I temporarily changed the INBOX definition to make it write into /var/tmp/ (on a local filesystem), and delivery worked. I then temporarily changed the INBOX definition to make it write into an NFS filesystem with root NOT squashed, and again it worked (after I chmodded the directory to 1777 to allow any user to create a file). I believe that the person who wrote the above posting is correct: at some point, file access is (incorrectly) checked as root instead of as the target user. This is a bit of a showstopper for me. Any plans to address this? I attach the output of "dovecot -n", fwiw, but I don't think that this is a configuration problem... Anne. -- Ms. Anne Bennett, Senior Sysadmin, ENCS, Concordia University, Montreal H3G 1M8 anne(a)encs.concordia.ca +1 514 848-2424 x2285

2 4

Warning sqlpool(mysql): Query failed
by Alessio Cecchi 27 Jun '23

27 Jun '23

Hi, with the last dovecot version (2.3.13) I see many of this warnings via "doveadm log errors": Feb 17 03:26:28 Warning: dict(31513): conn unix:dict (pid=31330,uid=95): dict(mysql)<email1(a)company1.com>: sqlpool(mysql): Query failed, retrying: MySQL server has gone away (idled for 679 secs) Feb 17 03:48:53 Warning: dict(31013): conn unix:dict (pid=31805,uid=95): dict(mysql)<email2(a)company2.com>: sqlpool(mysql): Query failed, retrying: MySQL server has gone away (idled for 685 secs) Feb 17 03:54:12 Warning: dict(32529): conn unix:dict (pid=3147,uid=95): dict(mysql)<email3(a)company3.com>: sqlpool(mysql): Query failed, retrying: MySQL server has gone away (idled for 670 secs) What do they mean? I thinks are related to inactivity timeout on mysql server (where I have a wait_timeout=600), but these warnings could be problems or can be fixed with some setting in dovecot? My dovecot configuration about dict: dict { acl = mysql:/etc/dovecot/dovecot-dict-sql.conf.ext expire = mysql:/etc/dovecot/dovecot-dict-sql.conf.ext sieve = mysql:/etc/dovecot/dovecot-dict-sieve-sql.conf.ext sqlquota = mysql:/etc/dovecot/dovecot-dict-sql.conf.ext } plugin { [...] acl_shared_dict = proxy::acl expire_dict = proxy::expire quota2 = dict:Quota Usage::noenforcing:proxy::sqlquota sieve = file:~/sieve;active=~/.dovecot.sieve sieve_before = dict:proxy::sieve;name=activesql [...] } service dict { process_limit = 500 unix_listener dict { group = vmail mode = 0660 user = vmail } } Thanks -- Alessio Cecchi Postmaster @ http://www.qboxmail.it https://www.linkedin.com/in/alessice

2 1

decrypt.rb
by Dave 11 Apr '23

11 Apr '23

Per the Dovecot site here: https://wiki.dovecot.org/Plugins/MailCrypt ... the "decrypt.rb" ruby script can be used to decrypt a Dovecot-encrypted message file from the command line. The script sort of runs successfully for me, in the sense that it doesn't error out, but it doesn't show the decrypted message. I've called it like so: decrypt.rb -k <PATH_TO_DOVECOT_KEYFILE> -f ./encrypted_message But when I do it just displays the info below and exits (I've subbed <DATA> tags for the actual data): ------------------[OUTPUT]----------------------- Key(s) (total: 1) - Key type : EC - Key digest: <DATA1> - Peer key : <DATA2> - Encrypted : <DATA3> - Kd hash : <DATA4> ------------------------------------------------------- I've tried specifying an output file as well, per the script's command line options, but the output file is 0 bytes. Does anyone have any suggestions? I *think* I'm using it the way it's intended to be used, but maybe I'm not?! -Dave

5 14

2.3.14: stale imap-login processes due to bogus user setup tying up process limit
by Volker Stolz 16 Dec '22

16 Dec '22

I just dealt with an interesting Dovecot issue on our small server, and thought I might share it. I also feel that although in the end it was a configuration error, Dovecot should somehow avoid leaving this processes around and hence filling up the process limit quickly. - set up Dovecot IMAP on Debian buster (either with the older 2.3.x Debian package, or 2.3.14 from the dovecot-repo) - config: ... namespace inbox { inbox = yes location = ... default settings ... ... passdb { args = scheme=HMAC-MD5 username_format=%u /etc/dovecot/users driver = passwd-file } protocols = " imap" ... userdb { args = blocking=no driver = passwd } ... - secret sauce: have a user in the passdb that doesn't have a physical account on the system yet (we were migrating to a new machine). The log-file shows successful authentication for that user (after we flipped DNS to point to this new machine), but over time (2-3 times/day) we were left with an increasing number of `imap-login` processes in state `pre-login`, eventually requiring a dovecot restart. Dialling up process_limits didn't seem to help, we'd just get more of these stale processes. After creating the user on the system, the behaviour reverted to normal, no more stale processes. I do not know what error message that user received on their end, but since we announced we were migrating, they probably just ignored it and thought it as part of the transition. Best, Volker (a happy & long Dovecot user)

3 4

Catch all for Metadata storage in SQL database
by Steffen Kaiser 27 Oct '22

27 Oct '22

Hi, the https://doc.dovecot.org/configuration_manual/imap_metadata/ sample uses mail_attribute_dict = file:%h/Maildir/dovecot-attributes which stores all keys=value pairs in the file. http://dovecot.2317879.n4.nabble.com/Dovecot-v2-3-9-3-HTTP-API-Endpoint-for… uses a SQL dict, however very specific ones. How can I use a SQL dict to store _all_ keys, as with a file based storage? I cannot find a documentation for "pattern" specification, that works as "catch all", in order to store anything not catched by patterns into the database. https://wiki.dovecot.org/Dictionary does not give any hint (in my eyes). -- Steffen Kaiser

3 4

dovecot mailing list (this mailing list), DKIM, SPF and DMARC
by Lev Serebryakov 22 Oct '22

22 Oct '22

My domain (serebrtyajov.spb.ru) has all these "new" e-mail technologies configured. It works fine till I write to this mailing list. After that I've got several DMARC reports about "spam" from my domain. All these reports are about my mailing list post. I don't have such problems with other mailing lists (FreeBSD ones, OpenJDK ones, and others). Looks like mailing list software for this mailing list is misconfigured. I'm sure, I'll get new after this message. -- // Black Lion AKA Lev Serebryakov

15 38

Panic: file mail-index-transaction-finish.c: line 185
by tobisworld＠gmail.com 19 Sep '22

19 Sep '22

Hi list I have weird issue with my Dovecot 2.3.17.1 (476cd46418) When deleting a certain amount of messages from my INBOX via my MUA (Evolution) all over sudden dovecot starts to panic Panic: file mail-index-transaction-finish.c: line 185 (mail_index_transaction_get_uid): assertion failed: (seq <= t->view- >map->hdr.messages_count) imap(REDACTED)<24075><P0/vLkXUNt4KQmMB>: Error: Raw backtrace: /usr/lib64/dovecot/libdovecot.so.0(backtrace_append+0x42) [0x7f09274d4142] -> /usr/lib64/dovecot/libdovecot.so.0(backtrace_get+0x1e) [0x7f09274d424e] -> /usr/lib64/dovecot/libdovecot.so.0(+0xf72fe) [0x7f09274e22fe] -> /usr/lib64/dovecot/libdovecot.so.0(+0xf73a1) [0x7f09274e23a1] -> /usr/lib64/dovecot/libdovecot.so.0(i_fatal+0) [0x7f0927430e38] -> /usr/lib64/dovecot/libdovecot-storage.so.0(+0xf438d) [0x7f092789d38d] - > /usr/lib64/dovecot/libdovecot-storage.so.0(+0xf43da) [0x7f092789d3da] -> /usr/lib64/dovecot/libdovecot- storage.so.0(mail_index_transaction_finish+0x177) [0x7f092789da87] -> /usr/lib64/dovecot/libdovecot-storage.so.0(+0xf9ad6) [0x7f09278a2ad6] - > /usr/lib64/dovecot/libdovecot- storage.so.0(mail_index_transaction_commit_full+0x9d) [0x7f09278a2fad] -> /usr/lib64/dovecot/libdovecot- storage.so.0(mail_index_transaction_commit+0x1c) [0x7f09278a306c] -> /usr/lib64/dovecot/libdovecot- storage.so.0(mail_cache_set_seq_corrupted_reason+0x61) [0x7f092788c921] -> /usr/lib64/dovecot/libdovecot- storage.so.0(mail_set_mail_cache_corrupted+0xed) [0x7f09277fbbbd] -> /usr/lib64/dovecot/libdovecot-storage.so.0(+0x7a3e9) [0x7f09278233e9] - > /usr/lib64/dovecot/libdovecot-storage.so.0(+0x7a6b0) [0x7f09278236b0] -> /usr/lib64/dovecot/libdovecot- storage.so.0(mail_get_physical_size+0x38) [0x7f09277e8ba8] -> /usr/libexec/dovecot//lib20_mail_log_plugin.so(+0x2465) [0x7f09263dd465] -> /usr/libexec/dovecot//lib15_notify_plugin.so(notify_contexts_mail_copy+ 0x5c) [0x7f09265e13ec] -> /usr/libexec/dovecot//lib15_notify_plugin.so(+0x25d4) [0x7f09265e25d4] -> /usr/libexec/dovecot//lib10_quota_plugin.so(+0x102ae) [0x7f09269f92ae] -> /usr/libexec/dovecot//lib01_acl_plugin.so(+0xef3e) [0x7f0926c10f3e] -> /usr/lib64/dovecot/libdovecot- storage.so.0(+0x50c4c) [0x7f09277f9c4c] -> /usr/lib64/dovecot/libdovecot-storage.so.0(mailbox_move+0x58) [0x7f09277f9ec8] -> dovecot/imap(+0x1175b) [0x55a2c0ea575b] -> dovecot/imap(command_exec+0x64) [0x55a2c0eb3f04] -> dovecot/imap(+0x1dde2) [0x55a2c0eb1de2] -> dovecot/imap(+0x1de71) [0x55a2c0eb1e71] -> dovecot/imap(+0x1e039) [0x55a2c0eb2039] -> dovecot/imap(client_handle_input+0x205) [0x55a2c0eb22f5] -> dovecot/imap(client_input+0x79) [0x55a2c0eb28d9] imap(REDACTED)<24075><P0/vLkXUNt4KQmMB>: Fatal: master: service(imap): child 24075 killed with signal 6 (core dumps disabled - https://dovecot.org/bugreport.html#coredumps) >From that point on ANY access to INBOX from my MUA causes the error. The only way that I found to get around is to unsubscribe the INBOX folder and subscribe again. Then the error is gone until I delete a bunch of messages again. The error only occurs if I delete the messages within short time or select multiple (about 20msg at once). If I delete them one-by-one always waiting for expunge message in dovecot logs to appear then I can delete as many as I want. I have not verified with other MUA but in Evolution I can reproduce the issue. Cheers and have a good one tobi

4 14

Unclear how to get both user and domain quotas to work
by Hans van Zijst 10 Sep '22

10 Sep '22

Hi, First of all: my apologies for this long message. I'm trying to post all the information anybody could need to help me on my way. What I'm trying to make is an installation where both users and domains can have quotas. Ideally I would configure a quota for a domain and set a quota of 0 for all users within that domain, so that mail will be accepted up to the point where the domain quota is reached. Setting up user quota was fairly easy, there's lots of documentation around and examples to take inspiration from. Not so much for domain quota however, or I'm really bad at searching the Net. I'm running Debian Bullseye here: MariaDB 10.5.12 Dovecot 2.3.13 Postfixadmin 3.3.10 I want to use dictionaries in MySQL, because eventually this will be a platform with several Dovecot and Postfix servers. At this time I'm only running one Dovecot installation and a few Postfix servers (two for communication with the outside world and one to do the virus and spam scanning). My current setup for user quota is how Postfixadmin wants it: MariaDB [postfixadmin]> desc quota2; +----------+--------------+------+-----+---------+-------+ | Field | Type | Null | Key | Default | Extra | +----------+--------------+------+-----+---------+-------+ | username | varchar(100) | NO | PRI | NULL | | | bytes | bigint(20) | NO | | 0 | | | messages | int(11) | NO | | 0 | | +----------+--------------+------+-----+---------+-------+ 3 rows in set (0.001 sec) In /etc/dovecot/conf.d/90-quota.conf I have this: plugin { quota = dict:User quota::proxy::sqlquota quota_rule = *:bytes=1024M quota_rule2 = Trash:bytes=+100M quota_vsizes = yes quota_status_success = DUNNO quota_status_nouser = DUNNO quota_status_overquota = "552 5.2.2 Mailbox is full" } dict { sqlquota = mysql:/etc/dovecot/dovecot-dict-sql.conf.ext } The SQL-configuration /etc/dovecot/dovecot-dict-sql.conf.ext is this: connect = host=... dbname=... user=... password=... map { pattern = priv/quota/storage table = quota2 username_field = username value_field = bytes } map { pattern = priv/quota/messages table = quota2 username_field = username value_field = messages } map { pattern = shared/expire/$user/$mailbox table = expires value_field = expire_stamp fields { username = $user mailbox = $mailbox } } I use LMTP to accept mail from Postfix; the quota-plugin is activated for LMTP, so every incoming mail should be counted. This works like a charm: if I don't configure a quota for a user, he gets the default 1GB, if I override it in Postfixadmin, then that's what he gets. I'm running quota-status on a TCP-port, so the gateway SMTP-servers can connect to Dovecot for a quotacheck to decide whether to accept or reject an incoming message. Again, this works flawlessly. I can't find any serious documentation about this mapping thing. In particular, what's with that "pattern"? All I can find in the documentation is: "The dict key must match exactly priv/quota/storage. The dict keys are hardcoded in the Dovecot code, so depending on what functionality you’re configuring you need to know the available dict keys used it." -- https://doc.dovecot.org/configuration_manual/dict/#dict-sql If anyone can point me at better documentation than the actual source code: please! I browsed through the quota-plugin source code, but I'm not a programmer and couldn't find what I thought I was looking for. That said, I'm not sure where I got the third "map" from, with the shared/expire pattern. I seem to have forgotten to document that bit of my journey. Now, domain quotas... I've tried all kinds of stuff, but at the moment I'm stuck with something that seems to almost work. I added a second quota root: plugin { quota2 = dict:Domain quota:%d:proxy::sqldomainquota quota2_rule = *:bytes=1024M quota2_status_success = DUNNO quota2_status_nouser = DUNNO quota2_status_overquota = "552 5.2.2 Domain quota exceeded" quota2_vsizes = yes } dict { sqldomainquota = mysql:/etc/dovecot/dovecot-dict-sql.conf.ext } This dict refers to the same mapping as the one for user quotas, and I think that's the way it should be. Please correct me if I'm wrong. This creates a new user in the quota2 table, by the name of just the domain. Unfortunately, it simply fills it with the numbers from the first user it can find in that domain, not all users in that domain combined. What I think I should do, is change something in the dict so that it sums up all users in that domain, something like this: SELECT SUM(bytes) FROM quota2 WHERE username LIKE '%@domain'; Problem is that I can't find anything useful online with regards to this, I'm not even sure if I'm thinking in the right direction here. Any hints, suggestions or corrections? Or pointers to articles or documentation I might have missed? Kind regards, Hans

2 1

running alternate dovecot instances on the same server
by Chris Hoogendyk 21 Jun '22

21 Jun '22

I'm posting to the list, but not on the list. I presume that means a reply-all to get to me as well as the list? We have two servers (dovecot --version: 2.2.22 (fe789d2)) that handle email for two different departments. We are transitioning mail service to the University central IT. They need to move accounts in an automated fashion and therefore need a master password to our dovecot servers. However, we are running with LDAP authentication, and I understand that a master password is not possible in that configuration. Would it be possible to run an alternate dovecot process that would use local account authentication, have a master password, and use an alternate port for connecting? Ideally it would only read accounts without changing anything, and would not interfere with the operation of the other dovecot process. I'm hoping that I could copy the configuration files, make these changes, and then launch it manually without any startup scripts in /etc/inetd.conf. Oh, by the way, we are running Ubuntu 16.04 LTS and have contracts with Ubuntu Advantage for ongoing patch support. The dovecot version is from the distribution, installed with aptitude. -- --------------- Chris Hoogendyk - O__ ---- Systems Administrator, Retired c/ /'_ --- Biology & Geosciences Departments (*) \(*) -- 315 Morrill Science Center III ~~~~~~~~~~ - University of Massachusetts, Amherst <hoogendyk(a)bio.umass.edu> --------------- Erdös 4

3 7

What is the state of SMTPUTF8 support?
by Sylvhem 02 Jun '22

02 Jun '22

Hi! It’s been some time since I last saw a mention of SMTPUTF8 here. Last time I heard about it, it was worked on. Does anybody have news about that? -- Sylvhem

5 8