April 2022 - dovecot - dovecot.org

FTS solr or xapian and Public Folders
by David Williams 13 May '22

13 May '22

Hi all I hope someone can help with this. I'm looking at setting up FTS on a Dovecot server which has some quite big pubic folders (100,000+ emails each) and would appreciate some info about how fts both Xapian and Solr works with public folders. As background of the folders can receive emails and I use a dummy user and an alias file to deliver them for example testfolder: dummy+Public/MYTESTFOLDER(a)example.com delivers email addressed to testfolder(a)example.com to MYTESTFOLDER in the namespace Public. Has anyone successfully setup FTS with public folders using either Xapian or Solr and what happens when one user changes a folder, does that change show up for other users? E.G.: When an email is delivered by dummy and indexed will that email be indexed for other users as well? Similarly what happens that when an email is moved between, deleted from or copied to public folders by one user will that change then show up for the other users or not? I guess the basic question is: Are public folders indexed once and then the indexes are made available to each user with access or are they indexed for each user? Any info or experience that anyone has will be appreciated. Many thanks David

2 1

no full syncs after upgrading to dovecot 2.3.18
by Arnaud Abélard 12 May '22

12 May '22

Hello, I am working on replicating a server (and adding compression on the other side) and since I had "Error: dsync I/O has stalled, no activity for 600 seconds (version not received)" errors I upgraded both source and destination server with the latest 2.3 version (2.3.18). While before the upgrade all the 15 replication connections were busy after upgrading dovecot replicator dsync-status shows that most of the time nothing is being replicated at all. I can see some brief replications that last, but 99,9% of the time nothing is happening at all. I have a replication_full_sync_interval of 12 hours but I have thousands of users with their last full sync over 90 hours ago. "doveadm replicator status" also shows that i have over 35,000 queued full resync requests, but no sync, high or low queued requests so why aren't the full requests occuring? There are no errors in the logs. Thanks, Arnaud -- Arnaud Abélard Responsable pôle Système et Stockage Service Infrastructures DSIN Université de Nantes -

8 19

Authentication type for lan and haproxy (internet)
by Kees van Vloten 29 Apr '22

29 Apr '22

Hi Team, Would it be possible to setup a different authentication method depending on the connection source? I would like to use oauth2 (with mfa) for connections from internet via haproxy, whereas on the lan I run samba-dc and hence AD (krb5) is the method to use. The latter is already setup and works fine, now I want to add oauth2 for haproxy connections (or outside lan ip-range). Here's the relevant bit of "dovecot -n": auth_default_realm = EXAMPLE.COM auth_gssapi_hostname = mailserver.example.com auth_krb5_keytab = /etc/keytab/dovecot.keytab auth_master_user_separator = * auth_mechanisms = gssapi gss-spnego plain auth_realms = EXAMPLE.COM passdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap pass = yes } passdb { driver = pam } userdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } - Kees.

1 0

director service tries to start without any configuration
by Eirik Rye 29 Apr '22

29 Apr '22

Hello, - Dovecot 2.3.18 (originally Dovecot 2.3.16, but upgraded in an attempt to fix issue) - Ubuntu 20.04 using Dovecot repo In my organization have run a cluster of dovecot proxy machines, with the director service enabled in a transition period as we have migrated all our users to do direct proxying to backend (e.g. `proxy=y, host=192.168.0.2`), bypassing the director service. Now that all users have been migrated, it is time to disable the director service. However, even after removing all director configuration ("doveconf -n | grep director" returns nothing) and restarting the entire dovecot service (not just "doveadm reload"), the error log still spits out these errors: 2022-04-29T11:27:25+0200 director: Error: Empty server list 2022-04-29T11:27:25+0200 director: Fatal: Invalid value for director_mail_servers setting 2022-04-29T11:27:25+0200 master: Error: service(director): command startup failed, throttling for 60.000 secs Why is this happening? It's not critical, and logins work fine without the director service running, but I'm trying to figure out why and stop the log noise. doveconf stuff: root@director03:~# doveconf -n | grep director # Hostname: director03 root@director03:~# doveconf -n # 2.3.18 (9dd8408c18): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.18 (0bc28b32) # OS: Linux 5.4.0-88-generic x86_64 Ubuntu 20.04.4 LTS # Hostname: director03 debug_log_path = /var/log/dovecot.log default_vsz_limit = 768 M disable_plaintext_auth = no doveadm_password = # hidden, use -P to show it doveadm_port = 24245 event_exporter log { format = json format_args = time-rfc3339 transport = log } imap_id_retain = yes info_log_path = /var/log/dovecot.log lmtp_add_received_header = no lmtp_proxy = yes log_path = /var/log/dovecot.err log_timestamp = "%FT%T%z " login_greeting = %{hostname} ready. login_log_format_elements = user=<%u> orig=<%{orig_user}> method=%m proto=%s rip=%r lip=%l session=<%{session}> %c %k login_proxy_max_disconnect_delay = 10 secs login_trusted_networks = <redacted> mail_plugins = quota managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext metric auth_passdb_request_finished { filter = event=auth_passdb_request_finished AND category=service:auth group_by = service passdb_name result } passdb { args = /etc/dovecot/dovecot-redis.conf.ext auth_verbose = yes driver = dict name = redis override_fields = proxy=y } protocols = imap pop3 lmtp sieve service doveadm { inet_listener http { port = 8080 } } service imap-login { client_limit = 2048 executable = imap-login inet_listener imap { address = port = 143 } inet_listener imaps { address = port = 993 ssl = yes } process_limit = 32 process_min_avail = 16 service_count = 0 vsz_limit = 1 G } service lmtp { inet_listener lmtp { port = 24 } } service managesieve-login { client_limit = 1024 executable = managesieve-login inet_listener sieve { address = port = 4190 } process_limit = 2 process_min_avail = 1 service_count = 0 vsz_limit = 1 G } service pop3-login { client_limit = 2048 executable = pop3-login inet_listener pop3 { address = port = 110 } inet_listener pop3s { address = port = 995 ssl = yes } process_limit = 4 process_min_avail = 2 service_count = 0 vsz_limit = 1 G } service stats { client_limit = 65536 inet_listener http { port = 9900 } } ssl_cert = </etc/dovecot/wildcard.crt ssl_cipher_list = ALL:!LOW:!SSLv2:!EXP:!aNULL ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it ssl_min_protocol = TLSv1 verbose_proctitle = yes protocol imap { mail_max_userip_connections = 25 } protocol pop { mail_max_userip_connections = 25 } local 127.0.0.0/8 { doveadm_password = # hidden, use -P to show it }

2 3

Informational messages written to ~/.dovecot.sieve.log
by Gedalya 29 Apr '22

29 Apr '22

Hi, After adding "vnd.dovecot.debug" to the require list at the top of a sieve script, informational messages started appearing in ~/.dovecot.sieve.log, even when debug_log was not used. The script looks like this: require ["fileinto","imap4flags","reject","duplicate","vnd.dovecot.debug"]; # rule:[Duplicate] if duplicate :header "X-dd-hash" :last { debug_log "Duplicate message, discarding"; discard; } [ .. more rules .. ] Log lines: sieve: info: started log at 2022-04-28 23:49:43 -0400. info: msgid=<xxxxxxxxx>: stored mail into mailbox 'INBOX'. (no rule matched) sieve: info: started log at 2022-04-29 00:51:40 -0400. info: msgid=<xxxxxxxxx>: fileinto action: stored mail into mailbox 'Alerts'. I would expect / prefer that the log would be used only when debug_log was used. With too many log messages, the interesting ones would get rotated out sooner than desired.

1 0

Can I set a different certificate per listen port?
by Kees van Vloten 28 Apr '22

28 Apr '22

Hi all, I am trying to setup dovecot to listen to imaps on the local network and through haproxy from the internet. service imap-login { inet_listener imaps { port = 993 ssl = yes } inet_listener imaps_haproxy { haproxy = yes port = 10993 ssl = yes } } Obviously the dns-name on the internet connection (10993) is different than on the lan (993). In the docs (https://doc.dovecot.org/configuration_manual/dovecot_ssl_configuration/) I found multiple options, but unfortunately none of those have the option to distinguish per listen port. Is there a way to setup two different certificates for the two listeners? - Kees

3 3

master user namespace error?
by Thomas Winterstein 26 Apr '22

26 Apr '22

Hello, I've set up a master user for migration purposes and doveadm auth tests succeed. If I test with telnet, the login as user also works and performs a user search on ldap but I get a namespace error: > Debug: ldap(testuser,1.2.3.4,<0o/OTasGHdfNCB>): Finished userdb lookup > Debug: master userdb out: USER#011911998977#011testuser#011uid=500#011gid=500#011nopassword=<hidden>#011proxy_maybe=yes#011master_user=admin#011auth_mech=PLAIN#011auth_token=b8c3dfdfcc9ac33cb1c2f1d755g8e04db58a7aa0#011auth_user=admin > imap-login: Login: user=<testuser>, method=PLAIN, rip=1.2.3.4, lip=5.6.7.8, mpid=22569, TLS, session=<0o/OTasGHdfNCB> > Error: Namespace '': Mail storage autodetection failed with home=(not set) > Disconnected: Namespace '': Mail storage autodetection failed with home=(not set) in=0 out=417 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes Anything special to consider in a proxy setup? thank you Thomas

1 0

how to setup IMAPs with letsencrypt
by alice＠coakmail.com 26 Apr '22

26 Apr '22

hello I have setup website using letsencrypt for certification. how can I setup IMAP to use this certs as well? Thank you.

10 20

Heads-up: Exim 4.96 RC0 may break your Dovecot LDA delivery
by Kirill Miazine 25 Apr '22

25 Apr '22

Hi, all The just released RC0 for Exim 4.96 will break Dovecot LDA delivery as described on https://wiki.dovecot.org/LDA/Exim Here is the relevant ChangeLog entry: JH/25 Taint-check exec arguments for transport-initiated external processes. Previously, tainted values could be used. This affects "pipe", "lmtp" and "queryprogram" transport, transport-filter, and ETRN commands. The ${run} expansion is also affected: in "preexpand" mode no part of the command line may be tainted, in default mode the executable name may not be tainted. As of now I don't have a personal working solution to get untained data. I did try a small hack, but Exim was smart enough to see what I was doing. -- -- Kirill Miazine <km(a)krot.org>

2 3

doveadm pw usage
by ミユナ (alice) 25 Apr '22

25 Apr '22

Hello when i want to assign a password to a user, I need to write the plain passwd to a text file then do: # doveadm pw -p input.txt {CRAM-MD5}77180880... it's not that convenient to write to a file first. does it support the format below? doveadm pw "plain password" providing the plain password as CL argument to generate a encrypted one. thank you ミユナ alice

5 6