September 2022 - dovecot

dovecot mailing list (this mailing list), DKIM, SPF and DMARC
by Lev Serebryakov 21 Oct '22

21 Oct '22

My domain (serebrtyajov.spb.ru) has all these "new" e-mail technologies configured. It works fine till I write to this mailing list. After that I've got several DMARC reports about "spam" from my domain. All these reports are about my mailing list post. I don't have such problems with other mailing lists (FreeBSD ones, OpenJDK ones, and others). Looks like mailing list software for this mailing list is misconfigured. I'm sure, I'll get new after this message. -- // Black Lion AKA Lev Serebryakov

15 38

Unseen field reported by imap status command returns wrong count for shared mailboxes on dovecot cluster
by Nikolaos Pyrgiotis 19 Oct '22

19 Oct '22

Hello, We recently migrated our mail server to a dovecot cluster of 5nodes, a dovecot proxy, 2directors and 2dovecot backends. All dovecot nodes run version 2.19.1. We use a glusterfs mounted volume on the backends forthe mail storage. We noticed that when issuing the IMAP command to check forUNSEEN messages formails on the shared namespace instead of seeing the value of the unseen messages of the user that the mailbox has been shared to, the value of the unseen messages of the owner of the mailbox is returned. This behavior causes thunderbird when getting new messages forshared mailboxes, to show briefly all messages of the mailbox as unseen forthe user before showing the correct unseen count forthe shared mailbox. The mail location of the shared mailboxes is defined with imapc storage type as described inthe documentation. Is this a dovecot bug? Can we configure a different dovecot configuration setting so that imap status command reports the correct unseen field count when mail location is an imapc storage location? An examples is given below when running doveadm command from one the 2 dovecot directors: When issuing the status command we see that the unseen count is 2: root@doved0-rmt0-cn1:/etc/cron.d# doveadm mailbox status -u npyrgiotis all shared.sysadmins doveadm(npyrgiotis): Info: remote(10.101.0.71:8080): doveadm(npyrgiotis(a)domie02.com)<19078><9l8IJTb+GWOGSgAAEU9A+w>: imapc(10.101.0.75:143): Connected to 10.101.0.75:143 (local 10.101.0.71:33476) shared.sysadmins messages=2 recent=0 uidnext=3 uidvalidity=1662640492 unseen=2 highestmodseq=3 vsize=3950 guid=c92f64f79f0d1ed01e6d5b314f04886c firstsaved=1662643853 shared.sysadmins messages=2recent=0uidnext=3uidvalidity=1662640492unseen=2highestmodseq=3vsize=3950guid=c92f64f79f0d1ed01e6d5b314f04886c firstsaved=1662643853 But when fetching the emails of the mailboxes we can see that the \Seen flag is set for both emails root@doved0-rmt0-cn1:/etc/cron.d# doveadm fetch -u npyrgiotis flags mailbox shared.sysadmins ALL doveadm(npyrgiotis): Info: remote(10.101.0.71:8080): doveadm(npyrgiotis(a)domie02.com)<19074><e7rWDgj+GWOCSgAAEU9A+w>: imapc(10.101.0.75:143): Connected to 10.101.0.75:143 (local 10.101.0.71:38750) flags: \Seen flags: \Seen Below i post the dovecot configuration of one of the two dovecot backends: # 2.3.19.1 (9b53102964): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.19 (4eae2f79) # OS: Linux 5.10.0-17-amd64 x86_64 Debian 11.4 # Hostname: doveb0-rmt0-cn1 auth_cache_negative_ttl = 5mins auth_cache_size = 50M auth_debug = yes auth_default_realm = example.com auth_master_user_separator = * auth_mechanisms = plain login auth_verbose = yes auth_worker_max_count = 16 disable_plaintext_auth = no first_valid_uid = 499 hostname = smtp.example.com imapc_features = fetch-bodystructure fetch-headers rfc822.size search modseq acl delay-login imapc_host = 10.101.0.75 imapc_password = # hidden, use -P to show it imapc_sasl_mechanisms = plain login imapc_ssl = starttls imapc_ssl_verify = no last_valid_uid = 499 lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes login_greeting = You have successfully logged into example.com IMAP server login_trusted_networks = 10.101.0.73 10.101.0.74 mail_always_cache_fields = flags hdr.* date.received date.sent mail_cache_fields = flags date.received guid size.physical size.virtual imap.bodystructure body.snippet mail_debug = yes mail_fsync = always mail_plugins = " notify mail_log zlib acl" mail_privileged_group = mail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext mdbox_rotate_size = 200M mmap_disable = yes namespace example { list = children location = imapc:~/shared/%%n:INDEXPVT=~/shared-pvt/%%n prefix = shared.%%n. separator = . subscriptions = no type = shared } namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Spam.Virus { auto = subscribe } mailbox Spam { auto = subscribe } mailbox Trash { special_use = \Trash } prefix = separator = . subscriptions = yes type = private } passdb { args = password=#hidden_use-P_to_show# driver = static master = yes override_fields = allow_real_nets=127.0.0.0/8,local,10.101.0.73,10.101.0.74 userdb_acl_user=%{auth_user} userdb_namespace/example/disabled=yes result_success = continue } passdb { args = password=#hidden_use-P_to_show# driver = static override_fields = allow_real_nets=127.0.0.0/8,local,10.101.0.73,10.101.0.74 result_success = continue } passdb { args = /etc/dovecot/dovecot-ldap-users.conf.ext driver = ldap } passdb { args = /etc/dovecot/dovecot-ldap-groups.conf.ext driver = ldap } plugin { acl = vfile:/etc/dovecot/global-acls/%d/master-dovecot-acl:cache_secs=300 acl_defaults_from_inbox = yes acl_globals_only = no acl_shared_dict = file:/var/dovecot-acl/%d/shared-mailboxes.db imap_compress_deflate_level = 6 mail_log_events = flag_change mail_log_fields = uid box flags sieve = file:~/sieve;active=~/sieve/%n.sieve sieve_before = /var/vmail/global-sieve/global.sieve sieve_env_email_address = %u sieve_env_mailbox_prefix = %{userdb:mailbox_prefix} sieve_global = /var/vmail/sieve sieve_global_extensions = +editheader +vnd.dovecot.environment zlib_save = zstd zlib_save_level = 5 } protocols = " imap lmtp sieve submission" service auth-worker { user = dovecot } service auth { unix_listener auth-userdb { group = mail mode = 0666 user = vmail } } service doveadm { inet_listener dovadm-dom-mgmt { address = 10.100.1.71 port = 8080 ssl = no } inet_listener dovadm-dom { address = 10.101.0.71 port = 8080 ssl = no } vsz_limit = 256M } service imap-login { inet_listener imap-dom { address = 10.101.0.71 port = 143 ssl = no } inet_listener imap { port = 0 } inet_listener imaps-dom { address = 10.101.0.71 port = 993 ssl = yes } inet_listener imaps { port = 0 } process_limit = 400 process_min_avail = 2 service_count = 20 vsz_limit = 512M } service imap { process_limit = 2048 process_min_avail = 0 service_count = 1 vsz_limit = 4G } service lmtp { inet_listener lmtp-dom { address = 10.101.0.71 port = 24 ssl = no } process_limit = 0 process_min_avail = 0 service_count = 0 unix_listener lmtp { mode = 0666 } vsz_limit = 256M } service managesieve-login { inet_listener sieve-dom { address = 10.101.0.71 port = 4190 ssl = no } inet_listener sieve { port = 0 } process_limit = 0 process_min_avail = 0 service_count = 0 vsz_limit = 64M } service managesieve { process_limit = 1024 process_min_avail = 0 service_count = 1 vsz_limit = 256M } service submission-login { inet_listener submission-dom { address = 10.101.0.71 port = 587 ssl = no } inet_listener submission { port = 0 } inet_listener submissions-dom { address = 10.101.0.71 port = 465 ssl = yes } process_limit = 250 process_min_avail = 2 service_count = 1 vsz_limit = 256M } service submission { process_limit = 1024 process_min_avail = 0 service_count = 1 vsz_limit = 256M } ssl = required ssl_cert = </etc/ssl/certs/doveb0-rmt0-cn1.mail.rmt.example.com.pem ssl_client_ca_dir = /etc/ssl/certs ssl_key = # hidden, use -P to show it submission_max_mail_size = 30000k submission_relay_host = 10.101.0.7 submission_relay_port = 587 submission_relay_ssl = starttls submission_relay_ssl_verify = no submission_relay_trusted = yes userdb { driver = prefetch } userdb { args = /etc/dovecot/dovecot-ldap-users.conf.ext driver = ldap } userdb { args = /etc/dovecot/dovecot-ldap-groups.conf.ext driver = ldap } protocol lmtp { mail_plugins = " notify mail_log zlib acl sieve acl" } protocol lda { mail_plugins = " notify mail_log zlib acl sieve acl" } protocol imap { mail_max_userip_connections = 100 mail_plugins = " notify mail_log zlib acl" } protocol sieve { mail_max_userip_connections = 40 } protocol submission { mail_max_userip_connections = 70 } local10.101.0.71 { doveadm_allowed_commands = doveadm_password = # hidden, use -P to show it } local10.100.1.71 { doveadm_allowed_commands = doveadm_password = # hidden, use -P to show it } Thank you, Nikolaos Pyrgiotis

2 3

Dovecot mail-crypt webmail can't read encrypted messages
by Serveria Support 17 Oct '22

17 Oct '22

I'm trying to setup Dovecot with mail-crypt plugin with per-user encryption. I have configured mail-crypt plugin as per official guide here: https://doc.dovecot.org/configuration_manual/mail_crypt_plugin/ After that I created a user and an encrypted key by running this command: doveadm -o \plugin/mail_crypt_private_password=12345 mailbox cryptokey generate -u mail(a)example.org -URf (replacing dummy data ofc) I can log in to webmail (and Dovecot) just fine, emails are getting sent and delivered. I have also checked the storage and the messages seem to be stored encrypted. However, I can't read the emails in webmail (just headers can be seen) and in Dovecot logs I can see the following error: failed: Private key not available: Cannot decrypt key ### Cannot decrypt key ### <8632: Password not available (FETCH RFC822.HEADER) There seems to be an issue with mySQL query. The query I'm using (Select username as "user", password,"%w" as userdb_mail_crypt_private_password from mailbox;) seems to work just fine, when run from mysql prompt it outputs the usernames and passwords, but the error is still there (Cannot decrypt key ### Password not available). Any ideas? What am I missing?

16 70

Multidomain ssl config ?
by Maurizio Caloro 15 Oct '22

15 Oct '22

on postfix now this seems to run, and with dovecot i need also handle this two domains, but appairing this error messages. like: Jun 29 20:49:28 Dovecot/imap-login: Info: Disconnected (no auth attempts in 0 secs): user=<>, rip=a.b.c.d, lip=37.120.190.188, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines: ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<FdklDjkdfrkfi> Running with Debian Buster # dovecot --version 2.3.4.1 (f79e8e7e4) # nmail.caloro.ch local_name nmail.caloro.ch { ssl_cert = </etc/letsencrypt/live/nmail.caloro.ch/privkey.pem ssl_key = </etc/letsencrypt/live/nmail.caloro.ch/fullchain.pem } # nmail.calm-ness.ch local_name nmail.calm-ness.ch { ssl_cert = </etc/letsencrypt/live/nmail.calm-ness.ch/privkey.pem ssl_key = </etc/letsencrypt/live/nmail.calm-ness.ch/fullchain.pem } thanks for possible help

6 5

grabbing multiple patterns from allof
by Marc 10 Oct '22

10 Oct '22

Anyone an idea how you should grab multiple matches from allof? if allof ( true, header :regex "Subject" "(test).*(test2)", envelope :matches "from" "*" )

2 1

Replacing antispam plugin with IMAPSieve not 100% correct?
by Marc 04 Oct '22

04 Oct '22

I think this page[1] is not correct If you configure this option: imapsieve_mailbox1_before = file:/usr/lib/dovecot/sieve/report-spam.sieve the file report-spam.svbin cannot be created because users cannot write there. [1] https://doc.dovecot.org/configuration_manual/howto/antispam_with_sieve/#how…

3 2

Matching Addresses in Sieve
by Doug Hardie 30 Sep '22

30 Sep '22

I have an email with the following header line: From: 'Thank you!Kohls' <Kohls-MNc(a)FeedbackKohlsOpinionRequestedlxecrftHO.com> I am trying to match that with: if address :contains "from" "Thank you!Kohls" { addflag "\\Seen"; fileinto "Junk"; stop; } However, the matching portion of the from address is only the section between < and >. Since there are changing sections that are different for each email, I can't use that. I wanted to match the stuff before <. I have tried numerous formats for the if statement but none of them have worked. What is the proper way to make that match work? Thanks, -- Doug

2 2

new feature: sieve forward plugin
by Marc 26 Sep '22

26 Sep '22

As this page[1] describes a more often occurring problem of forwarding messages from servers that are not included in the spf records. Maybe there should be a plugin that offers this forward functionality. Something like get the spf records of the sender check if there is a -all then apply the sender substitution. https://doc.dovecot.org/configuration_manual/sieve/configuring_auto_forward…

4 4

Vmail Home
by Silvio Siefke 26 Sep '22

26 Sep '22

Hello, I use Opensmtpd with Dovecot LMTP. All this run but one point I not understand. I use Virtual Users, with System User vmail, home is /var/vmail but dovecot stored message in path /home/vmail/<domain>/user. In configuration files is /var/vmail (dovecot users). Thx for help Silvio ---- cat /etc/passwd | grep vmail vmail:x:2000:2000:Vmail Directory and User:/var/vmail:/usr/sbin/nologin ---- dovecot -n # 2.3.13 (89f716dc2): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.13 (cdd19fe3) # OS: Linux 5.10.0-18-amd64 x86_64 Debian 11.5 # Hostname: asia.sisi-systems.ovh default_vsz_limit = 1 G doveadm_password = # hidden, use -P to show it doveadm_port = 20000 mail_gid = vmail mail_location = maildir:~/Maildir mail_plugins = " notify replication" mail_privileged_group = vmail mail_uid = vmail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext imapsieve vnd.dovecot.imapsieve namespace inbox { inbox = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Sent { auto = subscribe special_use = \Sent } mailbox Spam { auto = subscribe special_use = \Junk } mailbox Trash { auto = subscribe special_use = \Trash } prefix = } passdb { args = scheme=SHA512-CRYPT username_format=%u /etc/dovecot/users driver = passwd-file } plugin { imapsieve_mailbox1_before = file:/var/vmail/sieve/global/learn-spam.sieve imapsieve_mailbox1_causes = COPY imapsieve_mailbox1_name = Spam imapsieve_mailbox2_before = file:/var/vmail/sieve/global/learn-ham.sieve imapsieve_mailbox2_causes = COPY imapsieve_mailbox2_from = Spam imapsieve_mailbox2_name = * mail_replica = tcp:192.168.1.112 quota = maildir:User quota quota_exceeded_message = Benutzer %u hat das Speichervolumen überschritten. / User %u has exhausted allowed storage space. sieve = file:/var/vmail/sieve/%d/%n/scripts;active=/var/vmail/sieve/%d/%n/active-script.sieve sieve_before = /var/vmail/sieve/global/spam-global.sieve sieve_global_extensions = +vnd.dovecot.pipe +vnd.dovecot.environment sieve_pipe_bin_dir = /usr/bin sieve_plugins = sieve_imapsieve sieve_extprograms } protocols = lmtp imap pop3 sieve service aggregator { fifo_listener replication-notify-fifo { user = vmail } unix_listener replication-notify { user = vmail } } service doveadm { inet_listener { port = 20000 } } service imap-login { inet_listener imap { port = 143 } vsz_limit = 1 G } service lmtp { unix_listener lmtp { group = vmail user = vmail } } service managesieve-login { inet_listener sieve { port = 4190 ssl = yes } } service managesieve { process_limit = 1024 } service pop3-login { inet_listener pop3 { port = 110 } inet_listener pop3s { port = 995 ssl = yes } } service replicator { process_min_avail = 1 unix_listener replicator-doveadm { mode = 0600 user = vmail } } ssl = required ssl_cert = </etc/lego/certificates/imap.sisi-systems.ovh.crt ssl_cipher_list = ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384 ssl_client_ca_dir = /etc/ssl/certs ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it ssl_min_protocol = TLSv1.2 userdb { args = username_format=%u /etc/dovecot/users driver = passwd-file override_fields = uid=vmail gid=vmail home=/home/vmail/%d/%n } protocol imap { imap_idle_notify_interval = 29 mins mail_max_userip_connections = 20 mail_plugins = " notify replication quota imap_quota imap_sieve" } protocol lmtp { mail_plugins = " notify replication sieve notify push_notification" postmaster_address = network(a)sisi-systems.ovh } protocol pop3 { mail_max_userip_connections = 10 mail_plugins = " notify replication" }

2 1

Custom post login scripting variables via ID command
by hi＠zakaria.website 26 Sep '22

26 Sep '22

Hi there, I wonder if dovecot would consider this feature request. In post login scripting, given USER, IP, LOCAL_IP, and userdb lookup fields, are only available, I want to push additional variables from web mail to dovecot using ID commands yet I looked at the source in imap-login-cmd-id.c and script-login.c it seems to be possible while I'm not an expert in C and IMAP standards and not sure if its something would break the standards. I hope the dev team to consider this and if anyone have a workaround or an idea with I can start to patch a workaround myself, please let me know as it would be very much appreciated. With thanks. Zakaria.

3 4