September 2022 - dovecot

Thunderbird can't connect to Dovecot (bad certificate: SSL alert number 42)
by Meikel 19 Sep '22

19 Sep '22

Hi folks, on a Rocky Linux 8.6 based home server I run Dovecot with an account that I use as an archive. Archive means, that from different Thunderbird instances I connect to that Dovecot via IMAPS to move emails there, that I want to keep. Since some days from all Thunderbird instances I can no longer connect to that Dovecot account. In /var/log/maillog of the server I see Sep 14 06:39:54 server3 dovecot[2033173]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14094412:SSL routines:ssl3_read_bytes:sslv3 alert bad certificate: SSL alert number 42 (no auth attempts in 0 secs): user=<>, rip=192.168.177.105, lip=192.168.177.13, TLS handshaking: SSL_accept() failed: error:14094412:SSL routines:ssl3_read_bytes:sslv3 alert bad certificate: SSL alert number 42, session=<dL1luJvokK3AqLFp> I found that Openssl alert number 42 might be a problem with the SSL certificate (which certificate?) but also might be an expired SSL certificate (which certificate?). As on the Dovecot installation I work with a self signed certificat. I created a new self signed certificate yesterday with an expiry not before year 2032. That did not help, I see the same messages when I try to connect from Thunderbird. Just to see how Thunderbird is involved in the problem I installed Claws-Mail. From Claws-Mail I do NOT have those problems, I can access to Dovecot via IMAPS as expected. I do not understand why all my Thunderbird installations can no longer access Dovecot via IMAPS. This worked fine for about 18 months. I can't prove but I think on beginning of month it worked fine. Something happened meanwhile. If there is a problem with an SSL certificate (bad certificate: SSL alert number 42), which certificate makes the problem? The certificate used by Dovecot or some certificate used in Thunderbird? About installation: cat /etc/redhat-release Rocky Linux release 8.6 (Green Obsidian) dovecot --version 2.3.16 (7e2e900c1a) sudo dovecot -n # 2.3.16 (7e2e900c1a): /etc/dovecot/dovecot.conf # OS: Linux 4.18.0-372.19.1.el8_6.x86_64 x86_64 Rocky Linux release 8.6 (Green Obsidian) # Hostname: ....... auth_debug = yes auth_mechanisms = plain login auth_verbose = yes first_valid_uid = 1000 mail_debug = yes mail_gid = vmail mail_location = maildir:~/Maildir mail_privileged_group = vmail mail_uid = vmail mbox_write_locks = fcntl namespace { inbox = yes location = mailbox Archives { special_use = \Archive } prefix = INBOX/ separator = / type = private } passdb { args = scheme=CRYPT username_format=%u /etc/dovecot/users driver = passwd-file } protocols = imap service imap-login { inet_listener imap { port = 0 } } ssl = required ssl_cert = </etc/dovecot/......crt ssl_cipher_list = PROFILE=SYSTEM ssl_key = # hidden, use -P to show it userdb { args = username_format=%u /etc/dovecot/users driver = passwd-file } verbose_proctitle = yes I used the following command to recreate the SSL certificate for Dovecot: sudo openssl req -x509 -nodes -days 3650 -newkey rsa:4096 -keyout /etc/dovecot/......key -out /etc/dovecot/......crt And with the command openssl s_client -crlf -connect .....:993 I can successfully connect to Dovecot and "simulate" a minimal IMAP-Session: * OK [CAPABILITY IMAP4rev1 SASL-IR LOGIN-REFERRALS ID ENABLE IDLE LITERAL+ AUTH=PLAIN AUTH=LOGIN] Dovecot ready a login meikel.archive@..... topsecret a OK [CAPABILITY IMAP4rev1 SASL-IR LOGIN-REFERRALS ID ENABLE IDLE SORT SORT=DISPLAY THREAD=REFERENCES THREAD=REFS THREAD=ORDEREDSUBJECT MULTIAPPEND URL-PARTIAL CATENATE UNSELECT CHILDREN NAMESPACE UIDPLUS LIST-EXTENDED I18NLEVEL=1 CONDSTORE QRESYNC ESEARCH ESORT SEARCHRES WITHIN CONTEXT=SEARCH LIST-STATUS BINARY MOVE SNIPPET=FUZZY PREVIEW=FUZZY LITERAL+ NOTIFY SPECIAL-USE] Logged in a logout * BYE Logging out a OK Logout completed (0.001 + 0.000 secs). closed I have the problem with different Thunderbird installations on various operating systems (Windows 10, Fedora Linux 36 XFCE). Regards, Meikel

10 13

Bug report: TLS SNI for LDAP userdb/passdb
by Tobias Wolter 18 Sep '22

18 Sep '22

Cheers, Dovecot 2.3.4.1 (Debian stable) here, and the changelog does not offer any hope of salvation, so a bug report it is. The LDAP connections for userdb/passdb do not support SNI via TLS. Simple construct to reproduce this: 0.) Have a.pem with SAN `foo.example.com`, b.pem with `bar.example.com` 1.) Configure haproxy frontend with `bind *:636 ssl crt /foo/a.pem ssl crt /foo/b.pem` 2.) Try to use ldaps://bar.example.com/ in passdb, receive "auth: Error: LDAP: Can't connect to server: ldaps://bar.example.com" Expectation, of course, would be for this to work; most libraries should support it, it's probably just a matter of convincing the appropriate binding. Kind regards, -towo

4 4

Client for a Windows User ?
by White, Daniel E. (GSFC-770.0)[AEGIS] 13 Sep '22

13 Sep '22

Specifically, Windows 2016 server I suggested Thunderbird. Is there anything else ? Is this current ? https://wiki.dovecot.org/Clients

6 6

Overquota flag and auth caching
by Christian Rößner 13 Sep '22

13 Sep '22

Hello, I like the over quota flag mechanism in Dovecot. I found out that I get in trouble if a user gets over quota and I have turned on auth caching, because the cache does not automatically invalidate a user while toggling the flag. The cache still serves the old state. The result is that mails are still accepted, even a user went over quota resulting in bounces. Workaround is to flush a user from inside the toggle script, which solves the bounce problem, but it prevents the user from getting under quota before the user is flushed from the cache again. What is the correct way to use the over quota flag and which solutions can be taken to invalidate the user? Is it possible to do this in a Lua user backend? Any other method? Thanks in advance Christian Rößner -- Rößner-Network-Solutions Zertifizierter ITSiBe / CISO Karl-Bröger-Str. 10, 36304 Alsfeld Fax: +49 6631 78823409, Mobil: +49 171 9905345 USt-IdNr.: DE225643613, https://roessner.website PGP fingerprint: 658D 1342 B762 F484 2DDF 1E88 38A5 4346 D727 94E5

2 1

Re: Sieve Symlink Creation
by dovecot＠ptld.com 13 Sep '22

13 Sep '22

> On 09-12-2022 12:16 pm, hi(a)zakaria.website wrote: > > It seems that dovecot doesn't understand the relative format and requires absolute format, per the documentation example. Perhaps find the code which parses the absolute path, and compile your own dovecot build, which can understand the path format you want? I did not find that. I want to learn more, can you link me the dovecot documentation you found explaining how absolute paths are required for sieve? > On 2022-08-25 13:32, dovecot(a)ptld.com wrote: >> The first time when the sieve files and folders get created, the active symlink is created as a full absolute path >> >> .active_sieve -> /mnt/email/domain/user/_sieve/filters.sieve >> >> After that, if you disable and enable the rule set the symlink gets recreated as relative >> >> .active_sieve -> filters.sieve >> >> How can i have the symlink always created as a relative path even on first time creation? >> Having a full absolute path over a mounted NSF is fragile. >> >> Dovecot 2.3.16 >> Pigeonhole 2.3.16 >> >> mail_home = /mnt/email/%d/%n/_dovecot >> mail_location = maildir:/mnt/email/%d/%n/_folders:INDEX=/mnt/email/%d/%n/_dovecot:CONTROL=/mnt/email/%d/%n/_dovecot >> plugin { >> sieve = file:~/../_sieve;active=~/../_sieve/.active_sieve >> sieve_max_script_size = 1M >> sieve_max_actions = 32 >> sieve_max_redirects = 4 >> sieve_quota_max_scripts = 20 >> sieve_quota_max_storage = 5M >> sieve_vacation_min_period = 1d >> sieve_vacation_use_original_recipient = no >> sieve_vacation_dont_check_recipient = no >> sieve_vacation_send_from_recipient = no >> sieve_redirect_envelope_from = sender >> sieve_user_email = %u >> }

2 1

real duplicates of some e-mails / dovecot-2.3.19
by Götz Reinicke 13 Sep '22

13 Sep '22

Hi, we have the issue, that some(!) e-mails we receive are duplicated when processed by dovecot and stored to the users inbox. The mails are binary identical, same message ID, same size etc. diff sees no difference …. For now we only see that it happens do small mails max. +- 5k in size. And in dose not happen for all mails, but some are spam, some are internal mails some are newsletter which are expected…. and it happens for different users. Dose anyone have/had a similar issue? Any suggestion or idea would be helpful. Thanks . Götz

2 1

Handling imap from outlook 365
by Todd Krein 12 Sep '22

12 Sep '22

I apologize if this has been answered before, but... Microsoft Outlook 365 doesn't allow a user to specify the account name for an imap acout, only the email address. Thus fred(a)smith.com<mailto:fred@smith.com> tries to log in as "fred(a)smith.com<mailto:fred@smith.com>" rather than "fred". Has anyone seen a way to fix this (Microsoft help boards are silent), perhaps by stripping the "@smith.com" during the logon procedure? Thanks, Todd Todd Krein | VP Hardware o:650.566.6657 m:408.857.0556 [Ooma_email_sig_11_ooma.jpg] ooma.com<http://ooma.com> _______________________________________ Ooma Confidential and Proprietary (including attachments if any)

3 2

Outlook 365 (RE: dovecot Digest, Vol 233, Issue 20)
by Todd Krein 12 Sep '22

12 Sep '22

Emilio, Thanks for the suggestions, but neither of these worked for me. Manual setup on Outlook 365 (I think as opposed to Outlook 202x), doesn't let you set the account name directly. It's being "helpful." Interestingly enough, if you set up as POP3, it realizes the account name is wrong and lets you enter it once you try to sync. Not so with IMAP. I was able to create the new account on the control panel, but outlook365 ignores all those accounts. Cheers, Todd -----Original Message----- ---------------------------------------------------------------------- Message: 1 Date: Sun, 11 Sep 2022 01:53:21 -0400 From: Emilio Augusto Lazo Zaia <emiliolazozaia(a)gmail.com> To: dovecot(a)dovecot.org Subject: Re: Solved (RE: Handling imap from outlook 365) Message-ID: <5eb6d25f-f9a9-88c5-db01-9306d0925a9c(a)gmail.com> Content-Type: text/plain; charset="utf-8"; Format="flowed" Manual setup or go to Windows Control Panel, Mail / Outlook section and the new account dialog should be like earlier versions of Office... hth Emilio Augusto Lazo Zaia On 9/9/22 16:18, Todd Krein wrote: > > (Sorry for the format, not sure how to reply to a single email in a > digest) > > ?[HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\setup] > > "DisableOffice365SimplifiedAccountCreation"=dword:00000001 > > and then chosen manual setup?? That lets us specify 'fred' as the username. > > Ken > > ? > > Ken, > > ????????????? OMG, you are a godsend. Yes, that fixed it completely! > > ????????????? Where do I send the beer? > > ????????????? Best regards, > > ????????????? Todd > > *Todd Krein *| VP Hardware > > o:650.566.6657 ? m:408.857.0556 > > Ooma_email_sig_11_ooma.jpg > > ooma.com <http://ooma.com> > > _______________________________________ > > Ooma Confidential and Proprietary (including attachments if any) >

1 0

Solved (RE: Handling imap from outlook 365)
by Todd Krein 11 Sep '22

11 Sep '22

(Sorry for the format, not sure how to reply to a single email in a digest) "[HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\setup] "DisableOffice365SimplifiedAccountCreation"=dword:00000001 and then chosen manual setup? That lets us specify 'fred' as the username. Ken " Ken, OMG, you are a godsend. Yes, that fixed it completely! Where do I send the beer? Best regards, Todd Todd Krein | VP Hardware o:650.566.6657 m:408.857.0556 [Ooma_email_sig_11_ooma.jpg] ooma.com<http://ooma.com> _______________________________________ Ooma Confidential and Proprietary (including attachments if any)

2 1

Unclear how to get both user and domain quotas to work
by Hans van Zijst 10 Sep '22

10 Sep '22

Hi, First of all: my apologies for this long message. I'm trying to post all the information anybody could need to help me on my way. What I'm trying to make is an installation where both users and domains can have quotas. Ideally I would configure a quota for a domain and set a quota of 0 for all users within that domain, so that mail will be accepted up to the point where the domain quota is reached. Setting up user quota was fairly easy, there's lots of documentation around and examples to take inspiration from. Not so much for domain quota however, or I'm really bad at searching the Net. I'm running Debian Bullseye here: MariaDB 10.5.12 Dovecot 2.3.13 Postfixadmin 3.3.10 I want to use dictionaries in MySQL, because eventually this will be a platform with several Dovecot and Postfix servers. At this time I'm only running one Dovecot installation and a few Postfix servers (two for communication with the outside world and one to do the virus and spam scanning). My current setup for user quota is how Postfixadmin wants it: MariaDB [postfixadmin]> desc quota2; +----------+--------------+------+-----+---------+-------+ | Field | Type | Null | Key | Default | Extra | +----------+--------------+------+-----+---------+-------+ | username | varchar(100) | NO | PRI | NULL | | | bytes | bigint(20) | NO | | 0 | | | messages | int(11) | NO | | 0 | | +----------+--------------+------+-----+---------+-------+ 3 rows in set (0.001 sec) In /etc/dovecot/conf.d/90-quota.conf I have this: plugin { quota = dict:User quota::proxy::sqlquota quota_rule = *:bytes=1024M quota_rule2 = Trash:bytes=+100M quota_vsizes = yes quota_status_success = DUNNO quota_status_nouser = DUNNO quota_status_overquota = "552 5.2.2 Mailbox is full" } dict { sqlquota = mysql:/etc/dovecot/dovecot-dict-sql.conf.ext } The SQL-configuration /etc/dovecot/dovecot-dict-sql.conf.ext is this: connect = host=... dbname=... user=... password=... map { pattern = priv/quota/storage table = quota2 username_field = username value_field = bytes } map { pattern = priv/quota/messages table = quota2 username_field = username value_field = messages } map { pattern = shared/expire/$user/$mailbox table = expires value_field = expire_stamp fields { username = $user mailbox = $mailbox } } I use LMTP to accept mail from Postfix; the quota-plugin is activated for LMTP, so every incoming mail should be counted. This works like a charm: if I don't configure a quota for a user, he gets the default 1GB, if I override it in Postfixadmin, then that's what he gets. I'm running quota-status on a TCP-port, so the gateway SMTP-servers can connect to Dovecot for a quotacheck to decide whether to accept or reject an incoming message. Again, this works flawlessly. I can't find any serious documentation about this mapping thing. In particular, what's with that "pattern"? All I can find in the documentation is: "The dict key must match exactly priv/quota/storage. The dict keys are hardcoded in the Dovecot code, so depending on what functionality you’re configuring you need to know the available dict keys used it." -- https://doc.dovecot.org/configuration_manual/dict/#dict-sql If anyone can point me at better documentation than the actual source code: please! I browsed through the quota-plugin source code, but I'm not a programmer and couldn't find what I thought I was looking for. That said, I'm not sure where I got the third "map" from, with the shared/expire pattern. I seem to have forgotten to document that bit of my journey. Now, domain quotas... I've tried all kinds of stuff, but at the moment I'm stuck with something that seems to almost work. I added a second quota root: plugin { quota2 = dict:Domain quota:%d:proxy::sqldomainquota quota2_rule = *:bytes=1024M quota2_status_success = DUNNO quota2_status_nouser = DUNNO quota2_status_overquota = "552 5.2.2 Domain quota exceeded" quota2_vsizes = yes } dict { sqldomainquota = mysql:/etc/dovecot/dovecot-dict-sql.conf.ext } This dict refers to the same mapping as the one for user quotas, and I think that's the way it should be. Please correct me if I'm wrong. This creates a new user in the quota2 table, by the name of just the domain. Unfortunately, it simply fills it with the numbers from the first user it can find in that domain, not all users in that domain combined. What I think I should do, is change something in the dict so that it sums up all users in that domain, something like this: SELECT SUM(bytes) FROM quota2 WHERE username LIKE '%@domain'; Problem is that I can't find anything useful online with regards to this, I'm not even sure if I'm thinking in the right direction here. Any hints, suggestions or corrections? Or pointers to articles or documentation I might have missed? Kind regards, Hans

2 1