January 2023 - dovecot

17 Jan '23

Hello Everybody, just a short question, maybe someone used this plugin and can give me a short answer. I have configured dovecot Quota Clone Plugin to copy quota information into a MySQL Database. Works finde, but dovecot writes the quota information only to the database if the quota is triggert by new email or something else like this. So I don't have all my user in the MySQL Database. Is there any command I can use that can trigger dovecot to write the quota information of all the users to the database one time, so that I have all my user quota information copied in the database? I have tried "doveadm quota recalc -A" but it took quite a long time and there is a very high I/O Load on the server, so I stopped it. I don't think this is what I want to do. Maybe there is another way. For all of you who don't know this plugin. https://doc.dovecot.org/configuration_manual/quota_clone_plugin/ Greetings, Oliver

3 3

hostname in director_mail_servers setting
by k v 16 Jan '23

16 Jan '23

director_mail_servers setting uses IP Adresses as values https://doc.dovecot.org/settings/core/#core_setting-director_mail_servers As described in the documentation, hostnames are converted to addresses when the configuration is read https://doc.dovecot.org/settings/types/#ip-addresses This is acceptable in host or virtual machine environment, but becomes a problem in a containerized environment. When any backend container is restarted, its address will change and users related to this backend can no longer connect, but backend (available with new IP address) can process request for example, director_mail_servers = dovecot-1 dovecot-2 dovecot-3 becomes in runtime (with one successfully connectetd user foo(a)example.com) doveadm director status mail server ip tag vhosts state state changed users 10.0.71.3 100 up - 0 10.0.71.4 100 up - 1 10.0.71.5 100 up - 0 where dovecot-1 10.0.71.3, dovecot-2 10.0.71.4, dovecot-3 10.0.71.5 When dovevecot-2 backend container restarts, and becomes new IP address, user can't connect to related backend: imap-login: Info: proxy(foo@example.com,10.0.71.4:143): Started proxying to <10.0.71.4> (<dovecot-2>) (0.009 secs) imap-login: Error: proxy(foo@example.com,10.0.71.4:143): connect(10.0.71.4, 143) failed: No route to host (after 28 secs, 3 reconnects, local=10.0.71.13:41066) My suggestion to developers: resolve backend hostnames to IP address on every request to director_mail_servers It's not about dovemon service with active health checks from dovecot pro, just dynamic hostname resolve

2 1

Error: Mailbox INBOX: file_dotlock_create in directory /var/mail failed: Permission denied
by manmatha 16 Jan '23

16 Jan '23

Hi All, We are running Round cube on top of dovecot and postfix as our email echo system. Main problem we are facing is that, roundcube loads really slow for big inboxes (~5000 emails). I found that, while it loads, imap process goes high in terms of CPU utilization(~90%). I asked it in some roundcube support group, They believe that it is related to dovecot not roundcube. Can you shed any light on this issue. Thanks in advance. Here is $dovecot -n$ output xyz@roundcube-internal-server-1:/etc/dovecot$ dovecot -n # 2.3.16 (7e2e900c1a): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.16 (09c29328) # OS: Linux 5.15.0-1024-kvm x86_64 Ubuntu 22.04.1 LTS # Hostname: roundcube-internal-server-1 auth_mechanisms = plain login disable_plaintext_auth = no listen = * lock_method = dotlock mail_always_cache_fields = date.received mail_cache_min_mail_count = 5000 mail_location = mbox:~/mail:INBOX=/var/mail/%u:INDEX=/var/indexes/isical.ac.in/%n mail_privileged_group = mail mail_sort_max_read_count = 100 mailbox_list_index_include_inbox = yes mailbox_list_index_very_dirty_syncs = yes maildir_very_dirty_syncs = yes mbox_dotlock_change_timeout = 1 mins mbox_lazy_writes = no mbox_write_locks = dotlock fcntl namespace inbox { inbox = yes location = prefix = } passdb { driver = pam } protocols = imap pop3 ssl_cert = </etc/dovecot/private/dovecot.pem ssl_client_ca_dir = /etc/ssl/certs ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { driver = passwd } protocol !indexer-worker { mail_vsize_bg_after_count = 100 } On a different note we are getting error occasionally of the following type. I dont know if they are related. Jan 16 15:36:13 roundcube-internal-server-1 dovecot: imap(xyz)<361270><aqauu17ycsvAqL8/>: Error: unlink(/var/mail/xyz.lock) failed: Permission denied (in file-dotlock.c:195) Jan 16 15:36:13 roundcube-internal-server-1 dovecot: imap(xyz)<361270><aqauu17ycsvAqL8/>: Error: unlink(xyz.lock) failed: Permission denied (in file-dotlock.c:195) Jan 16 15:36:13 roundcube-internal-server-1 dovecot: imap(xyz)<361270><aqauu17ycsvAqL8/>: Error: Mailbox INBOX: file_dotlock_create(xyz) in directory /var/mail failed: Permission denied (euid=10865(xyz) egid=8(mail) missing +w perm: /var/mail, UNIX perms appear ok (ACL/MAC wrong?), dir owned by 0:8 mode=0771)

2 1

Up to date dovecot packages on Ubuntu 22.4LTS
by Gerben Wierda 12 Jan '23

12 Jan '23

I just found out that Ubuntu Linux 22.04 LTS has a dovecot apt package that is 2.3.16. Debian 11 (stable) is at dovecot 2.3.13 with apt. if I looked correctly. Dovecot itself is at 2.3.20. That surprised me (I am new to the Linux distro and package management world) as Ubuntu 22.04 is a Long-Time Support version, and I was expecting packages to be updated as well (as many users will want updated packages. How does that work in the dovecot world? How come macOS MacPorts (2.3.19) has more recent packages than any of the large Debian-based Linuxes? Gerben Wierda (LinkedIn <https://www.linkedin.com/in/gerbenwierda>) R&A IT Strategy <https://ea.rna.nl/> (main site) Book: Chess and the Art of Enterprise Architecture <https://ea.rna.nl/the-book/> Book: Mastering ArchiMate <https://ea.rna.nl/the-book-edition-iii/>

3 2

director: pass different username to proxy than the one that is used for hashing
by alex 12 Jan '23

12 Jan '23

dovecot 2.3.13 Hi, I'm looking for a way to make director use a user@domain that is returned by the database for hashing but actually send the original user@domain in the proxied request. I cannot seem to find a way. I can change the name used for hashing by just returning a different user from the db. but that user is also the one that is send in the proxied request. this is what I have so far: director_username_hash = %L{user} # relevant sql: password_query = SELECT \ username as user, \ # -> this is used for hashing if destuser is not present. = OK NULL as password, \ 'y' as proxy, \ 'y' as nopassword, \ '%n@%d' as destuser \ # -> but as soon as I add this, this is used for hashing = !OK FROM dovecot_data('%n', '%d') Anyone know any clever tricks to accomplish this? Thanks! Alex (background: I've inherited a mail setup where mailboxes have multiple logins. (those all share the same 'home' for their maildirs). I need all of these to go to the same server. Most ideal would be hashing on home '%h' instead of %u :)).

1 0

Living without fdpass / SCM_RIGHTS
by Dengler, Gabriel 10 Jan '23

10 Jan '23

Hello everyone, I wanted to run Dovecot inside Gramine [1]. Gramine is a tool to let normal Linux binaries run with the help of the Intel Software Guard Extensions (SGX) technology [2] in a secure enclave to which the operating system doesn't have an access to. Most parts of Dovecot now run fine, however, Dovecot uses the SCM_RIGHTS flag for the sendmsg system call to exchange file descriptors over Unix sockets [3]. Normally, this feature is available in every Unix, but in Gramine, this is currently not supported [4]. So, according to the logs, the authentication works, but after that, the imap-login process cannot exchange the file descriptor with the imap process. Therefore I wanted to ask if there is a possibility to make Dovecot work without this feature or if this would need fundamental changes in the code structure. Thanks for your help in advance! Best regards, Gabriel References: [1] https://gramineproject.io/ [2] https://de.wikipedia.org/wiki/Software_Guard_Extensions [3] https://github.com/dovecot/core/blob/main/src/lib/fdpass.c#L128 [4] https://github.com/gramineproject/gramine/discussions/1013#discussioncommen…

1 0

Dovecot - mail_crypt - lmtp-server - no password to decrypt the key
by Baljeet Bhinder 09 Jan '23

09 Jan '23

I have been using postfix+dovecot successfully for a while now until I tried mail crypt plugin lately. I tried what is describe here https://doc.dovecot.org/configuration_manual/mail_crypt_plugin/ and I went for global-keys as described here: https://doc.dovecot.org/configuration_manual/mail_crypt_plugin/#global-keys /"A good solution for environments where no user folder sharing is needed is to generate per-user EC key pair and encrypt that with something derived from user’s password."/ I am setting mail_crypt_global_private_key, mail_crypt_global_public_key, mail_crypt_save_version from user_query and userdb_mail_crypt_global_private_key_password from password_query. mail_crypt seems to work fine in imap (I saved a message as draft and it is stored encrypted on the disk), but lmtp complains about "mail_crypt_global_private_key_password unset, no password to decrypt the key" As you can see below in logs that it was able to set all other mail_crypt_ configurations successfully from user_query. However, the password is provided via password_query and I assume lmtp does not read password_query. How else can I provide a password in lmtp? Is my approach correct to begin with? -- Dovecot Configurations -- # using doveconf -n # 2.3.19.1 (9b53102964): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.19 (4eae2f79) # OS: Linux 5.15.0-57-generic x86_64 Ubuntu 20.04.5 LTS # Hostname: mailserver-dovecot-7c9ff7b94b-8ldrr auth_mechanisms = plain login auth_verbose = yes auth_verbose_passwords = yes debug_log_path = /dev/stdout haproxy_trusted_networks = 192.168.0.0/16 10.10.10.0/24 10.10.30.0/24 172.17.0.1/16 hostname = imap.mailserver.k8s.local pop.mailserver.k8s.local info_log_path = /dev/stdout listen = * log_path = /dev/stdout mail_debug = yes mail_gid = 1000 mail_home = /var/vmail/mailboxes/%d/%n mail_location = maildir:~/:LAYOUT=fs mail_plugins = quota mail_crypt mail_privileged_group = mail mail_uid = 1000 managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext imapsieve vnd.dovecot.imapsieve namespace inbox { inbox = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Spam { auto = subscribe autoexpunge = 30 days special_use = \Junk } mailbox Trash { auto = subscribe autoexpunge = 30 days special_use = \Trash } prefix = } passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } plugin { imapsieve_mailbox1_before = file:/var/vmail/sieve/global/learn-spam.sieve imapsieve_mailbox1_causes = COPY APPEND FLAG imapsieve_mailbox1_name = Spam imapsieve_mailbox2_before = file:/var/vmail/sieve/global/learn-ham.sieve imapsieve_mailbox2_causes = COPY APPEND FLAG imapsieve_mailbox2_from = Spam imapsieve_mailbox2_name = * mail_crypt_save_version = 0 quota = maildir:User quota quota_exceeded_message = User %u has exhausted allowed storage space. quota_rule = Junk:ignore quota_rule2 = Trash:storage=+100M quota_warning = storage=90%% quota-warning 90 %u %d quota_warning2 = storage=80%% quota-warning 80 %u %d sieve = file:~/sieve;active=~/.dovecot.sieve sieve_before = /var/vmail/sieve/global/spam-global.sieve sieve_global = /var/vmail/sieve/global/ sieve_global_extensions = +vnd.dovecot.pipe +vnd.dovecot.debug sieve_pipe_bin_dir = /var/vmail/sieve/global sieve_plugins = sieve_imapsieve sieve_extprograms } protocols = " imap lmtp sieve pop3" service auth { inet_listener { port = 25252 } } service imap-login { inet_listener imap { haproxy = yes } inet_listener imaps { haproxy = yes ssl = yes } } service lmtp { executable = lmtp -L inet_listener lmtp { address = 0.0.0.0 port = 24 } } service managesieve-login { inet_listener sieve { port = 4190 } } service pop3-login { inet_listener pop3 { haproxy = yes } inet_listener pop3s { haproxy = yes } } ssl = required ssl_cert = </etc/dovecot/certs/tls.crt ssl_client_ca_dir = /etc/ssl/certs ssl_key = # hidden, use -P to show it ssl_prefer_server_ciphers = yes userdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } protocol lmtp { info_log_path = /dev/stdout log_path = /dev/stdout mail_plugins = quota mail_crypt sieve postmaster_address = <hidden> } protocol imap { mail_plugins = quota mail_crypt quota imap_quota imap_sieve } -- Dovecot Configurations Ends -- -- Password Query -- password_query = \ SELECT username, domain, password, \ '%{sha256:password}' AS userdb_mail_crypt_global_private_key_password \ FROM mailbox \ WHERE username='%u'; -- Password Query Ends-- -- User Query -- user_query = SELECT CONCAT('*:bytes=', 1024) as quota_rule, \ private_key AS mail_crypt_global_private_key, \ public_key AS mail_crypt_global_public_key, \ mail_crypt_save_version AS mail_crypt_save_version \ FROM mailbox \ WHERE username='%u'; -- User Query Ends -- -- Debug Logs -- --- Load Inbox --- imap-login: Info: Login: user=<someone(a)example.com>, method=PLAIN, rip=192.168.49.1, lip=192.168.49.2, mpid=241, TLS, session=<oaoI9sLxVKXAqDEB> imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: Loading modules from directory: /usr/lib/dovecot/modules imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: Module loaded: /usr/lib/dovecot/modules/lib10_mail_crypt_plugin.so imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: Module loaded: /usr/lib/dovecot/modules/lib10_quota_plugin.so imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: Module loaded: /usr/lib/dovecot/modules/lib11_imap_quota_plugin.so imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: Module loaded: /usr/lib/dovecot/modules/lib95_imap_sieve_plugin.so imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: Added userdb setting: plugin/mail_crypt_global_private_key=LS0tLS1CRUd.....LS0tLS0K imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: Added userdb setting: plugin/mail_crypt_global_private_key_password=<hidden> imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: Added userdb setting: plugin/mail_crypt_global_public_key=LS0tLS1CRUd.....LS0tCg== imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: Added userdb setting: plugin/mail_crypt_save_version=2 imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: Added userdb setting: plugin/quota_rule=*:bytes=1024000000 imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: Effective uid=1000, gid=1000, home=/var/vmail/mailboxes/example.com/someone imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: mail_crypt_plugin: mail_crypt_curve setting missing - generating EC keys disabled imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: Quota root: name=User quota backend=maildir args= imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: Quota rule: root=User quota mailbox=* bytes=1024000000 messages=0 imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: Quota rule: root=User quota mailbox=Trash bytes=+104857600 messages=0 imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: Quota warning: bytes=921600000 (90%) messages=0 reverse=no command=quota-warning 90 someone(a)example.com example.com imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: Quota warning: bytes=819200000 (80%) messages=0 reverse=no command=quota-warning 80 someone(a)example.com example.com imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: Quota grace: root=User quota bytes=102400000 (10%) imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: open(/proc/self/io) failed: Permission denied imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: Namespace inbox: type=private, prefix=, sep=, inbox=yes, hidden=no, list=yes, subscriptions=yes location=maildir:~/:LAYOUT=fs imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: fs: root=/var/vmail/mailboxes/example.com/someone, index=, indexpvt=, control=, inbox=/var/vmail/mailboxes/example.com/someone, alt= imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: quota: quota_over_flag check: quota_over_script unset - skipping imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: Mailbox INBOX: Mailbox opened --- Load Inbox Ends --- --- Lmtp --- lmtp(248): Info: Connect from 172.17.0.1 lmtp(someone(a)example.com)<248><e2dcD6TuumP4AAAALzF/Qw>: Debug: auth-master: userdb lookup(someone(a)example.com): Started userdb lookup lmtp(someone(a)example.com)<248><e2dcD6TuumP4AAAALzF/Qw>: Debug: auth-master: conn unix:/var/run/dovecot/auth-userdb: Connecting lmtp(someone(a)example.com)<248><e2dcD6TuumP4AAAALzF/Qw>: Debug: auth-master: conn unix:/var/run/dovecot/auth-userdb (pid=143,uid=0): Client connected (fd=18) imap(someone(a)example.com)<247><WlggG8PxEOvAqDEB>: Debug: Mailbox Sent: Purging (new file_seq=1673195172): creating cache imap(someone(a)example.com)<247><WlggG8PxEOvAqDEB>: Debug: Mailbox Sent: Purging finished, file_seq changed 0 -> 1673195172, size=0 -> 388, max_uid=0 lmtp(someone(a)example.com)<248><e2dcD6TuumP4AAAALzF/Qw>: Debug: auth-master: userdb lookup(someone(a)example.com): auth USER input: someone(a)example.com quota_rule=*:bytes=1024000000 mail_crypt_global_private_key=LS0tLS1CRUd.....LS0tLS0K mail_crypt_global_public_key=LS0tLS1CRUd.....LS0tCg== mail_crypt_save_version=2 lmtp(someone(a)example.com)<248><e2dcD6TuumP4AAAALzF/Qw>: Debug: auth-master: userdb lookup(someone(a)example.com): Finished userdb lookup (username=someone(a)example.com quota_rule=*:bytes=1024000000 mail_crypt_global_private_key=LS0tLS1CRUd.....LS0tLS0K mail_crypt_global_public_key=LS0tLS1CRUd.....LS0tCg== mail_crypt_save_version=2) lmtp(someone(a)example.com)<248><e2dcD6TuumP4AAAALzF/Qw>: Debug: lmtp-server: conn 172.17.0.1:6376 [1]: rcpt someone(a)example.com: Added userdb setting: plugin/mail_crypt_global_private_key=LS0tLS1CRUd.....LS0tLS0K imap(someone(a)example.com)<247><WlggG8PxEOvAqDEB>: Debug: duplicate db: Initialize lmtp(someone(a)example.com)<248><e2dcD6TuumP4AAAALzF/Qw>: Debug: lmtp-server: conn 172.17.0.1:6376 [1]: rcpt someone(a)example.com: Added userdb setting: plugin/mail_crypt_global_public_key=LS0tLS1CRUd.....LS0tCg== imap(someone(a)example.com)<247><WlggG8PxEOvAqDEB>: Debug: sieve: Pigeonhole version 0.5.19 (4eae2f79) initializing lmtp(someone(a)example.com)<248><e2dcD6TuumP4AAAALzF/Qw>: Debug: lmtp-server: conn 172.17.0.1:6376 [1]: rcpt someone(a)example.com: Added userdb setting: plugin/mail_crypt_save_version=2 lmtp(someone(a)example.com)<248><e2dcD6TuumP4AAAALzF/Qw>: Debug: lmtp-server: conn 172.17.0.1:6376 [1]: rcpt someone(a)example.com: Added userdb setting: plugin/quota_rule=*:bytes=1024000000 lmtp(someone(a)example.com)<248><e2dcD6TuumP4AAAALzF/Qw>: Debug: lmtp-server: conn 172.17.0.1:6376 [1]: rcpt someone(a)example.com: Effective uid=1000, gid=1000, home=/var/vmail/mailboxes/example.com/someone lmtp(someone(a)example.com)<248><e2dcD6TuumP4AAAALzF/Qw>: Debug: lmtp-server: conn 172.17.0.1:6376 [1]: rcpt someone(a)example.com: mail_crypt_plugin: mail_crypt_curve setting missing - generating EC keys disabled lmtp(someone(a)example.com)<248><e2dcD6TuumP4AAAALzF/Qw>: Debug: lmtp-server: conn 172.17.0.1:6376 [1]: rcpt someone(a)example.com: Quota root: name=User quota backend=maildir args= lmtp(someone(a)example.com)<248><e2dcD6TuumP4AAAALzF/Qw>: Debug: lmtp-server: conn 172.17.0.1:6376 [1]: rcpt someone(a)example.com: Quota rule: root=User quota mailbox=* bytes=1024000000 messages=0 lmtp(someone(a)example.com)<248><e2dcD6TuumP4AAAALzF/Qw>: Debug: lmtp-server: conn 172.17.0.1:6376 [1]: rcpt someone(a)example.com: Quota rule: root=User quota mailbox=Trash bytes=+104857600 messages=0 lmtp(someone(a)example.com)<248><e2dcD6TuumP4AAAALzF/Qw>: Debug: lmtp-server: conn 172.17.0.1:6376 [1]: rcpt someone(a)example.com: Quota warning: bytes=921600000 (90%) messages=0 reverse=no command=quota-warning 90 someone(a)example.com example.com lmtp(someone(a)example.com)<248><e2dcD6TuumP4AAAALzF/Qw>: Debug: lmtp-server: conn 172.17.0.1:6376 [1]: rcpt someone(a)example.com: Quota warning: bytes=819200000 (80%) messages=0 reverse=no command=quota-warning 80 someone(a)example.com example.com lmtp(someone(a)example.com)<248><e2dcD6TuumP4AAAALzF/Qw>: Debug: lmtp-server: conn 172.17.0.1:6376 [1]: rcpt someone(a)example.com: Quota grace: root=User quota bytes=102400000 (10%) lmtp(248): Error: lmtp-server: conn 172.17.0.1:6376 [1]: rcpt someone(a)example.com: Failed to initialize user: mail_crypt_plugin: mail_crypt_global_private_key: mail_crypt_global_private_key_password unset, no password to decrypt the key lmtp(248): Info: Disconnect from 172.17.0.1: Logged out (state=READY) --- Lmtp Ends --- -- Debug Logs Ends -- Thanks Baljeet Bhinder

3 3

Keycloak Authorization Code Flow
by Gary Horchem 08 Jan '23

08 Jan '23

Can dovecot use Keycloak Authorization Code Flow? I would like to use it instead of Password Resource Grant Flow for better security. Sent from my iPhone

1 0

How to set otp one time password
by weihao.chen＠artisantechnologies.cn 07 Jan '23

07 Jan '23

Dear Everybody: May I ask how to configure dovecot otp one-time verification login, that is, after the user logs in to the mailbox with the password + otp, he can send and receive emails without entering the password + otp again? # This is my settings: # /etc/dovecot/conf.d/10-auth.conf disable_plaintext_auth = yes auth_cache_size = 10M auth_failure_delay = 5 secs auth_ssl_username_from_cert = yes auth_mechanisms = otp !include auth-ldap.conf.ext error logs: ------------------------------- 6952-Jan 06 18:03:01 master: Info: Dovecot v2.3.19.1 (9b53102964) starting up for imap, lmtp (core dumps disabled) 6953-Jan 06 18:03:02 auth: Debug: Loading modules from directory: /usr/lib/dovecot/auth 6954-Jan 06 18:03:02 auth: Debug: Module loaded: /usr/lib/dovecot/auth/lib20_auth_var_expand_crypt.so 6955:Jan 06 18:03:02 auth: Fatal: OTP mechanism can't be supported with given passdbs 6956-Jan 06 18:03:02 master: Error: service(auth): command startup failed, throttling for 2.000 secs 6957-Jan 06 18:03:02 imap-login: Info: Disconnected: Auth process broken (disconnected before auth was ready, waited 0 secs): user=<>, rip=172.30.20.51, lip=172.16.5.111, TLS handshaking, session=<OiDkhZXx7fasHhQz> 6958-Jan 06 18:03:07 auth: Debug: Loading modules from directory: /usr/lib/dovecot/auth 6959-Jan 06 18:03:07 auth: Debug: Module loaded: /usr/lib/dovecot/auth/lib20_auth_var_expand_crypt.so 6960:Jan 06 18:03:07 auth: Fatal: OTP mechanism can't be supported with given passdbs 6961-Jan 06 18:03:07 master: Error: service(auth): command startup failed, throttling for 4.000 secs 6962-Jan 06 18:03:07 imap-login: Info: Disconnected: Auth process broken (disconnected before auth was ready, waited 0 secs): user=<>, rip=172.30.20.51, lip=172.16.5.111, TLS handshaking, session=<qgIyhpXx8PasHhQz> 6963-Jan 06 18:03:11 auth: Debug: Loading modules from directory: /usr/lib/dovecot/auth 6964-Jan 06 18:03:11 auth: Debug: Module loaded: /usr/lib/dovecot/auth/lib20_auth_var_expand_crypt.so 6965:Jan 06 18:03:11 auth: Fatal: OTP mechanism can't be supported with given passdbs 6966-Jan 06 18:03:11 master: Error: service(auth): command startup failed, throttling for 8.000 secs 6967-Jan 06 18:03:11 imap-login: Info: Disconnected: Auth process broken (disconnected before auth was ready, waited 3 secs): user=<>, rip=172.30.20.51, lip=172.16.5.111, TLS, session=<gDdvhpXx8/asHhQz> 6968-Jan 06 18:03:19 auth: Debug: Loading modules from directory: /usr/lib/dovecot/auth 6969-Jan 06 18:03:19 auth: Debug: Module loaded: /usr/lib/dovecot/auth/lib20_auth_var_expand_crypt.so 6970:Jan 06 18:03:19 auth: Fatal: OTP mechanism can't be supported with given passdbs 6971-Jan 06 18:03:19 master: Error: service(auth): command startup failed, throttling for 16.000 secs 6972-Jan 06 18:03:19 imap-login: Info: Disconnected: Auth process broken (disconnected before auth was ready, waited 8 secs): user=<>, rip=172.30.20.51, lip=172.16.5.111, TLS, session=<qp7phpXx9PasHhQz> 6973-Jan 06 18:03:29 imap-login: Info: Disconnected: Connection closed (disconnected before auth was ready, waited 5 secs): user=<>, rip=172.30.20.51, lip=172.16.5.111, TLS, session=<N1qAh5Xx/PasHhQz> 6974-Jan 06 18:03:35 auth: Debug: Loading modules from directory: /usr/lib/dovecot/auth 6975-Jan 06 18:03:35 auth: Debug: Module loaded: /usr/lib/dovecot/auth/lib20_auth_var_expand_crypt.so 6976:Jan 06 18:03:35 auth: Fatal: OTP mechanism can't be supported with given passdbs 6977-Jan 06 18:03:35 master: Error: service(auth): command startup failed, throttling for 32.000 secs 6978-Jan 06 18:04:01 master: Warning: Killed with signal 15 (by pid=2692494 uid=0 code=kill) 6979-Jan 06 18:04:02 master: Info: Dovecot v2.3.19.1 (9b53102964) starting up for imap, lmtp (core dumps disabled) 6980-Jan 06 18:04:09 auth: Debug: Loading modules from directory: /usr/lib/dovecot/auth 6981-Jan 06 18:04:09 auth: Debug: Module loaded: /usr/lib/dovecot/auth/lib20_auth_var_expand_crypt.so 6982:Jan 06 18:04:09 auth: Fatal: OTP mechanism can't be supported with given passdbs 6983-Jan 06 18:04:09 master: Error: service(auth): command startup failed, throttling for 2.000 secs 6984-Jan 06 18:04:09 imap-login: Info: Disconnected: Auth process broken (disconnected before auth was ready, waited 0 secs): user=<>, rip=172.30.20.51, lip=172.16.5.111, TLS handshaking, session=<8VrsiZXxFfesHhQz> 6985-Jan 06 18:04:56 auth: Debug: Loading modules from directory: /usr/lib/dovecot/auth 6986-Jan 06 18:04:56 auth: Debug: Module loaded: /usr/lib/dovecot/auth/lib20_auth_var_expand_crypt.so 6987:Jan 06 18:04:56 auth: Fatal: OTP mechanism can't be supported with given passdbs 6988-Jan 06 18:04:56 master: Error: service(auth): command startup failed, throttling for 4.000 secs 6989-Jan 06 18:05:57 auth: Debug: Loading modules from directory: /usr/lib/dovecot/auth 6990-Jan 06 18:05:57 auth: Debug: Module loaded: /usr/lib/dovecot/auth/lib20_auth_var_expand_crypt.so 6991:Jan 06 18:05:57 auth: Fatal: OTP mechanism can't be supported with given passdbs 6992-Jan 06 18:05:57 master: Error: service(auth): command startup failed, throttling for 8.000 secs 6993-Jan 06 18:06:26 master: Warning: Killed with signal 15 (by pid=2692680 uid=0 code=kill) 6994-Jan 06 18:06:27 log(2692602): Warning: Killed with signal 15 (by pid=1 uid=0 code=kill) 6995-Jan 06 18:06:27 master: Info: Dovecot v2.3.19.1 (9b53102964) starting up for imap, lmtp (core dumps disabled) 6996-Jan 06 18:06:47 auth: Debug: Loading modules from directory: /usr/lib/dovecot/auth 6997-Jan 06 18:06:47 auth: Debug: Module loaded: /usr/lib/dovecot/auth/lib20_auth_var_expand_crypt.so 6998-Jan 06 18:06:47 auth: Debug: Read auth token secret from /var/run/dovecot//auth-token-secret.dat 6999-Jan 06 18:06:47 auth: Error: ldap_bind 7000-Jan 06 18:06:47 auth: Error: ldap_simple_bind 7001-Jan 06 18:06:47 auth: Error: ldap_sasl_bind ------------------------------- if option: auth_mechanisms = plain login Can send and receive emails successfully, but when the otp time expires, you need to re-enter the password + otp, which is unacceptable to the user Looking forward to your reply, Tanks -- nick(Weihao) weihao.chen(a)artisantechnologies.cn

2 1

postfix connects to dovecot lmtp socket, but nothing is delivered
by Gerben Wierda 05 Jan '23

05 Jan '23

I am setting up a new server combination (postfix + dovecot). dovecot's auth service works for postfix. Just lmtp does not and I need to find out why. I don't see anything in the dovecot logging, but I see this on the postfix side (debug) Jan 05 16:11:59 snape postfix/lmtp[127]: connection established Jan 05 16:11:59 snape postfix/lmtp[127]: master_notify: status 0 Jan 05 16:11:59 snape postfix/lmtp[127]: deliver_request_initial: send initial response Jan 05 16:11:59 snape postfix/lmtp[127]: send attr protocol = delivery_request_protocol Jan 05 16:16:59 snape postfix/lmtp[126]: smtp_get: timeout Jan 05 16:16:59 snape postfix/lmtp[126]: connect to subsystem private/defer Jan 05 16:16:59 snape postfix/lmtp[126]: private/defer socket: wanted attribute: protocol Jan 05 16:16:59 snape postfix/lmtp[126]: input attribute name: protocol Jan 05 16:16:59 snape postfix/lmtp[126]: input attribute value: delivery_status_protocol Jan 05 16:16:59 snape postfix/lmtp[126]: private/defer socket: wanted attribute: (list terminator) Jan 05 16:16:59 snape postfix/lmtp[126]: input attribute name: (end) Jan 05 16:16:59 snape postfix/lmtp[126]: send attr nrequest = 0 Jan 05 16:16:59 snape postfix/lmtp[126]: send attr flags = 0 Jan 05 16:16:59 snape postfix/lmtp[126]: send attr queue_id = C71B3D1262 Jan 05 16:16:59 snape postfix/lmtp[126]: send attr original_recipient = sysbh(a)rna.nl Jan 05 16:16:59 snape postfix/lmtp[126]: send attr recipient = sysbh(a)rna.nl Jan 05 16:16:59 snape postfix/lmtp[126]: send attr offset = 18446744073709551615 Jan 05 16:16:59 snape postfix/lmtp[126]: send attr dsn_orig_rcpt = rfc822;sysbh(a)rna.nl Jan 05 16:16:59 snape postfix/lmtp[126]: send attr notify_flags = 0 Jan 05 16:16:59 snape postfix/lmtp[126]: send attr status = 4.4.2 Jan 05 16:16:59 snape postfix/lmtp[126]: send attr diag_type = Jan 05 16:16:59 snape postfix/lmtp[126]: send attr diag_text = Jan 05 16:16:59 snape postfix/lmtp[126]: send attr mta_type = Jan 05 16:16:59 snape postfix/lmtp[126]: send attr mta_mname = Jan 05 16:16:59 snape postfix/lmtp[126]: send attr action = delayed Jan 05 16:16:59 snape postfix/lmtp[126]: send attr reason = conversation with snape.rna.nl[private/lmtp] timed out while receiving the initial server greeting Jan 05 16:16:59 snape postfix/lmtp[126]: private/defer socket: wanted attribute: status Jan 05 16:16:59 snape postfix/lmtp[126]: input attribute name: status Jan 05 16:16:59 snape postfix/lmtp[126]: input attribute value: 0 Jan 05 16:16:59 snape postfix/lmtp[126]: private/defer socket: wanted attribute: (list terminator) Jan 05 16:16:59 snape postfix/lmtp[126]: input attribute name: (end) Jan 05 16:16:59 snape postfix/lmtp[126]: C71B3D1262: to=<sysbh(a)rna.nl>, relay=snape.rna.nl[private/lmtp], delay=300, delays=0.02/0/300/0, dsn=4.4.2, status=deferred (conversation with snape.rna.nl[private/lmtp] timed out while receiving the initial server greeting) Jan 05 16:16:59 snape postfix/lmtp[126]: flush_add: site rna.nl id C71B3D1262 Jan 05 16:16:59 snape postfix/lmtp[126]: match_list_match: rna.nl: no match Jan 05 16:16:59 snape postfix/lmtp[126]: flush_add: site rna.nl id C71B3D1262 status 4 Jan 05 16:16:59 snape postfix/lmtp[126]: deliver_request_final: send: "conversation with snape.rna.nl[private/lmtp] timed out while receiving the initial server greeting" -1 Jan 05 16:16:59 snape postfix/lmtp[126]: send attr status = 4.4.2 Jan 05 16:16:59 snape postfix/lmtp[126]: send attr diag_type = Jan 05 16:16:59 snape postfix/lmtp[126]: send attr diag_text = Jan 05 16:16:59 snape postfix/lmtp[126]: send attr mta_type = Jan 05 16:16:59 snape postfix/lmtp[127]: master_notify: status 1 Jan 05 16:16:59 snape postfix/lmtp[126]: send attr mta_mname = Jan 05 16:16:59 snape postfix/lmtp[127]: connection closed Jan 05 16:16:59 snape postfix/lmtp[126]: send attr action = Jan 05 16:16:59 snape postfix/lmtp[126]: send attr reason = conversation with snape.rna.nl[private/lmtp] timed out while receiving the initial server greeting Jan 05 16:16:59 snape postfix/lmtp[126]: send attr status = 4294967295 Jan 05 16:16:59 snape postfix/lmtp[126]: master_notify: status 1 Jan 05 16:16:59 snape postfix/lmtp[126]: connection closed It seems dovecot doesn't react to whatever postfix is doing on the socket. Another possibility is that the socket doesn't really work and dovecot never gets a connection request. How can I debug this? Might I test if the socket is the problem by running lmtp on the dovecot side on TCP on 127.0.0.1 and have postfix use that? Just to see if it works? If so, how do I tell postfix to do that? In dovecot I have added the tcp: service lmtp { inet_listener lmtp { address = 127.0.0.1 port = 24 } unix_listener /var/spool/postfix/private/lmtp { mode = 0660 user = postfix group = postfix } } service lmtp { executable = lmtp -L } protocol lmtp { info_log_path = /var/log/mail/dovecot-lmtp.log } Any other tips? Gerben Wierda (LinkedIn <https://www.linkedin.com/in/gerbenwierda>) R&A IT Strategy <https://ea.rna.nl/> (main site) Book: Chess and the Art of Enterprise Architecture <https://ea.rna.nl/the-book/> Book: Mastering ArchiMate <https://ea.rna.nl/the-book-edition-iii/>

4 8