February 2023 - dovecot

Can I encrypt already existant unencrypted mail before I start using the mail-crypt plugin?
by mailinglist-subscriptions 23 Feb '23

23 Feb '23

Hi, I am using dovecot 2.3.16, along with postfix and a PostgreSQL database for managing virtual accounts. I'd like to start using the mail-crypt plugin. However, I'm having a bit some difficulty understanding the documentation at https://doc.dovecot.org/configuration_manual/mail_crypt_plugin to reach my goal. I plan to ask questions about those issues by starting new threads in this mailing list. But before I even come to that, I'd like to investigate the following: The above documentation only addresses a clean install and doesn't seem to mention encrypting already existent unencrypted mails, like my server has. Is it possible to encrypt those before I start using the mail-crypt plugin, such that it will be able to decrypt those messages as well? If it is, I am assuming that how I would go about achieving that will be very dependent on the ultimate configuration I have in mind (pub/priv keys, etc.). So I don't expect a full-fledged guide. However, if you could perhaps give a general overview of what would be needed to achieve this, I would very much appreciate that. Thank you.

4 4

Re: Auth-worker, unknown scheme ARGON2ID
by James Brown 22 Feb '23

22 Feb '23

On 21 Feb 2023, at 10:12 pm, James Brown <jlbrown(a)bordo.com.au> wrote: > > The new one has Dovecot compiled with same configure options, same configuration files, but fails to authenticate: > > Feb 21 21:51:03 master: Info: Dovecot v2.3.20 (80a5ac675d) starting up for imap, pop3 (core dumps disabled) > Feb 21 21:51:33 auth-worker(11701): Error: conn unix:auth-worker (uid=214): auth-worker<1>: sql(jlbrown@bordo.com.au,::1,<bRgbkDP2udEBAAAAAAAAAAAAAAAAAAB>): Unknown scheme ARGON2ID > > ./configure --with-ssl=openssl --with-mysql > > Was what I used to compile. > > Using OpenSSL 3.0.8. New server is running macOS 13.2.1 Ventura. > > (Have also installed libsodium 1.0.18_1) > > Any help would be most appreciated. > > thanks, > > James. I’ve spent ages on this and am getting really desperate! :-( CPPFLAGS=-I/opt/homebrew/Cellar/openssl(a)3/3.0.8/include LDFLAGS=-L/opt/homebrew/opt/openssl@3/lib ./configure --with-ssl=openssl --with-mysql ... Install prefix . : /usr/local File offsets ... : 64bit I/O polling .... : kqueue I/O notifys .... : kqueue SSL ............ : yes (OpenSSL) GSSAPI ......... : no passdbs ........ : static passwd passwd-file pam checkpassword sql : -shadow -bsdauth -ldap userdbs ........ : static prefetch passwd passwd-file checkpassword sql sudo doveadm pw -l SHA1 SSHA512 SCRAM-SHA-256 BLF-CRYPT PLAIN HMAC-MD5 OTP SHA512 SHA DES-CRYPT CRYPT SSHA MD5-CRYPT PLAIN-MD4 PLAIN-MD5 SCRAM-SHA-1 CLEAR CLEARTEXT SSHA256 MD5 PBKDF2 SHA256 CRAM-MD5 PLAIN-TRUNC SMD5 DIGEST-MD5 LDAP-MD5 How do I get ARGON2I, ARGON2ID in that list? Has anybody got Dovecot to work on recent macOS with these password schemes? Any hints? Thanks, James.

2 8

Auth-worker, unknown scheme ARGON2ID
by James Brown 21 Feb '23

21 Feb '23

On my current mail server I was able to upgrade everyone’s password scheme to ARGON2ID with no issues, I just had to have: service auth { vsz_limit = 0 } This was an older version of macOS than the new server I’m trying to migrate to. The new one has Dovecot compiled with same configure options, same configuration files, but fails to authenticate: Feb 21 21:51:03 master: Info: Dovecot v2.3.20 (80a5ac675d) starting up for imap, pop3 (core dumps disabled) Feb 21 21:51:33 auth-worker(11701): Error: conn unix:auth-worker (uid=214): auth-worker<1>: sql(jlbrown@bordo.com.au,::1,<bRgbkDP2udEBAAAAAAAAAAAAAAAAAAB>): Unknown scheme ARGON2ID ./configure --with-ssl=openssl --with-mysql Was what I used to compile. Using OpenSSL 3.0.8. New server is running macOS 13.2.1 Ventura. (Have also installed libsodium 1.0.18_1) Any help would be most appreciated. thanks, James.

1 0

service(imap-login): Fatal: setrlimit(RLIMIT_DATA, 268435456): Invalid argument macOS
by James Brown 21 Feb '23

21 Feb '23

I fixed the issue with Dovecot not starting on macOS Ventura by adding this to 10-master.conf: service log { vsz_limit = 0 } But now when I try to login via Imap on port 143 I get the same error for imap-login: Feb 20 15:55:41 imap-login: Error: Feb 20 15:55:41 service(imap-login): Fatal: setrlimit(RLIMIT_DATA, 268435456): Invalid argument Feb 20 15:55:41 imap-login: Fatal: master: service(imap-login): child 11781 returned error 89 (Fatal failure) Feb 20 15:55:41 master: Error: service(imap-login): command startup failed, throttling for 60.000 secs Feb 20 16:13:04 imap-login: Error: Feb 20 16:13:04 service(imap-login): Fatal: setrlimit(RLIMIT_DATA, 268435456): Invalid argument Feb 20 16:13:04 imap-login: Fatal: master: service(imap-login): child 20370 returned error 89 (Fatal failure) Feb 20 16:13:04 master: Error: service(imap-login): command startup failed, throttling for 60.000 secs Config: sudo /usr/local/sbin/dovecot -n # 2.3.20 (80a5ac675d): /usr/local/etc/dovecot/dovecot.conf # OS: Darwin 22.3.0 arm64 apfs # Hostname: mail-server-mac-studio.local auth_mechanisms = plain login auth_verbose = yes auth_verbose_passwords = yes default_internal_group = mail default_internal_user = _dovecot default_login_user = _dovenull first_valid_gid = 0 first_valid_uid = 102 last_valid_gid = 501 last_valid_uid = 105 log_path = /var/log/dovecot.log mail_gid = 102 mail_location = maildir:/usr/local/virtual/%d/%u mail_uid = 102 namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = /usr/local/etc/dovecot/dovecot-sql.conf.ext driver = sql } protocols = imap pop3 service auth { unix_listener /var/spool/postfix/private/auth { group = _postfix mode = 0660 user = _postfix } unix_listener auth-userdb { mode = 0660 user = _vmail } } service imap-login { vsz_limit = 0 } service log { vsz_limit = 0 } ssl_cert = </etc/letsencrypt/live/mail.bordo.com.au/fullchain.pem ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { driver = prefetch } userdb { args = /usr/local/etc/dovecot/dovecot-sql.conf.ext driver = sql } protocol imap { mail_max_userip_connections = 40 } Quitting Dovecot and restarting and I now get: Feb 20 17:01:11 master: Info: Dovecot v2.3.20 (80a5ac675d) starting up for imap, pop3 (core dumps disabled) Feb 20 17:01:11 master: Error: service(anvil): command startup failed, throttling for 2.000 secs Then trying to connect on port 143 log says: Feb 20 17:20:08 master: Error: service(config): command startup failed, throttling for 2.000 secs Feb 20 17:20:08 config: Error: Feb 20 17:20:08 service(config): Fatal: setrlimit(RLIMIT_DATA, 268435456): Invalid argument Feb 20 17:20:08 anvil: Fatal: master: service(anvil): child 43250 returned error 89 (Fatal failure) Feb 20 17:20:08 config: Fatal: master: service(config): child 52530 returned error 89 (Fatal failure) Feb 20 17:20:08 stats: Fatal: master: service(stats): child 52531 returned error 89 (Fatal failure) Feb 20 17:20:08 stats: Error: Feb 20 17:20:08 service(stats): Fatal: setrlimit(RLIMIT_DATA, 268435456): Invalid argument Feb 20 17:20:08 master: Error: service(stats): command startup failed, throttling for 2.000 secs Feb 20 17:20:10 config: Error: Feb 20 17:20:10 service(config): Fatal: setrlimit(RLIMIT_DATA, 268435456): Invalid argument Feb 20 17:20:10 config: Fatal: master: service(config): child 52532 returned error 89 (Fatal failure) Feb 20 17:20:10 master: Error: service(config): command startup failed, throttling for 4.000 secs Feb 20 17:20:10 imap-login: Fatal: Error reading configuration: read(/usr/local/var/run/dovecot/config) failed: EOF - Also failed to read config by executing doveconf: /usr/local/var/run/dovecot/config is a UNIX socket (path is from CONFIG_FILE environment) Feb 20 17:20:10 master: Error: service(imap-login): command startup failed, throttling for 2.000 secs Any suggestions? This is really driving me crazy! thanks, James.

2 1

Get correct subjects in summary but wrong article body after transitioning between servers
by Steinar Bang 19 Feb '23

19 Feb '23

I am transitioning between servers (both debian 11.6 with dovecot 2.3.13) and I'm seeing some strange behaviour after the transition: it seems like dovecot is listing the correct subject for the test messages I'm sending in what's shown in my MUA's summary. But the body of the message is an old message. Dovecot is serving messages from Maildir folders in the users' home directories. And I may have messed up some things here: I rsynced the maildirs and then still got some deliveries both places when the MX records were in transition, so I did a belated rsync, thinking that "Maildir can handle that". But I weren't thinking about the dovecot files, ie: drwx------ 2 sb sb 155648 Feb 11 06:43 cur -rw------- 1 sb sb 30 Nov 23 18:14 dovecot-keywords -rw------- 1 sb sb 116407 Feb 11 06:43 dovecot-uidlist -rw------- 1 sb sb 8 Feb 28 2022 dovecot-uidvalidity -rw------- 1 sb sb 0 Mar 17 2011 dovecot-uidvalidity.4d821095 -rw------- 1 sb sb 38016 Jan 31 15:38 dovecot.index -rw------- 1 sb sb 203852 Feb 5 21:37 dovecot.index.cache -rw------- 1 sb sb 15076 Feb 11 06:43 dovecot.index.log -rw------- 1 sb sb 6424 Feb 4 08:06 dovecot.list.index -rw------- 1 sb sb 7796 Feb 11 06:43 dovecot.list.index.log -rw------- 1 sb sb 3048 Mar 6 2022 dovecot.mailbox.log drwx------ 2 sb sb 4096 Feb 11 06:43 new -rw------- 1 sb sb 738 Mar 6 2022 subscriptions drwx------ 2 sb sb 4096 Feb 6 22:05 tmp Are there any of these that could have been adversely affected by the rsync? Will regenerating these files fix the behaviour where I get the wrong article when fetching them? What is the best way to regenerate them? Can these feil be safely deleted and will be autogenerated? (I also see that some of these files are quite old. I had another server transition in 2017, so the files from 2011 has been rsynced into that server and not touched since) Thanks! - Steinar

1 2

Roundcube <-> Dovecot timeouts under very moderate load on big Dovecot nodes
by Malte Schmidt 18 Feb '23

18 Feb '23

Due to a recent topic regarding the performance of the Roundcube webmailer with Dovecot as a backend, I set up imapproxy successfully, shrinking the response latency of the webmailer heavily, which is great. However, I still encounter strange timeouts on some requests when Roundcube tries to access Dovecot. Be it for authentication or to FETCH data. I run the tests/benchmarks via distributed JMeter from 4 nodes, they access the webmailer which in turn accesses the Dovecot via imapproxy. There are 16 different mailaccounts spread over two dovecot nodes with the first one acting as a proxy if the account resides on the second. The problems start at around 100 concurrent users and gets worse the more users are added. The timeouts make up for a small percentage of the requests (0.0something percent). The timeout is reached after 30 seconds of Dovecot not answering, due to the timeout set in the webserver the webmailer is running on. Now I am wondering how to further debug this and what could be the reason. Some requests towards Dovecot are certainly taking longer than 30 seconds, while the average request takes mostly less than 1. The Dovecot is running on two big hardware machines with 48 cores, 96G memory and SSD storage. The load on the Dovecot nodes while the test is running is minimal. Best regards, M. Schmidt

1 0

dovecot_login accepts blank password for exim smtp auth
by Jeff Rogers 18 Feb '23

18 Feb '23

Hi all, I recently discovered a configuration issue on my system where a system user account had a blank rather than invalid or disabled password in the passwd/shadow database. The user could not be logged into through login/telnet/ssh because it was marked as a system account (uid < 100). Dovecot also would not authenticate the user for the same reason. However, I'm using exim using dovecot_login for authentication, and that would authenticate the user with a blank and allow me to be used as an open relay. This is clearly a config issue on my part (since fixed), but should dovecot_login guard against blank passwords or system users just as a normal login does? I'm running dovecot 2.2.36 (1f10bfa63) Exim version 4.96 I don't know which software supplies the dovecot_login connenector. The SMTP session would include AUTH LOGIN 334 VXNlcm5hbWU6 cG9zdGZpeA== 334 UGFzc3dvcmQ6 <-- nothing, just a return here 235 Authentication succeeded DONE

2 1

Special authentication use case
by Philippe MARASSE 17 Feb '23

17 Feb '23

Folks, I'm trying to configure dovecot SASL with two use cases : - First with XOAUTH2 : I've managed to get it working, pretty right out of the box, developers have done a great job :-) - Second with Client TLS Certificate with no luck. Let me explain, the certificate brought by the client does not have any clue of associated email, I have to check that username (=email) sent by the client is really related to some information included in the certificate (I have to extract the OU and then lookup into a table of authorized mails for that OU). Is it possible to do that with dovecot ? I think yes but I'm looking for direction to achieve that. Lua maybe ? Our configuration : - OS : Debian 11 $ /usr/sbin/dovecot --version 2.3.13 (89f716dc2) Regards. -- Philippe MARASSE Responsable pôle Infrastructures - DSIO Centre Hospitalier Henri Laborit CS 10587 - 370 avenue Jacques Cœur 86021 Poitiers Cedex Tel : 05.49.44.57.19

1 1

Re: SOLVED: Re: Dovecot does not start on MacOS 12.01, and now 13.2.1 - RLIMIT_DATA
by James Brown 17 Feb '23

17 Feb '23

Sorry, replying to an old thread found on mail-archive.com <http://mail-archive.com/>, so it’s not threaded email. https://www.mail-archive.com/dovecot@dovecot.org/msg84776.html I have just installed Dovecot onto Mac Studio running Ventura (macOS 13.2.1) and get the same error with Dovecot 2.3.20: service(log): Fatal: setrlimit(RLIMIT_DATA, 268435456): Invalid argument Adding the ’service log’ stanza to 10-master.conf fixed the issue. Is this still the correct way to handle it? If so it would be great to have it documented somewhere. Just lucky I found the above mail thread. Thanks, James. Hi! That solution is bit overly broad way to solve this, I would instead recommend service log { vsz_limit = 0 } so that only service log is affected. Aki > On 31/10/2021 20:36 Don Feliciano <don.felici...(a)icloud.com> wrote: > > > > A kind person who isn’t on the mailing list share the solution to this with > me: > > default_vsz_limit = 0 > > > > On Oct 28, 2021, at 12:12 PM, Don Feliciano <don.felici...(a)icloud.com> > > wrote: > > > > > > Warning: fd limit (ulimit -n) is lower than required under max. load (256 < > > 1000), because of default_client_limit > > Oct 28 12:08:48 service(log): Fatal: setrlimit(RLIMIT_DATA, 268435456): > > Invalid argument > > > > > > > On Oct 27, 2021, at 11:08 AM, Don Feliciano <don.felici...(a)icloud.com> > > > wrote: > > > > > > I've been happily running Dovecot on my Mac for many years (installed via > > > Homebrew). After upgrading to Monterey (MacOS 12.01), it no longer starts: > > > > > > $ sw_vers > > > ProductName: macOS > > > ProductVersion: 12.0.1 > > > BuildVersion: 21A559 > > > > > > $ uname -a > > > Darwin dfelicia-mac 21.1.0 Darwin Kernel Version 21.1.0: Wed Oct 13 > > > 17:33:23 PDT 2021; root:xnu-8019.41.5~1/RELEASE_X86_64 x86_64 > > > > > > $ sudo dovecot -F > > > Oct 27 10:11:18 service(log): Fatal: setrlimit(RLIMIT_DATA, 268435456): > > > Invalid argument

1 0

Could not override "mail_location" with "userdb_mail" statment in "/etc/passwd"
by Xavier 17 Feb '23

17 Feb '23

Hi, ** Using Dovecot 2.2.22 and Postfix 3.1.0 ** I plan to migrate all accounts on my server from mbox to maildir storage but before i want to make some tests on dedicated accounts. To do so i want to overide the general "mail_location" ( mail_location = mbox:~/mail:INBOX=/var/mail/%u ) with "maildir:~/Maildir" only for some test accounts. To do so i modified my "/etc/passwd" file using something like that : testm2m_mydomain.tld:x:2122:2122::/home/mail/testm2m_mydomain.tld:/bin/false:userdb_mail=maildir:~/Maildir Also tried testm2m_mydomain.tld:x:2122:2122::/home/mail/testm2m_mydomain.tld:/bin/false::userdb_mail=maildir:~/Maildir And as mentioned in the doc (https://wiki.dovecot.org/LDA/Postfix) i added -d "$USER" in my Postfix "mailbox_command" but it don't seem to work (my new mail_location for this test user is is not taken into account). When i try to make an "doveadm user testm2m_mydomain.tld" i get this : 8<-------------------------------- field value uid 2122 gid 2122 home /home/mail/testm2m_mydomain.tld mail mbox:~/mail:INBOX=/var/mail/testm2m_mydomain.tld system_groups_user testm2m_mydomain.tld 8<-------------------------------- My modification is not taken into account ... Any help is welcome ! /Xavier

2 4