June 2023 - dovecot - dovecot.org

JMAP support?
by Mark Constable 31 Jan '24

31 Jan '24

On Fri Jan 25 2019 Aki wrote: > There is no JMAP support in any dovecot version yet. Two years on so what is the status of JMAP support in Dovecot now?

7 10

replicator: Panic: data stack: Out of memory when allocating 268435496 bytes
by Gerben Wierda 06 Dec '23

06 Dec '23

One step further in my quest to create a replacement mail server. I now have my old mail server (2.3.19.1, macOS + MacPorts) and my new (2.3.20, Alpine Linux, Docker, apk package). When I turn on replication it works, but, after a while I see: Jan 06 00:50:31 replicator: Panic: data stack: Out of memory when allocating 268435496 bytes Jan 06 00:50:32 replicator: Fatal: master: service(replicator): child 133 killed with signal 6 (core dumped) Jan 06 00:50:32 lmtp(pid 195 user sysbh): Warning: replication(sysbh): Sync failure: Jan 06 00:50:32 lmtp(pid 195 user sysbh): Warning: replication(sysbh): Remote sent invalid input: - I've removed synchronous operation for now (found a message on the net suggesting that) but is this known and what does it mean? Gerben Wierda (LinkedIn <https://www.linkedin.com/in/gerbenwierda>) R&A IT Strategy <https://ea.rna.nl/> (main site) Book: Chess and the Art of Enterprise Architecture <https://ea.rna.nl/the-book/> Book: Mastering ArchiMate <https://ea.rna.nl/the-book-edition-iii/>

6 15

Debian package for bookworm
by Claudio Corvino 14 Oct '23

14 Oct '23

Hi guys, I updated to Debian 12 but I can't find repo for bookworm on https://repo.dovecot.org/. When it will be released? Thanks! -- Claudio

8 10

bug report: lmtp fails on root-squashed NFS filesystem
by Anne Bennett 09 Oct '23

09 Oct '23

Hi, all. I'm trying to set up Postfix with dovecot LTMP delivery on a host where the user files (/var/spool/mail as well as home directories) are on NFS filesystems, which are exported root-squashed to the mail server. I definitely don't want to give the mail server root permissions on the user files. LMTP delivery fails with this logged message (e.g.): Nov 16 17:51:36 lust dovecot: lmtp(anne)<16830><mkkzEPg1lGG+QQAAs/mAJw>: msgid=<202111162229.1AGMTfAO024765(a)vindemiatrix.encs.concordia.ca>: save failed to INBOX: Read-only mbox I found this posting where someone else had a similar problem and traced it in some detail back in 2019: https://dovecot.org/list/dovecot/2019-February/114611.html but apparently no one answered the fellow. In order to check that this is indeed the same problem, I temporarily changed the INBOX definition to make it write into /var/tmp/ (on a local filesystem), and delivery worked. I then temporarily changed the INBOX definition to make it write into an NFS filesystem with root NOT squashed, and again it worked (after I chmodded the directory to 1777 to allow any user to create a file). I believe that the person who wrote the above posting is correct: at some point, file access is (incorrectly) checked as root instead of as the target user. This is a bit of a showstopper for me. Any plans to address this? I attach the output of "dovecot -n", fwiw, but I don't think that this is a configuration problem... Anne. -- Ms. Anne Bennett, Senior Sysadmin, ENCS, Concordia University, Montreal H3G 1M8 anne(a)encs.concordia.ca +1 514 848-2424 x2285

2 4

Compression: all or nothing?
by Alex King 03 Oct '23

03 Oct '23

Using 2.3.13 (89f716dc2) (debian package), with mdbox storage. I considering adding the zlib plugin. I understand that reading mail can cope with either compressed or uncompressed mailboxes. I'm wondering if I can leave the main storage uncompressed, while having the alternate storage compressed. There does not seem to be a way to configure this, from https://doc.dovecot.org/settings/plugin/zlib-plugin/ it seems compression (on saving emails) is an all-or-nothing option? Can I leave zlib_save unset in my main configuration, and have doveadm use some alternate configuration with zlib_save set? It doesn't look hopeful because I don't see the ability to use a different config at https://wiki.dovecot.org/Tools/Doveadm/Altmove. Perhaps I would need multiple copies of the daemon running? Or is it better just to compress everything? I plan to store older mails (perhaps 3months+) in the alternative storage, and was thinking it would be nice to have those compressed, while I don't need to compress the main store. Any feedback welcome. Thanks, Alex

2 2

auth: Panic: file oauth2-request.c assertion failed
by Urban Loesch 05 Sep '23

05 Sep '23

Hi, I'm running a postfix smtp relay server on which users are getting authenticated trough sasl via the dovecot authentication service. This works without problems. Recently I extended my configuration to authenticate users with the PLAIN mechanism against Azure AD B2C with oauth2 in the future. Important to mention is that currently no users are stored in Azure B2C. I only prepared the hole configuration and authentiucation falls back to mysql database. Now sometimes I get the error below in my logs (not permanently): ... Dec 7 11:36:49 relay-out1 dovecot: auth: Panic: file oauth2-request.c: line 201 (oauth2_request_start): assertion failed: (oauth2_valid_token(input->token)) Dec 7 11:36:49 relay-out1 dovecot: auth: Error: Raw backtrace: /usr/lib/dovecot/libdovecot.so.0(backtrace_append+0x3d) [0x7f399402e62d] -> /usr/lib/dovecot/libdovecot.so.0(backtrace_get+0x1e) [0x7f399402e74e] -> /usr/lib/dovecot/libdovecot.so.0(+0x1006eb) [0x7f399403b6eb] -> /usr/lib/dovecot/libdovecot.so.0(+0x100781) [0x7f399403b781] -> /usr/lib/dovecot/libdovecot.so.0(+0x54b7c) [0x7f3993f8fb7c] -> /usr/lib/dovecot/libdovecot.so.0(+0x4605a) [0x7f3993f8105a] -> /usr/lib/dovecot/libdovecot.so.0(oauth2_passwd_grant_start+0xfa) [0x7f3993f9870a] -> dovecot/auth(db_oauth2_lookup+0x2ca) [0x560d0804368a] -> dovecot/auth(auth_request_default_verify_plain_continue+0x2d6) [0x560d08026436] -> dovecot/auth(auth_policy_check+0x2b) [0x560d0802071b] -> dovecot/auth(+0x29f72) [0x560d0802ff72] -> dovecot/auth(auth_request_handler_auth_continue+0xf7) [0x560d0802a197] -> dovecot/auth(+0x16c62) [0x560d0801cc62] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_call_io+0x69) [0x7f3994051c29] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run_internal+0x131) [0x7f3994053251] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run+0x4c) [0x7f3994051ccc] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_run+0x40) [0x7f3994051e50] -> /usr/lib/dovecot/libdovecot.so.0(master_service_run+0x13) [0x7f3993fc4df3] -> dovecot/auth(main+0x415) [0x560d0801abf5] -> /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xeb) [0x7f3993cee09b] -> dovecot/auth(_start+0x2a) [0x560d0801ad8a] ... After the error above postfix says the connection to the authentication server was lost: ... Dec 7 11:36:49 relay-out1 rolrelayout1/smtpd[1655601]: warning: domain.com[12.12.12.12]: SASL LOGIN authentication failed: Connection lost to authentication server ... I was able to make a core dump. ... # gdb /usr/lib/dovecot/auth core.auth.1654357.1670409409 GNU gdb (Debian 8.2.1-2+b3) 8.2.1 ... For help, type "help". Type "apropos word" to search for commands related to "word"... Reading symbols from /usr/lib/dovecot/auth...Reading symbols from /usr/lib/debug/.build-id/bc/f14ed9cc2dda3ee9565fbd7ccd835460008438.debug...done. done. [New LWP 1654357] [Thread debugging using libthread_db enabled] Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1". Core was generated by `dovecot/auth'. Program terminated with signal SIGABRT, Aborted. #0 __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50 50 ../sysdeps/unix/sysv/linux/raise.c: Datei oder Verzeichnis nicht gefunden. (gdb) bt full #0 __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50 set = {__val = {0, 1415, 1416, 94613970086496, 10, 139885273538955, 155, 139885273347109, 140724590457408, 118, 206158430224, 140724590457744, 140724590457536, 16888407779496842752, 94613970086472, 139885273131758}} pid = <optimized out> tid = <optimized out> ret = <optimized out> #1 0x00007f3993cec535 in __GI_abort () at abort.c:79 save_stage = 1 act = {__sigaction_handler = {sa_handler = 0x73f, sa_sigaction = 0x73f}, sa_mask = {__val = {1024, 18446744073709551615, 94613971926672, 94613971631792, 139885273108347, 94613970084312, 139885273090236, 94613970084312, 16888407779496842752, 94613970084288, 139885273346402, 140724590457744, 94613970084312, 140724590457744, 139885273346761, 94613970084312}}, sa_flags = -1811749030, sa_restorer = 0x5} sigs = {__val = {32, 0 <repeats 15 times>}} #2 0x00007f3993f8feaf in default_fatal_finish (status=0, type=LOG_TYPE_PANIC) at failures.c:465 backtrace = 0x560d0813e220 "/usr/lib/dovecot/libdovecot.so.0(backtrace_append+0x3d) [0x7f399402e62d] -> /usr/lib/dovecot/libdovecot.so.0(backtrace_get+0x1e) [0x7f399402e74e] -> /usr/lib/dovecot/libdovecot.so.0(+0x1006eb) [0x7f39"... backtrace = <optimized out> recursed = 0 #3 fatal_handler_real (ctx=<optimized out>, format=<optimized out>, args=<optimized out>) at failures.c:477 status = 0 #4 0x00007f399403b781 in i_internal_fatal_handler (ctx=<optimized out>, format=<optimized out>, args=<optimized out>) at failures.c:879 No locals. #5 0x00007f3993f8fb7c in i_panic (format=format@entry=0x7f399407a0e8 "file %s: line %d (%s): assertion failed: (%s)") at failures.c:530 ctx = {type = LOG_TYPE_PANIC, exit_status = 0, timestamp = 0x0, timestamp_usecs = 0, log_prefix = 0x0, log_prefix_type_pos = 0} args = {{gp_offset = 40, fp_offset = 48, overflow_arg_area = 0x7ffcff39b4e0, reg_save_area = 0x7ffcff39b420}} #6 0x00007f3993f8105a in oauth2_request_start (set=0x560d08176150, input=0x7ffcff39b5d0, callback=0x560d08042b50 <db_oauth2_lookup_passwd_grant>, context=0x560d082ffe90, p=0x560d082b7eb0, method=0x7f399407a2c6 "POST", url=0x560d08178480 "https://xxx.b2clogin.com/xxx.onmicrosoft.com/B2C_1_ropc/oauth2/v2.0/token?s…", payload=0x560d082b7ed8, add_auth_bearer=false) at oauth2-request.c:201 __func__ = "oauth2_request_start" pool = <optimized out> req = <optimized out> #7 0x00007f3993f9870a in oauth2_passwd_grant_start (set=set@entry=0x560d08176150, input=input@entry=0x7ffcff39b5d0, username=0x560d082ffe38 "user.name", password=0x560d082ffe48 "", callback=callback@entry=0x560d08042b50 <db_oauth2_lookup_passwd_grant>, context=context@entry=0x560d082ffe90) at oauth2-request.c:351 pool = 0x560d082b7eb0 payload = 0x560d082b7ed8 #8 0x0000560d0804368a in db_oauth2_lookup (db=0x560d08176060, req=0x560d082ffe90, token=<optimized out>, request=0x560d082ffba8, callback=0x560d080370b0 <oauth2_verify_plain_continue>, context=0x560d082ffba8) at db-oauth2.c:862 input = {token = 0x560d082ffe48 "", service = 0x560d082ffe20 "smtp", local_ip = {family = 2, u = {ip6 = {__in6_u = {__u6_addr8 = "\303\376\374\322", '\000' <repeats 11 times>, __u6_addr16 = {65219, 54012, 0, 0, 0, 0, 0, 0}, __u6_addr32 = {3539795651, 0, 0, 0}}}, ip4 = {s_addr = 3539795651}}}, real_local_ip = {family = 2, u = {ip6 = {__in6_u = {__u6_addr8 = "\303\376\374\322", '\000' <repeats 11 times>, __u6_addr16 = {65219, 54012, 0, 0, 0, 0, 0, 0}, __u6_addr32 = {3539795651, 0, 0, 0}}}, ip4 = {s_addr = 3539795651}}}, remote_ip = {family = 2, u = {ip6 = {__in6_u = {__u6_addr8 = "*\300\070\226", '\000' <repeats 11 times>, __u6_addr16 = {49194, 38456, 0, 0, 0, 0, 0, 0}, __u6_addr32 = {2520301610, 0, 0, 0}}}, ip4 = {s_addr = 2520301610}}}, real_remote_ip = {family = 2, u = {ip6 = {__in6_u = {__u6_addr8 = "*\300\070\226", '\000' <repeats 11 times>, __u6_addr16 = { 49194, 38456, 0, 0, 0, 0, 0, 0}, __u6_addr32 = {2520301610, 0, 0, 0}}}, ip4 = {s_addr = 2520301610}}}, local_port = 0, real_local_port = 0, remote_port = 0, real_remote_port = 0} __func__ = "db_oauth2_lookup" #9 0x0000560d08026436 in auth_request_default_verify_plain_continue (request=0x560d082ffba8, callback=0x560d0803e6f0 <plain_verify_callback>) at auth-request.c:1123 passdb = 0x560d0814da40 result = 22029 cache_key = <optimized out> error = 0x560d082ffe38 "user.name" password = 0x560d082ffe48 "" __func__ = "auth_request_default_verify_plain_continue" #10 0x0000560d0802071b in auth_policy_check (request=<optimized out>, password=<optimized out>, cb=<optimized out>, context=<optimized out>) at auth-policy.c:575 pool = <optimized out> ctx = <optimized out> #11 0x0000560d0802ff72 in mech_plain_auth_continue (request=0x560d082ffba8, data=0x560d0813d368 "user.name", data_size=30) at mech-plain.c:58 authid = <optimized out> authenid = 0x560d0813d377 "user.name" error = 0x560d0813d320 "h\323\023\b\rV" pass = 0x560d0813d388 "" i = <optimized out> len = <optimized out> count = 2 #12 0x0000560d0802a197 in auth_request_handler_auth_continue (handler=0x560d082d1ae8, args=args@entry=0x560d08268e96 "21\tdGhvbWFzLmZlcnJhcmkAdGhvbWFzLmZlcnJhcmkA") at auth-request-handler.c:738 request = 0x560d082ffba8 data = 0x560d08268e99 "dGhvbWFzLmZlcnJhcmkAdGhvbWFzLmZlcnJhcmkA" data_len = 40 buf = 0x560d0813d320 id = 21 #13 0x0000560d0801cc62 in auth_client_handle_line (line=0x560d08268e91 "CONT\t21\tdGhvbWFzLmZlcnJhcmkAdGhvbWFzLmZlcnJhcmkA", conn=0x560d08276d30) at auth-client-connection.c:228 No locals. #14 auth_client_input (conn=<optimized out>) at auth-client-connection.c:311 _data_stack_cur_id = 3 line = <optimized out> ret = <optimized out> #15 0x00007f3994051c29 in io_loop_call_io (io=0x560d0826f240) at ioloop.c:737 ioloop = 0x560d08145f80 t_id = 2 __func__ = "io_loop_call_io" #16 0x00007f3994053251 in io_loop_handler_run_internal (ioloop=ioloop@entry=0x560d08145f80) at ioloop-epoll.c:222 ctx = 0x560d08148600 events = <optimized out> event = 0x560d08148680 list = 0x560d082ae620 io = <optimized out> tv = {tv_sec = 0, tv_usec = 315566} events_count = <optimized out> msecs = <optimized out> ret = <optimized out> i = 0 j = <optimized out> call = <optimized out> __func__ = "io_loop_handler_run_internal" #17 0x00007f3994051ccc in io_loop_handler_run (ioloop=0x560d08145f80) at ioloop.c:789 __func__ = "io_loop_handler_run" #18 0x00007f3994051e50 in io_loop_run (ioloop=0x560d08145f80) at ioloop.c:762 __func__ = "io_loop_run" #19 0x00007f3993fc4df3 in master_service_run (service=0x560d08145dd0, callback=<optimized out>) at master-service.c:869 No locals. #20 0x0000560d0801abf5 in main (argc=<optimized out>, argv=<optimized out>) at main.c:393 c = <optimized out> ... And "doveconf -n": ... # 2.3.19.1 (9b53102964): /etc/dovecot/dovecot.conf # OS: Linux 5.10.0-18-amd64 x86_64 Debian 10.13 # Hostname: relay-out1.domain.com auth_cache_negative_ttl = 0 auth_cache_size = 40 M auth_cache_ttl = 30 days auth_mechanisms = plain login auth_username_chars = abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ01234567890.-_%@ auth_username_translation = %@ auth_verbose = yes auth_verbose_passwords = plain auth_worker_max_count = 100 disable_plaintext_auth = no namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = /etc/dovecot/dovecot-oauth2.plain.conf.ext driver = oauth2 mechanisms = plain login } passdb { args = /etc/dovecot/dovecot-sql-account.conf driver = sql } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } } userdb { args = /etc/dovecot/dovecot-sql-account.conf driver = sql } ... System OS is Debian 10, Dovecot installed from dovecot repository. Many thanks Urban

1 1

Pigeonhole redirect is adding a message-id header when it already exists
by Sébastien Riccio 04 Aug '23

04 Aug '23

Hello, We are using sieve filter to redirect incoming mails to an external mailbox (gmail) an we are seeing some forwarded e-mails being rejected by gmail because of duplicate headers. I think was able to identify the probable cause of the duplicate headers: It seems that when the original message's "Message-ID" is not compliant, pigeonhole acts like if the header is not existing and adds it's own Message-ID. This result in having two "Message-ID" headers being submitted to the destination mail server. Original Message-ID: Message-ID: 1883biz_pay_after_purchase:0:0_572392900$ae7ed6e4d53b424c84aaf83b30c507e7 Pigeon hole adds his own Message-ID: Message-ID: <dovecot-sieve-1664386049-21512-0@510faa1ff2d9> Gmail answer: 550-5.7.1 [94.103.100.17] Our system has detected that this message is not RFC 550-5.7.1 5322 compliant: duplicate headers. To reduce the amount of spam sent 550-5.7.1 to Gmail, this message has been blocked. Please review 550 5.7.1 RFC 5322 specifications for more information. While I understand the original "Message-ID" seems to be all but compliant with RFCs, shouldn't a "Message-ID" be added only when "Message-ID" is really missing ? When redirecting a message, If the original "Message-ID" exists but is bogus shouldn't it still be forwarded untouched ? Also, maybe if pigeonhole is adding it's own "Message-ID", shouldn't it remove any previous "Message-ID" to avoid generating duplicate headers ? (but maybe it could break some DKIM stuff?) Any ideas how to workaround this issue ? Thanks a lot for your feedbacks! Sébastien RICCIO SYSTEM ADMINISTRATOR P +41 840 888 888 F +41 840 888 000 M sriccio(a)swisscenter.com<mailto:sriccio@swisscenter.com>

9 17

subscription, dots and subscribe to shared folder.
by Julien Nadal 24 Jul '23

24 Jul '23

Hello; We were able to set up shared folders in a cluster (using dovecot as proxy on dedicated front-end servers, without using director) by following https://doc.dovecot.org/configuration_manual/shared_mailboxes/cluster_setup/. Here is our related conf on imap farms (dovecot v2.3.16 on Almalinux): namespaces: mail_location = maildir:~/Maildir namespace default { inbox = yes location = prefix = separator = / } namespace shared { list = children location = imapc:~/shared/%%u:INDEXPVT=~/shared-pvt/%%u prefix = shared/%%u/ separator = / subscriptions = no type = shared } imapc settings: imapc_features = fetch-bodystructure fetch-headers rfc822.size search modseq acl delay-login imapc_host = XXXXXX imapc_master_user = %{user} imapc_password = XXXXXX imapc_port = XXXXXX passdb { args = password=#hidden_use-P_to_show# userdb_namespace/shared/disabled=yes userdb_acl_user=%{auth_user} allow_nets=XXXXX/XX driver = static master = yes } dict { acl-mysql = mysql:/etc/dovecot/conf.d/dovecot-dict-sql.conf.ext } This way, a folder is created under ~/ : shared & shared-pvt : When user A shares a folder with B, B will find ~/shared/userA/sharedfolder I should mention that the user authentication (backend: mysql) uses the full email address as we are in a multi-tenant context. So the folder looks like ~/shared/usera(a)domain.tld/folder Since then, everything works perfectly, we can share and see the shared folders in the webmail (SOGo). Unfortunately, accessing these folders through an imap client (tested on Thunderbird and MSOutlook) is impossible because the subscription fails (the folder is listed, but the subscription doesn't seem to do anything). I could not find any relevant logs but I was able to confirm on the command line: I am able to view folder with LIST, subscribe with an "OK" output, but the folder is not listed with LSUB. So I could see that the subscribtion file in maildir shows incorrect entries: V 2 Sent Trash Drafts Junk shared/testuser1@sub domain tld/INBOX/folder The dots in the folder names are replaced by tabs. I was able to recover things by editing the file as follows: Sent Trash Drafts Junk shared/testuser1(a)sub.domain.tld/INBOX/folder This means that Maildir++ and V2 subscription can't handle dots in folders. I found a previous discussion: https://dovecot.org/pipermail/dovecot/2021-January/121233.html But the final advice can't be applied on our side: - changing LAYOUT to FS is not possible for us - we have already migrated the dot separator to slash - changing the layout only for shared namespaces does not solve the problem and totally breaks the access to shared folders. Thanks a lot for your advice Best regards Julien

3 4

Many IDLE imap processes but very few connections moved to imap-hibernate
by pierre.alletru＠gmail.com 17 Jul '23

17 Jul '23

Hi Dovecot community! I have a strange issue with imap-hibernate. Or more likely it behaves as it's supposed to and it's just that I don't really understand it. I have enabled it, and it works, but for some reason hibernation happens only to a tiny amount of connections, whereas I have a lot of IDLE imap processes. And I can't find any relevant errors in the logs. ## config ## mail_debug = yes verbose_proctitle = yes $ doveconf imap_hibernate_timeout imap_hibernate_timeout = 5 secs $ doveconf -a | grep -A 21 'service imap-hibernate' service imap-hibernate { chroot = client_limit = 0 drop_priv_before_exec = no executable = imap-hibernate extra_groups = group = idle_kill = 0 privileged_group = process_limit = 0 process_min_avail = 0 protocol = imap service_count = 0 type = unix_listener imap-hibernate { group = $default_internal_group mode = 0660 user = } user = $default_internal_user vsz_limit = 18446744073709551615 B } ## imap processes ## $ ps aux | grep "dovecot/imap" | wc -l 2214 ps aux | grep "dovecot/imap" | grep IDLE | wc -l 1258 $ ps aux | grep "imap-hibernate" syslog 1571453 0.0 0.0 4748 3156 ? S 15:44 0:00 dovecot/imap-hibernate [18 connections] As you can see here I have 1258 IDLE imap processes (out of 2214 in total), and only 18 connections in imap-hibernate. I'd like to have all IDLE processes to be moved to imap-hibernate in order to save up memory. Any idea why these 1k+ IDLE imap processes are not moved into imap-hibernate? Thank you!

2 1

Chrooting
by Alexey Vlasov 30 Jun '23

30 Jun '23

Hi, I have the following hier for chrooting local users: /var/mail/.u336084 /var/mail/.u336084/bin /var/mail/.u336084/dev [cut here] /var/mail/.u336084/proc /var/mail/.u336084/var/ [cut here] /var/mail/.u336084/var/mail/ /var/mail/.u336084/var/mail/u336084 /var/mail/.u336084/var/mail/u336084/Mail /var/mail/.u336084/Mail -> var/mail/u336084/Mail (symlink) passwd file: u336084:x:1340334:255::/var/mail/.u336084:/bin/bash Chroot works fine, for SSH, FTP and etc, for example: # chroot /var/mail/.u336084 /bin/bash Given the current hierarchy, is it possible to tell the dovecot to do the same chroot? I found strange behavior that users cannot delete IMAP-folders: [pid 25055] stat("/var/mail/.u336084/Mail/.www1", {st_mode=S_IFDIR|0700, st_size=167, ...}) = 0 [pid 25055] stat("/var/mail/.u336084/Mail/.Trash.www1", 0x7ffeddc3d5c0) = -1 ENOENT (No such file or directory) [pid 25055] stat("/var/mail/.u336084/Mail/.Trash", {st_mode=S_IFDIR|0777, st_size=198, ...}) = 0 [pid 25055] fcntl(16, F_SETLK, {l_type=F_UNLCK, l_whence=SEEK_SET, l_start=0, l_len=0}) = 0 [pid 25055] fcntl(16, F_SETLK, {l_type=F_WRLCK, l_whence=SEEK_SET, l_start=0, l_len=0}) = 0 [pid 25055] fstat(16, {st_mode=S_IFREG|0600, st_size=0, ...}) = 0 [pid 25055] stat("/var/mail/.u336084/Mail/mailboxes.lock", {st_mode=S_IFREG|0600, st_size=0, ...}) = 0 [pid 25055] unlink("/var/mail/.u336084/Mail/mailboxes.lock") = 0 [pid 25055] close(16) = 0 [pid 25055] write(7, "96 NO [CANNOT] Renaming not supported across conflicting directory permissions (0.002 + 0.000 + 0.001 secs).\r\n", 110) = 110 [pid 25055] epoll_wait(11, [{EPOLLIN, {u32=1794732256, u64=94916277006560}}], 7, 1800000) = 1 Btw I don't see any conflicting dirs: root@:/var/mail/u336084# ls -ld /var/mail/.u336084/Mail/.www1 drwx------ 5 u336084 virtmail 167 Jun 27 13:26 /var/mail/.u336084/Mail/.www1 root@:/var/mail/u336084# ls -ld /var/mail/.u336084/Mail lrwxrwxrwx 1 u336084 virtmail 26 Apr 28 21:43 /var/mail/.u336084/Mail -> var/mail/u336084/Mail root@:/var/mail/u336084# ls -ld Mail drwx------ 16 u336084 virtmail 4096 Jun 30 01:25 Mail All folders have right owner u336084. With this configuration Courier worked properly, I noteced the problem after migration to Dovecot. Thanks in advance.

1 0