June 2024 - dovecot - dovecot.org

IMAPSieve plugin will not run rspamd script
by postfix_dovecot＠gmx.de 02 Jul '24

02 Jul '24

Host: VMware Workstation 14.1.8 OS: Debian 12 (Bookworm) Dovecot: 2.3.19.1 Postfix: 3.7.10 Mailclient: Outlook 2016 Hello, I am currently working on a new mail server to replace my Debian 10 mail server. For preparation, I use VMware Workstation to learn and test the installation steps. When I'm eventually done, I'll rebuild my root server from scratch. This time, my problem is getting the IMAPSieve plugin working to trigger rspamd if mail gets moved to the junk folder. Sieve runs well – if rspam recognizes a spam mail, it will be transferred to the junk folder. For me it looks like the IMAPSieve plugin recognizes the move but will not running the script behind. I can see some actions in the log but nothing happens on the rspamd side where the log is also open to view. Moving a mail with Outlook produces the following log entry: imap(mail(a)test.example)<1797><a/FKmgIcqKvAqB4a>: Debug: Module loaded: /usr/lib/dovecot/modules/lib95_imap_sieve_plugin.so imap(mail(a)test.example)<1797><a/FKmgIcqKvAqB4a>: Debug: imapsieve: mailbox INBOX/Spam: APPEND event imap(mail(a)test.example)<1797><a/FKmgIcqKvAqB4a>: Debug: sieve: Pigeonhole version 0.5.19 (4eae2f79) initializing imap(mail(a)test.example)<1797><a/FKmgIcqKvAqB4a>: Debug: sieve: include: sieve_global is not set; it is currently not possible to include `:global' scripts. imap(mail(a)test.example)<1797><a/FKmgIcqKvAqB4a>: Debug: sieve: Sieve imapsieve plugin for Pigeonhole version 0.5.19 (4eae2f79) loaded imap(mail(a)test.example)<1797><a/FKmgIcqKvAqB4a>: Debug: sieve: Sieve Extprograms plugin for Pigeonhole version 0.5.19 (4eae2f79) loaded imap(mail(a)test.example)<1797><a/FKmgIcqKvAqB4a>: Debug: imapsieve: Static mailbox rule [1]: mailbox=`Spam' from=`*' causes=(COPY APPEND) => before=`file:/usr/lib/dovecot/sieve/report-spam.sieve' after=(none) imap(mail(a)test.example)<1797><a/FKmgIcqKvAqB4a>: Debug: imapsieve: Static mailbox rule [2]: mailbox=`*' from=`Spam' causes=(COPY APPEND) => before=`file:/usr/lib/dovecot/sieve/report-ham.sieve' after=(none) imap(mail(a)test.example)<1795><iC6JmQIcnqvAqB4a>: Debug: imapsieve: mailbox INBOX: FLAG event (changed flags: \Deleted) imap(mail(a)test.example)<1795><iC6JmQIcnqvAqB4a>: Debug: sieve: Pigeonhole version 0.5.19 (4eae2f79) initializing imap(mail(a)test.example)<1795><iC6JmQIcnqvAqB4a>: Debug: sieve: include: sieve_global is not set; it is currently not possible to include `:global' scripts. imap(mail(a)test.example)<1795><iC6JmQIcnqvAqB4a>: Debug: sieve: Sieve imapsieve plugin for Pigeonhole version 0.5.19 (4eae2f79) loaded imap(mail(a)test.example)<1795><iC6JmQIcnqvAqB4a>: Debug: sieve: Sieve Extprograms plugin for Pigeonhole version 0.5.19 (4eae2f79) loaded imap(mail(a)test.example)<1795><iC6JmQIcnqvAqB4a>: Debug: imapsieve: Static mailbox rule [1]: mailbox=`Spam' from=`*' causes=(COPY APPEND) => before=`file:/usr/lib/dovecot/sieve/report-spam.sieve' after=(none) imap(mail(a)test.example)<1795><iC6JmQIcnqvAqB4a>: Debug: imapsieve: Static mailbox rule [2]: mailbox=`*' from=`Spam' causes=(COPY APPEND) => before=`file:/usr/lib/dovecot/sieve/report-ham.sieve' after=(none) imap(mail(a)test.example)<1795><iC6JmQIcnqvAqB4a>: Debug: imapsieve: mailbox INBOX: FLAG event (changed flags: \Seen) My /etc/dovecot/local.conf looks like this: ## dovecot.conf # Mailuser im Log mit Namen darstellen verbose_proctitle = yes protocols = imap lmtp sieve ## 10-auth.conf # Disable LOGIN command and all other plaintext authentications unless # SSL/TLS is used (LOGINDISABLED capability). Note that if the remote IP # matches the local IP (ie. you're connecting from the same computer), the # connection is considered secure and plaintext authentication is allowed. # See also ssl=required setting. disable_plaintext_auth = yes # Space separated list of wanted authentication mechanisms: # plain login digest-md5 cram-md5 ntlm rpa apop anonymous gssapi otp # gss-spnego # NOTE: See also disable_plaintext_auth setting. auth_mechanisms = plain login # Username formatting before it's looked up from databases. You can use # the standard variables here, eg. %Lu would lowercase the username, %n would # drop away the domain if it was given, or "%n-AT-%d" would change the '@' into # "-AT-". This translation is done after auth_username_translation changes. auth_username_format = %Lu ## ## Password and user databases ## # # Password database is used to verify user's password (and nothing more). # You can have multiple passdbs and userdbs. This is useful if you want to # allow both system users (/etc/passwd) and virtual users to login without # duplicating the system users into virtual database. # # <doc/wiki/PasswordDatabase.txt> # # User database specifies where mails are located and what user/group IDs # own them. For single-UID configuration use "static" userdb. # # <doc/wiki/UserDatabase.txt> #!include conf.d/auth-deny.conf.ext #!include conf.d/auth-master.conf.ext #!include conf.d/auth-system.conf.ext #!include conf.d/auth-sql.conf.ext #!include conf.d/auth-ldap.conf.ext !include conf.d/auth-passwdfile.conf.ext #!include conf.d/auth-checkpassword.conf.ext #!include conf.d/auth-static.conf.ext ## 10-director.conf ## 10-logging.conf # Loglevel festelegen auth_verbose = no auth_debug = no mail_debug = yes ## 10-mail.conf # Format der Mailbox ändern mail_location = maildir:~/Maildir namespace inbox { # Namespace type: private, shared or public type = private # Hierarchy separator to use. You should use the same separator for all # namespaces or some clients get confused. '/' is usually a good one. # The default however depends on the underlying mail storage format. separator = / # Prefix required to access this namespace. This needs to be different for # all namespaces. For example "Public/". prefix = INBOX/ # Physical location of the mailbox. This is in same format as # mail_location, which is also the default for it. location = # There can be only one INBOX, and this setting defines which namespace # has it. inbox = yes # If namespace is hidden, it's not advertised to clients via NAMESPACE # extension. You'll most likely also want to set list=no. This is mostly # useful when converting from another server with different namespaces which # you want to deprecate but still keep working. For example you can create # hidden namespaces with prefixes "~/mail/", "~%u/mail/" and "mail/". hidden = no # If namespace namespace/location fails to load, by default the entire # session will fail to start. If this is set, this namespace will be ignored # instead. ignore_on_failure = no # Show the mailboxes under this namespace with LIST command. This makes the # namespace visible for clients that don't support NAMESPACE extension. # "children" value lists child mailboxes, but hides the namespace prefix. list = yes # Namespace handles its own subscriptions. If set to "no", the parent # namespace handles them (empty prefix should always have this as "yes") subscriptions = yes # See 15-mailboxes.conf for definitions of special mailboxes. } ## 10-master.conf service lmtp { inet_listener lmtp { address = 127.0.0.1 ::1 port = 24 } } service auth { # auth_socket_path points to this userdb socket by default. It's typically # used by dovecot-lda, doveadm, possibly imap process, etc. Users that have # full permissions to this socket are able to get a list of all usernames and # get the results of everyone's userdb lookups. # # The default 0666 mode allows anyone to connect to the socket, but the # userdb lookups will succeed only if the userdb returns an "uid" field that # matches the caller process's UID. Also if caller's uid or gid matches the # socket's uid or gid the lookup succeeds. Anything else causes a failure. # # To give the caller full permissions to lookup all users, set the mode to # something else than 0666 and Dovecot lets the kernel enforce the # permissions (e.g. 0777 allows everyone full permissions). unix_listener auth-userdb { #mode = 0666 #user = #group = } # Postfix smtp-auth unix_listener /var/spool/postfix/private/auth { mode = 0666 } # Auth process is run as this user. #user = $default_internal_user } ## 10-ssl.conf ## 10-tcpwrapper.conf ## 15-lda.conf ## 15-mailboxes.conf namespace inbox { inbox = yes mailbox Spam { auto = subscribe special_use = \Junk } mailbox Trash { auto = subscribe special_use = \Trash } mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Sent { auto = subscribe special_use = \Sent } } ## 20-imap.conf protocol imap { # Space separated list of plugins to load (default is global mail_plugins). mail_plugins = $mail_plugins imap_sieve } ## 20-lmtp.conf protocol lmtp { # Space separated list of plugins to load (default is global mail_plugins). mail_plugins = $mail_plugins sieve } ## 20-managesieve.conf ## 90-acl.conf ## 90-plugin.conf ## 90-quota.conf ## 90-sieve.conf plugin { sieve_before = /etc/dovecot/conf.d/custom-sieve/global_before.sieve sieve_after = /etc/dovecot/conf.d/custom-sieve/global_after.sieve sieve_plugins = sieve_imapsieve sieve_extprograms # From elsewhere to Spam folder imapsieve_mailbox1_name = Spam imapsieve_mailbox1_causes = COPY APPEND imapsieve_mailbox1_before = file:/usr/lib/dovecot/sieve/report-spam.sieve # From Spam folder to elsewhere imapsieve_mailbox2_name = * imapsieve_mailbox2_from = Spam imapsieve_mailbox2_causes = COPY APPEND imapsieve_mailbox2_before = file:/usr/lib/dovecot/sieve/report-ham.sieve sieve_pipe_bin_dir = /usr/lib/dovecot/sieve sieve_global_extensions = +vnd.dovecot.pipe +vnd.dovecot.environment } ## 90-sieve-extprograms.conf root@ServerIV-home:~# ^C root@ServerIV-home:~# cat /etc/dovecot/local.conf ## dovecot.conf # Mailuser im Log mit Namen darstellen verbose_proctitle = yes protocols = imap lmtp sieve ## 10-auth.conf # Disable LOGIN command and all other plaintext authentications unless # SSL/TLS is used (LOGINDISABLED capability). Note that if the remote IP # matches the local IP (ie. you're connecting from the same computer), the # connection is considered secure and plaintext authentication is allowed. # See also ssl=required setting. disable_plaintext_auth = yes # Space separated list of wanted authentication mechanisms: # plain login digest-md5 cram-md5 ntlm rpa apop anonymous gssapi otp # gss-spnego # NOTE: See also disable_plaintext_auth setting. auth_mechanisms = plain login # Username formatting before it's looked up from databases. You can use # the standard variables here, eg. %Lu would lowercase the username, %n would # drop away the domain if it was given, or "%n-AT-%d" would change the '@' into # "-AT-". This translation is done after auth_username_translation changes. auth_username_format = %Lu ## ## Password and user databases ## # # Password database is used to verify user's password (and nothing more). # You can have multiple passdbs and userdbs. This is useful if you want to # allow both system users (/etc/passwd) and virtual users to login without # duplicating the system users into virtual database. # # <doc/wiki/PasswordDatabase.txt> # # User database specifies where mails are located and what user/group IDs # own them. For single-UID configuration use "static" userdb. # # <doc/wiki/UserDatabase.txt> #!include conf.d/auth-deny.conf.ext #!include conf.d/auth-master.conf.ext #!include conf.d/auth-system.conf.ext #!include conf.d/auth-sql.conf.ext #!include conf.d/auth-ldap.conf.ext !include conf.d/auth-passwdfile.conf.ext #!include conf.d/auth-checkpassword.conf.ext #!include conf.d/auth-static.conf.ext ## 10-director.conf ## 10-logging.conf # Loglevel festelegen auth_verbose = no auth_debug = no mail_debug = yes ## 10-mail.conf # Format der Mailbox ändern mail_location = maildir:~/Maildir namespace inbox { # Namespace type: private, shared or public type = private # Hierarchy separator to use. You should use the same separator for all # namespaces or some clients get confused. '/' is usually a good one. # The default however depends on the underlying mail storage format. separator = / # Prefix required to access this namespace. This needs to be different for # all namespaces. For example "Public/". prefix = INBOX/ # Physical location of the mailbox. This is in same format as # mail_location, which is also the default for it. location = # There can be only one INBOX, and this setting defines which namespace # has it. inbox = yes # If namespace is hidden, it's not advertised to clients via NAMESPACE # extension. You'll most likely also want to set list=no. This is mostly # useful when converting from another server with different namespaces which # you want to deprecate but still keep working. For example you can create # hidden namespaces with prefixes "~/mail/", "~%u/mail/" and "mail/". hidden = no # If namespace namespace/location fails to load, by default the entire # session will fail to start. If this is set, this namespace will be ignored # instead. ignore_on_failure = no # Show the mailboxes under this namespace with LIST command. This makes the # namespace visible for clients that don't support NAMESPACE extension. # "children" value lists child mailboxes, but hides the namespace prefix. list = yes # Namespace handles its own subscriptions. If set to "no", the parent # namespace handles them (empty prefix should always have this as "yes") subscriptions = yes # See 15-mailboxes.conf for definitions of special mailboxes. } ## 10-master.conf service lmtp { inet_listener lmtp { address = 127.0.0.1 ::1 port = 24 } } service auth { # auth_socket_path points to this userdb socket by default. It's typically # used by dovecot-lda, doveadm, possibly imap process, etc. Users that have # full permissions to this socket are able to get a list of all usernames and # get the results of everyone's userdb lookups. # # The default 0666 mode allows anyone to connect to the socket, but the # userdb lookups will succeed only if the userdb returns an "uid" field that # matches the caller process's UID. Also if caller's uid or gid matches the # socket's uid or gid the lookup succeeds. Anything else causes a failure. # # To give the caller full permissions to lookup all users, set the mode to # something else than 0666 and Dovecot lets the kernel enforce the # permissions (e.g. 0777 allows everyone full permissions). unix_listener auth-userdb { #mode = 0666 #user = #group = } # Postfix smtp-auth unix_listener /var/spool/postfix/private/auth { mode = 0666 } # Auth process is run as this user. #user = $default_internal_user } ## 10-ssl.conf ## 10-tcpwrapper.conf ## 15-lda.conf ## 15-mailboxes.conf namespace inbox { inbox = yes mailbox Spam { auto = subscribe special_use = \Junk } mailbox Trash { auto = subscribe special_use = \Trash } mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Sent { auto = subscribe special_use = \Sent } } ## 20-imap.conf protocol imap { # Space separated list of plugins to load (default is global mail_plugins). mail_plugins = $mail_plugins imap_sieve } ## 20-lmtp.conf protocol lmtp { # Space separated list of plugins to load (default is global mail_plugins). mail_plugins = $mail_plugins sieve } ## 20-managesieve.conf ## 90-acl.conf ## 90-plugin.conf ## 90-quota.conf ## 90-sieve.conf plugin { sieve_before = /etc/dovecot/conf.d/custom-sieve/global_before.sieve sieve_after = /etc/dovecot/conf.d/custom-sieve/global_after.sieve sieve_plugins = sieve_imapsieve sieve_extprograms # From elsewhere to Spam folder imapsieve_mailbox1_name = Spam imapsieve_mailbox1_causes = COPY APPEND imapsieve_mailbox1_before = file:/usr/lib/dovecot/sieve/report-spam.sieve # From Spam folder to elsewhere imapsieve_mailbox2_name = * imapsieve_mailbox2_from = Spam imapsieve_mailbox2_causes = COPY APPEND imapsieve_mailbox2_before = file:/usr/lib/dovecot/sieve/report-ham.sieve sieve_pipe_bin_dir = /usr/lib/dovecot/sieve sieve_global_extensions = +vnd.dovecot.pipe +vnd.dovecot.environment } ## 90-sieve-extprograms.conf root@ServerIV-home:~# cat /etc/dovecot/local.conf ## dovecot.conf # Mailuser im Log mit Namen darstellen verbose_proctitle = yes protocols = imap lmtp sieve ## 10-auth.conf # Disable LOGIN command and all other plaintext authentications unless # SSL/TLS is used (LOGINDISABLED capability). Note that if the remote IP # matches the local IP (ie. you're connecting from the same computer), the # connection is considered secure and plaintext authentication is allowed. # See also ssl=required setting. disable_plaintext_auth = yes # Space separated list of wanted authentication mechanisms: # plain login digest-md5 cram-md5 ntlm rpa apop anonymous gssapi otp # gss-spnego # NOTE: See also disable_plaintext_auth setting. auth_mechanisms = plain login # Username formatting before it's looked up from databases. You can use # the standard variables here, eg. %Lu would lowercase the username, %n would # drop away the domain if it was given, or "%n-AT-%d" would change the '@' into # "-AT-". This translation is done after auth_username_translation changes. auth_username_format = %Lu ## ## Password and user databases ## # # Password database is used to verify user's password (and nothing more). # You can have multiple passdbs and userdbs. This is useful if you want to # allow both system users (/etc/passwd) and virtual users to login without # duplicating the system users into virtual database. # # <doc/wiki/PasswordDatabase.txt> # # User database specifies where mails are located and what user/group IDs # own them. For single-UID configuration use "static" userdb. # # <doc/wiki/UserDatabase.txt> #!include conf.d/auth-deny.conf.ext #!include conf.d/auth-master.conf.ext #!include conf.d/auth-system.conf.ext #!include conf.d/auth-sql.conf.ext #!include conf.d/auth-ldap.conf.ext !include conf.d/auth-passwdfile.conf.ext #!include conf.d/auth-checkpassword.conf.ext #!include conf.d/auth-static.conf.ext ## 10-director.conf ## 10-logging.conf # Loglevel festelegen auth_verbose = no auth_debug = no mail_debug = yes ## 10-mail.conf # Format der Mailbox ändern mail_location = maildir:~/Maildir namespace inbox { # Namespace type: private, shared or public type = private # Hierarchy separator to use. You should use the same separator for all # namespaces or some clients get confused. '/' is usually a good one. # The default however depends on the underlying mail storage format. separator = / # Prefix required to access this namespace. This needs to be different for # all namespaces. For example "Public/". prefix = INBOX/ # Physical location of the mailbox. This is in same format as # mail_location, which is also the default for it. location = # There can be only one INBOX, and this setting defines which namespace # has it. inbox = yes # If namespace is hidden, it's not advertised to clients via NAMESPACE # extension. You'll most likely also want to set list=no. This is mostly # useful when converting from another server with different namespaces which # you want to deprecate but still keep working. For example you can create # hidden namespaces with prefixes "~/mail/", "~%u/mail/" and "mail/". hidden = no # If namespace namespace/location fails to load, by default the entire # session will fail to start. If this is set, this namespace will be ignored # instead. ignore_on_failure = no # Show the mailboxes under this namespace with LIST command. This makes the # namespace visible for clients that don't support NAMESPACE extension. # "children" value lists child mailboxes, but hides the namespace prefix. list = yes # Namespace handles its own subscriptions. If set to "no", the parent # namespace handles them (empty prefix should always have this as "yes") subscriptions = yes # See 15-mailboxes.conf for definitions of special mailboxes. } ## 10-master.conf service lmtp { inet_listener lmtp { address = 127.0.0.1 ::1 port = 24 } } service auth { # auth_socket_path points to this userdb socket by default. It's typically # used by dovecot-lda, doveadm, possibly imap process, etc. Users that have # full permissions to this socket are able to get a list of all usernames and # get the results of everyone's userdb lookups. # # The default 0666 mode allows anyone to connect to the socket, but the # userdb lookups will succeed only if the userdb returns an "uid" field that # matches the caller process's UID. Also if caller's uid or gid matches the # socket's uid or gid the lookup succeeds. Anything else causes a failure. # # To give the caller full permissions to lookup all users, set the mode to # something else than 0666 and Dovecot lets the kernel enforce the # permissions (e.g. 0777 allows everyone full permissions). unix_listener auth-userdb { #mode = 0666 #user = #group = } # Postfix smtp-auth unix_listener /var/spool/postfix/private/auth { mode = 0666 } # Auth process is run as this user. #user = $default_internal_user } ## 10-ssl.conf ## 10-tcpwrapper.conf ## 15-lda.conf ## 15-mailboxes.conf namespace inbox { inbox = yes mailbox Spam { auto = subscribe special_use = \Junk } mailbox Trash { auto = subscribe special_use = \Trash } mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Sent { auto = subscribe special_use = \Sent } } ## 20-imap.conf protocol imap { # Space separated list of plugins to load (default is global mail_plugins). mail_plugins = $mail_plugins imap_sieve } ## 20-lmtp.conf protocol lmtp { # Space separated list of plugins to load (default is global mail_plugins). mail_plugins = $mail_plugins sieve } ## 20-managesieve.conf ## 90-acl.conf ## 90-plugin.conf ## 90-quota.conf ## 90-sieve.conf plugin { sieve_before = /etc/dovecot/conf.d/custom-sieve/global_before.sieve sieve_after = /etc/dovecot/conf.d/custom-sieve/global_after.sieve sieve_plugins = sieve_imapsieve sieve_extprograms # From elsewhere to Spam folder imapsieve_mailbox1_name = Spam imapsieve_mailbox1_causes = COPY APPEND imapsieve_mailbox1_before = file:/usr/lib/dovecot/sieve/report-spam.sieve # From Spam folder to elsewhere imapsieve_mailbox2_name = * imapsieve_mailbox2_from = Spam imapsieve_mailbox2_causes = COPY APPEND imapsieve_mailbox2_before = file:/usr/lib/dovecot/sieve/report-ham.sieve sieve_pipe_bin_dir = /usr/lib/dovecot/sieve sieve_global_extensions = +vnd.dovecot.pipe +vnd.dovecot.environment } ## 90-sieve-extprograms.conf Meanwhile I tried a lot of several guides in the internet – nothing of them worked for me – what’s hard to understand because it’s a fresh and simple installation I did. Any help is very appreciated! Thanks Jens

4 6

Sieve Symlink Error
by Benjamin Rose 01 Jul '24

01 Jul '24

Hello, I'm in the process of moving our mail server from RHEL 6 to RHEL 9. We will be moving to: # dovecot --version 2.3.16 (7e2e900c1a) My issue is that sieve does not appear to work on the new setup, where it does work on the old one. I made a simple filter rule: # cat /u/mail0test/.sieve/ingo.sieve # Sieve Filter # Generated by Ingo (http://www.horde.org/apps/ingo/) (06/28/2024, 11:14:52 PM) require "fileinto"; # Test if header :comparator "i;ascii-casemap" :contains "Subject" "filtertest" { fileinto "Fun"; stop; } Upon sending an email to this test account, the following appears in /var/log/maillog: Jun 29 23:19:56 mail5 dovecot[3066980]: lda(mail0test)<3066980><FA8fFtzOgGZkzC4AuM9lWg>: Warning: sieve: file storage: Active sieve script symlink /u/mail0test/.dovecot.sieve is broken: Invalid/unknown path to storage (points to /u/mail0test/.sieve). Jun 29 23:19:56 mail5 dovecot[2987026]: doveadm(mail0test)<3066983><KFf4FtzOgGZnzC4AuM9lWg>: Warning: sieve: file storage: Active sieve script symlink /u/mail0test/.dovecot.sieve is broken: Invalid/unknown path to storage (points to /u/mail0test/.sieve). Jun 29 23:19:56 mail5 dovecot[2987026]: doveadm(mail0test)<3067016><VdsdK9zOgGaIzC4AuM9lWg>: Warning: sieve: file storage: Active sieve script symlink /u/mail0test/.dovecot.sieve is broken: Invalid/unknown path to storage (points to /u/mail0test/.sieve). Yet: # ll /u/mail0test/.dovecot.sieve lrwxrwxrwx. 1 mail0test sysguest 17 Jun 28 23:26 /u/mail0test/.dovecot.sieve -> .sieve/ingo.sieve # file /u/mail0test/.sieve/ingo.sieve /u/mail0test/.sieve/ingo.sieve: ASCII text That is the filter file I've pasted above. I've set the following directives in /etc/dovecot/conf.d/90-sieve.conf via puppet: augeas { "dovecot_sieve_settings": context => "/files/etc/dovecot/conf.d/90-sieve.conf", changes => [ "set plugin/sieve_dir ~/.sieve", "set plugin/sieve_user_log ~/.sieve/log" ], require => Package["dovecot"], notify => Service["dovecot"]; } The full configuration dump is attached. /u in our environment is the path for user homedirs, which is an NFS mount to a NetApp. The OS is Springdale Linux 9.2, a clone of RedHat from before the IBM license change. It will soon be RHEL 9.4 as we have obtained a license, but for all intents and purposes, Springdale 9.2 and RHEL 9.2 should be considered bug-for-bug compatible. The arch is x86_64 with both machines mail5 and mail6 (replicated) having Intel(R) Xeon(R) Gold 6244 CPU @ 3.60GHz and 768gb of memory. I have the same issue with SELinux in both enforcing and permissive modes, so this is not a permissions error due to SELinux. Am I doing something wrong, or is this a bug? I've seen that there have been some previous issues similar to this that ended up being bugs in pigeonhole, so here I am. Thanks, Ben

2 3

Timeout when opening folder
by Entrepreneur AJ 28 Jun '24

28 Jun '24

Hi all, I'm stuck with an issue. Migrating everything to a k0s kubernetes cluster, trying to migrate dovecot and all so far seems to be well with PVC for mail storage, ssl working great, authentication vis PostgreSQL working great. Issue is when trying to look at another folder say Deleted or Spam etc folder I am getting a timeout error with no logs. I disabled apparmour on the nodes the try again and the following error message appears; Jun 24 21:01:55 imap-login: Info: Login: user=<eaj>, method=PLAIN, rip=194.207.0.0, lip=10.244.24.235, mpid=15, TLS, session=<eTNaF6kbzJHCz3qg> Jun 24 21:01:55 imap(eaj)<15><eTNaF6kbzJHCz3qg>: Debug: Added userdb setting: mail=maildir:/srv/vmail/eaj Jun 24 21:01:55 imap(eaj)<15><eTNaF6kbzJHCz3qg>: Debug: Effective uid=1000, gid=1000, home=/srv/vmail/eaj Jun 24 21:01:55 imap(eaj)<15><eTNaF6kbzJHCz3qg>: Debug: open(/proc/self/io) failed: Permission denied Jun 24 21:01:55 imap(eaj)<15><eTNaF6kbzJHCz3qg>: Debug: Namespace inbox: type=private, prefix=, sep=, inbox=yes, hidden=no, list=yes, subscriptions=yes location=maildir:/srv/vmail/eaj Jun 24 21:01:55 imap(eaj)<15><eTNaF6kbzJHCz3qg>: Debug: maildir++: root=/srv/vmail/eaj, index=, indexpvt=, control=, inbox=/srv/vmail/eaj, alt= Jun 24 21:01:55 imap(eaj)<14><3PRZF6kb0JHCz3qg>: Debug: Mailbox INBOX: Mailbox opened Jun 24 21:02:24 imap(eaj)<15><eTNaF6kbzJHCz3qg>: Debug: Mailbox Sent: Couldn't open mailbox in list index: Storage size changed 160 != 396 Jun 24 21:02:24 imap(eaj)<15><eTNaF6kbzJHCz3qg>: Debug: Mailbox Sent: Mailbox opened Jun 24 21:02:24 imap(eaj)<15><eTNaF6kbzJHCz3qg>: Debug: Mailbox Drafts: Couldn't open mailbox in list index: Storage size changed 160 != 396 Jun 24 21:02:24 imap(eaj)<15><eTNaF6kbzJHCz3qg>: Debug: Mailbox Drafts: Mailbox opened Thunderbird keeps showing a timeout error after a few minutes. Dovecot Version: 2.3.21 (47349e2482) dovecot -n config: # 2.3.21 (47349e2482): /etc/dovecot/dovecot.conf # OS: Linux 5.15.0-112-generic x86_64 # Hostname: dovecot-549bdc98ff-tzwcf auth_debug = yes auth_debug_passwords = yes auth_mechanisms = plain login auth_verbose = yes auth_verbose_passwords = yes base_dir = /var/run/dovecot/ first_valid_uid = 1000 import_environment = TZ last_valid_uid = 1000 log_path = /dev/stdout login_greeting = IMAP ready. mail_debug = yes mail_home = /srv/vmail/%n mail_location = maildir:~ namespace inbox { hidden = no inbox = yes list = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Spam { auto = subscribe special_use = \Junk } mailbox Trash { auto = subscribe special_use = \Trash } prefix = subscriptions = yes type = private } passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } plugin { acl = vfile:/etc/dovecot/global-acls:cache_secs=300 acl_shared_dict = file:/var/lib/dovecot/shared-mailboxes imap_compress_deflate_level = 9 mail_crypt_global_private_key = # hidden, use -P to show it mail_crypt_global_public_key = # hidden, use -P to show it mail_crypt_save_version = 2 zlib_save = zstd zlib_save_level = 3 } service auth-worker { user = vmail } service auth { unix_listener auth-userdb { group = vmail mode = 0600 user = vmail } } service dict { unix_listener dict { group = vmail mode = 0660 user = vmail } } service imap-login { inet_listener imap { port = 143 } inet_listener imaps { port = 993 ssl = yes } } service lmtp { inet_listener lmtp { port = 24 } user = vmail } service pop3-login { inet_listener pop3 { port = 0 } inet_listener pop3s { port = 0 ssl = yes } } service submission-login { inet_listener submission { port = 0 } inet_listener submissions { port = 0 } } ssl = required ssl_cert = </etc/dovecot/certs/tls.crt ssl_cipher_list = ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305 ssl_key = # hidden, use -P to show it ssl_prefer_server_ciphers = yes userdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } verbose_ssl = yes protocol imap { mail_plugins = postmaster_address = postmaster(a)eajglobal.net } protocol lmtp { mail_plugins = postmaster_address = postmaster(a)eajglobal.net } Any pointers would be highly appreciated.

5 7

Oauth2 remote IP address
by Scott Q. 27 Jun '24

27 Jun '24

Anyone knows how to configure Dovecot to send the real remote ip address of the user to the oauth2 provider ( Keycloak in this case ) ? Right now I see the request as coming from the Dovecot server... Thank you, Scott

1 0

sieve comparator i;unicode-casemap RFC5051
by Alexey 25 Jun '24

25 Jun '24

Hello. Am I right that currently there is no chance to compare non-ascii characters case-insensitive? (UTF-8 strings from inside Subject or Body) I'm looking for :comparator i;unicode-casemap, but can't find it. It is described in RFC5051. Regards, Alexey

1 0

logging computer name
by hp＠hungpham.no 25 Jun '24

25 Jun '24

I am running Dovecot 2.3.21. One client has multiple computers in their LAN, connecting to my server with a static IP. One or several computers in that LAN keep logging in with failed password, but the Dovecot log only shows the public static IP, like this Jun 25 10:39:20 server-name dovecot[689]: imap-login: Disconnected: Connection closed (auth failed, 2 attempts in 62 secs): user=<xxxx(a)domainyyy.com>, method=PLAIN, rip=client-public-IP, lip=server-IP, TLS, session=<MCLxoK4bksIO8zXR> I tried to enable debug, but there is no more information about the LAN IP or computer names. Is there any setting which helps me with that purpose? So it will be much easier to locate the failed computers in that LAN? Thank you.

3 2

Re: Only some of my sent emails are stored in sent-folder
by Joseph Tam 22 Jun '24

22 Jun '24

From: Nils <dovecot(a)bugblatterbeast.de> > Still, there is no filter rule that would apply to that. Additionally, I > only use "fileinto" actions in my filter rules. No, I meant Thunderbird's rules and filters. If your mail reader decides to not save the message, IMAP and Sireve will never see it. Joseph Tam <jtam.home(a)gmail.com>

1 0

Only some of my sent emails are stored in sent-folder
by Nils 21 Jun '24

21 Jun '24

Lots of the emails I send aren't stored in the sent folder. It seems that it mostly (but not always) work for sent emails where the main email-address (the one that is also used as login name) is used as sender. It never seems to work when an alias is used as sender name. There isn't any entry in the mail.err log and nothing that looks suspicious to me in the regular mail.log. I didn't notice it at first, because I usually don't check my sent folder that much, but I it seems to have started when I migrated to the new server a few weeks ago. Any idea what could be the reason for it? Kind regards, Nils Test 1 using main email address (NOT STORED IN SENT FOLDER) Jun 20 20:10:28 SERVER postfix/submission/smtpd[5156]: connect from INTERNET_PROVIDER[IPV6_ADDRESS] Jun 20 20:10:28 SERVER postfix/submission/smtpd[5156]: 3B8B0C0DA8: client=INTERNET_PROVIDER[IPV6_ADDRESS], sasl_method=PLAIN, sasl_username=RECIPIENT(a)SERVER.TLD Jun 20 20:10:28 SERVER postfix/cleanup[5161]: 3B8B0C0DA8: message-id=<bcdc1b7e-e3f1-4a82-8fd9-05dd307313e4(a)SERVER.TLD> Jun 20 20:10:28 SERVER amavis[5197]: (05197-01) Passed CLEAN {AcceptedInbound}, AM.PDP-SOCK [IPV6_ADDRESS] [IPV6_ADDRESS] <RECIPIENT(a)SERVER.TLD> -> <RECIPIENT(a)SERVER.TLD>, Queue-ID: 3B8B0C0DA8, Message-ID: <bcdc1b7e-e3f1-4a82-8fd9-05dd307313e4(a)SERVER.TLD>, mail_id: nv7qsKFzK11D, Hits: 0.975, size: 702, 463 ms Jun 20 20:10:28 SERVER opendkim[1081]: 3B8B0C0DA8: DKIM-Signature field added (s=SERVER.TLD, d=SERVER.TLD) Jun 20 20:10:28 SERVER postfix/qmgr[1792]: 3B8B0C0DA8: from=<RECIPIENT(a)SERVER.TLD>, size=402, nrcpt=1 (queue active) Jun 20 20:10:28 SERVER dovecot: lmtp(5228): Connect from local Jun 20 20:10:28 SERVER dovecot: lmtp(RECIPIENT(a)SERVER.TLD)<5228><cL5iLbSMdGZsFAAAVy37qw>: sieve: msgid=<bcdc1b7e-e3f1-4a82-8fd9-05dd307313e4(a)SERVER.TLD>: stored mail into mailbox 'INBOX' Jun 20 20:10:28 SERVER postfix/lmtp[5227]: 3B8B0C0DA8: to=<RECIPIENT(a)SERVER.TLD>, relay=SERVER.TLD[private/dovecot-lmtp], delay=0.55, delays=0.54/0/0/0.01, dsn=2.0.0, status=sent (250 2.0.0 <RECIPIENT(a)SERVER.TLD> cL5iLbSMdGZsFAAAVy37qw Saved) Jun 20 20:10:28 SERVER dovecot: lmtp(5228): Disconnect from local: Logged out (state=READY) Jun 20 20:10:28 SERVER postfix/qmgr[1792]: 3B8B0C0DA8: removed Jun 20 20:10:28 SERVER dovecot: imap-login: Login: user=<RECIPIENT(a)SERVER.TLD>, method=PLAIN, rip=IPV6_ADDRESS, lip=2a01:4f8:10a:e50::2, mpid=5248, TLS, session=<DdED6FcbbusgAwDKv0yBAGXh6Xy3cdaM> Jun 20 20:10:29 SERVER dovecot: imap(RECIPIENT(a)SERVER.TLD)<5248><DdED6FcbbusgAwDKv0yBAGXh6Xy3cdaM>: Disconnected: Logged out in=496 out=637 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0 Jun 20 20:10:33 SERVER postfix/submission/smtpd[5156]: disconnect from INTERNET_PROVIDER[IPV6_ADDRESS] ehlo=2 starttls=1 auth=1 mail=1 rcpt=1 data=1 quit=1 commands=8 Test 2 using alias email address (NOT STORED IN SENT FOLDER) Jun 20 20:10:41 SERVER postfix/submission/smtpd[5156]: connect from INTERNET_PROVIDER[IPV6_ADDRESS] Jun 20 20:10:42 SERVER postfix/submission/smtpd[5156]: 184A5C0DAD: client=INTERNET_PROVIDER[IPV6_ADDRESS], sasl_method=PLAIN, sasl_username=EMAIL(a)SERVER.TLD Jun 20 20:10:42 SERVER postfix/cleanup[5161]: 184A5C0DAD: message-id=<bc2f2025-67e0-4780-9a54-8f06c3b16389(a)SERVER.TLD> Jun 20 20:10:42 SERVER amavis[5196]: (05196-02) Passed CLEAN {AcceptedInbound}, AM.PDP-SOCK [IPV6_ADDRESS] [IPV6_ADDRESS] <ALIAS(a)SERVER.TLD> -> <RECIPIENT(a)SERVER.TLD>, Queue-ID: 184A5C0DAD, Message-ID: <bc2f2025-67e0-4780-9a54-8f06c3b16389(a)SERVER.TLD>, mail_id: ySF-pJQA8aRl, Hits: 0.975, size: 716, 607 ms Jun 20 20:10:42 SERVER opendkim[1081]: 184A5C0DAD: DKIM-Signature field added (s=key1, d=SERVER.TLD) Jun 20 20:10:42 SERVER postfix/qmgr[1792]: 184A5C0DAD: from=<ALIAS(a)SERVER.TLD>, size=408, nrcpt=1 (queue active) Jun 20 20:10:42 SERVER dovecot: lmtp(5228): Connect from local Jun 20 20:10:42 SERVER dovecot: lmtp(RECIPIENT(a)SERVER.TLD)<5228><KCs+LcKMdGZsFAAAVy37qw>: sieve: msgid=<bc2f2025-67e0-4780-9a54-8f06c3b16389(a)SERVER.TLD>: stored mail into mailbox 'INBOX' Jun 20 20:10:42 SERVER dovecot: lmtp(5228): Disconnect from local: Logged out (state=READY) Jun 20 20:10:42 SERVER postfix/lmtp[5227]: 184A5C0DAD: to=<RECIPIENT(a)SERVER.TLD>, relay=SERVER.TLD[private/dovecot-lmtp], delay=0.69, delays=0.68/0/0/0.01, dsn=2.0.0, status=sent (250 2.0.0 <RECIPIENT(a)SERVER.TLD> KCs+LcKMdGZsFAAAVy37qw Saved) Jun 20 20:10:42 SERVER postfix/qmgr[1792]: 184A5C0DAD: removed Jun 20 20:10:47 SERVER postfix/submission/smtpd[5156]: disconnect from INTERNET_PROVIDER[IPV6_ADDRESS] ehlo=2 starttls=1 auth=1 mail=1 rcpt=1 data=1 quit=1 commands=8 Test 3 using main email address (stored in sent-folder) Jun 20 20:30:24 SERVER postfix/submission/smtpd[5813]: connect from INTERNET_PROVIDER[IPV6_ADDRESS] Jun 20 20:30:25 SERVER postfix/submission/smtpd[5813]: 3F2C1C0DAD: client=INTERNET_PROVIDER[IPV6_ADDRESS], sasl_method=PLAIN, sasl_username=EMAIL(a)SERVER.TLD Jun 20 20:30:25 SERVER postfix/cleanup[5818]: 3F2C1C0DAD: message-id=<603d7b61-d8d1-4099-bbc2-f0d2e9c776ee(a)SERVER.TLD> Jun 20 20:30:26 SERVER amavis[5197]: (05197-02) Passed CLEAN {AcceptedInbound}, AM.PDP-SOCK [IPV6_ADDRESS] [IPV6_ADDRESS] <EMAIL(a)SERVER.TLD> -> <RECIPIENT(a)SERVER.TLD>, Queue-ID: 3F2C1C0DAD, Message-ID: <603d7b61-d8d1-4099-bbc2-f0d2e9c776ee(a)SERVER.TLD>, mail_id: KDDY0Tv2B0Ut, Hits: 0.975, size: 704, 1096 ms Jun 20 20:30:26 SERVER opendkim[1081]: 3F2C1C0DAD: DKIM-Signature field added (s=key1, d=SERVER.TLD) Jun 20 20:30:26 SERVER postfix/qmgr[1792]: 3F2C1C0DAD: from=<EMAIL(a)SERVER.TLD>, size=398, nrcpt=1 (queue active) Jun 20 20:30:26 SERVER dovecot: lmtp(5824): Connect from local Jun 20 20:30:26 SERVER dovecot: lmtp(RECIPIENT(a)SERVER.TLD)<5824><xsEAGWKRdGbAFgAAVy37qw>: sieve: msgid=<603d7b61-d8d1-4099-bbc2-f0d2e9c776ee(a)SERVER.TLD>: stored mail into mailbox 'INBOX' Jun 20 20:30:26 SERVER postfix/lmtp[5823]: 3F2C1C0DAD: to=<RECIPIENT(a)SERVER.TLD>, relay=SERVER.TLD[private/dovecot-lmtp], delay=1.2, delays=1.2/0.01/0.01/0.01, dsn=2.0.0, status=sent (250 2.0.0 <RECIPIENT(a)SERVER.TLD> xsEAGWKRdGbAFgAAVy37qw Saved) Jun 20 20:30:26 SERVER dovecot: lmtp(5824): Disconnect from local: Logged out (state=READY) Jun 20 20:30:26 SERVER postfix/qmgr[1792]: 3F2C1C0DAD: removed Jun 20 20:30:26 SERVER dovecot: imap(EMAIL(a)SERVER.TLD)<5669><5nRfHlgbHIYgAwDKv0yBAGXh6Xy3cdaM>: Disconnected: Logged out in=1228 out=11932 deleted=0 expunged=0 trashed=0 hdr_count=3 hdr_bytes=816 body_count=0 body_bytes=0 Jun 20 20:30:31 SERVER postfix/submission/smtpd[5813]: disconnect from INTERNET_PROVIDER[IPV6_ADDRESS] ehlo=2 starttls=1 auth=1 mail=1 rcpt=1 data=1 quit=1 commands=8

6 15

RE: Only some of my sent emails are stored in sent-folder
by Joseph Tam 21 Jun '24

21 Jun '24

From: Nils <dovecot(a)bugblatterbeast.de> > Lots of the emails I send aren't stored in the sent folder. It seems > that it mostly (but not always) work for sent emails where the main > email-address (the one that is also used as login name) is used as > sender. It never seems to work when an alias is used as sender name. Sounds to me like some mail reader filtering rule. Ordinarily, dovecot does not handle the capture of outgoing mail, Most of the time, it's the mail reader (MUA) that files outgoing messages to a sent-mail folder, and less commonly, the MTA will do it. Mail readers probably employ their own logic to determine what belongs in the sent mail folder: it could be all outgoing mail, it could be redirected based on some role filter. If you have a repeatable case, check it against your filter rule set. If it's inconsistent (the same message does and does not make it into your sent mail folder), you can look at other causes. Joseph Tam <jtam.home(a)gmail.com>

2 1

Core-dump on SSL connection
by Scott Q. 21 Jun '24

21 Jun '24

I'm on Debian 12.5 which comes with openssl 3.0.11 I compiled Dovecot 2.3.21 with some pretty vanilla options: /configure --prefix=/usr/local/dovecot --with-sql --with-mysql --with-docs --with-ssl --without-shadow --without-pam --without-ldap --without-pgsql --without-sqlite --with-systemd systemunitdir=/lib/systemd/system when I connect to it via SSL it core-dumps: Jun 18 20:50:01 mail kernel: imap-login[396438]: segfault at 69 ip 00007f2e5ee19556 sp 00007fffd7ca38f8 error 4 in libcrypto.so.3[7f2e5ecc5000+279000] likely on CPU 8 (core 8, socket 0) Jun 18 20:50:01 mail kernel: Code: c2 31 d2 31 ff c3 66 0f 1f 44 00 00 31 d2 31 ff c3 0f 1f 00 31 c0 48 85 ff 74 41 48 8b 57 08 8b 87 8c 00 00 00 48 85 d2 74 22 8b 52 68 48 85 d2 74 19 48 83 ec 08 ff d2 31 d2 85 c0 0f 48 c2 Anyone encountered something similar and knows how to fix it ?

4 8