August 2024 - dovecot

2.3.21.1 and oauth
by v＠minakov.pro 14 Nov '24

14 Nov '24

Hello! I'm using dovecot with keycloak for oauth authentication. My config is: client_id = dovecot client_secret = MY_SECRET introspection_url = https://MY_KEYCLOAK/realms/master/protocol/openid-connect/token/introspect introspection_mode = post pass_attrs = pass=%{oauth2:access_token} Everything worked great on version 2.3.20. After upgrading to version 2.3.21.1 oauth stopped working with errors: auth: Debug: http-client: conn [::1]:443 [1]: Got 401 response for request [Req1: POST https://MY_KEYCLOAK/realms/master/protocol/openid-connect/token/introspect] Unauthorized (took 5 ms + >Aug 16 00:23:58 auth: Error: oauth2(MY_EMAIL,127.0.0.1,<HADwdb8f+PN/AAAB>): oauth2 failed: Introspection failed: No username returned I tried all combination of configurations, debugging and versions of keycloak. Seems something was broken in this version of dovecot.

3 3

sieve crashes when two optional include scripts are missing
by Michal Hlavinka 27 Oct '24

27 Oct '24

Hi, we've found an issue with sieve plugin. When script includes two missing optional scripts, it causes crash. For reproducing the issue, script names must belong to same hash table node, so either two scripts with same name or scripts where 'hash(name) % table->size' results in same value, like missing_a and missing_aa in reproducer below. Reduced reproducer: cat >dovecot.min.conf <<EOF mail_location = maildir:~/Maildir plugin { sieve = file:/tmp;active=/tmp/dovecot.sieve } EOF cat >reproducer.sieve <<EOF require "include"; include :personal :optional "missing_a"; include :personal :optional "missing_aa"; EOF echo -n > empty sieve-test -c dovecot.min.conf reproducer.sieve empty any test mail would do, but empty file is enough for reproducer # return sblock->id causes the crash as sblock is NULL backtrace: (gdb) bt #0 sieve_binary_block_get_id (sblock=0x0) at src/lib-sieve/sieve-binary.c:421 #1 ext_include_execute_include (renv=0x5555555bbed8, include_id=1, flags=EXT_INCLUDE_FLAG_OPTIONAL) at plugins/include/ext-include-common.c:696 #2 opc_include_execute (renv=0x5555555bbed8, address=0x5555555bbf10) at plugins/include/cmd-include.c:399 #3 sieve_interpreter_operation_execute (interp=0x5555555bbe88) at src/lib-sieve/sieve-interpreter.c:901 #4 sieve_interpreter_continue (interp=0x5555555bbe88, interrupted=0x0) at src/lib-sieve/sieve-interpreter.c:959 #5 sieve_interpreter_start (interp=0x5555555bbe88, result=0x5555555b9230, interrupted=0x0) at src/lib-sieve/sieve-interpreter.c:1049 #6 sieve_interpreter_run (interp=0x5555555bbe88, result=0x5555555b9230) at src/lib-sieve/sieve-interpreter.c:1057 #7 sieve_run (sbin=0x55555558ee18, result=0x5555555b9230, eenv=0x7fffffffe890, ehandler=0x55555558c338) at src/lib-sieve/sieve.c:357 #8 sieve_test (sbin=0x55555558ee18, msgdata=0x7fffffffe9f0, senv=0x7fffffffea30, ehandler=0x55555558c338, stream=0x5555555b2cd0, flags=SIEVE_EXECUTE_FLAG_LOG_RESULT) at src/lib-sieve/sieve.c:598 #9 main (argc=5, argv=0x555555567a10) at src/sieve-tools/sieve-test.c:391 issue seems to be caused by lib-sieve/plugins/include/ext-include-common.c: ext_include_generate_include on first pass (script) the check for script already compiled into binary at 529: included = ext_include_binary_script_get_include_info(binctx, script); returns NULL, so code goes through 'else' block where it hits sieve_script_is_open(script) check. It includes script with NULL block, returns 0 so caller cmd_include_generate does not emit anything. On second pass the above 'included' check returns first missing script, it goes through true block where it just checks flags and returns non-zero, so caller this time goes through the emit code block and the previously included NULL sblock gets referenced causing crash later. Note: despite scripts have different name, they pass the "same script" check because sieve_file_script_equals compares 0==0 dev & inode numbers as scripts do not exist. This is why scripts do not have to have same names. Side effect of this is that as missing_a and missing_aa are treated like the same script, only first one is linked in compiled svbin. Which means that if missing_aa reappears later, svbin won't get recompiled. Another manifestation of the issue is when included missing_a script is present when main script is compiled and later missina_a is removed again. During execution, script is not recompiled and it aborts for hash table dupe check: sieve_binary_open->ext_include_binary_script_include->hash_table_insert There are several ways how to solve this. I've tried a few, but there were other corner cases that appeared. One tried way was for example ext_include_generate_include in the 'if (included)' replicate the check sieve_script_is_open(...) from else block, just check flags, no include and set result to 0. Another way to solve this is to return from ext_include_execute_include early if sblock is NULL just before it tries to derefernce it, similarly as it does if it fails 'once' check. Same for dumping in opc_include_dump. Whilst the first approach seems a bit better, it won't stop crashing in existing environments as it won't trigger svbin recompilation and svbin would fail. This means that the second soultion is sort of needed anyway. This still won't solve the problem with different missing scripts as only first one would be able to trigger recompilation when file becomes available. Just including both in the mentioned function won't work either as they would still be evaluated as same and hash table anti-dupe check would trigger abort. So some changes in script comparison seem needed anyway. This is what I've used in my approach. Return early from ext_include_execute_include and opc_include_dump if sblock is NULL and change sieve_file_script_equals to compare also script->location for missing scripts (when inode is 0). Let me know if you need more information. Cheers, Michal Hlavinka

2 1

Uppercase username emails are rejected
by lua8ds＠proton.me 20 Oct '24

20 Oct '24

When a sender writes my email address with my username uppercase, e.g. USERNAME(a)name.com, in the to: field of their MUA, my mail server rejects that email. /var/log/mail.log prints: <USERNAME(a)redacted.com>: host mail.redacted.com[private/dovecot-lmtp] said: 550 5.1.1 > <USERNAME(a)redacted.com> User doesn't exist: USERNAME(a)redacted.com (in reply to RCPT TO > command) In the manual, I found that: auth_username_format Default: %Lu Formatting applied to username before querying the auth database. You can use the standard variables here. Examples: %Lu Lowercases the username [...] My current setting was not the default; I had: auth_username_format = %n So I updated that setting to: auth_username_format = %Lu expecting that %Lu would lowercase the username - and that my problem would be fixed. It does not though. Updating this setting not only prompts my email server to still reject USERNAME(a)redacted.com, but now also rejects (lowercase username) username(a)redacted.com (which my server had no issue receiving beforehand). So I reverted auth_username_format to: auth_username_format = %n Emails sent to username(a)redacted.com land in my mailbox again - but emails sent to USERNAME(a)redacted.com still don't. What can I try to troubleshoot? Which config file shall I share with you?

10 22

dsync with vurtial folder leads to mess of msg ID
by Kirill A. Korinsky 25 Sep '24

25 Sep '24

Greetings, I have a setup with two dovecot servers and dsync replication between them. On both of them I have a virtual folders, forexample All with config: mx1# cat /etc/dovecot/virtual/All/dovecot-virtual * -Trash -Trash/* -Junk -Junk/* all All virtual folders are excluded from replication because it leads to broken replication with errors like: virtual.All can't be created. So, I have. replication_dsync_parameters = -d -l 30 -U -x virtual. Unfortently, after a couple of weeks I've noticed that msg id for the same message on the different servers aren't match. For example: mx1# doveadm fetch -u kirill(a)korins.ky 'uid' mailbox virtual.All header Message-ID 'macports/macports-ports/pull/22284/c1901369454(a)github.com' uid: 157786 mx1# doveadm fetch -u kirill(a)korins.ky 'uid' mailbox INBOX header Message-ID 'macports/macports-ports/pull/22284/c1901369454(a)github.com' uid: 5561 mx1# vs mx2# doveadm fetch -u kirill(a)korins.ky 'uid' mailbox virtual.All header Message-ID 'macports/macports-ports/pull/22284/c1901369454(a)github.com' uid: 157766 mx2# doveadm fetch -u kirill(a)korins.ky 'uid' mailbox INBOX header Message-ID 'macports/macports-ports/pull/22284/c1901369454(a)github.com' uid: 5561 mx2# as you may see msgid at INBOX are matched, but it isn't true for virtual.All, here 157786 vs 157766 So, here the question: how can I sync msg id inside virtual folder on this setup? -- wbr, Kirill

2 18

Pay Someone to Take My Online Course?
by xotawa2329＠hapincy.com 17 Sep '24

17 Sep '24

Pay Someone to Take My Online Course? Different understudies who battle with reworking school, work, and family obligations select online class tutors to assist them with finishing their tests and complete their coursework. In any case, some solicitation the ethicality of this planning. While <a href="https://onlineclassservices.com/nurs-fpx-4040-assessment-4-attempt-1-inform…">NURS FPX 4040 Assessment 4</a>  has every one of the reserves of being enticing, it goes with two or three serious dangers. This article will examine a piece of the things you ought to remember going before enlisting an online class help association. It's clearly a fact that online classes can be truly troublesome, particularly for working professionals who have a clamoring plan. Oftentimes they are searching for someone to take a whole course or individual tasks for them, to assist with managing their grades and moderate their strain. Nonetheless, be wary of affiliations that guarantee too wonderful to be authentic. They could charge you enormous totals for their associations and end up not conveying. The best technique for guaranteeing that you are getting anything that would be fair is to use an online class tutor who offers an inadequate responsibility. Additionally, review that different schools consider paying someone to take an online class to swindle. Therefore, whenever got, you could go facing silly outcomes like besieging the course, scholarly suspension or even send off. To this end picking a fair relationship with a showed history is crucial. The association is clear: present your mentioning and survey offers from qualified educated authorities. Then enlist the one that is reasonable for yourself and store maintains in <a href="https://onlineclassservices.com/nurs-fpx-4050-assessment-1-attempt-3-prelim…">NURS FPX 4050 Assessment 1</a>  scrow until your assignment is finished. Online classes are eminent among understudies who need to save time on education and spotlight more on work or other private issues. These merge understudies who are taking courses while working and attempting to change family and profession responsibilities, military understudies on sending, and understudies with genuine inadequacies or sickness that make it pursuing for them to go to classes. Unfortunately, there are many tricks that confirmation to take online courses for you. These affiliations charge ridiculous totals and don't complete their obligations. They may also hand you over to your school. Tolerating that they do, you could be killed from your underwriting project or even suspended or removed from school. This isn't the very thing that you truly need for your business and future. Therefore, you genuinely need to track down serious areas of strength for a that offers a fair cost and mind blowing results. To this end you ought to search for a <a href="https://onlineclassservices.com/nurs-fpx-4050-assessment-2-attempt-1-ethica…">NURS FPX 4050 Assessment 2</a>  affiliation that has an inadequate responsibility and splendid customer association. Various individuals decide to use a professional to take their online class since they need the opportunity to go to it very close. They could be working the whole day, supervising family issues, or fighting disease and disappointments that log jam their review tendencies. These professionals can assist you with fulfilling time necessities, stay away from imaginative theft, and set free your nights to zero in on work or other unwinding works out. They may comparatively have the decision to help you with beating any learning handicaps you have. Copyright infringement suggests utilizing someone else's words and thoughts without their endorsement. It is viewed as a kind of cheating and can accomplish a delicate grade or even send off from school. It is difficult to ensure that a used professional won't phony. This is on the grounds that educational foundations don't have <a href="https://onlineclassservices.com/nurs-fpx-4900-assessment-1-assessing-the-pr…">NURS FPX 4900 Assessment 1 Assessing the Problem</a>  assets for check whether understudies are authentic or not. This truly expects that tolerant you are gotten, you will probably lose the cash you paid to have someone take your class. There's no veritable strategy for remaining caution assuming the solitary you enroll to take your online course will tell the truth and dependable. They probably won't be in a tantamount state as you. Moreover, they apparently won't be as dedicated to finishing the class for you as you are. They may very well be doing the base extent of work expected to get reviewed and a brief time frame later vanish. MORE <a href="https://dev.gajim.org/gajim/website/-/issues/35#note_211778">Facebook is a powerful tool for business</a> <a href="https://xtremepape.rs/members/horridhenry7860.397211/about">Mobile Application Development Services</a> <a href="https://xtremepape.rs/members/samfarrid4563.397213/about">best digital marketing agencies</a>

4 3

Dovecot v2.3.21.1 released
by Aki Tuomi 07 Sep '24

07 Sep '24

Hi all, we are releasing a CVE patch release 2.3.21.1. https://dovecot.org/releases/2.3/dovecot-2.3.21.1.tar.gz https://dovecot.org/releases/2.3/dovecot-2.3.21.1.tar.gz.sig Binary packages in https://repo.dovecot.org/ Docker images in https://hub.docker.com/r/dovecot/dovecot Kind regards, Aki Tuomi Open-Xchange oy --- - CVE-2024-23184: A large number of address headers in email resulted in excessive CPU usage. - CVE-2024-23185: Abnormally large email headers are now truncated or discarded, with a limit of 10MB on a single header and 50MB for all the headers of all the parts of an email. - oauth2: Dovecot would send client_id and client_secret as POST parameters to introspection server. These need to be optionally in Basic auth instead as required by OIDC specification. - oauth2: JWT key type check was too strict. - oauth2: JWT token audience was not validated against client_id as required by OIDC specification. - oauth2: XOAUTH2 and OAUTHBEARER mechanisms were not giving out protocol specific error message on all errors. This broke OIDC discovery. - oauth2: JWT aud validation was not performed if aud was missing from token, but was configured on Dovecot.

5 9

Re: Dovecot authentication hangs when ldap_start_tls_s() fails for invalid certificate
by Aki Tuomi 04 Sep '24

04 Sep '24

> On 19/11/2020 12:55 sebastiano degan <sebastiano.degan(a)frigoveneta.it> wrote: > > > On a Debian10 I've installed postfix 3.4.14 and dovecot 2.3.4.1. > I've configured multiple passdb sources and I expect that if one fails > the other ones are tested. > This is usually the case, except when the failure is due to an invalid > certificate from the ldap server. > In that case all authentication attempts from that moment on will fail. Hi! Can you try with latest CE release from https://repo.dovecot.org/ Regards, Aki

2 1

What are all the /var/spool/smtpd/offline/1689525601.XXXXlJ85yQ
by Steve Litt 03 Sep '24

03 Sep '24

Hi all, I just filled up my whole /var with zillions of files /var/spool/smtpd/offline , dating back to 2018. What are these files and is it safe for me to delete the ones more than a week old? Thanks, SteveT Steve Litt http://444domains.com

5 7

Inconsistency in map index with dovecot v2.3.21
by Nikolaos Pyrgiotis 02 Sep '24

02 Sep '24

Hello, We have been running dovecot version 2.3.21 since July on debian bookworm system. After upgrading we have seen in the logs similar messages to the following: 2024-08-29T19:33:27.755399+03:00 server1 dovecot: lmtp(user1(a)modulus.gr)<481240><7TMeHNei0GYpeTkA1g8ogQ:P1>: Warning: mdbox /path/user1/mdbox/storage: Inconsistency in map index (2213,40 != 2213,56). 2024-08-29T19:33:27.755399+03:00 server1 dovecot: lmtp(user1(a)modulus.gr)<481240><7TMeHNei0GYpeTkA1g8ogQ:P1>: Warning: mdbox /path/user1/mdbox/storage: Inconsistency in map index (2213,40 != 2213,56) 2024-08-29T19:33:27.838990+03:00 server1 dovecot: lmtp(user1(a)modulus.gr)<481240><7TMeHNei0GYpeTkA1g8ogQ:P1>: sieve: msgid=<39f9c444-0c08-4bda-bfc9-512c34584470(a)modulus.gr>: fileinto action: stored mail into mailbox 'Replies' 2024-08-29T19:33:27.840222+03:00 server1 dovecot: lmtp(user1(a)modulus.gr)<481240><7TMeHNei0GYpeTkA1g8ogQ:P1>: Warning: fscking index file /path/user1/mdbox/storage/dovecot.map.index 2024-08-29T19:33:27.953281+03:00 server1 dovecot: lmtp(user1(a)modulus.gr)<481240><7TMeHNei0GYpeTkA1g8ogQ:P1>: Warning: mdbox /path/user1/mdbox/storage: rebuilding indexes 2024-08-29T19:37:27.989792+03:00 server1 dovecot: lmtp(user1(a)modulus.gr)<481249><vhzsLROj0GYQVgcAfAk26A:P1>: Error: Timeout (180s)while waiting for lock for transaction log file /path/user1/mdbox/storage/dovecot.map.index.log (WRITE lock held by pid 481240) 2024-08-29T19:37:27.995913+03:00 server1 dovecot: lmtp(user1(a)modulus.gr)<481249><vhzsLROj0GYQVgcAfAk26A:P1>: Error: sieve: msgid=<39f9c444-0c08-4bda-bfc9-512c34584470(a)modulus.gr>: fileinto action: failed to store into mailbox 'Mailbox': Timeout (180s) while waiting for lock for transaction log file /path/user1/mdbox/storage/dovecot.map.index.log (WRITE lock held by pid 481240) This has happened a few times since we upgraded always by a lmtp process. It seems to be happening randomly and we have not been able to reproduce it. The mailboxes are stored in a glusterfs server, and we use the dovecot director with shared mailboxes architecture. Usually this was mitigated automatically by dovecot index rebuilding, but last time it happened on a mailbox with a lot of giga byte of mail data the following logs were produced for more than an hour: 2024-08-29T19:45:30.506694+03:00 server1 dovecot: lmtp(user1(a)modulus.gr)<481240><7TMeHNei0GYpeTkA1g8ogQ:P1>: Error: mmap_anon(/path/user/mdbox/mailboxes/Mailbox/dbox-Mails/dovecot.index.cache, 74076160) failed: Cannot allocate memory During that period segfaults starting being generated for the imap processes accessing that mailbox probably caused by timeouts from imap processes attempting to fetch emails from the affected mailbox: [3912187.557029] imap[481783]: segfault at 38 ip 00007fb03248abf8 sp 00007ffc88b264f0 error 4 in libdovecot-storage.so.0.0.0[7fb0323c7000+d8000] likely on CPU 6 (core 3, socket 0) What might be the reason that inconsistency of the map index is introduced on random users? We have seen some other users had similar issues and have mentioned them on this mailing list(dovecot Digest, Vol 249, Issue 4, dovecot Digest, Vol 250, Issue 8)? Is there any update for a mitigation or bug confirmation for dovecot version 2.3.21 that might be responsible? Thank you, Nikos Pyrgiotis

4 6

Fwd: maintainer-feedback requested: [Bug 280929] mail/dovecot move bogus warning "Time moved forwards" to debug
by Larry Rosenman 01 Sep '24

01 Sep '24

Comments from the dovecot community? Aug 19, 2024 11:07:30 AM bugzilla-noreply(a)freebsd.org: Bugzilla Automation <bugzilla(a)FreeBSD.org> has asked Larry Rosenman <ler(a)FreeBSD.org> for maintainer-feedback: Bug 280929: mail/dovecot move bogus warning "Time moved forwards" to debug https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=280929 --- Description --- Dovecot complains about time moving forward, which seems to be due to a broken mechanism (on FreeBSD) used to measure timeouts. This warning spams the maillog up to several hundred times per day. There's an ongoing thread about this issue in the freebsd forums: https://forums.freebsd.org/threads/dovecot-time-moved-forwards.82886 In post #33 RypPn points out the offending line in main.c and in post #34 msplsh suggests instead of completely removing/commenting out the line, it would be more sensible to move it from 'warning' to 'debug'. This is what this patch does: change the log facility to 'debug' to mute that bogus message for standard configurations, but keep it in 'debug' for anyone who might want to debug that issue in the future. I tested the patch as a local patch in poudriere and it builds fine on 13.3-RELEASE with the quarterly and latest branch.

7 12