January 2025 - dovecot

Proper syntax for using `allow_nets` with dovecot passdb sql
by Kevin Farley 24 Jan '25

24 Jan '25

Hi there, I posted this question in ServerFault (https://serverfault.com/questions/1170095/proper-syntax-for-using-allow-net…) but haven't gotten an answer after 10 days so thought I'd try here, I appreciate any help you can offer! I want to allow for two auth methods in dovecot via SQL. First, the traditional route where the password is hashed with |SHA512-CRYPT| and compared to the DB response. Second, where the request is coming from a user already authenticated by a different part of the local system, and the hash itself is passed and compared as |PLAIN|. It works perfectly with the following |auth-sql.conf.ext| and associated sql files... |# Passdb for traditional method passdb { driver = sql args = /etc/dovecot/conf.d/dovecot-sql.conf.ext } # Passdb for hybrid method (direct hash comparison) passdb { driver = sql args = /etc/dovecot/conf.d/dovecot-sql-hybrid.conf.ext } # Userdb prefetch to use attributes from the passdb query userdb { driver = prefetch } # Userdb static as fallback for default attributes userdb { driver = static args = uid=vmail gid=vmail home=/srv/mail/%d/%n } | The problem I'm having is that I want to secure the second hybrid |PLAIN| method so that it can only be used by the local host using the |allow_nets| argument. In the documentation <https://doc.dovecot.org/2.3/configuration_manual/authentication/allow_nets/…> it shows that I should simply add it to the |args| like this... |args = /etc/dovecot/conf.d/dovecot-sql-hybrid.conf.ext allow_nets=local,127.0.0.1/32 | But as soon as I do this, the logs show that it's trying to open the entire string as if the |allow_nets...| argument is part of the path, and fails to find the file. I've tried moving the |allow_nets| argument to the beginning, but that had the same result. What is the correct syntax for using |allow_nets| with |passdb sql|? # 2.3.16 (7e2e900c1a): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.16 (09c29328) # OS: Linux 5.14.0-503.21.1.el9_5.x86_64 x86_64 Rocky Linux release 9.5 (Blue Onyx) xfs Thanks, Kevin.

1 0

doveadm mailbox list permission failure for virtual user
by leo1subscr＠zudiewiener.com 23 Jan '25

23 Jan '25

I'm using Dovecot 2.3.21 (47349e2482) on Ubuntu and have convigured virtual mail users. Everything is working finem but a few doevadm commands fail sudo doveadm mailbox list returns doveadm(root): Error: chdir(/root/) failed: Permission denied (euid=1001(vmail) egid=1001(vmail) missing +x perm: /root, dir owned by 0:0 mode=0700)

3 2

Fwd: Fwd: [OFFLIST] Re: connection refused, no error anywhere
by Marco Fioretti 23 Jan '25

23 Jan '25

Hi Robert, I corrected the service imap-login section of both dovecot.conf AND conf.d/10-master.conf as you suggested, The files in ssl_cert and ssl_key exist and are readable by dovecot. I have even changed for testing the permission of /etc/letsencrypt/live /etc/letsencrypt/archive to 0755 and restarted dovecot. However, the output of ss -tuln | grep 993 is still null. What next? Thanks ---------- Forwarded message --------- Da: Robert Nowotny <rnowotny(a)rotek.at> Date: mar 21 gen 2025 alle ore 23:47 Subject: RE: Fwd: [OFFLIST] Re: connection refused, no error anywhere To: Marco Fioretti <marco.fioretti(a)gmail.com> To resolve the connection refused error when accessing Dovecot on the new server, you need to adjust the Dovecot configuration to enable the appropriate IMAP service ports. 1. Enable IMAPS (Port 993) for Secure Connections: - Modify the `service imap-login` section in your Dovecot configuration (likely in `/etc/dovecot/conf.d/10-master.conf`) to include an `imaps` listener: ```conf service imap-login { inet_listener imap { port = 0 # Disables plain IMAP (port 143) } inet_listener imaps { port = 993 ssl = yes } } ``` - This configuration disables plaintext IMAP on port 143 and enables IMAPS on port 993 with SSL. 2. Ensure SSL Certificates Are Correct: - Verify the paths to your SSL certificate and key in `/etc/dovecot/conf.d/10-ssl.conf`: ```conf ssl_cert = </etc/letsencrypt/live/example.com/fullchain.pem ssl_key = </etc/letsencrypt/live/example.com/privkey.pem ``` - Confirm the files exist and have proper permissions (readable by Dovecot). 3. Restart Dovecot: ```bash sudo systemctl restart dovecot ``` 4. Verify Dovecot is Listening: ```bash sudo ss -tuln | grep 993 ``` - You should see Dovecot listening on port 993. 5. Test the Connection Using SSL: ```bash openssl s_client -connect example.com:993 ``` - This should establish a secure connection to the IMAPS port. Additional Recommendations: - Disable Plaintext IMAP: Keeping `port = 0` for the `imap` listener ensures unencrypted IMAP is disabled, enhancing security. - Firewall Configuration: Confirm UFW allows port 993: ```bash sudo ufw allow 993/tcp ``` By enabling IMAPS on port 993 and ensuring SSL is properly configured, secure email access will be restored. If you must use port 143 (not recommended), set `port = 143` in the `imap` listener and enforce STARTTLS by adding `ssl = required` in your SSL configuration. *Von:* Marco Fioretti via dovecot <dovecot(a)dovecot.org> <dovecot(a)dovecot.org> *Gesendet:* Dienstag, 21. Januar 2025 um 23:22 MEZ *An:* Dovecot <dovecot(a)dovecot.org> <dovecot(a)dovecot.org> *Betreff:* FW: [OFFLIST] Re: connection refused, no error anywhere ---------- Forwarded message --------- Da: Marco Fioretti <marco.fioretti(a)gmail.com> <marco.fioretti(a)gmail.com> Date: mar 21 gen 2025 alle ore 19:33 Subject: Re: [OFFLIST] Re: connection refused, no error anywhere To: Michael Peddemors <michael(a)linuxmagic.com> <michael(a)linuxmagic.com> Hi Michel, I cannot say which NGO it is. What I know is that everything with that configuration was working fine, as far as they know, on the old server. So, any help to change the configuration to make it work with the current version of dovecot on Ubuntu 24.04LTS is very welcome... Il giorno mar 21 gen 2025 alle ore 19:11 Michael Peddemors <michael(a)linuxmagic.com> ha scritto: Which NGO? Don't listen on port 143 any more, make sure to only listen on 587/465/993/995 with TLS/SSL.. NGO's are often targeted.. On 2025-01-21 09:50, Marco Fioretti via dovecot wrote: Greetings, I was just tasked with rebuilding from scratch the mail server of an NGO, on a brand new Ubuntu 24.04 LTS VPS. I have copied the whole dovecot configuration to the new server, and now am stuck because: - dovecot IS running, dovecot service status shows no errors, but: - if I try to connect with mutt from my desktop I get "connection refused" - the ufw firewall does allow imap/imaps connections, and there are no errors in its log - even "telnet localhost 143" fails: Trying ::1... Connection failed: Connection refused Trying 127.0.0.1... telnet: Unable to connect to remote host: Connection refused - I see no related errors in /var/log/mail.log or /var/log/syslog. output of dovecot -n is pasted below, I only changed the actual domain name to "example.com" TIA for any pointer, I really need to get this server back online as soon as possible... Marco # 2.3.21 (47349e2482): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.21 (f6cd4b8e) doveconf: Warning: NOTE: You can get a new clean config file with: doveconf -Pn > dovecot-new.conf doveconf: Warning: Obsolete setting in /etc/dovecot/conf.d/10-ssl.conf:9: ssl_dh_parameters_length is no longer needed # OS: Linux 6.8.0-51-generic x86_64 Ubuntu 24.04.1 LTS ext4 # Hostname: example.com auth_debug = yes auth_verbose = yes auth_verbose_passwords = plain mail_location = maildir:/var/mail/mymail_storage/base/ mbox_write_locks = fcntl passdb { args = /etc/imap.v_users driver = passwd-file } passdb { driver = pam } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } } service imap-login { inet_listener imap { port = 0 } } ssl_cert = </etc/letsencrypt/live/example.com/fullchain.pem ssl_cipher_list = ALL ssl_key = # hidden, use -P to show it ssl_prefer_server_ciphers = yes userdb { args = /etc/imap.v_users driver = passwd-file } userdb { driver = passwd } verbose_ssl = yes _______________________________________________ dovecot mailing list -- dovecot(a)dovecot.org To unsubscribe send an email to dovecot-leave(a)dovecot.org -- "Catch the Magic of Linux..." ------------------------------------------------------------------------ Michael Peddemors, President/CEO LinuxMagic Inc. Visit us at http://www.linuxmagic.com @linuxmagic A Wizard IT Company - For More Info http://www.wizard.ca "LinuxMagic" a Reg. TradeMark of Wizard Tower TechnoServices Ltd. ------------------------------------------------------------------------ 604-682-0300 Beautiful British Columbia, Canada _______________________________________________ dovecot mailing list -- dovecot(a)dovecot.org To unsubscribe send an email to dovecot-leave(a)dovecot.org

6 13

dovecot not listening, but doing passw checks? Was: connection refused, no error anywhere
by Marco Fioretti 22 Jan '25

22 Jan '25

Greetings, I just woke up and went back to try to diagnose the problem I first reported in my other thread, and noticed something weird. After your suggestions, the situation is as follow: 0) FTR, postfix is working, if I open the local mailboxes with mutt running on the server I do see email coming in as expected, from mailing lists and our correspondents 1) output of dovecot -n is below 2) both "ss -tuln | grep 993" and "netstat -tanp" show NO activity /presence on port 993 3) BUT, running "service dovecot status" (see output below, I only changed server and user name) I noticed a failed authentication attempt from SOMEUSER2, happened ~15/20 minutes before I checked, where "SOMEUSER" (without the trailing "2") is an ACTUAL user of the old server, and 200.89.159.59 an IP address I don't know (not my desktop's for sure, and AFAIK no legitimate user is trying to use the server at this time, they know I'm rebuilding it...) Now the question is, OK, that attempt may be some attacker trying to get in, this happens but... HOW is he succeeding to TRY to connect, if dovecot doesn't appear to be listening at all??? And of course, does this help in any way to figure out what is wrong with my configuration? Thanks, Marco ######################################### OUTPUT of dovecot -n (actual domain name changed to example.com) # 2.3.21 (47349e2482): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.21 (f6cd4b8e) doveconf: Warning: NOTE: You can get a new clean config file with: doveconf -Pn > dovecot-new.conf doveconf: Warning: Obsolete setting in /etc/dovecot/conf.d/10-ssl.conf:9: ssl_dh_parameters_length is no longer needed # OS: Linux 6.8.0-51-generic x86_64 Ubuntu 24.04.1 LTS ext4 # Hostname: nexaima auth_debug = yes auth_verbose = yes auth_verbose_passwords = plain mail_debug = yes mail_location = maildir:/var/mail/mymail_storage/base/ mbox_write_locks = fcntl passdb { args = /etc/imap.v_users driver = passwd-file } passdb { driver = pam } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } } service imap-login { inet_listener imap { port = 0 } inet_listener imaps { port = 993 ssl = yes } } ssl_cert = </etc/letsencrypt/live/example.com/fullchain.pem ssl_cipher_list = ALL ssl_key = # hidden, use -P to show it ssl_prefer_server_ciphers = yes userdb { args = /etc/imap.v_users driver = passwd-file } userdb { driver = passwd } verbose_ssl = yes ###################################################### FULL OUTPUT OF "service dovecot status": root@example:/# service dovecot status ● dovecot.service - Dovecot IMAP/POP3 email server Loaded: loaded (/usr/lib/systemd/system/dovecot.service; enabled; preset: enabled) Active: active (running) since Tue 2025-01-21 23:41:45 UTC; 5h 24min ago Docs: man:dovecot(1) https://doc.dovecot.org/ Main PID: 35241 (dovecot) Status: "v2.3.21 (47349e2482) running" Tasks: 5 (limit: 4543) Memory: 3.6M (peak: 5.5M) CPU: 503ms CGroup: /system.slice/dovecot.service ├─35241 /usr/sbin/dovecot -F ├─35242 dovecot/anvil ├─35243 dovecot/log ├─35246 dovecot/config └─35323 dovecot/stats Jan 22 04:49:06 example dovecot[35243]: auth-worker(37492): Debug: conn unix:auth-worker (pid=37491,uid=111): auth-worker<2>: pam(SOMEUSER2,200.89.159.59): #1/1 style=1 > Jan 22 04:49:06 example auth[37492]: pam_unix(dovecot:auth): check pass; user unknown Jan 22 04:49:06 example auth[37492]: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=SOMEUSER2 rhost=200.89.159.59 Jan 22 04:49:08 example dovecot[35243]: auth-worker(37492): conn unix:auth-worker (pid=37491,uid=111): auth-worker<2>: pam(SOMEUSER2,200.89.159.59): pam_authenticate() f> Jan 22 04:49:08 example dovecot[35243]: auth-worker(37492): Debug: conn unix:auth-worker (pid=37491,uid=111): auth-worker<2>: pam(SOMEUSER2,200.89.159.59): Finished pass> Jan 22 04:49:08 example dovecot[35243]: auth-worker(37492): Debug: conn unix:auth-worker (pid=37491,uid=111): auth-worker<2>: Finished: password_mismatch Jan 22 04:49:08 example dovecot[35243]: auth: Debug: pam(SOMEUSER2,200.89.159.59): Finished passdb lookup Jan 22 04:49:08 example dovecot[35243]: auth: Debug: auth(SOMEUSER2,200.89.159.59): Auth request finished Jan 22 04:49:10 example dovecot[35243]: auth: Debug: client passdb out: FAIL 2 user=SOMEUSER2 Jan 22 04:50:06 example dovecot[35243]: auth-worker(37492): Debug: conn unix:auth-worker (pid=37491,uid=111): Disconnected: Connection closed (fd=-1) lines 1-27/27 (END)

3 5

Fwd: [OFFLIST] Re: connection refused, no error anywhere
by Marco Fioretti 21 Jan '25

21 Jan '25

---------- Forwarded message --------- Da: Marco Fioretti <marco.fioretti(a)gmail.com> Date: mar 21 gen 2025 alle ore 19:33 Subject: Re: [OFFLIST] Re: connection refused, no error anywhere To: Michael Peddemors <michael(a)linuxmagic.com> Hi Michel, I cannot say which NGO it is. What I know is that everything with that configuration was working fine, as far as they know, on the old server. So, any help to change the configuration to make it work with the current version of dovecot on Ubuntu 24.04LTS is very welcome... Il giorno mar 21 gen 2025 alle ore 19:11 Michael Peddemors < michael(a)linuxmagic.com> ha scritto: > Which NGO? > > Don't listen on port 143 any more, make sure to only listen on > 587/465/993/995 with TLS/SSL.. > > NGO's are often targeted.. > > > > On 2025-01-21 09:50, Marco Fioretti via dovecot wrote: > > Greetings, > > > > I was just tasked with rebuilding from scratch the mail server of an NGO, > > on a brand new Ubuntu 24.04 LTS VPS. > > > > I have copied the whole dovecot configuration to the new server, and now > am > > stuck because: > > > > - dovecot IS running, dovecot service status shows no errors, but: > > > > - if I try to connect with mutt from my desktop I get "connection > refused" > > > > - the ufw firewall does allow imap/imaps connections, and there are no > > errors in its log > > > > - even "telnet localhost 143" fails: > > Trying ::1... > > Connection failed: Connection refused > > Trying 127.0.0.1... > > telnet: Unable to connect to remote host: Connection refused > > > > - I see no related errors in /var/log/mail.log or /var/log/syslog. > > > > > > output of dovecot -n is pasted below, I only changed the actual domain > name > > to "example.com" > > > > TIA for any pointer, I really need to get this server back online as soon > > as possible... > > > > Marco > > > > # 2.3.21 (47349e2482): /etc/dovecot/dovecot.conf > > # Pigeonhole version 0.5.21 (f6cd4b8e) > > doveconf: Warning: NOTE: You can get a new clean config file with: > doveconf > > -Pn > dovecot-new.conf > > doveconf: Warning: Obsolete setting in /etc/dovecot/conf.d/10-ssl.conf:9: > > ssl_dh_parameters_length is no longer needed > > # OS: Linux 6.8.0-51-generic x86_64 Ubuntu 24.04.1 LTS ext4 > > # Hostname: example.com > > auth_debug = yes > > auth_verbose = yes > > auth_verbose_passwords = plain > > mail_location = maildir:/var/mail/mymail_storage/base/ > > mbox_write_locks = fcntl > > passdb { > > args = /etc/imap.v_users > > driver = passwd-file > > } > > passdb { > > driver = pam > > } > > service auth { > > unix_listener /var/spool/postfix/private/auth { > > group = postfix > > mode = 0660 > > user = postfix > > } > > } > > service imap-login { > > inet_listener imap { > > port = 0 > > } > > } > > ssl_cert = </etc/letsencrypt/live/example.com/fullchain.pem > > ssl_cipher_list = ALL > > ssl_key = # hidden, use -P to show it > > ssl_prefer_server_ciphers = yes > > userdb { > > args = /etc/imap.v_users > > driver = passwd-file > > } > > userdb { > > driver = passwd > > } > > verbose_ssl = yes > > _______________________________________________ > > dovecot mailing list -- dovecot(a)dovecot.org > > To unsubscribe send an email to dovecot-leave(a)dovecot.org > > > -- > "Catch the Magic of Linux..." > ------------------------------------------------------------------------ > Michael Peddemors, President/CEO LinuxMagic Inc. > Visit us at http://www.linuxmagic.com @linuxmagic > A Wizard IT Company - For More Info http://www.wizard.ca > "LinuxMagic" a Reg. TradeMark of Wizard Tower TechnoServices Ltd. > ------------------------------------------------------------------------ > 604-682-0300 Beautiful British Columbia, Canada > >

1 0

Fwd: connection refused, no error anywhere
by Marco Fioretti 21 Jan '25

21 Jan '25

Hi Nick, honestly, I don't know why that port was set to 0, I just inherited the whole server... however, even changing that number to 143 and restarting dovecot makes no difference in the output of netstat I just pasted in another reply.... Il giorno mar 21 gen 2025 alle ore 19:00 Nick Howitt via dovecot < dovecot(a)dovecot.org> ha scritto: > Any reason why the imap-listener port is set to 0 and not 143 or > commented out? > > Have you checked if dovecot is listening on 143? > > > On 21/01/2025 17:50, Marco Fioretti via dovecot wrote: > > Greetings, > > > > I was just tasked with rebuilding from scratch the mail server of an NGO, > > on a brand new Ubuntu 24.04 LTS VPS. > > > > I have copied the whole dovecot configuration to the new server, and now > am > > stuck because: > > > > - dovecot IS running, dovecot service status shows no errors, but: > > > > - if I try to connect with mutt from my desktop I get "connection > refused" > > > > - the ufw firewall does allow imap/imaps connections, and there are no > > errors in its log > > > > - even "telnet localhost 143" fails: > > Trying ::1... > > Connection failed: Connection refused > > Trying 127.0.0.1... > > telnet: Unable to connect to remote host: Connection refused > > > > - I see no related errors in /var/log/mail.log or /var/log/syslog. > > > > > > output of dovecot -n is pasted below, I only changed the actual domain > name > > to "example.com" > > > > TIA for any pointer, I really need to get this server back online as soon > > as possible... > > > > Marco > > > > # 2.3.21 (47349e2482): /etc/dovecot/dovecot.conf > > # Pigeonhole version 0.5.21 (f6cd4b8e) > > doveconf: Warning: NOTE: You can get a new clean config file with: > doveconf > > -Pn > dovecot-new.conf > > doveconf: Warning: Obsolete setting in /etc/dovecot/conf.d/10-ssl.conf:9: > > ssl_dh_parameters_length is no longer needed > > # OS: Linux 6.8.0-51-generic x86_64 Ubuntu 24.04.1 LTS ext4 > > # Hostname: example.com > > auth_debug = yes > > auth_verbose = yes > > auth_verbose_passwords = plain > > mail_location = maildir:/var/mail/mymail_storage/base/ > > mbox_write_locks = fcntl > > passdb { > > args = /etc/imap.v_users > > driver = passwd-file > > } > > passdb { > > driver = pam > > } > > service auth { > > unix_listener /var/spool/postfix/private/auth { > > group = postfix > > mode = 0660 > > user = postfix > > } > > } > > service imap-login { > > inet_listener imap { > > port = 0 > > } > > } > > ssl_cert = </etc/letsencrypt/live/example.com/fullchain.pem > > ssl_cipher_list = ALL > > ssl_key = # hidden, use -P to show it > > ssl_prefer_server_ciphers = yes > > userdb { > > args = /etc/imap.v_users > > driver = passwd-file > > } > > userdb { > > driver = passwd > > } > > verbose_ssl = yes > > _______________________________________________ > > dovecot mailing list --dovecot(a)dovecot.org > > To unsubscribe send an email todovecot-leave(a)dovecot.org > _______________________________________________ > dovecot mailing list -- dovecot(a)dovecot.org > To unsubscribe send an email to dovecot-leave(a)dovecot.org >

1 0

Fwd: connection refused, no error anywhere
by Marco Fioretti 21 Jan '25

21 Jan '25

---------- Forwarded message --------- Da: Marco Fioretti <marco.fioretti(a)gmail.com> Date: mar 21 gen 2025 alle ore 19:27 Subject: Re: connection refused, no error anywhere To: Marc <Marc(a)f1-outsourcing.eu> Hi Marc, this is the output of netstat -tanp (I only removed the line showing the details of my ssh connection): Active Internet connections (servers and established) Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name tcp 0 0 127.0.0.53:53 0.0.0.0:* LISTEN 516/systemd-resolve tcp 0 0 127.0.0.54:53 0.0.0.0:* LISTEN 516/systemd-resolve tcp 0 0 127.0.0.1:10023 0.0.0.0:* LISTEN 28575/postgrey --in tcp6 0 0 :::80 :::* LISTEN 26990/apache2 tcp6 0 0 ::1:10023 :::* LISTEN 28575/postgrey --in and indeed it there is no tracce of dovecot there, but what should I do then? "service dovecot status" says the service IS active... Thanks! Il giorno mar 21 gen 2025 alle ore 19:00 Marc <Marc(a)f1-outsourcing.eu> ha scritto: > You are sure dovecot is running on the ports (netstat -tanp). You are sure > this firewall is ok? Maybe flush it, just to be sure. > > > Greetings, > > > > I was just tasked with rebuilding from scratch the mail server of an > > NGO, > > on a brand new Ubuntu 24.04 LTS VPS. > > > > I have copied the whole dovecot configuration to the new server, and now > > am > > stuck because: > > > > - dovecot IS running, dovecot service status shows no errors, but: > > > > - if I try to connect with mutt from my desktop I get "connection > > refused" > > > > - the ufw firewall does allow imap/imaps connections, and there are no > > errors in its log > > > > - even "telnet localhost 143" fails: > > Trying ::1... > > Connection failed: Connection refused > > Trying 127.0.0.1... > > telnet: Unable to connect to remote host: Connection refused > > > > - I see no related errors in /var/log/mail.log or /var/log/syslog. > > > > > > output of dovecot -n is pasted below, I only changed the actual domain > > name > > to "example.com" > > > > TIA for any pointer, I really need to get this server back online as > > soon > > as possible... > > > > Marco > > > > # 2.3.21 (47349e2482): /etc/dovecot/dovecot.conf > > # Pigeonhole version 0.5.21 (f6cd4b8e) > > doveconf: Warning: NOTE: You can get a new clean config file with: > > doveconf > > -Pn > dovecot-new.conf > > doveconf: Warning: Obsolete setting in /etc/dovecot/conf.d/10- > > ssl.conf:9: > > ssl_dh_parameters_length is no longer needed > > # OS: Linux 6.8.0-51-generic x86_64 Ubuntu 24.04.1 LTS ext4 > > # Hostname: example.com > > auth_debug = yes > > auth_verbose = yes > > auth_verbose_passwords = plain > > mail_location = maildir:/var/mail/mymail_storage/base/ > > mbox_write_locks = fcntl > > passdb { > > args = /etc/imap.v_users > > driver = passwd-file > > } > > passdb { > > driver = pam > > } > > service auth { > > unix_listener /var/spool/postfix/private/auth { > > group = postfix > > mode = 0660 > > user = postfix > > } > > } > > service imap-login { > > inet_listener imap { > > port = 0 > > } > > } > > ssl_cert = </etc/letsencrypt/live/example.com/fullchain.pem > > ssl_cipher_list = ALL > > ssl_key = # hidden, use -P to show it > > ssl_prefer_server_ciphers = yes > > userdb { > > args = /etc/imap.v_users > > driver = passwd-file > > } > > userdb { > > driver = passwd > > } > > verbose_ssl = yes >

1 0

connection refused, no error anywhere
by Marco Fioretti 21 Jan '25

21 Jan '25

Greetings, I was just tasked with rebuilding from scratch the mail server of an NGO, on a brand new Ubuntu 24.04 LTS VPS. I have copied the whole dovecot configuration to the new server, and now am stuck because: - dovecot IS running, dovecot service status shows no errors, but: - if I try to connect with mutt from my desktop I get "connection refused" - the ufw firewall does allow imap/imaps connections, and there are no errors in its log - even "telnet localhost 143" fails: Trying ::1... Connection failed: Connection refused Trying 127.0.0.1... telnet: Unable to connect to remote host: Connection refused - I see no related errors in /var/log/mail.log or /var/log/syslog. output of dovecot -n is pasted below, I only changed the actual domain name to "example.com" TIA for any pointer, I really need to get this server back online as soon as possible... Marco # 2.3.21 (47349e2482): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.21 (f6cd4b8e) doveconf: Warning: NOTE: You can get a new clean config file with: doveconf -Pn > dovecot-new.conf doveconf: Warning: Obsolete setting in /etc/dovecot/conf.d/10-ssl.conf:9: ssl_dh_parameters_length is no longer needed # OS: Linux 6.8.0-51-generic x86_64 Ubuntu 24.04.1 LTS ext4 # Hostname: example.com auth_debug = yes auth_verbose = yes auth_verbose_passwords = plain mail_location = maildir:/var/mail/mymail_storage/base/ mbox_write_locks = fcntl passdb { args = /etc/imap.v_users driver = passwd-file } passdb { driver = pam } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } } service imap-login { inet_listener imap { port = 0 } } ssl_cert = </etc/letsencrypt/live/example.com/fullchain.pem ssl_cipher_list = ALL ssl_key = # hidden, use -P to show it ssl_prefer_server_ciphers = yes userdb { args = /etc/imap.v_users driver = passwd-file } userdb { driver = passwd } verbose_ssl = yes

3 2

Mail with single \r, partial fetch, error "Broken virtual size in mailbox"
by Ewald Dieterich 17 Jan '25

17 Jan '25

I run Dovecot 2.3.21 with the mdbox mailbox format. If I do a certain partial fetch on a mail with a single carriage return \r Dovecot closes the connection and logs the following error: Error: Mailbox INBOX: Deleting corrupted cache record uid=1: UID 1: Broken virtual size in mailbox INBOX: read(/var/spool/dovecot/user/storage/m.1): FETCH BODY[]<18.100> got too little data: 5 vs 6 This happens every time, doveadm force-resync doesn't help. Here's how to reproduce the issue: Deliver a mail with a single carriage return \r (here after the header/body separator, but that's not important): echo -ne "Subject: Test\r\n\r\n\rBody\r\n" | doveadm save -u user Then do a partial fetch from a specific offset: . fetch 1 body[]<18.100> * 1 FETCH (BODY[]<18> {6} ody Connection closed by foreign host. Offset 18 with length 6 should "Body\r\n", that's why the response is 1 byte short ("got too little data: 5 vs 6" in the error message), by why is \r causing this? Other offsets seem to work.

4 5

find mailbox (path) of message
by Marc 13 Jan '25

13 Jan '25

How should I use 'doveadm search -u' to get the mailbox path where the message is stored?

4 4