February 2025 - dovecot

Re: suggestion: Argon2id example in `doveadm pw` examples
by Michael Slusarz 13 Feb '25

13 Feb '25

> On 02/08/2025 10:31 PM MST Sean McBride via dovecot <dovecot(a)dovecot.org> wrote: > > It says here https://www.dovecot.org/bugreport-mail/ that bug reports should go to this list. Does that apply to suggestions too? Assuming so... Best practice these days is to file a bug report (or MR) to GitHub. https://github.com/dovecot/ shows the various Dovecot components. We are actively working on improving our various websites, so this updated recommendation will (eventually) work its way on the pages somewhere. > The docs here are very good: > > https://doc.dovecot.org/main/core/man/doveadm-pw.1.html > > but it's always nice to have examples of current best practice. As I understand it, the best password hashing algorithm these days is Argon2id, according to: > > https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet… > > So it would be nice to have an example corresponding to best practices, showing use of argon2id. > > I could attempt a PR on GitHub if you'd like. That would be the proper way to suggest. Do note: as mentioned in another message to the list I just sent, the mission of the Dovecot documentation is to document how the software works. It is not to document email server hosting best practices. Determination of which PW hashing algorithm to use seems to be in the latter category. (Documenting that Dovecot supports argon2id is in scope per the former, but it sounds like we did our job there.) michael

3 2

Dovecot's default password storage scheme is not GDPR compliant
by Rupert Gallagher 13 Feb '25

13 Feb '25

Dovecot aligns the password encryption scheme used by the imap client with the password storage scheme used by the server. Since the default is set to plain text, the client sends the password in plain text (tls tunneled), and the server local storage of passwords is a plain text file. For minimum protection, just enough to say you are not using plaintext, you can use md5, so the client sends the hashed password and the server's local storage is a plain text file containing hashed passwords. Last year a GDPR commissioner filed a hefty monetary sanction to a company because they used md5 to store passwords. Therefore, Dovecot's plain text default, and the md5 option, are both non-GDPR compliant. To avoid monetary sanctions, Dovecot ought to change how it stores passwords by default. Please do not ignore this message.

10 17

dovecot 2.4.0: Unable to build without LDAP/LUA headers/libs.
by h_y_i_e_n＠yahoo.com 13 Feb '25

13 Feb '25

I'm getting LDAP/LUA build errors with dovecot 2.4.0 even when --without-lua and --without-ldap is specified: eg. In file included from db-ldap-settings.c:9: ../../src/lib-ldap/ldap-settings-parse.h:4:10: fatal error: ldap.h: No such file or directory 4 | #include <ldap.h> | ^~~~~~~~ compilation terminated. make[3]: *** [Makefile:2134: auth-db-ldap-settings.o] Error 1

3 2

Configuration rewrite feature is now in main
by Aki Tuomi 12 Feb '25

12 Feb '25

Hi all! We were finally able to merge the content in 2.4.0 + new development to main. We had to rebase it few times before merging, so release-2.4.0 will not match with main exactly. 2.4.1 will be made from main though, so it will be fine again in this regards. Regards, Aki Tuomi

1 0

Re: Dovecot's default password storage scheme is not GDPR compliant
by Michael Slusarz 12 Feb '25

12 Feb '25

GDPR applies to companies operating software, not the software itself. As Aki pointed out (somewhere) in this thread, Dovecot doesn't store passwords itself, and doesn't work unless an admin proactively configures at least one authentication mechanism, so it is "secure by default" under any definition I'm aware of. We might be open to a (short) MR on some language to add to the base authentication configuration page that would alert an admin to possible GDPR requirements. But the Dovecot configuration site is maintained to describe how the software works, not educate on what you might or might not need to do to operate a public mail platform, so the scope of such MR would need to be exceedingly narrow. michael > On 02/12/2025 9:16 AM MST infoomatic via dovecot <dovecot(a)dovecot.org> wrote: > > > On 12.02.25 01:25, Steven Varco via dovecot wrote: > > So, after my mandatory rant :D, the DEFAULT setup of dovecot should actually be as simple as possible. > > > I fully second that. There is no need to discuss whether dovecots > default password storage complies to GDPR or not. The administrator or > the liable person of a company is responsible for taking care about it, > just as Steven Varco mentioned, the same goes with web servers or any > publicly available service. The important point is: you can configure > dovecot complying to the GDPR. > > Because what's next - argue that a web framework is not GDPR compliant > in its standard configuration because there is no cookie consent popup > by default? This is ridiculous. > > Regards, > Robert > _______________________________________________ > dovecot mailing list -- dovecot(a)dovecot.org > To unsubscribe send an email to dovecot-leave(a)dovecot.org

1 0

Re: mailinglist (mailman) + dovecot
by Schulz 12 Feb '25

12 Feb '25

Hello, just have a look at the mailman documentation (hooking up the mail server). Yes, mailman receives mail via LMTP. No, the container is not stateless, mailman processes data on local queue directories that should be persistent. Maybe you want to switch over to the mailman list after consulting the detailed mailman3 documentation. Am 12. Februar 2025 um 15:43 schrieb "Marc" <Marc(a)f1-outsourcing.eu mailto:Marc@f1-outsourcing.eu?to=%22Marc%22%20%3CMarc%40f1-outsourcing.eu%3E >: > > Yes I also don't like to have this on the server. I was just looking at these Dockerfiles they have there. I prefer to have an external stateless container for this. This mailman seems to connect to a database. So I was just wondering how it should receive the emails. > > currently I have sendmail deliver to docker lmtp. > FEATURE(`local_lmtp',`[IPC]',`FILE /var/run/dovecot/lmtp')dnl > > I guess I should be able to deliver remotely with something like this. > dnl FEATURE(`local_lmtp',`[IPC]',`TCP [192.168.xx.xx] 24')dnl > > Just need to figure out how to configure sendmail for what to use when. > > Do you know if you can run mailman in stateless containers because it stores everything in the db? And this lmtp is only for temporary new mail processing? And does it indeed have an 'lmtp" port open? > > > > > we always prefer to separate things, for example in docker containers > > (https://github.com/maxking/docker-mailman is the official one), but > > when you use a python .venv, isolation is already halfway done > > > > > > Am 12. Februar 2025 um 14:38 schrieb "Marc via dovecot" > > <dovecot(a)dovecot.org > > <mailto:dovecot@dovecot.org?to=%22Marc%20via%20dovecot%22%20%3Cdovecot%4 > > 0dovecot.org%3E> >: > > > > I was think of adding a mailinglist for a few users. First I > > thought about maybe using separate container for this, but maybe I can > > just also add this to the server running dovecot. > > > > Anyone having experience with running mailman or something else > > next to dovecot? > > > > > > _______________________________________________ > > dovecot mailing list -- dovecot(a)dovecot.org > > To unsubscribe send an email to dovecot-leave(a)dovecot.org > > >

1 0

mailinglist (mailman) + dovecot
by Marc 12 Feb '25

12 Feb '25

I was think of adding a mailinglist for a few users. First I thought about maybe using separate container for this, but maybe I can just also add this to the server running dovecot. Anyone having experience with running mailman or something else next to dovecot?

1 0

Dovecot uses wrong separator after migration, modify sieve script
by Matthias Fechner 12 Feb '25

12 Feb '25

Dear all, I migrated a dovecot installation that was using pam to a virtual setup where users are stored in a SQL database. I see that my old pam based installation on the filesystem directories are starting with a dot. The new server does not have the leading dot. So even if the configuration is mostly equal, I cannot find a reason why dovecot changed its behavior here. I do not define a separator in the dovecot configuration and the same dovecot package on FreeBSD is used for both installations. My problem is now, that I use a rather complex sieve script to automatically sort mailinglist based emails automatically into subfolders. But as this script is using a dot it is now not moving the email into a nested directory like: github/haproxy/haproxy but is generating a flat directory (depth 1) as github.haproxy.haproxy I cannot change the behavior of dovecot, as I have several users running there and I do not want to cause problem for them changing the dovecot configuration. So I must modify the sieve script. As I do not really know the sieve syntax, I would like to ask if hopefully someone here can help me. I think is is necessary to change the dots to slashes before the fileinto is executed. The sievescript I use to sort mailing based emails into subfolder is: # # 2016-5-2 Script to sort mailing list mails automatically to folders # ## require [ "regex", "include", "variables", "fileinto", "envelope", "mailbox", "imap4flags", "vnd.dovecot.debug" ]; global ["sender_userpart", "sender_domain", "listname"]; # split out the various list forms # Mailman & other lists using list-id if exists "list-id" { fileinto :create "${listname}"; stop; } # Listar and mailman like elsif exists "x-list-id" { debug_log "Mailinglist: x-list-id found"; if header :regex "x-list-id" "<([a-z_0-9-]+)\\\\." { set :lower "listname" "${1}"; fileinto :create "${listname}"; } else { keep; } stop; } # Ezmlm elsif exists "mailing-list" { debug_log "Mailinglist: mailing-list found"; if header :regex "mailing-list" "([a-z_0-9-]+)@" { set :lower "listname" "${1}"; fileinto :create "${listname}"; } else { keep; } stop; } # York lists service elsif exists "x-mailing-list" { debug_log "Mailinglist: x-mailing-list found"; if header :regex "x-mailing-list" "^\\\\s*([a-z_0-9-]+)@?" { set :lower "listname" "${1}"; fileinto :create "${listname}"; } else { keep; } stop; } # Smartlist elsif exists "x-loop" { debug_log "Mailinglist: x-loop found"; if header :regex "x-loop" "^\\\\s*(a-z_0-9-]+)@?" { set :lower "listname" "${1}"; fileinto :create "${listname}"; } else { keep; } stop;} # poorly identified elsif envelope :contains "from" "owner-" { debug_log "Mailinglist: poorly identified matched"; if envelope :regex "from" "owner-([a-z_0-9-]+)-outgoing@" { set :lower "listname" "${1}"; fileinto :create "${listname}"; } elsif envelope :regex "from" "owner-([a-z_0-9-]+)@" { set :lower "listname" "${1}"; fileinto :create "${listname}"; } elsif header :regex "Sender" "owner-([a-z_0-9-]+)@" { set :lower "listname" "${1}"; fileinto :create "${listname}"; } else { keep; } stop;} # other poorly identified elsif envelope :contains "from" "-request" { if envelope :regex "from" "([a-z_0-9-]+)-request@" { set :lower "listname" "${1}"; fileinto :create "${listname}"; } else { keep; } stop; } Thanks a lot! Gruß Matthias -- "Programming today is a race between software engineers striving to build bigger and better idiot-proof programs, and the universe trying to produce bigger and better idiots. So far, the universe is winning." -- Rich Cook

1 0

Error in tests for Dovecot 2.4.0 aarch64
by Peter 11 Feb '25

11 Feb '25

When attempting to build Dovecot 2.4.0 on the aarch64 platform, when running tests... test-file-cache.c:268: Assert failed: file_cache_set_size(cache, 1024) == -1 Panic: file test-common.c: line 222 (test_expect_error_string_n_times): assertion failed: (expected_errors == 0) test-common.c:256: Assert failed: suppress == TRUE Error: Raw backtrace: #0 fatal_handler_real[0x7f73779dcca0] -> #1 default_fatal_handler[0x7f73779dcda0] -> #2 i_panic[0x7f73779766ec] -> #3 test_file_cache[0x7f7377997740] -> #4 main[0x7f7377977420] -> #5 __libc_start_call_main[0x4000008f4210] -> #6 __libc_start_main[0x4000008f42c0] -> #7 _start[0x7f7377977980] Any ideas on this one? Peter

4 7

How do I change the password encryption scheme?
by Ken Wright 10 Feb '25

10 Feb '25

Still working through difficulties upgrading to Dovecot 2.4. Right now I'm having trouble getting my mail client (Evolution) to connect; I keep getting "temporary authentication failures." Before upgrading I was using the ARGON2I encryption scheme, so all my users' passwords are stored that way. How do I tell 2.4 to use ARGON2I by default? There used to be a "default_pass_scheme" parameter but that's apparently gone now. Any help is greatly appreciated! Ken

2 1