March 2025 - dovecot - dovecot.org

Problem email client iPhone ios18.2
by andrzej.milewski＠gmail.com 17 Apr '25

17 Apr '25

Hello, I have a fairly new installation of the Dovecot server version 2.3.19.1 on Debian 12.8. In general, the server works correctly. It sends and receives emails without issues. The clients primarily use Thunderbird on desktops and Gmail on Android. However, some clients are using iPhones with various hardware versions. Those with iOS below version 18 work correctly without any issues. Those who have updated their phones to version 18 and now even 18.2 are experiencing problems with mailbox synchronization. On version 18.2, the issue appears as follows: When you open the app, you can read several messages. They load correctly, but, for instance, attachments do not. If I wait for some time, the attachment eventually loads. During this time, I observe the server logs, and it shows that a certain session on the Dovecot server has ended. Dec 17 13:13:01 iredmail0 dovecot[408]: imap(xxx(a)xxx.com)<44785><1QGZCHcp/+3AqM2O>: Disconnected: Connection closed (UID SEARCH finished 92.295 secs ago) in=2972 out=6076956 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=36 body_bytes=6059064 Dec 18 08:40:41 iredmail0 dovecot[408]: imap(xxx(a)xxx.com)<177412>: Disconnected: Connection closed (UID FETCH finished 90.079 secs ago) in=5126 out=1304237 deleted=0 expunged=0 trashed=0 hdr_count=94 hdr_bytes=289688 body_count=89 body_bytes=969615 Dec 18 08:42:19 iredmail0 dovecot[408]: imap(xxx(a)xxx.com)<177410><D5mqU4cpZ+nAqM2O>: Disconnected: Connection closed (UID FETCH finished 95.051 secs ago) in=4475 out=1162785 deleted=0 expunged=0 trashed=0 hdr_count=95 hdr_bytes=281674 body_count=61 body_bytes=839545 Dec 18 08:44:17 iredmail0 dovecot[408]: imap(edyta.kowalewska(a)laktopol.com.pl)<177918>: Disconnected: Connection closed (UID FETCH finished 92.132 secs ago) in=29399 out=30266644 deleted=0 expunged=0 trashed=0 hdr_count=565 hdr_bytes=1726228 body_count=628 body_bytes=28109455 After the session is closed, the attachment loads immediately. From the logs and router analysis, it appears that the download happens in another previously opened session. After this incident, I go to another message with an attachment, and the situation repeats. There are also situations where the email body does not load, and the app waits for the server until the session closes and the content is fetched in another session. It does not matter whether I connect to the server via the internet or through a local network. On an iPhone 7 with iOS 15.8.3, everything works smoothly. Attachments open without issues. On iOS 18.1.1, attachments do not load, and the session does not close on its own. It takes forever unless the app is closed. In the Gmail app, everything works correctly without any issues. This is clearly a problem with the mail client on iPhone. However, is there anything I can adjust in my server settings to mitigate this issue for users? My dovecot configuration https://pastebin.com/UPNQ5dZz

26 58

Stats-writer permission denied
by Ken Wright 15 Apr '25

15 Apr '25

I've got a new Dovecot error (well, new to me, at least)! I ran tail /var/log/mail.err and got the following: net_connect_unix(/var/run/dovecot/stats-writer) failed: Permission denied I checked the file, and it's owned by www-data and the www-data group, with read and write permissions for owner and group... just like I have specified in /etc/dovecot/conf.d/10-master.conf. I can't understand why permission is denied when the file permissions appear to be correct. Can anyone shed any light on this for me? Ubuntu 20.04 Dovecot 2.3.7.2 Ken

3 2

shared folders in dovecot
by Anton Shevtsov 15 Apr '25

15 Apr '25

I used dovecot without shared folders some time ago. All work fine. old dovecot config: |mail_home=/var/mail/%d/%n mail_location = maildir:/var/mail/%d/%n:UTF-8:INBOX=/var/mail/%d/%n/Inbox |mail_plugins = acl |protocol imap { mail_plugins = $mail_plugins } | All work fine. Now I want to add shared folder functionality. I am defining namespaces and doing it wrong (maybe) new dovecot config: |mail_home=/var/mail/%d/%n mail_location = maildir:/var/mail/%d/%n:UTF-8:INBOX=/var/mail/%d/%n/Inbox |mail_plugins = acl |mail_debug=yes namespace inbox { type = private separator = / prefix = inbox = yes } namespace { type = shared separator = / prefix = shared/%%u/ # wrong #location = maildir:%%h/Maildir:INDEX=~/Maildir/shared/%%u:INDEXPVT=~/Maildir/shared/%%u |# wrong again location = maildir:%%h/:INDEX=~/%%u |subscriptions = no list = children } protocol imap { mail_plugins = $mail_plugins imap_acl acl } plugin { acl = vfile acl_shared_dict = file:/var/mail/%d/shared-mailboxes.db } | I can set access right for shared folder (screenshot - https://ibb.co/ccxQ63wN) but i can not see shared folder in subscriptions (screenshot - https://ibb.co/PRfpD7X) -- *Anton* I used dovecot without shared folders some time ago. All work fine. old dovecot config: mail_home=/var/mail/%d/%n mail_location = maildir:/var/mail/%d/%n:UTF-8:INBOX=/var/mail/%d/%n/Inbox mail_plugins = acl protocol imap { mail_plugins = $mail_plugins } All work fine. Now I want to add shared folder functionality. I am defining namespaces and doing it wrong (maybe) new dovecot config: mail_home=/var/mail/%d/%n mail_location = maildir:/var/mail/%d/%n:UTF-8:INBOX=/var/mail/%d/%n/Inbox mail_plugins = acl mail_debug=yes namespace inbox { type = private separator = / prefix = inbox = yes } namespace { type = shared separator = / prefix = shared/%%u/ # wrong #location = maildir:%%h/Maildir:INDEX=~/Maildir/shared/%%u:INDEXPVT=~/ Maildir/shared/%%u # wrong again location = maildir:%%h/:INDEX=~/%%u subscriptions = no list = children } protocol imap { mail_plugins = $mail_plugins imap_acl acl } plugin { acl = vfile acl_shared_dict = file:/var/mail/%d/shared-mailboxes.db } I can set access right for shared folder (screenshot - https://ibb.co/ccxQ63wN) but i can not see shared folder in subscriptions (screenshot - https://ibb.co/ PRfpD7X) -- Anton

3 8

crypt_private_key_file retrived from userdb/ldap doesn't work
by luis.neapolis＠gmail.com 10 Apr '25

10 Apr '25

Hello, if I try to retrieve crypt_private_key_file from userdb/ldap doesn't work, infact if I have: crypt_global_private_key main{ crypt_private_key_password=secret crypt_private_key_file=/path/to/file } all is ok. If I want to have: crypt_global_private_key main{ crypt_private_key_password=secret crypt_private_key_file= } userdb ldap { driver = ldap ..... fields { mail_crypt_global_private_key/main/crypt_private_key_file=inline:%{ldap:key} } } I have into logs: lmtp(134879): Fatal: Raw user initialization failed: mail_crypt_plugin: nuovo: Couldn't parse private key : Unknown key format I am sure that the key is correctly base64 encoded, infact if I pick the ldap value of %{ldap:key} and I decode base64 I have the pkey crypted key. Any suggestion?

2 4

[Dovecot] auth: Error: net_connect_unix(anvil-auth-penalty) failed: Permission denied
by mailing＠securitylabs.it 02 Apr '25

02 Apr '25

Hello, just upgraded one of my testing machine from dovecot 1.2.15 to 2.0.7. After some trouble with permissions now all seems working, but when I stop dovecot I have these errors in log: Nov 9 17:08:07 in dovecot: master: Warning: Killed with signal 15 (by pid=20362 uid=0 code=kill) Nov 9 17:08:07 in dovecot: pop3-login: Error: read(anvil) failed: EOF Nov 9 17:08:07 in dovecot: imap-login: Error: read(anvil) failed: EOF Nov 9 17:08:07 in dovecot: imap(mailing(a)securitylabs.it): Server shutting down. bytes=410/59361 Nov 9 17:08:07 in dovecot: imap(mailing(a)securitylabs.it): Server shutting down. bytes=79/26605 Nov 9 17:08:07 in dovecot: imap(mailing(a)securitylabs.it): Server shutting down. bytes=802/55708 Nov 9 17:08:07 in dovecot: imap(mailing(a)securitylabs.it): Server shutting down. bytes=258/1242 Nov 9 17:08:07 in dovecot: auth: Error: read(anvil-auth-penalty) failed: EOF Nov 9 17:08:07 in dovecot: auth: Error: net_connect_unix(anvil-auth-penalty) failed: Permission denied dovecot -n: # 2.0.7: /usr/local/etc/dovecot/dovecot.conf # OS: Linux 2.6.32-5-xen-686 i686 Debian squeeze/sid auth_cache_negative_ttl = 2 mins auth_cache_size = 1000 M auth_cache_ttl = 2 mins auth_master_user_separator = * auth_username_chars = abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ01234567890.-_@& disable_plaintext_auth = no dotlock_use_excl = yes first_valid_uid = 100 last_valid_uid = 105 lock_method = dotlock log_timestamp = "%Y-%m-%d %H:%M:%S " login_greeting = Server ready. mail_fsync = never mail_gid = Debian-exim mail_location = maildir:~/Maildir:INDEX=/var/indexes/%d/%n mail_privileged_group = Debian-exim mail_uid = Debian-exim managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date namespace { inbox = yes location = prefix = separator = / type = private } namespace { location = maildir:~/Maildir/expunged prefix = EXPUNGED/ separator = / type = private } namespace { location = maildir:~/Maildir/deleted prefix = DELETED/ separator = / type = private } namespace { location = maildir:~/Maildir/deleted/expunged prefix = DELETED/EXPUNGED/ separator = / type = private } passdb { args = /usr/local/etc/dovecot-sql.conf driver = sql } passdb { args = /usr/local/etc/passwd.masterusers driver = passwd-file master = yes pass = yes } plugin { lazy_expunge = EXPUNGED/ DELETED/ DELETED/EXPUNGED/ mail_log_events = delete expunge mail_log_group_events = quota = maildir quota_warning = storage=80%% /usr/local/bin/dovecot-quota-warning.sh 80 quota_warning2 = storage=90%% /usr/local/bin/dovecot-quota-warning.sh 90 sieve = ~/.dovecot.sieve } pop3_no_flag_updates = yes protocols = imap pop3 service auth { unix_listener auth-userdb { group = Debian-exim mode = 0600 user = Debian-exim } } service imap-login { client_limit = 256 process_limit = 128 process_min_avail = 3 service_count = 1 } service imap { drop_priv_before_exec = yes process_limit = 256 vsz_limit = 256 B } service pop3-login { client_limit = 256 process_limit = 128 process_min_avail = 3 service_count = 1 } service pop3 { drop_priv_before_exec = yes process_limit = 256 vsz_limit = 256 B } ssl_cert = </usr/local/etc/dovecot.crt ssl_key = </usr/local/etc/dovecot.key userdb { args = /usr/local/etc/dovecot-sql.conf driver = sql } protocol imap { mail_max_userip_connections = 10 mail_plugins = " notify quota imap_quota mail_log lazy_expunge" } protocol pop3 { mail_max_userip_connections = 3 mail_plugins = " notify quota mail_log" pop3_uidl_format = %08Xu%08Xv } protocol lda { mail_plugins = quota sieve postmaster_address = postmaster(a)securitylabs.it } My /usr/local/var/run/dovecot directory: 4 drwxr-sr-x 4 root staff 4096 Nov 9 17:08 . 4 drwxrwsrwx 3 root staff 4096 Nov 9 17:05 .. 0 srw------- 1 root staff 0 Nov 9 17:05 anvil 0 srw------- 1 root staff 0 Nov 9 17:05 anvil-auth-penalty 0 srw------- 1 root staff 0 Nov 9 17:05 auth-client 0 srw------- 1 dovecot staff 0 Nov 9 17:05 auth-login 0 srw------- 1 root staff 0 Nov 9 17:05 auth-master 0 srw------- 1 Debian-exim Debian-exim 0 Nov 9 17:05 auth-userdb 0 srw------- 1 dovecot staff 0 Nov 9 17:05 auth-worker 0 srw------- 1 root staff 0 Nov 9 17:05 config 0 srw------- 1 root staff 0 Nov 9 17:05 dict 0 srw------- 1 root staff 0 Nov 9 17:05 director-admin 0 srw-rw-rw- 1 root staff 0 Nov 9 17:05 dns-client 0 srw------- 1 root staff 0 Nov 9 17:05 doveadm-server 0 lrwxrwxrwx 1 root staff 35 Nov 9 17:05 dovecot.conf -> /usr/local/etc/dovecot/dovecot.conf 4 drwxr-xr-x 2 root root 4096 Nov 9 17:05 empty 4 drwxr-x--- 2 root dovenull 4096 Nov 9 17:05 login My emails are delivered as user Debian-exim and users are virtual in a MySQL DB. This system is behind a proxy (so the master user)

3 2

Bug: dovecot 2.3.21.1 fails to build with recent ICU
by Marcel Telka 01 Apr '25

01 Apr '25

Hi, dovecot 2.3.21.1 fails to build with ICU 77. There are also reports it does not build with ICU 76 for the same reason: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=284832 There is no issue when built with ICU 75. The failure is this: /bin/bash ../../libtool --tag=CC --mode=link /usr/gcc/14/bin/gcc -std=gnu99 -m64 -O3 -Wno-incompatible-pointer-types -fstack-protector-strong -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=2 -mfunction-return=keep -mindirect-branch=keep -Wall -W -Wmissing-prototypes -Wmissing-declarations -Wpointer-arith -Wchar-subscripts -Wformat=2 -Wbad-function-cast -fno-builtin-strftime -Wstrict-aliasing=2 -I/usr/openssl/3/include -no-undefined -m64 -o test-fts-icu test-fts-icu.o fts-icu.lo -licui18n ../lib-test/libtest.la ../lib/liblib.la -lsocket -lnsl -lsendfile libtool: link: /usr/gcc/14/bin/gcc -std=gnu99 -m64 -O3 -Wno-incompatible-pointer-types -fstack-protector-strong -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=2 -mfunction-return=keep -mindirect-branch=keep -Wall -W -Wmissing-prototypes -Wmissing-declarations -Wpointer-arith -Wchar-subscripts -Wformat=2 -Wbad-function-cast -fno-builtin-strftime -Wstrict-aliasing=2 -I/usr/openssl/3/include -m64 -o test-fts-icu test-fts-icu.o .libs/fts-icu.o -licui18n ../lib-test/.libs/libtest.a ../lib/.libs/liblib.a -lsocket -lnsl -lsendfile Undefined first referenced symbol in file ucasemap_utf8ToLower_77 .libs/fts-icu.o (symbol belongs to implicit dependency /usr/lib/amd64/libicuuc.so.77) u_strFromUTF8Lenient_77 .libs/fts-icu.o (symbol belongs to implicit dependency /usr/lib/amd64/libicuuc.so.77) u_errorName_77 .libs/fts-icu.o (symbol belongs to implicit dependency /usr/lib/amd64/libicuuc.so.77) u_cleanup_77 .libs/fts-icu.o (symbol belongs to implicit dependency /usr/lib/amd64/libicuuc.so.77) ucasemap_close_77 .libs/fts-icu.o (symbol belongs to implicit dependency /usr/lib/amd64/libicuuc.so.77) u_strToUTF8WithSub_77 .libs/fts-icu.o (symbol belongs to implicit dependency /usr/lib/amd64/libicuuc.so.77) ucasemap_open_77 .libs/fts-icu.o (symbol belongs to implicit dependency /usr/lib/amd64/libicuuc.so.77) ld: fatal: symbol referencing errors. No output written to test-fts-icu collect2: error: ld returned 1 exit status The workaround is easy: to add -licuuc to LDFLAGS, however it would be great if dovecot builds without any workarounds needed. Thank you. -- +-------------------------------------------+ | Marcel Telka e-mail: marcel(a)telka.sk | | homepage: http://telka.sk/ | +-------------------------------------------+

3 2

Dovecot v2.4.1 released
by Aki Tuomi 31 Mar '25

31 Mar '25

Hi! We arey happy to release Dovecot v2.4.1! Some IMPORTANT things to notice (still): - We have changed the signing key for 2.4 going forward, releases are signed with EF0882079FD4ED32BF8B23B2A1B09EF84EDC5219, which can be found at https://repo.dovecot.org/DOVECOT-REPO-GPG-2.4 and is signed with the previous key. The old key has been renamed to https://repo.dovecot.org/DOVECOT-REPO-GPG-2.3. - New 2.4 packages **are not** compatible with old 2.3 configuration, please carefully review https://doc.dovecot.org/2.4.1/installation/upgrade/2.3-to-2.4.html before installing the new packages. - We are happy to provide experimental arm64 support in the form of a Docker image. There are now three kinds of images, latest, latest-dev and latest-root. - The latest docker image is now ran rootless, with UID 1000 as vmail. Please take this into consideration when upgrading. The latest-root image still runs as root. Latest 2.3 image can be used with tag 2.3-latest still We won't be sending separate mail about Pigeonhole anymore as we will release one anyways when we release Dovecot, and Pigeonhole versioning has been changed to match Dovecot versioning. Source codes available at - https://www.dovecot.org/releases/2.4/dovecot-2.4.1.tar.gz - https://www.dovecot.org/releases/2.4/dovecot-2.4.1.tar.gz.sig - https://pigeonhole.dovecot.org/releases/2.4/dovecot-pigeonhole-2.4.1.tar.gz - https://pigeonhole.dovecot.org/releases/2.4/dovecot-pigeonhole-2.4.1.tar.gz… Binary packages in https://repo.dovecot.org/ Docker images in https://hub.docker.com/r/dovecot/dovecot Kind regards, Aki Tuomi Open-Xchange oy --- Dovecot Core NEWS ----------------- * auth: Change unix_listener/auth-userdb/group = $SET:default_internal_group This change needs dovecot_config_version=2.4.1. * auth: lua - Remove support for single string result. * imap: Unconditionally advertise SPECIAL-USE capability. * lib-dcrypt: Install dcrypt_openssl.so into dovecot modules directory. * lib-master: For glibc, default MALLOC_MMAP_THRESHOLD_=131072. * lib-storage: Change default mail_cache_fields to: hdr.date hdr.subject hdr.from hdr.sender hdr.reply-to hdr.to hdr.cc hdr.bcc hdr.in-reply-to hdr.message-id date.received size.virtual imap.bodystructure mime.parts hdr.references hdr.importance hdr.x-priority hdr.x-open-xchange-share-url pop3.uidl pop3.order. This change needs dovecot_config_version=2.4.1. * lib-var-expand: Use moduledir instead of pkglibdir for crypt. * lmtp: Change the default lmtp_user_concurrency_limit to 10. This change needs dovecot_config_version=2.4.1. * lmtp: Change the default service_restart_request_count to 1. This change needs dovecot_config_version=2.4.1. + auth: Allow configuring passdb/userdb sql to use auth-workers. + config: Add default group @mailbox_defaults = english. + config: Improve "Unknown setting" error with more details and suggestions. + doveconf: Add -U parameter to ignore unknown settings in config file. + fts-flatcurve: Support lock files in VOLATILEDIR. + imap-acl: Add support for the IMAP LIST-MYRIGHTS capability (RFC 8440). + imap-client: Support ANONYMOUS authentication. + imap: Implement support for the REPLACE capability. - auth: ldap - Passdb fields were ignored with passdb_ldap_bind_userdn=yes. - auth: lua - Fix error result handling in lua passdb/userdb. - auth: oauth2 - When building oauth2 failure reply, memory would leak. - config: local_name handling would work wrong with multiple names and wildcards. - fts-flatcurve: A potential crash could occur when searching virtual mailboxes. Fixes: Panic: file fts-search.c: line 87 (level_scores_add_vuids): assertion failed: (array_count(&vuids_arr) == array_count(&br->scores)) - fts-flatcurve: Maybe queries were done wrong. - fts-flatcurve: Non-selectable mailboxes were not ignored when doing optimize/rescan. - fts-flatcurve: Signal 11 crash could happen with fts rescan. - fts: Fix crash caused by event object lifecycle mishandling. - imap-hibernate: Client counters would get reset on unhibernation, affecting imap_logout_format variables. - imap: Crash would occur with Maildir when trying to send INPROGRESS during mailbox syncing. - ldap: Dovecot could not be compiled without LDAP. - lib-dcrypt: Output stream encryption can cause assert crash if attempting to encrypt over 64 GiB of data with GCM. This is still not supported with GCM, but it fails better. - lib-http: HTTP client context memory usage was increasing. - lib-http: Pipeline corruption could happen after 100 Continue response. - lib-settings: Variable expansion initialization could crash with Panic: file settings.c: line 1560 (settings_var_expand_init_add): assertion failed: (I_MAX(num_tables, num_provs) == num_ctx) - lib-smtp: Pipelining initial SASL response after AUTH was broken. - lib-var-expand: If filter failed, memory leak would occur. - lib-var-expand: Older bison versions did not have error symbol for handling causing unexpected behaviour on the parser on error conditions. - quota: Quota calculations had minor bugs causing small errors. Pigeonhole NEWS --------------- - global: Fix settings handling bugs. Especially %variables weren't working in various settings. - ldap: Pigeonhole could not be built without LDAP.

5 8

For additional modules, the mail_plugin_dir parameter is ignored
by Lafiel 31 Mar '25

31 Mar '25

Hi. The NixOS distribution for Dovecot uses a patch that hardcodes the path to the plugins in `/etc/dovecot/modules`. The modules themselves are located at `/nix/store/z9kf4ri8sq9f3r510qsm59g1n6kfc7q6-dovecot-2.3.21.1/lib/dovecot`, the script creates symlinks in the `/etc/dovecot/modules` directory. The additional modules are loaded normally. Now I want to remove the patch. I added the parameter `“--with-moduledir=$(out)/etc/dovecot/modules”`, and the modules are located at path `/nix/store/wb885d6w5dfchg9v481f55zj4a2p3r89-dovecot-2.3.21.1/etc/dovecot/modules`. In the configuration I added the parameter `mail_plugin_dir = /etc/dovecot/modules`. The main modules load fine, but the optional modules don't want to load: ``` Error: Plugin 'imap_sieve' not found from directory /nix/store/wb885d6w5dfchg9v481f55zj4a2p3r89-dovecot-2.3.21.1/etc/dovecot/modules ``` For additional modules, the mail_plugin_dir parameter is ignored. Temporary solution - in src/config/config-parser.h file I replaced the line ``` #define CONFIG_MODULE_DIR MODULEDIR"/settings” ``` by ``` #define CONFIG_MODULE_DIR “/etc/dovecot/modules/settings” ``` -- Best regards, Lafiel mailto:lafiel@elven.pw

2 5

Bug: Inconsistency in configuration between various clients.
by Louis Schmitz 27 Mar '25

27 Mar '25

We found out about this through a misconfiguration in our web panel. In the main config file the following line includes a subdirectory; !include conf.d/*.conf The web panel created the following two relevant configuration snippets in /etc/dovecot/conf.d/ 11-plesk-security-ssl.conf > ssl_dh=</opt/psa/etc/dhparams2048.pem > ssl_min_protocol=TLSv1.2 > ssl_cipher_list=EECDH+AESGCM+AES128:EECDH+AESGCM+AES256:EECDH+CHACHA20:EECDH+SHA256+AES128:EECDH+SHA384+AES256:EECDH+SHA1+AES128:EECDH+SHA1+AES256:EECDH+HIGH:AESGCM+AES128:AESGCM+AES256:CHACHA20:SHA256+AES128:SHA256+AES256:SHA1+AES128:SHA1+AES256:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!3DES:!MD5:!PSK:!KRB5:!aECDH:!kDH:!EDH > ssl_prefer_server_ciphers=yes > ssl=yes > ssl_cert=</etc/dovecot/private/dovecot.pem > ssl_key=</etc/dovecot/private/dovecot.pem This sets a server wide certificate as being the cert in /etc/dovecot/private/dovecot.pem. Let's say our main server domain is 'acme.com' for example, its 'hostname' (linux hostname) is for example 's02.acme.com'. Then it would also create 14-plesk-sni-mail.acme.com.conf, containing something akin to: > local_name mail.acme.com { > ssl_cert = </opt/psa/var/certificates/scf7b9lcY > ssl_key = </opt/psa/var/certificates/scf7b9lcY > } These point to the ssl cert and key configured for that specific vhost (not the entire server), which can be different from that configured for the server. When some clients connected to the server (connecting to mail.acme.com) it would serve the /etc/dovecot/private/dovecot.pem certificate. This was renewed and the clients would work without issue. Other clients, however, used the certificate at /opt/psa/var/certificates/scf7b9lcY. This certificate is supposed to be the same, but expired and wasn't renewed along with the other one. This was tricky to figure out since the problems did not appear on our side, only when looking at a client. Once I went around the panel GUI and into the actual dovecot configuration files I found the culprit(s). I think, but do not know, that it could be related to which IP protocol (V4 or V6) is used to connect to dovecot. All clients who failed happened to connect over V6. The cases that did not used V4. This seems entirely unrelated and strange behaviour that must be a bug of some kind. Either both should use the one certificate, or the other, or there should be an error or warning if local_name includes a variant subdomain of the server name, the latter in addition to making a consistent choice. It appears that sometimes the first relevant ssl_key and ssl_cert are used, and other times the second when the option is included twice in the configuration, pointing to different matching certificates/keys. It's not apparently a race condition: The behaviour is very consistent for the same client connecting.

1 0

Input Buffer Full with OAuth login
by Brad Koehn 26 Mar '25

26 Mar '25

I’m running Dovecot 2.3.21.1 using Authentik for OAuth authentication. I’m using SOGo 5.12.0 as a UI, also with OAuth authentication. When SOGo connects to Dovecot and authenticates with OAuth, it fails and the following is logged: imap-login: Info: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=10.42.1.1, lip=10.42.1.196, TLS, session=<NZnp7zMxQuMKKgEB> My dovecot-oauth2.conf.ext looks like this: openid_configuration_url = https://auth.koehn.com/application/o/dovecot-oauth2/.well-known/openid-conf… introspection_url = https://auth.koehn.com/application/o/introspect/ introspection_mode = post client_id = [redacted] client_secret = [redacted] username_attribute = email debug = yes rawlog_dir = /tmp/oauth2 And my auth-oauth2.conf.ext looks like this: passdb { driver = oauth2 mechanisms = xoauth2 oauthbearer args = /etc/dovecot/conf.d/dovecot-oauth2.conf.ext } I’m using the Dovecot Debian packages from repo.dovecot.org. I’ve tried auth for introspection_mode, to no avail. There’s nothing extra in the logs when I turn on debug, and there’s nothing logged in the /tmp/oauth2 directory either, FWIW. Any ideas? — Brad I’m running Dovecot 2.3.21.1 using Authentik for OAuth authentication. I’m using SOGo 5.12.0 as a UI, also with OAuth authentication. When SOGo connects to Dovecot and authenticates with OAuth, it fails and the following is logged: imap-login: Info: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=10.42.1.1, lip=10.42.1.196, TLS, session=<NZnp7zMxQuMKKgEB> My dovecot-oauth2.conf.ext looks like this: openid_configuration_url = https://auth.koehn.com/application/o/dovecot- oauth2/.well-known/openid-configuration introspection_url = https://auth.koehn.com/application/o/introspect/ introspection_mode = post client_id = [redacted] client_secret = [redacted] username_attribute = email debug = yes rawlog_dir = /tmp/oauth2 And my auth-oauth2.conf.ext looks like this: passdb { driver = oauth2 mechanisms = xoauth2 oauthbearer args = /etc/dovecot/conf.d/dovecot-oauth2.conf.ext } I’m using the Dovecot Debian packages from repo.dovecot.org. I’ve tried auth for introspection_mode, to no avail. There’s nothing extra in the logs when I turn on debug, and there’s nothing logged in the /tmp/ oauth2 directory either, FWIW. Any ideas? — Brad

3 3