May 2025 - dovecot - dovecot.org

(2.4) weird doveadm behavior
by Kamil Jońca 06 May '25

06 May '25

debian package 2.4.1-4 (7d8c0e5759): /etc/dovecot/dovecot.conf I have namespace: namespace expunged { mail_driver = maildir mail_path = ~/Mail/expunged/ mailbox_list_layout = fs hidden = yes inbox = no list = no prefix = .EXPUNGED/ separator = / } %doveadm search -u kjonca mailbox .EXPUNGED|head -n 1 08ac303413c11168864d2a00a6f72b09 30802 %doveadm fetch -u kjonca text mailbox-guid 08ac303413c11168864d2a00a6f72b09 uid 30802 ...empty output... How can I fetch messages? KJ -- http://wolnelektury.pl/wesprzyj/teraz/ Now KEN and BARBIE are PERMANENTLY ADDICTED to MIND-ALTERING DRUGS ...

3 6

2.3 -> 2.4 migration problem(s)
by Kamil Jońca 06 May '25

06 May '25

Recently in debian sid version 2.4 appeared and I tried to migrate. it (mostly working) but Neither dovecot-lda nor doveadm does not see current system user context i.e. --8<---------------cut here---------------start------------->8--- %doveadm mailbox list Fatal: One of -u, -F, -A or --no-userdb-lookup must be provided --8<---------------cut here---------------end--------------->8--- from lda logs --8<---------------cut here---------------start------------->8--- Fatal: Namespace root: mail_storage settings: Failed to parse configuration: Invalid setting mail_path=~/Mail/0/: mail_path setting used home directory (~/) but there is no mail_home and userdb didn't return it --8<---------------cut here---------------end--------------->8--- for dovecot-lda setting "mail_home = /home/%{user|username}" helped but still ... doveadm mailbox list -u kjonca and "-d" option helped in both cases Moreover I found that doveadm does not work when dovecot is stoped (but used to work in 2.3.x) Another thing is: --8<---------------cut here---------------start------------->8--- deliver_log_format = msgid=%m: %$ --8<---------------cut here---------------end--------------->8--- in 2.3.x configuration it created line like this: --8<---------------cut here---------------start------------->8--- 2025-04-27T02:08:31.925845+02:00 alfa dovecot: LDA(kjonca): sieve: msgid=<fd248603-b186-4ee2-9e76-b9b9c0fe7a87@alfa>: fileinto action: stored mail into mailbox 'RSS' --8<---------------cut here---------------end--------------->8--- but now it does not work (what is strange I cannot find %$ description and %m is described as "mechanism" not message id ...) So how can I have old loggin and authentication mechanisms? KJ # 2.4.1-4 (7d8c0e5759): /etc/dovecot/dovecot.conf # Pigeonhole version 2.4.1-4 (0a86619f) # OS: Linux 6.12.22-amd64 x86_64 Debian trixie/sid # ... # 4 default setting change dovecot_config_version = 2.4.0 acl_driver = vfile auth_allow_cleartext = yes auth_debug = yes auth_mechanisms = plain digest-md5 cram-md5 login auth_username_format = %{user | username } auth_verbose = yes default_vsz_limit = 1024M dovecot_storage_version = 2.4.0 lazy_expunge_mailbox = .EXPUNGED/ lazy_expunge_only_last_instance = yes listen = alfa mail_driver = maildir mail_inbox_path = ~/Mail/0/INBOX mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename flag_change save mail_log_fields = uid box msgid size from subject flags mail_log_prefix = "%{protocol}(%{user}): " mail_path = ~/Mail/0/ mail_plugins { acl = yes lazy_expunge = yes } postmaster_address = root@localhost protocols { imap = yes } sieve_execute_bin_dir = %{home}/sieve/bin sieve_execute_exec_timeout = 86400s sieve_extensions { fileinto = yes reject = yes envelope = yes encoded-character = yes vacation = yes subaddress = yes comparator-i;ascii-numeric = yes relational = yes regex = yes imap4flags = yes copy = yes include = yes body = yes variables = yes enotify = yes environment = yes mailbox = yes date = yes index = yes ihave = yes duplicate = yes mime = yes foreverypart = yes extracttext = yes vnd.dovecot.pipe = yes vnd.dovecot.execute = yes vnd.dovecot.filter = yes vnd.dovecot.debug = yes editheader = yes } sieve_filter_bin_dir = %{home}/sieve/bin sieve_filter_exec_timeout = 86400s sieve_pipe_bin_dir = %{home}/sieve/bin sieve_pipe_exec_timeout = 86400s sieve_plugins { sieve_extprograms = yes } ssl = no service auth { user = root unix_listener auth-userdb { } } passdb alfa { default_password_scheme = PLAIN driver = passwd-file passwd_file_path = /etc/security/dovecot.pwd } userdb alfa { passwd_file_path = /etc/security/dovecot.pwd driver = passwd-file } namespace root { inbox = yes separator = / } namespace expunged { mail_driver = maildir mail_path = ~/Mail/expunged/ hidden = yes inbox = no list = no prefix = .EXPUNGED/ separator = / } service imap-login { inet_listener imap { } } service imap { } service auth-worker { user = dovecot } service dict { unix_listener dict { } } protocol lda { deliver_log_format = msgid=%m: %$ info_log_path = syslog log_path = syslog mail_plugins { sieve = yes } syslog_facility = mail } protocol imap { mail_max_userip_connections = 20 mail_plugins { mail_log = yes notify = yes acl = yes imap_acl = yes lazy_expunge = yes } } sieve_script personal { path = ~/.dovecot.sieve } sieve_script before { path = /etc/dovecot/sieve } -- http://wolnelektury.pl/wesprzyj/teraz/ The way I understand it, the Russians are sort of a combination of evil and incompetence... sort of like the Post Office with tanks. -- Emo Philips

3 2

Re: Authentication caching and password changes
by Michael Slusarz 04 May '25

04 May '25

> On 05/03/2025 5:31 AM MDT Diego Alvarez via dovecot <dovecot(a)dovecot.org> wrote: > > In Dovecot docs (https://doc.dovecot.org/2.3/configuration_manual/ > authentication/caching/) we see: > > 1. User logs in with password Y. The cached password X doesn’t match Y and the > previous authentication was unsuccessful, so Dovecot doesn’t bother doing > another backend passdb lookup (until cache TTL expires). The login fails. > > Anyone knows why they chose this design ? Why not simply do a passdb lookup > instead of waiting for cache TTL to expire ? You didn't copy and paste the whole context of this documentation comment: https://doc.dovecot.org/2.4.1/core/config/auth/caching.html#early-change When looking at the full context, this is a situation where a user is either using a password that isn't yet valid (= a bad password, so it's a valid denial), or the user did change their password but the Dovecot system doesn't see the change for some reason (= server/admin issue). In the above situation, doing a passdb lookup without waiting for cache TTL expiration is simply the same situation as not having a negative cache at all. So either don't use the negative cache or fix the password sync (and if you can't fix the authentication sync delay, you can't use a negative cache). An unlikely situation is that the user is using the wrong password originally, and then changes their password to this wrong password. You can always reduce the negative cache TTL if you want to catch this rare situation, at the cost of a lower cache hit rate more generally. michael

2 1

Re: (2.3->2.4) How to expunge with hierarhy saving?
by Michael Slusarz 04 May '25

04 May '25

> On 05/02/2025 10:17 PM MDT Kamil Jońca via dovecot <dovecot(a)dovecot.org> wrote: > > I have used lazy_expunge plugin with namespace (configuration convert): > > namespace expunged { > mail_driver = maildir > mail_path = ~/Mail/expunged/ > hidden = yes > inbox = no > list = no > prefix = .EXPUNGED/ > separator = / > } > > with > lazy_expunge_mailbox = .EXPUNGED > > this allowed me to keep hierarchy (i.e.mails from "admin" mailbox were > expunged to "~/Mail/expunged/admin" ) > this is no longer true - the best I can achieve is to have single > mailbox with all mails :( > Is it possible to get older behavior? > (lazy_expunge_mailbox = .EXPUNGED/ - ends with error) Namespace storage for lazy-expunge plugin was deprecated all the way back in 2.3.0, and was removed for 2.4. I've cleaned up the documentation page to remove all references to namespaces (https://github.com/dovecot/documentation/pull/1234) michael

1 0

Running dovecot 2.4
by Odhiambo Washington 04 May '25

04 May '25

Looking at https://doc.dovecot.org/2.4.1/core/admin/running.html, and comparing with a system where I have installed Dovecot 2.4.1: root@mail:/etc/dovecot/conf.d# ps auxw|grep "dovecot" root 9739 0.0 0.0 8872 4816 ? Ss 14:47 0:00 /usr/sbin/dovecot -F root 9741 0.0 0.0 5324 3280 ? S 14:47 0:00 dovecot/anvil root 9742 0.0 0.0 5428 3256 ? S 14:47 0:00 dovecot/log root 9743 0.0 0.1 51976 10248 ? S 14:47 0:00 dovecot/config Why are my other services not running? For example, the dovecot/auth service is not running. On an system running 2.3.21, I get: wash@eu:~$ ps auxw|grep "dovecot" root 181404 0.0 0.0 8240 4408 ? Ss 14:33 0:00 /usr/sbin/dovecot -F dovecot 181408 0.0 0.0 10668 6936 ? S 14:33 0:00 dovecot/managesieve-login Debian-+ 181409 0.0 0.0 12192 8880 ? S 14:33 0:00 dovecot/lmtp -L dovecot 181410 0.0 0.0 4760 1436 ? S 14:33 0:00 dovecot/anvil root 181411 0.0 0.0 5028 2960 ? S 14:33 0:00 dovecot/log Debian-+ 181412 0.0 0.0 12192 8848 ? S 14:33 0:00 dovecot/lmtp -L Debian-+ 181413 0.0 0.0 12192 9040 ? S 14:33 0:00 dovecot/lmtp -L Debian-+ 181414 0.0 0.0 12192 8908 ? S 14:33 0:00 dovecot/lmtp -L Debian-+ 181415 0.0 0.0 12192 8876 ? S 14:33 0:00 dovecot/lmtp -L root 181416 0.0 0.0 8096 5444 ? S 14:33 0:00 dovecot/config dovecot 181418 0.0 0.0 5964 3496 ? S 14:33 0:00 dovecot/stats dovecot 181419 0.0 0.0 12216 8456 ? S 14:33 0:00 dovecot/auth root@mail:/etc/dovecot/conf.d# doveconf -n # 2.4.1-4+debian12 (7d8c0e5759): /etc/dovecot/dovecot.conf # Pigeonhole version 2.4.1-4+debian12 (0a86619f) # OS: Linux 6.1.0-34-amd64 x86_64 Debian 12.10 # Hostname: mail.test,domain dovecot_config_version = 2.4.1 auth_debug_passwords = yes auth_mechanisms = plain login dovecot_storage_version = 2.4.1 fts_autoindex = yes fts_autoindex_max_recent_msgs = 999 fts_search_add_missing = yes info_log_path = /var/log/dovecot.log log_debug = category=auth mail_driver = Maildir mail_path = ~/Maildir protocols = imap pop3 lmtp sieve sql_driver = mysql mysql /var/run/mysqld/mysqld.sock { dbname = exim4u password = # hidden, use -P to show it user = exim4u } passdb sql { default_password_scheme = SHA512 query = SELECT crypt AS password FROM users,domains WHERE users.username = '%{user}' AND users.enabled = '1' AND users.type='local' and domains.enabled='1' and domains.domain_id = users.domain_id } userdb sql { iterate_query = SELECT username AS user FROM users query = SELECT pop as home, uid, gid FROM users WHERE username = '%{user}' } namespace inbox { inbox = yes mailbox Drafts { special_use = "\\Drafts" } mailbox Junk { special_use = "\\Junk" } mailbox Trash { special_use = "\\Trash" } mailbox Sent { special_use = "\\Sent" } mailbox "Sent Messages" { special_use = "\\Sent" } } service imap-login { inet_listener imap { } inet_listener imaps { } } service pop3-login { inet_listener pop3 { } inet_listener pop3s { } } service submission-login { inet_listener submission { } inet_listener submissions { } } service lmtp { unix_listener lmtp { } } service imap { } service pop3 { } service submission { } service auth { unix_listener auth-userdb { } } service auth-worker { } service dict { unix_listener dict { } } service managesieve-login { inet_listener sieve { port = 4190 } inet_listener sieve_deprecated { port = 2000 } } service managesieve { } -- Best regards, Odhiambo WASHINGTON, Nairobi,KE +254 7 3200 0004/+254 7 2274 3223 In an Internet failure case, the #1 suspect is a constant: DNS. "Oh, the cruft.", egrep -v '^$|^.*#' ¯\_(ツ)_/¯ :-) [How to ask smart questions: http://www.catb.org/~esr/faqs/smart-questions.html] Looking at https://doc.dovecot.org/2.4.1/core/admin/running.html, and comparing with a system where I have installed Dovecot 2.4.1: root@mail:/etc/dovecot/conf.d# ps auxw|grep "dovecot" root 9739 0.0 0.0 8872 4816 ? Ss 14:47 0:00 /usr/sbin/ dovecot -F root 9741 0.0 0.0 5324 3280 ? S 14:47 0:00 dovecot/ anvil root 9742 0.0 0.0 5428 3256 ? S 14:47 0:00 dovecot/log root 9743 0.0 0.1 51976 10248 ? S 14:47 0:00 dovecot/ config Why are my other services not running? For example, the dovecot/auth service is not running. On an system running 2.3.21, I get: wash@eu:~$ ps auxw|grep "dovecot" root 181404 0.0 0.0 8240 4408 ? Ss 14:33 0:00 /usr/sbin/ dovecot -F dovecot 181408 0.0 0.0 10668 6936 ? S 14:33 0:00 dovecot/ managesieve-login Debian-+ 181409 0.0 0.0 12192 8880 ? S 14:33 0:00 dovecot/lmtp -L dovecot 181410 0.0 0.0 4760 1436 ? S 14:33 0:00 dovecot/ anvil root 181411 0.0 0.0 5028 2960 ? S 14:33 0:00 dovecot/log Debian-+ 181412 0.0 0.0 12192 8848 ? S 14:33 0:00 dovecot/lmtp -L Debian-+ 181413 0.0 0.0 12192 9040 ? S 14:33 0:00 dovecot/lmtp -L Debian-+ 181414 0.0 0.0 12192 8908 ? S 14:33 0:00 dovecot/lmtp -L Debian-+ 181415 0.0 0.0 12192 8876 ? S 14:33 0:00 dovecot/lmtp -L root 181416 0.0 0.0 8096 5444 ? S 14:33 0:00 dovecot/ config dovecot 181418 0.0 0.0 5964 3496 ? S 14:33 0:00 dovecot/ stats dovecot 181419 0.0 0.0 12216 8456 ? S 14:33 0:00 dovecot/auth root@mail:/etc/dovecot/conf.d# doveconf -n # 2.4.1-4+debian12 (7d8c0e5759): /etc/dovecot/dovecot.conf # Pigeonhole version 2.4.1-4+debian12 (0a86619f) # OS: Linux 6.1.0-34-amd64 x86_64 Debian 12.10 # Hostname: mail.test,domain dovecot_config_version = 2.4.1 auth_debug_passwords = yes auth_mechanisms = plain login dovecot_storage_version = 2.4.1 fts_autoindex = yes fts_autoindex_max_recent_msgs = 999 fts_search_add_missing = yes info_log_path = /var/log/dovecot.log log_debug = category=auth mail_driver = Maildir mail_path = ~/Maildir protocols = imap pop3 lmtp sieve sql_driver = mysql mysql /var/run/mysqld/mysqld.sock { dbname = exim4u password = # hidden, use -P to show it user = exim4u } passdb sql { default_password_scheme = SHA512 query = SELECT crypt AS password FROM users,domains WHERE users.username = '% {user}' AND users.enabled = '1' AND users.type='local' and domains.enabled='1' and domains.domain_id = users.domain_id } userdb sql { iterate_query = SELECT username AS user FROM users query = SELECT pop as home, uid, gid FROM users WHERE username = '%{user}' } namespace inbox { inbox = yes mailbox Drafts { special_use = "\\Drafts" } mailbox Junk { special_use = "\\Junk" } mailbox Trash { special_use = "\\Trash" } mailbox Sent { special_use = "\\Sent" } mailbox "Sent Messages" { special_use = "\\Sent" } } service imap-login { inet_listener imap { } inet_listener imaps { } } service pop3-login { inet_listener pop3 { } inet_listener pop3s { } } service submission-login { inet_listener submission { } inet_listener submissions { } } service lmtp { unix_listener lmtp { } } service imap { } service pop3 { } service submission { } service auth { unix_listener auth-userdb { } } service auth-worker { } service dict { unix_listener dict { } } service managesieve-login { inet_listener sieve { port = 4190 } inet_listener sieve_deprecated { port = 2000 } } service managesieve { } -- Best regards, Odhiambo WASHINGTON, Nairobi,KE +254 7 3200 0004/+254 7 2274 3223 In an Internet failure case, the #1 suspect is a constant: DNS. "Oh, the cruft.", egrep -v '^$|^.*#' ¯\_(ツ)_/¯ :-) [How to ask smart questions: http://www.catb.org/~esr/faqs/smart- questions.html]

1 0

MySQL AUTH failing
by Odhiambo Washington 03 May '25

03 May '25

I am arriving late to begin the migration to 2.4. The following is my auth-sql.conf.ext: # MySQL Authentication sql_driver = mysql mysql /var/run/mysqld/mysqld.sock { user = user password = SECRET dbname = pass } passdb sql { default_password_scheme = MD5-CRYPT query = SELECT crypt AS password FROM users,domains WHERE users.username = '%u' AND users.enabled = '1' AND users.type='local' and domains.enabled='1' and domains.domain_id = users.domain_id } userdb sql { query = SELECT pop as home, uid, gid FROM users WHERE username = '%u' iterate_query = SELECT username AS user FROM users } The queries work for Dovecot 2.3, but fail for 2.4: May 03 20:46:44 auth-worker(john(a)doe.com,127.0.0.1)<4758><AAi/1z40rt9/AAAB>: request [1]: Debug: sql: query: SELECT crypt AS password FROM users,domains WHERE users.username = '%u' AND users.enabled = '1' AND users.type='local' and domains.enabled='1' and domains.domain_id = users.domain_id May 03 20:46:44 auth-worker(4758): Debug: mysql(/var/run/mysqld/mysqld.sock): Finished query 'SELECT crypt AS password FROM users,domains WHERE users.username = '%u' AND users.enabled = '1' AND users.type='local' and domains.enabled='1' and domains.domain_id = users.domain_id' in 1 msecs May 03 20:46:44 auth-worker(john(a)doe.com,127.0.0.1)<4758><AAi/1z40rt9/AAAB>: request [1]: Info: sql: unknown user May 03 20:46:44 auth-worker(john(a)doe.com,127.0.0.1)<4758><AAi/1z40rt9/AAAB>: request [1]: Debug: sql: Finished passdb lookup May 03 20:46:44 auth-worker(4758): Debug: conn unix:auth-worker (pid=4757,uid=116): auth-worker<1>: Finished: user_unknown May 03 20:46:44 auth(john@doe.com,127.0.0.1,sasl:plain)<AAi/1z40rt9/AAAB>: Debug: sql: Finished passdb lookup May 03 20:46:44 auth(john@doe.com,127.0.0.1,sasl:plain)<AAi/1z40rt9/AAAB>: Debug: Auth request finished May 03 20:46:44 auth(john@doe.com,127.0.0.1,sasl:plain)<AAi/1z40rt9/AAAB>: Debug: delaying auth failure May 03 20:46:46 auth: Debug: conn unix:login (pid=4755,uid=117) [1]: client passdb out: FAIL 1 user=john(a)doe.com -- Best regards, Odhiambo WASHINGTON, Nairobi,KE +254 7 3200 0004/+254 7 2274 3223 In an Internet failure case, the #1 suspect is a constant: DNS. "Oh, the cruft.", egrep -v '^$|^.*#' ¯\_(ツ)_/¯ :-) [How to ask smart questions: http://www.catb.org/~esr/faqs/smart-questions.html] I am arriving late to begin the migration to 2.4. The following is my auth-sql.conf.ext: # MySQL Authentication sql_driver = mysql mysql /var/run/mysqld/mysqld.sock { user = user password = SECRET dbname = pass } passdb sql { default_password_scheme = MD5-CRYPT query = SELECT crypt AS password FROM users,domains WHERE users.username = '%u' AND users.enabled = '1' AND users.type='local' and domains.enabled='1' and domains.domain_id = users.domain_id } userdb sql { query = SELECT pop as home, uid, gid FROM users WHERE username = '%u' iterate_query = SELECT username AS user FROM users } The queries work for Dovecot 2.3, but fail for 2.4: May 03 20:46:44 auth-worker(john(a)doe.com,127.0.0.1)<4758><AAi/1z40rt9/AAAB>: request [1]: Debug: sql: query: SELECT crypt AS password FROM users,domains WHERE users.username = '%u' AND users.enabled = '1' AND users.type='local' and domains.enabled='1' and domains.domain_id = users.domain_id May 03 20:46:44 auth-worker(4758): Debug: mysql(/var/run/mysqld/mysqld.sock): Finished query 'SELECT crypt AS password FROM users,domains WHERE users.username = '%u' AND users.enabled = '1' AND users.type='local' and domains.enabled='1' and domains.domain_id = users.domain_id' in 1 msecs May 03 20:46:44 auth-worker(john(a)doe.com,127.0.0.1)<4758><AAi/1z40rt9/AAAB>: request [1]: Info: sql: unknown user May 03 20:46:44 auth-worker(john(a)doe.com,127.0.0.1)<4758><AAi/1z40rt9/AAAB>: request [1]: Debug: sql: Finished passdb lookup May 03 20:46:44 auth-worker(4758): Debug: conn unix:auth-worker (pid=4757,uid=116): auth-worker<1>: Finished: user_unknown May 03 20:46:44 auth(john@doe.com,127.0.0.1,sasl:plain)<AAi/1z40rt9/AAAB>: Debug: sql: Finished passdb lookup May 03 20:46:44 auth(john@doe.com,127.0.0.1,sasl:plain)<AAi/1z40rt9/AAAB>: Debug: Auth request finished May 03 20:46:44 auth(john@doe.com,127.0.0.1,sasl:plain)<AAi/1z40rt9/AAAB>: Debug: delaying auth failure May 03 20:46:46 auth: Debug: conn unix:login (pid=4755,uid=117) [1]: client passdb out: FAIL 1 user=john(a)doe.com -- Best regards, Odhiambo WASHINGTON, Nairobi,KE +254 7 3200 0004/+254 7 2274 3223 In an Internet failure case, the #1 suspect is a constant: DNS. "Oh, the cruft.", egrep -v '^$|^.*#' ¯\_(ツ)_/¯ :-) [How to ask smart questions: http://www.catb.org/~esr/faqs/smart- questions.html]

1 0

Authentication caching and password changes
by Diego Alvarez 03 May '25

03 May '25

In Dovecot docs (https://doc.dovecot.org/2.3/configuration_manual/ authentication/caching/) we see: 1. User logs in with password Y. The cached password X doesn’t match Y and the previous authentication was unsuccessful, so Dovecot doesn’t bother doing another backend passdb lookup (until cache TTL expires). The login fails. Anyone knows why they chose this design ? Why not simply do a passdb lookup instead of waiting for cache TTL to expire ? In Dovecot docs (https://doc.dovecot.org/2.3/configuration_manual/ authentication/caching/) we see: 1. User logs in with password Y. The cached password X doesn’t match Y and the previous authentication was unsuccessful, so Dovecot doesn’t bother doing another backend passdb lookup (until cache TTL expires). The login fails. Anyone knows why they chose this design ? Why not simply do a passdb lookup instead of waiting for cache TTL to expire ?

1 0

(2.3->2.4) How to expunge with hierarhy saving?
by Kamil Jońca 03 May '25

03 May '25

I have used lazy_expunge plugin with namespace (configuration convert): namespace expunged { mail_driver = maildir mail_path = ~/Mail/expunged/ hidden = yes inbox = no list = no prefix = .EXPUNGED/ separator = / } with lazy_expunge_mailbox = .EXPUNGED this allowed me to keep hierarchy (i.e.mails from "admin" mailbox were expunged to "~/Mail/expunged/admin" ) this is no longer true - the best I can achieve is to have single mailbox with all mails :( Is it possible to get older behavior? (lazy_expunge_mailbox = .EXPUNGED/ - ends with error) KJ -- http://wolnelektury.pl/wesprzyj/teraz/ Zuzanka najwyraźniej pełni obowiązki Albina Siwaka w tej ekipie... (C) Slawek Kotynski w dyskusj nt. pl.whatewer.SETI@home...

1 0

GSSAPI authentication regression with 2.4.x
by Noah Meyerhans 02 May '25

02 May '25

While preparing the Debian packages of Dovecot 2.4.1, I encountered what appears to be a regression that impacts the ability of some clients to successfully negotiate gssapi/krb5 authentication. The regression has so far been observed in gsasl, which was able to successfully authenticate to 2.3.19 but cannot authenticate to 2.4.1. Mutt is able to successfully authenticate with 2.3.19 and 2.4.1. Doveconf output is attached. The debug logs for both failed (gsasl) and successful (mutt) authentications follow. Note that all logs are from an ephemeral debug environment, and sensitive data is not redacted. I can provide additional information as needed, and can test different code and/or configuration changes. Failed authentication dovecot debug log: Apr 30 13:40:09 auth: Debug: Loading modules from directory: /usr/lib/dovecot/modules/auth Apr 30 13:40:09 auth: Debug: Loading modules from directory: /usr/lib/dovecot/modules/auth Apr 30 13:40:09 auth: Debug: Module loaded: /usr/lib/dovecot/modules/auth/libmech_gssapi.so Apr 30 13:40:09 auth: Debug: Read auth token secret from /home/noahm/dovecot-root/b/auth-token-secret.dat Apr 30 13:40:09 auth: Debug: conn unix:login (pid=6791,uid=1000) [1]: Server accepted connection (fd=18) Apr 30 13:40:09 auth: Debug: conn unix:login (pid=6791,uid=1000) [1]: auth client connected (pid=6791) Apr 30 13:40:09 auth: Debug: conn unix:login (pid=6791,uid=1000) [1]: client in: AUTH 1 GSSAPI protocol=imap final-resp-ok session=FhRIDv8zdMzAqAHa lip=172.18.0.205 rip=192.168.1.218 lport=17436 rport=52340 Apr 30 13:40:09 auth(?,192.168.1.218,sasl:gssapi)<FhRIDv8zdMzAqAHa>: Debug: gssapi: Using all keytab entries Apr 30 13:40:09 auth: Debug: conn unix:login (pid=6791,uid=1000) [1]: client passdb out: CONT 1 # Apr 30 13:40:09 auth: Debug: conn unix:login (pid=6791,uid=1000) [1]: client in: CONT 1 # (previous base64 data may contain sensitive data) Apr 30 13:40:09 auth(?,192.168.1.218,sasl:gssapi)<FhRIDv8zdMzAqAHa>: Debug: gssapi: Processed incoming packet correctly, waiting for another. Apr 30 13:40:09 auth: Debug: conn unix:login (pid=6791,uid=1000) [1]: client passdb out: CONT 1 YEcGBisGAQUFAqA9MDugDTALBgkqhkiG9xIBAgKjKjAooCYbJG5vdF9kZWZpbmVkX2luX1JGQzQxNzhAcGxlYXNlX2lnbm9yZQ== Apr 30 13:40:09 auth: Debug: conn unix:login (pid=6791,uid=1000) [1]: client in: CONT 1 YIIDAAYJKoZIhvcSAQICAQBuggLvMIIC66ADAgEFoQMCAQ6iBwMFACAAAACjggIDYYIB/zCCAfugAwIBBaENGwtFWEFNUExFLkNPTaIfMB2gAwIBA6EWMBQbBGltYXAbDGRvdmVjb3QtdGVzdKOCAcIwggG+oAMCARKhAwIBAqKCAbAEggGsj4jD3VOwvfNdLxjc2hqxFsBYyCvjdOCX0R1So6ANZEYnEWddqZwMCuz7BxXv4z+cXaL6g6iGlVkU4RxQyJQHDFUQC8JroTlyMQ+XsIM4zuwn5N4/xRsgKa+SisK92UNMYyl9hVIPKvu/A54cU0zYTdDjYfDGnkurG2RgXDrKIzMpU2LtpoBEtwl3F1H+rzKFJAqe96e39C85GjK1D4s8/TOm3IcHJ5eofeHxI2GeUodysi+DlurRQTSnsUkGa1LXSgkY+4QdlMf+4goNRG5xNdZ8OA2CLY97TPAFqIeej1Amvb9uQBIKvWfbTjDdItBWOhuvAetlNfqnxlcCbnjbCmFTOIbVsHhNW8W1JIElL28mGydbMPimi9brc250E+ImO0Bxp3gMn5oXGV0tUJl5Y8W1lHlEUU7vKK0V7khUob0b3P3lCGQVJyWZEGNodgpr5zkTbR2M8orP4eI9SYoYp2UB0Ag+JkeYSNoQrKZNxSoKBYLVPGzwwGNPBKl7T0CdXlDAOhfZS/FSxdoy8LGRhuTdv7ghQAvstOllibSbjN3wos8ZC8wH2I5LFkekgc4wgcugAwIBEqKBwwSBwMCJkwg3LL7QqlEOunOjvQzpXmA/LMbdtEDyW9b0EQNFL9KFkNuRKDC3V8SFkmG1KlEEHFp2GQNij6AN89xvmEGvhj3tqC280awJs8ve3Bbr7GHRJoFO/sikSRsol1HD/K3sC9OMDufEEItsWf94uu8SmEBpB2OBOzedtfw+PRpoWyYUJYEfAL9T4w0KmBD26KVcehzIv8e3vOl52aT3x9Ovjnw8RfFkZa+t/iGhMpYpf8ApWExZDWBZ6uzVJxcAPg== (previous base64 data may contain sensitive data) Apr 30 13:40:09 auth(?,192.168.1.218,sasl:gssapi)<FhRIDv8zdMzAqAHa>: Debug: Auth request finished Apr 30 13:40:09 auth(?,192.168.1.218,sasl:gssapi)<FhRIDv8zdMzAqAHa>: Debug: delaying auth failure Apr 30 13:40:11 auth: Debug: conn unix:login (pid=6791,uid=1000) [1]: client passdb out: FAIL 1 Apr 30 13:40:11 auth: Debug: conn unix:login (pid=6791,uid=1000) [1]: Disconnected: Connection closed (fd=18) And the corresponding client log: noahm@42b23a0b5002:~$ gsasl -m GSSAPI -d --no-starttls --imap dovecot-test 17436 Trying 'dovecot-test'... * OK [CAPABILITY IMAP4rev1 LOGIN-REFERRALS ID ENABLE IDLE SASL-IR LITERAL+ STARTTLS AUTH=PLAIN AUTH=GSSAPI] Dovecot ready. . CAPABILITY * CAPABILITY IMAP4rev1 LOGIN-REFERRALS ID ENABLE IDLE SASL-IR LITERAL+ STARTTLS AUTH=PLAIN AUTH=GSSAPI . OK Pre-login capabilities listed, post-login capabilities have more. . AUTHENTICATE GSSAPI + YEcGBisGAQUFAqA9MDugDTALBgkqhkiG9xIBAgKjKjAooCYbJG5vdF9kZWZpbmVkX2luX1JGQzQxNzhAcGxlYXNlX2lnbm9yZQ== YIIDAAYJKoZIhvcSAQICAQBuggLvMIIC66ADAgEFoQMCAQ6iBwMFACAAAACjggIDYYIB/zCCAfugAwIBBaENGwtFWEFNUExFLkNPTaIfMB2gAwIBA6EWMBQbBGltYXAbDGRvdmVjb3QtdGVzdKOCAcIwggG+oAMCARKhAwIBAqKCAbAEggGsj4jD3VOwvfNdLxjc2hqxFsBYyCvjdOCX0R1So6ANZEYnEWddqZwMCuz7BxXv4z+cXaL6g6iGlVkU4RxQyJQHDFUQC8JroTlyMQ+XsIM4zuwn5N4/xRsgKa+SisK92UNMYyl9hVIPKvu/A54cU0zYTdDjYfDGnkurG2RgXDrKIzMpU2LtpoBEtwl3F1H+rzKFJAqe96e39C85GjK1D4s8/TOm3IcHJ5eofeHxI2GeUodysi+DlurRQTSnsUkGa1LXSgkY+4QdlMf+4goNRG5xNdZ8OA2CLY97TPAFqIeej1Amvb9uQBIKvWfbTjDdItBWOhuvAetlNfqnxlcCbnjbCmFTOIbVsHhNW8W1JIElL28mGydbMPimi9brc250E+ImO0Bxp3gMn5oXGV0tUJl5Y8W1lHlEUU7vKK0V7khUob0b3P3lCGQVJyWZEGNodgpr5zkTbR2M8orP4eI9SYoYp2UB0Ag+JkeYSNoQrKZNxSoKBYLVPGzwwGNPBKl7T0CdXlDAOhfZS/FSxdoy8LGRhuTdv7ghQAvstOllibSbjN3wos8ZC8wH2I5LFkekgc4wgcugAwIBEqKBwwSBwMCJkwg3LL7QqlEOunOjvQzpXmA/LMbdtEDyW9b0EQNFL9KFkNuRKDC3V8SFkmG1KlEEHFp2GQNij6AN89xvmEGvhj3tqC280awJs8ve3Bbr7GHRJoFO/sikSRsol1HD/K3sC9OMDufEEItsWf94uu8SmEBpB2OBOzedtfw+PRpoWyYUJYEfAL9T4w0KmBD26KVcehzIv8e3vOl52aT3x9Ovjnw8RfFkZa+t/iGhMpYpf8ApWExZDWBZ6uzVJxcAPg== . NO [AUTHENTICATIONFAILED] Authentication failed. gsasl: server error Successful authentication (mutt) dovecot debug log: Apr 30 13:32:30 auth: Debug: Loading modules from directory: /usr/lib/dovecot/modules/auth Apr 30 13:32:30 auth: Debug: Loading modules from directory: /usr/lib/dovecot/modules/auth Apr 30 13:32:30 auth: Debug: Module loaded: /usr/lib/dovecot/modules/auth/libmech_gssapi.so Apr 30 13:32:30 auth: Debug: Read auth token secret from /home/noahm/dovecot-root/b/auth-token-secret.dat Apr 30 13:32:30 auth: Debug: conn unix:login (pid=6788,uid=1000) [1]: Server accepted connection (fd=18) Apr 30 13:32:30 auth: Debug: conn unix:login (pid=6788,uid=1000) [1]: auth client connected (pid=6788) Apr 30 13:32:30 auth: Debug: conn unix:login (pid=6788,uid=1000) [1]: client in: AUTH 1 GSSAPI protocol=imap final-resp-ok session=4aLx8v4z8JPAqAHa lip=172.18.0.205 rip=192.168.1.218 lport=17436 rport=37872 resp=YIIDAAYJKoZIhvcSAQICAQBuggLvMIIC66ADAgEFoQMCAQ6iBwMFACAAAACjggIDYYIB/zCCAfugAwIBBaENGwtFWEFNUExFLkNPTaIfMB2gAwIBA6EWMBQbBGltYXAbDGRvdmVjb3QtdGVzdKOCAcIwggG+oAMCARKhAwIBAqKCAbAEggGsj4jD3VOwvfNdLxjc2hqxFsBYyCvjdOCX0R1So6ANZEYnEWddqZwMCuz7BxXv4z+cXaL6g6iGlVkU4RxQyJQHDFUQC8JroTlyMQ+XsIM4zuwn5N4/xRsgKa+SisK92UNMYyl9hVIPKvu/A54cU0zYTdDjYfDGnkurG2RgXDrKIzMpU2LtpoBEtwl3F1H+rzKFJAqe96e39C85GjK1D4s8/TOm3IcHJ5eofeHxI2GeUodysi+DlurRQTSnsUkGa1LXSgkY+4QdlMf+4goNRG5xNdZ8OA2CLY97TPAFqIeej1Amvb9uQBIKvWfbTjDdItBWOhuvAetlNfqnxlcCbnjbCmFTOIbVsHhNW8W1JIElL28mGydbMPimi9brc250E+ImO0Bxp3gMn5oXGV0tUJl5Y8W1lHlEUU7vKK0V7khUob0b3P3lCGQVJyWZEGNodgpr5zkTbR2M8orP4eI9SYoYp2UB0Ag+JkeYSNoQrKZNxSoKBYLVPGzwwGNPBKl7T0CdXlDAOhfZS/FSxdoy8LGRhuTdv7ghQAvstOllibSbjN3wos8ZC8wH2I5LFkekgc4wgcugAwIBEqKBwwSBwHCqBBzSB3g1k9BBC5M8XG5NpM35pvpLMHWjw0HIXloN2XjibgczTBt6l+q4DuWo6OWCuf5U+g+BrQ17y52AnCwUk/l722toAEhxwEKA/f3K+7i/lXBzjfCxGTmD2TTO6NUVZUM6TTa6CvwKgGwzGZLh/kQ90VnyzaOyTErL5oiNtl8ZKfguMt38yV8THESf8ZGjxUCKUUa1n3UNClhVk/0Kl88qGD1h11it0yFoNNK5/tbqI5e+sdi+pK4VHsvjPw== (previous base64 data may contain sensitive data) Apr 30 13:32:30 auth(?,192.168.1.218,sasl:gssapi)<4aLx8v4z8JPAqAHa>: Debug: gssapi: Using all keytab entries Apr 30 13:32:30 auth(noahm@example.com,192.168.1.218,sasl:gssapi)<4aLx8v4z8JPAqAHa>: Debug: gssapi: security context state completed. Apr 30 13:32:30 auth: Debug: conn unix:login (pid=6788,uid=1000) [1]: client passdb out: CONT 1 YIGZBgkqhkiG9xIBAgICAG+BiTCBhqADAgEFoQMCAQ+iejB4oAMCARKicQRvsiRFdcazky9GL2l//v2J+U606pbiLSCahGZ2wUxpp05eo9kGAl7j/UQfkzmlOWW7aMfMzPrJTveYBZiDpcfyeTt/wJfAHiEk5A24KYKTIt2ialxe6YOvrmz1e4B+mULZAghrfq5ftdUkQfh0CP/W Apr 30 13:32:30 auth: Debug: conn unix:login (pid=6788,uid=1000) [1]: client in: CONT 1 (previous base64 data may contain sensitive data) Apr 30 13:32:30 auth(noahm@example.com,192.168.1.218,sasl:gssapi)<4aLx8v4z8JPAqAHa>: Debug: gssapi: Negotiated security layer Apr 30 13:32:30 auth: Debug: conn unix:login (pid=6788,uid=1000) [1]: client passdb out: CONT 1 BQQF/wAMAAAAAAAAFUr00gH/////HIlwJEVFPtqhtCU= Apr 30 13:32:30 auth: Debug: conn unix:login (pid=6788,uid=1000) [1]: client in: CONT 1 BQQE/wAMAAAAAAAAIfpD4AH///9ub2FobalxyQ7OjgY973Gakw== (previous base64 data may contain sensitive data) Apr 30 13:32:30 auth(noahm,192.168.1.218,sasl:gssapi)<4aLx8v4z8JPAqAHa>: Debug: static: Performing passdb lookup Apr 30 13:32:30 auth(noahm,192.168.1.218,sasl:gssapi)<4aLx8v4z8JPAqAHa>: Debug: static: lookup Apr 30 13:32:30 auth(noahm,192.168.1.218,sasl:gssapi)<4aLx8v4z8JPAqAHa>: Debug: static: Finished passdb lookup Apr 30 13:32:30 auth(noahm,192.168.1.218,sasl:gssapi)<4aLx8v4z8JPAqAHa>: Debug: Credentials: 70656e63696c Apr 30 13:32:30 auth(noahm,192.168.1.218,sasl:gssapi)<4aLx8v4z8JPAqAHa>: Debug: Auth request finished Apr 30 13:32:30 auth: Debug: conn unix:login (pid=6788,uid=1000) [1]: client passdb out: OK 1 user=noahm original_user=noahm(a)EXAMPLE.COM Apr 30 13:32:30 auth: Debug: conn unix:/home/noahm/dovecot-root/b/auth-master (pid=6790,uid=0): Server accepted connection (fd=19) Apr 30 13:32:30 auth: Debug: master in: REQUEST 4221435905 6788 1 6b8a10b34adc8ace171603fc8d378730 session_pid=6790 request_auth_token Apr 30 13:32:30 auth(noahm,192.168.1.218,sasl:gssapi)<4aLx8v4z8JPAqAHa>: Debug: static: Performing userdb lookup Apr 30 13:32:30 auth(noahm,192.168.1.218,sasl:gssapi)<4aLx8v4z8JPAqAHa>: Debug: static: Finished userdb lookup Apr 30 13:32:30 auth: Debug: master userdb out: USER 4221435905 noahm uid=4711 gid=4711 home=/home/noahm/dovecot-root auth_mech=GSSAPI auth_token=705494201f3425a0145e2f7af1edca82fee2ee17 auth_user=noahm(a)EXAMPLE.COM The corresponding client-side logs generated by mutt are: [2025-04-30 13:32:30] Connecting to dovecot-test... [2025-04-30 13:32:30] Connected to dovecot-test:17436 on fd=4 [2025-04-30 13:32:30] 4< * OK [CAPABILITY IMAP4rev1 LOGIN-REFERRALS ID ENABLE IDLE SASL-IR LITERAL+ STARTTLS AUTH=PLAIN AUTH=GSSAPI] Dovecot ready. [2025-04-30 13:32:30] imap_authenticate: Trying method gssapi [2025-04-30 13:32:30] imap_auth_gsasl: using mech GSSAPI [2025-04-30 13:32:30] Authenticating (GSSAPI)... [2025-04-30 13:32:30] 4> a0000 AUTHENTICATE GSSAPI YIIDAAYJKoZIhvcSAQICAQBuggLvMIIC66ADAgEFoQMCAQ6iBwMFACAAAACjggIDYYIB/zCCAfugAwIBBaENGwtFWEFNUExFLkNPTaIfMB2gAwIBA6EWMBQbBGltYXAbDGRvdmVjb3QtdGVzdKOCAcIwggG+oAMCARKhAwIBAqKCAbAEggGsj4jD3VOwvfNdLxjc2hqxFsBYyCvjdOCX0R1So6ANZEYnEWddqZwMCuz7BxXv4z+cXaL6g6iGlVkU4RxQyJQHDFUQC8JroTlyMQ+XsIM4zuwn5N4/xRsgKa+SisK92UNMYyl9hVIPKvu/A54cU0zYTdDjYfDGnkurG2RgXDrKIzMpU2LtpoBEtwl3F1H+rzKFJAqe96e39C85GjK1D4s8/TOm3IcHJ5eofeHxI2GeUodysi+DlurRQTSnsUkGa1LXSgkY+4QdlMf+4goNRG5xNdZ8OA2CLY97TPAFqIeej1Amvb9uQBIKvWfbTjDdItBWOhuvAetlNfqnxlcCbnjbCmFTOIbVsHhNW8W1JIElL28mGydbMPimi9brc250E+ImO0Bxp3gMn5oXGV0tUJl5Y8W1lHlEUU7vKK0V7khUob0b3P3lCGQVJyWZEGNodgpr5zkTbR2M8orP4eI9SYoYp2UB0Ag+JkeYSNoQrKZNxSoKBYLVPGzwwGNPBKl7T0CdXlDAOhfZS/FSxdoy8LGRhuTdv7ghQAvstOllibSbjN3wos8ZC8wH2I5LFkekgc4wgcugAwIBEqKBwwSBwHCqBBzSB3g1k9BBC5M8XG5NpM35pvpLMHWjw0HIXloN2XjibgczTBt6l+q4DuWo6OWCuf5U+g+BrQ17y52AnCwUk/l722toAEhxwEKA/f3K+7i/lXBzjfCxGTmD2TTO6NUVZUM6TTa6CvwKgGwzGZLh/kQ90VnyzaOyTErL5oiNtl8ZKfguMt38yV8THESf8ZGjxUCKUUa1n3UNClhVk/0Kl88qGD1h11it0yFoNNK5/tbqI5e+sdi+pK4VHsvjPw== [2025-04-30 13:32:30] 4< + YIGZBgkqhkiG9xIBAgICAG+BiTCBhqADAgEFoQMCAQ+iejB4oAMCARKicQRvsiRFdcazky9GL2l//v2J+U606pbiLSCahGZ2wUxpp05eo9kGAl7j/UQfkzmlOWW7aMfMzPrJTveYBZiDpcfyeTt/wJfAHiEk5A24KYKTIt2ialxe6YOvrmz1e4B+mULZAghrfq5ftdUkQfh0CP/W [2025-04-30 13:32:30] 4> [2025-04-30 13:32:30] 4< + BQQF/wAMAAAAAAAAFUr00gH/////HIlwJEVFPtqhtCU= [2025-04-30 13:32:30] 4> BQQE/wAMAAAAAAAAIfpD4AH///9ub2FobalxyQ7OjgY973Gakw== [2025-04-30 13:32:30] 4< a0000 OK [CAPABILITY IMAP4rev1 SASL-IR LOGIN-REFERRALS ID ENABLE IDLE SORT SORT=DISPLAY THREAD=REFERENCES THREAD=REFS THREAD=ORDEREDSUBJECT MULTIAPPEND URL-PARTIAL CATENATE UNSELECT CHILDREN NAMESPACE UIDPLUS LIST-EXTENDED I18NLEVEL=1 CONDSTORE QRESYNC ESEARCH ESORT SEARCHRES WITHIN CONTEXT=SEARCH LIST-STATUS BINARY MOVE REPLACE SNIPPET=FUZZY PREVIEW=FUZZY PREVIEW SPECIAL-USE STATUS=SIZE SAVEDATE COMPRESS=DEFLATE INPROGRESS NOTIFY LITERAL+] Logged in

5 5

Dovecot 3.21.1 -> 2.4.0 SegFault
by Cata S 02 May '25

02 May '25

Hi guys, There seems to be some issue with Dovecot deployed on alpine. More specifically, the dovecot.config file is not properly read. I have run some debugging and the SegFault is returned in the function below: #0 0x000055555556779b in config_parsed_get_setting () No symbol table info available. #1 0x0000555555563708 in config_dump_full () No symbol table info available. #2 0x000055555555c814 in main () No symbol table info available. This was also addressed by alpine here: https://gitlab.alpinelinux.org/alpine/aports/-/issues/17050 Any idea what could be causing this? Thanks for looking into it, Cata

2 3