June 2025 - dovecot - dovecot.org

Why would "doveadm mailbox" check certificate file access?
by Ralph Seichter 15 Jun '25

15 Jun '25

The following came as a nasty surprise while testing Dovecot 2.4.1-4: alice@host $ doveadm mailbox list -u $(whoami) doveconf: Fatal: Error in configuration file /etc/dovecot/dovecot.conf line 61: cert_file: open(/path/to/cert.pem) failed: Permission denied Unprivileged user Alice does not have access to cert.pem, nor does she need it. Calling "doveadm flags ..." causes the same error. I suspect other subcommands are affected as well, but did not test it. The technical reason might be that dovecot.conf is parsed for each doveadm invocation? In any case, the certificate access check for subcommands like "flags" or "mailbox" seems like a bug to me. -Ralph

3 4

Migrating to Docker 2.4.1 not show Mailbox elements
by alberto 15 Jun '25

15 Jun '25

Hi, I'm migrating my physical Dovecot Server 2.2.33.2 to a new 2.4.1 (latest) on Docker container installation. I've got auth process successfully (Mariadb + Wforce included), but I cannot see their Maildir mailbox structure and elements, and logging debug not show errors related. I detected in my probe account that when I make logging with the new installation, a new "Maildir" directory into Mailbox structure disk is created, as unique difference that I noted, and perhaps would be a symptom, but I'm not sure. ... imap(probe@mydomain)<20><BpSIoIY3GIpYDjFl>: Info: Mailbox INBOX: Mailbox created ... --- "probe@mydomain" account disk structure --- drwxrwsr-x 7 mail dovecot 4096 dic 19 09:33 .. drwx--S--- 3 dovecot dovecot 4096 jun 14 13:40 Maildir drwxrwsr-x 2 dovecot dovecot 4096 jun 13 20:12 tmp drwxrwsr-x 2 dovecot dovecot 4096 jun 14 12:42 new drwxrwsr-x 2 dovecot dovecot 16384 jun 14 12:47 cur drwx--S--- 3 dovecot dovecot 4096 jun 3 16:02 sieve drwxrwsr-x 5 dovecot dovecot 4096 jun 14 12:57 .Sent drwxrwsr-x 5 dovecot dovecot 4096 nov 9 2020 .spam drwxrwsr-x 5 dovecot dovecot 4096 abr 30 2019 .Drafts drwxrwsr-x 5 dovecot dovecot 4096 jun 14 12:47 .Trash -rw------- 1 dovecot dovecot 212 jul 28 2019 .dovecot.svbin -rw-rw-r-- 1 dovecot dovecot 656 feb 11 02:09 dovecot.index -rw-rw-r-- 1 dovecot dovecot 31832 jun 14 12:47 dovecot.index.cache -rw-rw-r-- 1 dovecot dovecot 26252 jun 14 12:57 dovecot.index.log -rw-rw-r-- 1 dovecot dovecot 7420 ene 16 14:32 dovecot.list.index.log -rw-rw-r-- 1 dovecot dovecot 29 may 4 2019 dovecot-acl-list -rw-rw-r-- 1 dovecot dovecot 10 oct 31 2020 dovecot-keywords -rw------- 1 dovecot dovecot 240 dic 26 16:37 dovecot.mailbox.log -rw------- 1 dovecot dovecot 8 dic 26 16:37 dovecot-uidvalidity -r--r--r-- 1 dovecot dovecot 0 abr 19 2019 dovecot-uidvalidity.5cb9d075 -rw-rw-r-- 1 dovecot dovecot 909 jun 13 20:12 dovecot-uidlist -rw-rw-r-- 1 dovecot dovecot 87 dic 26 16:37 subscriptions --- old other account disk structure --- drwxrwsr-x 7 mail dovecot 4096 dic 19 09:33 .. drwxrwsr-x 2 dovecot dovecot 4096 oct 8 2024 tmp drwxrwsr-x 2 dovecot dovecot 4096 oct 8 2024 new drwxrwsr-x 2 dovecot dovecot 4096 oct 8 2024 cur drwx--S--- 3 dovecot dovecot 4096 may 27 23:38 sieve drwxrwsr-x 5 dovecot dovecot 4096 abr 2 15:37 .Sent drwxrwsr-x 5 dovecot dovecot 4096 may 26 17:03 .spam drwxrwsr-x 5 dovecot dovecot 4096 abr 30 2019 .Drafts drwxrwsr-x 5 dovecot dovecot 4096 sep 4 2020 .Trash lrwxrwxrwx 1 dovecot dovecot 23 may 4 2019 .dovecot.sieve -> sieve/managesieve.sieve -rw------- 1 dovecot dovecot 264 may 5 2019 .dovecot.svbin -rw-rw-r-- 1 dovecot dovecot 816 oct 17 2019 dovecot.index -rw-rw-r-- 1 dovecot dovecot 30152 abr 2 15:35 dovecot.index.log -rw-rw-r-- 1 dovecot dovecot 30884 abr 2 15:35 dovecot.index.cache -rw-rw-r-- 1 dovecot dovecot 146 may 3 2019 dovecot.index.thread -rw-rw-r-- 1 dovecot dovecot 13 may 2 2019 dovecot-keywords -rw-rw-r-- 1 dovecot dovecot 240 oct 17 2019 dovecot.mailbox.log -rw------- 1 dovecot dovecot 8 oct 17 2019 dovecot-uidvalidity -rw-rw-r-- 1 dovecot dovecot 1773 oct 8 2024 dovecot-uidlist -rw-rw-r-- 1 dovecot dovecot 54 oct 17 2019 subscriptions This is my new Docker installation config: # 2.4.1 (7d8c0e5759): /etc/dovecot/dovecot.conf # Pigeonhole version 2.4.1 (0a86619f) # OS: Linux 4.15.0 x86_64 Debian 12.11 # Hostname: midovecot # 4 default setting changes since version 2.4.0 dovecot_config_version = 2.4.0 auth_allow_weak_schemes = yes auth_debug_passwords = yes auth_mechanisms = plain login cram-md5 auth_verbose_passwords = yes debug_log_path = /dev/stdout default_internal_group = vmail default_internal_user = vmail default_login_user = vmail deliver_log_format = msgid=%{msgid}: %{message} (subject=%{subject} from=%{from} To=%{to_envelope} size=%{size}) dovecot_storage_version = 2.4.0 first_valid_gid = 119 first_valid_uid = 108 import_environment { CORE_ERROR = %{env:CORE_ERROR} CORE_OUTOFMEM = %{env:CORE_OUTOFMEM} MALLOC_MMAP_THRESHOLD_ = 131072 PATH = %{env:PATH} TZ = %{env:TZ} } instance_name = midovecot last_valid_gid = 119 last_valid_uid = 108 log_debug = category=mail log_path = /dev/stdout mail_driver = maildir mail_gid = vmail mail_home = /var/mail/%{user|lower} mail_log_events = delete undelete expunge copy mailbox_create mailbox_delete mailbox_rename flag_change append mail_plugins { notify = yes mail_log = yes acl = yes quota = yes } mail_uid = vmail mail_utf8_extensions = yes mailbox_list_layout = index mailbox_list_utf8 = yes protocols = imap lmtp sql_driver = mysql state_dir = /run/dovecot service imap-login { client_limit = 100 process_min_avail = 1 inet_listener imap { port = 0 } inet_listener imaps { port = 31993 ssl = yes } } service imap { } service pop3-login { inet_listener pop3 { port = 0 } inet_listener pop3s { port = 0 ssl = yes } } service pop3 { } service submission-login { inet_listener submission { port = 31587 } inet_listener submissions { port = 31465 } } service submission { } service managesieve-login { client_limit = 100 process_min_avail = 1 inet_listener sieve { port = 34190 } inet_listener sieve_deprecated { port = 2000 } } service managesieve { } service lmtp { unix_listener lmtp { } } service auth { unix_listener auth-userdb { } } service auth-worker { } service dict { unix_listener dict { } } service stats { process_min_avail = 1 inet_listener http { port = 9090 } } service doveadm { inet_listener http { port = 8080 ssl = yes } } mysql mimariadb { dbname = xxxxxx password = # hidden, use -P to show it user = xxxxxxx } passdb sql { default_password_scheme = CRYPT query = SELECT username, domain, home AS userdb_home, uid AS userdb_uid, gid AS userdb_gid, (CASE WHEN '%{mechanism}' = 'CRAM-MD5' THEN crampassword ELSE password END) AS password, concat('*:bytes=', quota) AS userdb_quota_rule, concat('*:messages=', quotamsgs) AS userdb_quota_rule3 FROM users WHERE username = '%{user|username}' AND domain = '%{user|domain}' AND active = 'Y' } userdb sql { iterate_query = SELECT username,domain AS user FROM users query = SELECT home, uid, gid, concat('*:bytes=', quota) AS quota_rule, concat('*:messages=', quotamsgs) AS quota_rule3 FROM users WHERE username = '%{ user | username | lower }' AND domain = '%{ user | domain | lower }' } auth_policy { hash_nonce = # hidden, use -P to show it server_api_header = Authorization: Basic d2ZvcmNlOmllcGE server_url = http://miwforce:8084 } ssl_server { cert_file = /dovecot/albertocerts/fullchain.pem key_file = /dovecot/albertocerts/privkey.pem key_password = # hidden, use -P to show it } namespace inbox { inbox = yes separator = / type = private mailbox Drafts { special_use = "\\Drafts" } mailbox Junk { special_use = "\\Junk" } mailbox Trash { auto = subscribe autoexpunge = 10d special_use = "\\Trash" quota_storage_extra = 100M } mailbox Sent { special_use = "\\Sent" } mailbox "Sent Messages" { special_use = "\\Sent" } } namespace shared { prefix = shared/$user/ type = shared } protocol imap { mail_plugins { imap_filter_sieve = yes imap_acl = yes imap_quota = yes } } protocol lmtp { mail_plugins { sieve = yes } } quota "User quota" { storage_size = 1G quota_warning warn-95 { quota_storage_percentage = 95 execute quota-warning { args = 95 %{user} } } quota_warning warn-80 { quota_storage_percentage = 80 execute quota-warning { args = 80 %{user} } } } service quota-warning { executable = script /dovecot/albertobin/quota-warning.sh user = vmail unix_listener quota-warning { user = vmail } } Best Regards, Alberto

2 8

BUG: extra_groups doesn't accept multiple values
by m＠sacha.pl 14 Jun '25

14 Jun '25

Hello, I'm reporting a bug in the config processor/parser. The option extra_groups does not accept multiple (list) values. If you put a section like: service auth-worker { user = $default_internal_user group = $default_internal_group extra_groups = shadow mail } you will get the error message like: dovecotFatal: service(auth-worker) Group doesn't exist: shadow mail (See service auth-worker { extra_groups } setting) It is trivial to reproduce - just try to run the dovecot with the section like above, and you will get the error. Best regards, Marcin

2 1

Dovecot and xoauth2: oauth2 active_attribute check failed
by Markus Grandpré 14 Jun '25

14 Jun '25

Dear dovecot list members, I am currently working on the task of implementing an MFA solution with OpenID for our SOGo server v5.12.1.20250612-1 and our Dovecot server v2.3.21.1. For this purpose, we are using a Shibboleth IDP v5.1.4 with the appropriate OpenID extension via XOAUTH2. In my opinion, authentication and autorization requests and responses between SOGo and the IDP are working flawlessly, and with: SOGoSMTPAuthenticationType = xoauth2; NGImap4AuthMechanism = xoauth2; the SOGo server forwards the received access token to the Dovecot server. On the Dovecot side, I have configured the server as follows: /etc/dovecot/conf.d/10-auth.conf: disable_plaintext_auth = yes auth_username_format = %Ln auth_master_user_separator = * auth_mechanisms = plain login auth_verbose = yes auth_verbose_passwords = no auth_debug = yes auth_debug_passwords = yes mail_debug = yes verbose_ssl = yes !include auth-master.conf.ext !include auth-oauth2.conf.ext /etc/dovecot/conf.d/auth-oauth2.conf.ext auth_mechanisms = $auth_mechanisms plain xoauth2 oauthbearer passdb { driver = oauth2 mechanisms = xoauth2 oauthbearer args = /etc/dovecot/dovecot-oauth2.conf.ext } userdb { driver = static args = uid=vmail gid=vmail home=/var/vmail/%u } service auth { unix_listener /var/spool/postfix/private/auth { mode = 0660 # Assuming the default Postfix user and group user = postfix group = postfix } } /etc/dovecot/dovecot-oauth2.conf.ext introspection_mode = post introspection_url = https://<ID>>:<SECRET>@idp-test.uni-konstanz.de/idp/profile/oauth2/introspection username_attribute = mail tls_ca_cert_file = /etc/ssl/certs/ca-certificates.crt active_attribute = active active_value = true As soon as the SOGo server contacts the Dovecot server, and the latter contacts the IDP server, I see the following error message in the Dovecot server logs: Jun 13 11:44:47 bamenda dovecot: auth: Debug: http-client[1]: request [Req7: POST https://idp-test.uni-konstanz.de/idp/profile/oauth2/introspection] Free (requests lef t=1) Jun 13 11:44:47 bamenda dovecot: auth: Debug: oauth2(pop519315,134.34.240.55,<kMaO5XA3FrWGIvA3>): Introspection succeeded Jun 13 11:44:47 bamenda dovecot: auth: Debug: oauth2(pop519315,134.34.240.55,<kMaO5XA3FrWGIvA3>): Processing field active Jun 13 11:44:47 bamenda dovecot: auth: Debug: oauth2(pop519315,134.34.240.55,<kMaO5XA3FrWGIvA3>): oauth2 active_attribute check failed: expected active="true" but got "false" Jun 13 11:44:47 bamenda dovecot: auth: oauth2(pop519315,134.34.240.55,<kMaO5XA3FrWGIvA3>): oauth2 failed: Introspection failed: Provided token is not valid Jun 13 11:44:47 bamenda dovecot: auth: Debug: oauth2(pop519315,134.34.240.55,<kMaO5XA3FrWGIvA3>): Finished passdb lookup Jun 13 11:44:47 bamenda dovecot: auth: Debug: auth(pop519315,134.34.240.55,<kMaO5XA3FrWGIvA3>): Auth request finished Is the error on the IDP side, or is there something wrong with my Dovecot configuration, or both? How can I make Dovecot more verbose the way I could see all the tokens exchanged with SOGo and IDP? I would greatly appreciate your help. Best regards, Markus Grandpré -- Markus Ludwig Grandpré Universität Konstanz Kommunikations-, Informations-, Medienzentrum (KIM) Abteilung IT-Dienste Forschung und Lehre, B803, Tel: +49 7531 88 4342

2 1

dovecot-2.4 problems with uid/gid and mbox settings
by "Tóth Attila" 14 Jun '25

14 Jun '25

1. I have a disturbing uid/gid issue: up until dovecot-2.3, dovecot changed its uid/gid to the user it is delivering the mail for. I'm the first user on the system with uid 1000 and the users gid is 100. Therefore I kept first_valid_uid = 1000 and first_valid_gid = 100. Now that I've upgraded to dovecot-2.4, it immediately started to complain about unable to change uid/gid, because it tries to write in user's directory as mail:mail. Mail directories and files in it are accessible only by the owner, not even by the group. So even after lowering first_valid_uid/gid, the operation fails. Are there any configuration options to restore dovecot-2.3 behavior to change uid:gid to the actual user Jun 8 21:40:52 server dovecot: imap(user)<48978><1LgipBQ3LO1/AAAB>: Error: mkdir(/home/user/mail/.imap) failed: Permission denied (euid=8(mail) egid=12(mail) missing +x perm: /home/user/mail, dir owned by 1000:100 mode=0700) Jun 8 21:40:52 server dovecot: imap(user)<48978><1LgipBQ3LO1/AAAB>: Error: mkdir(/home/user/mail/.imap) failed: Permission denied (euid=8(mail) egid=12(mail) missing +x perm: /home/user/mail, dir owned by 1000:100 mode=0700) 2. I know, that mbox is deprecated as of dovecot-2.4 - or that it has been long superseded by more modern formats, but I have a setup for 20+ years (without any problems and less files) and before I would convert it to Maildir, I'd rather provide a transition period and keep using mbox for a little while. During dovecot-2.3 times this was my mail_location setting: mail_location = mbox:~/mail/:INBOX=/var/spool/mail/%u Mails get delivered into /var/spool/mail/user and when dovecot reads them, they get copied under /home/user/mail. Now for dovecot-2.4 I'm forced to came up with this: mail_driver = mbox mail_path = /home/%{user}/mail mail_inbox_path = /var/spool/mail/%{user} #mail_home Are there anyone else with a setup like this struggling with dovecot-2.4? Thanks: Dw. -- dr Tóth Attila, Radiológus, 06-20-825-8057 Attila Toth MD, Radiologist, +36-20-825-8057

2 1

Verifying LDAP configuration from command line ?
by BuzzSaw Code 14 Jun '25

14 Jun '25

Dovecot version : 2.3.x - using RedHat build Years ago I had a Dovecot install that was setup to perform certificate based authentication for clients that worked well - part of that setup was creating a passdb that pointed to a flat file that contained entries like this: cool.joe.c:{PLAIN}::::::username=cooljc and the passdb definition looked like this: passdb { driver = passwd-file args = scheme=plain /etc/dovecot/users.external skip = authenticated mechanisms = EXTERNAL default_fields = uid=vmail gid=vmail nopassword=1 } That worked and we had a cron job that would build that users.external file and keep it up to date. Now, a few years down the road, I've setup a new Dovecot server that is working wonderfully but I'd like to add the same functionality but also use a direct LDAP query instead of managing a flat file to maintain the list of users. I have another passdb entry that is using LDAP that works great for username/password auth, but I'd like to test what I think is a proper LDAP configuration specific for this passdb, But for the life of me I can't find out how to test the configuration file without having to actually update my dovecot configuration to use it. I'm looking for something like the Postfix 'postmap' tool that I can provide my configuration file for the LDAP lookup, give a username input to and it will show me the results from the configuration, including the return values. Is there such a tool ? Or do I have to setup a test server, add it to the config, and debug it ? Sorry if this is FAQ or dumb question - I've been reading documentation on the official Dovecot site looking for the answer but I'm either missing it or I'm reading the wrong docs.

4 3

FreeBSD deployment
by Eugene R 07 Jun '25

07 Jun '25

Hello! I am planning a migration of the Postfix/Dovecot mail system to a new FreeBSD server. In recent years, I have come to prefer the official ports/packages installations; however, the FreeBSD port of Dovecot is still at 2.3.21 which is substantially different from the current upstream 2.4.1. I have no problems with installing from sources (have been doing that for a long time) but I wonder what is the recommended approach with regard to the installation and configuration paths. I would prefer to follow the standard conventions and eventually switch to the ports-based install once it catches up, with minimal disruption and reconfiguration. Thank you in advance Eugene

4 4

GSSAPI authentication for sieve
by Paul Zirnik 05 Jun '25

05 Jun '25

Hi all, I try to get GSSAPI working for sieve. I already found there was an issue with GSSAPI in dovecot 2.4 and applied the patch from this thread https://dovecot.org/mailman3/archives/list/dovecot@dovecot.org/thread/MWCLQ… With the patch GSSAPI now works for imap. I do test this with "imtest" from cyrus tools imat@speedy:~> imtest -v -p 143 -u imat -m GSSAPI manitou.disconnected.homeip.net S: * OK [CAPABILITY IMAP4rev1 LOGIN-REFERRALS ID ENABLE IDLE SASL-IR LITERAL+ STARTTLS LOGINDISABLED AUTH=GSSAPI] Dovecot ready. C: A01 AUTHENTICATE GSSAPI YIIDIgYJKoZIhvcSAQICAQBuggMRMIIDDaADAgEFoQMCAQ6iBwMFACAAAACjggIaYYICFjCCAhKgAwIBBaEZGxdESVNDT05ORUNURUQuSE9NRUlQLk5FVKIyMDCgAwIBA6EpMCcbBGltYXAbH21hbml0b3UuZGlzY29ubmVjdGVkLmhvbWVpcC5uZXSjggG6MIIBtqADAgESoQMCAQKiggGoBIIBpFcei+vGql9tb5TpNjKFgdKAo7p1IiSW8DXPJR2GkCrHVrm0LdtsUaky4zOCskwEQkLURA8CuxM5HGmXT38O56434VTStpRHWZx7Xu43UHHJpOjdf76YYqnIA7WEk76QQyUpnO3hQWCEwyAPf1GhQKGDWCosHEuvn3jNE8t8fWmnRtWSgr35w5GD9OHsYKwca14yUruNU/qfVL9I41bjiFcJ1FFjMyVa/+ogghBm4jDoiFTV7vB8WYpx8Vuuev0d48TZDqv7Kf5/G8TgH3bc59VLjCemLAzTjOQ4mZxTXBEh9OpibKPUozRd266ao7dAD4OHMWNORXKqWl/Ch0iC7q/QEg/qY7E0dm7wqMDROrzmaxWW8p5+y69AbjwylsgivknVcTmbQjVnGGvniDLTke8O6CvqeIum/uUli2FyBmSUt8kVju1GIfoysFP8BEu6gDXdbcsG2XbuoTvfzLyJNT7eomILhF9nZI1vFariqF3TJLo14/L4OCG05RrAH3o8kHTkUMz8rrZj5y0yzfQqlME66yBRezRRSccrrD5AWdHzRMvw26SB2TCB1qADAgESooHOBIHLTo7UMx+G8Q+Ly+Mmj35JBfLm+SWeCV1YGcJQ8O1hI6F3pKh4fMjx5L9v4v4NzbDWpZ8YlQtSBcDgyebiZjHaeqGf4bIcOaGyzfor3DhAn0q0n0Zx/SKJiTJuT9eT0pHwb/yaT9MzOZTP6C5HuXgxUN/2Po2qNwkzaU5gOH+sOYu6Y0AKoKGlkIQHejzns70FehWRn8wBbu8T9+8zKRU0qmBQXnqg/C10pSW7EUVD37VPhY0kLY6SB77KS/8aguWWC3OVAfw6bcAXVVM= S: + YIGZBgkqhkiG9xIBAgICAG+BiTCBhqADAgEFoQMCAQ+iejB4oAMCARKicQRvzFWfR5FTOl77CqiMZ7qWR4I6JqXdi0JbIG4xTYJNYvQSsvxAxyfEiGINTMW5QytlcMvfiJpTj0U2Fd3Hr/MzLcCeCRwJ9jTg8m2E1ZgpmzmpXzl7xGq+MRIvetu3Wdgxum+ZQ8jPS1obTnI1Vh7I C: S: + BQQF/wAMAAAAAAAAHJz31AH///+2dWHfKNY/6f01FUw= C: BQQE/wAMAAAAAAAABI42iwEAAABpbWF0C53m6npnJwjAfaEu S: A01 OK [CAPABILITY IMAP4rev1 SASL-IR LOGIN-REFERRALS ID ENABLE IDLE SORT SORT=DISPLAY THREAD=REFERENCES THREAD=REFS THREAD=ORDEREDSUBJECT MULTIAPPEND URL-PARTIAL CATENATE UNSELECT CHILDREN NAMESPACE UIDPLUS LIST-EXTENDED I18NLEVEL=1 CONDSTORE QRESYNC ESEARCH ESORT SEARCHRES WITHIN CONTEXT=SEARCH LIST-STATUS BINARY MOVE REPLACE SNIPPET=FUZZY PREVIEW=FUZZY PREVIEW SPECIAL-USE STATUS=SIZE SAVEDATE COMPRESS=DEFLATE INPROGRESS NOTIFY LITERAL+] Logged in Authenticated. Security strength factor: 0 C: Q01 LOGOUT * BYE Logging out Q01 OK Logout completed (0.001 + 0.000 secs). Connection closed. When i try to use "sivtest" from cyrus tools, this does hang and it looks like sievtest is still waiting for some data imat@speedy:~> sivtest -v -p 4190 -u imat -m GSSAPI manitou.disconnected.homeip.net S: "IMPLEMENTATION" "Dovecot Pigeonhole" S: "SIEVE" "fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include body variables enotify environment mailbox date index ihave duplicate mime foreverypart extracttext" S: "NOTIFY" "mailto" S: "SASL" "GSSAPI" S: "STARTTLS" S: "VERSION" "1.0" S: OK "Dovecot ready." C: AUTHENTICATE "GSSAPI" {1076+} YIIDIwYJKoZIhvcSAQICAQBuggMSMIIDDqADAgEFoQMCAQ6iBwMFACAAAACjggIbYYICFzCCAhOgAwIBBaEZGxdESVNDT05ORUNURUQuSE9NRUlQLk5FVKIzMDGgAwIBA6EqMCgbBXNpZXZlGx9tYW5pdG91LmRpc2Nvbm5lY3RlZC5ob21laXAubmV0o4IBujCCAbagAwIBEqEDAgECooIBqASCAaTS89GNFHQk6FCilKJkEP8Xl27g/A8b1T0pxGwipjYBug0+bprqG0xJucYaULvqi1PnTI+A6WJesi2434B+L0WAv1sdWhI60SpmmfnsZPD8uqbJmZEFMj9bQnS4VbNgduhEA+pgYp85q0PcP3I5DcMeypIC7rk2hv15qYnVSYhND/P3tOANikXc5JB3cWnnPc79gRW+Ozi75waihMIv7C3UvllUtb2tTUKqdGwz2D9/BT3e1ZfcueaWznhXmzieh4dHZyqvbm4UVVUuc4paI1QMUrImy6zEfXjEH0O8dbZN3FbiKjCdP7E/zFtd6PkWaI0lgk8qGP1JqaFtGgqo+EcDEgyh4DoTRuNGGJp7n1zmQGkgIHzsUNR+SydUhWijdWJSegeIrGsZ4/s8YZupdxpC8g1qComP0+holawe9/iAnCxmRNGrNXDSRnL8wMaVAgm7t0SrBUSOm/YHKZSlHpMIWw438Dp/FdWwuCm2jA5pTksRbzmpS9fguMwp65bX0xh/a0NkI2VWJfwUmgqws3LRv1WHsn2FB/k+w55oOMboOtO3SCCkgdkwgdagAwIBEqKBzgSBy9PZObV0yc813IAR4TwEzPtKepfhzLvT0vFekCieE0sCu7jig2m+bpKt1IbIngs+hiztVx4TXYJu/UjH8UKNYct7xFWAOamuh/Fp4AnTBQXxieMM9TGZsiot7NzH75kRUY6SifNYYbz579wBAMbPzId5n2NVdp2blEpaCDKhMdZf/AQqUj3eFbafs5ociy4cOfmQSNuW7hY4KpQ0JU0cdWQyh0+Xl+fE9tz1ctmRoTA4WIF3U1UcwB0CPxlFxlw6cW+OAP0mlWqJE5Yx S: "YIGZBgkqhkiG9xIBAgICAG+BiTCBhqADAgEFoQMCAQ+iejB4oAMCARKicQRvEb5fwEVTKq3wm3xJawxEVD9Ngdz3tmzW5a8wJAh9lSRYSE0aJS97LvUtT1mWqZTFx5AZMJGfM7KpcbmJc3cOkVhe5lTUQDir58n1RywkyWYM6RvKd1Vzeonxt/AyJi7rN1CMR9VIh2KZUItIsz1y" here it hangs until timeout. May 24 10:10:36 manitou dovecot[45007]: auth(imat@disconnected.homeip.net,192.168.42.24,sasl:gssapi)<mh73Nt01+OHAqCoY>: Request timed out waiting for client to continue authentication (150 secs) May 24 10:11:06 manitou dovecot[45007]: managesieve-login: Login aborted: Inactivity during authentication (client didn't finish SASL auth, 1 attempts in 180 secs) (auth_waiting_client): user=<>, method=GSSAPI, rip=192.168.42.24, lip=192.168.42.42, session=<mh73Nt01+OHAqCoY> and sievtest does end with this S: BYE "Disconnected for inactivity during authentication." base64 decoding error Authentication failed. generic failure Security strength factor: 0 Connection closed. The "base64 decoding error" probably is unrelated as it does try to decode the "S: BYE .....". I also tested with other sieve clients, none does work (however different issues reported), while all tested imap clients do work. My guess is some small fix like the one from above is also needed for dovecot-pigeonhole. This is my used config manitou:~ # dovecot -n # 2.4.1-4 (7d8c0e5759): /etc/dovecot/dovecot.conf # Pigeonhole version 2.4.1-4 (0a86619f) # OS: Linux 6.14.6-1-default x86_64 # Hostname: manitou.disconnected.homeip.net # 4 default setting changes since version 2.4.0 dovecot_config_version = 2.4.0 auth_debug = yes auth_debug_passwords = yes auth_gssapi_hostname = manitou.disconnected.homeip.net auth_krb5_keytab = /etc/dovecot/dovecot.keytab auth_mechanisms = plain login gssapi dovecot_storage_version = 2.4.0 protocols { imap = yes lmtp = yes sieve = yes } protocol lmtp { auth_username_format = %{user | username} mail_plugins = sieve } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } unix_listener auth-userdb { } } namespace inbox { mail_driver = maildir mail_inbox_path = ~/Maildir/.INBOX mail_path = ~/Maildir inbox = yes separator = / } passdb pam { service_name = dovecot } userdb passwd { use_worker = yes } ssl_server { cert_file = /etc/ssl/servercerts/servercert.pem key_file = /etc/ssl/servercerts/serverkey.pem } service managesieve-login { } service managesieve { } sieve_script personal { active_path = ~/.dovecot.sieve path = ~/.sieve } What logs/infos are needed to dig into it ? thanks and regards, Tami

1 1

Dovecot 2.4. field lookup for sqlite_path?
by Brent Clark 04 Jun '25

04 Jun '25

Good day Guys Reading: https://doc.dovecot.org/2.4.1/core/config/auth/databases/sql.html#sqlite Im trying to do a field look up but I get the following error message Failed to parse configuration: Failed to expand sqlite_path setting variables: dom ain: No value to get domain from This is what I have passdb sql { query = SELECT name AS username, password FROM mailboxes WHERE name = '%{user | username}' sqlite_path = /usr/home/.mail/%{domain}/mailconf.sq3 } If I hard code the path, then the error message goes away Regards Brent Clark

2 2

Fatal: Couldn't load required plugin /usr/lib/dovecot/lib90_sieve_plugin.so: dlopen() failed: Error relocating /usr/lib/dovecot/lib90_sieve_plugin.so: mail_deliver_get_return_address: symbol not found
by paradoor 04 Jun '25

04 Jun '25

Hi there, I have a Postfix/Dovecot server which today I upgraded from Alpine Linux 3.21 to 3.22. In the process, Dovecot updated from 2.3.21 to 2.4.1, and I updated my Dovecot config accordingly. At least `doveconf -n` runs without any error, and I'm able to start and run Dovecot. For context, I am using a passwd file where I enter usernames and argon2id passwords manually, since it's just a small mail server where I am the only user. The setup was working fine with Dovecot 2.3.x, and I've sent and received lots of mail before the update. However, I noticed that I'm no longer able to authenticate to the server since doing all the updates. I thought, maybe I should make sure the passwd file is correct with my password, so I tried running `doveadm pw -s argon2id`. I then got the error: `Fatal: Couldn't load required plugin /usr/lib/dovecot/lib90_sieve_plugin.so: dlopen() failed: Error relocating /usr/lib/dovecot/lib90_sieve_plugin.so: mail_deliver_get_return_address: symbol not found` I assume this is the cause of the problem, ie Dovecot isn't able to authenticate as this error occurs when a login attempt is made (I think?). I am not sure if this is an Alpine packaging issue or a Dovecot user issue, but just in case it's a user issue that I can fix myself, I thought to post here and ask if people know if there's something I can do to resolve this. I'm also posting to the Alpine mailing list in the case of it being an Alpine packaging issue. I've attached the output of `doveconf -n`; let me know if it's preferable to put this in the body of the email and I can send a reply with it in the body. `dovecot --version` is `2.4.1-4 (7d8c0e5759)`. Example `/var/log/dovecot.conf` authentication attempt: May 31 21:50:41 auth: Debug: conn unix:login (pid=21015,uid=91) [1]: client in: AUTH 4 PLAIN protocol=imap final-resp-ok secured=tls session=ElBsg3U25ou51Zrs lip=93.113.25.226 rip=185.213.154.236 lport=993 rport=35814 ssl_ja3_hash=422b5eb1ed3e9bdf65e87a42ed96ba1f local_name=mail.revsuine.xyz resp=<hidden> May 31 21:50:41 auth(${user | username},185.213.154.236,sasl:plain)<ElBsg3U25ou51Zrs>: Debug: passwd-file: Performing passdb lookup May 31 21:50:41 auth(${user | username},185.213.154.236,sasl:plain)<ElBsg3U25ou51Zrs>: Debug: passwd-file: lookup: user=${user | username} file=/etc/dovecot/passwd May 31 21:50:41 auth(${user | username},185.213.154.236,sasl:plain)<ElBsg3U25ou51Zrs>: Info: passwd-file: unknown user May 31 21:50:41 auth(${user | username},185.213.154.236,sasl:plain)<ElBsg3U25ou51Zrs>: Debug: passwd-file: Finished passdb lookup May 31 21:50:41 auth(${user | username},185.213.154.236,sasl:plain)<ElBsg3U25ou51Zrs>: Debug: Auth request finished May 31 21:50:41 auth(${user | username},185.213.154.236,sasl:plain)<ElBsg3U25ou51Zrs>: Debug: delaying auth failure May 31 21:50:43 auth: Debug: conn unix:login (pid=21015,uid=91) [1]: client passdb out: FAIL 4 user=${user | username} original_user=pid1 (The IP addresses are my public server IP address and a Mullvad VPN IP address, so not sensitive.) I'm using the same credentials and passwd file as before the update. Thanks in advance, appreciate any responses.

3 6