September 2025 - dovecot

[Dovecot] auth: Error: net_connect_unix(anvil-auth-penalty) failed: Permission denied
by mailing＠securitylabs.it 01 Oct '25

01 Oct '25

Hello, just upgraded one of my testing machine from dovecot 1.2.15 to 2.0.7. After some trouble with permissions now all seems working, but when I stop dovecot I have these errors in log: Nov 9 17:08:07 in dovecot: master: Warning: Killed with signal 15 (by pid=20362 uid=0 code=kill) Nov 9 17:08:07 in dovecot: pop3-login: Error: read(anvil) failed: EOF Nov 9 17:08:07 in dovecot: imap-login: Error: read(anvil) failed: EOF Nov 9 17:08:07 in dovecot: imap(mailing(a)securitylabs.it): Server shutting down. bytes=410/59361 Nov 9 17:08:07 in dovecot: imap(mailing(a)securitylabs.it): Server shutting down. bytes=79/26605 Nov 9 17:08:07 in dovecot: imap(mailing(a)securitylabs.it): Server shutting down. bytes=802/55708 Nov 9 17:08:07 in dovecot: imap(mailing(a)securitylabs.it): Server shutting down. bytes=258/1242 Nov 9 17:08:07 in dovecot: auth: Error: read(anvil-auth-penalty) failed: EOF Nov 9 17:08:07 in dovecot: auth: Error: net_connect_unix(anvil-auth-penalty) failed: Permission denied dovecot -n: # 2.0.7: /usr/local/etc/dovecot/dovecot.conf # OS: Linux 2.6.32-5-xen-686 i686 Debian squeeze/sid auth_cache_negative_ttl = 2 mins auth_cache_size = 1000 M auth_cache_ttl = 2 mins auth_master_user_separator = * auth_username_chars = abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ01234567890.-_@& disable_plaintext_auth = no dotlock_use_excl = yes first_valid_uid = 100 last_valid_uid = 105 lock_method = dotlock log_timestamp = "%Y-%m-%d %H:%M:%S " login_greeting = Server ready. mail_fsync = never mail_gid = Debian-exim mail_location = maildir:~/Maildir:INDEX=/var/indexes/%d/%n mail_privileged_group = Debian-exim mail_uid = Debian-exim managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date namespace { inbox = yes location = prefix = separator = / type = private } namespace { location = maildir:~/Maildir/expunged prefix = EXPUNGED/ separator = / type = private } namespace { location = maildir:~/Maildir/deleted prefix = DELETED/ separator = / type = private } namespace { location = maildir:~/Maildir/deleted/expunged prefix = DELETED/EXPUNGED/ separator = / type = private } passdb { args = /usr/local/etc/dovecot-sql.conf driver = sql } passdb { args = /usr/local/etc/passwd.masterusers driver = passwd-file master = yes pass = yes } plugin { lazy_expunge = EXPUNGED/ DELETED/ DELETED/EXPUNGED/ mail_log_events = delete expunge mail_log_group_events = quota = maildir quota_warning = storage=80%% /usr/local/bin/dovecot-quota-warning.sh 80 quota_warning2 = storage=90%% /usr/local/bin/dovecot-quota-warning.sh 90 sieve = ~/.dovecot.sieve } pop3_no_flag_updates = yes protocols = imap pop3 service auth { unix_listener auth-userdb { group = Debian-exim mode = 0600 user = Debian-exim } } service imap-login { client_limit = 256 process_limit = 128 process_min_avail = 3 service_count = 1 } service imap { drop_priv_before_exec = yes process_limit = 256 vsz_limit = 256 B } service pop3-login { client_limit = 256 process_limit = 128 process_min_avail = 3 service_count = 1 } service pop3 { drop_priv_before_exec = yes process_limit = 256 vsz_limit = 256 B } ssl_cert = </usr/local/etc/dovecot.crt ssl_key = </usr/local/etc/dovecot.key userdb { args = /usr/local/etc/dovecot-sql.conf driver = sql } protocol imap { mail_max_userip_connections = 10 mail_plugins = " notify quota imap_quota mail_log lazy_expunge" } protocol pop3 { mail_max_userip_connections = 3 mail_plugins = " notify quota mail_log" pop3_uidl_format = %08Xu%08Xv } protocol lda { mail_plugins = quota sieve postmaster_address = postmaster(a)securitylabs.it } My /usr/local/var/run/dovecot directory: 4 drwxr-sr-x 4 root staff 4096 Nov 9 17:08 . 4 drwxrwsrwx 3 root staff 4096 Nov 9 17:05 .. 0 srw------- 1 root staff 0 Nov 9 17:05 anvil 0 srw------- 1 root staff 0 Nov 9 17:05 anvil-auth-penalty 0 srw------- 1 root staff 0 Nov 9 17:05 auth-client 0 srw------- 1 dovecot staff 0 Nov 9 17:05 auth-login 0 srw------- 1 root staff 0 Nov 9 17:05 auth-master 0 srw------- 1 Debian-exim Debian-exim 0 Nov 9 17:05 auth-userdb 0 srw------- 1 dovecot staff 0 Nov 9 17:05 auth-worker 0 srw------- 1 root staff 0 Nov 9 17:05 config 0 srw------- 1 root staff 0 Nov 9 17:05 dict 0 srw------- 1 root staff 0 Nov 9 17:05 director-admin 0 srw-rw-rw- 1 root staff 0 Nov 9 17:05 dns-client 0 srw------- 1 root staff 0 Nov 9 17:05 doveadm-server 0 lrwxrwxrwx 1 root staff 35 Nov 9 17:05 dovecot.conf -> /usr/local/etc/dovecot/dovecot.conf 4 drwxr-xr-x 2 root root 4096 Nov 9 17:05 empty 4 drwxr-x--- 2 root dovenull 4096 Nov 9 17:05 login My emails are delivered as user Debian-exim and users are virtual in a MySQL DB. This system is behind a proxy (so the master user)

7 7

Dovecot 2.3 to 2.4 invalid Maildir settings
by User 01 Oct '25

01 Oct '25

Greetings, I am unable to completely migrate my Dovecot 2.3 config to 2.4.1 as I'm unable to get past the following error: Error: Namespace inbox: maildir: maildir settings: Failed to parse configuration: Failed to override configuration from userdb: Invalid maildir=${domain}/${user}/: Setting is a named filter, use 'maildir {' I found a similar encounter at https://www.mail-archive.com/dovecot@dovecot.org/msg90843.html that points to https://doc.dovecot.org/2.4.0/core/config/mailbox/mail_location.html#per-us… yet I still can't get my config to work. I've attached my doveconf at the end, including the ported 2.3 settings that used to work for me (commented out). I would appreciate any advise. # /etc/dovecot/dovecot.conf dovecot_config_version = 2.4.1 dovecot_storage_version = 2.4.1 sql_driver = mysql mysql /run/mysqld/mysqld.sock { user = mail password = mail dbname = mail } passdb sql { query = SELECT username AS user, \ password FROM mailbox WHERE username = '%{user}' AND active='1' default_password_scheme = ARGON2I } userdb sql { query = SELECT maildir, \ 600 AS uid, \ 600 AS gid \ FROM mailbox WHERE username = '%{user}' AND active='1' iterate_query = SELECT username AS user FROM mailbox } # previously: # passdb { # driver = sql # args = /etc/dovecot/dovecot-sql.conf.ext # } # userdb { # driver = sql # args = /etc/dovecot/dovecot-sql.conf.ext # } # disable_plaintext_auth = yes auth_username_format = %{user | lower} # previously: "auth_username_format = %Lu" auth_mechanisms = plain login auth_default_domain = mail.com # previously: "auth_default_realm = mail.com" auth_debug = yes auth_debug_passwords = yes mail_privileged_group = mail # previously: "mail_location = maildir:~/Maildir" mail_driver = maildir mail_path = %{home}/Maildir mail_home = /var/vmail/%{user | domain}/%{user | username} # previously: "mail_home = /var/vmail/%d/%n/" service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { mode = 0600 user = postfix group = postfix } } service auth { unix_listener /var/spool/postfix/private/auth { mode = 0660 user = postfix group = postfix } } service stats { unix_listener stats-reader { user = nginx group = nginx mode = 0660 } unix_listener stats-writer { user = nginx group = nginx mode = 0660 } } ssl = required ssl_min_protocol = TLSv1.2 ssl_server_prefer_ciphers = server # previously: "ssl_prefer_server_ciphers = yes" ssl_server { dh_file = /etc/ssl/dovecot/dh.pem cert_file = /etc/ssl/dovecot/tls.pem key_file = /etc/ssl/dovecot/tls.key } # previously: # ssl_dh = </etc/ssl/dovecot/dh.pem # ssl_cert = </etc/ssl/dovecot/tls.pem # ssl_key = </etc/ssl/dovecot/tls.key namespace inbox { inbox = yes mailbox Archive { auto = subscribe special_use = \Archive } mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk { auto = subscribe special_use = \Junk } mailbox Trash { auto = subscribe special_use = \Trash } mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } } protocols = imap lmtp # previously: /etc/dovecot/dovecot-sql.conf.ext driver = mysql connect = host=localhost dbname=mail user=mail password=mail default_pass_scheme = ARGON2I password_query = SELECT username AS user,password FROM mailbox WHERE username = '%u' AND active='1' user_query = SELECT maildir, 600 AS uid, 600 AS gid FROM mailbox WHERE username = '%u' AND active='1' iterate_query = SELECT username AS user FROM mailbox

5 7

2.3 to 2.4 /proc/self/io) failed: Permission denied
by Don Bowman 01 Oct '25

01 Oct '25

I have a dovecot system running in my kubernetes cluster that i use to gateway some emails to imap that are in turn used by systems that poll for email. No people are involved. Its been running for sometime on 2.3, i've now updated the base container to 2.4 and i have two problems, perhaps related, perhaps not. I'm assuming its related to my config changes for 2.4, but I'm kind of at my wits end. The first issue: Sep 06 15:05:31 imap(support)<443><YIobSSM+MMoKIAIr>: Debug: open(/proc/self/io) failed: Permission denied (euid=1001(support) egid=1001(support) missing +r perm: /proc/self/io) I am seeing errors like this. I can't figure why. I tried "doveadm force-resync -u support /home/support/Maildir/" and it returns no errors. The 2nd error, again, perhaps related, the user doing the poll for new email doesn't see it (despite I see the email delivered to the 'new' dir, it doesn't get picked up and moved to 'cur'). Below is my config file. In /home/support/Maildir i have the new, cur, tmp etc. There's no mention of 'INBOX', which i think my previous had (mail_location = maildir:/home/%u/Maildir:INBOX=/var/mail/%u/Maildir was previous) Any advice? I'm not sure where to go from here. dovecot_config_version = 2.4.1 dovecot_storage_version = 2.4.1 auth_mechanisms = plain login auth_allow_cleartext = yes #disable_plaintext_auth = no mail_privileged_group = mail #mail_location = maildir:/home/%u/Maildir:INBOX=/var/mail/%u/Maildir mail_driver = maildir mail_path = /var/mail/%{user | username}/Maildir mail_inbox_path = /var/mail/%{user | username}/Maildir userdb passwd { fields { home = /home/{%user | username} mail_driver = maildir mail_path = /var/mail/{%user | username}/Maildir mail_inbox_path = /var/mail/%{user | username}/Maildir } } passdb pam { service_name = dovecot } protocols = " imap" namespace inbox { inbox = yes mailbox Trash { auto = subscribe # autocreate and autosubscribe the Trash mailbox special_use = \Trash } mailbox Sent { auto = subscribe # autocreate and autosubscribe the Sent mailbox special_use = \Sent } } service imap-login { inet_listener imap { port = 143 } inet_listener imaps { port = 993 } } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } } ssl=yes ssl_server_cert_file = /run/ca/tls.crt ssl_server_key_file = /run/ca/tls.key log_path = /tmp/dc.log mail_debug = yes ssl_min_protocol = TLSv1.2 log_debug = category=email # verbose_ssl=yes #auth_verbose=yes #auth_debug=yes I have a dovecot system running in my kubernetes cluster that i use to gateway some emails to imap that are in turn used by systems that poll for email. No people are involved. Its been running for sometime on 2.3, i've now updated the base container to 2.4 and i have two problems, perhaps related, perhaps not. I'm assuming its related to my config changes for 2.4, but I'm kind of at my wits end. The first issue: Sep 06 15:05:31 imap(support)<443><YIobSSM+MMoKIAIr>: Debug: open(/proc/self/io) failed: Permission denied (euid=1001(support) egid=1001(support) missing +r perm: /proc/self/io) I am seeing errors like this. I can't figure why. I tried "doveadm force-resync -u support /home/support/Maildir/" and it returns no errors. The 2nd error, again, perhaps related, the user doing the poll for new email doesn't see it (despite I see the email delivered to the 'new' dir, it doesn't get picked up and moved to 'cur'). Below is my config file. In /home/support/Maildir i have the new, cur, tmp etc. There's no mention of 'INBOX', which i think my previous had (mail_location = maildir:/home/%u/Maildir:INBOX=/var/mail/%u/Maildir was previous) Any advice? I'm not sure where to go from here. dovecot_config_version = 2.4.1 dovecot_storage_version = 2.4.1 auth_mechanisms = plain login auth_allow_cleartext = yes #disable_plaintext_auth = no mail_privileged_group = mail #mail_location = maildir:/home/%u/Maildir:INBOX=/var/mail/%u/Maildir mail_driver = maildir mail_path = /var/mail/%{user | username}/Maildir mail_inbox_path = /var/mail/%{user | username}/Maildir userdb passwd { fields { home = /home/{%user | username} mail_driver = maildir mail_path = /var/mail/{%user | username}/Maildir mail_inbox_path = /var/mail/%{user | username}/Maildir } } passdb pam { service_name = dovecot } protocols = " imap" namespace inbox { inbox = yes mailbox Trash { auto = subscribe # autocreate and autosubscribe the Trash mailbox special_use = \Trash } mailbox Sent { auto = subscribe # autocreate and autosubscribe the Sent mailbox special_use = \Sent } } service imap-login { inet_listener imap { port = 143 } inet_listener imaps { port = 993 } } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } } ssl=yes ssl_server_cert_file = /run/ca/tls.crt ssl_server_key_file = /run/ca/tls.key log_path = /tmp/dc.log mail_debug = yes ssl_min_protocol = TLSv1.2 log_debug = category=email # verbose_ssl=yes #auth_verbose=yes #auth_debug=yes

4 3

Public namespace - configuration help (new to Dovecot) - version 2.3.x
by daniel.botting＠codethink.co.uk 01 Oct '25

01 Oct '25

Hi all, I'm configuring a public namespace for an existing Dovecot install, I have the public namespace configured and working in a basic manner (it can be subscribed to in an MUA and mail can be moved into it for a specified user named in the dovecot-acl file). I've followed the official docs: - https://doc.dovecot.org/2.3/configuration_manual/shared_mailboxes/public_sh… When I configure the MUA (Thunderbird) I can see the public namespace and a subfolder that I've manually created underneath (with new/cur/tmp folders, parent public folders also has a new tmp cur directories, mail cannot be moved into public top level folder), but it is displayed as below when subscribed to: public^subfolder I've resolved this by changing the separator to a / , however as per my doveconf -n below I then received a separator conflict, which I resolved by changing the separator for the default namespace to also be a / . As the default namespace is already using period ( . ) on the production servers, I'd like to continue using this separator and not / separator. The existing install of a couple of hundred mailboxes and I'm concerned I'll break the mailboxes /any existing sieve filters. I would like the public folder to display with an empty prefix as below, but I understand you cannot have two 'prefix =' (empty prefixes) : subfolder doveconf -n output below: # 2.3.21.1 (d492236fa0): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.21.1 (49005e73) # OS: Linux 5.10.0-35-cloud-amd64 x86_64 Debian 11.11 # Hostname: imap-server.hostname.co.uk auth_verbose = yes default_vsz_limit = 0 doveadm_password = # hidden, use -P to show it first_valid_gid = 8 first_valid_uid = 8 last_valid_gid = 8 last_valid_uid = 8 lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes mail_gid = 8 mail_location = maildir:~/Maildir mail_plugins = " notify replication acl" mail_uid = 8 managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext editheader imapflags namespace { list = no location = maildir:/srv/vmail/public:INDEXPVT=~/Maildir/public prefix = Public/ separator = / subscriptions = no type = public } namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = separator = / <--- I'd like this to be a . instead } namespace subscriptions { hidden = yes list = no location = prefix = subscriptions/ <--- had to put something here because inbox namespace was empty subscriptions = yes } passdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } plugin { acl = vfile mail_replica = tcps:other-replica.domain.co.uk:port number sieve = ~/.dovecot.sieve sieve_before = /etc/dovecot/common.sieve sieve_dir = ~/sieve sieve_extensions = +editheader +imapflags } postmaster_address = postmaster(a)domain.co.uk protocols = " imap sieve pop3" replication_dsync_parameters = -d -N -l 15 -U -T 10 replication_max_conns = 24 service aggregator { fifo_listener replication-notify-fifo { user = mail } unix_listener replication-notify { user = mail } } service auth { unix_listener /var/run/dovecot-exim-bridge { mode = 0660 user = Debian-exim } } service doveadm { inet_listener { port = <replica port number> ssl = yes } } service imap-login { inet_listener imap { port = 143 } inet_listener imaps { port = 993 ssl = yes } process_limit = 512 process_min_avail = 4 service_count = 1 } service imap { process_limit = 1024 } service managesieve-login { inet_listener sieve { port = <port number> } process_min_avail = 1 service_count = 8 vsz_limit = 256 M } service managesieve { process_limit = 1024 } service replicator { process_min_avail = 1 unix_listener replicator-doveadm { mode = 0666 } } ssl = required ssl_cert = <path/to/fullchain.pem ssl_cipher_list = ALL:!LOW:!SSLv2:!EXP:!aNULL ssl_client_ca_dir = /etc/ssl/certs ssl_key = # hidden, use -P to show it userdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap override_fields = home=/var/mail/%u uid=mail gid=mail } protocol lda { mail_plugins = " notify replication acl sieve" } protocol imap { mail_max_userip_connections = 32 mail_plugins = " notify replication acl acl" } protocol sieve { mail_max_userip_connections = 10 managesieve_logout_format = bytes=%i/%o managesieve_max_line_length = 64 k } Also the public folder is not displayed in Roundcube webmail in folder sections to be subscribed to. doveadm mailbox list -u <username> I appreciate that replication does not work with public mailboxes, I'll have to look at that further. Many thanks Dan

2 6

Using MongoDB as a custom message store via plugin
by The Sixth Serpent 30 Sep '25

30 Sep '25

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hello Dovecot Community! I have recently written a NodeJS-based mail system that I hope to eventually open-source. The SMTP daemon (accepting inbound for delivery/relay) and queue processor (handing off messages to remote MTAs for relay messages) both use MongoDB (utilizing Mongoose Schema) to store/queue the messages (emails). All of this is in-place and working. Now, I turn my attention to making the emails accessible to the end user (i.e., webmail, POP3, and/or IMAP). I already have a working POP3+TLS daemon (NodeJS + Mongoose), though it is unlikely that I'll make the POP3 service available to my users. I'm hoping to make use of RoundCube or other open-source webmail clients. IMAP provides the interface between my message store and webmail/user's clients. I've chosen Dovecot (yay!) to provide this interface (as opposed to the nightmare of writing one from scratch) given that it's open source and it's extensibility via plugins. Does the idea of providing a MongoDB-based message store sound like something that can be done sole via plugins - or might this require modification of the actual Dovecot core? Is support for a MongoDB message store interesting to anyone beyond myself? I'd be happy to share my Mongoose schema (as the intent is to open source the entire project once I get it together). I'll also need Dovecot to authenticate against my MongoDB instance. I have a collection, called "mailboxes" that defines the username and password (hashed with ARGON2), among other things. I'm imagining that custom authentication is something that can be achieved via plugins alone? What does everyone think to be simpler/more appropriate: 1. authentication plugin that connects directly to MongoDB, fetches the authen creds, and verifies the password via ARGON2 2. authentication plugin that accesses a NodeJS-express API endpoint that provides a boolean result From my perspective, option (a) makes the most sense. I consider option (b) in case the plugin system doesn't support MongoDB, or doesn't support ARGON2, or .... Can anyone recommend any good docs/howtos on writing Dovecot plugins? Any plugins' whose source might be of interest to me (i.e., custom message store, custom auth, etc)? Thank you for taking the time to consider these questions! I appreciate any responses. I'll make available, or describe further, any aspect of my system if it will help. Regards, TJ Easter II -- "The Information Age offers much to mankind, and I would like to think that we will rise to the challenges it presents. But it is vital to remember that information - in the sense of raw data - is not knowledge; that knowledge is not wisdom; and that wisdom is not foresight. But information is the first essential step to all of these." -- Arthur C. Clarke; 12/2003 Sent with Proton Mail secure email. -----BEGIN PGP SIGNATURE----- Version: ProtonMail wsC5BAEBCgBtBYJo209sCRDKQ0X/3WTf3EUUAAAAAAAcACBzYWx0QG5vdGF0 aW9ucy5vcGVucGdwanMub3JnOD2KL5NSk5rYX75gCW+d8bYmHLJNP8m5nkVy wnHpCHMWIQTQAEbAbK1F7TqiE2jKQ0X/3WTf3AAAChQH/iXWnG3kBM3oQpfe Yd4Hv2TkN/iduzaXfOwWDBcUCP4Dc2YDnYR2W/6OI6hcFLaPw+RvEWe6FMvu aik7s5wypDdQv8bNugO7FkyyooA4UYDLoffRDNIHv+vTXviAmByjywU64Qor hNwajt+vXCuJZY21+vElXhk0Nnea62DrBhRjrVWjxEQAmj9dNSP0HG5woqcX mCYC/PufJLbQatcortFZV5Eiq0OQCfe7C7AEtPjA+isbx2lzqTpMhcmJ87qn 95FwmMoEUuQPoLiUfrzkbBcFECFRi9EZsMhPr4vwuZLlGr49vIyzzqMgI/gX /XJq4cu6mZ1j0Hp+N2zq1iDG55I= =6CWa -----END PGP SIGNATURE-----

1 0

ENV var expansions work mostly in 2.4, but not in some locations
by publists＠emailgroups.net 29 Sep '25

29 Sep '25

Hi, I'm trying to clean up my migrated v2.4 config. I'm still having a hard time with environment variable expansions :-( They work in most places. But so far for me not in mail_plugin_dir ssl_client_* or ssl_server_* listen= For example, this config using literal file paths works great ssl_server { ca_file = /path/to/CA.crt.pem ... } ssl_client { ca_file = /path/to/CA.crt.pem ... } protocol doveadm { ssl_server { ca_file = /path/to/CA.crt.pem ... } ... } protocol imap { ssl_server { ca_file = /path/to/CA.crt.pem ... } ... } protocol lmtp { ssl_server { ca_file = /path/to/CA.crt.pem ... } ... } protocol sieve { ssl_server { ca_file = /path/to/CA.crt.pem ... } ... } protocol submission { ssl_server { ca_file = /path/to/CA.crt.pem ... } ... } When I add an env var import_environment { CA_FILE=/path/to/CA.crt.pem } and change any of those /path/to/CA.crt.pem instances to this %{env:CA_FILE} OR this $ENV:CA_FILE I get errors os startup like dovecot[13660]: doveconf: Fatal: Error in configuration file /etc/dovecot/dovecot.conf: ssl_server_request_client_cert=yes, but ssl_server_ca_file not provided If I go back to literal paths, everything works OK. I've read these https://doc.dovecot.org/main/core/settings/variables.html https://doc.dovecot.org/main/core/settings/syntax.html#environment-variables https://doc.dovecot.org/main/core/settings/types.html#file and as far as I can tell this should work. Something's different about these that I'm not understanding. Or there's a list of keys that can't use these vars in values. How do you use ENV var expansion in ssl file paths, listen addresses, etc? Dave

1 0

Enforce LMTP auth with client certs
by rhi＠pengutronix.de 29 Sep '25

29 Sep '25

Hello, I'm trying to get TLS client cert authentication to work on the LMTP socket via TCP port 24 with Dovecot 2.4. I was already able to get TLS working on the LMTP socket, but if I connect to it via 'openssl s_client' from another machine, and type in a few LMTP commands, Dovecot accepts all mail without requesting a client cert from me. The server running Dovecot is behind a firewall, so LMTP connections should only be possible from the SMTP server in the same local network, not from the whole internet. However I want to guard against possible firewall misconfigs by enforcing client certs between the incoming SMTP server and Dovecot for mail delivery. Is there a way to do this in Dovecot? My /etc/dovecot/conf.d/20-lmtp.conf effectively looks like this: lmtp_save_to_detail_mailbox = yes lmtp_add_received_header = yes protocol lmtp { mail_plugins { sieve = yes } ssl = required ssl_server_ca_file = /etc/lmtp-ca/ca.crt ssl_server_cert_file = /etc/lmtp-ca/local.crt ssl_server_key_file = /etc/lmtp-ca/private/local.key ssl_server_request_client_cert = yes # TODO: this should enforce client certs, but it does not work... auth_ssl_require_client_cert = yes ssl_server_require_crl = no log_debug = category=ssl OR category=auth } … and /etc/dovecot/conf.d/10-master.conf has: service lmtp { #unix_listener lmtp { # mode = 0666 #} inet_listener lmtp { # Accept connections from anywhere, but 20-lmtp.conf configures LMTP to require client certs listen = * :: port = 24 inet_listener_ssl = yes # TODO: this should enforce client certs, but it does not work... auth_ssl_require_client_cert = yes } } I also tried enabling ssl_server_request_client_cert = yes and auth_ssl_require_client_cert = yes globally, but this did not make a difference. I already tried looking at the Dovecot source code, but didn't find anything yet. I'm happy for any pointers in the right direction. Thanks, - Roland

2 2

postfix alias and dovecot quota
by Alexandre Ellert 28 Sep '25

28 Sep '25

Hello, Can someone tell me if it’s possible to configure dovecot to answer quota information about real mailbox when I query a postfix alias mailbox (this information is actually in a mysql database) ? Example : doveadm quota get - u alias(a)domain.com doveadm(alias(a)domain.com): Fatal: User doesn't exist doveadm quota get - u realmailbox(a)domain.com Quota name Type Value Limit % user STORAGE 2048853 2048000 100 user MESSAGE 6783 - 0 I’d like to have this result : doveadm quota get - u alias(a)domain.com Quota name Type Value Limit % user STORAGE 2048853 2048000 100 user MESSAGE 6783 - 0 doveadm quota get - u realmailbox(a)domain.com Quota name Type Value Limit % user STORAGE 2048853 2048000 100 user MESSAGE 6783 - 0 Thanks for your help. Alexandre.

6 9

Dovecot 2.4.1 sieve
by Martin Brampton 28 Sep '25

28 Sep '25

Just upgraded mail server from Debian 12 to 13. Fixed a number of issues with changed Dovecot, but stuck getting sieve working. The server uses LMTP. I’ll post some configuration if it helps. But the messages in the log saying the plugin sieve_lmtpsieve is missing seems fundamental and relevant. I can’t find anything called that in the Debian repository. How is it installed? Or am I doing something fundamentally wrong? Martin Just upgraded mail server from Debian 12 to 13. Fixed a number of issues with changed Dovecot, but stuck getting sieve working. The server uses LMTP. I'll post some configuration if it helps. But the messages in the log saying the plugin sieve_lmtpsieve is missing seems fundamental and relevant. I can't find anything called that in the Debian repository. How is it installed? Or am I doing something fundamentally wrong? Martin

7 21

2.4.1 Config woes
by Anthony Mellor 27 Sep '25

27 Sep '25

Hi, greetings Do sing out please if this is the wrong place or style for this mailing list, please - and there's a community somewhere isn't there? spent days not succeeding with these configs. I'm a new install on Trixie and Dovecot 2.4.1 and going round in many circles with nano /etc/dovecot/dovecot.conf nano /etc/dovecot/conf.d/10-auth.conf nano /etc/dovecot/conf.d/auth-sql.conf.ext nano /etc/dovecot/conf.d/10-master.conf MariaDB having tried one million variations of this, so this is just one, being the latest suggestion # Declare named instances of passdb/userdb using the SQL driver passdb sql { } userdb sql { } # Passdb (authentication) SQL settings passdb_sql_driver = mysql # MariaDB uses "mysql" passdb_sql_host = 127.0.0.1 # or: /run/mysqld/mysqld.sock passdb_sql_port = 3306 passdb_sql_dbname = maildb passdb_sql_user = dovecot passdb_sql_password = CHANGEME # Choose the scheme to match your DB: # - MD5-CRYPT for $1$... hashes or {MD5-CRYPT} prefix # - PLAIN-MD5 for 32-hex unsalted MD5 passdb_sql_default_pass_scheme = MD5-CRYPT passdb_sql_password_query = \ SELECT username AS user, password \ FROM users \ WHERE username = '%u' (thought this is now changed) # Userdb (user lookup) SQL settings userdb_sql_driver = mysql userdb_sql_host = 127.0.0.1 userdb_sql_port = 3306 userdb_sql_dbname = maildb userdb_sql_user = dovecot userdb_sql_password = CHANGEME # Must return at least uid, gid and home or mail userdb_sql_user_query = \ SELECT \ 5000 AS uid, 5000 AS gid, \ home, \ CONCAT('maildir:', maildir) AS mail \ FROM users \ WHERE username = '%u' (thought this is now changed) I have never used Dovecot before this install ten days ago - any example files that work will be forever gratefully appreciated to give me a basic starting point. Very frustratingly at one 3am morning I did get it working and the lost it. a t b Anthony _______________________________________________ dovecot mailing list -- dovecot(a)dovecot.org To unsubscribe send an email to dovecot-leave(a)dovecot.org

1 0