September 2026 - dovecot

[2.4.5] LDAPS Panic: file ldap-utils.c: line 66: unreached
by inaugurator＠ya.ru 07 Sep '26

07 Sep '26

Hello, LDAP in passdb with 389 port works pretty well. But when I change port to 636 and use ldaps:// I get the error: ``` auth: Panic: file ldap-utils.c: line 66: unreached auth: Error: Raw backtrace: #0 default_fatal_finish[0x7a7e387b9ef4] -> #1 fatal_handler_real[0x7a7e387b9fb2] -> #2 i_internal_fatal_handler[0x7a7e387bb36d] -> #3 i_panic[0x7a7e387ba1ec] -> #4 i_unreached[0x7a7e387bb867] -> #5 ldap_set_opt_str[0x7a7e3763ad84] -> #6 ldap_set_tls_options[0x7a7e3763af3d] -> #7 ldap_set_options[0x7a7e3763200d] -> #8 db_ldap_init_ld[0x7a7e3763230f] -> #9 db_ldap_init[0x7a7e37633efb] -> #10 passdb_ldap_preinit[0x7a7e37635d22] -> #11 passdb_preinit[0x55cc948e7eb9] -> #12 auth_passdb_preinit[0x55cc948c0193] -> #13 auth_preinit[0x55cc948c0a87] -> #14 auths_preinit[0x55cc948c16de] -> #15 main_preinit[0x55cc948bf3e2] -> #16 main[0x55cc948bfae2] -> #17 __libc_init_first[0x7a7e383671d0] -> #18 __libc_start_main[0x7a7e38367280] -> #19 _start[0x55cc948bee20] master: Error: service(auth): command startup failed, throttling for 16.000 secs auth: Fatal: master: service(auth): child 344291 killed with signal 6 (core dumps disabled - https://dovecot.org/bugreport.html#coredumps) ```

1 0

Help with sieve
by Jorge Bastos 07 Sep '26

07 Sep '26

Hi guys, Small help with a sieve script, I have the script below in a useraccount, in this exact order. The redirect works, but the discard doesn't. A message that comes from the domain "clubefashing.com" or "nutribody.pt", is always redirected. Any idea what is wrong here? # rule:[blocks] if anyof (header :contains "from" "clubefashion.com", header :contains "from" "nutribody.pt") { discard; } # rule:[redir] if true { redirect "jorge(a)decimal.pt"; } Hi guys, Small help with a sieve script, I have the script below in a useraccount, in this exact order. The redirect works, but the discard doesn't. A message that comes from the domain "clubefashing.com" or "nutribody.pt", is always redirected. Any idea what is wrong here? # rule:[blocks] if anyof (header :contains "from" "clubefashion.com", header :contains "from" "nutribody.pt") { discard; } # rule:[redir] if true { redirect "jorge(a)decimal.pt"; }

4 6

Process destroy
by Christian H. Kuhn 06 Sep '26

06 Sep '26

Hi all, i have a user who cannot log in anymore with thunderbird. The problem arose after my updating to ubuntu 26.04. It is only that one user with his three accounts who has the problem. If i read the log right, he uses the correct credentials and could log in, if there wasn't a read problem with /proc/self/io and ad Process destroy. Here are the relevant data: root@bywater ~ # lsb_release -a No LSB modules are available. Distributor ID: Ubuntu Description: Ubuntu 26.04.1 LTS Release: 26.04 Codename: resolute root@bywater ~ # dovecot --version 2.4.2 (0962ed2104) /var/log/dovecot/dovecot.debug: 2026-09-06T08:51:08.583060+02:00 bywater dovecot: auth(user@sglasker.de,2a00:fbc:ec47:a4b1:c484:16a7:366c:c4a8,sasl:plain)<G6 Ad7cpaOMIqAA+87EekscSEFqc2bMSo>: Debug: sasl(plain): Set authid 'user(a)sglasker.de' 2026-09-06T08:51:08.583084+02:00 bywater dovecot: auth(user@sglasker.de,2a00:fbc:ec47:a4b1:c484:16a7:366c:c4a8,sasl:plain)<G6 Ad7cpaOMIqAA+87EekscSEFqc2bMSo>: Debug: sasl(plain): Performing plain passdb verification 2026-09-06T08:51:08.583108+02:00 bywater dovecot: auth(user@sglasker.de,2a00:fbc:ec47:a4b1:c484:16a7:366c:c4a8,sasl:plain)<G6 Ad7cpaOMIqAA+87EekscSEFqc2bMSo>: Debug: sql: Performing passdb lookup 2026-09-06T08:51:08.583178+02:00 bywater dovecot: auth-worker(user@sglasker.de,2a00:fbc:ec47:a4b1:c484:16a7:366c:c4a8)<339340><G6Ad7cpaOMIqAA+87EekscSEFqc2bMSo>: request [11]: Debug: sql: Performing passdb lookup 2026-09-06T08:51:08.583210+02:00 bywater dovecot: auth-worker(user@sglasker.de,2a00:fbc:ec47:a4b1:c484:16a7:366c:c4a8)<339340><G6Ad7cpaOMIqAA+87EekscSEFqc2bMSo>: request [11]: Debug: sql: query: SELECT email AS user, password FROM user WHERE email = 'user(a)sglasker.de' 2026-09-06T08:51:08.583374+02:00 bywater dovecot: auth-worker: Debug: mysql(127.0.0.1): Finished query 'SELECT email AS user, password FROM user WHERE email = 'user(a)sglasker.de'' in 0 msecs 2026-09-06T08:51:08.585565+02:00 bywater dovecot: auth-worker(user@sglasker.de,2a00:fbc:ec47:a4b1:c484:16a7:366c:c4a8)<339340><G6Ad7cpaOMIqAA+87EekscSEFqc2bMSo>: request [11]: Debug: sql: Finished passdb lookup 2026-09-06T08:51:08.585652+02:00 bywater dovecot: auth(user@sglasker.de,2a00:fbc:ec47:a4b1:c484:16a7:366c:c4a8,sasl:plain)<G6Ad7cpaOMIqAA+87EekscSEFqc2bMSo>: Debug: sql: Finished passdb lookup 2026-09-06T08:51:08.585677+02:00 bywater dovecot: auth(user@sglasker.de,2a00:fbc:ec47:a4b1:c484:16a7:366c:c4a8,sasl:plain)<G6Ad7cpaOMIqAA+87EekscSEFqc2bMSo>: Debug: sasl(plain): Finished plain passdb verification (status=ok) 2026-09-06T08:51:08.585704+02:00 bywater dovecot: auth(user@sglasker.de,2a00:fbc:ec47:a4b1:c484:16a7:366c:c4a8,sasl:plain)<G6Ad7cpaOMIqAA+87EekscSEFqc2bMSo>: Debug: sasl(plain): Interaction succeeded 2026-09-06T08:51:08.585738+02:00 bywater dovecot: auth(user@sglasker.de,2a00:fbc:ec47:a4b1:c484:16a7:366c:c4a8,sasl:plain)<G6Ad7cpaOMIqAA+87EekscSEFqc2bMSo>: Debug: Auth request finished 2026-09-06T08:51:08.585769+02:00 bywater dovecot: auth: Debug: conn unix:login (pid=339464,uid=111) [501]: client passdb out: OK#0111#011user=user(a)sglasker.de 2026-09-06T08:51:08.591149+02:00 bywater dovecot: auth(user@sglasker.de,2a00:fbc:ec47:a4b1:c484:16a7:366c:c4a8,sasl:plain)<G6Ad7cpaOMIqAA+87EekscSEFqc2bMSo>: Debug: static: Performing userdb lookup 2026-09-06T08:51:08.591186+02:00 bywater dovecot: auth(user@sglasker.de,2a00:fbc:ec47:a4b1:c484:16a7:366c:c4a8,sasl:plain)<G6Ad7cpaOMIqAA+87EekscSEFqc2bMSo>: Debug: static: Finished userdb lookup 2026-09-06T08:51:08.591209+02:00 bywater dovecot: auth: Debug: master userdb out: USER#011622723073#011user@sglasker.de#011uid=5000#011gid=5000#011home=/var/mail/vhosts/sglasker.de/user#011auth_mech=PLAIN#011auth_token=581264423b972f752ffa367319e23d10630ec484#011local_name=IMAP.qno.de 2026-09-06T08:51:08.591236+02:00 bywater dovecot: auth(user@sglasker.de,2a00:fbc:ec47:a4b1:c484:16a7:366c:c4a8)<G6Ad7cpaOMIqAA+87EekscSEFqc2bMSo>: Debug: sasl(plain): Request destroy 2026-09-06T08:51:08.591513+02:00 bywater dovecot: imap(user(a)sglasker.de)<339465><G6Ad7cpaOMIqAA+87EekscSEFqc2bMSo>: Debug: Effective uid=5000, gid=5000, home=/var/mail/vhosts/sglasker.de/user 2026-09-06T08:51:08.591603+02:00 bywater dovecot: imap(user(a)sglasker.de)<339465><G6Ad7cpaOMIqAA+87EekscSEFqc2bMSo>: Debug: open(/proc/self/io) failed: Permission denied (euid=5000(vmail) egid=5000(vmail) missing +r perm: /proc/self/io) 2026-09-06T08:51:08.591811+02:00 bywater dovecot: imap(user(a)sglasker.de)<339465><G6Ad7cpaOMIqAA+87EekscSEFqc2bMSo>: Debug: Namespace inbox: type=private, prefix=, sep=, inbox=yes, hidden=no, list=yes, subscriptions=yes 2026-09-06T08:51:08.591868+02:00 bywater dovecot: imap(user(a)sglasker.de)<339465><G6Ad7cpaOMIqAA+87EekscSEFqc2bMSo>: Debug: maildir++: root=/var/mail/vhosts/sglasker.de/user/Maildir, index=, indexpvt=, control=, inbox=/var/mail/vhosts/sglasker.de/user/Maildir, alt= 2026-09-06T08:51:08.981986+02:00 bywater dovecot: imap(user(a)sglasker.de)<339465><G6Ad7cpaOMIqAA+87EekscSEFqc2bMSo>: Debug: Mailbox INBOX: Mailbox opened Any hints? TIA QNo

1 0

Process destroy
by Christian H. Kuhn 06 Sep '26

06 Sep '26

Hi all, i have a user who cannot log in anymore with thunderbird. The problem arose after my updating to ubuntu 26.04. It is only that one user with his three accounts who has the problem. If i read the log right, he uses the correct credentials and could log in, if there wasn't a read problem with /proc/self/io and ad Process destroy. Here are the relevant data: root@bywater ~ # lsb_release -a No LSB modules are available. Distributor ID: Ubuntu Description: Ubuntu 26.04.1 LTS Release: 26.04 Codename: resolute root@bywater ~ # dovecot --version 2.4.2 (0962ed2104) /var/log/dovecot/dovecot.debug: 2026-09-06T08:51:08.583060+02:00 bywater dovecot: auth(user@sglasker.de,2a00:fbc:ec47:a4b1:c484:16a7:366c:c4a8,sasl:plain)<G6 Ad7cpaOMIqAA+87EekscSEFqc2bMSo>: Debug: sasl(plain): Set authid 'user(a)sglasker.de' 2026-09-06T08:51:08.583084+02:00 bywater dovecot: auth(user@sglasker.de,2a00:fbc:ec47:a4b1:c484:16a7:366c:c4a8,sasl:plain)<G6 Ad7cpaOMIqAA+87EekscSEFqc2bMSo>: Debug: sasl(plain): Performing plain passdb verification 2026-09-06T08:51:08.583108+02:00 bywater dovecot: auth(user@sglasker.de,2a00:fbc:ec47:a4b1:c484:16a7:366c:c4a8,sasl:plain)<G6 Ad7cpaOMIqAA+87EekscSEFqc2bMSo>: Debug: sql: Performing passdb lookup 2026-09-06T08:51:08.583178+02:00 bywater dovecot: auth-worker(user@sglasker.de,2a00:fbc:ec47:a4b1:c484:16a7:366c:c4a8)<339340><G6Ad7cpaOMIqAA+87EekscSEFqc2bMSo>: request [11]: Debug: sql: Performing passdb lookup 2026-09-06T08:51:08.583210+02:00 bywater dovecot: auth-worker(user@sglasker.de,2a00:fbc:ec47:a4b1:c484:16a7:366c:c4a8)<339340><G6Ad7cpaOMIqAA+87EekscSEFqc2bMSo>: request [11]: Debug: sql: query: SELECT email AS user, password FROM user WHERE email = 'user(a)sglasker.de' 2026-09-06T08:51:08.583374+02:00 bywater dovecot: auth-worker: Debug: mysql(127.0.0.1): Finished query 'SELECT email AS user, password FROM user WHERE email = 'user(a)sglasker.de'' in 0 msecs 2026-09-06T08:51:08.585565+02:00 bywater dovecot: auth-worker(user@sglasker.de,2a00:fbc:ec47:a4b1:c484:16a7:366c:c4a8)<339340><G6Ad7cpaOMIqAA+87EekscSEFqc2bMSo>: request [11]: Debug: sql: Finished passdb lookup 2026-09-06T08:51:08.585652+02:00 bywater dovecot: auth(user@sglasker.de,2a00:fbc:ec47:a4b1:c484:16a7:366c:c4a8,sasl:plain)<G6Ad7cpaOMIqAA+87EekscSEFqc2bMSo>: Debug: sql: Finished passdb lookup 2026-09-06T08:51:08.585677+02:00 bywater dovecot: auth(user@sglasker.de,2a00:fbc:ec47:a4b1:c484:16a7:366c:c4a8,sasl:plain)<G6Ad7cpaOMIqAA+87EekscSEFqc2bMSo>: Debug: sasl(plain): Finished plain passdb verification (status=ok) 2026-09-06T08:51:08.585704+02:00 bywater dovecot: auth(user@sglasker.de,2a00:fbc:ec47:a4b1:c484:16a7:366c:c4a8,sasl:plain)<G6Ad7cpaOMIqAA+87EekscSEFqc2bMSo>: Debug: sasl(plain): Interaction succeeded 2026-09-06T08:51:08.585738+02:00 bywater dovecot: auth(user@sglasker.de,2a00:fbc:ec47:a4b1:c484:16a7:366c:c4a8,sasl:plain)<G6Ad7cpaOMIqAA+87EekscSEFqc2bMSo>: Debug: Auth request finished 2026-09-06T08:51:08.585769+02:00 bywater dovecot: auth: Debug: conn unix:login (pid=339464,uid=111) [501]: client passdb out: OK#0111#011user=user(a)sglasker.de 2026-09-06T08:51:08.591149+02:00 bywater dovecot: auth(user@sglasker.de,2a00:fbc:ec47:a4b1:c484:16a7:366c:c4a8,sasl:plain)<G6Ad7cpaOMIqAA+87EekscSEFqc2bMSo>: Debug: static: Performing userdb lookup 2026-09-06T08:51:08.591186+02:00 bywater dovecot: auth(user@sglasker.de,2a00:fbc:ec47:a4b1:c484:16a7:366c:c4a8,sasl:plain)<G6Ad7cpaOMIqAA+87EekscSEFqc2bMSo>: Debug: static: Finished userdb lookup 2026-09-06T08:51:08.591209+02:00 bywater dovecot: auth: Debug: master userdb out: USER#011622723073#011user@sglasker.de#011uid=5000#011gid=5000#011home=/var/mail/vhosts/sglasker.de/user#011auth_mech=PLAIN#011auth_token=581264423b972f752ffa367319e23d10630ec484#011local_name=IMAP.qno.de 2026-09-06T08:51:08.591236+02:00 bywater dovecot: auth(user@sglasker.de,2a00:fbc:ec47:a4b1:c484:16a7:366c:c4a8)<G6Ad7cpaOMIqAA+87EekscSEFqc2bMSo>: Debug: sasl(plain): Request destroy 2026-09-06T08:51:08.591513+02:00 bywater dovecot: imap(user(a)sglasker.de)<339465><G6Ad7cpaOMIqAA+87EekscSEFqc2bMSo>: Debug: Effective uid=5000, gid=5000, home=/var/mail/vhosts/sglasker.de/user 2026-09-06T08:51:08.591603+02:00 bywater dovecot: imap(user(a)sglasker.de)<339465><G6Ad7cpaOMIqAA+87EekscSEFqc2bMSo>: Debug: open(/proc/self/io) failed: Permission denied (euid=5000(vmail) egid=5000(vmail) missing +r perm: /proc/self/io) 2026-09-06T08:51:08.591811+02:00 bywater dovecot: imap(user(a)sglasker.de)<339465><G6Ad7cpaOMIqAA+87EekscSEFqc2bMSo>: Debug: Namespace inbox: type=private, prefix=, sep=, inbox=yes, hidden=no, list=yes, subscriptions=yes 2026-09-06T08:51:08.591868+02:00 bywater dovecot: imap(user(a)sglasker.de)<339465><G6Ad7cpaOMIqAA+87EekscSEFqc2bMSo>: Debug: maildir++: root=/var/mail/vhosts/sglasker.de/user/Maildir, index=, indexpvt=, control=, inbox=/var/mail/vhosts/sglasker.de/user/Maildir, alt= 2026-09-06T08:51:08.981986+02:00 bywater dovecot: imap(user(a)sglasker.de)<339465><G6Ad7cpaOMIqAA+87EekscSEFqc2bMSo>: Debug: Mailbox INBOX: Mailbox opened Any hints? TIA QNo

1 0

History Assignment Writing Help – Expert Assistance
by Theo Wilson 05 Sep '26

05 Sep '26

Struggling with your history assignments? Our History Assignment Writing Help service offers expert guidance to help you craft well-researched, structured, and original assignments. Fill out this form to get personalized support from experienced writers and improve your grades with ease. https://www.newassignmenthelp.co.uk/history-assignment-help

2 1

Pay Someone to Take My Online Course?
by xotawa2329＠hapincy.com 05 Sep '26

05 Sep '26

Pay Someone to Take My Online Course? Different understudies who battle with reworking school, work, and family obligations select online class tutors to assist them with finishing their tests and complete their coursework. In any case, some solicitation the ethicality of this planning. While <a href="https://onlineclassservices.com/nurs-fpx-4040-assessment-4-attempt-1-inform…">NURS FPX 4040 Assessment 4</a>  has every one of the reserves of being enticing, it goes with two or three serious dangers. This article will examine a piece of the things you ought to remember going before enlisting an online class help association. It's clearly a fact that online classes can be truly troublesome, particularly for working professionals who have a clamoring plan. Oftentimes they are searching for someone to take a whole course or individual tasks for them, to assist with managing their grades and moderate their strain. Nonetheless, be wary of affiliations that guarantee too wonderful to be authentic. They could charge you enormous totals for their associations and end up not conveying. The best technique for guaranteeing that you are getting anything that would be fair is to use an online class tutor who offers an inadequate responsibility. Additionally, review that different schools consider paying someone to take an online class to swindle. Therefore, whenever got, you could go facing silly outcomes like besieging the course, scholarly suspension or even send off. To this end picking a fair relationship with a showed history is crucial. The association is clear: present your mentioning and survey offers from qualified educated authorities. Then enlist the one that is reasonable for yourself and store maintains in <a href="https://onlineclassservices.com/nurs-fpx-4050-assessment-1-attempt-3-prelim…">NURS FPX 4050 Assessment 1</a>  scrow until your assignment is finished. Online classes are eminent among understudies who need to save time on education and spotlight more on work or other private issues. These merge understudies who are taking courses while working and attempting to change family and profession responsibilities, military understudies on sending, and understudies with genuine inadequacies or sickness that make it pursuing for them to go to classes. Unfortunately, there are many tricks that confirmation to take online courses for you. These affiliations charge ridiculous totals and don't complete their obligations. They may also hand you over to your school. Tolerating that they do, you could be killed from your underwriting project or even suspended or removed from school. This isn't the very thing that you truly need for your business and future. Therefore, you genuinely need to track down serious areas of strength for a that offers a fair cost and mind blowing results. To this end you ought to search for a <a href="https://onlineclassservices.com/nurs-fpx-4050-assessment-2-attempt-1-ethica…">NURS FPX 4050 Assessment 2</a>  affiliation that has an inadequate responsibility and splendid customer association. Various individuals decide to use a professional to take their online class since they need the opportunity to go to it very close. They could be working the whole day, supervising family issues, or fighting disease and disappointments that log jam their review tendencies. These professionals can assist you with fulfilling time necessities, stay away from imaginative theft, and set free your nights to zero in on work or other unwinding works out. They may comparatively have the decision to help you with beating any learning handicaps you have. Copyright infringement suggests utilizing someone else's words and thoughts without their endorsement. It is viewed as a kind of cheating and can accomplish a delicate grade or even send off from school. It is difficult to ensure that a used professional won't phony. This is on the grounds that educational foundations don't have <a href="https://onlineclassservices.com/nurs-fpx-4900-assessment-1-assessing-the-pr…">NURS FPX 4900 Assessment 1 Assessing the Problem</a>  assets for check whether understudies are authentic or not. This truly expects that tolerant you are gotten, you will probably lose the cash you paid to have someone take your class. There's no veritable strategy for remaining caution assuming the solitary you enroll to take your online course will tell the truth and dependable. They probably won't be in a tantamount state as you. Moreover, they apparently won't be as dedicated to finishing the class for you as you are. They may very well be doing the base extent of work expected to get reviewed and a brief time frame later vanish. MORE <a href="https://dev.gajim.org/gajim/website/-/issues/35#note_211778">Facebook is a powerful tool for business</a> <a href="https://xtremepape.rs/members/horridhenry7860.397211/about">Mobile Application Development Services</a> <a href="https://xtremepape.rs/members/samfarrid4563.397213/about">best digital marketing agencies</a>

6 6

Lazy-Expunge plugin documentation incomplete?
by Randolf Richardson 04 Sep '26

04 Sep '26

One of the Dovecot repository maintainers on GitHub recommended sending an eMail to you regarding the issue I encountered: Documentation for lazy-expunge doesn't work https://github.com/dovecot/documentation/issues/1555 -------- I converted from Dovecot 2.3 to Dovecot 2.4.1, which was not a minor upgrade. Anyway, I can't get the lazy-expunge plugin to work in 2.4.1 now. Here's my configuration file from 2.3 -- how can I get this working in 2.4.1? Thanks. namespace inbox { mailbox EXPUNGED { autoexpunge = 32days autoexpunge_max_mails = 100000 #auto = create } } # Namespace for lazy_expunge plugin namespace { prefix = EXPUNGED/ hidden = yes list = no subscriptions = no separator = / location = maildir:~/Maildir.deleted:INDEX= } mail_plugins = $mail_plugins lazy_expunge acl plugin { # Move expunged messages into the .EXPUNGED namespace lazy_expunge = EXPUNGED/ # Only move to expunged storage if this is the last copy of the message in the user´s account lazy_expunge_only_last_instance = yes # Exclude Drafts from lazy expunging lazy_expunge_exclude = \Drafts # Copy of each message is done with hard links whenever possible maildir_copy_with_hardlinks = yes # Define ACL so that user cannot list the .EXPUNGED mailbox # Example entry: .EXPUNGED owner rwstipekxa acl = vfile:/etc/dovecot/dovecot.acl # dovecot.acl contains one line: EXPUNGED owner ip # Expunged messages most likely don't want to be included in quota: quota_rule = EXPUNGED:ignore } #lazy_expunge_mailbox = EXPUNGED Here's an example of someone else who encountered the same problem: https://www.dovecot.org/mailman3/archives/list/dovecot@dovecot.org/thr ead/25BXSHQWGQQ3ACVZSYF3O3LC4WROTUCI/ Randolf Richardson, CNA - randolf(a)inter-corporate.com Inter-Corporate Computer & Network Services, Inc. Beautiful British Columbia, Canada https://www.inter-corporate.com/

2 4

Config parser bug?
by Pat Suwalski 03 Sep '26

03 Sep '26

Hello, I recently upgraded my servers from Debian Bullseye to Trixie (2.3 -> 2.4). I have a pretty basic config, though I use Maildir instead of Debian's default of mbox. In the process of getting things working correctly for the new config format, I believe I have stumbled on a bug. To make the inbox work correctly, I need the mail_inbox_path variable to be unset. This is because the default shipped 10-mail.conf file from Debian has: mail_driver = mbox mail_home = /home/%{user | username} mail_path = %{home}/mail mail_inbox_path = /var/mail/%{user} So, I overrode the mail_driver and mail_path in my local.conf. From the documentation, it seems like I should be able to set: mail_inbox_path = And that should clear it. Certainly, doveconf shows no mail_inbox_path variable set when that happens. However, no inbox! If I comment out mail_inbox_path from 10-mail.conf, doveconf output is identical, however the inbox works. My workaround is to make it the same as mail_path: mail_inbox_path = ~/Maildir However, I think the variable unsetting is buggy. This is dovecot 2.4.1. --Pat

3 10

discussion about "Remove doveadm_allowed_commands setting"
by Patrick Cernko 03 Sep '26

03 Sep '26

Hi Timo, hi list, I saw this commit (https://github.com/dovecot/core/commit/2b0947986ccb72e2f5ce13f8bd4b300e94e3…) on Dovecot's github repo: > doveadm: Remove doveadm_allowed_commands setting > The setting only compared the first command name against a list, which > gave a false sense of security. Anyone who is allowed to connect to the > doveadm server can already do practically anything with the commands > that were typically allowed: most commands take a -u/-A user parameter, > and commands like sync, backup and import take parameters that access > arbitrary paths. Restricting the command name doesn't change that, so > doveadm access must be given only to trusted clients regardless. I tried to understand the detailed reasoning but I don't get it. As far as I can follow the code not only the *first command name* is checked but every command send (in the list of commands via HTTP API). From our point of view, this setting has a clear security benefit like this: > # security: we only allow specific doveadm commands via doveadm-server and some more when coming from localhost > doveadm_allowed_commands = user,who > local 127.0.0.1/8 { > doveadm_allowed_commands = user,who,"sieve list","sieve get","sieve put","sieve activate" > } It limits the allowed commands in general to who and user which are read-only. Only if the connection is comming from localhost, we additionally grant some sieve commands for our web interface to manage and test sieve rulesets (https://gitlab.mpi-klsb.mpg.de/pcernko/sieveweb) All other commands are not allowed at all, e.g. it is not possible to delete mails or use dsync via the HTTP API. This policy matches our general security policy to only grant what's needed. So, Timo, I would like to ask, why this setting has to get removed (I assume in the next release) or if it can be restored again in the main branch? Is there anyone else using this setting besides me? What do the other users think about the removal of the setting? Best regards, -- Patrick Cernko <pcernko(a)mpi-klsb.mpg.de> +49 681 9325 5815 Joint Scientific IT and Technical Service Max-Planck-Institute für Informatik & Softwaresysteme

2 1

Minor freebsd issue on dovecot 2.4.5
by Lucas Holt 02 Sep '26

02 Sep '26

On FreeBSD and MidnightBSD, Dovecot's net_getunixcred() relies on getpeereid(), which lacks PID info, causing every imap-login connection to register with anvil as pid=-1 and collide in its per-process hash. Here's an example fix for the problem. Note this was AI generated with claude fable and I don't know what your AI policy is. --- src/lib/net.c.orig 2026-08-28 00:00:00 UTC +++ src/lib/net.c @@ -9,6 +9,9 @@ #include <fcntl.h> #include <ctype.h> #include <sys/un.h> +#ifdef __FreeBSD__ +# include <sys/ucred.h> +#endif #include <netinet/tcp.h> #if defined(HAVE_UCRED_H) # include <ucred.h> /* for getpeerucred() */ @@ -832,6 +835,26 @@ cred_r->gid = ucred.unp_egid; cred_r->pid = ucred.unp_pid; return 0; +#elif defined(LOCAL_PEERCRED) && defined(__FreeBSD__) && __FreeBSD__ >= 13 + /* FreeBSD 13+ / MidnightBSD 4+ (getpeereid() exists too, but struct + xucred also carries the peer pid, which anvil needs) */ + struct xucred ucred; + socklen_t len = sizeof(ucred); + + if (getsockopt(fd, 0, LOCAL_PEERCRED, &ucred, &len) < 0) { + i_error("getsockopt(LOCAL_PEERCRED) failed: %m"); + return -1; + } + + if (ucred.cr_version != XUCRED_VERSION) { + errno = EINVAL; + return -1; + } + + cred_r->uid = ucred.cr_uid; + cred_r->gid = ucred.cr_gid; + cred_r->pid = ucred.cr_pid; + return 0; #elif defined(HAVE_GETPEEREID) /* OSX 10.4+, FreeBSD 4.6+, OpenBSD 3.0+, NetBSD 5.0+ */ if (getpeereid(fd, &cred_r->uid, &cred_r->gid) < 0) {

4 8