- dovecot - dovecot.org

Preventing Plain Auth
by Steve Litt 06 Mar '26

06 Mar '26

Hi all, https://doc.dovecot.org/2.4.2/core/summaries/settings.html , the auth_allow_cleartext section, says "If no, disables the LOGIN command and all other cleartext authentication unless SSL/TLS is used (LOGINDISABLED capability) or the connection is secured (see ssl). See SSL configuration for more detailed explanation of how this setting interacts with the ssl setting. This setting replaces the disable_plaintext_auth setting." I put auth_allow_cleartext = no in my 2.4.2 dovecot.conf, but my Claws-Mail client can still access it, even though there are no key files. I tried putting this setting in several different places: Didn't prevent plain access. I tried switching from 127.0.0.1 to 10.0.2.15, same problem. The following is the output of my dovecot -n command: ========================================= # 2.4.2 (0962ed2104): /etc/dovecot/dovecot.conf # OS: Linux 6.12.74_1 x86_64 # Hostname: dovecotvoid dovecot_config_version = 2.4.2 dovecot_storage_version = 2.4.2 listen = 10.0.2.15 log_path = /var/log/dovecot.log mail_driver = maildir mail_gid = vmail mail_home = /home/slitt mail_path = ~/mail/Maildir mail_uid = vmail protocols { imap = yes lmtp = no pop3 = no } service imap { inet_listener imap-login { auth_allow_cleartext = no } } namespace inbox { inbox = yes separator = / } passdb pam { driver = pam } userdb passwd { driver = passwd } ========================================= How do I disable plain text authentication? Thanks, SteveT Steve Litt http://444domains.com

1 0

Executing a sieve-extprograms pipe script as non-root
by Roland Hieber 05 Mar '26

05 Mar '26

Hi, Ultimately I'm trying to call procmail via a `pipe "procmail";` in my Sieve script on Dovecot 2.4.1. I have therefore created the respective wrapper script in /usr/lib/dovecot/sieve-pipe/procmail, but I noted that the script is apparently run as root. With some debug output in the wrapper script, I see: # `id` output uid=0(root) gid=1059(rhi) groups=1059(rhi),116(dovecot) # `pstree -s -u $$` systemd(1)---dovecot(1064)---lmtp(266577,rhi)---procmail(266706,root)---pstree(266711) This Dovecot gets mail delivered via LMTP from another server. 1059 (rhi) is my local user ID on the IMAP server both in /etc/passwd and in /etc/dovecot/users (using auth-passwdfile.conf.ext in 10-auth.conf instead of auth-system.conf.ext), since mail needs to be delivered and chown'ed correctly into Maildirs that should be user-accessible. However I don't understand how the `procmail` wrapper can be run as the root user rights when the LMTP process starting it is running as my own user?!? I'd like to prevent procmail from running as root as far as possible, so for now I've been able to work around this by wrapping the procmail call into an additional `sudo -U $USER` (after determining the user who owns the target maildir), but I'd like to understand the problem a bit further and like to know if this is really how calling sieve-extprograms is supposed to work – I'd have expected that the external scripts are also run as my unprivileged user. I'm running a fairly standard config on Debian stable (dovecot package version 1:2.4.1+dfsg1-6+deb13u2) with only minimal changes by enabling the passwdfile backend and some sieve plugins. Thanks for any insights, - Roland -- Roland Hieber, Pengutronix e.K. | rhi(a)pengutronix.de | Steuerwalder Str. 21 | https://www.pengutronix.de/ | 31137 Hildesheim, Germany | Phone: +49-5121-206917-0 | Amtsgericht Hildesheim, HRA 2686 | Fax: +49-5121-206917-5555 |

4 5

Sync'ing two dovecot servers
by Marc Singer 04 Mar '26

04 Mar '26

Greetings, I was pleased to see that dovecot has a sync function in doveadm. So far, other tools for moving mailbox contents from one server to another has not been successful. However. Perhaps I don't understand how this should work. I have a new containerized dovecot v2.4.2 # 2.4.2 (0962ed2104): /etc/dovecot/dovecot.conf # OS: Linux 6.12.63+deb13-amd64 x86_64 and I have an existing dovecot running in a VPS: # 2.3.19.1 (9b53102964): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.19 (4eae2f79) # OS: Linux 6.1.0-35-amd64 x86_64 Debian 12.11 I want to move one user, as a test. I execute this in the container. # doveadm sync -R1 -u USER tcps:OLD_SERVER:993 doveadm(USER): Error: conn OLD_SERVER:993 (IP:993): doveadm server sent invalid handshake: * OK [CAPABILITY IMAP4rev1 SASL-IR LOGIN-REFERRALS ID ENABLE IDLE LITERAL+ AUTH=PLAIN AUTH=LOGIN] Dovecot (Debian) ready. doveadm(USER): Error: cmd sync: Disconnected from remote: Connection closed I'm pretty sure that doveadm sync was able to negotiate the TLS connection. I don't see what it could object to in the sign-on. What am I missing? Cheers -- /Marc Oscar Singer/ *Woollysoft* Dial 817.1823.602.1+ from right to left. Greetings, I was pleased to see that dovecot has a sync function in doveadm. So far, other tools for moving mailbox contents from one server to another has not been successful. However. Perhaps I don't understand how this should work. I have a new containerized dovecot v2.4.2 # 2.4.2 (0962ed2104): /etc/dovecot/dovecot.conf # OS: Linux 6.12.63+deb13-amd64 x86_64 and I have an existing dovecot running in a VPS: # 2.3.19.1 (9b53102964): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.19 (4eae2f79) # OS: Linux 6.1.0-35-amd64 x86_64 Debian 12.11 I want to move one user, as a test. I execute this in the container. # doveadm sync -R1 -u USER tcps:OLD_SERVER:993 doveadm(USER): Error: conn OLD_SERVER:993 (IP:993): doveadm server sent invalid handshake: * OK [CAPABILITY IMAP4rev1 SASL-IR LOGIN-REFERRALS ID ENABLE IDLE LITERAL+ AUTH=PLAIN AUTH=LOGIN] Dovecot (Debian) ready. doveadm(USER): Error: cmd sync: Disconnected from remote: Connection closed I'm pretty sure that doveadm sync was able to negotiate the TLS connection. I don't see what it could object to in the sign-on. What am I missing? Cheers -- Marc Oscar Singer Woollysoft Dial 817.1823.602.1+ from right to left.

3 4

Getting quota limits from DB
by Alberto 04 Mar '26

04 Mar '26

Hi group: I have a Docker Dovecot 2.4.2 installation with MySQL user management, with this record: SELECT * FROM users; +---------------------------------------------------------------------------- | username | domain | password | home | uid | gid | active | quota | quotamsgs | crampassword +---------------------------------------------------------------------------- | alberto | bersol.info | {MD5-CRYPT}$1$Jm... | /var/mail/alberto | 1000 | 1000 | Y | 3221225472 | 149999 | {CRAM-MD5}fd246... | +---------------------------------------------------------------------------- But I have a problem with user quota definitions... If I run "doveadm" command, I get the user quota occupation, I have "quota_clone" plugin working, but I don't get user quota limit, I don't know why: ----- # docker exec -it midovecot doveadm quota get -A Username Quota name Type Value Limit % alberto(a)bersol.info User quota STORAGE 1925805 3145728 61 alberto(a)bersol.info User quota MESSAGE 37608 100000 37 ----- That limit isn't the correct limit set in DB, but the one is put in the config, and it must to be override in my userdb:Extra Fields. ----- # # docker exec -it midovecot doveadm config # 2.4.2 (0962ed2104): /etc/dovecot/dovecot.conf ... userdb sql { iterate_query = SELECT CONCAT(username,'@',domain) AS user FROM users query = SELECT home,CONCAT(username,'@',domain) AS username,crampassword AS password,uid AS userdb_uid,gid AS userdb_gid,CONCAT(quota,'B') AS userdb_quota_storage_size,concat('*:messages=',quotamsgs) AS userdb_quota_storage_size FROM users WHERE username = '%{ user | username | lower }' AND domain = '%{ user | domain | lower }' } ... quota_storage_size = 3G quota_message_count = 100000 ... ----- Do you have any idea of the problem? Best Regards, Alberto

2 3

Dovecot marking outgonig emails as unread
by stef204 03 Mar '26

03 Mar '26

Starting a few days ago, I have one email account where ALL outgoing emails are automatically marked as UNREAD. The message is sent, then copied to the "Sent" folder, and has status "unread". Then, a couple of minutes later, something happens where this message gets marked as UNREAD, without ANY interaction of client side. This occurs not matter the email client used, I have tried it with multiple email clients, both local and via web interface, the behavior does not change. This is via Dovevot on Cpanel. if I look at the [1]changelog, it is difficult to identify which changes could have triggered this as there seem to be changes impacting Dovecot almost with every update. I do not control the server myself, this is on a shared hosting plan; tech support has been willing to troubleshoot but is unable to locate the problem. This problem does NOT occur on other email accounts on the same domain, so it looks to me like some corruption or problem syncing flags perhaps? I am at a loss at the moment to fix this behavior. Any suggestions or ideas welcome. Thanks. References Visible links 1. https://docs.cpanel.net/changelogs/132-change-log/

3 5

[Pigeonhole] extracttext on "message/rfc822" attachment ignores included headers
by quentinduchemin＠tuta.io 03 Mar '26

03 Mar '26

Hi everyone! I'm not sure this is a design decision, a bug, something not implemented or malformed input on my side. My use case is the following: users that forward their mails outside the domain I manage have the option to report spam as attachment so the spam classifier can learn anyway. I prefer attachment over forward because MUAs have their own way to do it and it's difficult to reliably reconstruct some headers/email structure that can be important for the spam classifier. Each input message is processed through a Sieve extensions of RFC 5703 to extract the attachment. I ask user to produce a file with .eml extension through any export-like feature of their MUA. Below is an example EML file produced by Tuta (Thunderbird does a similar thing with a different encoding for the body). I'll use a bunch of = characters as a separator in the rest of this. =============================================== [...bunch of header...] X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 00000000-0000-0000-0000-0000000000 00 X-MS-Exchange-Transport-CrossTenantHeadersStamped: TYSPR04MB7035 Content-Type: multipart/related; boundary="------------79Bu5A16qPEYcVIZL@tutanota" --------------79Bu5A16qPEYcVIZL@tutanota Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: base64 DQo8ZGl2IHN0eWxlPSJmb250LWZhbWlseTogQXB0b3MsIEFwdG9zX0VtYmVkZGVkRm9udCwgQXB0b3 NfTVNGb250U2VydmljZSwgQ2FsaWJyaSwgSGVsdmV0aWNhLCBzYW5zLXNlcmlmOyBmb250LXNpemU6 [...base64 encoding of the body...] =============================================== While attached and sent, the received messaged looks like this: =============================================== [...headers of the actual email...] X-Infomaniak-Routing: alpha This is a multi-part message in MIME format. --------------5jyKrhQ08xXUif7LHhgg648N Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit --------------5jyKrhQ08xXUif7LHhgg648N Content-Type: message/rfc822; name="a.eml" Content-Disposition: attachment; filename="a.eml" Content-Transfer-Encoding: 7bit [...headers of the spam....] Subject: Re: //Re: AI + Ranking /// Thread-Topic: //Re: AI + Ranking /// [....] Content-Type: multipart/related; boundary="------------79Bu5A16qPEYcVIZL@tutanota" --------------79Bu5A16qPEYcVIZL@tutanota Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: base64 DQo8ZGl2IHN0eWxlPSJmb250LWZhbWlseTogQXB0b3MsIEFwdG9zX0VtYmVkZGVkRm9udCwgQXB0b3 NfTVNGb250U2VydmljZSwgQ2FsaWJyaSwgSGVsdmV0aWNhLCBzYW5zLXNlcmlmOyBmb250LXNpemU6 [...base64 encoding of the spam....] --------------79Bu5A16qPEYcVIZL@tutanota-- --------------5jyKrhQ08xXUif7LHhgg648N-- =============================================== I face two issues: 1. Only the base64 decoded string can be retrived through foreverypart/extracttext; 2. It has a lot of newlines. - 2. is not a big deal. The original spam has a lot of HTML junk, and each line with HTML without an inner text node is stripped, but the newline is kept. I don't know if this is intended. - 1. is more of a big deal. To try to confirm that, I made an over-simplified version of the Sieve script (I skip configuration but plugins are loaded etc, please ask if useful). =============================================== [...require...] foreverypart { extracttext "eml"; debug_log "PART ============================== ${eml}"; } =============================================== mail_debug is activated. In the logs, I can read: =============================================== Info: sieve: DEBUG: PART ============================== Info: sieve: DEBUG: PART ============================== Info: sieve: DEBUG: PART ============================== Info: sieve: DEBUG: PART ============================== Info: sieve: DEBUG: PART ============================== Info: sieve: Info: sieve: Info: sieve: Info: sieve: Info: sieve: Info: sieve: Info: sieve: Hello, Info: sieve: Info: sieve: Hope you're doing well. Info: sieve: Info: sieve: Info: sieve: Info: sieve: Info: sieve: Would you like attract more traffic with our AEO + GEO + SEO services. AI-driven search is here—don’t miss out. =============================================== So multiple parts are analyzed but only the last gives something. The RFC says that "If the transfer encoding or character set is unrecognized by the implementation or recognized but invalid, an empty string will result.". But it's over my knowledge. I activated trace for Sieve with "matching" level, and the file looks like (this is another test but was the same result): =============================================== Sieve trace log for message delivery: Username: REDACTED Session ID: ozNMOEPNl2nlAAAAO14Lzw Sender: REDACTED Final recipient: REDACTED Default mailbox: INBOX ## Started executing script 'move-spam' 33: foreverypart loop begin 33: loop ends at line 36 35: extracttext command 36: assign 'eml' [0] = "" 36: debug_log "PART ============================== " 36: foreverypart loop end 36: switched to next message part 36: looping back to line 35 35: extracttext command 36: assign 'eml' [0] = "" 36: debug_log "PART ============================== " 36: foreverypart loop end 36: switched to next message part 36: looping back to line 35 35: extracttext command 36: assign 'eml' [0] = "" 36: debug_log "PART ============================== " 36: foreverypart loop end 36: switched to next message part 36: looping back to line 35 35: extracttext command 36: assign 'eml' [0] = "" 36: debug_log "PART ============================== " 36: foreverypart loop end 36: switched to next message part 36: looping back to line 35 35: extracttext command 36: assign 'eml' [0] = "Hi, Just checking in to see if you had a chance to review my earlier message. [...body spam....] 36: debug_log "PART ============================== ????????????Hi, ?? ??Just checking in t..." 36: foreverypart loop end 36: no more message parts 36: exiting loops at line 36 ## Finished executing script 'move-spam' =============================================== Hypothesis: A. Could it be because the mail headers are indistinguishable from the part headers? B. Or is it related to Pigeonhole not implementing yet the enclose extension, which do this the other way? I hope this message is not too hard to read with all the code/logs. Please tell me if there is a better way of doing it. And thanks in advance for any help, because I don't really know what to do and trying to take a (superficial) look at the Pigeonhole code didn't helped.

1 2

Dovecot 2.4 doveadm_worker_count corrupts tab-formatted output
by Philip Iezzi 01 Mar '26

01 Mar '26

Hi there On a Dovecot 2.4.2 (Debian Bookworm) server with over 1300 users, I am using the following config to retrieve quota usage information with doveadm: --------------------------------------- quota "User quota" { } mail_plugins = quota acl mail_log notify userdb sql { iterate_query = SELECT username AS user, CONCAT(quota, 'M') AS quota_storage_size FROM mailaccounts WHERE active = 1 query = \ SELECT '/var/vmail/%{user | domain}/%{user | username}' AS home, 'vmail' AS uid, 'vmail' AS gid, CONCAT(quota, 'M') AS quota_storage_size \ FROM mailaccounts \ WHERE username = '%{user}' AND (active = 1 OR transport_suspended = 0) } --------------------------------------- Initially, I had to run `doveadm quota recalc -A` to recalc quotas and populate the `count` quota driver which is enabled by default for "User quota". But still, it took roughly 20ms per single user or 15-20s for all users: $ time doveadm -f tab quota get -u demo(a)example.com real 0m0.020s $ time doveadm -f tab quota get -A real 0m16.800s Now, to greatly speed this up, I have introduced parallel processing: doveadm_worker_count = 4 Like this, `doveadm -f tab quota get -A` runs approx 10x faster, done in 1.5 - 2.5s But there is one major drawback which I assume to be a bug: # sane output without `doveadm_worker_count = 4` => always 6 fields demo(a)example.com User quota STORAGE 29 204800 0 demo(a)example.com User quota MESSAGE 1 - 0 # broken output with `doveadm_worker_count = 4` => sometimes 7 fields demo(a)example.com User quota STORAGE 29 2048 00 0 demo(a)example.com User quota MESSAGE 1 - 0 Somehow, the tab formatter does not play nicely together with parallel processing. On some output, the value gets split apart by an extra tab, e.g. '2024<TAB>00' in above example. Can you explain this corrupted data? Some kind of "output interleaving" seems to happen when running parallel workers. If I switch to json output (`doveadm -f json quota get -A`), this does not seem to happen and I always get valid JSON output, even with `doveadm_worker_count = 4`. Cheers, Philip

2 7

Panic: file imap-sieve-storage.c: line 216 (imap_sieve_add_mailbox_event): assertion failed: (ismt->src_box == NULL || ismt->src_box == src_box)
by Christian Kivalo 28 Feb '26

28 Feb '26

Reposting my reply from a few days ago to a thread with the same panic message. I found this in my logs when some mails that got deleted on the phone were still visible in roundcube. I currently have three users that trigger the panic. One user with an iPad accounts for nearly all of the panics. The problem shows when the account is accessed from android (thunderbird) or ipad. The same accounts show no problems when beeing used with roundcube or thunderbird on windows. I enabled core dumps on 2026-01-14 and have ~8500 core dumps of the imap binary until now. What causes this error and how can I fix it? In the logs all I see is the users login, then the panic. # doveconf -n # 2.4.2-2+debian13 (0962ed2104): /etc/dovecot/dovecot.conf # Pigeonhole version 2.4.2-2+debian13 (767418c3) # OS: Linux 6.12.0-custom.kvm x86_64 Debian 13.3 ext4 2026-01-13T21:44:32.317609+01:00 uschi dovecot: imap-login: Logged in: user=<user(a)example.com>, method=PLAIN, rip=<IP1>, lip=<IP2>, mpid=4194077, TLS, session=<cpkID0tId7dUc9rl> 2026-01-13T21:44:38.455379+01:00 uschi dovecot: imap(user(a)example.com)<4194077><cpkID0tId7dUc9rl>: Panic: file imap-sieve-storage.c: line 216 (imap_sieve_add_mailbox_event): assertion failed: (ismt->src_box == NULL || ismt->src_box == src_box) 2026-01-13T21:44:38.458755+01:00 uschi dovecot: imap(user(a)example.com)<4194077><cpkID0tId7dUc9rl>: Error: Raw backtrace: #1 [unw_get_proc_name() failed: -10] -> #2 [unw_get_proc_name() failed: -10] -> #3 i_panic[0x7f6b6c46c2f6] -> #4 [unw_get_proc_name() failed: -10] -> #5 [unw_get_proc_name() failed: -10] -> #6 [unw_get_proc_name() failed: -10] -> #7 mailbox_save_alloc[0x7f6b6ca103c0] -> #8 [unw_get_proc_name() failed: -10] -> #9 command_exec[0x55654e677400] -> #10 [unw_get_proc_name() failed: -10] -> #11 [unw_get_proc_name() failed: -10] -> #12 [unw_get_proc_name() failed: -10] -> #13 client_handle_input[0x55654e67ddc0] -> #14 client_continue_pending_input[0x55654e67e0b0] -> #15 io_loop_call_io[0x7f6b6c565490] -> #16 io_loop_handler_run_internal[0x7f6b6c567230] -> #17 io_loop_handler_run[0x7f6b6c5673c0] -> #18 io_loop_run[0x7f6b6c5675a0] -> #19 master_service_run[0x7f6b6c4b27f0] -> #20 main[0x55654e6688a0] -> #21 [unw_get_proc_name() failed: -10] -> #22 __libc_start_main[0x7f6b6c234ce0] -> #23 _start[0x55654e668eb0] 2026-01-13T21:44:38.459536+01:00 uschi dovecot: imap(user(a)example.com)<4194077><cpkID0tId7dUc9rl>: Fatal: master: service(imap): child 4194077 killed with signal 6 (core dumps disabled - https://dovecot.org/bugreport.html#coredumps) # coredumpctl dump PID: 1071230 (imap) UID: 5000 (vmail) GID: 5000 (vmail) Signal: 6 (ABRT) Timestamp: Fri 2026-01-16 19:17:15 CET (2s ago) Command Line: $'dovecot/imap [user(a)example.com <IP redacted> UID MOVE]' Executable: /usr/lib/dovecot/imap Control Group: /system.slice/dovecot.service Unit: dovecot.service Slice: system.slice Boot ID: 3668d179bda340229a780d5d43e426c3 Machine ID: 05698baa30ae984c9bd014566e16da18 Hostname: uschi Storage: /var/lib/systemd/coredump/core.imap.5000.3668d179bda340229a780d5d43e426c3.1071230.1768587435000000.zst (present) Size on Disk: 1.1M Message: Process 1071230 (imap) of user 5000 dumped core. Module libgcc_s.so.1 from deb gcc-14-14.2.0-19.amd64 Module libstdc++.so.6 from deb gcc-14-14.2.0-19.amd64 Module libzstd.so.1 from deb libzstd-1.5.7+dfsg-1.amd64 Stack trace of thread 1071230: #0 0x00007fbd1ca9f95c n/a (libc.so.6 + 0x9495c) #1 0x00007fbd1ca4acc2 raise (libc.so.6 + 0x3fcc2) #2 0x00007fbd1ca334ac abort (libc.so.6 + 0x284ac) #3 0x00007fbd1cc6caa0 n/a (libdovecot.so.0 + 0x6caa0) #4 0x00007fbd1cd49e67 n/a (libdovecot.so.0 + 0x149e67) #5 0x00007fbd1cc6c3d0 i_panic (libdovecot.so.0 + 0x6c3d0) #6 0x00007fbd1c42f942 n/a (lib95_imap_sieve_plugin.so + 0x4942) #7 0x00007fbd1c431223 n/a (lib95_imap_sieve_plugin.so + 0x6223) #8 0x00007fbd1d258f10 n/a (libdovecot-storage.so.0 + 0x11bf10) #9 0x00007fbd1d1a843b mailbox_save_alloc (libdovecot-storage.so.0 + 0x6b43b) #10 0x00005590b7ed4a69 n/a (n/a + 0x0) ELF object binary architecture: AMD x86-64 -- Christian Kivalo

5 12

LDAP AD Quota override not working
by wt.forsaken＠gmail.com 26 Feb '26

26 Feb '26

Hi there, I'm testing the new version of Dovecot 2.4 in Debian 13 before upgrading to my customers and I'm having difficult on trying to override the user's quota. The LDAP base is from Samba4 AD and having been trying the following configuration: auth-ldap.conf.ext: ldap_uris = ldap://localhost ldap_auth_dn = cn=admin,dc=localdomain ldap_auth_dn_password = password ldap_base = ou=users, dc=localdomain passdb ldap { filter = (&(objectClass=person)(sAMAccountName=%{user})) bind = yes fields { userdb_quota_storage_size = %{ldap:telephoneNumber}B } } userdb prefetch { driver = prefetch } userdb ldap { fields { quota_storage_size = %{ldap:telephoneNumber}B } } 90-quota.conf mail_plugins { quota = yes } quota "User quota" { } quota_storage_size = 40M Since there is no quotaBytes in Samba AD, I'm testing to map the telephoneNumber parameters to override the quota, also I'm just testing a 40M to see how it works. Roundcube webmail can see the quota being overriden in its inferior bar, but when I send an email to the user which is above the quota, the journal log inform "failed to store into mailbox 'INBOX': Quota exceeded (mailbox for user is full)". I don't know how to override the quota, since in passdb section I used the "userdb_" prefix but it is not being passed to userdb when I input the "doveadm user ..." command. I don't know if I have been clear in my request, but I'd appreciate any help.

3 3

Dovecot 2.4 LMTP socket for Postfix / Dovecot base_dir not created upon restart
by Philip Iezzi 24 Feb '26

24 Feb '26

Hi there, After over a week of Dovecot 2.3 -> 2.4 upgrade testing in various mailserver clones, I am now ready for the big picture. Thanks Aki for the Config Upgrader https://dovecot.org/upgrader/ which helped a lot! Tomorrow, I am planning to upgrade a larger mailserver in these 3 steps: 1) Debian Bullseye / Dovecot 2.3.21 => 2.4.1 2) Debian Bullseye => Bookworm / Dovecot 2.4.1 => 2.4.2 3) Debian Bookworm => Trixie Postfix needs to talk to Dovecot over LMTP, using the following in main.cf: virtual_transport = lmtp:unix:/run/dovecot/lmtp Now, while testing this in a full server clone, I stepped over my planned LMTP server setup: =============================================== service lmtp { unix_listener /run/dovecot/lmtp { mode = 0666 user = postfix group = postfix } } protocols = imap pop3 sieve lmtp =============================================== The socket needs to be owned by postfix:postfix for some (security) reasons, otherwise Postfix complains. That's why I cannot go with the default, as documented here: https://doc.dovecot.org/2.4.2/core/config/delivery/lmtp.html#lmtp-server > The UNIX listener on $base_dir/lmtp is enabled by default when protocols setting contains lmtp. But, when using an absolute path on unix_listener, upgrade step 2) Bullseye=>Bookworm breaks with: Processing triggers for dovecot-core (2:2.4.2-2+debian12) ... Job for dovecot.service failed because the control process exited with error code. (...) dovecot[34446]: master: Error: service(lmtp): Socket already exists: /var/run/dovecot/lmtp dovecot[34446]: master: Fatal: Failed to start listeners I then moved to `unix_listener lmtp`: service lmtp { unix_listener lmtp { mode = 0666 user = postfix group = postfix } } Bookworm upgrade (restarted from scratch with a fresh server clone) went through fine. But even after several dovecot.service restarts, the socket ended up in /run/lmtp without creating the /run/dovecot directory, and after a full system reboot, it was suddenly back where I have expected it: /run/dovecot/lmtp I never changed base_dir, which defaults to /var/run/dovecot/ So, here's my question: Is that really the recommended setup (using `inet_listener lmtp` instead of an absolute path) and how can I trust Dovecot to always create the socket in $base_dir/lmtp as documented? Are you guys aware of this issue or was it just me, a temporary hiccup on my just upgraded server? I just found this in mail.log: dovecot: master: Error: bind(/var/run/dovecot/lmtp) failed: No such file or directory dovecot: master: Error: service(lmtp): net_listen_unix(/var/run/dovecot/lmtp) failed: No such file or directory dovecot: master: Fatal: Failed to start listeners Again, this problem seems to have occurred both with `unix_listener /run/dovecot/lmtp` and `unix_listener lmtp` and only resolved after a full system reboot. Thanks, Philip

2 2