- dovecot - dovecot.org

[Dovecot] my quota warning script not getting executed2
by ihab 12 Nov '13

12 Nov '13

Why is my quota warning script not getting executed? :( dovecot version is 1.2.15 this is part of dovecot.conf protocol imap { listen = 127.0.0.1:143 #ji1 quota config mail_plugins = quota } quota = maildir:User quota quota_rule = *:storage=2M quota_exceeded_message=Quota exceeded please go http://www.go.com . quota_warning = storage=99%% /usr/local/bin/quota-warning.sh 99 %u quota_warning2 = storage=98%% /usr/local/bin/quota-warning.sh 98 %u quota_warning3 = storage=97%% /usr/local/bin/quota-warning.sh 97 %u and this is quota-warning.sh FROM="postmasterEmail" msg="From: $FROM To: TEST EMAIL Subject: Your email quota is 10% full Your mailbox is now 10% full." echo -e "$msg" | /usr/sbin/sendmail -f $FROM "TEST EMAIL " exit 0 -- View this message in context: http://dovecot.2317879.n4.nabble.com/my-quota-warning-script-not-getting-ex… Sent from the Dovecot mailing list archive at Nabble.com.

3 3

[Dovecot] Dovecot MTA
by Timo Sirainen 12 Nov '13

12 Nov '13

Hi all, I've never really wanted to create my own MTA, because I like Postfix quite a lot. And I always thought it would require a horribly lot of time to be able to create something that was anywhere even close to having Postfix's features. (I would shudder to even think about recreating Dovecot from scratch nowadays.) But slowly over time I've also been thinking of ways how things could be done a bit better, and I think I have enough ideas to start thinking about Dovecot MTA more seriously in a few more months (after my current busy schedule calms down a bit). And (unlike Dovecot!) I'm not planning on taking over the world with the MTA (or at least not very quickly), but it would definitely be useful for many installations I know of. My main design goals for the MTA are: * In normal load don't queue mails, just continue delivering the mail through different processes/services until it succeeds or fails, and only after that return ok/failure to the SMTP client. So there's no (forced) post-queue filtering, everything would normally happen pre-queue. This is required because in Germany (and EU in general?) you aren't allowed to just drop spams after SMTP server has responsed OK to the client, even if you’re 100% sure it’s a spam. So this would also mean that the SMTP DATA replies will come more slowly, which means that the SMTP server must be able to handle a lot more concurrent SMTP connections, which means that in large installations the smtpd process must be able to asynchronously handle multiple SMTP client connections. * In some cases you can't really avoid placing mails into a queue. This could be because of temporary failures or maybe because of an abnormal load spike. A mail queue in local disk isn't very nice though, because if the local disk dies, the queued mails are lost. Dovecot MTA will allow the queue to be in object storage and it will also likely support replication (similar to current dsync replication). In both of these cases if a server dies, another server can quickly take over its queue and continue handling it. * Dovecot MTA is a new product, which means we can add some requirements to how it's being used, especially related to securely sending emails between servers. It could do a bunch of checks at startup and fail to even start if everything isn't correct. Here are some things I had in mind - not sure if all of these are good ideas or not: - Require DKIM configuration. All outgoing mails will be DKIM signed. - Require the domain’s DNS to contain _submission._tcp SRV record (and actually might as well require _imap._tcp too) - Require SSL certificates to be configured and always allow remote to use STARTTLS - Require DANE TLSA record to exist and match the server's configured SSL cert - Have very good (and strict?) DNSSEC support. If we know a remote server is supposed to have valid DNSSEC entries, but doesn't, fail to deliver mail entirely? - Add a new DNS record that advertises this is a Dovecot MTA (or compatible). If such entry is found (especially when correctness is guaranteed by DNSSEC), the email sender can assume that certain features exist and work correctly. If they don't, it could indicate an attack and the mail sending should be retried later. This DNS record would of course be good to try to standardize. * Configuration: It would take years to implement all of the settings that Postfix has, but I think it's not going to be necessary. In fact I think the number of new settings to dovecot.conf that Dovecot MTA requires would be very minimal. Instead nearly all of the configuration could be done using Sieve scripts. We'd need to implement some new MTA-specific Sieve extensions and a few core features/configurations/databases that the scripts can use, but after that there wouldn't be really any limits to what could be done with them. * Try to implement as many existing interfaces as possible (e.g. Milter and various Postfix APIs like policy servers) so that it wouldn’t be necessary to reimplement all the tools and filters. So perhaps something like this could be done in time for Dovecot v2.4. Any thoughts/ideas/suggestions?

30 76

[Dovecot] blames for using maillists ?
by Benny Pedersen 12 Nov '13

12 Nov '13

why do you not simply shut up? # sieve rule require ["imap4flags"]; # rule:[reindl] if allof (header :contains "From" "h.reindl(a)thelounge.net") { setflag ["\\Seen","\\Flagged"]; stop; }

3 3

[Dovecot] dsync-server panic/fatal errors
by IT geek 31 11 Nov '13

11 Nov '13

Would anyone like to hazard a guess what these errors mean: Nov 11 18:57:04 server2 dovecot: dsync-server(mark): Panic: file mbox-lock.c: line 799 (mbox_lock): assertion failed: (lock_type == F_RDLCK || mbox->mbox_lock_type != F_RDLCK) Nov 11 18:57:04 server2 dovecot: dsync-server(mark): Fatal: master: service(doveadm): child 3119 killed with signal 6 (core not dumped - set service doveadm { drop_priv_before_exec=yes }) Getting this replication working is driving me nuts! :'-( Any help would be appreciated. -Mark

1 0

[Dovecot] Incorrect Responses on deliverable mails with LMTP server
by Thomas Leuxner 11 Nov '13

11 Nov '13

Appears some change between 2.2.6 and 2.2.7 altered the response codes for LMTP user verification probes. Dovecot 2.2.6: Nov 2 15:50:48 spectre postfix/qmgr[627]: 3dBjr80wMgz1s: from=<double-bounce(a)spectre.leuxner.net>, size=271, nrcpt=1 (queue active) Nov 2 15:50:48 spectre postfix/cleanup[6226]: 3dBjr80xbYz1w: message-id=<20131102145047.2D3C6824147(a)sam.dfn-cert.de> Nov 2 15:50:48 spectre postfix/lmtp[6228]: 3dBjr80wMgz1s: to=<tlx(a)leuxner.net>, orig_to=<security(a)leuxner.net>, relay=spectre.leuxner.net[private/dovecot-lmtp], delay=0.03, delays=0/0.01/0.01/0.01, dsn=2.1.5, status=deliverable (250 2.1.5 OK) Dovecot 2.2.7: Nov 5 05:24:04 spectre postfix/qmgr[627]: 3dDHnc5J06z1s: from=<double-bounce(a)spectre.leuxner.net>, size=271, nrcpt=1 (queue active) Nov 5 05:24:04 spectre postfix/smtpd[2484]: 3dDHnc5KWcz1w: client=web.heise.de[193.99.144.71] Nov 5 05:24:04 spectre postfix/cleanup[2489]: 3dDHnc5KWcz1w: message-id=<E1VdXxN-0002Gx-0s.01(a)web.heise.de> Nov 5 05:24:04 spectre postfix/lmtp[2491]: 3dDHnc5J06z1s: to=<tlx(a)leuxner.net>, orig_to=<newsletters(a)leuxner.net>, relay=spectre.leuxner.net[private/dovecot-lmtp], delay=0.03, delays=0/0.01/0.01/0, dsn=4.4.2, status=undeliverable (lost connection with spectre.leuxner.net[private/dovecot-lmtp] while sending MAIL FROM) While it still seems to work, mail gets delivered, it looks pretty ugly in the logs. Regards Thomas

2 2

[Dovecot] server side private/public key
by Peter Mogensen 11 Nov '13

11 Nov '13

*Christian Felsing wrote: * > Please consider to add server side private/public key encryption for incoming mails. > If client logs on, the password is used to unlock users server side private key. > If mail arrives from MTA or any other source, mail is encrypted with users public key. > Key pair should be located in LDAP or SQL server. PGP and S/MIME should be supported. > This is for the situation if NSA or other organizations asks admin for > users mail insistently, So ... exactly which security threat are you thinking about preventing here? This won't protect against: * NSA listening in on the mails when they arrive. * NSA taking a backup of your mails and wait for your first attempt to read them - at which time they'll have your private key in plain text. It seems like a much wider protection to just keep you private key for your self. /Peter

3 2

[Dovecot] Can't get sieve/managedsieve working
by Alter Depp 11 Nov '13

11 Nov '13

Hi, I am running dovecot 2.1.7 for a while, with roundcube webmail frontend 0.9.5 . Now I wanted to add sieve to filter mails. Unfortunately most tutorials are for dovecot 1.x but I'm running dovecot 2 on debian wheezy. I could upload some scripst with sieve-connect, checked and activated them. When I try to edit filters with thunderbird sieve plugin 0.2.2 nothing happens. If I try to edit filters with roundcube managesieve plugin nothing happens, too, but I get some errors in logfile: > roundcube: "Authentication failed." (3) > roundcube: Not currently in AUTHORISATION stata (1): Can someone help me, to get it running? # 2.1.7: /etc/dovecot/dovecot.conf # OS: Linux 3.6.11+ armv6l Debian 7.2 auth_debug = yes auth_debug_passwords = yes auth_verbose = yes auth_verbose_passwords = plain lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes listen = * mail_location = mbox:~/mail:INBOX=/var/mail/%u managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave namespace { inbox = yes location = mailbox { special_use = \Drafts name = Drafts } mailbox { special_use = \Junk name = Junk } mailbox { special_use = \Sent name = Sent } mailbox { special_use = \Sent name = Sent Messages } mailbox { special_use = \Trash name = Trash } prefix = name = inbox } passdb { driver = pam } plugin { sieve = ~/.dovecot.sieve sieve_dir = ~/sieve } postmaster_address = stefan@localhost protocols = " imap sieve" service replication-notify-fifo { name = aggregator } service anvil-auth-penalty { name = anvil } service auth-worker { name = auth-worker } service auth-client { name = auth } service config { name = config } service dict { name = dict } service login/proxy-notify { name = director } service dns-client { name = dns_client } service doveadm-server { name = doveadm } service imap { name = imap-login } service login/imap { name = imap } service indexer-worker { name = indexer-worker } service indexer { name = indexer } service ipc { name = ipc } service lmtp { name = lmtp } service log-errors { name = log } service { inet_listener { port = 4190 name = sieve } name = managesieve-login } service login/sieve { name = managesieve } service pop3 { name = pop3-login } service login/pop3 { name = pop3 } service replicator { name = replicator } service login/ssl-params { name = ssl-params } service stats-mail { name = stats } ssl_cert = </etc/ssl/certs/ssl-cert-raspi.pem ssl_key = </etc/ssl/certs/ssl-cert-raspi.pem userdb { driver = passwd } protocol lmtp { service replication-notify-fifo { name = aggregator } service anvil-auth-penalty { name = anvil } service auth-worker { name = auth-worker } service auth-client { name = auth } service config { name = config } service dict { name = dict } service login/proxy-notify { name = director } service dns-client { name = dns_client } service doveadm-server { name = doveadm } service imap { name = imap-login } service login/imap { name = imap } service indexer-worker { name = indexer-worker } service indexer { name = indexer } service ipc { name = ipc } service lmtp { name = lmtp } service log-errors { name = log } service sieve { name = managesieve-login } service login/sieve { name = managesieve } service pop3 { name = pop3-login } service login/pop3 { name = pop3 } service replicator { name = replicator } service login/ssl-params { name = ssl-params } service stats-mail { name = stats } } protocol lda { mail_plugins = " sieve" service replication-notify-fifo { name = aggregator } service anvil-auth-penalty { name = anvil } service auth-worker { name = auth-worker } service auth-client { name = auth } service config { name = config } service dict { name = dict } service login/proxy-notify { name = director } service dns-client { name = dns_client } service doveadm-server { name = doveadm } service imap { name = imap-login } service login/imap { name = imap } service indexer-worker { name = indexer-worker } service indexer { name = indexer } service ipc { name = ipc } service lmtp { name = lmtp } service log-errors { name = log } service sieve { name = managesieve-login } service login/sieve { name = managesieve } service pop3 { name = pop3-login } service login/pop3 { name = pop3 } service replicator { name = replicator } service login/ssl-params { name = ssl-params } service stats-mail { name = stats } } protocol imap { service replication-notify-fifo { name = aggregator } service anvil-auth-penalty { name = anvil } service auth-worker { name = auth-worker } service auth-client { name = auth } service config { name = config } service dict { name = dict } service login/proxy-notify { name = director } service dns-client { name = dns_client } service doveadm-server { name = doveadm } service imap { name = imap-login } service login/imap { name = imap } service indexer-worker { name = indexer-worker } service indexer { name = indexer } service ipc { name = ipc } service lmtp { name = lmtp } service log-errors { name = log } service sieve { name = managesieve-login } service login/sieve { name = managesieve } service pop3 { name = pop3-login } service login/pop3 { name = pop3 } service replicator { name = replicator } service login/ssl-params { name = ssl-params } service stats-mail { name = stats } } protocol sieve { service replication-notify-fifo { name = aggregator } service anvil-auth-penalty { name = anvil } service auth-worker { name = auth-worker } service auth-client { name = auth } service config { name = config } service dict { name = dict } service login/proxy-notify { name = director } service dns-client { name = dns_client } service doveadm-server { name = doveadm } service imap { name = imap-login } service login/imap { name = imap } service indexer-worker { name = indexer-worker } service indexer { name = indexer } service ipc { name = ipc } service lmtp { name = lmtp } service log-errors { name = log } service sieve { name = managesieve-login } service login/sieve { name = managesieve } service pop3 { name = pop3-login } service login/pop3 { name = pop3 } service replicator { name = replicator } service login/ssl-params { name = ssl-params } service stats-mail { name = stats } }

5 7

[Dovecot] maildir_very_dirty_syncs and GFS
by Andrea gabellini - SC 11 Nov '13

11 Nov '13

Hello, I have two dovecot 2.2.7 and postfix with LDA backend that shares a GFS partition as email storage. In front of them there is a proxy with Director. In both backend servers only Dovecot access the cur/ directory. Can I use maildir_very_dirty_syncs=yes? Thanks, Andrea -- ---------------------------------------------------------------- That is what learning is. You suddenly understand something you've understood all your life, but in a new way. ---------------------------------------------------------------- Ing. *Andrea Gabellini* Email: andrea.gabellini(a)telecomitalia.sm <mailto:Andrea%20Gabellini%20%3Candrea.gabellini@telecomitalia.sm%3E> Skype: andreagabellini Tel: (+378) 0549 886111 Fax: (+378) 0549 886188 Telecom Italia San Marino S.p.A. Strada degli Angariari, 3 47891 Rovereta Republic of San Marino http://www.telecomitalia.sm

1 0

Re: [Dovecot] Dovecot MTA
by Peter Mogensen 11 Nov '13

11 Nov '13

Timo Sirainen wrote: > And Dovecot roadmap is slowly shrinking .. there aren’t all that many > big features left anymore. Soon it’s mainly going to be improvements > to reliability and performance. So I need to find some new things to > do in any case. :) True ... If I try to make a wish list for features many of them requires fixing the IMAP protocol it self. (Like not having the folder display name being the unique identifier) Which reminds me that the IMAP5 process (if there ever was one) seems to be slowed to a halt. Now, there's a task for a developer looking for something to do ;-) /Peter

1 0

[Dovecot] Getting debug output from antispam plugin with dspam
by Igor Zinovik 11 Nov '13

11 Nov '13

Hello. I'm trying to get some output from antispam plugin when it invokes dspam binary for retraining. Currently I see no messages related to dspam execution. Dovecot IMAP server works as 'vmail' user: # ps aux|grep 'dovecot/imap' vmail 3062 0.7 0.0 29824 3008 ? S 16:22 0:00 dovecot/imap User 'vmail' is listed as trusted in /etc/dspam/dspam.conf # fgrep vmail /etc/dspam/dspam.conf Trust vmail Dovecot IMAP plugins and antispam configuration: # doveconf -n | egrep -e '(^#|antispam|protocol imap)' # 2.2.7: /etc/dovecot/dovecot.conf # OS: Linux 3.7.10-1.16-default x86_64 openSUSE 12.3 (x86_64) antispam_allow_append_to_spam = YES antispam_backend = dspam antispam_dspam_args = --client;--user;%Lu;--deliver=spam,innocent;--source=error;--signature=%%s antispam_dspam_binary = /usr/sbin/dspam antispam_dspam_notspam = --class=innocent antispam_dspam_result_header = X-DSPAM-Result antispam_dspam_spam = --class=spam antispam_signature = X-DSPAM-Signature antispam_signature_missing = move antispam_spam = Spam antispam_trash = trash;Trash;Deleted;deleted;Deleted Items protocol imap { mail_plugins = expire mail_log notify quota trash imap_quota antispam Antispam plugin is successfully loaded: # grep antispam_plugin /var/log/dovecot/dovecot.log Nov 11 16:22:32 imap: Debug: Module loaded: /usr/lib64/dovecot/modules/lib90_antispam_plugin.so As i understand plugin would not work with message that do not contains dspam signature, so I sent GTUBE message to myself and when I move it to Spam folder I see only Dovecot messages: Nov 11 16:28:06 imap(zinovik(a)example.org): Info: copy from INBOX: box=Spam, uid=3422, msgid=<20131111144014.731f035b871deb0e082bc22e(a)example.org>, size=1130 Nov 11 16:28:06 imap(zinovik(a)example.org): Info: delete: box=INBOX, uid=26792, msgid=<20131111144014.731f035b871deb0e082bc22e(a)example.org>, size=1130 Nov 11 16:28:06 imap(zinovik(a)example.org): Info: expunge: box=INBOX, uid=26792, msgid=<20131111144014.731f035b871deb0e082bc22e(a)example.org>, size=1130 Dspam logs nothing, though debugging is turned on # ps aux | egrep -e '^dspam' dspam 2939 0.0 0.0 116408 2420 ? S 15:38 0:00 /usr/sbin/dspam --daemon --debug # egrep '^Debug ' /etc/dspam/dspam.conf Debug * Even if I set dspam binary to file that do not exist i do not get any debugging messages (according to code function i_debug("execution %s failed...") should be triggered). Maybe there is some kind of verbose output knob for plugins in Dovecot? I turned on everything I found (also using mail_log for imap protocol): # doveconf -n|egrep -e '(verbose|debug)' auth_debug = yes auth_verbose = yes mail_debug = yes verbose_ssl = yes Is there anybody out there who use Dovecot 2.2.7 with antispam plugin? Antispam plugin revision 5ebc6aae4d7c<http://hg.dovecot.org/dovecot-antispam-plugin/rev/5ebc6aae4d7c>

1 0