- dovecot - dovecot.org

Dovecot Submission - rate limiting
by itanguy＠univ-brest.fr 31 Mar '22

31 Mar '22

Hello, is there any way to rate limit submission mail (counting per user) when using Dovecot/Submission (no Postfix)? Using a milter seems impossible. Using Dovecot Events seems "too" global (not per users discrimination). Maybe rate-limiting has to be external and then include in the pass_db query ? Thank your for any hints. Ismaël Tanguy

3 3

Simplifying Support of Virtual and System Users
by Mark Olbert 29 Mar '22

29 Mar '22

Apologies if this has already been raised here (which I suspect it has 😊). I tried to raise it as an issue over on github but issues are not enabled for the repository. The support for mixing virtual users, with fully-qualified email addresses, and system users could be simpler. Assuming it doesn’t mess up other stuff in the code base, of course 😊. The problem appears to be that the PAM passwd module requires just user names without a domain (which makes sense given that they’re system users) but does not, so far as I can see, support the username_format argument. In my setup, the default structure of 10-auth.conf demonstrates this: auth_username_format = %n That means all username arguments lack the domain part…which complicates using fully-qualified ones for virtual users. I realize I could assign arbitrary unique names to the virtual accounts in the lookup file. But that complicates administering the system, so I want to be able to include the domain for virtual users. After about five hair-pulling hours of wrestling with the configuration I stumbled across an answer utilizing conditionals<https://serverfault.com/questions/260488/dovecot-user-lookup-fails-when-usi…> on ServerFault. It works fine. But being able to pass a username_format parameter to the PAM module (which I tried, but it was rejected) would be a lot simpler, and a lot more intuitive. - Mark

5 4

IMAP sync issue in email clients
by ChandranManikandan 29 Mar '22

29 Mar '22

Hi Friends, Some few email accounts are sync issues come in outlook,thunderbird,roundcube and squirrelmail after power shutdown suddenly. The dovecot mail log is shown below for those email accounts. Can anyone help me to fix it? imap(email(a)xxx.com)<19758><bW/i3lTbheQxJd/8>: Error: Mailbox INBOX: UID=502283: read(/home/vpopmail/domains/ xxx.com/email/Maildir/cur/1648520174.28570.mail.xxx.com,S=13720:2,) failed: Cached message size larger than expected (13720 > 0, box=INBOX, UID=502283) (read reason=mail stream) Mar 29 13:40:48 imap(email(a)xxx.com)<19758><bW/i3lTbheQxJd/8>: Error: Corrupted record in index cache file /home/vpopmail/domains/ xxx.com/email/Maildir/dovecot.index.cache: Broken physical size in mailbox INBOX: read(/home/vpopmail/domains/ xxx.com/email/Maildir/cur/1648520174.28570.mail.xxx.com,S=13720:2,) failed: Cached message size larger than expected (13720 > 0, box=INBOX, UID=502283) Mar 29 13:40:48 imap(email(a)xxx.com)<19758><bW/i3lTbheQxJd/8>: Error: Mailbox INBOX: UID=502283: read(/home/vpopmail/domains/ xxx.com/email/Maildir/cur/1648520174.28570..mail.xxx.com,S=13720:2,) failed: Cached message size larger than expected (13720 > 0, box=INBOX, UID=502283) (read reason=) Mar 29 13:40:48 imap(email(a)xxx.com)<19758><bW/i3lTbheQxJd/8>: Info: FETCH failed: Internal error occurred. Refer to server log for more information. [2022-03-29 13:40:48] in=323 out=589163 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0 -- *Regards,Manikandan.C*

2 2

Doveadm backup...
by Stephane Magnier 28 Mar '22

28 Mar '22

Hi I've recently tried to use the Dovecadm backup to backup the emails.. with the following syntax doveadm -Dv backup -u userx maildir:/mnt/nfs-backup/userx Sounds to be OK with few emails... Some of them got a lot of emails and one f them got an error and stop ! dsync(userx): Debug: brain S: Import Trash: Import change type=expunge GUID=1725fa475d774ee19cb98dfb6737b4f1 UID=24891 hdr_hash= result=GUIDs match dsync(userx): Debug: brain S: Import Trash: Import change type=expunge GUID=916ed110b4b1522868be6194f1ae36ff UID=24892 hdr_hash= result=GUIDs match dsync(userx): Debug: brain S: Import Trash: Import change type=expunge GUID=eb8d75c530a7b02fc26b494d9006c91b UID=24893 hdr_hash= result=GUIDs match dsync(userx): Debug: brain S: Import Trash: Import change type=expunge GUID=aee9155875c34861fd6500f1f2f51a26 UID=24894 hdr_hash= result=GUIDs match dsync(userx): Debug: brain S: Import Trash: Last common UID=24894. Delayed expunges= dsync(userx): Debug: brain S: Import Trash: Saved UIDs: dsync(userx): Debug: brain S: Import Trash: Finish update: min_next_uid=24895 min_first_recent_uid=24895 min_highest_modseq=35344 min_highest_pvt_modseq=0 dsync(userx): Debug: /mnt/nfs-backup/userx/.Trash/dovecot.index.cache: Compressed, file_seq changed 1645803588 -> 1645803589, size=32, max_uid=24894 dsync(userx): Warning: Mailbox changes caused a desync. You may want to run dsync again: Remote lost mailbox GUID 7e05c335174bf1608f0a02004eac7fb4 (maybe it was just deleted?) dsync(userx): Debug: auth-master: conn unix:/run/dovecot/auth-userdb: Disconnected: Connection closed (fd=10) I empty the trash... exactly the same problem... Any idea why this ?? Thanks and regards,

5 10

Private \seen flags lost during message move for other users
by Cube . 28 Mar '22

28 Mar '22

Hello, I have a shared mailbox set up with a private index: maildir:/var/mail/public:INDEXPVT=~/Maildir/public Per user \Seen flags are working fine until one user moves a message into another folder/sub-mailbox. For that user doing the move the message remains \Seen however for other users who have already seen the message the flag is lost and it appears unread in the new location. If the message is moved back it still appears unread to the other user even if had been read in that folder/sub-mailbox in the past. Is there anyway to retain per user \Seen that follows the message when its moved? Thank you.

2 1

dovecot replication on dovecot v 2.3.8
by Stephane Magnier 27 Mar '22

27 Mar '22

Hi, I am trying using a replication. Here is my config : 10-mail.conf. Before going " on real life " I try to make a very basic example... but without any success :-( bad start I took the config example on dovecot wiki The idea is to replicate the user: "user1" on a different server IP 177.28.1.120 at the location /home/SERVER/test and to get at the end the folder "/home/SERVER/test/user1" On the top, I wish to replication with the user / group : vmail. For the transfer, I use the root login on the backup server to avoid other rights problems at the moment 2) how to synchronized specific users ? apparently it's trying to sync other things.. :-) # mbox_very_dirty_syncs = yes mail_plugins=$mail_plugins quota notify replication service replicator { process_min_avail = 1 } dsync_remote_cmd = ssh -l root 177.28.1.120 doveadm dsync-server -u user1 plugin { mail_replica =remote:root@177.28.1.120:/home/SERVER/test/ } service aggregator { fifo_listener replication-notify-fifo { user = vmail } unix_listener replication-notify { user = vmail } } service replicator { unix_listener replicator-doveadm { mode = 0600 user = vmail } } replication_max_conns = 10 But apparently nothing is happening.... [root@xxx xenia]# doveadm replicator status Queued 'sync' requests 0 Queued 'high' requests 0 Queued 'low' requests 0 Queued 'failed' requests 0 Queued 'full resync' requests 24 Waiting 'failed' requests 10 Total number of known users 34 and the folder test is empty Any idea what is wrong ? maybe I should ask a start a cmd line to start the process ? ( [root@mbox1 xenia]# doveadm replicator status '*' username priority fast sync full sync success sync failed rngd none - - - - *user1 none 00:00:04 00:40:05 - y ( failed )* saslauth none - - - - sa-milt none - - - -

1 1

disable authentication for a user in specialuserdb passwd-file
by Marc 27 Mar '22

27 Mar '22

Is it possible to disable the authentication for a specific user in userdb password-file?

1 0

log failed plaintext password for specific user only
by mj 25 Mar '22

25 Mar '22

Hi, We are logging failed authentication attempts, with the attempted password as auth_verbose_passwords=sha1 The question: is it possible to configure auth_verbose_passwords=plain for a specific user only? Turning it on globally would be too much sensitive information for the purpose. Reason: We are currently observing a high number of failed authentications for a specific user, coming from *many* diffirent IPs across the globe, with most IPs only trying once or twice, making this difficult to block. The number of failed authentications cause this account to regularly become blocked in AD. We would like to know if they are trying older actual passwords from the user, or if it's just dictionary attack. Thanks!

4 7

Setting imap-login process_limit when service_count>1
by Joseph Tam 25 Mar '22

25 Mar '22

More of my users are accessing mail remotely, which probably explained why I started seeing Mar 18 05:50:34 dovecot: master: Warning: service(imap-login): process_limit (2) reached, client connections are being dropped I played around with increasing limits, but made the mistake of setting service_count to a value other than 0 and 1. service imap-login { client_limit = 1024 service_count = 10240 process_min_avail = 2 process_limit = 8 } Doubling and redoubling process_limit and increasing service_count didn't prevent IMAP from eventually grinding to a halt because process_limit was reached. Mar 18 12:36:12 dovecot: master: Warning: service(imap-login): process_limit (4) reached, client connections are being dropped Mar 18 20:39:48 viol dovecot: master: Warning: service(imap-login): process_limit (8) reached, client connections are being dropped Observing the way imap-login processes spawn and retain file descriptors, I finally understood the subtlety of [1], which explains that imap-login will not exit despite reaching service_count if one SSL connection is still open. With many long-lived client connections, the asymptotic behaviour is that the total #clients plateaus, but get spread out over many imap-login processes, with many lingering on to hold a few SSL connections. For service_count>1, process_limit should be set to a large fraction of peak simultaneous clients (i.e. the same value used when service_count=1), otherwise there is a high likelihood of running into process_limit and game over. Given this behaviour, there doesn't seem much sense in setting service_count to anything but 0 (unlimited => performance mode) or 1 (security mode). Setting to other values supposedly limit memory leaks, but if a single persistent SSL client can hold up an imap-login process from exiting and releasing memory, it seems to negate this purpose. Anyways, maybe [1] can mention this so others don't fall into the same pit I did. References [1] https://doc.dovecot.org/admin_manual/login_processes/ Joseph Tam <jtam.home(a)gmail.com>

1 0

ok replication does not work
by Paul Kudla (SCOM.CA Internet) 24 Mar '22

24 Mar '22

would someone please send me the standard that you are working towards (rfc stuff) in the mean time a bad email or folder or both are simply causing replication not to work no there is no logging of any kind of an error i would appreciate the info as i will start ripping down the c code to fix this doveadm / replication (seems to be seperate ???) remote , tcp tcps nothing works your co operation on this matter would be appreciated i dumped the 5 accounts listed below started from scratch and it just simply DOES NOT WORK all account replicate except for # sync.status Queued 'sync' requests 0 Queued 'high' requests 5 Queued 'low' requests 0 Queued 'failed' requests 0 Queued 'full resync' requests 0 Waiting 'failed' requests 0 Total number of known users 255 username type status paul(a)scom.ca incremental Waiting for dsync to finish nick(a)elirpa.com incremental Waiting for dsync to finish keith(a)elirpa.com incremental Waiting for dsync to finish ed.hanna(a)dssmgmt.com incremental Waiting for dsync to finish ed(a)scom.ca incremental Waiting for dsync to finish always the same five accounts and always they choke without any info i am forced to do a sync every five minutes (ten minute intevals) to keep the servers in sync. someone please give me a standard to work with otherwise the hacks that i do will be exactly that a hack???

2 1