- dovecot - dovecot.org

Feature request: use`openid_configuration_url` to guess OIDC endpoints and keys
by Éloi Rivard 04 Feb '22

04 Feb '22

Since version 2.3.16 dovecot has a openid_configuration_url [1] configuration parameter. Here is the documentation about this parameter: > Support for RFC 7628 OpenID Discovery (OIDC) can be achieved with > openid_configuration_url setting. Setting this causes Dovecot to report OIDC > configuration URL as openid-configuration element in error JSON. After reading the RFC I understand this brings some context to the error messages, but at first glance I would have expected more from this parameter. - Dovecot could read the userinfo_endpoint option [2] in the OIDC discovery endpoint to guess the IDP userinfo endpoint [3], and make the dovecot introspection_url parameter optional. - Dovecot could read the introspection_endpoint option [4] in the OIDC discovery endpoint to guess the IDP introspection endpoint [5], and make the dovecot tokeninfo_url parameter optional. RFC8414 is still a draft though, but there seems to be a convention about this parameter be called either token_introspection_endpoint or introspection_endpoint. Maybe both could be checked? - Dovecot could read the jwks_uri [4] option in the OIDC discovery endpoint to guess the IDP public keys, and make the local_validation_key_dict dovecot parameter optional. I would suggest to keep the values in introspection_url, tokeninfo_url and local_validation_key_dict if defined, but use the values found in the OIDC discovery endpoint by default. I think this would really help using OAUTH with dovecot. What do you think? [1] https://doc.dovecot.org/configuration_manual/authentication/oauth2/#openid-… [2] https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata [3] https://openid.net/specs/openid-connect-core-1_0.html#UserInfo [4] https://datatracker.ietf.org/doc/html/rfc8414#section-2 [5] https://datatracker.ietf.org/doc/html/rfc7662

1 0

Dovecot v2.3.18 released
by Aki Tuomi 04 Feb '22

04 Feb '22

Hi all! We are pleased to release v2.3.18 of Dovecot. Debian/Stretch support has now been dropped. CentOS 8 packages have been replaced with RedHat Enterprise Linux 8 packages. These should be compatible with all the various variants. https://dovecot.org/releases/2.3/dovecot-2.3.18.tar.gz https://dovecot.org/releases/2.3/dovecot-2.3.18.tar.gz.sig Binary packages in https://repo.dovecot.org/ Docker images in https://hub.docker.com/r/dovecot/dovecot Regards, Aki Tuomi Open-Xchange oy -- * Removed mail_cache_lookup_finished event. This event wasn't especially useful, but it increased CPU usage significantly. * fts: Don't index inline base64 encoded content in FTS indexes using the generic tokenizer. This reduces the FTS index sizes by removing input that is very unlikely to be searched for. See https://doc.dovecot.org/configuration_manual/fts/tokenization for details on how base64 is detected. Only applies when using libfts. * lmtp: Session IDs are now preserved through proxied connections, so LMTP sessions can be tracked. This slightly changes the LMTP session ID format by appending ":Tn" (transaction), ":Pn" (proxy connection) and ":Rn" (recipient) counters after the session ID prefix. + Events now have "reason_code" field, which can provide a list of reasons why the event is happening. See https://doc.dovecot.org/admin_manual/event_reasons/ + New events are added. See https://doc.dovecot.org/admin_manual/list_of_events/ + fts: Added fts_header_excludes and fts_header_includes settings to specify which headers to index. See https://doc.dovecot.org/settings/plugin/fts-plugin#plugin-fts-setting-fts-h… for configuration details. + fts: Initialize the textcat language detection library only once per process. This can reduce CPU usage if fts_languages setting has multiple languages listed and service indexer-worker { service_count } isn't 1. Only applies when using libfts. + lib-storage: Reduced CPU usage significantly for some operations that accessed lots of emails (e.g. fetching all flags in a folder, SORT, ...) + lib: DOVECOT_PREREQ() - Add micro version which enables compiling external plugins against different versions of Dovecot. + lmtp: Added new lmtp_verbose_replies setting that makes errors sent to the LMTP client much more verbose with details about why exactly backend proxy connections or commands are failing. + submission: Support implicit SASL EXTERNAL with submission_client_workarounds=implicit-auth-external. This allows automatically logging in when SSL client certificate is present. - *-login: Statistics were disabled if stats process connection was lost. - auth: Authentication master user login fails with SCRAM-* SASL mechanisms. - auth: With auth_cache_verify_password_with_worker=yes, passdb extra fields in the auth cache got lost. - doveadm: Fixed crash if zlib_save_level setting was specified, but zlib_save was unset. v2.3.15 regression. - doveadm: Proxying can panic when flushing print output. v2.3.17 regression. Fixes: Panic: file ioloop.c: line 865 (io_loop_destroy): assertion failed: (ioloop == current_ioloop) - doveadm: stats add --group-by parameter didn't work. - fts: Using email-address fts tokenizer could result in excessive memory usage with garbage email input. This could cause the indexer-worker processes to fail due to reaching the VSZ memory size limit. Only applies when using libfts. - imap: A SEARCH command timing out while fts returns indexes may timeout returning "NO [SERVERBUG]", while it should return "NO [INUSE]" instead. - imap: LIST-EXTENDED doesn't return STATUS for all folders. Sending LIST .. RETURN (SUBSCRIBED STATUS (...)) did not return STATUS for folders that are not subscribed when they have a child folder that is subscribed as mandated by IMAP RFCs. - imapc: Mailbox vsize calculation crashed with Panic: file index-mailbox-size.c: line 344 (index_mailbox_vsize_hdr_add_missing): assertion failed: (mails_left > 0) - indexer: If indexer-worker crashes, the request it was processing gets stuck in the indexer process. This stops indexing for the folder until indexer process is restarted. v2.3.14 regression. - indexer: Process was slowly leaking memory for each indexing request. - lib-event: Unnamed events were wrongly filtered out for event/metric filters like "event=abc OR something_independent_of_event_name". - lib-index: 64-bit big endian CPUs handle last_used field in dovecot.index.cache wrong. - lib-ssl-iostream: Fix buggy OpenSSL error handling without assert-crashing. If there is no error available, log it as an error instead of crashing. The previous fix for this in v2.3.11 was incomplete. Fixes Panic: file istream-openssl.c: line 51 (i_stream_ssl_read_real): assertion failed: (errno != 0) - lmtp: Out-of-memory issues can happen when proxying large messages to LMTP backend servers that accept the message data too slow. - master: HAProxy header parsing has read buffer overflow if provided header size is invalid. This happens only if inet_listener { haproxy=yes } is configured and only if the remote IP address is in haproxy_trusted_networks. - old_stats: Plugin kept increasing memory usage, which became noticeable with long-running imap sessions. - stats: Dynamically adding same metric multiple times causes multiple stats. - submission-login: Authentication does not accept OAUTH2 token (or other very long credentials) because it considers the line to be too long. - submission-login: Process can crash if HELO is pipelined with an invalid domain. - submission-proxy: Don't use SASL-IR if it would make the AUTH command line longer than 512 bytes. - submission: Service would crash if relay server authentication failed. - virtual: FTS search in a virtual folder could crash if there are duplicate mailbox GUIDs. This mainly happened when user had both INBOX and INBOX/INBOX folders and the namespace prefix was INBOX/. Fixes Panic: file hash.c: line 252 (hash_table_insert_node): assertion failed: (opcode == HASH_TABLE_OP_UPDATE) - virtual: If mailbox opening fails, the backend mailbox is leaked and process crashes when client disconnects. Fixes Panic: file mail-user.c: line 232 (mail_user_deinit): assertion failed: ((*user)->refcount == 1) - virtual: Searching headers in virtual folders didn't always use full-text search indexes, if fts_enforced=no or body.

2 1

posible guide
by d 03 Feb '22

03 Feb '22

2 1

Notification about branch and versioning changes
by Aki Tuomi 03 Feb '22

03 Feb '22

Dear subscribers, This year we will be releasing a new Dovecot major release. In preparations for this, we are doing some repository changes, which will affect you if you are using our git repositories. These changes will become effective after 14th of February. Following branch name changes are going to be implemented: - main => this is going to be the main branch in future - master => release-2.3 Note that Dovecot version number on main branch is going to change. The next major CE release will be 2.4.x. The change to a main branch and its version numbering also apply to Pigeonhole. We will also align Pigeonhole release version to match Dovecot, ie. the next major is 2.4.x and not 0.6. We will send more information about the upcoming major release as it progresses. Regards, Aki Tuomi Open-Xchange oy

1 0

Pigeonhole v0.5.18 released
by Aki Tuomi 03 Feb '22

03 Feb '22

Hi all! We are pleased to release v0.5.18 of Pigeonhole. Debian/Stretch support has now been dropped. CentOS 8 packages have been replaced with RedHat Enterprise Linux 8 packages. These should be compatible with all the various variants. https://pigeonhole.dovecot.org/releases/2.3/dovecot-2.3-pigeonhole-0.5.18.t… https://pigeonhole.dovecot.org/releases/2.3/dovecot-2.3-pigeonhole-0.5.18.t… Binary packages in https://repo.dovecot.org/ Docker images in https://hub.docker.com/r/dovecot/dovecot Regards, Aki Tuomi Open-Xchange oy -- - duplicate: Users without a home directory can crash with Sieve when using duplicate database. v2.3.17 regression. - imapsieve: When mail was expunged when processing imapsieve events, a crash could occur. Fixes Panic: file mail-index-map.c: line 558 (mail_index_map_lookup_seq_range): assertion failed: (first_uid > 0) - managesieve-login: Proxy didn't support forwarding the forward_* passdb fields. - redirect: Sieve would crash if redirect after keep-equivalent action failed. - sieve: Interpreter crashes when the Sieve index extension is used with index zero. - vnd.dovecot.filter: Envelope sender string may become corrupted when Sieve scripts are using vnd.dovecot.filter. This could end up corrupting mbox's From line and return wrong envelope sender string in

1 0

Re: dovecot Digest, Vol 212, Issue 56
by Steve 02 Feb '22

02 Feb '22

Greetings! A signed documentation you can find here: https://meta-calculator.com/tsaenauuovecumpttrqol/oieell-eiemnudai-mosboers… -----Original Message----- On Tuesday, 29 December 2020, 10:00 wrote: > Send dovecot mailing list submissions to dovecot(a)dovecot.org To subscribe > or unsubscribe via the World Wide Web, visit > https://dovecot.org/mailman/listinfo/dovecot or, via email, send a message > with subject or body 'help' to dovecot-request(a)dovecot.org You can reach > the person managing the list at dovecot-owner(a)dovecot.org When replying, > please edit your Subject line so it is more specific than "Re: Contents of > dovecot digest..." Today's Topics: 1. Re: .imap folders (Elise) 2. > dovecot+ldap with keepalive (Maciej Milaszewski) > ---------------------------------------------------------------------- > Message: 1 Date: Mon, 28 Dec 2020 17:16:30 +0100 From: Elise To: Aki Tuomi > Cc: Dovecot Mailing List Subject: Re: .imap folders Message-ID: > Content-Type: text/plain; charset=windows-1252; format=flowed Op 28-12-20 > om 12:56 schreef Aki Tuomi: > in your mail location, where you have > specified `mbox:~/...` > > We do not recommend using mbox mail format for > read-write, as the > support for that is limited. Noted, that did the > trick, thanks. /Elise ------------------------------ Message: 2 Date: Mon, > 28 Dec 2020 22:48:19 +0100 From: Maciej Milaszewski To: dovecot(a)dovecot.org > Subject: dovecot+ldap with keepalive Message-ID: Content-Type: text/plain; > charset=utf-8 Hi I have dovecot-2.36.4 (director +5 nodes) - backend to > auth is openldap+keepalived to second ldap For test i shutdown my ldap > server - keepalive? works perfectly VIP switched - ldapserach works ok (all > connect to second ldap) but I noticed strange dovecot behavior - some user > get "no response" or "waiting waiting" in dovecot i use: > auth_cache_negative_ttl = 5 mins auth_cache_size = 20 M auth_cache_ttl = 5 > mins service lmtp { ? inet_listener lmtp { ??? address = 127.0.0.1 > 10.0.100.4 ??? port = 24 ? } ? process_min_avail = 5 protocol lmtp { ? > auth_socket_path = director-userdb ? mail_plugins = quota expire notify > mail_log ? passdb { ??? args = proxy=y nopassword=y port=24 ??? driver = > static ??? name = ? } ? syslog_facility = local3 } in ldap server i have: > idletimeout???? 256 Any idea ? ------------------------------ Subject: > Digest Footer _______________________________________________ dovecot > mailing list dovecot(a)dovecot.org > https://dovecot.org/mailman/listinfo/dovecot ------------------------------ > End of dovecot Digest, Vol 212, Issue 56 > ****************************************

1 0

How to use virtual "All" and "Flagged" mailbox?
by A B 01 Feb '22

01 Feb '22

Hello, I'm trying to use the virtual "All" and "Flagged" mailboxes as described in 15-mailboxes.conf. The information here ( https://doc.dovecot.org/configuration_manual/virtual_plugin/) doesn't really touch on how to actually interact with the virtual mailboxes. My presumption is that when I mark an email message in the Inbox as FLAGGED (and I can confirm the \Flagged flag has been set) then I should then be able to either (1) see a copy of that message in the virtual.Flagged folder, or (2) when I use an imap command to get the message nums or whatever from the virtual.Flagged folder/mailbox, it should return the message that is flagged in the inbox as a result. Additionally, I'm presuming that for each new user that automatically gets added, I would have to create my own script that would add the dovecot-virtual file, dovecot doesn't do that on its own. When I view the user's directory I see these folders were created: --- [snippet] drwxrwx---. 5 vmail vmail 135 Jan 25 17:01 .virtual.All/ drwxrwx---. 5 vmail vmail 158 Jan 25 17:14 .virtual.Flagged/ [.virtual.Flagged]# ll total 20 drwxrwx---. 5 vmail vmail 158 Jan 25 17:14 ./ drwxrwx---. 20 vmail vmail 4096 Jan 25 17:33 ../ drwxrwx---. 2 vmail vmail 6 Jan 25 16:58 cur/ -rw-rw----. 1 vmail vmail 868 Jan 25 16:58 dovecot.index.cache -rw-rw----. 1 vmail vmail 384 Jan 25 17:01 dovecot.index.log -rw-rw----. 1 vmail vmail 51 Jan 25 17:01 dovecot-uidlist -rw-r--r--. 1 vmail vmail 8 Jan 25 17:14 dovecot-virtual -rw-rw----. 1 vmail vmail 0 Jan 25 16:58 maildirfolder drwxrwx---. 2 vmail vmail 6 Jan 25 16:58 new/ drwxrwx---. 2 vmail vmail 6 Jan 25 16:58 tmp [.virtual.Flagged]# cat dovecot-virtual * flagged --- Side note: This set-up uses the php-imap library to interact with Dovecot. Any help, or just concept of how the virtual/All virtual/Flagged directories work would be really appreciated. CONFIGURATION: dovecot -n # 2.3.8 (9df20d2db): /etc/dovecot/dovecot.conf # OS: Linux 4.18.0-348.2.1.el8_5.x86_64 x86_64 CentOS Linux release 8.5.2111 xfs # Hostname: [DOMAIN REDACTED] auth_debug = yes auth_verbose = yes auth_verbose_passwords = yes first_valid_uid = 1000 lda_mailbox_autocreate = yes log_timestamp = "%Y-%m-%d %H:%M:%S " mail_location = maildir:/home/vmail/%d/%n/Maildir mail_plugins = " quota" mbox_write_locks = fcntl namespace { location = virtual:/home/vmail/%d/%n/Maildir/virtual:LAYOUT=maildir++ prefix = virtual. separator = . type = private } namespace inbox { inbox = yes location = mailbox Archive { auto = subscribe special_use = \Archive } mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk { auto = subscribe special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Messages" { auto = subscribe special_use = \Sent } mailbox Trash { auto = subscribe special_use = \Trash } mailbox virtual.All { auto = create comment = All my messages special_use = \All } mailbox virtual.Flagged { auto = create comment = All my flagged messages special_use = \Flagged } prefix = INBOX. separator = . type = private } passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } passdb { driver = pam } plugin { quota = maildir:User quota quota_grace = 10%% quota_max_mail_size = 30M quota_rule = *:storage=100M quota_rule2 = INBOX.Trash:storage=+10M quota_status_nouser = DUNNO quota_status_overquota = 552 5.2.2 Mailbox is full quota_status_success = DUNNO } protocols = imap pop3 service auth-worker { user = root } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0666 user = postfix } unix_listener auth-master { mode = 0600 user = vmail } unix_listener auth-userdb { mode = 0600 user = vmail } user = dovecot } service imap-login { inet_listener imaps { port = 993 ssl = yes } } service pop3-login { inet_listener pop3s { port = 995 ssl = yes } } service quota-status { client_limit = 1 executable = quota-status -p postfix inet_listener { port = 12340 } } service stats { unix_listener stats-reader { group = vmail mode = 0660 user = vmail } unix_listener stats-writer { group = vmail mode = 0660 user = vmail } } ssl = required ssl_cert = </etc/letsencrypt/live/[DOMAIN REDACTED]/fullchain.pem ssl_cipher_list = PROFILE=SYSTEM ssl_key = # hidden, use -P to show it userdb { args = uid=5000 gid=5000 home=/home/vmail/%d/%n allow_all_users=yes driver = static } userdb { driver = passwd } protocol lda { auth_socket_path = /var/run/dovecot/auth-master log_path = /home/vmail/dovecot-deliver.log postmaster_address = postmaster@[DOMAIN REDACTED] } protocol pop3 { pop3_uidl_format = %08Xu%08Xv } protocol imap { mail_plugins = " quota imap_quota virtual" }

2 4

Quota: read how much diskspace is available?
by Hans van Zijst 01 Feb '22

01 Feb '22

Hi, I've been trying to get domain quotas to work for a while, but to no avail so far. Is there a way to let Dovecot simply check how much space is still available in a directory? I'm using GlusterFS as my mailstore, so I can configure quotas per directory. All I need is a way to let Dovecot check quota in a way like "df /var/vmail/<domain>". Kind regards, Hans

1 0

Set mail crypt private password with OAUTH?
by Max Kostikov 31 Jan '22

31 Jan '22

We currently use Dovecot and mailbox encryption via the mail-crypt-plugin. With standard password authentication, we set the value of the individual password to encrypt the contents of the userdb_mail_crypt_private_password mailbox in the SQL query. Is it possible to set the userdb_mail_crypt_private_password value when authenticating via OAUTH2 ? -- Best regards, Max Kostikov

3 16

PLAIN password scheme issue with {}
by Kris von Mach 31 Jan '22

31 Jan '22

Hello, Using PLAIN password scheme and a user having a password with {} for example {RnDR8DaD} causes the authentication to fail: auth-worker(85632): Error: conn unix:auth-worker (uid=143): auth-worker<3333>: sql(user(a)domain.com,123.45.68.78,<EBh0ouPWULvTF5AQ>): Unknown scheme RnDR8DaD Is there some sort of a workaround for this other than requesting user not to use {} at beginning and end of their password?

2 1