- dovecot - dovecot.org

Shared Mailboxes in Dovecot Cluster & director configuration
by Vincent Brillault 10 Jun '21

10 Jun '21

Hi! I've been trying to set a shared namespace on a test dovecot cluster and I've had some weird issues. I'm not sure if this is a feature or a bug, so please advice. As some features (like acl_ignore_namespace) are only in the upcoming 2.3.15, after some initial debugging, I've update the system I'm using to the master branches (df1b4b8750fdb87d38ac9accb8a1dea02ac3ce2e for core and 7090e62564bcb7bff7efc89bd2a42b1d32d9e475 for pigeonhole), but it didn't change the initial issues I was having. I've been following https://doc.dovecot.org/configuration_manual/shared_mailboxes/cluster_setup/ and linked documentations to set up the cluster. You'll find at the end of the mail the parts of the configuration that seems to be relevant. The issues I've had was with the `You’ll need to setup master user logins to work for all the users.` and `imapc_master_user` (for which the bullet points recommend to use `%{userdb:sharing_user}` but is then set to `%u` in the example. For the sake of the tests, I'm using one director and one backend. On this installation: - user1 shared the folder 'Junk' with user2 - after logging as user2, I run `a2 SELECT shared/user1/Junk` Initially on the director, I had (excluding other, unrelated configuration): ``` # Connection back from backends for shared mailbox access passdb { args = password=XXXX allow_nets=${IPs of backend} driver = static master = yes mechanisms = plain result_success = continue } ``` However, this lead to login failures on the director as the backend was logging directly as user1, without master user set! After further debugging, I now have on the director: ``` # Connection back from backends for shared mailbox access passdb { args = password=XXXX allow_nets=${IPs of backend} driver = static master = yes mechanisms = plain result_success = continue } passdb { args = password=XXXX allow_nets=${IPs of backend} driver = static mechanisms = plain result_success = continue } ``` And this works! Looking at the log, it's not that my `imapc_master_user` is not recognized, just that there are two imapc connections from the backend to the frontend. - The first one logs as user1 directly, with no master user set: ``` ${backend} dovecot[29900]: imap(user2)<29917><Mi/7WD/EgYi8uE1E>: Debug: imapc(${director}:993): Authenticating as user1 ``` - The second connection logs as expected, as user1 with user2 set as the master user: ``` ${backend} dovecot[29900]: imap(user2)<29917><Mi/7WD/EgYi8uE1E>: Debug: imapc(${director}:993): Authenticating as user2 for user user1 ``` Is it normal to have these two connections back to the director? From the documentation, I would have only expected the 2nd one. Going further, if I add a static part to imapc_master_user, like for example `imapc_master_user = X%{userdb:sharing_user}`, the logged authentications become: ``` ${backend} dovecot: imap(user2)<31073><xu94pz/EqYi8uE1E>: Debug: imapc(${director}:993): Authenticating as X for user user1 [...] ${backend} dovecot: imap(user2)<31073><xu94pz/EqYi8uE1E>: Debug: imapc(${director}:993): Authenticating as Xuser2 for user user1 ``` It looks to me that for the first connection, imapc_master_user is resolved with the wrong context, without `userdb:sharing_user` resolving to anything? Thanks in advance, let me know if you need more details. Vincent Brillault PS configuration details (relevant parts of doveconf -n): - Backend: ``` auth_master_user_separator = * imapc_features = fetch-bodystructure fetch-headers rfc822.size search modseq imapc_host = ${director} imapc_master_user = %{userdb:sharing_user} imapc_password = # hidden, use -P to show it imapc_port = 993 imapc_sasl_mechanisms = plain imapc_ssl = imaps imapc_ssl_verify = no mail_plugins = acl zlib virtual fts fts_solr namespace { list = children location = imapc:~/shared/%%u prefix = shared/%%u/ type = shared } namespace Virtual { hidden = yes list = no location = virtual:/etc/dovecot/virtual:INDEX=~/virtual prefix = Virtual/ separator = / subscriptions = no } namespace inbox { inbox = yes location = mailbox "Deleted Items" { auto = subscribe special_use = \Trash } mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox "Sent Items" { auto = subscribe special_use = \Sent } mailbox Spam { auto = create special_use = \Junk } prefix = } passdb { args = password=#hidden_use-P_to_show# allow_nets=${IPs of director} userdb_namespace/shared/disabled=yes driver = static master = yes } passdb { args = password=#hidden_use-P_to_show# allow_nets=${IPs of director} userdb_sharing_user=%u driver = static } plugin { acl = vfile:/etc/dovecot/dovecot-acl acl_ignore_namespace = Virtual/ acl_ignore_namespace2 = shared/* acl_shared_dict = file:/mail/sharing/shared-mailboxes [...] } ``` - Director (final & working version): ``` auth_master_user_separator = * auth_mechanisms = plain login xoauth2 oauthbearer gssapi auth_socket_path = director-userdb passdb { args = /etc/dovecot/passdb-masterusers.conf.ext driver = ldap master = yes mechanisms = plain login result_success = continue } passdb { args = password=#hidden_use-P_to_show# allow_nets=${IPs of backend} driver = static master = yes mechanisms = plain result_success = continue } passdb { args = password=#hidden_use-P_to_show# allow_nets=${IPs of backend} driver = static mechanisms = plain result_success = continue } passdb { args = /etc/dovecot/passdb-oauth2.conf.ext driver = oauth2 mechanisms = xoauth2 oauthbearer result_failure = return-fail result_internalfail = return-fail result_success = continue } passdb { args = /etc/dovecot/passdb-cerndc.conf.ext driver = ldap } ```

2 2

2.3.13 broken submission relay smtp parser
by Tony Hain 09 Jun '21

09 Jun '21

I have a new install of dovecot 2.3.13, along with exim 4.94, in an Azure hosted FreeBSD 12.2 VM. I have been running exim on local hardware with FreeBSD for 15+ years, but dovecot and Azure are a new "learning experience". I am getting an error response in dovecot.log when trying to use the submission relay function, which is apparently new in 2.3... It would appear the parser is either broken or has a character set limitation that no other smtp implementation has. I finally gave up trying to figure out what I might have done wrong in setting up exim and pointed dovecot at mailjet and got the same error. Jun 08 19:39:42 submission(testing(a)dispatch.tndh.net)<89538><lOfAL0zEFNmsOCrh>: Warning: smtp-client: conn in-v3.mailjet.com:587 (104.199.96.85:587) [1]: Received invalid EHLO response line: Unexpected character in EHLO keyword Jun 08 19:39:42 submission(testing(a)dispatch.tndh.net)<89538><lOfAL0zEFNmsOCrh>: Warning: smtp-client: conn in-v3.mailjet.com:587 (104.199.96.85:587) [1]: Received invalid EHLO response line: Unexpected character in EHLO keyword I didn't try the mailjet path with telnet, but I had done that earlier with the local exim server and I can't see any invalid characters, even in the tcpdump pcap file. Jun 08 10:49:42 submission(testing(a)dispatch.tndh.net)<29791><j8NnyETEqV2sOCq3>: Warning: smtp-client: conn 127.0.0.1:58 [1]: Received invalid EHLO response line: Unexpected character in EHLO keyword # telnet localhost 58 Trying 127.0.0.1... Connected to localhost. Escape character is '^]'. 220 secure smtp server ehlo dovecot.tndh.net 250-exim.tndh.net Hello dovecot.tndh.net [127.0.0.1] 250-SIZE 536870912 250-8BITMIME 250-VRFY 250-PIPELINING 250-X_PIPE_CONNECT 250-AUTH CRAM-MD5 250-CHUNKING 250-SMTPUTF8 250 HELP This might be some confusion about starttls on the mailjet path, but if that is true the error message is wrong; and it wouldn't be true for the local exim open smtp port. If it really is smtp, it would be most helpful if the error message actually reported what string it is taking issue with. I have the dovecot-sysreport, but I am not encouraged about sending it when stdout presented: # dovecot-sysreport Gathering configurations ... grep: The -P option is not supportedgrep: The -P option is not supported grep: The -P option is not supported Gathering system informations ... Creating archive ... All done! Please report file dovecot-sysreport-TNDH-mail-1623209001.tar.gz Removing temp files at /tmp/tmp.kphlba44 ... # While dovecot -n stdout presented the line: ssl_key = # hidden, use -P to show it expecting people to put sensitive configuration on a public mail list without knowing what the tool is including is a challenge, but when the tool is errantly using the command line option that is also used for exposing the private data by a related tool, it is even less likely that I want to do that. While the dovecot -n option did hide passwords, it did not hide the username associated with that. I will put dovecot -n (redacted) here, but until I have time to see exactly what the sysreport included, I am not releasing that. # 2.3.13 (89f716dc2): /usr/local/etc/dovecot/dovecot.conf # Pigeonhole version 0.5.13 (cdd19fe3) # OS: FreeBSD 12.2-RELEASE-p4 amd64 ufs # Hostname: TNDH-mail.g4msrgoph2uevil3ys5jvbbpza.jx.internal.cloudapp.net auth_debug = yes auth_debug_passwords = yes auth_verbose = yes debug_log_path = /var/log/dovecot-debug.log disable_plaintext_auth = no first_valid_uid = 220 hostname = dispatch.tndh.net imap_idle_notify_interval = 20 mins info_log_path = /var/log/dovecot-info.log last_valid_uid = 220 log_debug = (event=* AND cat=*) log_path = /var/log/dovecot.log login_greeting = tndh.net Mailer Server Ready ... login_trusted_networks = 127.0.0.1 10.0.0.4 mail_debug = yes mail_location = maildir:/usr/local/var/dovecot/vhosts/%d/%n mail_plugins = mail_log notify notify_status managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext namespace inbox { inbox = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk { auto = subscribe special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox Trash { auto = subscribe special_use = \Trash } mailbox virtual/Flagged { auto = subscribe special_use = \Flagged } prefix = separator = / type = private } passdb { args = username_format=%n /usr/local/var/dovecot/db/%d/passwd driver = passwd-file } plugin { expire = Trash mail_home = /usr/local/var/dovecot/vhosts/%d/%n mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename mail_log_fields = uid box msgid size recipient_delimiter = + sieve = /usr/local/var/dovecot/vhosts/%d/%n/sieve/.dovecot.sieve sieve_after = /usr/local/var/dovecot/vhosts/%d/%n/sieve/sieve-after.d sieve_before = /usr/local/var/dovecot/vhosts/%d/%n/sieve/sieve-before.d sieve_dir = /usr/local/var/dovecot/vhosts/%d/%n/sieve sieve_global_path = /usr/local/var/dovecot/vhosts/sieve/default.sieve } pop3_client_workarounds = outlook-no-nuls oe-ns-eoh protocols = imap pop3 lmtp submission service auth-worker { user = vmail } service imap-login { inet_listener imap { port = 143 } inet_listener imaps { port = 993 ssl = yes } } service stats { unix_listener stats-writer { mode = 0666 } } service submission-login { inet_listener submission { port = 465 ssl = yes } } ssl_cert = </usr/local/etc/dovecot/ssl/certs/dovecot.pem ssl_key = # hidden, use -P to show it submission_relay_host = in-v3.mailjet.com submission_relay_password = # hidden, use -P to show it submission_relay_port = 587 submission_relay_rawlog_dir = /var/log submission_relay_ssl = starttls submission_relay_user = **-as-if-I-want-this-on-a-public-list-** userdb { args = username_format=%n /usr/local/var/dovecot/db/%d/passwd driver = passwd-file } verbose_ssl = yes protocol lmtp { mail_fsync = optimized mail_plugins = mail_log notify notify_status sieve } protocol imap { mail_max_userip_connections = 10 mail_plugins = mail_log notify notify_status imap_sieve } protocol pop3 { mail_max_userip_connections = 10 mail_plugins = mail_log notify notify_status } protocol lda { mail_fsync = optimized mail_plugins = mail_log notify notify_status sieve }

3 5

Dovecot Subfolder Always Uses dot separator with mdbox
by Steven Smith 09 Jun '21

09 Jun '21

I’m trying to configure dovecot to use mailbox subfolders that look like both foo/bar on the IMAP client and the filesystem. But the subfolders created all look like foo.bar, not foo/bar with a proper nesting structure. This also happens when the folder ‘bar’ is moved into the folder ‘foo’—A new folder `foo.bar’ is created. I believe that i’m following the configuration rules at https://wiki.dovecot.org/MailboxFormat/Maildir#Maildir_and_filesystems and https://wiki.dovecot.org/MailLocation/Maildir. This issue happens whether I set separator to its default, ‘.’, or ‘/’: > mail_location = mdbox:/private/var/mail/tld.hostname.mail/%Ln/mdbox:LAYOUT=fs > namespace inbox { > … > separator = / > … > } The IMAP client is macOS Mail.app version 14.0. I’d greatly appreciate any help or pointers to fix this configuration issue. dovecot -n > # 2.3.13 (): /opt/local/etc/dovecot/dovecot.conf > # Pigeonhole version 0.5.13 () > # OS: Darwin 20.4.0 x86_64 apfs > # Hostname: mail.hostname.tld > aps_topic = com.apple.mail.XServer.ffffffff-ffff-fff-ffffffffff > auth_cache_size = 10 M > auth_gssapi_hostname = $ALL > auth_krb5_keytab = /opt/local/etc/dovecot/imap.keytab > auth_mechanisms = plain gssapi > auth_realms =mail.hostname.tld > auth_socket_path = /opt/local/var/run/dovecot/auth-userdb > auth_username_format = %Ln > debug_log_path = /opt/local/var/log/mail/mail-debug.log > disable_plaintext_auth = no > first_valid_gid = 6 > first_valid_uid = 6 > imap_id_log = * > imap_id_send = "name" * "version" * > imap_idle_notify_interval = 29 mins > imap_urlauth_submit_user = submit > info_log_path = /opt/local/var/log/mail/mail-info.log > last_valid_gid = 100 > lda_mailbox_autocreate = yes > log_path = /opt/local/var/log/mail/mail-err.log > login_log_format_elements = user=<%u> method=%m rip=%r lip=%l mpid=%e %c > mail_access_groups = mail > mail_attachment_dir = /private/var/mail/tld.hostname.mail/attachments > mail_attachment_fs = sis posix:mode=0666 > mail_gid = mail > mail_home = /private/var/mail/tld.hostname.mail > mail_location = mdbox:/private/var/mail/tld.hostname.mail/%Ln/mdbox:LAYOUT=fs > mail_log_prefix = "%s(pid %p user %u): " > mail_plugins = quota zlib acl fts fts_solr fts_lucene > mail_privileged_group = mail > mail_uid = _dovecot > managesieve_notify_capability = mailto > managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext imapsieve vnd.dovecot.imapsieve > mdbox_rotate_size = 200 M > namespace inbox { > inbox = yes > location = > mailbox Archive { > auto = subscribe > special_use = \Archive > } > mailbox Drafts { > auto = subscribe > special_use = \Drafts > } > mailbox Junk { > auto = create > special_use = \Junk > } > mailbox Notspam_train { > auto = create > special_use = \Junk > } > mailbox Sent { > auto = subscribe > special_use = \Sent > } > mailbox "Sent Messages" { > special_use = \Sent > } > mailbox Spam_train { > auto = create > special_use = \Junk > } > mailbox Trash { > auto = create > special_use = \Trash > } > prefix = > separator = / > } > passdb { > driver = pam > name = pam > } > plugin { > fts = solr > fts_autoindex = yes > fts_autoindex_exclude = \Junk > fts_solr = url=http://127.0.0.1:8983/solr/dovecot/ > imapsieve_mailbox1_before = file:/opt/local/etc/dovecot/sieve/report-spam.sieve > imapsieve_mailbox1_causes = COPY APPEND > imapsieve_mailbox1_name = Spam_train > imapsieve_mailbox2_before = file:/opt/local/etc/dovecot/sieve/report-ham.sieve > imapsieve_mailbox2_causes = COPY APPEND > imapsieve_mailbox2_name = Notspam_train > mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename > mail_log_fields = uid box msgid from subject size flags > quota_grace = 10%% > quota_rule = *:storage=16G > quota_rule2 = Trash:storage=+256M > quota_warning = storage=100%% quota-exceeded %u > quota_warning2 = storage=80%% quota-warning %u > recipient_delimiter = + > sieve = /private/var/mail/tld.hostname.mail/rules/%Ln/dovecot.sieve > sieve_after = /opt/local/etc/dovecot/sieve-after.d > sieve_before = /opt/local/etc/dovecot/sieve-before.d > sieve_dir = /private/var/mail/tld.hostname.mail/rules/%Ln/%u > sieve_global_extensions = +vnd.dovecot.pipe +vnd.dovecot.environment > sieve_pipe_bin_dir = /opt/local/etc/dovecot/sieve > sieve_plugins = sieve_imapsieve sieve_extprograms > sieve_quota_max_storage = 50M > } > postmaster_address = postmaster(a)hostname.tld > protocols = imap lmtp sieve > quota_full_tempfail = yes > sendmail_path = /opt/local/sbin/sendmail > service auth-worker { > group = mail > user = root > } > service auth { > extra_groups = _keytabusers > idle_kill = 15 mins > unix_listener /opt/local/var/spool/postfix/private/auth { > group = mail > mode = 0660 > user = _postfix > } > } > service dns-client { > unix_listener dns-client { > mode = 0600 > } > } > service imap-login { > inet_listener imap { > address = 127.0.0.1, ::1 > port = 143 > } > inet_listener imaps { > port = 993 > ssl = yes > } > process_min_avail = 6 > service_count = 0 > vsz_limit = 2 G > } > service imap { > process_limit = 200 > process_min_avail = 6 > } > service lmtp { > unix_listener /opt/local/var/spool/postfix/private/dovecot-lmtp { > group = mail > mode = 0660 > user = _postfix > } > } > ssl = required > ssl_ca = </opt/local/etc/certificates/cert.chain.pem > ssl_cert = </opt/local/etc/certificates/cert.cert.pem > ssl_cipher_list = ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256 > ssl_dh = # hidden, use -P to show it > ssl_key = # hidden, use -P to show it > ssl_min_protocol = TLSv1.2 > ssl_prefer_server_ciphers = yes > userdb { > driver = passwd > name = passwd > } > verbose_proctitle = yes > protocol lda { > mail_fsync = optimized > mail_plugins = quota zlib acl fts fts_solr fts_lucene sieve push_notify > } > protocol imap { > mail_max_userip_connections = 50 > mail_plugins = quota zlib acl fts fts_solr fts_lucene imap_acl imap_quota imap_zlib imap_sieve > } > protocol lmtp { > mail_fsync = optimized > mail_plugins = quota zlib acl fts fts_solr fts_lucene sieve > }

2 3

Correct procedure to convert Maildir format to Mdbox
by Marco Usai 09 Jun '21

09 Jun '21

Hi, I need to migrate mail from a shared hosting that stores mail in the Maildir format to another one that uses the Mdbox format. Both hosts use Dovecot, though I don't know what version, because neither has Dovecot command line/ssh utilities available. So I installed Debian 10.9 + Dovecot-imapd (ver.2.3.4.1 stable), then in "/etc/dovecot/conf.d/10-mail.conf" I changed "mail_location = mbox:~/mail:INBOX=/var/mail/%u" to "mail_location = mdbox:~/mdbox" and "#separator =" to "separator = /" . I moved the contents of the folder containing the mail in Maildir format to ~/Maildir/ and then I ran "dsync -v -u user mirror maildir:~/Maildir/". The only users on the system are root and a limited priviledges user, but on the Debian server I didn't recreate any mail account/user that existed on the source server. The conversion command is executed without showing errors: the resulting ~/mdbox folder has a size of 370 MB while the ~/Maildir/ folder was 456 MB. I would like to know if the procedure I followed is correct and if the absence of errors when the command is executed means that the conversion was successful, or if I need to do some other test/check to make sure the whole conversion process is ok. Thank you.

2 1

Panic -Dsync Replication
by Antonino Sidoti 07 Jun '21

07 Jun '21

Hi, I am seeing this; Jun 07 16:17:22 Warning: lmtp(nino(a)sidoti.id.au)<20211><vJkREfC5vWDzTgAAv/fbcw>: replication(nino(a)sidoti.id.au): Sync failure: Timeout in 2 secs Jun 07 16:17:22 Panic: replicator: data stack: Out of memory when allocating 268435496 bytes Jun 07 16:17:22 Fatal: replicator: master: service(replicator): child 77583 killed with signal 6 (core not dumped - https://dovecot.org/bugreport.html#coredumps) It started when I added the following to my configuration; replication_sync_timeout = 2 If I remove the above line then sync works properly and no errors. # 2.3.14 (cee3cbc0d): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.14 (1b5c82b2) # OS: OpenBSD 6.9 amd64 ffs # Hostname: obsd-mx1.stonyrange.com doveadm_password = # hidden, use -P to show it doveadm_port = 2727 hostname = mx1.stonyrange.com listen = * mail_gid = vmail mail_home = /var/vmail/%d/%n/Home mail_location = maildir:/var/vmail/%d/%n/Maildir mail_plugins = " notify replication" mail_uid = vmail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext imapsieve vnd.dovecot.imapsieve namespace inbox { inbox = yes location = mailbox "Deleted Messages" { special_use = \Trash } mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = scheme=BLF-CRYPT /etc/mail/passwd driver = passwd-file } plugin { imapsieve_mailbox1_before = file:/usr/local/lib/dovecot/sieve/report-spam.sieve imapsieve_mailbox1_causes = COPY imapsieve_mailbox1_name = Junk imapsieve_mailbox2_before = file:/usr/local/lib/dovecot/sieve/report-ham.sieve imapsieve_mailbox2_causes = COPY imapsieve_mailbox2_from = Junk imapsieve_mailbox2_name = * mail_replica = tcp:108.160.141.103:2727 replication_sync_timeout = 2 sieve = file:~/sieve;active=~/.dovecot.sieve sieve_global_extensions = +vnd.dovecot.pipe +vnd.dovecot.environment sieve_pipe_bin_dir = /usr/local/lib/dovecot/sieve sieve_plugins = sieve_imapsieve sieve_extprograms } protocols = imap lmtp service aggregator { fifo_listener replication-notify-fifo { user = vmail } unix_listener replication-notify { user = vmail } } service auth { unix_listener auth-userdb { user = vmail } } service doveadm { inet_listener { port = 2727 } user = vmail } service imap-login { inet_listener imap { port = 0 } inet_listener imaps { port = 993 ssl = yes } } service managesieve-login { inet_listener sieve { port = 4190 } } service replicator { drop_priv_before_exec = yes process_min_avail = 1 unix_listener replicator-doveadm { mode = 0600 user = vmail } } ssl = required ssl_cert = </etc/ssl/stonyrange.com.fullchain.pem ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { args = /etc/mail/passwd driver = passwd-file } protocol imap { mail_plugins = " notify replication imap_sieve" } protocol lmtp { mail_plugins = " notify replication sieve" } Antonino Sidoti

2 3

Definitive guide to running ObjectiveFS on top of a Clustered File System?
by Roel van Duijnhoven 06 Jun '21

06 Jun '21

Hey there, I am working on migrating a Dovecot system with + 50.000 users / 5TB on mail data to a new set-up that is better scalable. But I found it difficult to find a good solution. In this email I lay out what I learned, in the hope that others can profit. But also others can help me on this design before I actually start migrating. *My aim is to get a clustered file system setup for Dovecot. But with the additional constraint of not having to pay on a per-mailbox basis to some vendor. * Why a clustered file system? I believe this yields the best solution. Your machines are now stateless: consuming services. And scaling or recovery is now relatively easy. Why the constraint of not paying per-mailbox? If you did pay a fee per mailbox; you probably would be better of just using a managed mail service altogether. High-level ======== We are going to use ObjectiveFS as our clustered file system (not involved with them in any way). They use Fuse to make it behave like a POSIX filesystem. Due to the way they compact files that belong together it handles a large number of small files relatively fine. The great thing is: we can mount this filesystem on multiple machines. This piece of software is proprietary, but it's price is very reasonable, and it is a fixed monthly cost. We can use S3, Google Cloud Storage, or others as the actual storage system. We store metadata about the mailboxes in a database that is available to all machines. We can use any managed database service for this. We explicitly set the proxy_host for each user in this database. Thus every user gets routed to the same machine. We make sure to distributed the users among the available machines. All traffic is received by a TCP load balancer. This will forward the traffic to the underlying machines. Ideally this is a managed cloud service. I think there are two valid choices. But I prefer the first one: - Use a TCP pass-through load balancer. This way the source IP is retained without requiring any change to the protocol (an example of this is Google Cloud external TCP/UDP Network Load Balancing <https://cloud.google.com/load-balancing/docs/network>). - Use an TCP SSL terminating load balancer. And make it forward in HaProxy's PROXY format so we retain the source IP. That traffic is now routed to N-machines. Each of those machines runs Dovecot. And Dovecot is configured with Dovecot Proxy (not to be confused with HaProxy's PROXY protocol). Such that Dovecot will proxy the connection to another machine if required (or continue on this machine if you are already on the correct proxy_host). I believe this can be done using proxy_maybe <https://doc.dovecot.org/configuration_manual/authentication/proxies/>. Depending on the choice of load balancer you may need to configure Dovecot to understand HaProxy's PROXY format. We are going to use the maildir format. And store those files on the ObjectiveFS filesystem. The index to Dovecot is stored on a local SSD. Choice motivations =============== ObjectiveFS: - Can probably be another clustered file system as well. - But ObjectiveFS works quite well because it has support for handling many small files. And can be configured with a local SSD disk. - Using this software can get a clustered file system to run quite easy. Regarding the mailbox format: - dbox is said to be more performant. And having less files is an advantage in general. But one big disadvantage: because the index contains crucial information, you will need to place this index on the Clustered File System as well. Maildir does not have this problem, and that is why we prefer it. - obox is only available as Dovecot Pro, and solves a lot of problems. But you really can only get Dovecot Pro if you pay a fee per mailbox. We don't want that! Why don't use Dovecot Director as well? - You can not run Dovecot Director on the same machine as your Dovecot Backend / proxy. Thus we would need to introduce 2 additional hosts to just accept and route the traffic. This would increase the complexity of our solution. - But it could be build on top of this set-up fairly easy. - I don't see too many advantages for Director however currently. - One big advantage *could* be if it would automatically remove failed nodes. However this only works if you use Dovemon <https://doc.dovecot.org/configuration_manual/dovemon/>. And that is packaged with OX/Dovecot and thus requires paying per user. - So in case you want to put a node down you get a slightly easier API to do so. Namely *doveadm director add <backend server ip> 0*. However we can simply imitate this by updating our database and changing the proxy_host to another destination as well. Load balancer - You could also set-up your MX records to directly point to your Dovecot nodes. This should work as well I guess. - But I think the load balancer makes for better control, over changing and managing DNS. Questions ======== In general I'd like to know whether this is a good idea! But some other questions I have at this point that could make or break this setup: - Can a Dovecot backend instance be configured to *also* run Dovecot proxy? - Can a Dovecot Proxy node receive HaProxy PROXY traffic? Details ===== Once I am sure I am on the right track I'd like to post the settings I use for the software as well. But let's first discuss the stuff above! Best, Roel van Duijnhoven

2 1

possible minor bug: lmtp excessice newlines
by Laura Steynes 06 Jun '21

06 Jun '21

Aki, unnecessary newlines in lmtp received header? Received: from mail6.xxxxxxxxxx.com by mail6.xxxxxxx.com with LMTP id xxxxxxxxxxxxxxxxxx (envelope-from <xxxxxx(a)xxxxxxxx.net>) for <xxx(a)xxxxxxxx.net>; Sat, 05 Jun 2021 14:19:07 +0100 is this intentional Aki ? Evident is multiple clients, in widescreen, so is inot client squashing the header # Dovecot version 2.3.14 # Pigeonhole version 0.5.14 # OS: Linux 5.10.41 x86_64

1 0

Panic on indexer-worker and Dovecot stop to search on Solr
by Alessio Cecchi 03 Jun '21

03 Jun '21

Hi, I have setup on a (little busy) Dovecot server FTS with Solr and Virtual folder to enable "search in all folders" for users. All works fine until for some users the indexer-worker process crash. After this crash Dovecot stop to query Solr for new search in BODY, returning SERVERBUG, for all users on the server and only with a dovecot restart users can search in BODY again. Before the dovecot restart I can see that on Solr server no query from dovecot arriving anymore (for SEARCH BODY because SEARCH in FROM/TO/SUBJECT still works fine) Dovecot version is 2.3.14 (from RPM) and Apache Solr si 7.7.3. Here is the error found in the log: May 31 14:58:13 Panic: indexer-worker(user(a)email.com) session=<VA0oxZ/DXtG5Ydlx:0KzOIkLdtGDSawAAxbYlJw>: file http-client-request.c: line 1240 (http_client_request_send_more): assertion failed: (req->payload_input != NULL) May 31 14:58:13 Error: indexer-worker(user(a)email.com) session=<VA0oxZ/DXtG5Ydlx:0KzOIkLdtGDSawAAxbYlJw>: Raw backtrace: /usr/lib64/dovecot/libdovecot.so.0(backtrace_append+0x42) [0x7f3d91b2cac2] -> /usr/lib64/dovecot/libdovecot.so.0(backtrace_get+0x1e) [0x7f3d91b2cbce] -> /usr/lib64/dovecot/libdovecot.so.0(+0xf3cde) [0x7f3d91b39cde] -> /usr/lib64/dovecot/libdovecot.so.0(+0xf3d81) [0x7f3d91b39d81] -> /usr/lib64/dovecot/libdovecot.so.0(i_fatal+0) [0x7f3d91a8b25a] -> /usr/lib64/dovecot/libdovecot.so.0(http_client_request_send_more+0x3dd) [0x7f3d91ad39ad] -> /usr/lib64/dovecot/libdovecot.so.0(http_client_connection_output+0xf1) [0x7f3d91ad8101] -> /usr/lib64/dovecot/libdovecot.so.0(+0x11d2b0) [0x7f3d91b632b0] -> /usr/lib64/dovecot/libdovecot.so.0(io_loop_call_io+0x65) [0x7f3d91b51f45] -> /usr/lib64/dovecot/libdovecot.so.0(io_loop_handler_run_internal+0x12b) [0x7f3d91b538fb] -> /usr/lib64/dovecot/libdovecot.so.0(io_loop_handler_run+0x59) [0x7f3d91b52049] -> /usr/lib64/dovecot/libdovecot.so.0(io_loop_run+0x38) [0x7f3d91b52288] -> /usr/lib64/dovecot/libdovecot.so.0(http_client_wait+0xcd) [0x7f3d91ae120d] -> /usr/lib64/dovecot/lib21_fts_solr_plugin.so(solr_connection_select+0xe4) [0x7f3d8fca1174] -> /usr/lib64/dovecot/lib21_fts_solr_plugin.so(+0x45d4) [0x7f3d8fc9d5d4] -> /usr/lib64/dovecot/lib20_fts_plugin.so(fts_backend_get_last_uid+0x6e) [0x7f3d90e103fe] -> /usr/lib64/dovecot/lib20_fts_plugin.so(+0xf952) [0x7f3d90e16952] -> /usr/lib64/dovecot/lib20_fts_plugin.so(+0x10ef6) [0x7f3d90e17ef6] -> /usr/lib64/dovecot/lib20_virtual_plugin.so(+0x966a) [0x7f3d90bfc66a] -> /usr/lib64/dovecot/lib20_fts_plugin.so(+0x10ba6) [0x7f3d90e17ba6] -> /usr/lib64/dovecot/libdovecot-storage.so.0(mail_precache+0x2e) [0x7f3d91e3cb0e] -> dovecot/indexer-worker [user(a)email.com Virtual/All - 5300/20832](+0x2924) [0x5648464be924] -> /usr/lib64/dovecot/libdovecot.so.0(io_loop_call_io+0x65) [0x7f3d91b51f45] -> /usr/lib64/dovecot/libdovecot.so.0(io_loop_handler_run_internal+0x12b) [0x7f3d91b538fb] -> /usr/lib64/dovecot/libdovecot.so.0(io_loop_handler_run+0x59) [0x7f3d91b52049] -> /usr/lib64/dovecot/libdovecot.so.0(io_loop_run+0x38) [0x7f3d91b52288] -> /usr/lib64/dovecot/libdovecot.so.0(master_service_run+0x13) [0x7f3d91abcbb3] -> dovecot/indexer-worker [user(a)email.com Virtual/All - 5300/20832](main+0xd7) [0x5648464be1f7] -> /lib64/libc.so.6(__libc_start_main+0xf5) [0x7f3d9169a555] -> dovecot/indexer-worker [user(a)email.com Virtual/All - 5300/20832](+0x22ba) [0x5648464be2ba] May 31 14:58:13 Fatal: indexer-worker(user(a)email.com) session=<VA0oxZ/DXtG5Ydlx:0KzOIkLdtGDSawAAxbYlJw>: master: service(indexer-worker): child 27602 killed with signal 6 (core dumps disabled - https://dovecot.org/bugreport.html#coredumps) on Solr side I found this error log: org.apache.solr.common.SolrException: Early EOF at org.apache.solr.handler.loader.XMLLoader.load(XMLLoader.java:190) at org.apache.solr.handler.UpdateRequestHandler$1.load(UpdateRequestHandler.java:97) at org.apache.solr.handler.ContentStreamHandlerBase.handleRequestBody(ContentStreamHandlerBase.java:68) at org.apache.solr.handler.RequestHandlerBase.handleRequest(RequestHandlerBase.java:199) at org.apache.solr.core.SolrCore.execute(SolrCore.java:2551) at org.apache.solr.servlet.HttpSolrCall.execute(HttpSolrCall.java:733) at org.apache.solr.servlet.HttpSolrCall.call(HttpSolrCall.java:531) at org.apache.solr.servlet.SolrDispatchFilter.doFilter(SolrDispatchFilter.java:395) [...] and [com.ctc.wstx.exc.WstxLazyException] com.ctc.wstx.exc.WstxIOException: Early EOF at com.ctc.wstx.exc.WstxLazyException.throwLazily(WstxLazyException.java:45) at com.ctc.wstx.sr.StreamScanner.throwLazyError(StreamScanner.java:728) at com.ctc.wstx.sr.BasicStreamReader.safeFinishToken(BasicStreamReader.java:3678) at com.ctc.wstx.sr.BasicStreamReader.getText(BasicStreamReader.java:860) at org.apache.solr.handler.loader.XMLLoader.readDoc(XMLLoader.java:419) at org.apache.solr.handler.loader.XMLLoader.processUpdate(XMLLoader.java:260) at org.apache.solr.handler.loader.XMLLoader.load(XMLLoader.java:188) at org.apache.solr.handler.UpdateRequestHandler$1.load(UpdateRequestHandler.java:97) This is the relevant part of dovecot configuration: plugin { fts = solr fts_autoindex = yes fts_decoder = decode2text fts_enforced = body fts_index_timeout = 5s fts_solr = url=http://10.0.1.3:8983/solr/dovecot/ [...] } Is this an already know bug? Any workaround? Thanks -- Alessio Cecchi Postmaster @ http://www.qboxmail.it https://www.linkedin.com/in/alessice

2 4

Dovecot Stats for Logwatch
by Plutocrat 03 Jun '21

03 Jun '21

Hi all, I run logwatch on a few servers and the script on there which parses the dovecot logs provides waaaaaay too much detail, and contains a bunch of stuff I'm not interested in. There's not much point in having a log summary if its 100Kb long! The one for exim is also terrible, but I've replaced that with eximstats, and a bit of bash scripting and have something I can work with. I might at some point look at replacing that too. Now to my question. I haven't found anything in the dovecot family which compares to eximstats. I was wondering if there possibly is a report tool, or a way of extracting stats from doveadm just for key metrics such as 'number of POP logins in the last 24 hours', number of failed passwords, etc. Things that might be interesting on a logwatch report. Or maybe someone has written a script already that can be used in logwatch in perl, python, bash, whatever. Any pointers, suggestions, or ideas for useful summary metrics to pull out of the logfiles are appreciated. I suspect I might end up writing one myself anyway, but I'm just keen to see what already exists, get the benefit of anyone else's experiences in this matter before I start. P.

3 8

fts_autoindex_exclude for everything in a namespace?
by Daniel J. Luke 03 Jun '21

03 Jun '21

Hi, I've recently moved a system from using procmail to delivering via dovecot-lmtp w/ sieve - and it's great! I've got a copy of incoming mail going into mbox archives (that I compress after months end), and my mail log is full of "Error: fts: Failed to sync mailbox #Archive: Mailbox isn't selectable", though. I /think/ fts_autoindex_exclude = #Archive/* is what I want, but it doesn't seem to silence the error. I don't need the #Archive mailboxes visible to clients, but I don't mind if they are. I tried some setting the archive prefix = AutoArchive and setting list = yes, but that didn't silence the error. I feel like I'm probably missing something obvious :) dovecot 2.3.14 / pigenohole 0.5.14 relevant config from dovecot -n: mail_location = mbox:~/Mail/:INBOX=~/.mbox:INDEX=~/.dovecot-indexes mail_plugins = fts fts_lucene zlib namespace { inbox = yes location = mailbox Drafts { auto = no special_use = \Drafts } mailbox Sent { auto = subscribe special_use = \Sent } mailbox Trash { auto = no special_use = \Trash } mailbox spam { auto = create special_use = \Junk } prefix = separator = / } namespace archive { inbox = no list = no location = mbox:~/MailArchive/ prefix = "#Archive/" separator = / } plugin { fts = lucene fts_autoindex = yes fts_lucene = whitespace_chars=@. recipient_delimiter = + sieve = file:~/.sieve;active=~/.dovecot.sieve sieve_default = /usr/local/etc/dovecot/sieve/default.sieve sieve_default_name = file_spam } and the archive sieve script (which works) looks like this: if currentdate :matches "month" "*" { set "month" "${1}"; } if currentdate :matches "year" "*" { set "year" "${1}"; } if true { fileinto :copy :create "#Archive/${year}-${month}"; } -- Daniel J. Luke

1 0