- dovecot - dovecot.org

dovecot with libsodium on macos 10.13
by Jan Henk Koning 14 Feb '25

14 Feb '25

L.S. My name is Jan Henk Koning I am from the Netherlands and i would like youre help on the following subject. I saw a lot of reactions of you online in regards to questions about getting ARGON2I password hashing scheme available in dovecot. I tried a lot of suggestions and even installed / compiled your dovecot-libsodium-plugin-master which needed a lot of debugging on my system. Unfortunately I can not get it to work. I have dovecot 2.3.21.1 (d492236fa0) installed via macports. I also have mysql8 and php83 all via macports. I understood that I needed to have libsodium installed, so I also installed that via Macports. The problem is that I can not find the way to tell dovecot to use the libsodium plugin. I tried "!include sodium.h" in my 10-auth.conf file, but that does not work. I also edited the portfile of dovecot with the line "--with sodium" no succes. sudo doveadm pw -l gives me: SHA1 SSHA512 SCRAM-SHA-256 BLF-CRYPT PLAIN HMAC-MD5 OTP SHA512 SHA DES-CRYPT CRYPT SSHA MD5-CRYPT PLAIN-MD4 PLAIN-MD5 SCRAM-SHA-1 CLEAR CLEARTEXT SSHA256 MD5 PBKDF2 SHA256 CRAM-MD5 PLAIN-TRUNC SMD5 DIGEST-MD5 LDAP-MD5 I can not find specific instructions for dovecot and sodium installed via Macports on macos. Can you maybe help me in the right direction ? Many thanks in advance, Best regards, Jan Henk Koning

2 1

Migrating from 2.3 to 2.4 Maildir Config Problems
by Asai 13 Feb '25

13 Feb '25

Greetings, We've been using Dovecot since 2007, and I'm migrating yet again to a new version of Dovecot. Going from 2.3 to 2.4 and a lot of things have changed. I've been able to manage many of them, but I'm stuck on Maildir configuration, and I'm unable to understand the documentation as relates to this. Hopefully someone can clarify. Error: Initializing mail storage from mail_driver=maildir setting failed: maildir: maildir settings: Failed to parse configuration: Failed to override configuration from userdb: Invalid maildir=gcmm.net/test/: Setting is a named filter, use 'maildir {' Here's my doveconf as it has been migrated from 2.3 to 2.4 thus far. I realize that there are probably better ways to do things and I'm open to suggestions, but keep in mind that this is a production set up with hundreds of users and I've tried to maintain backwards compatibility through the years. Thanks for your assistance, Asai # 2.4.0 (daeb6bc59c): /etc/dovecot/dovecot.conf # Pigeonhole version 2.4.0 (1b2d5bb9) # OS: Linux 5.14.0-503.23.1.el9_5.x86_64 x86_64 AlmaLinux release 9.5 (Teal Serval) xfs # Hostname: xxxxx dovecot_config_version = 2.4.0 auth_allow_weak_schemes = yes auth_mechanisms = auth_mechanisms { plain = yes login = yes } auth_verbose_passwords = plain debug_log_path = /var/log/dovecot-debug.log default_vsz_limit = 512M deliver_log_format = msgid=%{msgid}: from=%{from}: %{deliver_log_format_extras} dovecot_storage_version = 2.4.0 hostname = xx.xxxx.xxxx log_path = /var/log/dovecot.log mail_driver = maildir mail_fsync = always #mail_home = /vmail/%{user | domain }/%{user | username }/home mail_log_events { delete = yes undelete = yes expunge = yes copy = yes mailbox_delete = yes mailbox_rename = yes flag_change = yes append = yes } mail_log_fields { uid = yes box = yes msgid = yes from = yes flags = yes } #mail_path = /vmail/%{user | domain }/%{user | username } mmap_disable = yes protocols { imap = yes lmtp = yes sieve = yes } sql_driver = mysql submission_relay_host = xxxx.xxxx.xxxxx submission_relay_port = 587 submission_relay_ssl = starttls submission_relay_trusted = yes syslog_facility = local5 mysql localhost { dbname = xxxx password = xxxxx user = postfix } passdb sql { default_password_scheme = PLAIN-MD5 query = SELECT password FROM mailbox WHERE username = '%{user}' } userdb sql { iterate_query = select username from mailbox; query = SELECT maildir, concat('/vmail/',maildir,'home') as home, 1001 AS uid, 1001 AS gid FROM mailbox WHERE username = '%{user}' and active = 1 } #namespace inbox { # inbox = yes # prefix = # separator = / # type = private #mailbox Drafts { # auto = subscribe # special_use { # "\\Drafts" = yes # } #} #mailbox Junk { # auto = subscribe # special_use { # "\\Junk" = yes # } #} #mailbox Spam { # special_use { # "\\Junk" = yes # } #} #mailbox Trash { # auto = subscribe # special_use { # "\\Trash" = yes # } #} #mailbox Sent { # auto = subscribe # special_use { # "\\Sent" = yes # } #} #mailbox "Sent Messages" { # special_use { # "\\Sent" = yes # } #} #mailbox "Sent Items" { # special_use { # "\\Sent" = yes # } #} #} #namespace empty { # prefix = # separator = / # alias_for = inbox # subscriptions = yes # mailbox_list_index_prefix = #} maildir { broken_filename_sizes = yes mail_path = /vmail/%{user | domain }/%{user | username } mail_home = /vmail/%{user | domain }/%{user | username }/home } service imap-login { restart_request_count = unlimited inet_listener imap { port = 143 } inet_listener imaps { port = 993 ssl = yes } } service lmtp { vsz_limit = 512M unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0660 user = postfix } } service imap { process_limit = 4096 vsz_limit = 1024 MB } service auth { user = root unix_listener auth-master { group = vmail mode = 0660 user = vmail } unix_listener auth-userdb { group = vmail mode = 0666 user = vmail } unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } } service auth-worker { } service dict { unix_listener dict { } } ssl_server { cert_file = /etc/postfix/ssl/server.pem dh_file = /etc/dovecot/dh.pem key_file = /etc/postfix/ssl/server.key } service stats { unix_listener stats-reader { group = vmail mode = 0660 user = vmail } unix_listener stats-writer { group = vmail mode = 0660 user = vmail } } protocol lda { } protocol imap { mail_max_userip_connections = 20 mail_plugins { mail_log = yes notify = yes } } protocol lmtp { mail_plugins { sieve = yes } } service managesieve-login { process_min_avail = 0 restart_request_count = 1 vsz_limit = 64M inet_listener sieve { port = 4190 } } service managesieve { process_limit = 1024 } sieve_script personal { active_path = /vmail/%{user | domain }/%{user | username }/home/.dovecot.sieve driver = file path = /vmail/%{user | domain }/%{user | username }/home/sieve } sieve_script before { path = /vmail/sieve/junk-spam.sieve type = before } sieve_script after { path = /vmail/sieve/junk-spam.sieve type = after } mail_debug = yes auth_verbose = yes auth_debug = yes auth_debug_passwords = yes log_debug = category=mail

2 4

Mustiple domains
by Ken Wright 13 Feb '25

13 Feb '25

I host two email servers, example1.com and example2.net. How can I configure Dovecot 2.4 to distinguish between the two? Ken

6 13

Re: suggestion: Argon2id example in `doveadm pw` examples
by Michael Slusarz 13 Feb '25

13 Feb '25

> On 02/08/2025 10:31 PM MST Sean McBride via dovecot <dovecot(a)dovecot.org> wrote: > > It says here https://www.dovecot.org/bugreport-mail/ that bug reports should go to this list. Does that apply to suggestions too? Assuming so... Best practice these days is to file a bug report (or MR) to GitHub. https://github.com/dovecot/ shows the various Dovecot components. We are actively working on improving our various websites, so this updated recommendation will (eventually) work its way on the pages somewhere. > The docs here are very good: > > https://doc.dovecot.org/main/core/man/doveadm-pw.1.html > > but it's always nice to have examples of current best practice. As I understand it, the best password hashing algorithm these days is Argon2id, according to: > > https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet… > > So it would be nice to have an example corresponding to best practices, showing use of argon2id. > > I could attempt a PR on GitHub if you'd like. That would be the proper way to suggest. Do note: as mentioned in another message to the list I just sent, the mission of the Dovecot documentation is to document how the software works. It is not to document email server hosting best practices. Determination of which PW hashing algorithm to use seems to be in the latter category. (Documenting that Dovecot supports argon2id is in scope per the former, but it sounds like we did our job there.) michael

3 2

Dovecot's default password storage scheme is not GDPR compliant
by Rupert Gallagher 13 Feb '25

13 Feb '25

Dovecot aligns the password encryption scheme used by the imap client with the password storage scheme used by the server. Since the default is set to plain text, the client sends the password in plain text (tls tunneled), and the server local storage of passwords is a plain text file. For minimum protection, just enough to say you are not using plaintext, you can use md5, so the client sends the hashed password and the server's local storage is a plain text file containing hashed passwords. Last year a GDPR commissioner filed a hefty monetary sanction to a company because they used md5 to store passwords. Therefore, Dovecot's plain text default, and the md5 option, are both non-GDPR compliant. To avoid monetary sanctions, Dovecot ought to change how it stores passwords by default. Please do not ignore this message.

10 17

dovecot 2.4.0: Unable to build without LDAP/LUA headers/libs.
by h_y_i_e_n＠yahoo.com 13 Feb '25

13 Feb '25

I'm getting LDAP/LUA build errors with dovecot 2.4.0 even when --without-lua and --without-ldap is specified: eg. In file included from db-ldap-settings.c:9: ../../src/lib-ldap/ldap-settings-parse.h:4:10: fatal error: ldap.h: No such file or directory 4 | #include <ldap.h> | ^~~~~~~~ compilation terminated. make[3]: *** [Makefile:2134: auth-db-ldap-settings.o] Error 1

3 2

Configuration rewrite feature is now in main
by Aki Tuomi 12 Feb '25

12 Feb '25

Hi all! We were finally able to merge the content in 2.4.0 + new development to main. We had to rebase it few times before merging, so release-2.4.0 will not match with main exactly. 2.4.1 will be made from main though, so it will be fine again in this regards. Regards, Aki Tuomi

1 0

Re: Dovecot's default password storage scheme is not GDPR compliant
by Michael Slusarz 12 Feb '25

12 Feb '25

GDPR applies to companies operating software, not the software itself. As Aki pointed out (somewhere) in this thread, Dovecot doesn't store passwords itself, and doesn't work unless an admin proactively configures at least one authentication mechanism, so it is "secure by default" under any definition I'm aware of. We might be open to a (short) MR on some language to add to the base authentication configuration page that would alert an admin to possible GDPR requirements. But the Dovecot configuration site is maintained to describe how the software works, not educate on what you might or might not need to do to operate a public mail platform, so the scope of such MR would need to be exceedingly narrow. michael > On 02/12/2025 9:16 AM MST infoomatic via dovecot <dovecot(a)dovecot.org> wrote: > > > On 12.02.25 01:25, Steven Varco via dovecot wrote: > > So, after my mandatory rant :D, the DEFAULT setup of dovecot should actually be as simple as possible. > > > I fully second that. There is no need to discuss whether dovecots > default password storage complies to GDPR or not. The administrator or > the liable person of a company is responsible for taking care about it, > just as Steven Varco mentioned, the same goes with web servers or any > publicly available service. The important point is: you can configure > dovecot complying to the GDPR. > > Because what's next - argue that a web framework is not GDPR compliant > in its standard configuration because there is no cookie consent popup > by default? This is ridiculous. > > Regards, > Robert > _______________________________________________ > dovecot mailing list -- dovecot(a)dovecot.org > To unsubscribe send an email to dovecot-leave(a)dovecot.org

1 0

Re: mailinglist (mailman) + dovecot
by Schulz 12 Feb '25

12 Feb '25

Hello, just have a look at the mailman documentation (hooking up the mail server). Yes, mailman receives mail via LMTP. No, the container is not stateless, mailman processes data on local queue directories that should be persistent. Maybe you want to switch over to the mailman list after consulting the detailed mailman3 documentation. Am 12. Februar 2025 um 15:43 schrieb "Marc" <Marc(a)f1-outsourcing.eu mailto:Marc@f1-outsourcing.eu?to=%22Marc%22%20%3CMarc%40f1-outsourcing.eu%3E >: > > Yes I also don't like to have this on the server. I was just looking at these Dockerfiles they have there. I prefer to have an external stateless container for this. This mailman seems to connect to a database. So I was just wondering how it should receive the emails. > > currently I have sendmail deliver to docker lmtp. > FEATURE(`local_lmtp',`[IPC]',`FILE /var/run/dovecot/lmtp')dnl > > I guess I should be able to deliver remotely with something like this. > dnl FEATURE(`local_lmtp',`[IPC]',`TCP [192.168.xx.xx] 24')dnl > > Just need to figure out how to configure sendmail for what to use when. > > Do you know if you can run mailman in stateless containers because it stores everything in the db? And this lmtp is only for temporary new mail processing? And does it indeed have an 'lmtp" port open? > > > > > we always prefer to separate things, for example in docker containers > > (https://github.com/maxking/docker-mailman is the official one), but > > when you use a python .venv, isolation is already halfway done > > > > > > Am 12. Februar 2025 um 14:38 schrieb "Marc via dovecot" > > <dovecot(a)dovecot.org > > <mailto:dovecot@dovecot.org?to=%22Marc%20via%20dovecot%22%20%3Cdovecot%4 > > 0dovecot.org%3E> >: > > > > I was think of adding a mailinglist for a few users. First I > > thought about maybe using separate container for this, but maybe I can > > just also add this to the server running dovecot. > > > > Anyone having experience with running mailman or something else > > next to dovecot? > > > > > > _______________________________________________ > > dovecot mailing list -- dovecot(a)dovecot.org > > To unsubscribe send an email to dovecot-leave(a)dovecot.org > > >

1 0

mailinglist (mailman) + dovecot
by Marc 12 Feb '25

12 Feb '25

I was think of adding a mailinglist for a few users. First I thought about maybe using separate container for this, but maybe I can just also add this to the server running dovecot. Anyone having experience with running mailman or something else next to dovecot?

1 0