- dovecot - dovecot.org

no longer able to delete emails
by Thing 24 Jun '25

24 Jun '25

Hi, I am getting this error in Dovecot, Server Error: UID MOVE: (0.012 + 0.000 + 0.011 secs) and seem unable to send to trash *I think) In the logs i am seeing, 8><---- <W910Ii44SNgAAAAAAAAAAAAAAAAAAAAB>: Error: Mailbox Trash: read() failed with mbox: Input/output error Jun 23 07:30:58 email-001 dovecot: imap(steven)<120035><W910Ii44SNgAAAAAAAAAAAAAAAAAAAAB>: Error: Mailbox Trash: ftruncate() failed with mbox: Structure needs cleaning Jun 23 07:30:58 email-001 dovecot: imap(steven)<120035><W910Ii44SNgAAAAAAAAAAAAAAAAAAAAB>: Logged out in=165 out=1189 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0 Jun 23 07:30:58 email-001 dovecot: imap-login: Login: user=<steven>, method=PLAIN, rip=::1, lip=::1, mpid=120067, secured, session=<WNR1Ii44TNgAAAAAAAAAAAAAAAAAAAAB> Jun 23 07:30:58 email-001 dovecot: imap(steven)<120067> 8><---- I doubt it is Dovecot but I have no idea as Google isnt helping much, any ideas please? I suspect it was a power loss issue as a CB failed on me. regards Steven Hi, I am getting this error in Dovecot, Server Error: UID MOVE: (0.012 + 0.000 + 0.011 secs) and seem unable to send to trash *I think) In the logs i am seeing, 8><---- <W910Ii44SNgAAAAAAAAAAAAAAAAAAAAB>: Error: Mailbox Trash: read() failed with mbox: Input/output error Jun 23 07:30:58 email-001 dovecot: imap (steven)<120035><W910Ii44SNgAAAAAAAAAAAAAAAAAAAAB>: Error: Mailbox Trash: ftruncate() failed with mbox: Structure needs cleaning Jun 23 07:30:58 email-001 dovecot: imap (steven)<120035><W910Ii44SNgAAAAAAAAAAAAAAAAAAAAB>: Logged out in=165 out=1189 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0 Jun 23 07:30:58 email-001 dovecot: imap-login: Login: user=<steven>, method=PLAIN, rip=::1, lip=::1, mpid=120067, secured, session=<WNR1Ii44TNgAAAAAAAAAAAAAAAAAAAAB> Jun 23 07:30:58 email-001 dovecot: imap(steven)<120067> 8><---- I doubt it is Dovecot but I have no idea as Google isnt helping much, any ideas please? I suspect it was a power loss issue as a CB failed on me. regards Steven

2 3

Re: Problem email client iPhone ios18.2
by Michael Slusarz 17 Jun '25

17 Jun '25

Timo confirmed this type of message (see below) breaks iOS mail clients regardless of the IMAP server used. So it is almost certainly a client issue. We are in contact with the Apple Mail developers and have provided this debug information to them. michael > On 02/10/2025 7:19 AM MST Timo Sirainen via dovecot <dovecot(a)dovecot.org> wrote: > > > On 10. Feb 2025, at 15.24, Florian Effenberger via dovecot <dovecot(a)dovecot.org> wrote: > > > > Hello, > > > > frido--- via dovecot wrote on 10.02.25 at 14:07: > >> The problem as described at the start of this thread is not solved in iOS 18.3. A bit more testing shows that it only appears to happen with attachments around 1MB and bigger. > > > > there seem to be two kind of problems, at least on my devices. > > I'm also wondering if there are multiple issues. I have one way of easily reproducing, but it has nothing to do with IMAP IDLE. Here's a test email which causes the hang - snipped it a bit in the middle which you can fill out yourself with: > > dd if=/dev/urandom bs=1024 count=3432 | base64 -w76 > > If you want to test multiple times, change Message-Id for every delivery. This mail can be simply saved to INBOX, e.g. with doveadm save: > > To: <user(a)example.com> > Subject: testing > Content-Type: multipart/mixed; boundary="foo" > Date: Tue, 17 Dec 2024 06:46:17 +0000 > From: <user(a)example.com> > Message-Id: <fooab(a)example.com> > > > > --foo > Content-Type: multipart/alternative; boundary="bar" > > --bar > Content-Transfer-Encoding: quoted-printable > Content-Type: text/html; charset=UTF-8 > > asdf > --bar-- > > --foo > Content-Description: test.pdf > Content-Disposition: attachment; filename="test.pdf" > Content-Transfer-Encoding: base64 > Content-Type: application/octet-stream; name="test.pdf" > > > lBjZO0luFuyUiOqQ8KPTTpMyPoNhlSTPPJauDuCVSwbZgaNyhnObul5qrdyPKo0NGiQKA3Kha34A > <61642 lines of random> > 4cNyk39T2wMsnQavfl8LXwG1vNQylpgmSN4p6fOpmGqQ > > --foo-- > > _______________________________________________ > dovecot mailing list -- dovecot(a)dovecot.org > To unsubscribe send an email to dovecot-leave(a)dovecot.org

3 3

Re: (solved) Dovecot 2.4.1 last-login configuration pattern: Unknown setting: pattern (dict_map_key_field_pattern or dict_map_key_field_service_pattern not found either.)
by Michael Borgelt 16 Jun '25

16 Jun '25

Zitat von Michael Borgelt via dovecot <dovecot(a)dovecot.org>: > Hello, > I am trying to configure last-login plugin for dovecot 2.4.1 and > getting the following error. > > doveconf -n > # 2.4.1-4 (7d8c0e5759): /etc/dovecot/dovecot.conf > # Pigeonhole version 2.4.1-4 (0a86619f) > doveconf: Fatal: Error in configuration file > /etc/dovecot/conf.d/30-lastlogin.conf line 24: pattern: Unknown > setting: pattern (dict_map_key_field_pattern or > dict_map_key_field_service_pattern not found either.) > > I am using the example config from the dovecot 2.4 documentation. > https://doc.dovecot.org/2.4.0/core/plugins/last_login.html#mysql-example > > Is this a bug in the config parser or in the example config? > > doveconf -n output with pattern lines in 30-lastlogin.conf commented: > > # 2.4.1-4 (7d8c0e5759): /etc/dovecot/dovecot.conf > # Pigeonhole version 2.4.1-4 (0a86619f) > # OS: Linux 6.12.27-amd64 x86_64 Debian 13.0 > # Hostname: debian.dg4yfa.org > # 4 default setting changes since version 2.4.0 > dovecot_config_version = 2.4.0 > auth_mechanisms = plain login > auth_username_format = %{user|username|lower} > dovecot_storage_version = 2.4.0 > first_valid_uid = 1000 > fts_autoindex = yes > fts_autoindex_max_recent_msgs = 999 > fts_search_add_missing = yes > imapsieve_url = sieve://127.0.0.1:4190 > language_filters = normalizer-icu snowball stopwords > language_tokenizers = generic email-address > last_valid_uid = 65530 > lda_mailbox_autocreate = yes > mail_driver = maildir > mail_inbox_path = ~/Maildir/.INBOX > mail_path = ~/Maildir > mail_plugins { > virtual = yes > fts = yes > fts_flatcurve = yes > quota = yes > } > mail_privileged_group = mail > protocols { > imap = yes > lmtp = yes > sieve = yes > pop3 = yes > } > quota_storage_size = 1G > sieve_execute_bin_dir = /usr/share/dovecot-pigeonhole/sieve > sieve_global_extensions { > vnd.dovecot.pipe = yes > vnd.dovecot.execute = yes > } > sieve_pipe_bin_dir = /usr/share/dovecot-pigeonhole/sieve > sieve_plugins = sieve_imapsieve sieve_extprograms > passdb pam { > } > userdb passwd { > result_failure = return-fail > result_success = continue > } > userdb passwd-file { > auth_username_format = %{user | username} > passwd_file_path = /etc/dovecot/users > driver = passwd-file > result_failure = return-ok > result_internalfail = continue > } > namespace inbox { > inbox = yes > mailbox Drafts { > special_use = "\\Drafts" > } > mailbox Entw&APw-rfe { > special_use = "\\Drafts" > } > mailbox Junk { > special_use = "\\Junk" > } > mailbox Spam { > special_use = "\\Junk" > } > mailbox Trash { > special_use = "\\Trash" > quota_storage_extra = 100M > } > mailbox Sent { > special_use = "\\Sent" > } > mailbox "Sent Messages" { > special_use = "\\Sent" > } > } > service imap-login { > inet_listener imap { > } > inet_listener imaps { > } > } > service pop3-login { > inet_listener pop3 { > } > inet_listener pop3s { > } > } > service submission-login { > inet_listener submission { > } > inet_listener submissions { > } > } > service lmtp { > unix_listener lmtp { > } > } > service imap { > } > service pop3 { > } > service submission { > } > service auth { > unix_listener auth-userdb { > } > } > service auth-worker { > } > service dict { > unix_listener dict { > } > } > ssl_server { > cert_file = /etc/dovecot/private/dovecot.pem > key_file = /etc/dovecot/private/dovecot.key > } > protocol lda { > mail_plugins { > sieve = yes > } > } > namespace virtual { > mail_driver = virtual > mail_path = ~/Maildir/virtual > prefix = virtual. > separator = . > } > protocol imap { > mail_plugins { > imap_sieve = yes > virtual = yes > imap_quota = yes > last_login = yes > } > } > protocol lmtp { > auth_username_format = %{user | username | lower} > mail_plugins { > sieve = yes > } > } > service managesieve-login { > inet_listener sieve { > port = 4190 > } > inet_listener sieve_deprecated { > port = 2000 > } > } > service managesieve { > } > last_login { > key = # hidden, use -P to show it > precision = ms > dict proxy { > name = sql > } > } > dict_server { > dict sql { > sql_driver = mysql > mysql localhost { > dbname = vmail > password = # hidden, use -P to show it > user = vmail > } > dict_map "shared/last-login/$service/$user/$remote_ip" { > sql_table = last_login > dict_map_value_field last_access { > type = uint > } > dict_map_key_field service { > } > dict_map_key_field userid { > } > dict_map_key_field last_ip { > } > } > } > } > language de { > filters = lowercase snowball > } > language en { > default = yes > filters = lowercase snowball english-possessive stopwords > } > fts flatcurve { > substring_search = yes > } > quota "User quota" { > driver = count > quota_warning warn-95 { > quota_storage_percentage = 95 > execute quota-warning { > args = 95 %{user} > } > } > quota_warning warn-80 { > quota_storage_percentage = 80 > execute quota-warning { > args = 80 %{user} > } > } > } > service quota-warning { > executable = script /usr/local/bin/quota-warning.sh > user = dovecot > unix_listener quota-warning { > user = Debian-exim > } > } > sieve_script personal { > active_path = ~/.dovecot.sieve > driver = file > path = ~/sieve > } > sieve_script default { > driver = file > name = default > path = /etc/dovecot/sieve/default/ > type = default > } > mailbox Spam { > sieve_script report-spam { > cause = copy > path = /usr/lib/dovecot/sieve/report-spam.sieve > type = before > } > } > imapsieve_from Spam { > sieve_script report-ham { > cause = copy > path = /usr/lib/dovecot/sieve/report-ham.sieve > type = before > } > } > > Thank you, > Michael > > > -- > Michael Borgelt > Email: mborgelt(a)borgelt.org > > _______________________________________________ > dovecot mailing list -- dovecot(a)dovecot.org > To unsubscribe send an email to dovecot-leave(a)dovecot.org Hello. I was able to solve the problem by replacing 'pattern' in 'dict_map' configuration with 'value'. With the following config the last_login table in mysql is getting filled as expected: last_login { dict proxy { name = sql } key = last-login/%{service}/%{user}/%{remote_ip} precision = ms } dict_server { dict sql { sql_driver = mysql mysql sql.example.com { dbname = mails user = dovecot password = pass } dict_map shared/last-login/$service/$user/$remote_ip { sql_table = last_login value_field last_access { type = uint } key_field userid { value = $user } key_field service { value = $service } key_field last_ip { value = $remote_ip } } } } The example in the dovecot documentation should be updated accordingly. Regards Michael. -- Michael Borgelt Email: michael(a)borgelt.org -- Michael Borgelt Email: mborgelt(a)borgelt.org

1 0

How do I enable the CDB backend in Dovecot 2.4.1? → “auth: Fatal: Unknown passdb driver ‘cdb’”
by Brent Clark 16 Jun '25

16 Jun '25

Good day everyone, I’m trying to authenticate against a constant database (CDB) file. After reading the /cdb_path/ description in the 2.4.1 manual (⟨https://doc.dovecot.org/2.4.1/core/summaries/settings.html#cdb_path⟩ <https://doc.dovecot.org/2.4.1/core/summaries/settings.html#cdb_path%E2%9F%A9>) I added the following to the conf file.: |passdb cdb { cdb_path = /srv/mail/passwd.cdb } userdb cdb { cdb_path = /srv/mail/passwd.cdb } | But dovecot says |auth: Fatal: Unknownpassdb driver 'cdb'| dovecot --version 2.4.1-4+debian11 (7d8c0e5759) I cant see anything in the changelogs. Is the “cdb” driver still available in 2.4.1, or was it renamed/removed? Any pointers (or a minimal working example) would be greatly appreciated. Kind Regards Brent Clark Good day everyone, I’m trying to authenticate against a constant database (CDB) file. After reading the cdb_path description in the 2.4.1 manual (⟨https:// doc.dovecot.org/2.4.1/core/summaries/settings.html#cdb_path⟩) I added the following to the conf file.: passdb cdb { cdb_path = /srv/mail/passwd.cdb } userdb cdb { cdb_path = /srv/mail/passwd.cdb } But dovecot says auth: Fatal: Unknown passdb driver 'cdb' dovecot --version 2.4.1-4+debian11 (7d8c0e5759) I cant see anything in the changelogs. Is the “cdb” driver still available in 2.4.1, or was it renamed/removed? Any pointers (or a minimal working example) would be greatly appreciated. Kind Regards Brent Clark

3 3

Why would "doveadm mailbox" check certificate file access?
by Ralph Seichter 15 Jun '25

15 Jun '25

The following came as a nasty surprise while testing Dovecot 2.4.1-4: alice@host $ doveadm mailbox list -u $(whoami) doveconf: Fatal: Error in configuration file /etc/dovecot/dovecot.conf line 61: cert_file: open(/path/to/cert.pem) failed: Permission denied Unprivileged user Alice does not have access to cert.pem, nor does she need it. Calling "doveadm flags ..." causes the same error. I suspect other subcommands are affected as well, but did not test it. The technical reason might be that dovecot.conf is parsed for each doveadm invocation? In any case, the certificate access check for subcommands like "flags" or "mailbox" seems like a bug to me. -Ralph

3 4

Migrating to Docker 2.4.1 not show Mailbox elements
by alberto 15 Jun '25

15 Jun '25

Hi, I'm migrating my physical Dovecot Server 2.2.33.2 to a new 2.4.1 (latest) on Docker container installation. I've got auth process successfully (Mariadb + Wforce included), but I cannot see their Maildir mailbox structure and elements, and logging debug not show errors related. I detected in my probe account that when I make logging with the new installation, a new "Maildir" directory into Mailbox structure disk is created, as unique difference that I noted, and perhaps would be a symptom, but I'm not sure. ... imap(probe@mydomain)<20><BpSIoIY3GIpYDjFl>: Info: Mailbox INBOX: Mailbox created ... --- "probe@mydomain" account disk structure --- drwxrwsr-x 7 mail dovecot 4096 dic 19 09:33 .. drwx--S--- 3 dovecot dovecot 4096 jun 14 13:40 Maildir drwxrwsr-x 2 dovecot dovecot 4096 jun 13 20:12 tmp drwxrwsr-x 2 dovecot dovecot 4096 jun 14 12:42 new drwxrwsr-x 2 dovecot dovecot 16384 jun 14 12:47 cur drwx--S--- 3 dovecot dovecot 4096 jun 3 16:02 sieve drwxrwsr-x 5 dovecot dovecot 4096 jun 14 12:57 .Sent drwxrwsr-x 5 dovecot dovecot 4096 nov 9 2020 .spam drwxrwsr-x 5 dovecot dovecot 4096 abr 30 2019 .Drafts drwxrwsr-x 5 dovecot dovecot 4096 jun 14 12:47 .Trash -rw------- 1 dovecot dovecot 212 jul 28 2019 .dovecot.svbin -rw-rw-r-- 1 dovecot dovecot 656 feb 11 02:09 dovecot.index -rw-rw-r-- 1 dovecot dovecot 31832 jun 14 12:47 dovecot.index.cache -rw-rw-r-- 1 dovecot dovecot 26252 jun 14 12:57 dovecot.index.log -rw-rw-r-- 1 dovecot dovecot 7420 ene 16 14:32 dovecot.list.index.log -rw-rw-r-- 1 dovecot dovecot 29 may 4 2019 dovecot-acl-list -rw-rw-r-- 1 dovecot dovecot 10 oct 31 2020 dovecot-keywords -rw------- 1 dovecot dovecot 240 dic 26 16:37 dovecot.mailbox.log -rw------- 1 dovecot dovecot 8 dic 26 16:37 dovecot-uidvalidity -r--r--r-- 1 dovecot dovecot 0 abr 19 2019 dovecot-uidvalidity.5cb9d075 -rw-rw-r-- 1 dovecot dovecot 909 jun 13 20:12 dovecot-uidlist -rw-rw-r-- 1 dovecot dovecot 87 dic 26 16:37 subscriptions --- old other account disk structure --- drwxrwsr-x 7 mail dovecot 4096 dic 19 09:33 .. drwxrwsr-x 2 dovecot dovecot 4096 oct 8 2024 tmp drwxrwsr-x 2 dovecot dovecot 4096 oct 8 2024 new drwxrwsr-x 2 dovecot dovecot 4096 oct 8 2024 cur drwx--S--- 3 dovecot dovecot 4096 may 27 23:38 sieve drwxrwsr-x 5 dovecot dovecot 4096 abr 2 15:37 .Sent drwxrwsr-x 5 dovecot dovecot 4096 may 26 17:03 .spam drwxrwsr-x 5 dovecot dovecot 4096 abr 30 2019 .Drafts drwxrwsr-x 5 dovecot dovecot 4096 sep 4 2020 .Trash lrwxrwxrwx 1 dovecot dovecot 23 may 4 2019 .dovecot.sieve -> sieve/managesieve.sieve -rw------- 1 dovecot dovecot 264 may 5 2019 .dovecot.svbin -rw-rw-r-- 1 dovecot dovecot 816 oct 17 2019 dovecot.index -rw-rw-r-- 1 dovecot dovecot 30152 abr 2 15:35 dovecot.index.log -rw-rw-r-- 1 dovecot dovecot 30884 abr 2 15:35 dovecot.index.cache -rw-rw-r-- 1 dovecot dovecot 146 may 3 2019 dovecot.index.thread -rw-rw-r-- 1 dovecot dovecot 13 may 2 2019 dovecot-keywords -rw-rw-r-- 1 dovecot dovecot 240 oct 17 2019 dovecot.mailbox.log -rw------- 1 dovecot dovecot 8 oct 17 2019 dovecot-uidvalidity -rw-rw-r-- 1 dovecot dovecot 1773 oct 8 2024 dovecot-uidlist -rw-rw-r-- 1 dovecot dovecot 54 oct 17 2019 subscriptions This is my new Docker installation config: # 2.4.1 (7d8c0e5759): /etc/dovecot/dovecot.conf # Pigeonhole version 2.4.1 (0a86619f) # OS: Linux 4.15.0 x86_64 Debian 12.11 # Hostname: midovecot # 4 default setting changes since version 2.4.0 dovecot_config_version = 2.4.0 auth_allow_weak_schemes = yes auth_debug_passwords = yes auth_mechanisms = plain login cram-md5 auth_verbose_passwords = yes debug_log_path = /dev/stdout default_internal_group = vmail default_internal_user = vmail default_login_user = vmail deliver_log_format = msgid=%{msgid}: %{message} (subject=%{subject} from=%{from} To=%{to_envelope} size=%{size}) dovecot_storage_version = 2.4.0 first_valid_gid = 119 first_valid_uid = 108 import_environment { CORE_ERROR = %{env:CORE_ERROR} CORE_OUTOFMEM = %{env:CORE_OUTOFMEM} MALLOC_MMAP_THRESHOLD_ = 131072 PATH = %{env:PATH} TZ = %{env:TZ} } instance_name = midovecot last_valid_gid = 119 last_valid_uid = 108 log_debug = category=mail log_path = /dev/stdout mail_driver = maildir mail_gid = vmail mail_home = /var/mail/%{user|lower} mail_log_events = delete undelete expunge copy mailbox_create mailbox_delete mailbox_rename flag_change append mail_plugins { notify = yes mail_log = yes acl = yes quota = yes } mail_uid = vmail mail_utf8_extensions = yes mailbox_list_layout = index mailbox_list_utf8 = yes protocols = imap lmtp sql_driver = mysql state_dir = /run/dovecot service imap-login { client_limit = 100 process_min_avail = 1 inet_listener imap { port = 0 } inet_listener imaps { port = 31993 ssl = yes } } service imap { } service pop3-login { inet_listener pop3 { port = 0 } inet_listener pop3s { port = 0 ssl = yes } } service pop3 { } service submission-login { inet_listener submission { port = 31587 } inet_listener submissions { port = 31465 } } service submission { } service managesieve-login { client_limit = 100 process_min_avail = 1 inet_listener sieve { port = 34190 } inet_listener sieve_deprecated { port = 2000 } } service managesieve { } service lmtp { unix_listener lmtp { } } service auth { unix_listener auth-userdb { } } service auth-worker { } service dict { unix_listener dict { } } service stats { process_min_avail = 1 inet_listener http { port = 9090 } } service doveadm { inet_listener http { port = 8080 ssl = yes } } mysql mimariadb { dbname = xxxxxx password = # hidden, use -P to show it user = xxxxxxx } passdb sql { default_password_scheme = CRYPT query = SELECT username, domain, home AS userdb_home, uid AS userdb_uid, gid AS userdb_gid, (CASE WHEN '%{mechanism}' = 'CRAM-MD5' THEN crampassword ELSE password END) AS password, concat('*:bytes=', quota) AS userdb_quota_rule, concat('*:messages=', quotamsgs) AS userdb_quota_rule3 FROM users WHERE username = '%{user|username}' AND domain = '%{user|domain}' AND active = 'Y' } userdb sql { iterate_query = SELECT username,domain AS user FROM users query = SELECT home, uid, gid, concat('*:bytes=', quota) AS quota_rule, concat('*:messages=', quotamsgs) AS quota_rule3 FROM users WHERE username = '%{ user | username | lower }' AND domain = '%{ user | domain | lower }' } auth_policy { hash_nonce = # hidden, use -P to show it server_api_header = Authorization: Basic d2ZvcmNlOmllcGE server_url = http://miwforce:8084 } ssl_server { cert_file = /dovecot/albertocerts/fullchain.pem key_file = /dovecot/albertocerts/privkey.pem key_password = # hidden, use -P to show it } namespace inbox { inbox = yes separator = / type = private mailbox Drafts { special_use = "\\Drafts" } mailbox Junk { special_use = "\\Junk" } mailbox Trash { auto = subscribe autoexpunge = 10d special_use = "\\Trash" quota_storage_extra = 100M } mailbox Sent { special_use = "\\Sent" } mailbox "Sent Messages" { special_use = "\\Sent" } } namespace shared { prefix = shared/$user/ type = shared } protocol imap { mail_plugins { imap_filter_sieve = yes imap_acl = yes imap_quota = yes } } protocol lmtp { mail_plugins { sieve = yes } } quota "User quota" { storage_size = 1G quota_warning warn-95 { quota_storage_percentage = 95 execute quota-warning { args = 95 %{user} } } quota_warning warn-80 { quota_storage_percentage = 80 execute quota-warning { args = 80 %{user} } } } service quota-warning { executable = script /dovecot/albertobin/quota-warning.sh user = vmail unix_listener quota-warning { user = vmail } } Best Regards, Alberto

2 8

BUG: extra_groups doesn't accept multiple values
by m＠sacha.pl 14 Jun '25

14 Jun '25

Hello, I'm reporting a bug in the config processor/parser. The option extra_groups does not accept multiple (list) values. If you put a section like: service auth-worker { user = $default_internal_user group = $default_internal_group extra_groups = shadow mail } you will get the error message like: dovecotFatal: service(auth-worker) Group doesn't exist: shadow mail (See service auth-worker { extra_groups } setting) It is trivial to reproduce - just try to run the dovecot with the section like above, and you will get the error. Best regards, Marcin

2 1

Dovecot and xoauth2: oauth2 active_attribute check failed
by Markus Grandpré 14 Jun '25

14 Jun '25

Dear dovecot list members, I am currently working on the task of implementing an MFA solution with OpenID for our SOGo server v5.12.1.20250612-1 and our Dovecot server v2.3.21.1. For this purpose, we are using a Shibboleth IDP v5.1.4 with the appropriate OpenID extension via XOAUTH2. In my opinion, authentication and autorization requests and responses between SOGo and the IDP are working flawlessly, and with: SOGoSMTPAuthenticationType = xoauth2; NGImap4AuthMechanism = xoauth2; the SOGo server forwards the received access token to the Dovecot server. On the Dovecot side, I have configured the server as follows: /etc/dovecot/conf.d/10-auth.conf: disable_plaintext_auth = yes auth_username_format = %Ln auth_master_user_separator = * auth_mechanisms = plain login auth_verbose = yes auth_verbose_passwords = no auth_debug = yes auth_debug_passwords = yes mail_debug = yes verbose_ssl = yes !include auth-master.conf.ext !include auth-oauth2.conf.ext /etc/dovecot/conf.d/auth-oauth2.conf.ext auth_mechanisms = $auth_mechanisms plain xoauth2 oauthbearer passdb { driver = oauth2 mechanisms = xoauth2 oauthbearer args = /etc/dovecot/dovecot-oauth2.conf.ext } userdb { driver = static args = uid=vmail gid=vmail home=/var/vmail/%u } service auth { unix_listener /var/spool/postfix/private/auth { mode = 0660 # Assuming the default Postfix user and group user = postfix group = postfix } } /etc/dovecot/dovecot-oauth2.conf.ext introspection_mode = post introspection_url = https://<ID>>:<SECRET>@idp-test.uni-konstanz.de/idp/profile/oauth2/introspection username_attribute = mail tls_ca_cert_file = /etc/ssl/certs/ca-certificates.crt active_attribute = active active_value = true As soon as the SOGo server contacts the Dovecot server, and the latter contacts the IDP server, I see the following error message in the Dovecot server logs: Jun 13 11:44:47 bamenda dovecot: auth: Debug: http-client[1]: request [Req7: POST https://idp-test.uni-konstanz.de/idp/profile/oauth2/introspection] Free (requests lef t=1) Jun 13 11:44:47 bamenda dovecot: auth: Debug: oauth2(pop519315,134.34.240.55,<kMaO5XA3FrWGIvA3>): Introspection succeeded Jun 13 11:44:47 bamenda dovecot: auth: Debug: oauth2(pop519315,134.34.240.55,<kMaO5XA3FrWGIvA3>): Processing field active Jun 13 11:44:47 bamenda dovecot: auth: Debug: oauth2(pop519315,134.34.240.55,<kMaO5XA3FrWGIvA3>): oauth2 active_attribute check failed: expected active="true" but got "false" Jun 13 11:44:47 bamenda dovecot: auth: oauth2(pop519315,134.34.240.55,<kMaO5XA3FrWGIvA3>): oauth2 failed: Introspection failed: Provided token is not valid Jun 13 11:44:47 bamenda dovecot: auth: Debug: oauth2(pop519315,134.34.240.55,<kMaO5XA3FrWGIvA3>): Finished passdb lookup Jun 13 11:44:47 bamenda dovecot: auth: Debug: auth(pop519315,134.34.240.55,<kMaO5XA3FrWGIvA3>): Auth request finished Is the error on the IDP side, or is there something wrong with my Dovecot configuration, or both? How can I make Dovecot more verbose the way I could see all the tokens exchanged with SOGo and IDP? I would greatly appreciate your help. Best regards, Markus Grandpré -- Markus Ludwig Grandpré Universität Konstanz Kommunikations-, Informations-, Medienzentrum (KIM) Abteilung IT-Dienste Forschung und Lehre, B803, Tel: +49 7531 88 4342

2 1

dovecot-2.4 problems with uid/gid and mbox settings
by "Tóth Attila" 14 Jun '25

14 Jun '25

1. I have a disturbing uid/gid issue: up until dovecot-2.3, dovecot changed its uid/gid to the user it is delivering the mail for. I'm the first user on the system with uid 1000 and the users gid is 100. Therefore I kept first_valid_uid = 1000 and first_valid_gid = 100. Now that I've upgraded to dovecot-2.4, it immediately started to complain about unable to change uid/gid, because it tries to write in user's directory as mail:mail. Mail directories and files in it are accessible only by the owner, not even by the group. So even after lowering first_valid_uid/gid, the operation fails. Are there any configuration options to restore dovecot-2.3 behavior to change uid:gid to the actual user Jun 8 21:40:52 server dovecot: imap(user)<48978><1LgipBQ3LO1/AAAB>: Error: mkdir(/home/user/mail/.imap) failed: Permission denied (euid=8(mail) egid=12(mail) missing +x perm: /home/user/mail, dir owned by 1000:100 mode=0700) Jun 8 21:40:52 server dovecot: imap(user)<48978><1LgipBQ3LO1/AAAB>: Error: mkdir(/home/user/mail/.imap) failed: Permission denied (euid=8(mail) egid=12(mail) missing +x perm: /home/user/mail, dir owned by 1000:100 mode=0700) 2. I know, that mbox is deprecated as of dovecot-2.4 - or that it has been long superseded by more modern formats, but I have a setup for 20+ years (without any problems and less files) and before I would convert it to Maildir, I'd rather provide a transition period and keep using mbox for a little while. During dovecot-2.3 times this was my mail_location setting: mail_location = mbox:~/mail/:INBOX=/var/spool/mail/%u Mails get delivered into /var/spool/mail/user and when dovecot reads them, they get copied under /home/user/mail. Now for dovecot-2.4 I'm forced to came up with this: mail_driver = mbox mail_path = /home/%{user}/mail mail_inbox_path = /var/spool/mail/%{user} #mail_home Are there anyone else with a setup like this struggling with dovecot-2.4? Thanks: Dw. -- dr Tóth Attila, Radiológus, 06-20-825-8057 Attila Toth MD, Radiologist, +36-20-825-8057

2 1

Verifying LDAP configuration from command line ?
by BuzzSaw Code 14 Jun '25

14 Jun '25

Dovecot version : 2.3.x - using RedHat build Years ago I had a Dovecot install that was setup to perform certificate based authentication for clients that worked well - part of that setup was creating a passdb that pointed to a flat file that contained entries like this: cool.joe.c:{PLAIN}::::::username=cooljc and the passdb definition looked like this: passdb { driver = passwd-file args = scheme=plain /etc/dovecot/users.external skip = authenticated mechanisms = EXTERNAL default_fields = uid=vmail gid=vmail nopassword=1 } That worked and we had a cron job that would build that users.external file and keep it up to date. Now, a few years down the road, I've setup a new Dovecot server that is working wonderfully but I'd like to add the same functionality but also use a direct LDAP query instead of managing a flat file to maintain the list of users. I have another passdb entry that is using LDAP that works great for username/password auth, but I'd like to test what I think is a proper LDAP configuration specific for this passdb, But for the life of me I can't find out how to test the configuration file without having to actually update my dovecot configuration to use it. I'm looking for something like the Postfix 'postmap' tool that I can provide my configuration file for the LDAP lookup, give a username input to and it will show me the results from the configuration, including the return values. Is there such a tool ? Or do I have to setup a test server, add it to the config, and debug it ? Sorry if this is FAQ or dumb question - I've been reading documentation on the official Dovecot site looking for the answer but I'm either missing it or I'm reading the wrong docs.

4 3