- dovecot - dovecot.org

Disable Dovecot LDA
by Adam Raszkiewicz 02 Apr '20

02 Apr '20

Hi, Is there any way to disable Dovecot LDA? I want to always send email via postfix and relay server even it will be a local delivery within the Dovecot server Thanks, Adam

6 9

auth service stops responding
by Michael Redert 02 Apr '20

02 Apr '20

Hi all, I am running postfix with dovecot configured for local mail delivery. Everything works as expected for a while, but after successfully delivering ~250 mails, dovecot does not accept requests anymore and mails start queueing up in the postfix mailqueue. After restarting dovecot, another ~250 mails are processed and the problem occurs again. The server is running ubuntu 18.04 with dovecot 2.2.33.2 and postfix 3.3.0 installed. Users are stored locally in /etc/dovecot/users. Based on the log messages below and the output of netstat, it seems to me, that the auth service is not accepting any requests on the corresponding socket anymore. Any help is very much appreciated! Kind regards, Michael --- postfix error messages --- Mar 28 09:36:13 srv postfix/lmtp[3850]: 2423F7A21C: to=<system(a)mydomain.de>, relay=srv.mydomain.de[private/dovecot-lmtp], delay=155, delays=0.01/0/0/155, dsn=4.3.0, status=deferred (host srv.mydomain.de[private/dovecot-lmtp] said: 451 4.3.0 <system(a)mydomain.de>Internal error occurred. Refer to server log for more information. (in reply to RCPT TO command)) Mar 28 09:38:48 srv postfix/lmtp[3850]: 45A0C7A2B5: to=<system(a)mydomain.de>, relay=srv.mydomain.de[private/dovecot-lmtp], delay=308, delays=0.01/153/0.02/155, dsn=4.3.0, status=deferred (host srv.mydomain.de[private/dovecot-lmtp] said: 451 4.3.0 <system(a)mydomain.de>Internal error occurred. Refer to server log for more information. (in reply to RCPT TO command)) -- dovecot error messages --- Mar 28 09:36:13 lmtp(2631): user-lookup(system(a)mydomain.de)Error: userdb lookup(system(a)mydomain.de): Request timed out Mar 28 09:36:14 lmtp(2623): user-lookup(system(a)mydomain.de)Error: userdb lookup(system(a)mydomain.de): Request timed out Mar 28 09:38:48 lmtp(2631): user-lookup(system(a)mydomain.de)Error: userdb lookup(system(a)mydomain.de): Connecting timed out Mar 28 09:38:49 lmtp(2623): user-lookup(system(a)mydomain.de)Error: userdb lookup(system(a)mydomain.de): Connecting timed out Mar 28 09:41:23 lmtp(system(a)mydomain.de): Error: userdb lookup(system(a)mydomain.de): Connecting timed out Mar 28 09:41:24 lmtp(system(a)mydomain.de): Error: userdb lookup(system(a)mydomain.de): Connecting timed out --- relevant netstat output when dovecot hangs ---- root@srv:~# netstat | grep dovecot | sort unix 2 [ ] STREAM CONNECTED 1449174 /var/run/dovecot/auth-userdb unix 2 [ ] STREAM CONNECTED 1449995 /var/run/dovecot/auth-userdb unix 2 [ ] STREAM CONNECTING 0 /var/run/dovecot/auth-userdb unix 2 [ ] STREAM CONNECTING 0 /var/run/dovecot/auth-userdb unix 2 [ ] STREAM CONNECTING 0 /var/run/dovecot/auth-userdb unix 2 [ ] STREAM CONNECTING 0 /var/run/dovecot/auth-userdb unix 2 [ ] STREAM CONNECTING 0 /var/run/dovecot/auth-userdb unix 2 [ ] STREAM CONNECTING 0 /var/run/dovecot/auth-userdb unix 2 [ ] STREAM CONNECTING 0 /var/run/dovecot/auth-userdb unix 2 [ ] STREAM CONNECTING 0 /var/run/dovecot/auth-userdb unix 2 [ ] STREAM CONNECTING 0 /var/run/dovecot/auth-userdb unix 2 [ ] STREAM CONNECTING 0 /var/run/dovecot/auth-userdb unix 3 [ ] STREAM CONNECTED 1468180 /var/run/dovecot/config unix 3 [ ] STREAM CONNECTED 1468267 /var/run/dovecot/config unix 3 [ ] STREAM CONNECTED 1468271 /var/run/dovecot/config unix 3 [ ] STREAM CONNECTED 1469651 /var/run/dovecot/config unix 3 [ ] STREAM CONNECTED 1470606 /var/spool/postfix/private/dovecot-lmtp unix 3 [ ] STREAM CONNECTED 1470614 /var/spool/postfix/private/dovecot-lmtp unix 3 [ ] STREAM CONNECTING 0 /var/run/dovecot/auth-userdb unix 3 [ ] STREAM CONNECTING 0 /var/run/dovecot/auth-userdb --- dovecot configuration ---- root@srv:~# dovecot -n # 2.2.33.2 (d6601f4ec): /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.21 (92477967) doveconf: Warning: SSLv2 not supported by OpenSSL. Please consider removing it from ssl_protocols. # OS: Linux 4.19.75-meson64 aarch64 Ubuntu 18.04.4 LTS auth_debug = yes auth_username_format = %n auth_verbose = yes debug_log_path = /var/log/dovecot-info.log default_client_limit = 16 default_process_limit = 32 first_valid_uid = 1000 hostname = mail.mydomain.de info_log_path = /var/log/dovecot-info.log lda_mailbox_autocreate = yes listen = * lock_method = dotlock log_path = /var/log/dovecot.log mail_debug = yes mail_fsync = always mail_location = mbox:~/mail:INBOX=/var/mail/%u mail_privileged_group = mail mmap_disable = yes namespace { inbox = yes location = mailbox { special_use = \Drafts name = Drafts } mailbox { special_use = \Junk name = Junk } mailbox { special_use = \Sent name = Sent } mailbox { special_use = \Sent name = Sent Messages } mailbox { special_use = \Trash name = Trash } prefix = name = inbox } passdb { args = scheme=CRYPT username_format=%u /etc/dovecot/users driver = passwd-file } postmaster_address = postmaster(a)mydomain.de protocols = " imap lmtp pop3" service replication-notify-fifo { name = aggregator } service { client_limit = 102 unix_listener { mode = 00 path = anvil-auth-penalty } name = anvil } service auth-worker { user = root name = auth-worker } service { client_limit = 160 name = auth } service config { name = config } service dict-async { name = dict-async } service dict { name = dict } service login/proxy-notify { name = director } service dns-client { name = dns_client } service doveadm-server { name = doveadm } service imap-hibernate { name = imap-hibernate } service { executable = imap-login -R rawlogs inet_listener { port = 0 name = imap } service_count = 0 vsz_limit = 256 M name = imap-login } service imap-urlauth { name = imap-urlauth-login } service imap-urlauth-worker { name = imap-urlauth-worker } service token-login/imap-urlauth { name = imap-urlauth } service { process_limit = 8 name = imap } service indexer-worker { name = indexer-worker } service indexer { name = indexer } service ipc { name = ipc } service { unix_listener { group = postfix mode = 0660 user = postfix path = /var/spool/postfix/private/dovecot-lmtp } name = lmtp } service log-errors { name = log } service { inet_listener { port = 0 name = pop3 } inet_listener { port = 0 name = pop3s } name = pop3-login } service { process_limit = 4 name = pop3 } service replicator-doveadm { name = replicator } service login/ssl-params { name = ssl-params } service stats-mail { name = stats } ssl = required ssl_cert = </etc/ssl/certs/srv.mydomain.de.pem ssl_cipher_list = ALL:HIGH:!SSLv2:!MEDIUM:!LOW:!EXP:!RC4:!MD5:!aNULL ssl_client_ca_dir = /etc/ssl/certs ssl_dh_parameters_length = 2048 ssl_key = # hidden, use -P to show it ssl_protocols = !SSLv2 !SSLv3 !TLSv1 userdb { args = username_format=%u /etc/dovecot/users driver = passwd-file } verbose_ssl = yes protocol lmtp { service replication-notify-fifo { name = aggregator } service anvil-auth-penalty { name = anvil } service auth-worker { name = auth-worker } service auth-client { name = auth } service config { name = config } service dict-async { name = dict-async } service dict { name = dict } service login/proxy-notify { name = director } service dns-client { name = dns_client } service doveadm-server { name = doveadm } service imap-hibernate { name = imap-hibernate } service imap { name = imap-login } service imap-urlauth { name = imap-urlauth-login } service imap-urlauth-worker { name = imap-urlauth-worker } service token-login/imap-urlauth { name = imap-urlauth } service imap-master { name = imap } service indexer-worker { name = indexer-worker } service indexer { name = indexer } service ipc { name = ipc } service lmtp { name = lmtp } service log-errors { name = log } service pop3 { name = pop3-login } service login/pop3 { name = pop3 } service replicator-doveadm { name = replicator } service login/ssl-params { name = ssl-params } service stats-mail { name = stats } } protocol !indexer-worker { service replication-notify-fifo { name = aggregator } service anvil-auth-penalty { name = anvil } service auth-worker { name = auth-worker } service auth-client { name = auth } service config { name = config } service dict-async { name = dict-async } service dict { name = dict } service login/proxy-notify { name = director } service dns-client { name = dns_client } service doveadm-server { name = doveadm } service imap-hibernate { name = imap-hibernate } service imap { name = imap-login } service imap-urlauth { name = imap-urlauth-login } service imap-urlauth-worker { name = imap-urlauth-worker } service token-login/imap-urlauth { name = imap-urlauth } service imap-master { name = imap } service indexer-worker { name = indexer-worker } service indexer { name = indexer } service ipc { name = ipc } service lmtp { name = lmtp } service log-errors { name = log } service pop3 { name = pop3-login } service login/pop3 { name = pop3 } service replicator-doveadm { name = replicator } service login/ssl-params { name = ssl-params } service stats-mail { name = stats } } protocol lda { service replication-notify-fifo { name = aggregator } service anvil-auth-penalty { name = anvil } service auth-worker { name = auth-worker } service auth-client { name = auth } service config { name = config } service dict-async { name = dict-async } service dict { name = dict } service login/proxy-notify { name = director } service dns-client { name = dns_client } service doveadm-server { name = doveadm } service imap-hibernate { name = imap-hibernate } service imap { name = imap-login } service imap-urlauth { name = imap-urlauth-login } service imap-urlauth-worker { name = imap-urlauth-worker } service token-login/imap-urlauth { name = imap-urlauth } service imap-master { name = imap } service indexer-worker { name = indexer-worker } service indexer { name = indexer } service ipc { name = ipc } service lmtp { name = lmtp } service log-errors { name = log } service pop3 { name = pop3-login } service login/pop3 { name = pop3 } service replicator-doveadm { name = replicator } service login/ssl-params { name = ssl-params } service stats-mail { name = stats } } protocol imap { service replication-notify-fifo { name = aggregator } service anvil-auth-penalty { name = anvil } service auth-worker { name = auth-worker } service auth-client { name = auth } service config { name = config } service dict-async { name = dict-async } service dict { name = dict } service login/proxy-notify { name = director } service dns-client { name = dns_client } service doveadm-server { name = doveadm } service imap-hibernate { name = imap-hibernate } service imap { name = imap-login } service imap-urlauth { name = imap-urlauth-login } service imap-urlauth-worker { name = imap-urlauth-worker } service token-login/imap-urlauth { name = imap-urlauth } service imap-master { name = imap } service indexer-worker { name = indexer-worker } service indexer { name = indexer } service ipc { name = ipc } service lmtp { name = lmtp } service log-errors { name = log } service pop3 { name = pop3-login } service login/pop3 { name = pop3 } service replicator-doveadm { name = replicator } service login/ssl-params { name = ssl-params } service stats-mail { name = stats } } protocol pop3 { service replication-notify-fifo { name = aggregator } service anvil-auth-penalty { name = anvil } service auth-worker { name = auth-worker } service auth-client { name = auth } service config { name = config } service dict-async { name = dict-async } service dict { name = dict } service login/proxy-notify { name = director } service dns-client { name = dns_client } service doveadm-server { name = doveadm } service imap-hibernate { name = imap-hibernate } service imap { name = imap-login } service imap-urlauth { name = imap-urlauth-login } service imap-urlauth-worker { name = imap-urlauth-worker } service token-login/imap-urlauth { name = imap-urlauth } service imap-master { name = imap } service indexer-worker { name = indexer-worker } service indexer { name = indexer } service ipc { name = ipc } service lmtp { name = lmtp } service log-errors { name = log } service pop3 { name = pop3-login } service login/pop3 { name = pop3 } service replicator-doveadm { name = replicator } service login/ssl-params { name = ssl-params } service stats-mail { name = stats } }

1 0

"auth_cache_verify_password_with_worker = yes" does not work with proxy
by Theo Pannen 02 Apr '20

02 Apr '20

Hello, i use a proxy only configuration with version 2.2.22 (Ubuntu 16.04) and have now transferred it to version 2.3.10. This works as before. But as soon as i use "auth_cache_verify_password_with_worker = yes", it does not work anymore. The first login still works, but from the second one, where the answer comes from the cache, there is an error. The login is still accepted but dovecot searches the mailbox locally. The configuration for cache and proxy (from dovecot -n): auth_cache_verify_password_with_worker = yes auth_cache_negative_ttl = 0 auth_cache_size = 64 M passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } The sql from /etc/dovecot/dovecot-sql.conf.ext: password_query = SELECT pwdCrypt AS password, \ NULL AS nopassword, \ 'MyMasterUser' AS master, \ 'MyMasterPass' AS pass, \ ipv4address AS host, \ '%u' AS destuser, \ 'Y' AS proxy \ FROM mailbox \ WHERE user = '%u' AND activeFlg = '1' LIMIT 1 The logfile extracts with "auth_cache_verify_password_with_worker = yes": - First Login from mail.log (work's) Apr 2 12:27:11 mf-19 dovecot: auth: Debug: client in: AUTH#0111#011PLAIN#011service=imap#011secured=tls#011session=6fZiPkyiWHJSZMhl#011lip=178.254.4.122#011rip=93.200.174.28#011lport=143#011rport=29272#011local_name=mf-19.1blu.de#011ssl_cipher=TLS_AES_128_GCM_SHA256#011ssl_cipher_bits=128#011ssl_pfs=KxANY#011ssl_protocol=TLSv1.3 Apr 2 12:27:11 mf-19 dovecot: auth: Debug: client passdb out: CONT#0111 Apr 2 12:27:11 mf-19 dovecot: auth: Debug: client in: CONT<hidden> Apr 2 12:27:11 mf-19 dovecot: auth: Debug: sql(testuser,93.200.174.28,<6fZiPkyiWHJSZMhl>): Performing passdb lookup Apr 2 12:27:11 mf-19 dovecot: auth: Debug: sql(testuser,93.200.174.28,<6fZiPkyiWHJSZMhl>): cache miss Apr 2 12:27:11 mf-19 dovecot: auth-worker(18978): Debug: Loading modules from directory: /usr/lib/dovecot/modules/auth Apr 2 12:27:11 mf-19 dovecot: auth-worker(18978): Debug: Module loaded: /usr/lib/dovecot/modules/auth/lib20_auth_var_expand_crypt.so Apr 2 12:27:11 mf-19 dovecot: auth-worker(18978): Debug: Module loaded: /usr/lib/dovecot/modules/auth/libdriver_mysql.so Apr 2 12:27:11 mf-19 dovecot: auth-worker(18978): Debug: conn unix:auth-worker (pid=18976,uid=109): Server accepted connection (fd=16) Apr 2 12:27:11 mf-19 dovecot: auth-worker(18978): Debug: conn unix:auth-worker (pid=18976,uid=109): Sending version handshake Apr 2 12:27:11 mf-19 dovecot: auth-worker(18978): Debug: conn unix:auth-worker (pid=18976,uid=109): auth-worker<1>: Handling PASSV request Apr 2 12:27:11 mf-19 dovecot: auth-worker(18978): Debug: sql(testuser,93.200.174.28,<6fZiPkyiWHJSZMhl>): Performing passdb lookup Apr 2 12:27:11 mf-19 dovecot: auth-worker(18978): Debug: sql(testuser,93.200.174.28,<6fZiPkyiWHJSZMhl>): query: SELECT pwdCrypt AS password, NULL AS nopassword, 'MyMasterUser' AS master, 'MyMasterPass' AS pass, ipv4address AS host, 'testuser' AS destuser, 'Y' AS proxy FROM mailbox WHERE user = 'testuser' AND activeFlg = '1' LIMIT 1 Apr 2 12:27:11 mf-19 dovecot: auth-worker(18978): Debug: sql(testuser,93.200.174.28,<6fZiPkyiWHJSZMhl>): Finished passdb lookup Apr 2 12:27:11 mf-19 dovecot: auth-worker(18978): Debug: conn unix:auth-worker (pid=18976,uid=109): auth-worker<1>: Finished Apr 2 12:27:11 mf-19 dovecot: auth: Debug: sql(testuser,93.200.174.28,<6fZiPkyiWHJSZMhl>): Finished passdb lookup Apr 2 12:27:11 mf-19 dovecot: auth: Debug: auth(testuser,93.200.174.28,<6fZiPkyiWHJSZMhl>): Auth request finished Apr 2 12:27:11 mf-19 dovecot: auth: Debug: client passdb out: OK#0111#011user=testuser#011master=MyMasterUser#011pass=<hidden>#011host=10.1.2.3#011destuser=testuser#011proxy Apr 2 12:27:11 mf-19 dovecot: imap-login: proxy(testuser): started proxying to 10.1.2.3:143 (master MyMasterUser): user=<testuser>, method=PLAIN, rip=93.200.174.28, lip=178.254.4.122, TLS, session=<6fZiPkyiWHJSZMhl> - Further logins from mail.log (searches locally): Apr 2 12:27:18 mf-19 dovecot: auth: Debug: client in: AUTH#0111#011PLAIN#011service=imap#011secured=tls#011session=L4PQPkyi7plSZMhl#011lip=178.254.4.122#011rip=93.200.174.28#011lport=143#011rport=39406#011local_name=mf-19.1blu.de#011ssl_cipher=TLS_AES_128_GCM_SHA256#011ssl_cipher_bits=128#011ssl_pfs=KxANY#011ssl_protocol=TLSv1.3 Apr 2 12:27:18 mf-19 dovecot: auth: Debug: client passdb out: CONT#0111 Apr 2 12:27:18 mf-19 dovecot: auth: Debug: client in: CONT<hidden> Apr 2 12:27:18 mf-19 dovecot: auth: Debug: sql(testuser,93.200.174.28,<L4PQPkyi7plSZMhl>): Performing passdb lookup Apr 2 12:27:18 mf-19 dovecot: auth: Debug: sql(testuser,93.200.174.28,<L4PQPkyi7plSZMhl>): cache hit: <hidden>#011master=MyMasterUser#011pass=MyMasterPass#011host=10.1.2.3#011destuser=testuser#011proxy=Y Apr 2 12:27:18 mf-19 dovecot: auth: Debug: sql(testuser,93.200.174.28,<L4PQPkyi7plSZMhl>): cache: validating password on worker Apr 2 12:27:18 mf-19 dovecot: auth-worker(18978): Debug: conn unix:auth-worker (pid=18976,uid=109): auth-worker<2>: Handling PASSW request Apr 2 12:27:18 mf-19 dovecot: auth-worker(18978): Debug: conn unix:auth-worker (pid=18976,uid=109): auth-worker<2>: Finished Apr 2 12:27:18 mf-19 dovecot: auth: Debug: sql(testuser,93.200.174.28,<L4PQPkyi7plSZMhl>): Finished passdb lookup Apr 2 12:27:18 mf-19 dovecot: auth: Debug: auth(testuser,93.200.174.28,<L4PQPkyi7plSZMhl>): Auth request finished Apr 2 12:27:18 mf-19 dovecot: auth: Debug: client passdb out: OK#0111#011user=testuser Apr 2 12:27:18 mf-19 dovecot: auth: Debug: master in: REQUEST#011219414529#01118975#0111#011f78b3499f7157a5daf7eb2050cd79e60#011session_pid=18980#011request_auth_token Apr 2 12:27:18 mf-19 dovecot: auth: Debug: static(testuser,93.200.174.28,<L4PQPkyi7plSZMhl>): Performing userdb lookup Apr 2 12:27:18 mf-19 dovecot: auth: Debug: static(testuser,93.200.174.28,<L4PQPkyi7plSZMhl>): Finished userdb lookup Apr 2 12:27:18 mf-19 dovecot: auth: Debug: master userdb out: USER#011219414529#011testuser#011#011auth_mech=PLAIN#011auth_token=e6819f7eac20f6520440abd937322ff13618741f Apr 2 12:27:18 mf-19 dovecot: imap-login: Login: user=<testuser>, method=PLAIN, rip=93.200.174.28, lip=178.254.4.122, mpid=18980, TLS, session=<L4PQPkyi7plSZMhl> Apr 2 12:27:18 mf-19 dovecot: imap(testuser)<18980><L4PQPkyi7plSZMhl>: Debug: Added userdb setting: plugin/=yes Because it is pure proxy there is no userdb configuration and no local user. mail.err therefore contains the error message: Apr 2 12:27:18 mf-19 dovecot: imap(testuser)<18980><L4PQPkyi7plSZMhl>: Error: Couldn't drop privileges: User is missing UID (see mail_uid setting) - Further logins without "auth_cache_verify_password_with_worker = yes" works as expected: Apr 2 12:31:46 mf-19 dovecot: auth: Debug: client in: AUTH#0111#011PLAIN#011service=imap#011secured=tls#011session=9cvDTkyi7XxSZMhl#011lip=178.254.4.122#011rip=93.200.174.28#011lport=143#011rport=31981#011local_name=mf-19.1blu.de#011ssl_cipher=TLS_AES_128_GCM_SHA256#011ssl_cipher_bits=128#011ssl_pfs=KxANY#011ssl_protocol=TLSv1.3 Apr 2 12:31:46 mf-19 dovecot: auth: Debug: client passdb out: CONT#0111 Apr 2 12:31:46 mf-19 dovecot: auth: Debug: client in: CONT<hidden> Apr 2 12:31:46 mf-19 dovecot: auth: Debug: sql(testuser,93.200.174.28,<9cvDTkyi7XxSZMhl>): Performing passdb lookup Apr 2 12:31:46 mf-19 dovecot: auth: Debug: sql(testuser,93.200.174.28,<9cvDTkyi7XxSZMhl>): cache hit: <hidden>#011master=MyMasterUser#011pass=MyMasterPass#011host=10.1.2.3#011destuser=testuser#011proxy=Y Apr 2 12:31:46 mf-19 dovecot: auth: Debug: sql(testuser,93.200.174.28,<9cvDTkyi7XxSZMhl>): Finished passdb lookup Apr 2 12:31:46 mf-19 dovecot: auth: Debug: auth(testuser,93.200.174.28,<9cvDTkyi7XxSZMhl>): Auth request finished Apr 2 12:31:46 mf-19 dovecot: auth: Debug: client passdb out: OK#0111#011user=testuser#011master=MyMasterUser#011pass=<hidden>#011host=10.1.2.3#011destuser=testuser#011proxy Apr 2 12:31:46 mf-19 dovecot: imap-login: proxy(testuser): started proxying to 10.1.2.3:143 (master MyMasterUser): user=<testuser>, method=PLAIN, rip=93.200.174.28, lip=178.254.4.122, TLS, session=<9cvDTkyi7XxSZMhl> Apr 2 12:32:37 mf-19 dovecot: auth-worker(19036): Debug: conn unix:auth-worker (pid=19032,uid=109): Disconnected: Connection closed (fd=-1) Did I forget something in the configuration or is this a bug? Thanks Theo

1 0

[Dovecot] Postfixadmin/MySQL/Dovecot 2 and quota
by Matt 01 Apr '20

01 Apr '20

Hi all, I'm setting up a new email server based on the softwares list below: * Postfix * Dovecot 2.0.9 * MySQL * Postfixadmin 2.3.6 My current problem is I'm unsure whether quota feature is well configured or not. In order to test and validate, I use Roundcubemail GUI which provides percentage of the space used by the mailbox (quota should be applied per mailbox). Here, my dovecot configuration: dovecot.conf: dict { quotadict = mysql:/etc/dovecot/dovecot-dict-quota.conf } dovecot-dict-quota.conf: connect = host=localhost dbname=postfix user=postfix password=postfix map { pattern = priv/quota/storage table = quota2 username_field = username value_field = bytes } map { pattern = priv/quota/messages table = quota2 username_field = username value_field = messages } dovecot-sql.conf.ext: driver = mysql connect = host=localhost dbname=postfix user=postfix password=postfix default_pass_scheme = PLAIN-MD5 password_query = SELECT username AS user, password, \ CONCAT('*:storage=', CAST(quota AS CHAR), 'b') AS quota_rule \ FROM mailbox WHERE username = '%u' AND active='1' user_query = SELECT maildir, 89 AS uid, 12 AS gid, \ concat('dict:storage=',floor(quota/1000),'::proxy::quotadict') AS quota, \ CONCAT('*:storage=', CAST(quota AS CHAR), 'b') AS quota_rule \ FROM mailbox WHERE username = '%u' AND active='1' conf.d/90-quota.conf: plugin { quota = dict:user::proxy::quotadict quota_rule2 = Trash:storage=+10%% } conf.d/20-imap.conf: protocol imap { mail_plugins = $mail_plugins imap_quota } When I check postfixadmin GUI, I can see that quota in realtime in quota2 table, no problem. But Roundcubemail cannot get this information and shows a unknown quota. If I add this line: quota_rule = *:storage=1G in conf.d/90-quota.conf file, it works, I mean roundcubemail gets and shows information (but not the one stored in db of course). I think I'm close to the right configuration but I need your help to complete this setup. Thank you in advance for your help. Best, Matt

7 20

sieve compile error
by Johannes Rohr 01 Apr '20

01 Apr '20

Dear all, I try to recompile my learn_ham.sieve script, which fails with the message root@ida:/etc/dovecot# sievec sieve-scripts/report-ham.sieve report-ham: line 1: error: require command: unknown Sieve capability `vnd.dovecot.pipe'.report-ham: line 1: error: require command: unknown Sieve capability `imapsieve'.report-ham: line 19: error: unknown command 'pipe' (only reported once at first occurrence).report-ham: error: validation failed.sievec(root): Fatal: failed to compile sieve script 'sieve-scripts/report-ham.sieve' Yes, in conf.d/20-imap.conf, imapsieve and vnd.dovecot.pipe are explicitly enabled: protocol imap { mail_plugins = $mail_plugins imap_sieve imap_acl mail_max_userip_connections = 50 plugin {sieve_plugins = sieve_imapsieve sieve_extprograms # From elsewhere to Spam folder imapsieve_mailbox1_name = Spam imapsieve_mailbox1_causes = COPY imapsieve_mailbox1_before = file:/etc/dovecot/sieve-scripts/report-spam.sieve # From Spam folder to elsewhere imapsieve_mailbox2_name = * imapsieve_mailbox2_from = Spam imapsieve_mailbox2_causes = COPY imapsieve_mailbox2_before = file:/etc/dovecot/sieve-scripts/report-ham.sieve#sieve_pipe_bin_dir = /etc/dovecot/sieve-scriptssieve_global_extensions = +vnd.dovecot.execute +vnd.dovecot.pipe }} I am obviously overlooking something here, but what? Any hints will be greatly appreciated! Johannes

2 2

Re: limit for user exceeded
by Maciej Milaszewski 31 Mar '20

31 Mar '20

Hi I Dont understand or I im thinking wrong: process_limit = 25000 Older: #fs.inotify.max_user_watches= 8192 #fs.inotify.max_user_instances = 16384 New: fs.inotify.max_user_instances = 8192 fs.inotify.max_user_watches= process_limit x 2 + fs.inotify.max_user_instances fs.inotify.max_user_watches= 58192 On 31.03.2020 13:44, Aki Tuomi wrote: > I would prefer replies on the list... =) > > no. the idea is to *increase* the *current* value of fs.inotify.max_user_watches and fs.inotify.max_user_instances with 50000 > > fs.inotify.max_user_watches = 8192 + 50000 = 58192 > > Aki > >> On 31/03/2020 14:21 Maciej Milaszewski <maciej.milaszewski(a)iq.pl> wrote: >> >> >> Hi >> How I understood it correctly >> >> service imap { >> process_limit = 25000 >> } >> >> fs.inotify.max_user_watches= 50000 >> fs.inotify.max_user_instances = 50000 >> >> ? >> >> >> On 31.03.2020 12:14, Aki Tuomi wrote: >>> Sorry, ment that we *increase* the current value with twice the process limit for IMAP. >>> >>> Aki >>> >>>> On 31/03/2020 13:12 Aki Tuomi <aki.tuomi(a)open-xchange.com> wrote: >>>> >>>> >>>> We usually set them to twice the number of process_limit for imap. >>>> >>>> Aki >>>> >>>>> On 31/03/2020 12:29 Maciej Milaszewski <maciej.milaszewski(a)iq.pl> wrote: >>>>> >>>>> >>>>> Hi >>>>> System debian 8.11 dovecot-2.2.36.4 and I have some warnings in log likes: >>>>> >>>>> Warning: Inotify watch limit for user exceeded, disabling. Increase >>>>> /proc/sys/fs/inotify/max_user_watches >>>>> >>>>> >>>>> cat /proc/sys/fs/inotify/max_user_watches >>>>> 8192 >>>>> >>>>> in sysctl i change >>>>> >>>>> #fs.inotify.max_user_watches= 8192 >>>>> #fs.inotify.max_user_instances = 16384 >>>>> >>>>> fs.inotify.max_user_watches= 16384 >>>>> fs.inotify.max_user_instances = 24576 >>>>> >>>>> One questions - should these values be equal?

1 0

mail_crypt crashing randomly during LMTP
by Andi Krischer 31 Mar '20

31 Mar '20

Hello everybody, hope you’re all well! We have a really strange bug with our dovecot setup. After weeks and month of debugging we’re finally reached the point when we ask you for help. Our basic setup is quite simple: a single dovecot 2.3.10 (0da0eff44) install on Debian 10 with LDAP as user/passdb and sieve, imap_sieve and mail_crypt as mail_plugins. For the mail_crypt we have a special rule which allows us to enable crypting for each user individually. See this line from dovecot-ldap.conf.ext: pass_attrs = userPassword=password,=userdb_mail_plugins=%{if;%{real_lport};eq;993;imap_sieve;} %{if;%{real_lport};eq;143;imap_sieve;} notify mail_log %{if;%{ldap:encryptMail};eq;TRUE;mail_crypt; },=userdb_mail_crypt_private_password=%w As you can see for IMAP connections we enable imap_sieve and if the LDAP attribute “encryptMail” is set to TRUE we enable “mail_crypt” as mail_plugin. This works fine except that around 5-10 times a day the dovecot server crashes during a LMTP connection. It crashes in the last steps of LMTP which result that the mail get delivered to Maildir but Postfix doesn’t get a positive response and delivers the mail again after a few minutes. So all of our users get some mails twice or even more times. This is what the log says in the moment of crashing: dovecot: lmtp(53852): Panic: Module context mail_crypt_user_module missing *** backtrace *** (see: https://pastebin.com/YCiFtxmy) dovecot: lmtp(53852): Fatal: master: service(lmtp): child 53852 killed with signal 6 (core dumps disabled - https://dovecot.org/bugreport.html#coredumps) Here I’ve pasted the LTMP session in mail.log: https://pastebin.com/A4ughNUF Obviously it looks like it has something to do with our mail_crypt setup. But the thing is that although we’re monitoring this for months we cannot find a condition which cause this. It seems to happen more frequent for mails with lot of people in To or CC (large headers), but definitively not all of them… Some more things we’ve already thought on: First my guess was that the mail_crypt plugin isn’t loaded in some case but in the backtrace are things from “lib10_mail_crypt_plugin.so”, so it should be loaded, right? On the other hand a non-crashing LTMP session looks exactly the same in log except it has three additional lines in mail.log: Debug: Loading modules from directory: /usr/lib/dovecot/modules Debug: Module loaded: /usr/lib/dovecot/modules/lib15_notify_plugin.so Debug: Module loaded: /usr/lib/dovecot/modules/lib20_mail_log_plugin.so My college already had a look in the source code, but this didn’t make us much smarter. Here his references: mail context is defined here: https://github.com/dovecot/core/blob/81b5b188c478ec36bea8bda8fcad1e5f32ac61… and removed again here: https://github.com/dovecot/core/blob/81b5b188c478ec36bea8bda8fcad1e5f32ac61… Does any of the experts on this list have an idea what could cause these crashes and how to fix them? Thanks in advance! Best, Andi

2 5

limit for user exceeded
by Maciej Milaszewski 31 Mar '20

31 Mar '20

Hi System debian 8.11 dovecot-2.2.36.4 and I have some warnings in log likes: Warning: Inotify watch limit for user exceeded, disabling. Increase /proc/sys/fs/inotify/max_user_watches cat /proc/sys/fs/inotify/max_user_watches 8192 in sysctl i change #fs.inotify.max_user_watches= 8192 #fs.inotify.max_user_instances = 16384 fs.inotify.max_user_watches= 16384 fs.inotify.max_user_instances = 24576 One questions - should these values be equal?

2 2

IMAP error
by Roy Lemmon 30 Mar '20

30 Mar '20

Hi, I am trying to setup a dovecot server on my laptop to serve my emails to emacs gnus. The emails are pulled from the mail server using isync into particular directories. I am using a Guix system. The dovecot service is running. I can telnet into it with: telnet localhost 143 Trying 127.0.0.1... Connected to localhost. Escape character is '^]'. * OK [CAPABILITY IMAP4rev1 SASL-IR LOGIN-REFERRALS ID ENABLE IDLE LITERAL+ STARTTLS AUTH=PLAIN] Dovecot ready. However if I then do: b select inbox b BAD Error in IMAP command received by server I have not logged in as I have not set any username or password. I assumed that access was open on localhost. Is this not correct ? I am not sure how to check further. I have checked the configuration and it is pointing to my email directories, imap is enabled etc. Thanks Roy.

2 2

Panic/Assert dns-lookup.c
by tim＠linux-daus.de 30 Mar '20

30 Mar '20

Hi, currently we deploying Dovecot as imap/pop3 proxy. Every few minutes some panic/assert occurred (we connect roughly 7k - 8k user at one imap proxy with a connection rate of 200/s). We activate core dumps. Concerning the sensitive information in the dump we would prefer to not share the dump (e.g. i found our ssl private key in the dump). Log/Stack trace: Mar 30 15:54:06 imap16 dovecot: auth: Panic: file dns-lookup.c: line 371 (dns_client_lookup_common): assertion failed: (param != NULL && *param != '\0') Mar 30 15:54:06 imap16 dovecot: auth: Error: Raw backtrace: #0 t_askpass[0x7f27a219b5f0] -> #1 backtrace_append[0x7f27a219b860] -> #2 backtrace_get[0x7f27a219b9c0] -> #3 i_syslog_error_handler[0x7f27a21a6840] -> #4 i_syslog_fatal_handler[0x7f27a21a6970] -> #5 i_fatal[0x7f27a20fc3b7] -> #6 dns_client_connect[0x7f27a216ffb0] -> #7 dns_client_lookup[0x7f27a21702a0] -> #8 auth_request_proxy_finish[0x55c930e9b200] -> #9 auth_request_handler_reply[0x55c930e9cee0] -> #10 auth_policy_check[0x55c930e93a10] -> #11 auth_request_success[0x55c930e9bcf0] -> #12 auth_request_verify_plain_callback_finish[0x55c930e9a650] -> #13 auth_request_verify_plain_callback[0x55c930e9a7a0] -> #14 authdb_ldap_deinit[0x7f279faa9f10] -> #15 db_ldap_result_iterate_deinit[0x7f279faa7f70] -> #16 io_loop_call_io[0x7f27a21c0490] -> #17 io_loop_handler_run_internal[0x7f27a21c1e20] -> #18 io_loop_handler_run[0x7f27a21c05c0] -> #19 io_loop_run[0x7f27a21c0810] -> #20 master_service_run[0x7f27a212d5b0] -> #21 main[0x55c930e8dd10] -> #22 __libc_start_main[0x7f27a14901f0] -> #23 _start[0x55c930e8e2c0] -> #24 [no start/end information] Mar 30 15:54:06 imap16 dovecot: auth: Fatal: master: service(auth): child 6133 killed with signal 6 (core dumped) Config: # 2.3.9.2 (844fc8246): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.9 (db4e9a2f) # OS: Linux 4.9.0-12-amd64 x86_64 Debian 9.12 # Hostname: imap16.domain.de auth_default_realm = domain.de auth_failure_delay = 0 auth_mechanisms = plain login cram-md5 auth_username_format = %{if;%d;eq;domain.de;%n(a)olddomain.de;%u} auth_verbose = yes base_dir = /var/run/dovecot/ default_client_limit = 4096 default_internal_user = pop default_process_limit = 400 default_vsz_limit = 1 G doveadm_password = # hidden, use -P to show it first_valid_uid = 48 import_environment = TZ last_valid_uid = 48 login_trusted_networks = 192.168.11.0/24 mail_gid = pop mail_plugins = " mail_log notify zlib quota" mail_uid = pop passdb { args = /etc/dovecot/conf.d/dovecot-ldap-domain-proxy.conf.ext driver = ldap result_failure = return-fail result_success = continue-ok } passdb { args = allow_real_nets=192.168.11.0/24 driver = static result_failure = continue-ok } passdb { args = /etc/dovecot/conf.d/dovecot-ldap-domain-protocol-deny.conf.ext driver = ldap result_failure = return-ok result_success = return-fail } passdb { args = /etc/dovecot/passdb-domain-ldap-cram.conf.ext driver = ldap mechanisms = CRAM-MD5 result_failure = continue-fail result_success = continue-ok } passdb { args = /etc/dovecot/passdb-domain-ldap.conf.ext driver = ldap mechanisms = LOGIN,PLAIN result_failure = return-fail result_success = continue-ok } plugin { mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename mail_log_fields = uid box msgid size zlib_save = gz zlib_save_level = 6 } protocols = " imap pop3" service auth { unix_listener auth-client { group = dovecot_auth mode = 0660 user = $default_internal_user } } service doveadm { group = pop inet_listener { port = 12345 } user = pop } service imap-login { process_min_avail = 24 service_count = 0 } service pop3-login { process_min_avail = 24 service_count = 0 } ssl = required ssl_cert = </etc/ssl/certs/star_domain_de.crt ssl_cipher_list = ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA:ECDHE-ECDSA-AES128-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-RSA-CAMELLIA128-SHA:DHE-RSA-CAMELLIA256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:CAMELLIA128-SHA:CAMELLIA256-SHA ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it verbose_proctitle = yes

2 4