- dovecot - dovecot.org

changing cipher for imap clients
by Fourhundred Thecat 29 Oct '19

29 Oct '19

When my client connects, I see this in my log: dovecot: imap-login: TLSv1 with cipher ECDHE-RSA-AES128-SHA (128/128 bits) Whereas, when client connects to my postfix server, I see: Anonymous TLS connection established from * TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits) how can I tell dovecot to use AES256, instead of AES128 ? is this set by ssl_cipher_list ? Here are my current values (defaults) # doveconf ssl_cipher_list ssl_cipher_list = ALL:!kRSA:!SRP:!kDHd:!DSS:!aNULL:!eNULL:!EXPORT:!DES:!3DES:!MD5:!PSK:!RC4:!ADH:!LOW@STRENGTH # dovecot --version 2.3.4.1 thanks,

4 4

Dovecot and MySQL aborted connections.
by Reio Remma 28 Oct '19

28 Oct '19

Is anyone else using Dovecot (2.3.8) with MySQL (5.7) seeing a lot of these in MySQL logs? 2019-10-28T11:08:20.384428+02:00 58378 [Note] Aborted connection 58378 to db: 'vmail' user: 'vmail' host: 'localhost' (Got an error reading communication packets) 2019-10-28T11:10:09.821171+02:00 58420 [Note] Aborted connection 58420 to db: 'vmail' user: 'vmail' host: 'localhost' (Got an error reading communication packets) 2019-10-28T11:11:26.170015+02:00 58441 [Note] Aborted connection 58441 to db: 'vmail' user: 'vmail' host: 'localhost' (Got an error reading communication packets) 2019-10-28T11:13:14.091426+02:00 58459 [Note] Aborted connection 58459 to db: 'vmail' user: 'vmail' host: 'localhost' (Got an error reading communication packets) They've plagued my logs for as long as I can remember. Is Dovecot not closing connections to the database properly or something similar? Reio

3 3

Dovecot list breaks DKIM.
by Reio Remma 28 Oct '19

28 Oct '19

Hello again, I noticed mails from the Dovecot list break DKIM signatures. Perhaps it's something to look at? Most lists I'm on manage to pass messages with DKIM intact. Authentication-Results: abc.abc.abc; dkim=fail (rsa verify failed) header.d=mrstuudio.ee header.s=mr header.b=M03Fp5lE; dmarc=pass (policy=none) header.from=dovecot.org; spf=pass Thanks, Reio

1 0

SQL iterate_query
by Daniel Miller 28 Oct '19

28 Oct '19

I've been hunting some ghost mailboxes - and I *think* I found the source. I use the complete email address as the username, and store such in a database. The storage structure is location=/var/mail/%d/%n. Not unusual I think. So all I *should* see from "ls /var/mail" would be a list of domains. But I keep seeing empty mailboxes being created at this level. Having corrected a few other errors I *hope* I've found the last one - but if I'm right I believe the docs need updating: The examples given for SQL userdb's include: iterate_query = SELECT userid AS username, domain FROM users So this means the username is returned for *both* the username and domain. Even if I'm wrong as to the cause of my own troubles this can't be right. It just can't. Or am I mistaken? So, given that the complete address is used as the username I now use: iterate_query = SELECT username FROM mailbox (I'm using postfixadmin to administer this - and "mailbox" is the default user table name) I believe the alternative would be an explicit: iterate_query = SELECT username, domain AS username, domain FROM users I don't *think* that would make any security difference for my use case so why add the extra processing? I believe the documentation should be updated, or at least clarified, on this issue. -- Daniel

2 1

Configure to only receive recent mail?
by lty 28 Oct '19

28 Oct '19

I am looking for imap or pop3 to receive only the most recent emails. Virtual-plugin seems to meet my needs https://doc.dovecot.org/configuration_manual/virtual_plugin/#virtual-plugin > List messages from past 48 hours (syntax is in seconds): > # ~/Maildir/virtual/recent/dovecot-virtual > INBOX > work/* > all younger 172800 but this will create a virtual/*, I want to control the real INBOX. The user can set the email for how long it takes to set itself, for example, within 3 months by default.This way you can use all the mail to display to the client. Does dovecot support such a configuration?

1 0

Dovecot Index Corruption and dovecot-uidlist Issues
by Billy Luedtke 25 Oct '19

25 Oct '19

Hello, We have recently implemented dovecot directors to resolve an ongoing NFS lock/corruption issue. Everything was working great! So we updated our servers from centos 7.3 to 7.7 and dovecot 2.2.10 to 2.3.8 This was a bit of a failure and we were getting spammed with corrupt index files and logs. After we clear the index files with rm rf/mail/d/e/username/Maildir/dovecot*, they just come back in. From: dovecot-mysql-2.3.8-4.x86_64 dovecot-2.3.8-4.x86_64 dovecot-pigeonhole-2.3.8-4.x86_64 To: dovecot-2.2.10-8.el7.x86_64 dovecot-mysql-2.2.10-8.el7.x86_64 dovecot-pigeonhole-2.2.10-8.el7.x86_64 We rolled back nfs-utils and libs due to a case on redhats bug report "https://bugzilla.redhat.com/show_bug.cgi?id=1521071" libnfsidmap-0.25-19.el7.x86_64 nfs-utils-1.3.0-0.65.el7.x86_64 to libnfsidmap-0.25-15.el7.x86_64 nfs-utils-1.3.0-0.33.el7.x86_64 We rolled back our dovecot version to 2.2.10 and are still getting the following logs. Any advice would help Network view: |Dovecot Directors x 3| | |Dovecot servers x4| Storage is shared between all 4 servers | |Netapp NFSv3 Storage| Nothing changed here Oct 25 01:33:25 <IP> dovecot: imap(<username>): Error: Log synchronization error at seq=89,offset=32340 for /mail/j/k/<username>/Maildir/dovecot.index: Extension record update for invalid uid=6798 Oct 25 01:33:25 <IP> dovecot: imap(<username>): Error: Log synchronization error at seq=89,offset=32384 for /mail/j/k/<username>/Maildir/dovecot.index: Extension record update for invalid uid=6798 Oct 25 01:33:25 <IP> dovecot: imap(<username>): Error: Synchronization corrupted index header /mail/j/k/<username>/Maildir/dovecot.index: first_recent_uid 6799 > next_uid 6798 Oct 25 01:33:25 <IP> dovecot: imap(<username>): Warning: fscking index file /mail/j/k/<username>/Maildir/dovecot.index Oct 25 01:33:25 <IP> dovecot: imap(<username>): Error: Fixed index file /mail/j/k/<username>/Maildir/dovecot.index: first_recent_uid 6799 -> 6798 Oct 25 01:33:26 <IP> dovecot: imap(<username>): Error: Broken file /mail/j/k/<username>/Maildir/dovecot-uidlist line 6461: Invalid data: Oct 25 01:33:26 <IP> dovecot: imap(<username>): Error: Log synchronization error at seq=89,offset=32488 for /mail/j/k/<username>/Maildir/dovecot.index: Append with UID 6798, but next_uid = 6799 Oct 25 01:33:26 <IP> dovecot: imap(<username>): Warning: fscking index file /mail/j/k/<username>/Maildir/dovecot.index Oct 25 01:47:14 <IP> dovecot: imap(<username>): Warning: fscking index file /mail/d/e/<username>/Maildir/dovecot.index Oct 25 01:47:14 <IP> dovecot: imap(<username>): Error: Failed to map transaction log /mail/d/e/<username>/Maildir/dovecot.index.log at sync_offset=9900 after locking: pread() failed: Stale file handle Oct 25 01:47:14 <IP> dovecot: imap(<username>): Error: Index /mail/d/e/<username>/Maildir/dovecot.index: Lost log for seq=16 offset=192: Missing middle file seq=16 (between 16..4294967295, we have seqs 14): Requested newer log than exists: Log inode is unchanged (initial_mapped=1, reason=Index mapped) Oct 25 01:51:14 <IP> dovecot: imap(<username>): Error: Broken file /mail/d/e/<username>/Maildir/dovecot-uidlist line 65: Invalid data: Dovecot -n # 2.2.10: /etc/dovecot/dovecot.conf # OS: Linux 3.10.0-1062.1.2.el7.x86_64 x86_64 CentOS Linux release 7.7.1908 (Core) auth_mechanisms = plain login auth_username_format = %Ln auth_verbose = yes auth_verbose_passwords = plain disable_plaintext_auth = no first_valid_uid = 300 lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes mail_fsync = always mail_location = maildir:~/Maildir mail_nfs_index = yes mail_nfs_storage = yes maildir_very_dirty_syncs = yes managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave mmap_disable = yes namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = /etc/dovecot/sql.conf.ext driver = sql } plugin { sieve = ~/.dovecot.sieve sieve_dir = ~/sieve sieve_global_dir = /mail/sieve/global/ sieve_global_path = /mail/sieve/default.sieve } postmaster_address = postmaster@%d protocols = imap pop3 lmtp sieve service auth { client_limit = 0 inet_listener { port = 11010 } process_limit = 1 process_min_avail = 0 service_count = 0 } service dict { unix_listener dict { group = vmail mode = 0600 user = vmail } } service imap-login { inet_listener imap { port = 143 } inet_listener imaps { port = 993 ssl = yes } process_limit = 2 process_min_avail = 2 service_count = 0 } service imap { client_limit = 1 executable = imap process_limit = 2048 process_min_avail = 50 service_count = 1 } service lmtp { client_limit = 1 process_limit = 0 process_min_avail = 0 service_count = 0 unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0660 user = postfix } } service managesieve-login { inet_listener sieve { port = 4190 } } service pop3-login { inet_listener pop3 { port = 110 } inet_listener pop3s { port = 995 ssl = yes } process_limit = 2 process_min_avail = 2 service_count = 0 } service pop3 { client_limit = 1 executable = pop3 process_limit = 256 process_min_avail = 25 service_count = 1 } ssl_ca = </etc/ssl/mdc/mdc.ca ssl_cert = </etc/ssl/mdc/mdc.crt ssl_cipher_list = !RC4:HIGH:MEDIUM:+TLSv1:!MD5:!SSLv2:+SSLv3:!ADH:!aNULL:!eNULL:!NULL:!DH:!ADH:!EDH:!AESGCM ssl_key = </etc/ssl/mdc/mdc.key ssl_protocols = !SSLv2 !SSLv3 userdb { args = /etc/dovecot/sql.conf.ext driver = sql override_fields = plain_pass=%w } protocol lmtp { mail_plugins = " quota sieve" } protocol imap { mail_max_userip_connections = 40 } protocol sieve { info_log_path = /var/log/dovecot-sieve.log log_path = /var/log/dovecot-sieve-errors.log managesieve_implementation_string = dovecot managesieve_max_line_length = 65536 } Billy Luedtke, Microsoft MCP System Administrator II, WIN

1 0

subscription namespace
by Daniel Miller 25 Oct '19

25 Oct '19

The current documentation makes mention of a "special" subscription namespace. The example given: namespace subscriptions { subscriptions = yes prefix = "" list = no hidden = yes } namespace inbox { inbox = yes location = subscriptions = no [...] results in a startup error as both namespaces have the same prefix. Was the intent for the "inbox" namespace to have an explicit "INBOX/" prefix? If this is configured for an existing server that previously had no such "INBOX/" prefix namespace - will clients need to be reconfigured? -- Daniel

1 0

Still trying to get past authorization problems
by Steve Matzura 24 Oct '19

24 Oct '19

Got all the Postfix errors fixed but maybe one, so I don't think that's involved in this mix any more. I had a domain definition problem, got that sorted. The accounts' logins are correct. I tried several from the shell, and they let me in. Here's the minus-n output, not very different from the first time I posted it: # 2.2.33.2 (d6601f4ec): /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.21 (92477967) # OS: Linux 4.15.0-64-generic x86_64 Ubuntu 18.04.3 LTS ext4 base_dir = /var/run/dovecot/ first_valid_gid = 109 first_valid_uid = 105 last_valid_gid = 109 last_valid_uid = 105 log_path = /var/log/dovecot.log mail_gid = postfix mail_location = maildir:/var/mail/vmail/%d/%n mail_uid = postfix namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { driver = pam } protocols = " imap lmtp" service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0666 user = postfix } unix_listener auth-userdb { group = postfix mode = 0666 user = postfix } } service imap-login { inet_listener imap { port = 143 } inet_listener imaps { port = 993 ssl = yes } process_min_avail = 0 service_count = 1 } service lmtp { unix_listener lmtp { mode = 0666 } } service pop3-login { inet_listener pop3 { port = 110 } inet_listener pop3s { port = 995 ssl = yes } } service pop3 { process_limit = 1024 } ssl = required ssl_cert = </etc/ssl/private/tgv2018.crt ssl_key = # hidden, use -P to show it userdb { driver = passwd } These from dovecot.log just keep going round and round. Oct 24 02:23:57 imap-login: Info: Aborted login (auth failed, 1 attempts in 3 secs): user=<chrissie(a)theglobalvoice.info>, method=PLAIN, rip=86.148.44.160, lip=95.142.174.193, TLS, session=<7SCVuZ6VScBWlCyg> Oct 24 02:25:55 imap-login: Info: Disconnected (auth failed, 2 attempts in 132 secs): user=<yourvoice(a)theglobalvoice.info>, method=PLAIN, rip=108.41.57.11, lip=95.142.174.193, TLS, session=<ZErquJ6VpMpsKTkL> Oct 24 02:25:55 imap-login: Info: Disconnected (auth failed, 2 attempts in 132 secs): user=<yourvoice(a)theglobalvoice.info>, method=PLAIN, rip=108.41.57.11, lip=95.142.174.193, TLS, session=<6bnquJ6VpcpsKTkL> Oct 24 02:57:58 imap-login: Info: Disconnected (auth failed, 4 attempts in 43 secs): user=<yourvoice(a)theglobalvoice.info>, method=PLAIN, rip=108.41.57.11, lip=95.142.174.193, TLS, session=<CRHUMJ+V59JsKTkL> Oct 24 03:06:23 imap-login: Info: Disconnected (no auth attempts in 0 secs): user=<>, rip=49.51.34.136, lip=95.142.174.193, session=<jGWJUZ+VAM8xMyKI> Oct 24 03:06:24 imap-login: Info: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=49.51.34.136, lip=95.142.174.193, session=<agCMUZ+V8JMxMyKI> Oct 24 03:07:55 imap-login: Info: Disconnected (auth failed, 2 attempts in 13 secs): user=<yourvoice(a)theglobalvoice.info>, method=PLAIN, rip=108.41.57.11, lip=95.142.174.193, TLS, session=<ivc4Vp+V79VsKTkL>

3 3

RE: dovecot disk space settings
by Marc Roos 22 Oct '19

22 Oct '19

Ok, what about placing a dummy file of 5GB or so on the partition, that you can remove when necessary? -----Original Message----- Subject: Re: dovecot disk space settings >> I don't want to restrict each mailbox size. It's just to prevent > running out space completely. > > Why? (If I may ask) > > To provide mailboxes with unlimited space. And to make it easier to administrate. My question is about an emergency option if someone has forgotten to migrate to new hardware. It's possible but a bit harder if the partition is out of space and there is no free byte left. Best, Marcel

4 3

dovecot.conf from problem installation
by Steve Matzura 22 Oct '19

22 Oct '19

*** dovecot.conf *** ## Dovecot configuration file # If you're in a hurry, see http://wiki2.dovecot.org/QuickConfiguration # "doveconf -n" command gives a clean output of the changed settings. Use it # instead of copy&pasting files when posting to the Dovecot mailing list. # '#' character and everything after it is treated as comments. Extra spaces # and tabs are ignored. If you want to use either of these explicitly, put the # value inside quotes, eg.: key = "# char and trailing whitespace " # Most (but not all) settings can be overridden by different protocols and/or # source/destination IPs by placing the settings inside sections, for example: # protocol imap { }, local 127.0.0.1 { }, remote 10.0.0.0/8 { } # Default values are shown for each setting, it's not required to uncomment # those. These are exceptions to this though: No sections (e.g. namespace {}) # or plugin settings are added by default, they're listed only as examples. # Paths are also just examples with the real defaults being based on configure # options. The paths listed here are for configure --prefix=/usr # --sysconfdir=/etc --localstatedir=/var # Enable installed protocols !include_try /usr/share/dovecot/protocols.d/*.protocol # A comma separated list of IPs or hosts where to listen in for connections. # "*" listens in all IPv4 interfaces, "::" listens in all IPv6 interfaces. # If you want to specify non-default ports or anything more complex, # edit conf.d/master.conf. #listen = *, :: # Base directory where to store runtime data. #base_dir = /var/run/dovecot/ # Name of this instance. In multi-instance setup doveadm and other commands # can use -i <instance_name> to select which instance is used (an alternative # to -c <config_path>). The instance name is also added to Dovecot processes # in ps output. #instance_name = dovecot # Greeting message for clients. #login_greeting = Dovecot ready. # Space separated list of trusted network ranges. Connections from these # IPs are allowed to override their IP addresses and ports (for logging and # for authentication checks). disable_plaintext_auth is also ignored for # these networks. Typically you'd specify your IMAP proxy servers here. #login_trusted_networks = # Space separated list of login access check sockets (e.g. tcpwrap) #login_access_sockets = # With proxy_maybe=yes if proxy destination matches any of these IPs, don't do # proxying. This isn't necessary normally, but may be useful if the destination # IP is e.g. a load balancer's IP. #auth_proxy_self = # Show more verbose process titles (in ps). Currently shows user name and # IP address. Useful for seeing who are actually using the IMAP processes # (eg. shared mailboxes or if same uid is used for multiple accounts). #verbose_proctitle = no # Should all processes be killed when Dovecot master process shuts down. # Setting this to "no" means that Dovecot can be upgraded without # forcing existing client connections to close (although that could also be # a problem if the upgrade is e.g. because of a security fix). #shutdown_clients = yes # If non-zero, run mail commands via this many connections to doveadm server, # instead of running them directly in the same process. #doveadm_worker_count = 0 # UNIX socket or host:port used for connecting to doveadm server #doveadm_socket_path = doveadm-server # Space separated list of environment variables that are preserved on Dovecot # startup and passed down to all of its child processes. You can also give # key=value pairs to always set specific settings. #import_environment = TZ ## ## Dictionary server settings ## # Dictionary can be used to store key=value lists. This is used by several # plugins. The dictionary can be accessed either directly or though a # dictionary server. The following dict block maps dictionary names to URIs # when the server is used. These can then be referenced using URIs in format # "proxy::<name>". dict { #quota = mysql:/etc/dovecot/dovecot-dict-sql.conf.ext #expire = sqlite:/etc/dovecot/dovecot-dict-sql.conf.ext } # Most of the actual configuration gets included below. The filenames are # first sorted by their ASCII value and parsed in that order. The 00-prefixes # in filenames are intended to make it easier to understand the ordering. !include conf.d/*.conf # A config file can also tried to be included without giving an error if # it's not found: !include_try local.conf log_path = /var/log/dovecot.log passdb { driver = static args = noauthenticate temp_user=%u user=%Ln } passdb { driver = pam } passdb { driver = static args = noautenticate user=%{passdb:temp_user} skip = unauthenticated } *** End *** If I try to start the daemon, or even attempt 'dovecot -n output', I get: # 2.2.33.2 (d6601f4ec): /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.21 (92477967) doveconf: Fatal: Error in configuration file /etc/dovecot/dovecot.conf line 107: Expecting '{' Line 107 is where the first passdb block begins. If I remove the three passdb blocks--everything below line 106--I get a clean startup, but the log looks like this: *** Begin *** Oct 22 12:22:04 auth-worker(13722): Info: pam(yourvoice(a)theglobalvoice.info,108.41.57.11,<BXn+2H6VKelsKTkL>): pam_authenticate() failed: Authentication failure (password mismatch?) (given password: redacted) Oct 22 12:22:06 auth: Debug: client passdb out: FAIL 1 user=yourvoice(a)theglobalvoice.info Oct 22 12:22:06 auth: Debug: client in: AUTH 2 PLAIN service=imap secured session=BXn+2H6VKelsKTkL lip=95.142.174.193 rip=108.41.57.11 lport=993 rport=59689 local_name=mail.theglobalvoice.info resp=AHlvdXJ2b2ljZUB0aGVnbG9iYWx2b2ljZS5pbmZvAFRoJEJvYTQxMFlu (previous base64 data may contain sensitive data) Oct 22 12:22:10 auth-worker(13722): Debug: pam(yourvoice(a)theglobalvoice.info,108.41.57.11,<BXn+2H6VKelsKTkL>): lookup service=dovecot Oct 22 12:22:10 auth-worker(13722): Debug: pam(yourvoice(a)theglobalvoice.info,108.41.57.11,<BXn+2H6VKelsKTkL>): #1/1 style=1 msg=Password: Oct 22 12:22:12 auth-worker(13722): Info: pam(yourvoice(a)theglobalvoice.info,108.41.57.11,<BXn+2H6VKelsKTkL>): pam_authenticate() failed: Authentication failure (password mismatch?) (given password: redacted) Oct 22 12:22:14 auth: Debug: client passdb out: FAIL 2 user=yourvoice(a)theglobalvoice.info Oct 22 12:22:14 imap-login: Debug: SSL alert: close notify [108.41.57.11] Oct 22 12:22:14 imap-login: Debug: SSL alert: close notify [108.41.57.11] Oct 22 12:22:14 imap-login: Info: Disconnected (auth failed, 2 attempts in 12 secs): user=<yourvoice(a)theglobalvoice.info>, method=PLAIN, rip=108.41.57.11, lip=95.142.174.193, TLS, session=<BXn+2H6VKelsKTkL>

1 0