- dovecot - dovecot.org

Emails not visible after renaming folders
by Aleksandr 14 Aug '19

14 Aug '19

Hello, I have strange problem with "losing" emails after rename mail folder(s) (via imap client: thunderbird, roundcude, etc..) How to reproduce: 1. Create some folder name, like TEST 2. Create sub-folder under TEST (like SUBTEST) Structure: TEST |--SUBTEST # doveadm mailbox list -u postmaster@testmailbox Spam Trash Sent Drafts INBOX TEST TEST/SUBTEST 3. Move (or copy) mails from INBOX to SUBTEST (all looks fine, and mails visible under SUBTEST) 4. Rename TEST folder to any new name, NEWTEST Let`s try to view mails in mail client in NEWTEST-SUBTEST, folder have no emails :( mailsrv# doveadm -f table mailbox status -u postmaster@testmailbox "messages vsize" NEWTEST* mailbox messages vsize NEWTEST 0 0 NEWTEST/SUBTEST 0 0 If doveadm force-resync postmaster@testmailbox, mails will be visible in INBOX mailsrv# doveadm -f table mailbox status -u postmaster@testmailbox "messages vsize" INBOX* mailbox messages vsize INBOX 2 28 Dovecot installation: CentOS x86_64 Linux 7.5.1804 Storage: HDD Local Partition - XFS filesystem / multi-dbox (mdbox) as mail_storage (this problem is not reproduced with the settings as Maildir storage !) somthing wrong with mapping indices. ---- [start] ---- # dovecot -n # 2.2.36 (1f10bfa63): /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.21 (92477967) # OS: Linux 3.10.0-862.2.3.el7.x86_64 x86_64 CentOS Linux release 7.5.1804 (Core) # Hostname: xxxx auth_mechanisms = plain login digest-md5 cram-md5 base_dir = /var/run/dovecot/ default_client_limit = 20000 default_login_user = dovecot default_process_limit = 10000 dict { quota = redis:host=127.0.0.1:prefix=user/:timeout_msecs=1000 } disable_plaintext_auth = no first_valid_gid = 90 first_valid_uid = 90 imapc_features = rfc822.size fetch-headers imapc_host = xxxx imapc_user = %u lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes login_greeting = xxxx. login_log_format_elements = user=<%u> method=%m rip=%r lip=%l %c login_trusted_networks = 10.0.1.0/24 mail_access_groups = mail mail_debug = yes mail_fsync = never mail_gid = 97 mail_location = mdbox:~/mail/mailboxes:FULLDIRNAME=mBoX-MeSsAgEs:INDEX=~/mail/index:CONTROL=~/mail/control:INBOX=~/mail/mailboxes/inbox mail_log_prefix = "%{session} %Us(%u): " mail_max_lock_timeout = 30 secs mail_plugins = quota zlib mail_prefetch_count = 20 mail_privileged_group = mail mail_uid = 97 managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables enotify environment mailbox date index ihave duplicate mime foreverypart extracttext vacation-seconds editheader mbox_lock_timeout = 30 secs mbox_very_dirty_syncs = yes mbox_write_locks = fcntl namespace inbox { inbox = yes list = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Sent { auto = subscribe special_use = \Sent } mailbox Spam { auto = subscribe } mailbox Trash { auto = subscribe special_use = \Trash } prefix = separator = / type = private } passdb { args = /etc/dovecot/dovecot-ldap.conf driver = ldap } plugin { cgroup_basedir = /usr/sys/cgroup hostingAccount = default quota = dict:User quota::proxy::quota quota_grace = 0%% quota_over_flag_value = TRUE quota_over_script = account-quota mismatch %u quota_rule = *:storage=4T quota_warning = storage=101%% account-quota block %u quota_warning1 = -storage=100%% account-quota unblock %u sieve = file:~/sieve;active=~/.dovecot.sieve sieve_before = /home/sieve/%d/ sieve_extensions = +editheader +vacation-seconds -body sieve_max_redirects = 200 sieve_vacation_min_period = 1s trash_folder = Trash zlib_save = lz4 zlib_save_level = 6 } pop3_delete_type = expunge protocols = imap pop3 sieve service account-quota { executable = script /usr/local/scripts/account-quota unix_listener account-quota { mode = 0666 user = dovecot } user = dovecot } service anvil { chroot = /var/empty client_limit = 0 drop_priv_before_exec = no executable = anvil extra_groups = group = $default_internal_user idle_kill = 4294967295 secs privileged_group = process_limit = 1 process_min_avail = 1 protocol = service_count = 0 type = anvil unix_listener anvil-auth-penalty { group = $default_internal_user mode = 0660 user = dovecot } unix_listener anvil { group = $default_internal_user mode = 0660 user = dovecot } user = $default_internal_user vsz_limit = 18446744073709551615 B } service auth-worker { chroot = /var/empty user = $default_internal_user } service auth { chroot = /var/empty executable = /usr/libexec/dovecot/auth unix_listener auth-client { mode = 0660 } unix_listener auth-master { mode = 0666 } unix_listener auth-userdb { mode = 0777 } user = $default_internal_user } service dict { executable = /usr/libexec/dovecot/dict unix_listener dict { mode = 0600 user = $default_internal_user } } service imap-login { executable = /usr/libexec/dovecot/imap-login inet_listener imap { address = xxxxxxx port = 143 } process_limit = 10000 process_min_avail = 1 service_count = 0 user = dovecot } service imap { executable = /usr/libexec/dovecot/imap process_limit = 18000 process_min_avail = 1 service_count = 0 vsz_limit = 256 M } service lmtp { process_limit = 10 } service pop3-login { executable = /usr/libexec/dovecot/pop3-login inet_listener pop3 { address = xxxxxx port = 110 } process_limit = 1000 process_min_avail = 1 service_count = 0 user = dovecot vsz_limit = 256 M } service pop3 { executable = /usr/libexec/dovecot/pop3 process_limit = 1000 process_min_avail = 1 service_count = 0 } service send-warning { executable = script /usr/local/scripts/send-warning unix_listener send-warning { mode = 0666 user = dovecot } user = dovecot } shutdown_clients = no ssl_cert = </etc/dovecot/xxxx.crt ssl_key = # hidden, use -P to show it userdb { args = /etc/dovecot/dovecot-ldap.conf driver = ldap } verbose_proctitle = yes protocol lda { mail_plugins = sieve quota cgroups zlib } protocol imap { imap_client_workarounds = delay-newmail tb-extra-mailbox-sep mail_max_userip_connections = 50 mail_plugins = quota imap_quota mail_log notify cgroups zlib } protocol pop3 { mail_max_userip_connections = 20 mail_plugins = quota cgroups zlib pop3_client_workarounds = outlook-no-nuls oe-ns-eoh pop3_enable_last = no pop3_no_flag_updates = yes pop3_uidl_format = %08Xu%08Xv } ---- [end] ---- Regards, Aleksandr.

3 4

Auth driver
by Riccardo Paolo Bestetti 14 Aug '19

14 Aug '19

(resending to the list; I apologize, I'm not using my usual email client) Hello, That's actually great news. The perspective of working in-tree didn't make me particularly happy. Could you point me to any documentation or examples? While I can find many plugins in the repo and around the Internet, I could find none which add authdb drivers. Best Regards, Riccardo P. Bestetti Da: Aki Tuomi <aki.tuomi(a)open-xchange.com> Inviato: venerdì 9 agosto 2019 13:56 A: Riccardo Paolo Bestetti <riccardo.kyogre(a)live.it>; dovecot(a)dovecot.org <dovecot(a)dovecot.org> Oggetto: Re: Auth driver On 9.8.2019 14.51, Riccardo Paolo Bestetti via dovecot wrote: > Greetings! > > I'm planning to implement a new auth driver. It's going to be, in concept, similar to the Lua and CheckPassword drivers, in that it allows an user program to carry out the authentication and user enumeration steps. If you do this, please make it as 3rd party repository. Dovecot auth supports plugins. Aki

3 2

Should dovecot not be using different logging facility and severity levels?
by Marc Roos 14 Aug '19

14 Aug '19

Should dovecot not be using different severity levels like auth.warn? On my system everything goes to loglevel info: lev_info:Aug 9 16:18:24 mail03 dovecot: imap-login: Aborted login (auth failed, 1 attempts in 2 secs): user=<xxxxx>, method=PLAIN, rip=x.x.x.x, lip=x.x.x.x, TLS, session=<UBXJ2K+PYh68zmjw> lev_info:Aug 9 16:18:29 mail03 dovecot: auth-worker(28656): pam(krinfo,188.206.104.240,<LOLx2K+PYx68zmjw>): unknown user lev_info:Aug 9 16:18:50 mail03 dovecot: imap-login: Aborted login (auth failed, 1 attempts in 25 secs): user=<xxxxx>, method=PLAIN, rip=x.x.x.x, lip=x.x.x.x, TLS: Disconnected, session=<LOLx2K+PYx68zmjw> lev_info:Aug 9 16:18:53 mail03 dovecot: auth-worker(28656): pam(krinfo,188.206.104.240,<qJOm2q+Pax68zmjw>): unknown user lev_info:Aug 9 16:19:01 mail03 dovecot: imap-login: Aborted login (auth failed, 1 attempts in 8 secs): user=<xxxxx>, method=PLAIN, rip=x.x.x.x, lip=x.x.x.x, TLS, session=<qJOm2q+Pax68zmjw> lev_info:Aug 9 16:19:13 mail03 dovecot: auth-worker(28656): pam(krinfo,188.206.104.240,<k8/X26+Pch68zmjw>): unknown user lev_info:Aug 9 16:19:15 mail03 dovecot: imap-login: Aborted login (auth failed, 1 attempts in 2 secs): user=<xxxxx>, method=PLAIN, rip=x.x.x.x, lip=x.x.x.x, TLS, session=<k8/X26+Pch68zmjw> lev_info:Aug 9 16:19:24 mail03 dovecot: auth-worker(28656): pam(krinfo,188.206.104.240,<MjBy3K+Pfh68zmjw>): unknown user lev_info:Aug 9 16:19:26 mail03 dovecot: imap-login: Aborted login (auth failed, 1 attempts in 2 secs): user=<xxxxx>, method=PLAIN, rip=x.x.x.x, lip=x.x.x.x, TLS, session=<MjBy3K+Pfh68zmjw> lev_info:Aug 9 16:19:27 mail03 dovecot: auth-worker(28656): pam(krinfo,188.206.104.240,<oRmo3K+Pfx68zmjw>): unknown user lev_info:Aug 9 16:19:29 mail03 dovecot: imap-login: Aborted login (auth failed, 1 attempts in 2 secs): user=<xxxxx>, method=PLAIN, rip=x.x.x.x, lip=x.x.x.x, TLS, session=<oRmo3K+Pfx68zmjw> lev_info:Aug 9 16:19:47 mail03 dovecot: auth-worker(29664): pam(krinfo,188.206.104.240,<14Pb3a+Pih68zmjw>): unknown user lev_info:Aug 9 16:19:49 mail03 dovecot: imap-login: Aborted login (auth failed, 1 attempts in 2 secs): user=<xxxxx>, method=PLAIN, rip=x.x.x.x, lip=x.x.x.x, TLS, session=<14Pb3a+Pih68zmjw> lev_info:Aug 9 16:19:51 mail03 dovecot: auth-worker(29664): pam(krinfo,188.206.104.240,<99cO3q+Pix68zmjw>): unknown user lev_info:Aug 9 16:19:53 mail03 dovecot: imap-login: Aborted login (auth failed, 1 attempts in 2 secs): user=<xxxxx>, method=PLAIN, rip=x.x.x.x, lip=x.x.x.x, TLS, session=<99cO3q+Pix68zmjw> This is how failed attempts are logged by vsftpd fac_authpriv:Aug 9 16:24:42 web01 vsftpd[7255]: pam_ldap(vsftpd:auth): Authentication failure; user=xxxxx fac_authpriv:Aug 9 16:24:42 web01 vsftpd[7255]: pam_unix(vsftpd:auth): authentication failure; logname= uid=0 euid=0 tty=ftp ruser=xxxxx rhost=xxxxx user=xxxxx fac_ftp:Aug 9 16:24:44 web01 vsftpd[7255]: [xxxxx] FAIL LOGIN: Client "x.x.x.x" lev_notice:Aug 9 16:24:42 web01 vsftpd[7255]: pam_ldap(vsftpd:auth): Authentication failure; user=xxxxx lev_notice:Aug 9 16:24:42 web01 vsftpd[7255]: pam_unix(vsftpd:auth): authentication failure; logname= uid=0 euid=0 tty=ftp ruser=xxxxx rhost=xxxxx user=xxxxx lev_warn:Aug 9 16:24:44 web01 vsftpd[7255]: [xxxxx] FAIL LOGIN: Client "x.x.x.x" Using dovecot-2.2.36-3.el7.x86_64 on CentOS7

4 4

ACL ignored for master users
by Philip Iezzi 14 Aug '19

14 Aug '19

Hi there! I can't get ACL working for master users. Login as master user works fine though, and I am able to access any mailbox using the auth_master_user_separator "*", tested e.g. via Python's imaplib: import imaplib imap = imaplib.IMAP4_SSL('imap.example.com') imap.login('foo(a)example.com*admin-acldemo', '**********') ('OK', [b'Logged in']) My /etc/dovecot/dovecot-acl looks like this: * user=admin lr bar(a)example.com user=admin-acldemo lr So, if I didn't misunderstand https://wiki.dovecot.org/Authentication/MasterUsers and https://wiki.dovecot.org/ACL documentation, this should only give "admin" master user access to all mailaccounts and limiting "admin-acldemo" master user to only a single mailaccount. That's what I would like to accomplish. But no matter what I put into dovecot-acl (it could even be empty), master users always have access to all existing mailaccounts. The whole dovecot-acl seems to be ignored and there are no logs pointing to any problem (syntax, access permissions) with that file. In mail.log I am getting a successful login message: dovecot: imap-login: Login: user=<foo(a)example.com>, method=PLAIN, ... So the login with "foo(a)example.com*admin-acldemo" seems to get resolved to a regular "foo(a)example.com" user login. My current setup (relevant config options): # 2.3.7.1 (0152c8b10): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.7.1 (db5c74be) # OS: Linux 4.15.18-18-pve x86_64 Debian 9.9 auth_master_user_separator = * mail_plugins = quota acl passdb { args = /etc/dovecot/passwd.masterusers driver = passwd-file master = yes pass = yes } plugin { acl = vfile:/etc/dovecot/dovecot-acl acl_user = %u master_user = %u } protocol lmtp { mail_plugins = quota acl sieve } protocol lda { mail_plugins = quota acl sieve } protocol imap { mail_plugins = quota acl imap_acl imap_quota } On ACL documentation it says: > Note that master users have their own ACLs. They're not the the mailbox owners, so by default they have no permissions to any of the mailboxes and on Authentication/MasterUsers documentation: > If ACL plugin is enabled, the Master user is still subject to ACLs just like any other user, which means that by default the master user has no access to any mailboxes of the user. So it must be somehow possible to limit master users to specific mailbox(es) via ACL. I could allow master users to be able to log in as themselves, by adding two passdb sections (one with `master = yes`, the other `master = no`), but then I see no way to do a user context switch (where ACLs would get respected...) after logging in with "admin". Any help greatly appreciated! Thanks in advance. Cheers, Philip

1 1

Dovecot - Microsoft Azure AD
by Lennart Boettcher 14 Aug '19

14 Aug '19

Hello, I am currently trying to connect my Dovecot mail server to Microsoft's Azure-AD and use it as password and user database. I am using version 2.3.7.1. Using the Azure-AD as passdb already works. In this context I noticed that the scope implementation is not yet merged. Since I haven't found any hints for an OAuth2 userdb implementation yet, I wanted to ask if there are any plans for an implementation. Greetings Lennart Boettcher

2 1

Solr, Dovecot & macOS / iOS
by James Brown 14 Aug '19

14 Aug '19

I’m thinking of getting Solr working with my Dovecot server. Server is new 6-core Mac Mini, mail store of over 1/2 TB. Mailboxes with 100s of thousands of messages. But I’m not sure if: a) it will make enough of a difference and b) does Mail.app and other mail clients on Macs or iOS devices perform searches on their local copy of mail or does it just send a search request to the server? I’m guessing the searches are done locally so no point in Solr? Does anyone know? Thanks, James.

4 5

Dovecot Sieve doesn't move spam to Junk folder in maildir
by Nagy Tibor 13 Aug '19

13 Aug '19

I have an *Ubuntu 16.04* mail server with postfix/spamassassin/*dovecot-2.2.2**2* with virtual mailboxes in maildir format. The whole process is working excellently since a year. Spams are marked with "*****SPAM*****" in subject and with "X-Spam-Flag: YES" in email header. I tried now to add sieve to dovecot to move the SPAM messages into the Junk folder without any success, I don't see any sign that sieve does something at all. The output of "dovecot -n": # 2.2.22 (fe789d2): /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.13 (7b14904) # OS: Linux 4.4.0-72-generic x86_64 Ubuntu 16.04.2 LTS ext4 auth_mechanisms = cram-md5 auth_verbose = yes base_dir = /var/run/dovecot/ info_log_path = /var/log/dovecot.info log_path = /var/log/dovecot log_timestamp = "%Y-%m-%d %H:%M:%S " mail_location = maildir:/home/vmail/%d/%n managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext namespace { inbox = yes location = prefix = separator = / } passdb { args = /etc/dovecot/passwd driver = passwd-file } plugin { sieve = /etc/dovecot/sieve/default.sieve } protocols = imap pop3 service auth { executable = /usr/lib/dovecot/auth unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0666 user = postfix } user = root } service imap-login { chroot = login executable = /usr/lib/dovecot/imap-login inet_listener imap { port = 0 } user = dovecot } service imap { executable = /usr/lib/dovecot/imap } service pop3-login { chroot = login executable = /usr/lib/dovecot/pop3-login inet_listener pop3 { port = 0 } inet_listener pop3s { port = 0 } user = dovecot } service pop3 { executable = /usr/lib/dovecot/pop3 } ssl_cert = </etc/ssl/certs/dovecot.pem ssl_key = </etc/ssl/private/dovecot.pem userdb { args = /etc/dovecot/users driver = passwd-file } valid_chroot_dirs = /var/spool/vmail protocol pop3 { pop3_uidl_format = %08Xu%08Xv } protocol lda { mail_plugins = " sieve" } I've added only plugin and protocol lda now. The content of the file default.sieve: require "fileinto"; if header :contains "X-Spam-Flag" "YES" { fileinto "Junk"; } The test SPAM message is marked as SPAM, but not moved to the folder Junk. I don't see anything in mail.log that is associated to sieve.: ul 30 20:05:12 zg-3 postfix/smtpd[4446]: connect from smtp4.enternet.hu[62.112.192.37] Jul 30 20:05:13 zg-3 postfix/smtpd[4446]: 3C4CC9F570: client=smtp4.enternet.hu[62.112.192.37] Jul 30 20:05:13 zg-3 postfix/cleanup[4450]: 3C4CC9F570: message-id=<c6b3bca5-ece3-9e69-8e30-28173abc2ec6(a)hu.inter.net> Jul 30 20:05:13 zg-3 postfix/qmgr[1557]: 3C4CC9F570: from=<nagyt(a)hu.inter.net>, size=918, nrcpt=1 (queue active) Jul 30 20:05:13 zg-3 postfix/smtpd[4446]: disconnect from smtp4.enternet.hu[62.112.192.37] ehlo=2 starttls=1 mail=1 rcpt=1 data=1 quit=1 commands=7 Jul 30 20:05:13 zg-3 postfix/pickup[3949]: 5F7FEA3CBC: uid=1003 from=<nagyt(a)hu.inter.net> Jul 30 20:05:13 zg-3 postfix/pipe[4451]: 3C4CC9F570: to=<tibor(a)softxs.ch>, relay=spamassassin, delay=0.15, delays=0.05/0.01/0/0.1, dsn=2.0.0, status=sent (delivered via spamassassin service) Jul 30 20:05:13 zg-3 postfix/qmgr[1557]: 3C4CC9F570: removed Jul 30 20:05:13 zg-3 postfix/cleanup[4450]: 5F7FEA3CBC: message-id=<c6b3bca5-ece3-9e69-8e30-28173abc2ec6(a)hu.inter.net> Jul 30 20:05:13 zg-3 postfix/qmgr[1557]: 5F7FEA3CBC: from=<nagyt(a)hu.inter.net>, size=3304, nrcpt=1 (queue active) Jul 30 20:05:13 zg-3 postfix/virtual[4455]: 5F7FEA3CBC: to=<tibor(a)softxs.ch>, relay=virtual, delay=0.02, delays=0.01/0.01/0/0, dsn=2.0.0, status=sent (delivered to maildir) Jul 30 20:05:13 zg-3 postfix/qmgr[1557]: 5F7FEA3CBC: removed What can be wrong?

2 2

dovecot acl delete messages questions
by hfh＠cndns.com 13 Aug '19

13 Aug '19

Dovecot's acl plugin can prevent deletion of messages,it works very well! I want: Some ips can delete messages, other ips can not delete messages,can anyone help me? hfh(a)cndns.com

1 0

LastLogin update
by Jorge Bastos 13 Aug '19

13 Aug '19

Howdy, I'd like an adive on what to use. I have sql users, and i want to have the lastlogin of them, what is the native option for this: * Using last_login plugin which will give me the last login? * Use postlogin for imap and pop3n which will give me besides lastlogin the IP and protocol? Thanks in advanced,

8 13

ACL ignored for master users
by Philip Iezzi 12 Aug '19

12 Aug '19

Hi there! I can't get ACL working for master users. Login as master user works fine though, and I am able to access any mailbox using the auth_master_user_separator "*", tested e.g. via Python's imaplib: >>> import imaplib >>> imap = imaplib.IMAP4_SSL('imap.example.com') >>> imap.login('foo(a)example.com*admin-acldemo', '**********') ('OK', [b'Logged in']) My /etc/dovecot/dovecot-acl looks like this: * user=admin lr bar(a)example.com user=admin-acldemo lr So, if I didn't misunderstand https://wiki.dovecot.org/Authentication/MasterUsers and https://wiki.dovecot.org/ACL documentation, this should only give "admin" master user access to all mailaccounts and limiting "admin-acldemo" master user to only a single mailaccount. But no matter what I put into dovecot-acl (it could even be empty), master users always have access to all existing mailaccounts. The whole dovecot-acl seems to be ignored and there are no logs pointing to any problem (syntax, access permissions) with that file. In mail.log I am getting a successful login message: dovecot: imap-login: Login: user=<foo(a)example.com>, method=PLAIN, rip=..., lip=..., mpid=42371, TLS, session=<T9GKEuyPKGxRPtGS> My current setup (relevant config options): # 2.3.7.1 (0152c8b10): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.7.1 (db5c74be) # OS: Linux 4.15.18-18-pve x86_64 Debian 9.9 auth_master_user_separator = * mail_plugins = quota acl passdb { args = /etc/dovecot/passwd.masterusers driver = passwd-file master = yes pass = yes } plugin { acl = vfile:/etc/dovecot/dovecot-acl acl_user = %u master_user = %u } protocol lmtp { mail_plugins = quota acl sieve } protocol lda { mail_plugins = quota acl sieve } protocol imap { mail_plugins = quota acl imap_acl imap_quota } On ACL documentation it says: > Note that master users have their own ACLs. They're not the the mailbox owners, so by default they have no permissions to any of the mailboxes and on Authentication/MasterUsers documentation: > If ACL plugin is enabled, the Master user is still subject to ACLs just like any other user, which means that by default the master user has no access to any mailboxes of the user. So it must be somehow possible to limit master users to specific mailbox(es) via ACL. If I disable `master = yes` master users won't be able to login at all. Any help greatly appreciated! Thanks in advance. Cheers, Philip

1 0