- dovecot - dovecot.org

dovecot user id and mail folder permissions, was "no shared cipher"
by Marco Fioretti 11 Dec '18

11 Dec '18

Greetings, I thought it may be better to start a separate thread now that the cipher problem is solved. Background: I have had to recreate from scratch, and without notice, a working server to a new VPS, with different versions of dovecot and other software. Now I am having problems with accessing the imap folders from home. Now I have postfix/procmail successfully delivering email to the right IMAP folders. Problem is, postfix/procmail run as user mail_manager, group mail_management, and the permissions on those folders are currently all set to 755. The consequence is that dovecot, running as user "dovecot", extra group mail_management, cannot modify those folders and their indexes. What is the best/safest configuration in these cases? 1) run dovecot too as user "mail_manager"? (if yes, how, with dovecot 2.2.36?) 2) recursively change permissions of ALL the mail folders and files to 775? 3) both 1) and 2) ? 4) other (e.g. certain permissions for folders, others for specific files? Thanks in advance for any advice! Marco

1 0

"no shared cypher", no matter what I try
by Marco Fioretti 11 Dec '18

11 Dec '18

Greetings, I have had to reinstall my email server on another Linux (centos 7.6) VPS, with a newer version of dovecot, other software and a brand new letsencrypt certificate just for email withpostfix and dovecot (that certificate works fine with postfix). Output of dovecot --version and dovecot -n on the new server is below. Now, messages ARE delivered in the right IMAP mailboxes, but when I try to connect with Mutt from my home computer, mutt says, before prompting for a password: gnutls_handshake: A TLS fatal alert has been received.(Handshake failed) the corresponding output of dovecot in /var/log/maillog is below. The gist of it **seems** to me to be the "no shared cipher" part, but I may be wrong. In any case, I have already tried to search online for that string, and other relevant parts of the log, without success. All I have found is suggestions to change the values of ssl_protocols and/or ssl_cipher_list to some non-default value, but I have tried all those tips without success. Current values of those variables are these: grep -v ^# /etc/dovecot/conf.d/10-ssl.conf ssl_cert = </etc/letsencrypt/live/MYSERVERNAME/fullchain.pem ssl_key = </etc/letsencrypt/live/MYSERVERNAME/privkey.pem ssl_protocols = !SSLv2 !SSLv3 ssl_cipher_list = ALL:!ADH:!LOW:!EXP:!aNULL:+HIGH:+MEDIU any pointer to what to check or change next is VERY welcome. Thanks in advance, Marco ################################################# Dec 8 10:53:43 MYSERVERNAME dovecot: imap-login: Debug: SSL: where=0x10, ret=1: before/accept initialization [47.53.159.60] Dec 8 10:53:43 MYSERVERNAME dovecot: imap-login: Debug: SSL: where=0x2001, ret=1: before/accept initialization [47.53.159.60] Dec 8 10:53:43 MYSERVERNAME dovecot: imap-login: Warning: SSL alert: where=0x4008, ret=552: fatal handshake failure [47.53.159.60] Dec 8 10:53:43 MYSERVERNAME dovecot: imap-login: Debug: SSL: where=0x2002, ret=-1: error [47.53.159.60] Dec 8 10:53:43 MYSERVERNAME dovecot: imap-login: Debug: SSL: where=0x2002, ret=-1: error [47.53.159.60] Dec 8 10:53:43 MYSERVERNAME dovecot: imap-login: Debug: SSL error: SSL_accept() failed: error:1408A0C1:SSL routines:ssl3_get_client_hello:no shared cipher Dec 8 10:53:43 MYSERVERNAME dovecot: imap-login: Disconnected (disconnected before auth was ready, waited 0 secs): user=<>, rip=47.53.159.60, lip=116.202.20.216, TLS handshaking: SSL_accept() failed: error:1408A0C1:SSL routines:ssl3_get_client_hello:no shared cipher, session=<knICtX98UK4vNZ88> Dec 8 10:53:43 MYSERVERNAME dovecot: auth: Debug: Loading modules from directory: /usr/lib64/dovecot/auth Dec 8 10:53:43 MYSERVERNAME dovecot: auth: Debug: Module loaded: /usr/lib64/dovecot/auth/lib20_auth_var_expand_crypt.so Dec 8 10:53:43 MYSERVERNAME dovecot: auth: Debug: Module loaded: /usr/lib64/dovecot/auth/libdriver_sqlite.so Dec 8 10:53:43 MYSERVERNAME dovecot: auth: Debug: Read auth token secret from /var/run/dovecot/auth-token-secret.dat Dec 8 10:53:43 MYSERVERNAME dovecot: auth: Debug: passwd-file /etc/imap.v_users: Read 1 users in 0 secs ################################################# dovecot --version 2.2.36 (1f10bfa63) # 2.2.36 (1f10bfa63): /etc/dovecot/dovecot.conf # OS: Linux 3.10.0-957.1.3.el7.x86_64 x86_64 CentOS Linux release 7.6.1810 (Core) ext4 # Hostname: MYSERVERNAME auth_debug = yes auth_mechanisms = plain login auth_verbose = yes mail_location = maildir:/var/mail//base/ passdb { args = /etc/imap.v_users driver = passwd-file } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } } service imap-login { inet_listener imap { port = 0 } inet_listener imaps { port = 993 } } ssl = required userdb { args = /etc/imap.v_users driver = passwd-file } verbose_ssl = yes

6 12

Log sync error
by Jakobus Schürz 11 Dec '18

11 Dec '18

Hi there! I get a lot of errormessages. My dovecot is: dovecot-core 2:2.3.2.1-1~stretch from Debian stable. I found this: https://www.dovecot.org/list/dovecot/2013-July/091648.html So the bug came back... The Log is attached Thanks Jakob

1 1

Replication Error - Trying to Interate Users
by Antonino Sidoti 11 Dec '18

11 Dec '18

HI, My first post to this list; I am trying to configure replication between two host, both hosts are having the same errors. Using ‘dovecot log errors’ gives the following errors; Dec 11 18:05:12 Error: auth: Trying to iterate users, but userdbs don't support it (created 0 msecs ago, handshake 0 msecs ago) Dec 11 18:05:12 Error: replicator: User listing returned failure Dec 11 18:05:12 Error: replicator: listing users failed, can't replicate existing data My version of Dovecot version = 2.2.36 My Configuration is attached. Any help is greatly appreciated. Thanks

2 1

Indexer worker small bug
by André Rodier 10 Dec '18

10 Dec '18

Hello, I think I submitted this before, but I am not sure this has been addressed I am using AppArmor with Dovecot, without any issue. However, I think there is a bug in the indexer working, from what I can see, a missing trailing slash. See: ------------ Dec 09 14:35:53 portal2 kernel: audit: type=1400 audit(1544366153.379:3035): apparmor="DENIED" operation="file_mmap" info="Failed name lookup - disconnected path" error=-13 profile="/usr/lib/dovecot/indexer-worker" name="var/cache/nscd/hosts" pid=10540 comm="indexer-worker" requested_mask="r" denied_mask="r" fsuid=1001 ouid=0 ------------ The indexer worker is trying to open the file "var/cache/nscd/hosts" instead of "/var/cache/nscd/hosts", which of course fails. Can someone double check the code of the indexer worker, or this has been fixed? Thanks, André -- https://github.com/progmaticltd/homebox

3 5

QUERY string clarification
by Ralf Hildebrandt 10 Dec '18

10 Dec '18

The manpage https://wiki.dovecot.org/Tools/Doveadm/SearchQuery specifies: BODY string Matches messages, which contain string in the body part. and a bit further down: TEXT string Matches messages, which contain string in the message body. Where's the difference? -- Ralf Hildebrandt Geschäftsbereich IT | Abteilung Netzwerk Charité - Universitätsmedizin Berlin Campus Benjamin Franklin Hindenburgdamm 30 | D-12203 Berlin Tel. +49 30 450 570 155 | Fax: +49 30 450 570 962 ralf.hildebrandt(a)charite.de | https://www.charite.de

2 1

Replication fatal error
by admin 10 Dec '18

10 Dec '18

Dear suscribers. I just dont understand this error. Don't know where to look first. If someone have already meet this problem... Dec 10 16:06:17 prudence dovecot: dsync-server(address(a)domain.fr): Panic: file dsync-brain-mailbox.c: line 370 (dsync_brain_sync_mailbox_deinit): assertion failed: (brain->failed) Dec 10 16:06:17 prudence dovecot: dsync-server(address(a)domain.fr): Error: Raw backtrace: /usr/lib/dovecot/libdovecot.so.0(+0xa0112) [0x7f2c66f62112] -> /usr/lib/dovecot/libdovecot.so.0(+0xa020a) [0x7f2c66f6220a] -> /usr/lib/dovecot/libdovecot.so.0(i_fatal+0) [0x7f2c66ef21d8] -> dovecot/doveadm-server(dsync_brain_sync_mailbox_deinit+0x1b0) [0x5587f89936b0] -> dovecot/doveadm-server(dsync_brain_slave_recv_mailbox+0x417) [0x5587f8994447] -> dovecot/doveadm-server(dsync_brain_run+0x286) [0x5587f8991a86] -> dovecot/doveadm-server(+0x430d9) [0x5587f89920d9] -> dovecot/doveadm-server(+0x595cf) [0x5587f89a85cf] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_call_io+0x52) [0x7f2c66f781a2] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run_internal+0x12e) [0x7f2c66f7984e] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run+0x36) [0x7f2c66f78236] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_run+0x38) [0x7f2c66f783e8] -> dovecot/doveadm-server(+0x27eed) [0x5587f8976eed] -> dovecot/doveadm-server(+0x298cd) [0x5587f89788cd] -> dovecot/doveadm-server(+0x3f30b) [0x5587f898e30b] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_call_io+0x52) [0x7f2c66f781a2] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run_internal+0x12e) [0x7f2c66f7984e] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run+0x36) [0x7f2c66f78236] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_run+0x38) [0x7f2c66f783e8] -> /usr/lib/dovecot/libdovecot.so.0(master_service_run+0x13) [0x7f2c66efc9f3] -> dovecot/doveadm-server(main+0x1b5) [0x5587f89691c5] -> /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xe7) [0x7f2c66af2b97] -> dovecot/doveadm-server(_start+0x2a) [0x5587f896928a] Dec 10 16:06:17 prudence dovecot: dsync-server(address(a)domain.fr): Fatal: master: service(doveadm): child 22362 killed with signal 6 (core dumped) server 1 dovecot configuration (version 2.2.9): default_client_limit = 2048 default_process_limit = 2048 disable_plaintext_auth = no doveadm_password = xxxxxxxxxxx doveadm_port = 11225 hostname = xxxxxxxxxxxx listen = 127.0.0.1,XX.XX.XX.XX mail_location = maildir:/srv/mail/%d/%n/Maildir mail_plugins = " notify replication" managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave namespace inbox { inbox = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk { auto = subscribe special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { auto = subscribe special_use = \Trash } prefix = } passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } plugin { mail_replica = tcp:xxxxxxxxx:11225 sieve = ~/.dovecot.sieve sieve_default = /etc/dovecot/sieve/Ingenie.sieve sieve_default_name = Ingenie sieve_dir = ~/sieve sieve_max_redirects = 0 sieve_vacation_dont_check_recipient = yes } postmaster_address = admin(a)ingenie.fr protocols = " imap lmtp sieve pop3" service aggregator { fifo_listener replication-notify-fifo { user = vmail } unix_listener replication-notify { user = vmail } } service auth { unix_listener /var/spool/postfix-submission/private/dovecot-auth { group = postfix mode = 0600 user = postfix } } service doveadm { inet_listener { address = XX.XX.XX.XX port = 11225 } vsz_limit = 100 M } service lmtp { inet_listener lmtp { address = 127.0.0.1 port = 11125 } } service replicator { process_min_avail = 1 unix_listener replicator-doveadm { group = vmail mode = 0600 user = vmail } } ssl_ca = </etc/ssl/ingenie.fr/cacrt.pem ssl_cert = </etc/ssl/ingenie.fr/crt.pem ssl_key = </etc/ssl/ingenie.fr/key.pem submission_host = 127.0.0.1:10025 userdb { driver = prefetch } userdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } protocol lmtp { mail_plugins = " sieve" } protocol imap { mail_max_userip_connections = 500 } protocol sieve { mail_max_userip_connections = 500 } protocol pop3 { mail_max_userip_connections = 50 } server 2 configuration (2.2.33.2 (d6601f4ec)) disable_plaintext_auth = no doveadm_password = # hidden, use -P to show it doveadm_port = 11225 hostname = xxxxxxxxxx listen = XX.XX.XX.XX mail_location = maildir:/srv/mail/%d/%n/Maildir mail_plugins = " notify replication" mail_privileged_group = mail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave namespace inbox { inbox = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk { auto = subscribe autoexpunge = 30 days special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { auto = subscribe autoexpunge = 30 days special_use = \Trash } prefix = } passdb { args = /etc/dovecot/sql.conf driver = sql } plugin { mail_replica = tcp:xxxxxxxx:11225 sieve = ~/.dovecot.sieve sieve_default = /etc/dovecot/sieve/Ingenie.sieve sieve_default_name = Ingenie sieve_dir = ~/sieve sieve_max_redirects = 0 sieve_vacation_dont_check_recipient = yes } postmaster_address = admin(a)ingenie.fr protocols = " imap lmtp sieve pop3 sieve" service aggregator { fifo_listener replication-notify-fifo { user = vmail } unix_listener replication-notify { user = vmail } } service auth { unix_listener /var/spool/postfix-submission/private/dovecot-auth { group = postfix mode = 0600 user = postfix } } service doveadm { inet_listener { address = XX.XX.XX.XX port = 11225 } vsz_limit = 100 M } service lmtp { inet_listener lmtp { address = 127.0.0.1 port = 11125 } } service replicator { process_min_avail = 1 unix_listener replicator-doveadm { group = vmail mode = 0600 user = vmail } } ssl_ca = </etc/ssl/ingenie.fr/cacrt.pem ssl_cert = </etc/ssl/ingenie.fr/crt.pem ssl_client_ca_dir = /etc/ssl/certs ssl_key = # hidden, use -P to show it userdb { driver = prefetch } userdb { args = /etc/dovecot/sql.conf driver = sql } protocol lmtp { mail_plugins = " sieve" } Thanks for considering my request.

3 2

set seen flag and junk moving a mail manually to JUNK
by Jakobus Schürz 10 Dec '18

10 Dec '18

Hi there! I want to set the \seen and the Junk Flag to an email, which i move manually to my Junk-Folder. I tried a lot... but nothing worked like expected. I have a sieve-filter, which takes an email and copy it to a pipe to rspamc. This filter is working correctly, i get a debug-message from the script, which is called through the sieve-filter. But adding another rule (addflag "Junk"; setflag "\\seen";) to this rule is getting ignored... Here is my sieve-rule: require ["imap4flags", "vnd.dovecot.pipe", "copy", "imapsieve", "environment", "variables"]; if environment :matches "imap.email" "*" { set "email" "${1}"; } addflag "Junk"; setflag "\\seen"; pipe :copy "learn-spam.sh" [ "${email}" ]; How said before, the script learn-spam.sh is called, when i move a Message via drag&drop in thunderbird from the INBOX to the Junk-Folder. But the message in the Junk-Folder is unseen, recent and has no Junk-Flag... What's wrong? BR Jakob

8 37

Sieve notify variables not working with body?
by Bambero 09 Dec '18

09 Dec '18

Hi, I want to send notification like this: if body :text :matches "*" { notify :importance "3" :message "[NOTIFY] ${1}" "mailto:test@example,com"; } The notification works but the variable ${1} seems to be empty. But in this case: if header :matches "Subject" "*" { notify :importance "3" :message "[NOTIFY] ${1}" "mailto:test@example,com"; } Everything works correct. Regards, Bambero

2 3

Mail aliases plugin not honouring namespace?
by Marc Roos 08 Dec '18

08 Dec '18

I have namespace { disabled = no hidden = no ignore_on_failure = no inbox = yes list = yes location = prefix = separator = / subscriptions = yes type = private } namespace Archive { disabled = no hidden = no ignore_on_failure = no inbox = no list = yes location = mbox:/home/mail-archive/%u/ prefix = Archive/ separator = / subscriptions = yes type = private } Without aliases, folders are created at /home/mail-archive/%u/ which is expected When I am adding these mailbox aliases mailbox_alias_old = Archive mailbox_alias_new = Archives These folders are created in the default namespace .Archive .Archives.2018 .Archives Is this as expected? I am at least not expecting it.

1 0