- dovecot - dovecot.org

'doveadm replicator remove' only temporary?
by Robert Giles 07 Nov '17

07 Nov '17

Hi folks, Wondering if this is expected behavior; we'd like to be able to pause replication for a particular account on our 2.2.32 active-active cluster, but delivering a message (LMTP) to the account seems to turn replication back on again: (replication on) server1:~# doveadm replicator status rgiles username priority fast sync full sync success sync failed rgiles none 00:00:30 23:45:01 00:00:30 - (remove manually) server:~# doveadm replicator remove rgiles (confirm replication is off) server:~# doveadm replicator remove rgiles Error: Replicator failed: User not found (confirm again that replication is still off) server1:~# doveadm replicator status rgiles username priority fast sync full sync success sync failed (and one more time, still off) server1:~# doveadm replicator status rgiles username priority fast sync full sync success sync failed (send an e-mail, and voila, replication is running again) server1:~# doveadm replicator status rgiles username priority fast sync full sync success sync failed rgiles none 00:00:01 00:00:03 00:00:01 - I've tried quickly disabling replication on both systems, and they inevitably override the 'doveadm replicator remove' command and begin dsync'ing again with each other. Thanks for any ideas out there - Robert

1 1

Re: Dovecot auth error
by Aki Tuomi 07 Nov '17

07 Nov '17

apparently my reply got lost.. have you installed dovecot-mysql package? ---Aki TuomiDovecot oy -------- Original message --------From: "Mathieu R." <mathieu(a)400iso.net> Date: 07/11/2017 16:18 (GMT+02:00) To: dovecot(a)dovecot.org Subject: Re: Dovecot auth error Maybe i got no answer because there is an error which seem obvious in my logs : Nov 4 20:57:55 vps81550 dovecot: auth: Fatal: sql: driver not set in configuration file /etc/dovecot/dovecot-sql.conf.ext I've obviously seen that, and tried to configure driver in that file, but it had no positive outcome, sous i reversed my config to the previous state. Considering what i've read, dovecot's MySQL configuration should be OK, but i still have that fatal error Le sam. 4 nov. 2017 à 21:02, Mathieu R. <mathieu(a)400iso.net> a écrit : > I just tried to configure a new dovecot/postfix server, and i end up with > a dovecot auth error at startup. > I can't find a solution by myself. > Below are details, thanks in advance for your precious help, and excuse my > poor english : > > dovecot --version > 2.2.27 (c0f36b0) (Debian) > > Dovecot -n : > https://400iso.net/public/dov.txt > > > grep -v '^ *$#.*$\?$' /etc/dovecot/dovecot-sql.conf > driver = mysql > connect = host=127.0.0.1 dbname=postfix user=postfix password=password > default_pass_scheme = MD5-CRYPT > user_query = SELECT '/srv/vmail/%d/%n' AS home, 3000 AS uid, 3000 AS gid, > CONCAT('*:bytes=', CAST(quota AS CHAR)) AS quota_rule FROM mailbox WHERE > username = '%u' AND active='1' > password_query = SELECT password FROM mailbox WHERE username = '%u' > > > Here is part of the server's log : > > Nov 4 20:57:49 vps81550 postfix/postscreen[21578]: CONNECT from > [209.85.215.51]:47485 to [149.56.x.x]:25 > Nov 4 20:57:49 vps81550 postfix/dnsblog[21583]: addr 209.85.215.51 listed > by domain dnsbl.sorbs.net as 127.0.0.6 > Nov 4 20:57:55 vps81550 postfix/postscreen[21578]: PASS OLD > [209.85.215.51]:47485 > Nov 4 20:57:55 vps81550 postfix/smtpd[21585]: connect from > mail-lf0-f51.google.com[209.85.215.51] > Nov 4 20:57:55 vps81550 postfix/smtpd[21585]: Untrusted TLS connection > established from mail-lf0-f51.google.com[209.85.215.51] TLSv1.2 with > cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits) > Nov 4 20:57:55 vps81550 dovecot: auth: Fatal: sql: driver not set in > configuration file /etc/dovecot/dovecot-sql.conf.ext > Nov 4 20:57:55 vps81550 dovecot: master: Error: service(auth): command > startup failed, throttling for 2 secs > Nov 4 20:57:55 vps81550 postfix/smtpd[21585]: fatal: no SASL > authentication mechanisms > Nov 4 20:57:56 vps81550 postfix/master[21528]: warning: process > /usr/lib/postfix/sbin/smtpd pid 21585 exit status 1 > Nov 4 20:57:56 vps81550 postfix/master[21528]: warning: > /usr/lib/postfix/sbin/smtpd: bad command startup -- throttling > -- > > Mathieu R. > -- Mathieu R.

1 0

Log reopen broken in 2.2.33?
by David Zambonini 07 Nov '17

07 Nov '17

Has re-opening the logfiles broken between 2.2.32 and 2.2.33 releases? Using the same config that I've had for the past 10 or so point releases, /usr/bin/doveadm log reopen works perfectly up until 2.2.32, but with 2.2.33 (and .1 and .2) no new logfiles are created, file descriptors still have the original files open and keep writings to those logs. On an idling test instance, I get: master: Warning: Sent SIGKILL to 1 log processes I can see both SIGUSR1 and SIGKILL generated by the master process, but the current log process doesn't terminate - it receives SIGUSR1, but not SIGKILL. Anyone able to verify this on their own setup? Am I missing a required config change? Using epoll, which hasn't changed. -- David Zambonini

2 3

dovecot-lda without starting dovecot?
by Stephan von Krawczynski 07 Nov '17

07 Nov '17

Hello, we have a setup where SMTP/LDA and POP3/IMAP are on different physical hosts. They share the mail data via an external storage. Now we would like to use dovecot-lda on the smtp host, so we wonder if the lda binary works without starting dovecot from init. As there will be no POP3/IMAP usage on this host it seems unnecessary. Nevertheless we cannot judge if it is still needed for lda&sieve to work. Your opinion? -- Regards, Stephan

4 5

mail_crypt plugin, few questions
by Zbyszek Żółkiewski 06 Nov '17

06 Nov '17

Hi, I have few questions regarding mail_crypt: 1) Is mail_crypt_global_private_key file read upon dovecot start/restart only or it is/can be read in any other time? I have made few tests by starting dovecot and removing master key for decryption - therefore it is not available on the platform - it only reside in memory, removing one of attack vectors 2) Is there planned any “rollout” for key rotation in the feature ? 3) is there any better way to encrypt mails that were sent before enabling mail_crypt ? I have made some simple script to automate and in-place encryption: https://gist.github.com/kolargol/d551d132949068ce6efce7bc85a317cb but maybe there is better way? If someone want to use it, please read code before as it require updating magic(5) local database thanks! _ Zbyszek Żółkiewski

2 5

stats module
by Jeff Abrahamson 06 Nov '17

06 Nov '17

I'd like to monitor my dovecot instance (running on ubuntu 16.04) using telegraf. [T] jeff@nantes-1:log $ dovecot --version 2.2.22 (fe789d2) [T] jeff@nantes-1:log $ To do that, I think I need to use the stats module and get it to talk on port 24242. I've not found enough documentation on this module to feel really comfortable with it, so it doesn't surprise me that I don't have it working. But I'd much appreciate if someone could point me in the right direction. In particular, nothing listens on 24242. # This file is based on https://wiki2.dovecot.org/Statistics # Dovecot v2.1+ supports gathering statistics (CPU, disk usage, etc.) # from mail processes (IMAP, POP3, LMTP, etc.) to the stats # process. The stats process can later be queried what's going on in # the system. With imap_stats plugin you can get per-command level # statistics for IMAP commands. # # There are different "zoom levels" you can look at the statistics: # # * command: Per-IMAP command # * session: Per IMAP/POP3 connection # * user: Per user (all of user's sessions summed up) # * domain: Per domain (all of domain's users summed up) # * ip: Per IP address (all sessions from the IP summed up) # * global: Everything summed up (2.2.16+) mail_plugins = $mail_plugins stats protocol imap { mail_plugins = $mail_plugins imap_stats } plugin { # how often to session statistics (must be set) stats_refresh = 30 secs # track per-IMAP command statistics (optional) stats_track_cmds = yes } # You'll also need to give enough permissions for mail processes to be # able to write to stats-mail fifo. For example if you use a single # "vmail" user for mail access: service stats { fifo_listener stats-mail { user = vmail mode = 0600 } } # Memory usage configuration # The stats process attempts to keep memory usage below a specified # amount. This value is only approximate because of extra overhead # caused by malloc() itself. stats_memory_limit = 16 M # Once the memory limit is reached, oldest statistics are freed from # memory. Different statistics levels have different timeout limits, # which are configured in: stats_command_min_time = 1 mins stats_domain_min_time = 12 hours stats_ip_min_time = 12 hours stats_session_min_time = 15 mins stats_user_min_time = 1 hours service stats { inet_listener { address = 127.0.0.1 port = 24242 } } Thanks in advance. -- Jeff Abrahamson +33 6 24 40 01 57 +44 7920 594 255 http://p27.eu/jeff/

6 11

migrating from maildir to mdbox, preserving pop3 UIDL
by Jan-Pieter Cornet 03 Nov '17

03 Nov '17

Hi, I'm trying to migrate from maildir to mdbox while preserving the pop3 UIDL (and the imap UID). The problem is, for maildir we use (for compatiblity with qpopper): pop3_uidl_format = %f Problem is, as soon as I convert that to mdbox, then whenever a client issues the UIDL command via a POP connection, the connection is closed and this error is displayed in the log: Error: UIDL: File name not found (pop3_uidl_format=%f not supported by storage?) As a workaround, I enabled "pop3_reuse_xuidl = yes", and before conversion I put an X-UIDL: header in the mails. However, since the UIDL is the filename and the filename also contains S=<size>,W=<sizeOnWire>, I need to change the header in such a way that the size and number of lines stay the same. That's... tedious and error-prone. Is there an easier solution, eg teaching 'doveadm sync' to preserve pop3 UIDL somehow? For the record, I currently convert maildir to mdbox using: doveadm -D backup -u user@domain 'doveadm -o mail=mdbox:/path/to/storage:INDEX=/path/to/fast/storage -o plugin/zlib_save=gz -o mail_uid=$UID -o mail_gid=$GID dsync-server' Thanks for any help! -- Jan-Pieter Cornet <johnpc(a)xs4all.net> Systeembeheer XS4ALL Internet bv www.xs4all.nl

1 0

Enabling notification for all users
by Delisle, John 03 Nov '17

03 Nov '17

Hello, I have a domain populated with ~60 users who infrequently receive email. As a result, they rarely check their email, and miss important messages. The users are virtual LDAP users, and each user has an attribute "backupMailAddress" that contains their primary high-traffic email address that they check daily. (i.e. they have an address like John(a)lowtrafficdomain.com<mailto:John@lowtrafficdomain.com>, and a backupMailAddress attribute like john(a)primaryemailaddress.com<mailto:john@primaryemailaddress.com> ) I'm looking to enable new-email notification for all users, and have the notifications go to their high-traffic email address (their backupMailAddress). I know I can do this through individual user managesieve.sieve configurations and have a script that populates this with a notify rule, but this solution doesn't scale well, and doesn't handle new users/ departing users well. Is the a way I could apply this globally, so that if a user has a populated backupMailAddress attribute, a notification is sent there? Thanks John Delisle | Solution Architecture | Ceridian HCM | m: 204.294.5529 (preferred) | w: 204.975.5909 John.Delisle(a)ceridian.com<mailto:John.Delisle@ceridian.com> | www.ceridian.com<http://www.ceridian.com/> Ceridian. Makes Work Life Better(tm) This communication is intended to be received only by the individual[s] or entity[s] to whom or to which it is addressed, and contains information which is confidential, privileged and subject to copyright. Any unauthorized use, copying, review or disclosure is prohibited. Please notify the sender immediately if you have received this communication in error [by calling collect, if necessary] so that we can arrange for its return at our expense. Thank you in advance for your anticipated assistance and cooperation. Cette communication est destinée uniquement à la personne ou à la personne morale à qui elle est adressée. Elle contient de l’information confidentielle, protégée par le secret professionnel et sujette à des droits d'auteurs. Toute utilisation, reproduction, consultation ou divulgation non autorisées sont interdites. Nous vous prions d’aviser immédiatement l’expéditeur si vous avez reçu cette communication par erreur (en appelant à frais virés, si nécessaire), afin que nous puissions prendre des dispositions pour en assurer le renvoi à nos frais. Nous vous remercions à l’avance de votre coopération.

1 0

LDAP Filters as defined for dovecot UserDB and passDB
by Will Merkens 03 Nov '17

03 Nov '17

I have pretty much everything working fine. I have run into one issue with the filters that I am unsure where this a filter is being set. Dovecot 2.2.32 (dfbe293d4) I have setup dovecot-ldap.conf.ext to control my LDAP query's My current layout used filters based on looking at the posixAccount attributes user_filter = (&(objectClass=posixAccount)(uid=%u)) If I connect to a a ldap account that has no posixAccount attributes set I was getting a failure in the logs Nov 02 14:15:48 mail2 dovecot[28715]: auth: Debug: ldap(sales,192.168.123.39,<fd5mpwVddrvAqHsn>): user search: base=ou=People,dc=userful,dc=ca scope=subtree filter=(&(objectClass=posixAccount)(uid=sales)) fields=mail,user_filter Nov 02 14:15:48 mail2 dovecot[28715]: auth: Debug: ldap(sales,192.168.123.39,<fd5mpwVddrvAqHsn>): no fields returned by the server Nov 02 14:15:48 mail2 dovecot[28715]: auth: ldap(sales,192.168.123.39,<fd5mpwVddrvAqHsn>): unknown user Nov 02 14:15:48 mail2 dovecot[28715]: auth: Error: ldap(sales,192.168.123.39,<fd5mpwVddrvAqHsn>): user not found from userdb I changed the filters thinking I needed to look at the attributes seen by one of these accounts, I used the apache studio to find out what was visible. >From that I saw inetOrgPerson could be used. So I changed the filters. user_filter = (&(objectClass=inetOrgPerson)(uid=%u)) pass_filter = (&(objectClass=inetOrgPerson)(uid=%n)) iterate_filter = (objectClass=inetOrgPerson) Nov 02 14:26:44 mail2 dovecot[29047]: auth: Debug: client in: AUTH 1 PLAIN service=imap secured session=Y0GBzgVdlorAqHsn lip=192.168.123.236 Nov 02 14:26:44 mail2 dovecot[29047]: auth-worker(29066): Debug: ldap(sales(a)userful.com,192.168.123.39,<Y0GBzgVdlorAqHsn>): bind search: base=ou=People,dc=userful,dc=ca filter=(&(objectClass=inetOrgPerson)(uid=sales)) Nov 02 14:26:44 mail2 dovecot[29047]: auth-worker(29066): Debug: ldap(sales(a)userful.com,192.168.123.39,<Y0GBzgVdlorAqHsn>): result: uid=sales; uid unused Nov 02 14:26:44 mail2 dovecot[29047]: auth-worker(29066): Debug: ldap(sales(a)userful.com,192.168.123.39,<Y0GBzgVdlorAqHsn>): username changed sales(a)userful.com -> sales Nov 02 14:26:44 mail2 dovecot[29047]: auth-worker(29066): Debug: ldap(sales,192.168.123.39,<Y0GBzgVdlorAqHsn>): result: uid=sales Nov 02 14:26:44 mail2 dovecot[29047]: auth: Debug: ldap(sales(a)userful.com,192.168.123.39,<Y0GBzgVdlorAqHsn>): username changed sales(a)userful.com -> sales Nov 02 14:26:44 mail2 dovecot[29047]: auth: Debug: client passdb out: OK 1 user=sales original_user=sales(a)userful.com so far so good but then I get Nov 02 14:26:44 mail2 dovecot[29047]: auth: Debug: master in: REQUEST 3851550721 29049 1 519189df600c24c010b57158ac01c867 session_pid=29073 request_auth_token Nov 02 14:26:44 mail2 dovecot[29047]: auth-worker(29066): Debug: ldap(sales,192.168.123.39,<Y0GBzgVdlorAqHsn>): user search: base=ou=People,dc=userful,dc=ca scope=subtree filter=(&(objectClass=posixAccount)(uid=sales)) fields=mail,user_filter Nov 02 14:26:44 mail2 dovecot[29047]: auth-worker(29066): Debug: ldap(sales,192.168.123.39,<Y0GBzgVdlorAqHsn>): no fields returned by the server Nov 02 14:26:44 mail2 dovecot[29047]: auth-worker(29066): ldap(sales,192.168.123.39,<Y0GBzgVdlorAqHsn>): unknown user Nov 02 14:26:44 mail2 dovecot[29047]: auth: Error: ldap(sales,192.168.123.39,<Y0GBzgVdlorAqHsn>): user not found from userdb The question then is where did it get filter=(&(objectClass=posixAccount) from since I changed the filters to inetOrgPerson I grep the dovecot settings directory and all My filters are in the one file. The file that hold the ldap settings -- William Merkens IT Support Analyst Userful Corporation +1 403.289.2177 ext.289 +1 866 USERFUL (1-866-873-7385) Suite 300, 736 8th Ave. SW Calgary AB T2P 1H4 Managed Desktops Done Right. http://www.userful.com

3 3

Bug: lmtp proxy does not quote local parts with spaces
by David Zambonini 03 Nov '17

03 Nov '17

There seems to be a bug with RFC822 processing in ltmp proxying that doesn't quote local parts that, for example, contain spaces. director config: director_username_hash = %Ln lmtp_proxy = yes recipient_delimiter = + protocol lmtp { auth_socket_path = director-userdb auth_username_chars = auth_username_format = %Ln passdb { driver = sql args = /etc/director/sql.d/lmtp.ext result_failure = return-fail result_internalfail = return-fail } } lmtp.ext: password_query = SELECT 'y' AS proxy, NULL AS password, 'y' AS nopassword FROM users WHERE userName='%Ln' from exim -> director LMTP network dump: MAIL FROM:<test(a)testdomain.com>\r\n RCPT TO:<"deemzed.uk+Junk E-mail"@mailbox.localhost>\r\n DATA\r\n (etc) .\r\n 501 5.5.4 Invalid parameters\r\n QUIT\r\n from director -> dovecot LMTP network dump: MAIL FROM:<test(a)testdomain.com>\r\n RCPT TO:<deemzed.uk+Junk E-mail>\r\n 501 5.5.4 Invalid.parameters\r\n I'll try to pare down a full config for doveconf that displays this behaviour if required, as currently I have sensitive/extraneous information in there, but this seems fairly cut and dried as a bug to me. -- Dave

3 7