- dovecot - dovecot.org

lazy-load SNI?
by Felipe Gasper 15 Nov '16

15 Nov '16

Hello, We’re rolling out large SNI deployments for our mail servers. Each domain gets an entry like this in the config: local_name mail.foo.com { ssl_cert = </ssl/domain_tls/*.foo.com/combined ssl_key = </ssl/domain_tls/*.foo.com/combined } There are a couple problems we’re finding with this approach: 1) Dovecot wants to load everything at once, which has some machines taking up many GiB of memory just for Dovecot. Is there any way to defer loading of an SSL cert until a client actually requests it? 2) Any time we add or remove a domain, Dovecot’s SNI config matrix needs to be rebuilt. Is there a way to handle SNI requests dynamically via some sort of configuration plugin, so we wouldn’t need to rebuild the config on domain add/remove? I looked through the docs but couldn’t see a way to do this. Thank you in advance! -Felipe Gasper Mississauga, ON

4 12

[PATCH] ssl: fix reference to SSLv2 and disable SSLv3
by Apollon Oikonomopoulos 15 Nov '16

15 Nov '16

This is driven by the fact that OpenSSL 1.1 does not know about SSLv2 at all and dovecot's defaults simply make OpenSSL error out with "Unknown protocol 'SSLv2'"[1]. So we change the defaults to refer to SSLv2 iff OpenSSL seems to know something about it. While at it, it's also a good idea to disable SSLv3 by default as well. [1] https://bugs.debian.org/844347 Signed-off-by: Apollon Oikonomopoulos <apoikos(a)debian.org> --- doc/example-config/conf.d/10-ssl.conf | 2 +- src/lib-master/master-service-ssl-settings.c | 6 +++++- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/doc/example-config/conf.d/10-ssl.conf b/doc/example-config/conf.d/10-ssl.conf index 31b750c..2cd445b 100644 --- a/doc/example-config/conf.d/10-ssl.conf +++ b/doc/example-config/conf.d/10-ssl.conf @@ -46,7 +46,7 @@ ssl_key = </etc/ssl/private/dovecot.pem #ssl_dh_parameters_length = 1024 # SSL protocols to use -#ssl_protocols = !SSLv2 +#ssl_protocols = !SSLv3 # SSL ciphers to use #ssl_cipher_list = ALL:!LOW:!SSLv2:!EXP:!aNULL diff --git a/src/lib-master/master-service-ssl-settings.c b/src/lib-master/master-service-ssl-settings.c index 4a05045..6b43f6c 100644 --- a/src/lib-master/master-service-ssl-settings.c +++ b/src/lib-master/master-service-ssl-settings.c @@ -44,7 +44,11 @@ static const struct master_service_ssl_settings master_service_ssl_default_setti .ssl_key = "", .ssl_key_password = "", .ssl_cipher_list = "ALL:!LOW:!SSLv2:!EXP:!aNULL", - .ssl_protocols = "!SSLv2", +#ifdef SSL_TXT_SSLV2 + .ssl_protocols = "!SSLv2 !SSLv3", +#else + .ssl_protocols = "!SSLv3", +#endif .ssl_cert_username_field = "commonName", .ssl_crypto_device = "", .ssl_verify_client_cert = FALSE, -- 2.10.1

2 1

save failed to open mailbox quarantine
by Eggert Ehmke FTV Spandau 14 Nov '16

14 Nov '16

I have dovecot 2.2.13 set up with spamassassin and amavis. This works fine so far, Spam emails are forwarded to "username+Quarantine(a)mydomain.de". The recipient_delimiter=+ is set, the Quarantine folder exists. However, Dovecot tries to deliver it to a folder quarantine, that does not exist. In the dovecot-deliver.log there are these lines: Nov 14 14:16:13 lda(username(a)mydomain.de): Info: msgid=<2707212.2aHC3KDWrN@wookie>: save failed to open mailbox quarantine: Mailbox doesn't exist: quarantine Nov 14 14:16:13 lda(username(a)mydomain.de): Info: msgid=<2707212.2aHC3KDWrN@xxxxxx>: saved mail to INBOX Indeed the message is found in the inbox. What can be done so the folder name is not converted to lower case?

2 5

How does one mark all messages as read (imap4flag "seen") with sieve?
by Ben Johnson 14 Nov '16

14 Nov '16

Hello! I had hoped that marking all messages that arrive to a specific mailbox as read/seen would be as simple as applying the following sieve script to all incoming mail for that mailbox user: ######################## require ["imap4flags"]; addflag "\\Seen"; ######################## With this script in-place, mail does not appear to be marked as read/seen. It arrives as it normally would, and my email client sees it as new mail. Is something more required? Or is it a bug/limitation in my email client? I've found many examples of "addflag "\\Seen";" on the web, but all of them are wrapped in conditional logic of some variety. This is a spam-training mailbox and I simply want everything marked as seen/read upon arrival so I'm not bothered/notified every time. Thanks for any pointers here! -Ben

3 12

dovecot / tcp-wrappers / FBSD 10.3
by Jim Pazarena 14 Nov '16

14 Nov '16

Can anyone share the proper config to get wrappers working in dovecot on FreeBSD? The dovecot examples do not seem to work, and I thought perhaps FBSD needs slightly different configs. I've compiled with: -DHAVE_LIBWRAP which I presume is the first step. The example for dovecot.conf in uncommenting: login_access_sockets = tcpwrap merely causes a log error of "imap-login: Error: connect(tcpwrap) failed: No such file or directory" Suggestions/Direction much appreciated.

3 2

Self-Signed Certificate issue
by Darryl Baker 13 Nov '16

13 Nov '16

My apologies if this is a repeat but my search of the archive did not turn it up in the recent past. If this has been covered just point me at the previous thread, please. I am running a small email site which I am moving from uw-imapd and Solaris to Ubuntu and Dovecot imaps and pop3s. I am trying to use a self-signed certificate for this site. I am using Thunderbird as the test client. I've tried both the pre-built snakeoil certificate and building a special one for dovecot. In /var/log/mail.err I keep getting what I am interpreting as a missing CA cert. The message is: dovecot: imap-login: Error: SSL: Stacked error: error:14094418:SSL routines:ssl3_read_bytes:tlsv1 alert unknown ca: SSL alert number 48 The certificate was created by: openssl req -new -x509 -days 365 -nodes -out /etc/ssl/certs/dovecot.pem -keyout /etc/ssl/private/dovecot.pem The Dovecot version is 2.2.22 (fe789d2) The Ubuntu version is 16.04 LTS current patches. *Darryl Baker*

3 3

help needed configuration of quota warning mails
by Götz Reinicke 13 Nov '16

13 Nov '16

Hi, we run dovecot 2.2.24 and from what I see, quota management with warning message is configured currently with "noenforcing". Our individual quota limit is stored in the users ldap DN which is fetched as I see from the logs and by "doveadm quota get -u" I tried to trigger the warning mail by going over the limit on my account step by step and can see that values are counted with the command above and in thunderbird by showing the orange and than red warning symbol at the bottom for me. But the warning mail script is not triggert. How may I debug this? /usr/local/bin/quota-warning.sh is owned currently by vmail and executable by vmail. Thanks for feedback and suggestion . /Götz

1 0

Dovecot lmtp
by Peter Fraser 13 Nov '16

13 Nov '16

Hi All I am migrating from dovecot-1.x where I had LDA running to dovecot2-2.2.26.0_1 where I am trying to set up LMTP. I have enabled a TCP/IP socket .Setting below. service lmtp { inet_listener lmtp { address = 127.0.0.1 port = 24 } } and put this additional entry in postfix virtual_transport = lmtp:127.0.0.1:24 in 10-mail.conf my mail location is below mail_location=maildir:~/Maildir:INBOX=~/Maildir/:INDEX=~/Maildir/tmp/index My problem is that when I enable lmtp, dovecot creates a new maildir at /home/vmail/user(a)domain.com and delivers the email there in a Maildir instead of using the default one at /home/vmail/username I researched it but I just can't seem to figure out why this is. I would really appreciate any help on this. Thanks in advance.

2 1

Redirect the emails from domain2 to domain1
by Quaquaraquà 11 Nov '16

11 Nov '16

Dear Dovecot and Exim users, I have a VPS using these two applications. I am transitioning from a domain_old to a domain_new. I'd like to redirect all the emails from domain_old to the local mailboxes of users @ domain_new. In exim I've assumed that it is enough to add domain_old to the list of local domains: domainlist local_domains = @ : domain_new : domain_old ... begin routers ... local_users: debug_print = "R: local_user for $local_part@$domain" driver = accept domains = +local_domains transport = dovecot_lmtp cannot_route_message = Unknown user However in Dovecot I'm checking both the username and the domain to perform the authentication: auth_username_format = %Lu passdb { driver = sql ; } password_query = SELECT username, domain, password FROM users WHERE username = '%n' AND domain = '%d' To have this system to work, I wish some special rule that rewrites the domain from domain_old to domain_new. But I'm not sure whether this needs to be done in exim or dovecot and how to add it? - Quaquaraqua'

3 2

How to Analyze Missing UIDs (and Files) in Maildirs?
by Jochen Bern 11 Nov '16

11 Nov '16

Hello everyone, I would like pointers on how to analyze the following situation, please: I'm running one test and one production dovecot IMAPS server for one of our platforms. The clients are essentially appliances we distribute, auth by client cert, virtual users only, mailboxes in maildir format: > auth_ssl_require_client_cert = yes > auth_ssl_username_from_cert = yes > auth_mechanisms = plain > ssl = required > ssl_cert = </etc/pki/dovecot/certs/... > ssl_key = </etc/pki/dovecot/private/... > ssl_ca = </etc/pki/dovecot/certs/... > ssl_verify_client_cert = yes > mail_location = maildir:~ > userdb { > driver = static > args = uid=... gid=... home=/home/.../%Ld_realm/%Ln > } > passdb { > driver = static > args = password=... > } The client certs have CNs unique to the appliance and no client besides that appliance is supposed to access the mailbox. Appliances take note of the UIDs they've seen (and not yet deleted) and expect to be able to re-access e-mails by the UIDs they know. (Needless to say, I keep my hands away from the cache files so as not to cause the UIDs to be reassigned.) The dovecot version used is updated along with the CentOS 6 source RPMs - which contain a 2.0.9 plus whatever patches CentOS backported - and receives two additional patches from me, one from current dovecot sources to improve closure of inactive SSL connections and one from me that turns the IMAP CREATE command into a NOP; the appliance code doesn't expect mailboxes to have folders besides INBOX. ------- QA is looking into an upcoming new feature that requires appliances to reread old e-mails, and got errors that UIDs the test appliances expected to still be on the (test) server weren't. I verified, the UIDs are indeed absent from the dovecot-uidlist files. The mails in question arrived *sometime* over the course of the last 12 months and must've vanished *sometime* since then ... ugh. No trace of what may have happened to them in any logs, of course. On the test server, I re-enabled logging of DELETE, UNDELETE and EXPUNGE commands, in case the appliances delete mails themselves and forget to update their own cache. Are there other IMAP commands that could remove mails, and thus should be added to the list? Would it be possible to have dovecot configured so that there's a log entry whenever a client tries to retrieve a UID that dovecot doesn't have in the maildir anymore? ------- While looking into the above issue, I noticed that a large number of mailboxes (test as well as production) have UIDs that *are* listed in dovecot-uidlist, yet, no corresponding file is present anymore. Example: > # grep -c : *_realm/$EXAMPLE_USER/dovecot-uidlist > 58 > # grep : *_realm/$EXAMPLE_USER/dovecot-uidlist | sed -e '2,57d' -e 's/ .*//' > 1 > 152 > # for PAIR in `grep : *_realm/$EXAMPLE_USER/dovecot-uidlist | sed -e 's/ .*:/:/'` ; do > > IMAP_UID=`echo $PAIR | sed -e 's/:.*//'`; BASE=`echo $PAIR | sed -e 's/.*://'` > > CNT=`find *_realm/$EXAMPLE_USER -type f -name "$BASE"'*' -ls | wc -l` > > if [ $CNT -ne 1 ]; then echo "Found $CNT files for UID $IMAP_UID"; fi; done > Found 0 files for UID 135 > Found 0 files for UID 136 > Found 0 files for UID 139 > Found 0 files for UID 142 > Found 0 files for UID 143 > Found 0 files for UID 144 > Found 0 files for UID 145 > Found 0 files for UID 150 > Found 0 files for UID 151 Is that normal behaviour? If not, how would I try to find out what happens there? Kind regards, -- Jochen Bern Systemingenieur Fon: +49 6151 9067-231 Fax: +49 6151 9067-290 E-Mail: jochen.bern(a)binect.de www.binect.de www.facebook.de/binect Binect GmbH Robert-Koch-Straße 9, 64331 Weiterstadt, DE Geschäftsführung: Christian Ladner, Dr. Frank Wermeyer, Nils Manegold Unternehmenssitz: Weiterstadt Register: Amtsgericht Darmstadt, HRB 94685 Umsatzsteuer-ID: DE 221 302 264 MAX 21-Unternehmensgruppe

1 0