- dovecot - dovecot.org

MFA 2FA TOTP razz-ma-tazz!
by WJCarpenter 22 Oct '16

22 Oct '16

I'd like to start offering my server's users multi-factor authentication. Right now, I funnel all authentication through dovecot. Before I get too far down the fantasy design path, I'm wondering if anyone else has already done this and could share some details or code. (I loaded up the subject line with acronyms to show how serious I am. :-)) I am specifically thinking of two-factor authentication using TOTP (time-based one-time passwords) as described in RFC-6238. Those are the ones compatible with Google Authenticator and compatible apps. I already am a user of those at several sites. Some of them don't have a separate opportunity to enter the 6-digit code. Instead, you append the 6-digit code to your normal password. If your config on the site shows you as a user of TOTP, they peel those trailing 6 digits off your password and then validate the rest of the password in the normal way. That is what I think I would do for dovecot authentication. So, who's already done this or something like it?

1 0

Dovecot does not close connections
by Benedikt Carda 22 Oct '16

22 Oct '16

Hello, I am running into this error: /Maximum number of connections from user+IP exceeded (mail_max_userip_connections=10)/ The suggested solution in hundreds of support requests on this mailing list and throughout the internet is to increase the number of maximum userip connections. But this is not curing the problem, it is just postponing it to the moment when the new limit is reached. When i type: /doveadm who// / I can see that some accounts have several pids running: /someaccount 10 imap (25396 25391 25386 25381 25374 7822 7817 5559 5543 5531) (xxx.xxx.xxx.xxx)/ Now when I check these pids with /ps aux/ I find out that the oldest pid (5531) has a lifetime of already over 12 hours. Anyway I know that the clients that initiated the connections are not connected anymore, so there is no way that there is a valid reason why this connection should still be open. Also I never had this problem before, it appeared some months ago. Does anybody know how to solve this? Thanks in advance, Benedikt.

3 4

keent() from Tika - with doveadm
by Larry Rosenman 21 Oct '16

21 Oct '16

getting the following: Oct 21, 2016 12:04:25 PM org.apache.tika.server.resource.TikaResource logRequest INFO: tika/ (application/vnd.openxmlformats-officedocument.wordprocessingml.document) doveadm(ctr): Debug: http-client: conn 127.0.0.1:9998 [1]: Got 200 response for request [Req69: PUT http://localhost:9998/tika/] (took 91 ms + 210 ms in queue) doveadm(ctr): Panic: kevent(): Invalid argument Abort trap (core dumped) if I turn off tika, I do NOt get it. 2.2.26-RC1 what else do you need? -- Larry Rosenman http://www.lerctr.org/~ler Phone: +1 214-642-9640 (c) E-Mail: larryrtx(a)gmail.com US Mail: 17716 Limpia Crk, Round Rock, TX 78664-7281

2 2

Released Pigeonhole v0.4.16.rc1 for Dovecot v2.2.26.rc1.
by Stephan Bosch 21 Oct '16

21 Oct '16

Hello Dovecot users, The upcoming release includes quite a few new features for a change. The most important ones are the Sieve discard-script feature and the new vnd.dovecot.config environment items. Documentation for these features can be found in the package itself. Please test these thoroughly. Changelog v0.4.16: * Part of the Sieve extprograms implementation was moved to Dovecot, which means that this release depends on Dovecot v2.2.26+. * ManageSieve: The PUTSCRIPT command now allows uploading empty Sieve scripts. There was really no good reason to disallow doing that. + Sieve vnd.dovecot.report extension: + Added a Dovecot-Reporting-User field to the report body, which contains the e-mail address of the user sending the report. + Added support for configuring the "From:" address used in the report. + LDA sieve plugin: Implemented support for a "discard script" that is run when the message is going to be discarded. This allows doing something other than throwing the message away for good. + Sieve vnd.dovecot.environment extension: Added vnd.dovecot.config.* environment items. These environment items map to sieve_env_* settings from the plugin {} section in the configuration. Such values can of course also be returned from userdb. + Sieve vacation extension: Use the Microsoft X-Auto-Response-Suppress header to prevent unwanted responses from and to (older) Microsoft products. + ManageSieve: Added rawlog_dir setting to store ManageSieve traffic logs. This replaces at least partially the rawlog plugin (mimics similar IMAP/POP3 change). - doveadm sieve plugin: synchronization: Prevent setting file timestamps to unix epoch time. This occurred when Dovecot passed the timestamp as 'unknown' during synchronization. - Sieve exprograms plugin: Fixed spurious '+' sometimes returned at the end of socket-based program output. - imapsieve plugin: Fixed crash occurring in specific situations. - Performed various fixes based on static analysis and Clang warnings. The release is available as follows: http://pigeonhole.dovecot.org/releases/2.2/rc/dovecot-2.2-pigeonhole-0.4.16… http://pigeonhole.dovecot.org/releases/2.2/rc/dovecot-2.2-pigeonhole-0.4.16… Refer to http://pigeonhole.dovecot.org and the Dovecot v2.x wiki for more information. Have fun testing this release candidate and don't hesitate to notify me when there are any problems. Regards, -- Stephan Bosch stephan(a)rename-it.nl

1 0

v2.2.26 release candidate released
by Timo Sirainen 21 Oct '16

21 Oct '16

http://dovecot.org/releases/2.2/rc/dovecot-2.2.26.rc1.tar.gz http://dovecot.org/releases/2.2/rc/dovecot-2.2.26.rc1.tar.gz.sig There are quite a lot of changes since v2.2.25. Please try out this RC so we can get a good and stable v2.2.26 out. * master: Removed hardcoded 511 backlog limit for listen(). The kernel should limit this as needed. * doveadm import: Source user is now initialized the same as target user. Added -U parameter to override the source user. * Mailbox names are no longer limited to 16 hierarchy levels. We'll check another way to make sure mailbox names can't grow larger than 4096 bytes. + Added a concept of "alternative usernames" by returning user_* extra field(s) in passdb. doveadm proxy list shows these alt usernames in "doveadm proxy list" output. "doveadm director&proxy kick" adds -f <passdb field> parameter. The alt usernames don't have to be unique, so this allows creation of user groups and kicking them in one command. + auth: passdb/userdb dict allows now %variables in key settings. + auth: If passdb returns noauthenticate=yes extra field, assume that it only set extra fields and authentication wasn't actually performed. + auth: passdb static now supports password={scheme} prefix. + imapc: Added imapc_max_line_length to limit maximum memory usage. + imap, pop3: Added rawlog_dir setting to store IMAP/POP3 traffic logs. This replaces at least partially the rawlog plugin. + dsync: Added dsync_features=empty-header-workaround setting. This makes incremental dsyncs work better for servers that randomly return empty headers for mails. When an empty header is seen for an existing mail, dsync assumes that it matches the local mail. + doveadm sync/backup: Added -I <max size> parameter to skip too large mails. + doveadm sync/backup: Fixed -t parameter and added -e for "end date". + doveadm mailbox metadata: Added -s parameter to allow accessing server metadata by using empty mailbox name. - master process's listener socket was leaked to all child processes. This might have allowed untrusted processes to capture and prevent "doveadm service stop" comands from working. - auth: userdb fields weren't passed to auth-workers, so %{userdb:*} from previous userdbs didn't work there. - auth: Each userdb lookup from cache reset its TTL. - auth: Fixed auth_bind=yes + sasl_bind=yes to work together - auth: Blocking userdb lookups reset extra fields set by previous userdbs. - auth: Cache keys didn't include %{passdb:*} and %{userdb:*} - auth-policy: Fixed crash due to using already-freed memory if policy lookup takes longer than auth request exists. - lib-auth: Unescape passdb/userdb extra fields. Mainly affected returning extra fields with LFs or TABs. - lmtp_user_concurrency_limit>0 setting was logging unnecessary anvil errors. - lmtp_user_concurrency_limit is now checked before quota check with lmtp_rcpt_check_quota=yes to avoid unnecessary quota work. - lmtp: %{userdb:*} variables didn't work in mail_log_prefix - autoexpunge settings for mailboxes with wildcards didn't work when namespace prefix was non-empty. - Fixed writing >2GB to iostream-temp files (used by fs-compress, fs-metawrap, doveadm-http) - director: Ignore duplicates in director_servers setting. - zlib, IMAP BINARY: Fixed internal caching when accessing multiple newly created mails. They all had UID=0 and the next mail could have wrongly used the previously cached mail. - doveadm stats reset wasn't reseting all the stats. - auth_stats=yes: Don't update num_logins, since it doubles them when using with mail stats. - quota count: Fixed deadlocks when updating vsize header. - dict-quota: Fixed crashes happening due to memory corruption. - dict proxy: Fixed various timeout-related bugs. - doveadm proxying: Fixed -A and -u wildcard handling. - doveadm proxying: Fixed hangs and bugs related to printing. - imap: Fixed wrongly triggering assert-crash in client_check_command_hangs. - imap proxy: Don't send ID command pipelined with nopipelining=yes - imap-hibernate: Don't execute quota_over_script or last_login after un-hibernation. - imap-hibernate: Don't un-hibernate if client sends DONE+IDLE in one IP packet. - imap-hibernate: Fixed various failures when un-hibernating. - fts: fts_autoindex=yes was broken in 2.2.25 unless fts_autoindex_exclude settings existed. - fts-solr: Fixed searching multiple mailboxes (patch by x16a0) - doveadm fetch body.snippet wasn't working in 2.2.25. Also fixed a crash with certain emails. - pop3-migration + dbox: Various fixes related to POP3 UIDL optimization in 2.2.25. - pop3-migration: Fixed "truncated email header" workaround.

10 17

Migrating users from a 2.0.19 to a 2.2.24 installation
by Gerben Wierda 21 Oct '16

21 Oct '16

Hello, I am currently still running an older dovecot (2.0.19apple1 on Mac OS X 10.8.5) and I want to migrate my users to a new server (macOS 10.12 with Server 5, which contains dovecot 2.2.24 (a82c823)). Basically, I want to create a new server installation on the new server so I don't bring any junk over (new user accounts, with the same uid/gid (still need to figure that one out), but after I have done that I need to move the data over from the old instalation to the new. Has anything changed in the formats between 2.0 and 2.2 that will stop me from doing this? Thanks, G

2 1

Extending IMAP daemon to comply with legacy Proxy
by Thorsten Hater 21 Oct '16

21 Oct '16

Hello, I am currently investigating if and how to migrate a legacy setup based on a modified Courier installation to Dovecot. So far I am really liking Dovecot. however, I will have to work with an existing IMAP proxy for the time being. In particular, the proxy authenticates the user and looks up the location of the mail directory and transfers the data to the actual server via an extension of the IMAP protocol. This extension will have to stay and the information transferred is not easily recoverable. Further database lookups on the real server would be possible to solve the issue, but I would prefer to keep the design intact at least for now. Is it possible to handle IMAP commands after LOGIN/AUTHENTICATE but before opening any mailboxes? Basically these commands aim to replace the userdb lookup. Any pointers on how to implement this, perhaps as a plugin? Best regards, Thorsten

1 0

sieve duplicate locking
by Alexander 'Leo' Bergolth 20 Oct '16

20 Oct '16

Hi! Does the duplicate sieve plugin do any locking to avoid duplicate parallel delivery of the same message? I sometimes experience duplicate mail delivery of messages with the same message-id, despite the use of a sieve duplicate filter. According to the log files, those messages are delivered in the same second by two parallel dovecot-lda processes. (Duplicate filtering works fine in all other cases.) RFC7352 states that the ID of a message may only be committed to the duplicate tracking list at the _end_ of a successful script execution, which may lead to race conditions. Maybe I am running into this? Is there an easy way to serialize mail delivery using some locking inside sieve? Or do I have to serialize per-user dovecot-lda delivery? Any experiences with that? I am using dovecot-2.2.25 and pidgeonhole-0.4.15. Mail is delivered using postfix-2.10 and dovecot-lda as mailbox_command. Mailbox format is maildir with LAYOUT=fs. Cheers, --leo -- e-mail ::: Leo.Bergolth (at) wu.ac.at fax ::: +43-1-31336-906050 location ::: IT-Services | Vienna University of Economics | Austria

2 2

Re: Massive LMTP Problems with dovecot
by Ralf Hildebrandt 20 Oct '16

20 Oct '16

> We'll need the `dovecot -n` output first. Here we go: > # 2.2.devel (933d16f): /etc/dovecot/dovecot.conf > # Pigeonhole version 0.4.devel (63f9b42) > # OS: Linux 3.13.0-98-generic x86_64 Ubuntu 14.04.5 LTS > default_vsz_limit = 2 G > lmtp_user_concurrency_limit = 10000 > mail_attachment_dir = /home/copymail/attachments > mail_location = mdbox:~/mdbox > mail_plugins = zlib fts fts_lucene > mdbox_rotate_size = 128 M > namespace inbox { > inbox = yes > location = > mailbox Drafts { > special_use = \Drafts > } > mailbox Junk { > special_use = \Junk > } > mailbox Sent { > special_use = \Sent > } > mailbox "Sent Messages" { > special_use = \Sent > } > mailbox Trash { > special_use = \Trash > } > prefix = > } > passdb { > args = username_format=%u /etc/dovecot/passwd > driver = passwd-file > } > plugin { > fts = lucene > fts_autoindex = yes > fts_languages = de,en > fts_lucene = whitespace_chars=@. > sieve = file:~/sieve;active=~/.dovecot.sieve > zlib_save = gz > zlib_save_level = 5 > } > protocols = " imap lmtp" > service imap-login { > inet_listener imap { > address = 127.0.0.1 > port = 143 > } > inet_listener imaps { > port = 993 > ssl = yes > } > } > service lmtp { > inet_listener lmtp { > address = 141.42.1.208 > port = 1025 > } > unix_listener /var/spool/postfix/private/dovecot-lmtp { > group = postfix > mode = 0660 > user = postfix > } > } > ssl_ca = /etc/ssl/certs/ca-certificates.crt > ssl_cert = </etc/ssl/certs/mail-cbf.pem > ssl_cipher_list = EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+aRSA+RC4:EECDH:EDH+aRSA:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS:!RC4 > ssl_key = # hidden, use -P to show it > ssl_prefer_server_ciphers = yes > ssl_protocols = !SSLv2 !SSLv3 > userdb { > args = username_format=%u /etc/dovecot/passwd > driver = passwd-file > } > protocol lmtp { > mail_plugins = zlib fts fts_lucene > } Ralf Hildebrandt Geschäftsbereich IT | Abteilung Netzwerk Charité - Universitätsmedizin Berlin Campus Benjamin Franklin Hindenburgdamm 30 | D-12203 Berlin Tel. +49 30 450 570 155 | Fax: +49 30 450 570 962 ralf.hildebrandt(a)charite.de | http://www.charite.de

2 6

Lmtp Fatal Error
by Sven Roellig 19 Oct '16

19 Oct '16

Hi,dovecot is create an Fatal Panik Error. <AM5DMwaCBlgpDQAAWm89Cw>: Fatal: master: service(lmtp): child 3369 killed with signal 6 (core dumps disabled) <1jx3DhuCBlg1DQAAWm89Cw>: Panic: file lda-sieve-plugin.c: line 447 (lda_sieve_execute_scripts): assertion failed: (script != NULL) <1jx3DhuCBlg1DQAAWm89Cw>: Error: Raw backtrace: /usr/lib/dovecot/libdovecot.so.0(+0x93fae) [0x7f547f6a3fae] -> /usr/lib/dovecot/libdovecot.so.0(+0x9409c) [0x7f547f6a409c] -> /usr/lib/dovecot/libdovecot.so.0(i_fatal+0) [0x7f547f63d56e] -> /usr/lib/dovecot/modules/lib90_sieve_plugin.so(+0x3ae8) [0x7f547d765ae8] -> /usr/lib/dovecot/libdovecot-lda.so.0(mail_deliver+0x49) [0x7f547fc709a9] -> dovecot/lmtp(+0x7201) [0x7f54800a1201] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_call_io+0x5f) [0x7f547f6b88bf] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run_internal+0x10a) [0x7f547f6b9d8a] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run+0x25) [0x7f547f6b8965] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_run+0x30) [0x7f547f6b8b00] -> /usr/lib/dovecot/libdovecot.so.0(master_service_run+0x13) [0x7f547f643ac3] -> dovecot/lmtp(main+0x1c9) [0x7f548009f2c9] -> /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xf5) [0x7f547f286b45] -> dovecot/lmtp(+0x53ae) [0x7f548009f3ae] Normal Mails are not deliverd but filterd mails are deliverd. System is Debian 8.6 Dovecot Core is 2%3a2.3.0-alpha0-1-auto+385 AMD64 can anyone help. Sven

3 4