- dovecot - dovecot.org

Missing mailboxes after migration from Maildir -> mdbox
by A 08 Mar '23

08 Mar '23

I migrated from existing dovecot Maildir to dbox. After adding separator to the namespace it migrated all Inbox mails, but the other mailboxes like user-created ones and "Junk", "Sent" and so on has not been migrated. Any advice would be helpful, here is my dovconf: https://pastebin.com/rDSeBcLe My migration I made using: 1. Edit dovecot.conf with new mdbox and adding separator 2. dsync mirror per user with old maildir:~/mail 3. missing mailboxes: tried with doveadm sync also with -f mode and specified mailboxes. No luck. dsync -v -u admin@(removed) mirror maildir:~/mail mail_home = /var/vmail/mailboxes/%d/%n #mail_location = maildir:~/mail:LAYOUT=fs mail_location=mdbox:~/mdbox My directorys: root@mail:/var/vmail/mailboxes/example.de/admin# ls -l insgesamt 56 drwxrwx--- 2 vmail vmail 4096 8. Mär 01:14 cur -rw-rw---- 1 vmail vmail 160 8. Mär 01:14 dovecot.index.log -rw-rw---- 1 vmail vmail 3712 8. Mär 01:14 dovecot.list.index.log -rw-rw---- 1 vmail vmail 96 8. Mär 01:14 dovecot.mailbox.log -rw-rw---- 1 vmail vmail 51 8. Mär 01:14 dovecot-uidlist -rw-rw---- 1 vmail vmail 8 8. Mär 01:14 dovecot-uidvalidity -r--r--r-- 1 vmail vmail 0 8. Mär 00:57 dovecot-uidvalidity.6407cf6d drwxrwx--- 20 vmail vmail 4096 8. Mär 02:51 mail drwx------ 7 vmail vmail 4096 8. Mär 13:52 mailboxes drwx------ 13 vmail vmail 4096 8. Mär 02:36 Maildir drwx------ 5 vmail vmail 4096 8. Mär 04:20 mdbox drwxrwx--- 2 vmail vmail 4096 8. Mär 01:14 new -rw-rw---- 1 vmail vmail 28 8. Mär 01:14 subscriptions drwxrwx--- 2 vmail vmail 4096 8. Mär 01:14 tmp drwxrwx--- 2 vmail vmail 4096 8. Mär 00:57 xapian-indexes root@mail:/var/vmail/mailboxes/example.de/admin/mail# ls -l insgesamt 87576 drwxrwx--- 2 vmail vmail 9113600 8. Mär 02:20 cur -rw-rw---- 1 vmail vmail 1602296 8. Mär 02:20 dovecot.index -rw-rw---- 1 vmail vmail 73030876 8. Mär 02:41 dovecot.index.cache -rw-rw---- 1 vmail vmail 441656 8. Mär 02:39 dovecot.index.log -rw-rw---- 1 vmail vmail 83568 8. Mär 02:20 dovecot.index.log.2 -rwxrwx--- 1 vmail vmail 206490 17. Jun 2019 dovecot.index.thread -rwxrwx--- 1 vmail vmail 51 2. Aug 2019 dovecot-keywords -rw-rw---- 1 vmail vmail 1392 8. Mär 01:25 dovecot.list.index -rw-rw---- 1 vmail vmail 6712 8. Mär 02:41 dovecot.list.index.log -rwxrwx--- 1 vmail vmail 1464 8. Mär 02:20 dovecot.mailbox.log -rw-rw---- 1 vmail vmail 4875528 8. Mär 02:20 dovecot-uidlist -rwxrwx--- 1 vmail vmail 8 8. Mär 01:25 dovecot-uidvalidity -rwxrwx--- 1 vmail vmail 0 17. Jun 2019 dovecot-uidvalidity.5a6912f0 drwxrwx--- 5 vmail vmail 4096 7. Mär 20:14 Drafts -rw-rw---- 1 vmail vmail 49 6. Mär 11:10 maildirsize drwxrwx--- 5 vmail vmail 4096 7. Mär 20:44 'Mailling Listen' drwxrwx--- 2 vmail vmail 204800 8. Mär 00:04 new drwxrwx--- 5 vmail vmail 4096 7. Mär 20:14 Sent drwxrwx--- 5 vmail vmail 4096 7. Mär 20:44 Spam drwxrwx--- 5 vmail vmail 4096 26. Feb 19:44 'SPF Fail' -rw-rw---- 1 vmail vmail 23 8. Mär 02:20 subscriptions drwxrwx--- 2 vmail vmail 4096 8. Mär 02:20 tmp drwxrwx--- 5 vmail vmail 4096 26. Feb 19:12 Trash drwxrwx--- 5 vmail vmail 4096 7. Mär 22:30 ubb drwxrwx--- 10 vmail vmail 4096 27. Feb 18:44 xapian-indexes

1 0

index locally
by tomate aceite 08 Mar '23

08 Mar '23

Hello, Do you know if is possible to store indexes locally instead of NFS in dovecot 2.2.7 ? Thanks.

3 2

Dovecot "Mailbox sharing between users".
by Jobst Schmalenbach 07 Mar '23

07 Mar '23

Hi I have appended the important bits of my server configuration to the end of this email I am trying to get "Mailbox sharing between users" to work. For starters it is very hard to follow the doc only https://doc.dovecot.org/configuration_manual/shared_mailboxes/shared_mailbo… without an actual example. I tried to use this (sorry in German) https://dokuwiki.tachtler.net/doku.php?id=tachtler:dovecot_shares and this got me a little further down the track. I followed the instructions required for the dovecot config files. Restarted dovecot, not errors displayed in the logs. I have got access to two user accounts, say USER1 and USER2. I executed this lines doveadm acl set -u USER1 INBOX user=USER2 admin create delete expunge insert lookup post read write write-deleted write-seen doveadm acl set -u USER2 INBOX user=USER1 admin create delete expunge insert lookup post read write write-deleted write-seen and created (just to be sure) two folders for each user /home/USER1/Mail/shared/USER1 /home/USER1/Mail/shared/USER2 /home/USER2/Mail/shared/USER1 /home/USER2/Mail/shared/USER2 The tried to create a mailboxes like so /home/USER1/Mail/shared/USER1/testa /home/USER1/Mail/shared/USER2/testb /home/USER2/Mail/shared/USER1/testa /home/USER2/Mail/shared/USER2/testb They are not created and no error is displayed - even looking at the dovecot logs. What I see in the folders for BOTH users though (for every folder) dovecot.list.index.log On the command line I can see the .imap files and do a 'ls -alR' in the folders, but no created mbox. I can definitely see the folders, but I cannot create a mbox file. What am I doing wrong? Help please. --------------------------------------------------------------------------------------------------------------------------------------------------------------- Here are the important configuration items # 2.3.16 (7e2e900c1a): /etc/dovecot/dovecot.conf # OS: Linux 4.18.0-425.13.1.el8_7.x86_64 x86_64 AlmaLinux release 8.7 (Stone Smilodon) xfs namespace shared { list = children location = maildir:~/Mail/:INDEX=~/Mail/shared/%%u:CONTROL=~/Mail/shared/ prefix = shared/%%u/ separator = / subscriptions = yes type = shared } mail_location = mbox:/home/%u/Mail/:INBOX=/var/mail/%u mail_plugins = acl passdb { driver = pam } plugin { acl = vfile acl_shared_dict = file:/var/lib/dovecot/db/shared-mailboxes.db } service auth { unix_listener auth-userdb { group = dovecot mode = 0777 user = dovecot } } protocol imap { mail_plugins = " acl imap_acl" } --

1 0

Flags/tags lost when moving e-mails to another folder
by Alexis Ben Miloud--Josselin 06 Mar '23

06 Mar '23

Hi, I have an issue with e-mail tags/flags. The IMAP user is using Thunderbird or Roundcube with Thunderbird tags. When the user (with an IMAP client) moves an e-mail from a folder to another, tags set on the e-mail are lost. When we check the filesystem, we can see the "a" tag: -rw-rw---- 2 test mailusers 2498 Dec 29 15:31 'cur/1676643827.M563793P15241.<HOSTNAME>,S=2498,W=2551:2,a' When we move the e-mail to another folder, the tag disappear: -rw-rw---- 2 test mailusers 2498 Dec 29 15:31 '.test/cur/1676644340.M214404P22014.<HOSTNAME>,S=2498,W=2551:2,' In both folders, the dovecot-keywords file is: 0 $LABEL1 The problem appeared after a major system upgrade (Debian 9 to 10). Dovecot version went from 2.2.27 to 2.3.4.1. Some system informations: # dovecot --version 2.3.4.1 (f79e8e7e4) # cat /etc/debian_version 10.13 # uname -a Linux <HOSTNAME> 4.19.0-23-amd64 #1 SMP Debian 4.19.269-1 (2022-12-20) x86_64 GNU/Linux # findmnt /var TARGET SOURCE FSTYPE OPTIONS /var /dev/vda3 ext4 rw,nosuid,relatime # findmnt /home TARGET SOURCE FSTYPE OPTIONS /home /dev/vdb ext4 rw,nosuid,nodev,noexec,relatime The output of `dovecot -n output` is here (link expires in one year): https://paste.evolix.org/?96d46acaea638568#56g7AQLuzJxxy4xintpexJCPgiAAG23c… Here are the operations I see on an e-mail file using strace: 15507 link("/home/test/Maildir/cur/1672326270.M619318P11927.<HOSTNAME>,S=2498,W=2551:2,Sa", "/home/test/Maildir/.test/tmp/1672326456.M737812P15507.<HOSTNAME>") = 0 15507 rename("/home/test/Maildir/.test/tmp/1672326456.M737812P15507.<HOSTNAME>", "/home/test/Maildir/.test/cur/1672326456.M737813P15507.<HOSTNAME>,S=2498,W=2551:2,S") = 0 15507 unlink("/home/test/Maildir/cur/1672326270.M619318P11927.<HOSTNAME>,S=2498,W=2551:2,Sa") = 0 Setting mbox_lazy_writes to yes and/or unsetting mail_cache_fields doesn't change anything. Any idea of what I am missing? Could this be a bug in Dovecot? Thanks in advance, -- Alexis Ben Miloud--Josselin <abenmiloud(a)evolix.fr> Evolix - Hébergement et Infogérance Open Source Marseille (37 rue Guibal, Pôle Média, 13003) / Paris / Montréal http://evolix.com | Twitter: @Evolix @EvolixNOC | http://blog.evolix.com

2 2

Re: Corrupted sizes using zlib plugin
by Tim Evers 06 Mar '23

06 Mar '23

Am 06.03.23 um 11:42 schrieb Aki Tuomi: >> On 06/03/2023 12:32 EET Tim Evers <te-ml-ext(a)artfiles.de> wrote: >> >> >> Hi, >> >> since I did not get any feedback on my bug report post regarding >> corrupted sizes while using zlib >> (https://dovecot.org/pipermail/dovecot/2023-February/126105.html) I >> would like to confirm that this bug report reached someone in charge. >> >> Or if not - I would kindly ask for directions on how to post it in a way >> that spawns some action. >> >> Thx >> >> Tim > Can you try erasing dovecot.index.cache and see if the problem fixes itself? It's possible your cache contains invalid values from old errors. > > Aki Did that already several times (other dovecot.index.* files too). The only thing that helps is actually deleting the dovecot-uidlist file but the problem returns. Tim

2 3

Corrupted sizes using zlib plugin
by Tim Evers 06 Mar '23

06 Mar '23

Hi, since I did not get any feedback on my bug report post regarding corrupted sizes while using zlib (https://dovecot.org/pipermail/dovecot/2023-February/126105.html) I would like to confirm that this bug report reached someone in charge. Or if not - I would kindly ask for directions on how to post it in a way that spawns some action. Thx Tim

2 1

Setting up the mail-crypt plugin with virtual accounts that have no home directories
by Jeremy 05 Mar '23

05 Mar '23

Hi again, I am using dovecot 2.3.16, along with postfix and a PostgreSQL database for managing virtual accounts. After an initial topic from me about encrypting already existent mail, I could now use some pointers on how to set up the mail-crypt plugin for pure virtual accounts (i.e. that have no matching system users and/or home directories. I hope somebody can clarify a few things that are not entirely clear to me yet. After doing my own research, I believe the following should be possible: I'd like to use the password of virtual email accounts to let dovecot encrypt/decrypt the keys needed to encrypt/decrypt the mail in the relevant folders. As per the documentation @ https://doc.dovecot.org/configuration_manual/mail_crypt_plugin/ I believe this would be all the configuration I need: # Config mail_attribute_dict = file:%h/Maildir/dovecot-attributes mail_plugins = $mail_plugins mail_crypt plugin { mail_crypt_curve = secp521r1 # or some other preferred curve mail_crypt_save_version = 2 mail_crypt_require_encrypted_user_key = yes # necessary for encrypting keys with user password } # File: /etc/dovecot/dovecot-sql.conf.ext password_query = SELECT \ email as user, password, \ '%w' AS userdb_mail_crypt_private_password \ FROM virtual_users WHERE email='%u'; My first question is: Is it possible to configure mail_attribute_dict in such a way as to not use home directories. Since I only use virtual accounts, without those accounts having home directories, can I somehow tell dovecot to save the attributes into the PostsreSQL database, for instance? If not, can you suggest another approach, without having to create home directories for virtual users? My second question is: The documentation warns about not using password directly in the above SQL query: > Choosing encryption key > DO NOT use password directly. It can contain % which is interpreted as > variable expansion and can cause errors. Does this refer to not accidentally substituting '%w' with password? In other words, if I leave the above query as is, should I be good, even if plain text passwords of users potentially have % signs in them? Or would I need to take further measurements? (The passwords in my database are already hashed, by the way). I hope somebody can offer some guidance on this. Thanks.

2 7

bug report: imap-login not killed
by Sacha 05 Mar '23

05 Mar '23

Hi, We have growing imap-login processes until we reach the max processes. This occurs when a particular user have a login error due to our LDAP misconfiguration: --- Mar 4 14:59:33 hera dovecot[2226963]: auth: Error: plain(john.doe,XX.XX.XX.XX,<13C0eBP2354lqXpO>): user not found from any userdbs Mar 4 14:59:33 hera dovecot[2226963]: imap: Error: auth-master: login: request [1001652225]: Login auth request failed: Authenticated user not found from userdb, auth lookup id=1001652225 (auth connected 2 msecs ago, request took 1 msecs, client-pid=2235348 client-id=1) Mar 4 14:59:33 hera dovecot[2226963]: imap-login: Internal login failure (pid=2235348 id=1): user=<ohn.doe>, method=PLAIN, rip=XX.XX.XX.XX, lip=18 5.233.100.1, mpid=2235359, TLS, session=<13C0eBP2354lqXpO> --- The origin of is issue is when passdb finds the user and userdb not. The result is imap-login processes with no timeout growing until we reach the max processes. * OS version Debian stable - Bullseye * Dovecot version dpkg -l |grep dovecot ii dovecot-antispam 2.0+20171229-1+b7 amd64 Dovecot plugins for training spam filters ii dovecot-common 1:2.1.7-7+deb7u1 all Transitional package for dovecot ii dovecot-core 1:2.3.13+dfsg1-2+deb11u1 amd64 secure POP3/IMAP server - core files ii dovecot-core-dbgsym 1:2.3.13+dfsg1-2+deb11u1 amd64 debug symbols for dovecot-core ii dovecot-imapd 1:2.3.13+dfsg1-2+deb11u1 amd64 secure POP3/IMAP server - IMAP daemon ii dovecot-imapd-dbgsym 1:2.3.13+dfsg1-2+deb11u1 amd64 debug symbols for dovecot-imapd ii dovecot-ldap 1:2.3.13+dfsg1-2+deb11u1 amd64 secure POP3/IMAP server - LDAP support ii dovecot-managesieved 1:2.3.13+dfsg1-2+deb11u1 amd64 secure POP3/IMAP server - ManageSieve server ii dovecot-mysql 1:2.3.13+dfsg1-2+deb11u1 amd64 secure POP3/IMAP server - MySQL support ii dovecot-pop3d 1:2.3.13+dfsg1-2+deb11u1 amd64 secure POP3/IMAP server - POP3 daemon ii dovecot-sieve 1:2.3.13+dfsg1-2+deb11u1 amd64 secure POP3/IMAP server - Sieve filters support * doveconf -n --- # 2.3.13 (89f716dc2): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.13 (cdd19fe3) doveconf: Warning: service auth { client_limit=1000 } is lower than required under max. load (4096) doveconf: Warning: service anvil { client_limit=1000 } is lower than required under max. load (4099) # OS: Linux 5.10.0-21-cloud-amd64 x86_64 Debian 11.6 ext4 # Hostname: XXX auth_mechanisms = plain login default_process_limit = 1024 first_valid_gid = 8 first_valid_uid = 109 last_valid_gid = 8 last_valid_uid = 109 login_greeting = XXX listening. mail_access_groups = mail mail_gid = 8 mail_location = maildir:/srv/vmail/%d/%n mail_privileged_group = mail mail_uid = 109 managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy i nclude variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext imapflags notify imapsieve vnd.dovecot.imapsieve vnd.dovecot.filter namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = /etc/dovecot/dovecot-ldap.conf driver = ldap } passdb { args = /etc/dovecot/dovecot-ldap-girondix.conf driver = ldap } passdb { args = /etc/dovecot/dovecot-oauth2.conf.ext driver = oauth2 mechanisms = xoauth2 oauthbearer } plugin { quota_rule = *:storage=100M quota_rule2 = Trash:storage=10%% recipient_delimiter = + sieve = /srv/vmail/%d/%n/dovecot.sieve sieve_default = /var/lib/dovecot/sieve/default.sieve sieve_dir = /srv/vmail/%d/%n/sieve sieve_extensions = +notify +imapflags +vnd.dovecot.filter sieve_filter_bin_dir = /usr/lib/dovecot/sieve-filter sieve_global_extensions = +vnd.dovecot.pipe sieve_max_script_size = 1M sieve_pipe_bin_dir = /etc/dovecot/sieve sieve_pipe_socket_dir = sieve-pipe sieve_plugins = sieve_imapsieve sieve_extprograms sieve_redirect_envelope_from = orig_recipient } protocols = imap pop3 sieve service auth { unix_listener /var/spool/postfix/private/auth { group = mail mode = 0600 user = postfix } unix_listener auth-master { group = mail mode = 0660 user = vmail } unix_listener auth-userdb { group = mail mode = 0600 user = vmail } } service imap-login { inet_listener imap { port = 0 } } service imap { vsz_limit = 1 G } service lmtp { executable = lmtp -L process_min_avail = 2 } service pop3-login { inet_listener pop3 { port = 0 } } ssl_cert = </srv/letsencrypt/pem/mail.aquilenet.fr.pem ssl_client_ca_dir = /etc/ssl/certs ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { args = /etc/dovecot/dovecot-ldap.conf driver = ldap } userdb { args = /etc/dovecot/dovecot-ldap-girondix.conf driver = ldap } protocol lmtp { auth_username_format = %n info_log_path = /var/log/dovecot-lmtp.log mail_plugins = " sieve" } protocol lda { mail_plugins = " mailbox_alias sieve" } protocol imap { imap_client_workarounds = delay-newmail tb-extra-mailbox-sep imap_idle_notify_interval = 30 secs mail_max_userip_connections = 50 mail_plugins = quota mailbox_alias imap_quota } protocol pop3 { mail_plugins = quota mailbox_alias acl pop3_client_workarounds = outlook-no-nuls oe-ns-eoh } ---

2 2

Multiple scripts with postlogin
by Dan Conway 03 Mar '23

03 Mar '23

Hello, I'm having trouble understanding how to execute separate scripts with postlogin. According to the documentation, it should be as simple as: You can run multiple post-login scripts by just giving multiple scripts as parameters to|script-login|, for example: executable = script-login rawlog /usr/local/bin/postlogin.sh /usr/local/bin/postlogin2.sh Given this information, I supplied two scripts to service imap-postlogin below: service imap { executable = imap imap-postlogin } service imap-postlogin { executable = script-login -d rawlog /usr/local/bin/postlogin.pl /usr/local/bin/postlogin2.pl user = $default_internal_user unix_listener imap-postlogin { } } Both scripts simply print "Script 1" and "Script 2" to STDERR. Here is what they look like: #!/usr/bin/perl use strict; use warnings; print STDERR "Script 1\n"; system("/usr/lib/dovecot/script-login"); After logging in, only the first script is executed. The second one is ignored. I tried not executing "/usr/lib/dovecot/script-login" in the first script, in hopes that it would execute the second script, but it only denies the connection after printing "Script 1" imap-postlogin: Error: Script 1 imap(<user>): Error: Post-login script denied access to user <user> Am I missing something? Thanks.

2 1

OAuth2: local validation with RFC9068 tokens
by Tomas Habarta 01 Mar '23

01 Mar '23

Hello, my IdP is kind of progressive and implemented RFC9068, where all access tokens now come with typ "at+JWT". Since the setup has used local validation, I had to switch and currently use introspection endpoint. Looked around at the src and there seems to be relatively simple check of the token typ checking the only fixed value of "JWT" -- do you think you could consider tuning it a little bit so that local validation works also with such tokens? I am not an expert on OAuth2 so have no idea whether this is a valid request, but think that such a token is still JWT but has the required structure per RFC, which should not anyhow be in collision with a simple "JWT" typ. Saying that, I would not wonder if the statement is not correct :) Many thanks, Tomas

1 0

Can't receive mail before connecting with mutt and sending mail
by efeizbudak 01 Mar '23

01 Mar '23

Hi everyone, I've recently set up an email server. I also have mail crypt plugin and the users are set up through pam. The problem is that whenever I set up a new user, it can send mail but not receive it until the account is connected with mutt and at least one mail is sent. I've noticed that the mail_attribute_dict file is also not set up before doing this. One peculiar thing about all this is that if an account is connected through the stock android email app, the same "send email to get email" trick does not work. How can I debug this? Thank you! -- All the best, Efe The funny quote of this email is trivial and left as an exercise.

1 0

"sh: doveadm: command not found" with doveadm -Dv backup -R
by James Brown 01 Mar '23

01 Mar '23

I’m moving from an old mail server to a new one. On the new one, trying to transfer mailboxes from the old machine using doveadm. It fails saying it can’f find doveadm: % sudo doveadm -Dv backup -R -u myuser(a)bordo.com.au remote:mail.bordo.com.au Password: Debug: Loading modules from directory: /usr/local/lib/dovecot/doveadm Debug: Skipping module doveadm_acl_plugin, because dlopen() failed: dlopen(/usr/local/lib/dovecot/doveadm/lib10_doveadm_acl_plugin.so, 0x000A): symbol not found in flat namespace '_acl_backend_nonowner_lookups_iter_deinit' (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_quota_plugin, because dlopen() failed: dlopen(/usr/local/lib/dovecot/doveadm/lib10_doveadm_quota_plugin.so, 0x000A): symbol not found in flat namespace '_quota_get_resource' (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_fts_plugin, because dlopen() failed: dlopen(/usr/local/lib/dovecot/doveadm/lib20_doveadm_fts_plugin.so, 0x000A): symbol not found in flat namespace '_fts_backend_lookup' (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_mail_crypt_plugin, because dlopen() failed: dlopen(/usr/local/lib/dovecot/doveadm/libdoveadm_mail_crypt_plugin.so, 0x000A): symbol not found in flat namespace '_mail_crypt_acl_secure_sharing_enabled' (this is usually intentional, so just ignore this message) Feb 28 12:42:02 Debug: Loading modules from directory: /usr/local/lib/dovecot/doveadm Feb 28 12:42:02 Debug: Skipping module doveadm_acl_plugin, because dlopen() failed: dlopen(/usr/local/lib/dovecot/doveadm/lib10_doveadm_acl_plugin.so, 0x000A): symbol not found in flat namespace '_acl_backend_nonowner_lookups_iter_deinit' (this is usually intentional, so just ignore this message) Feb 28 12:42:02 Debug: Skipping module doveadm_quota_plugin, because dlopen() failed: dlopen(/usr/local/lib/dovecot/doveadm/lib10_doveadm_quota_plugin.so, 0x000A): symbol not found in flat namespace '_quota_get_resource' (this is usually intentional, so just ignore this message) Feb 28 12:42:02 Debug: Skipping module doveadm_fts_plugin, because dlopen() failed: dlopen(/usr/local/lib/dovecot/doveadm/lib20_doveadm_fts_plugin.so, 0x000A): symbol not found in flat namespace '_fts_backend_lookup' (this is usually intentional, so just ignore this message) Feb 28 12:42:02 Debug: Skipping module doveadm_mail_crypt_plugin, because dlopen() failed: dlopen(/usr/local/lib/dovecot/doveadm/libdoveadm_mail_crypt_plugin.so, 0x000A): symbol not found in flat namespace '_mail_crypt_acl_secure_sharing_enabled' (this is usually intentional, so just ignore this message) Feb 28 12:42:02 doveadm(myuser(a)bordo.com.au)<76814><>: Debug: auth-master: userdb lookup(myuser(a)bordo.com.au): Started userdb lookup Feb 28 12:42:02 doveadm(myuser(a)bordo.com.au)<76814><>: Debug: auth-master: conn unix:/usr/local/var/run/dovecot/auth-userdb: Connecting Feb 28 12:42:02 doveadm(myuser(a)bordo.com.au)<76814><>: Debug: auth-master: conn unix:/usr/local/var/run/dovecot/auth-userdb (uid=0): Client connected (fd=9) Feb 28 12:42:02 doveadm(myuser(a)bordo.com.au)<76814><>: Debug: auth-master: userdb lookup(myuser(a)bordo.com.au): auth USER input: myuser(a)bordo.com.au home=/usr/local/virtual/bordo.com.au/myuser mail=maildir:/usr/local/virtual/bordo.com.au/myuser uid=102 gid=102 quota=*:storage=0 Feb 28 12:42:02 doveadm(myuser(a)bordo.com.au)<76814><>: Debug: auth-master: userdb lookup(myuser(a)bordo.com.au): Finished userdb lookup (username=myuser(a)bordo.com.au home=/usr/local/virtual/bordo.com.au/myuser mail=maildir:/usr/local/virtual/bordo.com.au/myuser uid=102 gid=102 quota=*:storage=0) Feb 28 12:42:02 doveadm(myuser(a)bordo.com.au)<76814><>: Debug: Added userdb setting: mail=maildir:/usr/local/virtual/bordo.com.au/myuser Feb 28 12:42:02 doveadm(myuser(a)bordo.com.au)<76814><>: Debug: Added userdb setting: plugin/quota=*:storage=0 Feb 28 12:42:02 doveadm(myuser(a)bordo.com.au): Debug: Effective uid=102, gid=102, home=/usr/local/virtual/bordo.com.au/myuser Feb 28 12:42:02 doveadm(myuser(a)bordo.com.au): Debug: open(/proc/self/stat) failed: No such file or directory Feb 28 12:42:02 doveadm(myuser(a)bordo.com.au): Debug: open(/proc/self/io) failed: No such file or directory Feb 28 12:42:02 doveadm(myuser(a)bordo.com.au): Debug: Namespace inbox: type=private, prefix=, sep=, inbox=yes, hidden=no, list=yes, subscriptions=yes location=maildir:/usr/local/virtual/bordo.com.au/myuser Feb 28 12:42:02 doveadm(myuser(a)bordo.com.au): Debug: maildir++: root=/usr/local/virtual/bordo.com.au/myuser, index=, indexpvt=, control=, inbox=/usr/local/virtual/bordo.com.au/myuser, alt= Feb 28 12:42:02 doveadm(myuser(a)bordo.com.au): Debug: brain M: Namespace has location maildir:/usr/local/virtual/bordo.com.au/myuser Feb 28 12:42:02 doveadm(myuser(a)bordo.com.au): Debug: Mailbox INBOX: Couldn't open mailbox in list index: Mailbox not found Feb 28 12:42:02 doveadm(myuser(a)bordo.com.au): Debug: Namespace : Using permissions from /usr/local/virtual/bordo.com.au/myuser: mode=0700 gid=default (root(a)mail.bordo.com.au) Password: sh: doveadm: command not found Feb 28 12:42:06 dsync-local(myuser(a)bordo.com.au)<SJq/Iepb/WMOLAEAiJz6GQ>: Error: read(mail.bordo.com.au) failed: EOF (version not received) Feb 28 12:42:06 dsync-local(myuser(a)bordo.com.au)<SJq/Iepb/WMOLAEAiJz6GQ>: Error: Remote command returned error 127: ssh mail.bordo.com.au doveadm dsync-server -umyuser(a)bordo.com.au -U Feb 28 12:42:06 dsync-local(myuser(a)bordo.com.au)<SJq/Iepb/WMOLAEAiJz6GQ>: Debug: User session is finished Feb 28 12:42:06 dsync-local(myuser(a)bordo.com.au)<SJq/Iepb/WMOLAEAiJz6GQ>: Debug: auth-master: conn unix:/usr/local/var/run/dovecot/auth-userdb (uid=0): Disconnected: Connection closed (fd=9) Does this mean the remote machine can’t fine doveadm? (Both machines are running macOS) I could probably transfer the mailboxes using rsync, but I thought that doveadm was a better way. Thanks, James.

2 2

Re: Auth variables unknown variable -- about to go crazy
by efeizbudak 28 Feb '23

28 Feb '23

1 0

Auth variables unknown variable -- about to go crazy
by efeizbudak 28 Feb '23

28 Feb '23

Hi everyone, I'm trying to configure my email server to encrypt mails on a per user basis. I have the following in my conf: mail_plugins = $mail_plugins mail_crypt mail_attribute_dict = file:%h/Mail/dovecot-attributes plugin { mail_crypt_curve = secp521r1 mail_crypt_save_version = 2 mail_crypt_require_encrypted_user_key = yes mail_crypt_private_password = %N{password} } And I'm getting %password unknown variable error. I use pam to store the passwords. All I want is to be able to hash the user password and use that to encrypt/decrypt the keys. Can someone _please_ help me? -- All the best, Efe The funny quote of this email is trivial and left as an exercise.

2 1

re: "Timeout (180s) while waiting for lock for transaction log file" since 2.3 upgrade?
by graeme vetterlein 26 Feb '23

26 Feb '23

This is an old thread (but still the best search match for the error message). Several other people pointed at NFS, so it got me to look. Indeed what appear to happen (for me at least) was .... The folders being imapped, some of them were on a NFSv3 mount. The NFS server had been shutdown. The imap process appeared to hang (presumably trying to read from the defunct NFS mount point) this held the lock , so other imap processes (possibly not using NFS) hung awaiting the lock. The "fix" was to bing the NFS server back online ...and as it turned out restart a number of things like autofs and dovecot (Normally NFS clients just carry on, so the timeout must have affected things) My long-term fix came from: https://docs.oracle.com/cd/E19620-01/805-5233/z400163399f/index.html Namely to add -soft in /etc/auto_master This should cause a "fail" instead of a hang. -- Graeme

1 0

Cannot reach documentation site
by Ken Bass 26 Feb '23

26 Feb '23

doc.dovecot.org does not have a DNS entry. It worked a few days ago, but not now.

3 3

quota groups
by Ken Young 26 Feb '23

26 Feb '23

Hello, How can I set up groups to give each group a different quota? for example, group A has mail storage 1GB, and users in this group get 1GB quota etc. Thanks. Ken Y

1 0

Small suggestion for improvement of pigeonhole/imapsieve documentation
by Matthias Petermann 25 Feb '23

25 Feb '23

Hello all, this is my first post on this list and I would like to introduce myself briefly. My name is Matthias and I am from Saxony in Germany. I'm working with Unix and mail systems for a long time - actually with focus for NetBSD and Cyrus IMAP. Occasionally I also use Dovecot, which has several reasons. Today, one of the reasons was that I would like to trigger Sieve scripts when moving mail within mailbox folders - i.e. at an unspecified time after the actual mail arrival. In doing so, I came across the imapsieve extension for Pigeonhole fairly quickly and decided that the administrative Sieve scripts in imapsieve were exactly what I needed. However, despite having debug logging fully up, I couldn't figure out until just now why my sieve script wasn't running despite having IMAP events logged. Even intentionally defining an invalid script did not result in an error, so it seemed to be ignored altogether. Until I just now came across that I seem to have misunderstood the documentation. The template shown for the imapsieve_mailboxXXX_ parameters suggested to me that a sequence number of three digits must / can be specified here. Thus, I started numbering my parameters with imapsieve_mailbox001. However, while researching in various forums, I came across only examples that use imapsieve_mailbox1_ as the first parameter. In desperation I tried this out - now it works for me, too. Long story short - I don't know if I'm the only one who has made this mistake so far. A little hint in the documentation[1] would have helped me, how the XXX is meant exactly. I am referring to this section: ``` This setting configures the name of a mailbox for which administrator scripts are configured. The `XXX’ in this setting is a sequence number, which allows configuring multiple associations between Sieve scripts and mailboxes. The settings defined hereafter with matching sequence numbers apply to the mailbox named by this setting. The sequence of configured mailboxes ends at the first missing imapsieve_mailboxXXX_name setting. This setting supports wildcards with a syntax compatible with the IMAP LIST command, meaning that this setting can apply to multiple or even all (“*”) mailboxes. ``` What do you think about adding a small explanatory sentence to the documentation? For example: ``` This setting configures the name of a mailbox for which administrator scripts are configured. The `XXX’ in this setting is a sequence number, which allows configuring multiple associations between Sieve scripts and mailboxes. The sequence number must begin with the digit 1 without preceding zeros and may have a maximum of three digits. The settings defined hereafter with matching sequence numbers apply to the mailbox named by this setting. The sequence of configured mailboxes ends at the first missing imapsieve_mailboxXXX_name setting. This setting supports wildcards with a syntax compatible with the IMAP LIST command, meaning that this setting can apply to multiple or even all (“*”) mailboxes. ``` Many greetings Matthias [1] https://doc.dovecot.org/configuration_manual/sieve/plugins/imapsieve/

1 0

Restored mail folders conflict with renamed original ones
by Nikolaos Milas 24 Feb '23

24 Feb '23

Hello, We are running Dovecot 2.3.18 (together with Postfix) on CentOS 7. It uses a Maildir structure. We have a user who has organized his mailbox as shows up at the end of this mail. The user had forgotten that he had renamed his "Grants Active \ European" (.Grants Active.European) folder to "Grants Active \ International" (.Grants Active.International), he thought that it was lost and requested a restore of "Grants Active \ European" (with all of its subfolders) from backup. Since we did that (using a simple "cp -rp" from a backup, observing timestamps, ownership and permissions), mail client software won't see "European" mail folder in "Grants Active" mail folder; "International" mail folder shows up but only with two folders, those which do not exist in "European" branch (obviously, these were created later). I have tried to run the command "doveadm index -u userx Grants\ Active" and likewise for each and every mail subfolder under "Grants\ Active"; I have also tried deleting the dovecot.index.cache and dovecot.index.log from the latter ("Grants\ Active") and then run: doveadm -vD force-resync -u userx Grants\ Active but it didn't do the trick: Mail clients are still stuck as I explained. In the end, I thought that the snag might be that mail folders that are not appearing have identical (duplicate) UIDs; As an example: [root@mailx .Grants Active.European]# cat dovecot-uidlist 3 V1548680759 N1 G64e70a1130343f61003c0000715faa8d [root@mailx .Grants Active.European]# cd .. [root@mailx Maildir]# cd .Grants\ Active.International [root@mailx .Grants Active.International]# cat dovecot-uidlist 3 V1548680759 N1 G64e70a1130343f61003c0000715faa8d If so, how should we overcome this issue? I guess I could simply delete the restored folders to return to an acceptable state? If nevertheless we need to restore the ".European" mail folder from a backup (as it was before getting renamed), what would be the right way to do so? Is there another way to resolve the issue without deleting the restored mail folders? Here is the list of mail folders in this mailbox (I have intentionally removed lots of them, to reduce irrelevant content; this mailbox includes a large number of mail folders): # doveadm mailbox list -u userx IGARSS 2024 IAC2022 Junk ... Junk E-mail INBOX.EMISSION ... Trash Trash.Equality Trash.sadf ... Grants Active Grants Active.European Grants Active.European.URBAN RELEAF Grants Active.European.SMURBS Grants Active.European.SMURBS.In Kind Grants Active.European.SMURBS.Final Reports Grants Active.European.RI-URBANS Grants Active.European.QA4EO Grants Active.European.ATMO-ACCESS Grants Active.European.IGOSP Grants Active.European.GAUSS Grants Active.European.E-SHAPE Grants Active.European.CIROCCO Grants Active.European.InCASE Grants Active.European.EIFFEL Grants Active.European.ARSINOE Grants Active.International Grants Active.International.2324 Grants Active.International.GAUSS Grants Active.International.CIROCCO Grants Active.International.IGOSP Grants Active.International.ATMO-ACCESS Grants Active.International.URBAN RELEAF Grants Active.International.InCASE Grants Active.International.ARSINOE Grants Active.International.RI-URBANS Grants Active.International.E-SHAPE Grants Active.International.EIFFEL Grants Active.International.QA4EO Grants Active.International.SMURBS Grants Active.International.SMURBS.Final Reports Grants Active.International.SMURBS.In Kind Grants Active.International.India Grants Active.Urban ReLeaf Grants Active.National Grants Active.National.ΑΓ ΠΑΡΑΣΚΕΥΗ Grants Active.National.ΠΕΤΡΟΥΠΟΛΗ Grants Active.National.CLIMATTICA Grants Active.National.ΝΑΥΠΛΙΟ Grants Active.National.ΕΔΒΜ Grants Active.National.PANGEA Grants Active.National.ΕΛΙΔΕΚ Grants Active.National.ΕΛΙΔΕΚ.OXONIAN - Δέσποινα Grants Active.National.ΕΛΙΔΕΚ.Νασια PhD Grants Active.National.CLIMPACT Sent ... INBOX Please, provide some guidance on what we should do to make these mail folders work correctly again. Sorry, I am not very knowledgeable on mail inner architecture and operations; please let me know if you need additional info. Thanks in advance, Nick

2 6

How to get a server listed in the IMAP Test wiki?
by Leander Beernaert 24 Feb '23

24 Feb '23

Hey, We recently announced Gluon (https://github.com/ProtonMail/gluon/) our IMAP server library we are using in Proton Bridge(https://github.com/ProtonMail/proton-bridge). We would love to have it have it listed in the IMAP Server Compliancy Status wiki page (https://imapwiki.org/ImapTest/ServerStatus) What do we need to do or whom do we need to contact to make this happen? Additionally, We have been using running imaptest (https://github.com/dovecot/imaptest) against our server library, but due to variety of configuration parameters, we would really appreciate it (if possible) if someone could point out to us the test setup used to validate each of those servers. Thank you in advance for your time. Kind Regards, Leander Beernaert Proton AG

4 6

creating a mailbox via imap
by Gabriele Bulfon 23 Feb '23

23 Feb '23

Hi, is there any way with Dovecot to open an admin imap connection and create a brand new mailbox? With Cyrus imapd I can do this by connecting as the Cyrus admin user and then create a folder "user/newuser(a)domain.tld". Thanks Gabriele Sonicle S.r.l. : http://www.sonicle.com Music: http://www.gabrielebulfon.com eXoplanets : https://gabrielebulfon.bandcamp.com/album/exoplanets

3 2

doveadm sending invalid AUTHENTICATE to uw-imap
by Chris Candreva 23 Feb '23

23 Feb '23

I'm migrating a legacy uw-imap system to Dovecot, on a Rocky (RHEL) 8 server running Dovecot 2.3.16-3 from their repos. I am using a master user to import all users for an imaps connection from the old server to the new. On a trial run however, it worked for about half the users. Half are giving an error of the form: dsync(user): Error: imapc(host:993): Command '1 AUTHENTICATE PLAIN xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx' failed with BAD: 1 Missing or invalid argument to AUTHENTICATE I can't seem to get the IMAP command for the users that did work. However, on the face of it, that is an invalid AUTHENTICATE command. If I take that string and brake it up into (what I've googled is) the proper form of multi-command form of 1 AUTHENTICATE PLAIN + xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx then the login succeeds. I have not been able to find anyone else with this problem in my search. Is this a known issue, is there a way to force the multi-line AUTHENTICATE, something else I'm missing ? Any help is appreciate on this! -Chris -- --- ======================================================================== Chris Candreva -- chris(a)westnet.com -- http://www.westnet.com/~chris

3 4

Redundant Database, Pgsql ?
by Paul Kudla 23 Feb '23

23 Feb '23

I am aware that there are provising for redundant database connections Basically i was working on my main db server (which is also a mail sever) I current have this in the dovecot-pgsql.conf ______________________________________________________________________ driver = pgsql connect = host=localhost port=5433 dbname=scom_billing user=pgsql password=xxxxxxxxx default_pass_scheme = PLAIN password_query = SELECT username as user, password FROM email_users WHERE username = '%u' and password <> 'alias' and status = True and destination = '%u' user_query = SELECT home, uid, gid FROM email_users WHERE username = '%u' and password <> 'alias' and status = True and destination = '%u' #iterate_query = SELECT user, password FROM email_users WHERE username = '%u' and password <> 'alias' and status = True and destination = '%u' iterate_query = SELECT "username" as user, domain FROM email_users WHERE status = True and alias_flag = False _______________________________________________________________________ Basically I have replicaed servers all over the place but mail18 (because dovecot only knows of one db instance) went down as well. May I please get some guidance on what to add to talk to another postgresql server (i have 6 replicated servers so would probably want a couple worst case issue) -- Happy Sunday !!! Thanks - paul Paul Kudla Scom.ca Internet Services <http://www.scom.ca> 004-1009 Byron Street South Whitby, Ontario - Canada L1N 4S3 Toronto 416.642.7266 Main 1.866.411.7266 Fax 1.888.892.7266 Email paul(a)scom.ca

10 13

Can I encrypt already existant unencrypted mail before I start using the mail-crypt plugin?
by mailinglist-subscriptions 23 Feb '23

23 Feb '23

Hi, I am using dovecot 2.3.16, along with postfix and a PostgreSQL database for managing virtual accounts. I'd like to start using the mail-crypt plugin. However, I'm having a bit some difficulty understanding the documentation at https://doc.dovecot.org/configuration_manual/mail_crypt_plugin to reach my goal. I plan to ask questions about those issues by starting new threads in this mailing list. But before I even come to that, I'd like to investigate the following: The above documentation only addresses a clean install and doesn't seem to mention encrypting already existent unencrypted mails, like my server has. Is it possible to encrypt those before I start using the mail-crypt plugin, such that it will be able to decrypt those messages as well? If it is, I am assuming that how I would go about achieving that will be very dependent on the ultimate configuration I have in mind (pub/priv keys, etc.). So I don't expect a full-fledged guide. However, if you could perhaps give a general overview of what would be needed to achieve this, I would very much appreciate that. Thank you.

4 4

Re: Auth-worker, unknown scheme ARGON2ID
by James Brown 22 Feb '23

22 Feb '23

On 21 Feb 2023, at 10:12 pm, James Brown <jlbrown(a)bordo.com.au> wrote: > > The new one has Dovecot compiled with same configure options, same configuration files, but fails to authenticate: > > Feb 21 21:51:03 master: Info: Dovecot v2.3.20 (80a5ac675d) starting up for imap, pop3 (core dumps disabled) > Feb 21 21:51:33 auth-worker(11701): Error: conn unix:auth-worker (uid=214): auth-worker<1>: sql(jlbrown@bordo.com.au,::1,<bRgbkDP2udEBAAAAAAAAAAAAAAAAAAB>): Unknown scheme ARGON2ID > > ./configure --with-ssl=openssl --with-mysql > > Was what I used to compile. > > Using OpenSSL 3.0.8. New server is running macOS 13.2.1 Ventura. > > (Have also installed libsodium 1.0.18_1) > > Any help would be most appreciated. > > thanks, > > James. I’ve spent ages on this and am getting really desperate! :-( CPPFLAGS=-I/opt/homebrew/Cellar/openssl(a)3/3.0.8/include LDFLAGS=-L/opt/homebrew/opt/openssl@3/lib ./configure --with-ssl=openssl --with-mysql ... Install prefix . : /usr/local File offsets ... : 64bit I/O polling .... : kqueue I/O notifys .... : kqueue SSL ............ : yes (OpenSSL) GSSAPI ......... : no passdbs ........ : static passwd passwd-file pam checkpassword sql : -shadow -bsdauth -ldap userdbs ........ : static prefetch passwd passwd-file checkpassword sql sudo doveadm pw -l SHA1 SSHA512 SCRAM-SHA-256 BLF-CRYPT PLAIN HMAC-MD5 OTP SHA512 SHA DES-CRYPT CRYPT SSHA MD5-CRYPT PLAIN-MD4 PLAIN-MD5 SCRAM-SHA-1 CLEAR CLEARTEXT SSHA256 MD5 PBKDF2 SHA256 CRAM-MD5 PLAIN-TRUNC SMD5 DIGEST-MD5 LDAP-MD5 How do I get ARGON2I, ARGON2ID in that list? Has anybody got Dovecot to work on recent macOS with these password schemes? Any hints? Thanks, James.

2 8

Auth-worker, unknown scheme ARGON2ID
by James Brown 21 Feb '23

21 Feb '23

On my current mail server I was able to upgrade everyone’s password scheme to ARGON2ID with no issues, I just had to have: service auth { vsz_limit = 0 } This was an older version of macOS than the new server I’m trying to migrate to. The new one has Dovecot compiled with same configure options, same configuration files, but fails to authenticate: Feb 21 21:51:03 master: Info: Dovecot v2.3.20 (80a5ac675d) starting up for imap, pop3 (core dumps disabled) Feb 21 21:51:33 auth-worker(11701): Error: conn unix:auth-worker (uid=214): auth-worker<1>: sql(jlbrown@bordo.com.au,::1,<bRgbkDP2udEBAAAAAAAAAAAAAAAAAAB>): Unknown scheme ARGON2ID ./configure --with-ssl=openssl --with-mysql Was what I used to compile. Using OpenSSL 3.0.8. New server is running macOS 13.2.1 Ventura. (Have also installed libsodium 1.0.18_1) Any help would be most appreciated. thanks, James.

1 0

service(imap-login): Fatal: setrlimit(RLIMIT_DATA, 268435456): Invalid argument macOS
by James Brown 21 Feb '23

21 Feb '23

I fixed the issue with Dovecot not starting on macOS Ventura by adding this to 10-master.conf: service log { vsz_limit = 0 } But now when I try to login via Imap on port 143 I get the same error for imap-login: Feb 20 15:55:41 imap-login: Error: Feb 20 15:55:41 service(imap-login): Fatal: setrlimit(RLIMIT_DATA, 268435456): Invalid argument Feb 20 15:55:41 imap-login: Fatal: master: service(imap-login): child 11781 returned error 89 (Fatal failure) Feb 20 15:55:41 master: Error: service(imap-login): command startup failed, throttling for 60.000 secs Feb 20 16:13:04 imap-login: Error: Feb 20 16:13:04 service(imap-login): Fatal: setrlimit(RLIMIT_DATA, 268435456): Invalid argument Feb 20 16:13:04 imap-login: Fatal: master: service(imap-login): child 20370 returned error 89 (Fatal failure) Feb 20 16:13:04 master: Error: service(imap-login): command startup failed, throttling for 60.000 secs Config: sudo /usr/local/sbin/dovecot -n # 2.3.20 (80a5ac675d): /usr/local/etc/dovecot/dovecot.conf # OS: Darwin 22.3.0 arm64 apfs # Hostname: mail-server-mac-studio.local auth_mechanisms = plain login auth_verbose = yes auth_verbose_passwords = yes default_internal_group = mail default_internal_user = _dovecot default_login_user = _dovenull first_valid_gid = 0 first_valid_uid = 102 last_valid_gid = 501 last_valid_uid = 105 log_path = /var/log/dovecot.log mail_gid = 102 mail_location = maildir:/usr/local/virtual/%d/%u mail_uid = 102 namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = /usr/local/etc/dovecot/dovecot-sql.conf.ext driver = sql } protocols = imap pop3 service auth { unix_listener /var/spool/postfix/private/auth { group = _postfix mode = 0660 user = _postfix } unix_listener auth-userdb { mode = 0660 user = _vmail } } service imap-login { vsz_limit = 0 } service log { vsz_limit = 0 } ssl_cert = </etc/letsencrypt/live/mail.bordo.com.au/fullchain.pem ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { driver = prefetch } userdb { args = /usr/local/etc/dovecot/dovecot-sql.conf.ext driver = sql } protocol imap { mail_max_userip_connections = 40 } Quitting Dovecot and restarting and I now get: Feb 20 17:01:11 master: Info: Dovecot v2.3.20 (80a5ac675d) starting up for imap, pop3 (core dumps disabled) Feb 20 17:01:11 master: Error: service(anvil): command startup failed, throttling for 2.000 secs Then trying to connect on port 143 log says: Feb 20 17:20:08 master: Error: service(config): command startup failed, throttling for 2.000 secs Feb 20 17:20:08 config: Error: Feb 20 17:20:08 service(config): Fatal: setrlimit(RLIMIT_DATA, 268435456): Invalid argument Feb 20 17:20:08 anvil: Fatal: master: service(anvil): child 43250 returned error 89 (Fatal failure) Feb 20 17:20:08 config: Fatal: master: service(config): child 52530 returned error 89 (Fatal failure) Feb 20 17:20:08 stats: Fatal: master: service(stats): child 52531 returned error 89 (Fatal failure) Feb 20 17:20:08 stats: Error: Feb 20 17:20:08 service(stats): Fatal: setrlimit(RLIMIT_DATA, 268435456): Invalid argument Feb 20 17:20:08 master: Error: service(stats): command startup failed, throttling for 2.000 secs Feb 20 17:20:10 config: Error: Feb 20 17:20:10 service(config): Fatal: setrlimit(RLIMIT_DATA, 268435456): Invalid argument Feb 20 17:20:10 config: Fatal: master: service(config): child 52532 returned error 89 (Fatal failure) Feb 20 17:20:10 master: Error: service(config): command startup failed, throttling for 4.000 secs Feb 20 17:20:10 imap-login: Fatal: Error reading configuration: read(/usr/local/var/run/dovecot/config) failed: EOF - Also failed to read config by executing doveconf: /usr/local/var/run/dovecot/config is a UNIX socket (path is from CONFIG_FILE environment) Feb 20 17:20:10 master: Error: service(imap-login): command startup failed, throttling for 2.000 secs Any suggestions? This is really driving me crazy! thanks, James.

2 1

Get correct subjects in summary but wrong article body after transitioning between servers
by Steinar Bang 19 Feb '23

19 Feb '23

I am transitioning between servers (both debian 11.6 with dovecot 2.3.13) and I'm seeing some strange behaviour after the transition: it seems like dovecot is listing the correct subject for the test messages I'm sending in what's shown in my MUA's summary. But the body of the message is an old message. Dovecot is serving messages from Maildir folders in the users' home directories. And I may have messed up some things here: I rsynced the maildirs and then still got some deliveries both places when the MX records were in transition, so I did a belated rsync, thinking that "Maildir can handle that". But I weren't thinking about the dovecot files, ie: drwx------ 2 sb sb 155648 Feb 11 06:43 cur -rw------- 1 sb sb 30 Nov 23 18:14 dovecot-keywords -rw------- 1 sb sb 116407 Feb 11 06:43 dovecot-uidlist -rw------- 1 sb sb 8 Feb 28 2022 dovecot-uidvalidity -rw------- 1 sb sb 0 Mar 17 2011 dovecot-uidvalidity.4d821095 -rw------- 1 sb sb 38016 Jan 31 15:38 dovecot.index -rw------- 1 sb sb 203852 Feb 5 21:37 dovecot.index.cache -rw------- 1 sb sb 15076 Feb 11 06:43 dovecot.index.log -rw------- 1 sb sb 6424 Feb 4 08:06 dovecot.list.index -rw------- 1 sb sb 7796 Feb 11 06:43 dovecot.list.index.log -rw------- 1 sb sb 3048 Mar 6 2022 dovecot.mailbox.log drwx------ 2 sb sb 4096 Feb 11 06:43 new -rw------- 1 sb sb 738 Mar 6 2022 subscriptions drwx------ 2 sb sb 4096 Feb 6 22:05 tmp Are there any of these that could have been adversely affected by the rsync? Will regenerating these files fix the behaviour where I get the wrong article when fetching them? What is the best way to regenerate them? Can these feil be safely deleted and will be autogenerated? (I also see that some of these files are quite old. I had another server transition in 2017, so the files from 2011 has been rsynced into that server and not touched since) Thanks! - Steinar

1 2

Roundcube <-> Dovecot timeouts under very moderate load on big Dovecot nodes
by Malte Schmidt 18 Feb '23

18 Feb '23

Due to a recent topic regarding the performance of the Roundcube webmailer with Dovecot as a backend, I set up imapproxy successfully, shrinking the response latency of the webmailer heavily, which is great. However, I still encounter strange timeouts on some requests when Roundcube tries to access Dovecot. Be it for authentication or to FETCH data. I run the tests/benchmarks via distributed JMeter from 4 nodes, they access the webmailer which in turn accesses the Dovecot via imapproxy. There are 16 different mailaccounts spread over two dovecot nodes with the first one acting as a proxy if the account resides on the second. The problems start at around 100 concurrent users and gets worse the more users are added. The timeouts make up for a small percentage of the requests (0.0something percent). The timeout is reached after 30 seconds of Dovecot not answering, due to the timeout set in the webserver the webmailer is running on. Now I am wondering how to further debug this and what could be the reason. Some requests towards Dovecot are certainly taking longer than 30 seconds, while the average request takes mostly less than 1. The Dovecot is running on two big hardware machines with 48 cores, 96G memory and SSD storage. The load on the Dovecot nodes while the test is running is minimal. Best regards, M. Schmidt

1 0

dovecot_login accepts blank password for exim smtp auth
by Jeff Rogers 18 Feb '23

18 Feb '23

Hi all, I recently discovered a configuration issue on my system where a system user account had a blank rather than invalid or disabled password in the passwd/shadow database. The user could not be logged into through login/telnet/ssh because it was marked as a system account (uid < 100). Dovecot also would not authenticate the user for the same reason. However, I'm using exim using dovecot_login for authentication, and that would authenticate the user with a blank and allow me to be used as an open relay. This is clearly a config issue on my part (since fixed), but should dovecot_login guard against blank passwords or system users just as a normal login does? I'm running dovecot 2.2.36 (1f10bfa63) Exim version 4.96 I don't know which software supplies the dovecot_login connenector. The SMTP session would include AUTH LOGIN 334 VXNlcm5hbWU6 cG9zdGZpeA== 334 UGFzc3dvcmQ6 <-- nothing, just a return here 235 Authentication succeeded DONE

2 1

Special authentication use case
by Philippe MARASSE 17 Feb '23

17 Feb '23

Folks, I'm trying to configure dovecot SASL with two use cases : - First with XOAUTH2 : I've managed to get it working, pretty right out of the box, developers have done a great job :-) - Second with Client TLS Certificate with no luck. Let me explain, the certificate brought by the client does not have any clue of associated email, I have to check that username (=email) sent by the client is really related to some information included in the certificate (I have to extract the OU and then lookup into a table of authorized mails for that OU). Is it possible to do that with dovecot ? I think yes but I'm looking for direction to achieve that. Lua maybe ? Our configuration : - OS : Debian 11 $ /usr/sbin/dovecot --version 2.3.13 (89f716dc2) Regards. -- Philippe MARASSE Responsable pôle Infrastructures - DSIO Centre Hospitalier Henri Laborit CS 10587 - 370 avenue Jacques Cœur 86021 Poitiers Cedex Tel : 05.49.44.57.19

1 1

Re: SOLVED: Re: Dovecot does not start on MacOS 12.01, and now 13.2.1 - RLIMIT_DATA
by James Brown 17 Feb '23

17 Feb '23

Sorry, replying to an old thread found on mail-archive.com <http://mail-archive.com/>, so it’s not threaded email. https://www.mail-archive.com/dovecot@dovecot.org/msg84776.html I have just installed Dovecot onto Mac Studio running Ventura (macOS 13.2.1) and get the same error with Dovecot 2.3.20: service(log): Fatal: setrlimit(RLIMIT_DATA, 268435456): Invalid argument Adding the ’service log’ stanza to 10-master.conf fixed the issue. Is this still the correct way to handle it? If so it would be great to have it documented somewhere. Just lucky I found the above mail thread. Thanks, James. Hi! That solution is bit overly broad way to solve this, I would instead recommend service log { vsz_limit = 0 } so that only service log is affected. Aki > On 31/10/2021 20:36 Don Feliciano <don.felici...(a)icloud.com> wrote: > > > > A kind person who isn’t on the mailing list share the solution to this with > me: > > default_vsz_limit = 0 > > > > On Oct 28, 2021, at 12:12 PM, Don Feliciano <don.felici...(a)icloud.com> > > wrote: > > > > > > Warning: fd limit (ulimit -n) is lower than required under max. load (256 < > > 1000), because of default_client_limit > > Oct 28 12:08:48 service(log): Fatal: setrlimit(RLIMIT_DATA, 268435456): > > Invalid argument > > > > > > > On Oct 27, 2021, at 11:08 AM, Don Feliciano <don.felici...(a)icloud.com> > > > wrote: > > > > > > I've been happily running Dovecot on my Mac for many years (installed via > > > Homebrew). After upgrading to Monterey (MacOS 12.01), it no longer starts: > > > > > > $ sw_vers > > > ProductName: macOS > > > ProductVersion: 12.0.1 > > > BuildVersion: 21A559 > > > > > > $ uname -a > > > Darwin dfelicia-mac 21.1.0 Darwin Kernel Version 21.1.0: Wed Oct 13 > > > 17:33:23 PDT 2021; root:xnu-8019.41.5~1/RELEASE_X86_64 x86_64 > > > > > > $ sudo dovecot -F > > > Oct 27 10:11:18 service(log): Fatal: setrlimit(RLIMIT_DATA, 268435456): > > > Invalid argument

1 0

Could not override "mail_location" with "userdb_mail" statment in "/etc/passwd"
by Xavier 17 Feb '23

17 Feb '23

Hi, ** Using Dovecot 2.2.22 and Postfix 3.1.0 ** I plan to migrate all accounts on my server from mbox to maildir storage but before i want to make some tests on dedicated accounts. To do so i want to overide the general "mail_location" ( mail_location = mbox:~/mail:INBOX=/var/mail/%u ) with "maildir:~/Maildir" only for some test accounts. To do so i modified my "/etc/passwd" file using something like that : testm2m_mydomain.tld:x:2122:2122::/home/mail/testm2m_mydomain.tld:/bin/false:userdb_mail=maildir:~/Maildir Also tried testm2m_mydomain.tld:x:2122:2122::/home/mail/testm2m_mydomain.tld:/bin/false::userdb_mail=maildir:~/Maildir And as mentioned in the doc (https://wiki.dovecot.org/LDA/Postfix) i added -d "$USER" in my Postfix "mailbox_command" but it don't seem to work (my new mail_location for this test user is is not taken into account). When i try to make an "doveadm user testm2m_mydomain.tld" i get this : 8<-------------------------------- field value uid 2122 gid 2122 home /home/mail/testm2m_mydomain.tld mail mbox:~/mail:INBOX=/var/mail/testm2m_mydomain.tld system_groups_user testm2m_mydomain.tld 8<-------------------------------- My modification is not taken into account ... Any help is welcome ! /Xavier

2 4

dovecot director how to obtain hashed
by tomate aceite 16 Feb '23

16 Feb '23

Morning again! Working with my directors node. Does anybody now how to obtain a list of all users hashes? I know how to obtain for one user example: *doveadm director status user@domain* I am looking to a way or command to take a list of hashed epired (1)#: doveadm director status manolito@mydomain > Current: 10.X.X.108 (expires 2023-02-17 12:17:59) > Hashed: 10.X.X.108 > Initial config: 10.X.X.108 > Where are stored the hashed ? To lock for the info , etc... Thanks in advance!!!

1 0

Error: Broken file dovecot-uidlist
by Sohin Vyacheslav 16 Feb '23

16 Feb '23

Hi All, In mail.log are exists error messages "Error: Broken file /data/mail/vhosts/domain.com/user(a)domain.com/Maildir/dovecot-uidlist line XX: Invalid data: for some email accounts. For example, dovecot-uidlist line 21197: Invalid data: When I open line 21197 in editor: # vim +21197 dovecot-uidlist 1750207 :1676454069.M698819P4439.mail-b,S=963716,W=976359 and then check this file size # ls -l /data/mail/vhosts/domain.com/user@domain.com/Maildir/cur/1676454069.M698819P4439.mail-b,S=963716,W=976359:2,S -rw------- 1 vmail vmail 963716 Feb 15 10:41 I see that size is the same: 963176 bytes. So what exactly mentioned in error message "dovecot-uidlist line 21197: Invalid data:"? -- Best wishes Sohin Vyacheslav

3 6

Corrupted sizes in cache once again
by Tim Evers 15 Feb '23

15 Feb '23

Hi, I run a fairly large Dovecot Installation (around 100k mailboxes) on several servers. gzip compression is on. Every once in a while I get the dreaded "cache corruption" messages in the log: Error: Corrupted record in index cache file /[redacted]/Maildir/dovecot.index.cache: UID 3868: Broken physical size in mailbox INBOX: read(zlib(/[redacted]/Maildir/cur/1674129792.M797543P21755.node2,S=8099,W=8276:2,)) failed: Cached message size smaller than expected (2877 < 8099, box=INBOX, UID=3868) Error: Corrupted record in index cache file /[redacted]/Maildir/dovecot.index.cache: UID 3875: Broken physical size in mailbox INBOX: read(zlib(/[redacted]/Maildir/cur/1674212201.M985809P29112.node2,S=13907,W=14121:2,)) failed: Cached message size smaller than expected (5533 < 8192, box=INBOX, UID=3875) The first entry shows 2877 (size on disk) vs. 8099 (real size unzipped, also in the filename: S=8099). The second entry shows 5533 (size on disk) vs. 8192 - this is not correct in any way. Size on disk is 13907 as noted in the filename. Both mails were delivered trough LMTP and retrieved by the POP3 service. Anyone with an idea what might be happening here? I've read all available info in the doc and in the previous discussions / bug reports, but nothing seems to match my case. And where does that 8192 come from - it looks suspicious? Version is 2.3.7.2 (Ubuntu 20.04) doveconf -n excerpt: protocol lmtp { mail_plugins = " old_stats mail_log notify zlib sieve quota" } protocol imap { mail_max_userip_connections = 50 mail_plugins = " old_stats mail_log notify zlib imap_old_stats quota imap_quota imap_sieve" } protocol pop3 { mail_max_userip_connections = 50 mail_plugins = " old_stats mail_log notify zlib" } Tim

5 12

Error: Corrupted index cache file
by Sohin Vyacheslav 15 Feb '23

15 Feb '23

Hi All, In mail.log exists an error messages "Error: Corrupted index cache file /data/mail/vhosts/domain.com/user(a)domain.com/Maildir/dovecot.index.cache: invalid record size" for some accounts. I tried these steps to fix it: 1. Running commands # doveadm -D -v index -u user(a)domain.com INBOX # doveadm -v force-resync -u user(a)domain.com INBOX after this I saw that the following files are updated in ../Maildir/: dovecot.index.cache dovecot.index.log dovecot-uidlist But after some time error messages occurred again. 2. Added NFS mount option 'nordirplus' to /etc/fstab with remount /data partition, add 'mmap_disable = yes' and 'mail_fsync = always' to 10-mail.conf as advised on https://doc.dovecot.org/configuration_manual/nfs/ (because /data partition mounted via NFS); 3. Renaming 3 files with/without Dovecot service pre-stop. # mv dovecot.index old.dovecot.index # mv dovecot.index.cache old.dovecot.index.cache # mv dovecot.index.log old.dovecot.index.log Unfortunately, all done steps didn't fix issue. What is the proper way to fix corrupted index cache errors? dovecot package: 1:2.2.33.2-1ubuntu4.8 (Ubuntu-18.04). p.s. for some of email accounts also exists error messages "Error: Broken file ../Maildir/dovecot-uidlist line ###: Invalid data:" besides mentioned cache error. -- Best wishes Sohin Vyacheslav

4 7

NFS and performances
by tomate aceite 15 Feb '23

15 Feb '23

Hello, i have some question about NFS, dovecot director, and imap settings. I was reading all dovecot documentation ad mail lists, but some aspect are not clear to me. I am looking for performance / tunning my infra to work in a more efficient way because we experiences some issues some days ago. This is my infra: I got an infra with 2 dovecot-directors and 3 imap backend. I got all the emails stored in a common NFS share filer to all the imap nodes. ( Index are locally stored in each imap node.) My NFS mount options: (0)#: nfsstat -m /data/mail from myipaddress:/export/mail/maildirs > Flags: > rw,nosuid,noexec,noatime,vers=3,rsize=1048576,wsize=1048576,namlen=255,hard,nordirplus,proto=tcp,timeo=600,retrans=2,sec=sys,mountaddr=10.0.0.205,mountvers=3,mountport=20048,mountproto=tcp,local_lock=none,addr=10.0.0.205 > *Questions*: ( https://wiki.dovecot.org/PerformanceTuning , https://doc.dovecot.org/configuration_manual/nfs/ >> i am following these steps ) 1) Is my NFS correct setup with the mount options well optimized ? Not sure if someone is using the same flags that me or got a better recomendation to used. 2) Set *mmap_disable = yes ??? * >> This must be set to yes if you store indexes to shared filesystems. In my case i got them locally in each imap node not in NFS share folder. I got setup mmap_disable = no , is this correct? I think no is the correct option here with indexes locally. because i can read here: https://wiki1.dovecot.org/NFS > > >> High performance NFS setup with indexes on local disk (see below for > benefits): > > mmap_disable = no > 3) Set* mail_fsync = always ???* Documentation: https://wiki.dovecot.org/PerformanceTuning always > > Use fsync after all disk writes. > > Recommended for NFS to make sure there aren’t any delayed write()s. > 3.a) where i can setup this option *mail_fsync = always , *because i run doveconf -n in director, and imap nodes, and they are not showing nothing. 3.b) *In which node ? *Do i need to add the setting in dovecot.conf in *director node or in imap node or in both ?* Not sure if this is the correct way: This is an attemp of setup, not sure if is correct? 0)#: doveconf -n > # 2.3.13 (89f716dc2): /etc/dovecot/dovecot.conf > # Pigeonhole version 0.5.13 (cdd19fe3) > # OS: Linux 5.10.0-20-amd64 x86_64 Debian 11.6 > > mail_debug = yes > mail_fsync = always > mail_max_userip_connections = 20 > mail_nfs_storage = yes > mail_plugins = " notify mail_log" > mail_privileged_group = mail > > > > protocol lmtp { > mail_fsync = always > mail_plugins = " notify mail_log sieve mail_lua push_notification > push_notification_lua" > plugin { > ... > } > 4) Do not set *mail_nfs_index *or *mail_nfs_storage* (i.e. keep them as no) ????? First option make sense but the second one not. https://doc.dovecot.org/settings/core/#core_setting-mail_nfs_storage mail_nfs_storage >>> >>> Default: no >>> >>> Values: Boolean >>> >>> Flush NFS caches whenever it is necessary to do so. >>> >> > This setting should only be enabled if you are using multiple servers > on NFS. > So should be possible to enable this option *mail_nfs_storage = yes ?????* 4) I got this setting in *dovecot-sql.conf ( director ) * driver = mysql > connect = host=myserver.X dbname=maildb user=dovecot > password=XXXXXXXXXXXXXXXX > default_pass_scheme = SHA > password_query = select login as user, crypt_sha1 as password, home as > userdb_home, uid AS userdb_uid, gid AS userdb_gid, > concat(maildir,':INDEX=/data/indexes/',login) as userdb_mail from mailbox > left join aliases on aliases.systemid = aliasid where login = '%u' and > inactive = 0; > user_query = select home, maildir as mail, uid, gid from mailbox left join > aliases on aliases.systemid = aliasid where login = '%u' and inactive = 0; > iterate_query = select distinct login as user from mailbox; > I would like to implement * ITERINDEX* and probably *VOLATILEDIR *but not sure if this is the correct change or if i need to change something into the database. from: password_query = select login as user, crypt_sha1 as password, home as > userdb_home, uid AS userdb_uid, gid AS userdb_gid, > concat(maildir,':INDEX=/data/indexes/',login) as userdb_mail from mailbox > left join aliases on aliases.systemid = aliasid where login = '%u' and > inactive = 0; > to: password_query = select login as user, crypt_sha1 as password, home as > userdb_home, uid AS userdb_uid, gid AS userdb_gid, > concat(maildir,':INDEX=/data/indexes/',login,':ITERINDEX',':VOLATILEDIR=/tmp/%2.256Nu/%u',login) > as userdb_mail from mailbox left join aliases on aliases.systemid = aliasid > where login = '%u' and inactive = 0; > But not sure if is working correctly, * i checked debuging* in my imap node in this way: auth_verbose = yes > auth_verbose_passwords = no > auth_debug = yes > auth_debug_passwords = yes > mail_debug = yes > verbose_ssl = yes > This is the output log: Feb 15 09:32:53 my-imap-server dovecot: auth: Debug: sql(manolo1(a)mydomain,10.X.X.109,<eWEh7bj09N4KAjxt>): cache hit: {SHA}8376922a27e83b9eadcdec3596a70bf6c4db5730#011user=manolo1@mydomain #011userdb_home=/data/mail/tmydomain/users/manolo1#011userdb_uid=700#011userdb_gid=700#011userdb_mail=/data/mail/mydomain/users/manolo1/Maildir/:INDEX=/data/indexes/manolo1@mydomain :ITERINDEX:VOLATILEDIR=/tmp/3a/manolo1@mydomain *Not sure if is correct the output or should i need to change something into the database or this change only afect locally?* 5) *mailbox_list_index = yes ???* Mailbox list indexes can be used to optimize IMAP STATUS commands. They are > also required for IMAP NOTIFY extension to be enabled. > *It is this option necesary to add? in order to work with ITERINDEX option ?* https://www.mail-archive.com/dovecot@dovecot.org/msg75035.html ( i see your answer to this post ) 6) *What is the best way to do a maintenance in a backend?* The last time i flushed all the user in a director from a backend node to do a maintenance, after the maintenance done i rebalanced the director cluster, but the next day when user started tp connect we got high peak I/O , etc with a lot of problems, because new users in this backend node were re-indexes o creating new indexes. *Are there any way to do in a safer way? *Without loosing the hashed for the directors nodes. Thanks in advance!!!!!!!

3 2

Hide local IP from non delivery notifications
by Claudio Corvino 15 Feb '23

15 Feb '23

Hi everyone, I have an external MTA configured with Postfix that delivers email to an internal IMAP/LMTP Dovecot server configured to bind an LDAP to check if users exist. If the user does not exist, my MX sends a non delivery notification, and into the e-mail there's the local IP address of the Dovecot server. I can't find a way to remove or hide that IP, here is an example of line that contains the IP (with X) that I would like to hide/remove: *"The mail system<user@domain>: host hostname.domain.com <http://hostname.domain.com>[XXX.XXX.XXX.XXX] said: 550"* Thanks in advance! Cheers -- Claudio

5 6

crash when trying to upgrade from 2.0.x to 2.3.x
by Eugene M. Zheganin 15 Feb '23

15 Feb '23

Hello, I'm trying to migrate dovecot mail database from 2.0.9 on Linux to 2.3.20 on FreeBSD. I've rsync'd the entire database, grabbed all the configs, changed the paths and permission, but when trying to access the mail from Thunderbird I have reproducible crash in the logs: ===Cut=== Feb 14 17:12:10 it-r-support dovecot[5888]: auth-worker(6378): Debug: mysql(localhost): Finished query 'SELECT maildir, 1143 AS uid, 1143 AS gid FROM mailbox WHERE username = 'zheganin-em(a)alamics.ru' AND active = '1'' in 0 msecs Feb 14 17:12:10 it-r-support dovecot[5888]: auth-worker(6378): Debug: conn unix:auth-worker (uid=143): auth-worker<16>: sql(zheganin-em(a)alamics.ru,192.168.57.177,<oE2zjKn0FTXAqDmx>): Finished userdb lookup Feb 14 17:12:10 it-r-support dovecot[5888]: auth-worker(6378): Debug: conn unix:auth-worker (uid=143): auth-worker<16>: Finished Feb 14 17:12:10 it-r-support dovecot[5888]: auth: Debug: sql(zheganin-em(a)alamics.ru,192.168.57.177,<oE2zjKn0FTXAqDmx>): Finished userdb lookup Feb 14 17:12:10 it-r-support dovecot[5888]: auth: Debug: master userdb out: USER 1282408449zheganin-em(a)alamics.ru maildir=alamics.ru/zheganin-em/ uid=1143 gid=1143 auth_mech=PLAIN auth_token=15cceab95e1251ea97a8e5ff62c70d1b7a76c96f Feb 14 17:12:10 it-r-support dovecot[5888]: imap-login: Login: user=<zheganin-em(a)alamics.ru>, method=PLAIN, rip=192.168.57.177, lip=172.16.11.13, mpid=6405, session=<oE2zjKn0FTXAqDmx> Feb 14 17:12:10 it-r-support dovecot[5888]: imap(zheganin-em(a)alamics.ru)<6405><oE2zjKn0FTXAqDmx>: Panic: file array.c: line 10 (array_idx_modifiable_i): assertion failed: (idx < array->buffer->used / array->element_size) Feb 14 17:12:10 it-r-support dovecot[5888]: imap(zheganin-em(a)alamics.ru)<6405><oE2zjKn0FTXAqDmx>: Fatal: master: service(imap): child 6405 killed with signal 6 (core dumped) ===Cut=== There's an older thread here mentioning that probably doveadm force-resync would help, but it doesn't fix this. Is there something that could be done here ? I've also reported this in the FreeBSD bugtracker, but just in case decided to ask here too. Backtrace: ===Cut=== # lldb /usr/local/libexec/dovecot/imap --core imap-6404.core (lldb) target create "/usr/local/libexec/dovecot/imap" --core "imap-6404.core" Core file '/var/cores/imap-6404.core' (x86_64) was loaded. (lldb) bt * thread #1, name = 'imap', stop reason = signal SIGABRT * frame #0: 0x000000001151133a libc.so.7`__sys_thr_kill + 10 frame #1: 0x0000000011489c74 libc.so.7`__raise + 52 frame #2: 0x000000001153b109 libc.so.7`abort + 73 frame #3: 0x000000001137a336 libdovecot.so.0`___lldb_unnamed_symbol5855 + 150 frame #4: 0x0000000011378ad1 libdovecot.so.0`___lldb_unnamed_symbol5844 + 49 frame #5: 0x0000000011379881 libdovecot.so.0`___lldb_unnamed_symbol5846 + 33 frame #6: 0x0000000011378ceb libdovecot.so.0`i_panic + 187 frame #7: 0x000000001136a514 libdovecot.so.0`array_idx_modifiable_i + 100 frame #8: 0x0000000012054a78 lib20_fts_plugin.so`fts_user_autoindex_exclude + 72 frame #9: 0x0000000012051b3b lib20_fts_plugin.so`fts_mailbox_allocated + 267 frame #10: 0x000000001113ad0b libdovecot-storage.so.0`hook_mailbox_allocated + 155 frame #11: 0x0000000011134491 libdovecot-storage.so.0`mailbox_alloc + 449 frame #12: 0x0000000001044311 imap`cmd_select_full + 353 frame #13: 0x000000000104cd92 imap`command_exec + 178 frame #14: 0x000000000104b64a imap`___lldb_unnamed_symbol1265 + 58 frame #15: 0x000000000104b7b6 imap`___lldb_unnamed_symbol1265 + 422 frame #16: 0x000000000104a151 imap`client_handle_input + 465 frame #17: 0x00000000010488a8 imap`client_input + 120 frame #18: 0x00000000113936df libdovecot.so.0`io_loop_call_io + 111 frame #19: 0x0000000011396214 libdovecot.so.0`io_loop_handler_run_internal + 388 frame #20: 0x0000000011393dea libdovecot.so.0`io_loop_handler_run + 378 frame #21: 0x0000000011393c28 libdovecot.so.0`io_loop_run + 88 frame #22: 0x00000000112f6208 libdovecot.so.0`master_service_run + 24 frame #23: 0x000000000105af67 imap`main + 1383 frame #24: 0x000000000103c11d imap`_start + 269 (lldb) ===Cut=== Same backtrace in GDB: ===Cut=== # gdb /usr/local/libexec/dovecot/imap --core imap-6404.core GNU gdb (GDB) 12.1 [GDB v12.1 for FreeBSD] Copyright (C) 2022 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html> This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type "show copying" and "show warranty" for details. This GDB was configured as "x86_64-portbld-freebsd13.1". Type "show configuration" for configuration details. For bug reporting instructions, please see: <https://www.gnu.org/software/gdb/bugs/>. Find the GDB manual and other documentation resources online at: <http://www.gnu.org/software/gdb/documentation/>. For help, type "help". Type "apropos word" to search for commands related to "word"... Reading symbols from /usr/local/libexec/dovecot/imap... (No debugging symbols found in /usr/local/libexec/dovecot/imap) [New LWP 100485] warning: Could not load shared library symbols for [vdso]. Do you need "set solib-search-path" or "set sysroot"? Core was generated by `dovecot/imap'. Program terminated with signal SIGABRT, Aborted. Sent by thr_kill() from pid 6404 and user 1143. #0 0x000000001151133a in thr_kill () from /lib/libc.so.7 (gdb) bt full #0 0x000000001151133a in thr_kill () from /lib/libc.so.7 No symbol table info available. #1 0x0000000011489c74 in raise () from /lib/libc.so.7 No symbol table info available. #2 0x000000001153b109 in abort () from /lib/libc.so.7 No symbol table info available. #3 0x000000001137a336 in ?? () from /usr/local/lib/dovecot/libdovecot.so.0 No symbol table info available. #4 0x0000000011378ad1 in ?? () from /usr/local/lib/dovecot/libdovecot.so.0 No symbol table info available. #5 0x0000000011379881 in ?? () from /usr/local/lib/dovecot/libdovecot.so.0 No symbol table info available. #6 0x0000000011378ceb in i_panic () from /usr/local/lib/dovecot/libdovecot.so.0 No symbol table info available. #7 0x000000001136a514 in array_idx_modifiable_i () from /usr/local/lib/dovecot/libdovecot.so.0 No symbol table info available. #8 0x0000000012054a78 in fts_user_autoindex_exclude () from /usr/local/lib/dovecot/lib20_fts_plugin.so No symbol table info available. #9 0x0000000012051b3b in fts_mailbox_allocated () from /usr/local/lib/dovecot/lib20_fts_plugin.so No symbol table info available. #10 0x000000001113ad0b in hook_mailbox_allocated () from /usr/local/lib/dovecot/libdovecot-storage.so.0 No symbol table info available. #11 0x0000000011134491 in mailbox_alloc () from /usr/local/lib/dovecot/libdovecot-storage.so.0 No symbol table info available. #12 0x0000000001044311 in cmd_select_full () No symbol table info available. #13 0x000000000104cd92 in command_exec () No symbol table info available. #14 0x000000000104b64a in ?? () No symbol table info available. #15 0x000000000104b7b6 in ?? () No symbol table info available. #16 0x000000000104a151 in client_handle_input () No symbol table info available. #17 0x00000000010488a8 in client_input () No symbol table info available. #18 0x00000000113936df in io_loop_call_io () from /usr/local/lib/dovecot/libdovecot.so.0 No symbol table info available. #19 0x0000000011396214 in io_loop_handler_run_internal () from /usr/local/lib/dovecot/libdovecot.so.0 No symbol table info available. #20 0x0000000011393dea in io_loop_handler_run () from /usr/local/lib/dovecot/libdovecot.so.0 No symbol table info available. #21 0x0000000011393c28 in io_loop_run () from /usr/local/lib/dovecot/libdovecot.so.0 No symbol table info available. --Type <RET> for more, q to quit, c to continue without paging-- #22 0x00000000112f6208 in master_service_run () from /usr/local/lib/dovecot/libdovecot.so.0 No symbol table info available. #23 0x000000000105af67 in main () No symbol table info available. (gdb) ===Cut=== Thanks. Eugene.

2 3

Feature Request: login_trusted_networks to take FQDN
by Sean Gallagher 15 Feb '23

15 Feb '23

In a previous post to this list I described a problem I was having validating client certificates on inet_listener lmtp connections. Subject: "Please Help: Dovecot ssl_ca selection based on remote IP address filtering not working." The problem there was that Dovecot does not "inspect" the subject name on the client certificate on LMTP connections. As such Any valid certificate will pass. In this context "valid" means the same as OpenSSL SSL_set_verify( ,SSL_VERIFY_PEER, ). I.e. the certificate chain is well formed and can be traced back to a trusted root. It does not say anything about the peer's identity. I propose here, that the "login_trusted_networks" setting be allowed to take a domain name - possibly with wildcards. Then the name on the client certificate could be checked against login_trusted_networks in much the same way that web browsers work. If you tell your web browser that you want to connect to www.example.com, the browser will check that the server's certificate matches "www.example.com". In the present case, if you tell Dovecot (through the login_trusted_networks setting) to allow connections from "smtp.example.com", then Dovecot could check the name on the client's certificate matches "smtp.example.com". More generally, example.com could issue client certificates with names matching "*.mua.example.com". Then you could tell Dovecot to allow connections from "*.mua.example.com" through the login_trusted_networks setting. These usages could largely replace the IP host and CIDR subnet usages currently allowed in the login_trusted_networks setting but both could exist side by side. Of course, more elaborate schemes could be devised involving database lookups, but the outlined proposal would be relatively easy to implement and cover a good majority of use cases. The alternative is to force the use of application-specific certificate authorities, or just ignore it and hope that no one knows how to spoof network traffic. That's My two cents... Sean. -- This email has been checked for viruses by AVG antivirus software. www.avg.com

1 0

IMAP folder subscription on Apple/Mac Mail
by Alex 13 Feb '23

13 Feb '23

Hi, We have a user with an iPhone who can't see their maildir mailboxes on dovecot-2.3.20 on fedora37. I've created a "subscriptions" file with all maildir mailboxes with the proper format (converted from mboxes using mb2md), but the user can only see their inbox. It appears this may be a known problem? https://wiki.dovecot.org/Clients Perhaps it's a problem with my "subscriptions" file, despite being able to see all mailboxes using K-9 on my android? Ideas for troubleshooting would be greatly appreciated.

1 1

Re: Pigeonhole Sieve Vacation Reply-To peculiarity with inbound AWS-SES
by Dr. Rolf Jansen 11 Feb '23

11 Feb '23

> Am 08.02.2023 um 20:03 schrieb Michael Peddemors <michael(a)linuxmagic.com>: > > Dovecot vacation message issues.. > Tough for any system to do correctly. > >> The problem here is that inbound mails from third parties utilizing AWS-SES come in with an unpersonalized envelope address and SES takes returns to this as bounce messages and changes the body's From: to „MAILER-DAEMON(a)xx-zzzz-1.amazonses.xn--com-5o0a, which is not even our MAILER-DAEMON but the one of the receiver of our reply. So the receiver gets no chance to know from the headers the identity of whom replied - he may assume it from the context the actual message, though. > > We addressed this by NOT returning vacation messages to systems that don't use 'proper' values in the MAIL FROM.. Eg Mailing Lists, Sender Rewrite schemes, and a slurry of other rules. Who is we? Your organization or the Pigeonhole developers? Actually, the question is, whether this is addressed somewhere in Pigeonhole’s code already? > But the problem is that if you are using the header From, or Reply-To etc, it's too easy to be sending to forged email addresses. > > Vacation bombing attacks for instance.. You got a point here, and of course I want to prevent this. > Now, there are legitimate cases of the MAIL FROM and header from not aligning, so it is best to send to the MAIL FROM addresses.. IF you don't send it to certain MAIL FROM formats, usually by not responding to anything with mailing list identifiers, auto-suppress headers, and a few others, you only end up with clean MAIL FROM to respond to. From the point of the view of our industrial customers, who are operating processes with our chemicals, this consideration is irrelevant. If they inform a production issue by mail to the responsible service technician, they expect an immediate response, since a production stop is unacceptable. OoO notices play a role here, because we would inform alternative addresses and fone numbers for attending the support case. That said, with Pigeonhole, we are almost there. > But if you have an example that is particularly bothering you, and represents your problem, we can walk through that as an example. I send an email from an account of a mail server (Postfix/Dovecot - outbound relay SES) running on an AWS-EC2 instance in São Paulo (Brazil) to another mail address of mine of a mail server (Postfix/Dovecot direct MX) on an AWS-EC2 instance in Frankfurt Germany, and here the Pigeonhole’s vacation reply is activated. In the following I changed my real mail address in Brazil to rolf(a)example.br and the real one in Germany to rolf(a)example.de: The Point of view of the both involved Postfixes of said transactions are: Sender (Brazil): postfix/submission/smtpd[29165]: 97006638E8: client=201-68-62-42.dsl.telesp.net.br[201.68.62.42], sasl_method=CRAM-MD5, sasl_username=rolf(a)example.br postfix/cleanup[29182]: 97006638E8: message-id=<707A1777-8F09-4335-99BA-70C0367C129A(a)example.br> postfix/qmgr[2058]: 97006638E8: from=<rolf(a)example.br>, size=39626, nrcpt=1 (queue active) postfix/smtp[29183]: 97006638E8: to=<rolf(a)example.de>, relay=email-smtp.sa-east-1.amazonaws.com[52.67.192.29]:587, delay=0.37, delays=0.05/0.01/0.13/0.18, dsn=2.0.0, status=sent (250 Ok 010301863b0211fe-9416f5b2-7e18-4c03-a5e5-2204dd7946f8-000000) Receiver (Germany): postfix/smtpd[86956]: connect from d215-2.smtp-out.sa-east-1.amazonses.com[23.249.215.2] postfix/smtpd[86956]: A44AB676E3: client=d215-2.smtp-out.sa-east-1.amazonses.com[23.249.215.2] postfix/cleanup[86957]: A44AB676E3: message-id=<010301863b0211fe-9416f5b2-7e18-4c03-a5e5-2204dd7946f8-000000(a)sa-east-1.amazonses.com> postfix/qmgr[915]: A44AB676E3: from=<010301863b0211fe-9416f5b2-7e18-4c03-a5e5-2204dd7946f8-000000(a)sa-east-1.amazonses.com>, size=40862, nrcpt=1 (queue active) postfix/local[86958]: A44AB676E3: passing <rolf(a)example.de> to transport=lmtp postfix/lmtp[86959]: A44AB676E3: to=<rolf(a)example.de>, relay=mail.example.de[private/dovecot-lmtp], delay=0.94, delays=0.83/0.01/0.04/0.07, dsn=2.0.0, status=sent (250 2.0.0 <rolf(a)example.de> +/goFGgl5mOwUwEAEYr/fg Saved) Sender of the OoO (Germany): postfix/qmgr[915]: 60242676F0: from=<rolf(a)example.de>, size=1177, nrcpt=1 (queue active) postfix/cleanup[86957]: 60242676F0: message-id=<dovecot-sieve-1676027240-343352-0(a)example.de> postfix/pickup[62932]: 60242676F0: uid=xxxx from=<rolf(a)example.de> postfix/smtp[86963]: 60242676F0: to=<010301863b0211fe-9416f5b2-7e18-4c03-a5e5-2204dd7946f8-000000(a)sa-east-1.amazonses.com>, relay=email-smtp.eu-central-1.amazonaws.com[3.74.180.161]:587, delay=0.31, delays=0.01/0.02/0.13/0.15, dsn=2.0.0, status=sent (250 Ok 010701863b022070-bb3e4541-8306-4438-b649-8879ec8ff666-000000) Receiver of the OoO notice (Brazil): postfix/smtpd[29184]: connect from d215-244.smtp-out.sa-east-1.amazonses.com[23.249.215.244] postfix/smtpd[29184]: 5F1346394E: client=d215-244.smtp-out.sa-east-1.amazonses.com[23.249.215.244] postfix/cleanup[29182]: 5F1346394E: message-id=<010301863b022c93-9842f45a-85ec-419f-8199-00e027888394-000000(a)sa-east-1.amazonses.com> postfix/qmgr[2058]: 5F1346394E: from=<>, size=3150, nrcpt=1 (queue active) postfix/local[29185]: 5F1346394E: passing <rolf(a)example.br> to transport=lmtp postfix/lmtp[29186]: 5F1346394E: to=<rolf(a)example.br>, relay=mail.example.br[private/dovecot-lmtp], delay=0.05, delays=0.01/0.01/0.02/0.01, dsn=2.0.0, status=sent (250 2.0.0 <rolf(a)example.br> RRZHGWwl5mMDcgAAjZNhtw Saved) The headers of the received OoO message (I removed the DKIM stuff for clarity) are: Return-Path: <> Delivered-To: rolf(a)example.br Received: from mail.example.br by example.br with LMTP id RRZHGWwl5mMDcgAAjZNhtw (envelope-from <>) for <rolf(a)example.br>; Fri, 10 Feb 2023 08:07:24 -0300 Received: from d215-244.smtp-out.sa-east-1.amazonses.com (d215-244.smtp-out.sa-east-1.amazonses.com [23.249.215.244]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.example.br (Postfix) with ESMTPS id 5F1346394E for <rolf(a)example.br>; Fri, 10 Feb 2023 08:07:24 -0300 (-03) DKIM-Signature: ... X-Sieve: Pigeonhole Sieve 0.5.20 (149edcf2) Message-ID: <010301863b022c93-9842f45a-85ec-419f-8199-00e027888394-000000(a)sa-east-1.amazonses.com> Date: Fri, 10 Feb 2023 11:07:23 +0000 From: MAILER-DAEMON(a)sa-east-1.amazonses.com To: rolf(a)example.br Subject: Out of Office - automatic notice In-Reply-To: <010301863b0211fe-9416f5b2-7e18-4c03-a5e5-2204dd7946f8-000000(a)sa-east-1.amazonses.com> References: <010301863b0211fe-9416f5b2-7e18-4c03-a5e5-2204dd7946f8-000000(a)sa-east-1.amazonses.com> Auto-Submitted: auto-replied (vacation) Precedence: bulk X-Auto-Response-Suppress: All MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit Feedback-ID: 1.sa-east-1.E7DnIghDRHBvwjrx2QL73gyWAj+NYISxiq7bqOVD27E=:AmazonSES X-SES-Outgoing: 2023.02.10-23.249.215.244 Note how there is not a single reference of the real origin of the OoO message, rolf(a)example.de. Instead we see From: MAILER-DAEMON(a)sa-east-1.amazonses.com. The receiver of this message need to guess the real address from the outside context. The actual problem is that Pigeonhole responds to to=<010301863b0211fe-9416f5b2-7e18-4c03-a5e5-2204dd7946f8-000000(a)sa-east-1.amazonses.com> instead of to=<rolf(a)example.de>. Amazon SES of the original sender (not our relay) takes this as a bounce and changes the relevant headers. This is not under our control. Perhaps this could be mitigated by adding a Reply-To: header which informs the original sender. Then the receiver of the OoO noice would at least have a reference to what and whom this is about. Best regards Rolf > On 2023-02-08 13:21, Dr. Rolf Jansen wrote: >> Am 08.02.2023 um 12:57 schrieb Michael Peddemors <michael(a)linuxmagic.com>: >>> On 2023-02-08 07:47, Dr. Rolf Jansen wrote: >>>> Am 08.02.2023 um 12:23 schrieb Michael Peddemors <michael(a)linuxmagic.com>: >>>>> On 2023-02-07 14:57, Dr. Rolf Jansen wrote: >>>>>> Am 07.02.2023 um 19:49 schrieb Michael Peddemors <michael(a)linuxmagic.com>: >>>>>>> On 2023-02-07 13:33, jeremy ardley wrote: >>>>>>>> On 8/2/23 05:08, Dr. Rolf Jansen wrote: >>>>>>>>> Am 07.02.2023 um 17:54 schrieb jeremy ardley<jeremy(a)ardley.org>: >>>>>>>>>> On 7/2/23 22:01, Dr. Rolf Jansen wrote: >>>>>>>>>> To begin with, usage of Amazons Simple Email Service (SES) is mandatory for outgoing mails from AWS-EC2 instances. >>>>>>>>>> I run AWS-EC2 instances using postfix to send a receive mail. They can send direct assuming I set up suitable SPF, but they typically forward mail to another host under my control that is not on AWS to use as the outgoing server. >>>>>>>>> OK, that’s another use case. Many do use a full fledged Postfix/Dovecot installation. However the outgoing port 25 into the internet is blocked by AWS, and therefore we may either use a third party relay for our outgoing emails or may use SES, which is not that bad - except some unusual peculiarities. >>>>>>>>> >>>>>>>> This is off topic, but to be precise: >>>>>>>> - AWS throttles but does not block traffic to a *destination* port 25. >>>>>>>> - The *origin* port on the EC2 instance is an unprivilged port, not port 25 >>>>>>>> - If you use a relayhost you typically send from an unprivilged EC2 port to port 587 on the relay host >>>>>>>> Jeremy >>>>>>> >>>>>>> And if you DO intend to send out to port 25, remember to update the PTR on your EC2 instance. >>>>>> I respond off-list. Generally a good hint but it’s like trying to bath salts (https://en.wikipedia.org/wiki/Bath_salts) when you are taking a shower. >>>>>> https://aws.amazon.com/premiumsupport/knowledge-center/ec2-port-25-throttle/ >>>>>> Although the link text (ec2-port-25-throttle) suggests throttling, it is actually blocking - read the text. This cannot be removed from standard EC2 instances. >>>>>> This also corresponds to my experience. On the console of an AWS-EC2 instance, I entered just now: >>>>>> telnet cyclaero.com 25 >>>>>> This hangs until timeout. At the same time cyclaero.com received emails from the internet on port 25. >>>>>> Trying 3.126.110.101... >>>>>> telnet: connect to address 3.126.110.101: Operation timed out >>>>>> telnet: Unable to connect to remote host >>>>> >>>>> There are a lot of malicous or compromised EC2 instances..It is good they block port by default, and the one day delay before unblocking (you can request it) helps stop those short term spam instances. >>>>> >>>>> Now, wish they blocked port 587 by default ;) >>>>> >>>>> Or at least tracked the attacks. >>>>> >>>>> Strange though, that people still try to set up email on EC2, doesn't make sense, and it isn't the cheapest alternative.

5 8

Please Help: Dovecot ssl_ca selection based on remote IP address filtering not working.
by Sean Gallagher 11 Feb '23

11 Feb '23

Hi All, I hope this is the correct place to post this. If not, apologies. I am in the process of updating my company's email servers and am trying to put Dovecot into an Alpine Linux container, hosted on ProxMox. In my setup, local mail deliveries via LMTP can come from the MSA (for intra-company mail) and an MTA (for inbound mail). The LMTP data is sent over IPv4 and is protected by TLS. Client certificates are used to authenticate sources. I wanted to prevent Dovecot from accepting LMTP from any other source and the method I came up with to do this was to use filtering on the "remote" address. I would create a "Fake" CA that had never signed a certificate and use that to evaluate the certificate presented by incoming connections from addresses other than the two legitimate sources. This would cause all connections from "bad" addresses to be rejected. This seemed simple enough on paper but Dovecot just isn't playing along. It seems that no matter what I do, I cannot get "remote" filtering to switch the "ssl_ca" parameter. I have put together a test bed to demonstrate. I then use openssl s_client to attempt to connect to the test bed container. I've attached the instructions to build the test bed from scratch. In all cases s_client reports "Acceptable client certificate CA names" "CN = Fake CA" I.e. it want's a certificate from the CA that has never signed a certificate and never will. Why not do the obvious thing? I use LDAP to authenticate individual users and the user name will be reported over LMTP. So to use the normal authentication mechanisms to authenticate the connection source, I would need to do two LDAP lookups, one for the connecting machine and one for the mail recipient. It is not clear if this is possible from the documentation.. *Questions:* Is config file filtering broken or am I doing it wrong? Is it possible to provide a different "ssl_ca" based on the remote IP address? Is there an easier way to restrict LMTP connections to specific remote IP addresses? p.s. Filtering just doesn't work like it's supposed to. Someone should look at that (especially multi-level) .. See this: https://dovecot.org/pipermail/dovecot/2016-June/104770.html Any help would be greatly appreciated. I am at my wits' end with this. -- This email has been checked for viruses by AVG antivirus software. www.avg.com

1 1

Why does creating a mailbox create it in all namespaces?
by e 10 Feb '23

10 Feb '23

When I create a mailbox using CREATE, it creates it in all namespaces? Is that supposed to happen? Look: ``` a namespace * NAMESPACE (("" "/")("Other/" "/")) NIL NIL a OK Namespace completed (0.001 + 0.000 secs). a list "" * * LIST (\HasNoChildren) "/" Other * LIST (\HasNoChildren) "/" INBOX a OK List completed (0.001 + 0.000 secs). a create Other/Drafts a OK Create completed (0.003 + 0.000 + 0.002 secs). a list "" * * LIST (\HasNoChildren) "/" Drafts * LIST (\HasChildren) "/" Other * LIST (\HasNoChildren) "/" Other/Drafts * LIST (\HasNoChildren) "/" INBOX a OK List completed (0.001 + 0.000 secs). ``` This is my namespace configuration ``` namespace { prefix = inbox = yes separator = / } namespace { prefix = Other/ separator = / } ``` And dovecot version is 2.3.7.2

2 1

doveadm: Error: Mailbox INBOX: Deleting corrupted cache: Cache file too large
by Ralf Hildebrandt 09 Feb '23

09 Feb '23

Hi! Upon issuing a % doveadm import -u restore(a)backup.invalid mdbox:/home/storage/mdbox I'm getting a: doveadm(restore(a)backup.invalid): Error: Mailbox INBOX: Deleting corrupted cache: Cache file too largea doveadm(restore(a)backup.invalid): Error: Corrupted dbox file /home/restore/mdbox/storage/m.7 (around offset=41602004): msg header has bad magic value doveadm(restore(a)backup.invalid): Error: Corrupted dbox file /home/restore/mdbox/storage/m.8 (around offset=17193748): msg header has bad magic value message -- but the process keeps running! Should I worry? dovecot packages: 2.3.20-3+ubuntu20.04 -- Ralf Hildebrandt Geschäftsbereich IT | Abteilung Netzwerk Charité - Universitätsmedizin Berlin Campus Benjamin Franklin Hindenburgdamm 30 | D-12203 Berlin Tel. +49 30 450 570 155 | Fax: +49 30 450 570 962 ralf.hildebrandt(a)charite.de | https://www.charite.de

1 0

Pigeonhole Sieve Vacation Reply-To peculiarity with inbound AWS-SES
by Dr. Rolf Jansen 08 Feb '23

08 Feb '23

To begin with, usage of Amazons Simple Email Service (SES) is mandatory for outgoing mails from AWS-EC2 instances. The Pro is, it does work and we may utilize email relays with high reputation for our outgoing mails at no additional costs. The Con's are that (A) SES does not relay mails with empty <> MAIL FROM addresses and (B) it fiddles with the envelope addresses of the relayed mails. Anyway this is out of our control, and while I could avoid (A) by switching the e-mail service provider, I still have no control over (B) because this affects replying to emails from others using AWS-SES. Problem A) The empty-MAIL-FROM may be effectively addressed by setting Pigeonhole’s sieve_vacation_send_from_recipient to ‚yes‘. Problem B) Pigeonhole Vacation utilizes the senders envelope address of the inbound message as the reply-address. The problem here is that inbound mails from third parties utilizing AWS-SES come in with an unpersonalized envelope address and SES takes returns to this as bounce messages and changes the body's From: to „MAILER-DAEMON(a)xx-zzzz-1.amazonses.xn--com-5o0a, which is not even our MAILER-DAEMON but the one of the receiver of our reply. So the receiver gets no chance to know from the headers the identity of whom replied - he may assume it from the context the actual message, though. I found the setting sieve_vacation_to_header_ignore_envelope, which was introduced in 2017 (https://dovecot.org/list/dovecot-cvs/2017-August/028917.html) My finding is, that this resolves the problem only half way. For a local workaround, I changed Line 1119 of cmd-vacation.c https://github.com/dovecot/pigeonhole/blob/34431d7a67474c00d5b0554f5d45b867… to: struct smtp_address real_to; if (smtp_address_init_from_msg(&real_to, &reply_to) >= 0) sctx = sieve_smtp_start_single(senv, &real_to, smtp_from, &output); else sctx = sieve_smtp_start_single(senv, smtp_to, smtp_from, &output); That in place and setting sieve_vacation_to_header_ignore_envelope to ‚yes‘, effectively resolves problem B as well. Best regards Rolf Jansen

6 10

Ubuntu packages for 22.04 LTS?
by Ralf Hildebrandt 06 Feb '23

06 Feb '23

Hi! I recently updated from 20.04 -> 22.04 and wondered if packages specifically for 22.04 were available. https://doc.dovecot.org/installation_guide/dovecot_community_repositories/u… doesn't seem list any... Neiter does https://repo.dovecot.org -- Ralf Hildebrandt Geschäftsbereich IT | Abteilung Netzwerk Charité - Universitätsmedizin Berlin Campus Benjamin Franklin Hindenburgdamm 30 | D-12203 Berlin Tel. +49 30 450 570 155 | Fax: +49 30 450 570 962 ralf.hildebrandt(a)charite.de | https://www.charite.de

2 2

problem converting mailbox to maildir with doveadm
by Kenneth Irving 05 Feb '23

05 Feb '23

Hello. I have an email server for testing purposes, using postfix 3.5.17 and dovecot 2.3.13. Initially, I configured postfix to use mailboxes, but now I've changed it to maildir. Emails arrive fine, and dovecot manages them well by pop3 or imap. No problems there. But I still have a lot of emails in different mailboxes which I'd like to convert to maildir. I found mb2md, which seems to do a pretty good job. Once the mailbox is converted, dovecot manages the emails without a problem. But I also wanted to learn how to use doveadm to convert mailboxes to maildir format. I read all the documentation I could find and tried to learn how this command works. I tried different combinations, but couldn't convert mailboxes to maildir. I always get error messages. I've been unable to understand why. I tried to sync, backup, and import, to no avail. I also tried dsync, which seems to have a different syntax, with the same result. Sorry for bothering you, but if you could explain to me how this command works, I'd be very grateful. Example: I have a user, let's say joe, who has a mailbox in /var/mail/joe and I'd like to transfer those emails to /home/joe/Maildir How do I use doveadm in this situation? Best regards Kenneth

3 4

IMAP tuning for Outlook 365
by Artur Pydo 02 Feb '23

02 Feb '23

Hello, I'm looking for advices on IMAP config tuning for best user experience with Outlook 365. I'm currently using dovecot 2.3.4.1 (f79e8e7e4) provided with Debian 10. One of my users has Outlook 365 and an IMAP mailbox of large size with several folders (more than 3GB). From time to time as his main inbox folder is growing he can see some problems with its Outlook application. Sometimes it freezes during mailbox synchronisation, sometimes he can't see new incoming emails. I wonder if there is some specific workarounds for an up-to-date Outlook in Dovecot or if you can suggests some config setup adjustments (timeouts, idleing ...) to avoid problems in his Outlook. Most of the config are defaults. But I can provide relevant parts of the config if needed. I have this workaround activated for a long time: imap_client_workarounds = delay-newmail By the way, I also have a big IMAP mailbox. Can't see any server specific problem while connecting with Thunderbird to this Dovecot server. -- Best regards, Artur

4 3

Dovecot gzip u.files on sdboxes
by Jose Celestino 01 Feb '23

01 Feb '23

Hi, I was wondering if it's possible to lighten the process of converting sdbox mailboxes to zlib by, instead of using dsync (that brings much more io, copying from alt - and copying of unneeded data as we have many mails already compressed from activating zlib a couble of years ago) just compressing each of the u files. By compression of the u files I mean opening the uncompressed u file for reading, a u.temp file for writting and: 1. copy the dbox message header from u to u.tmp 2. compress the plain message and write it to u.tmp 3. fix the message_size_hex on the u.tmp dbox message header to the new, compressed size 4. copy the dbox metadata from u to u.tmp with Zphysical_size added 5. copy the u stat times to u.tmp 6. replace u with u.tmp Is the message_size_hex stored anywhere else (indexes) that may cause this to not work? Thank you.

2 1

Add Userdb extra field to existing configuration settings, not overriding them
by Stefano Cecconello 27 Jan '23

27 Jan '23

Hi, If i understood correctly the extra field feature ( https://doc.dovecot.org/configuration_manual/authentication/user_database_ex tra_fields/ ), any extra field that is passed from a SQL query will overwrite any existing settings on the dovecot.conf configuration file ( if present ) . For example, if i want to enable a plugin ( ex: acl ) on a per user basis, i would add a column\field ( ex: "acl_enabled" = 1 ) into my auth DB , then add into the dovecot password\user queries : . IF(acl_enabled = 0, NULL, 'acl imap_acl') AS mail_plugins . While having in the dovecot.conf this setting : . mail_plugins = quota notify protocol imap mail_plugins = $mail_plugins imap_quota . >From my test, this combination will lead to having the logging users with acl_enabled=1, a mail_plugins list of acl and imap_acl only, without the quota and notify plugins . If i change the acl_value to 0, the returned mail_plugins list is empty and it will not overrive\overwrite the dovecot.conf mail_plugins configuration . If it's correct, there is a way to merge both settings, like having in the dovecot.conf a minimal\base subset of settings and adding any additional values via SQL queries ? Thanks and best regards Stefano

2 1

sieve_extprograms plugin calling bash script
by Tom 27 Jan '23

27 Jan '23

I receive an email a few times a week containing a URL for a live stream which starts within a minute after receiving the email. I want to automate capturing the whole stream. I've been trying to write a sieve script which uses the sieve extprograms plugin to call a bash script that parses the URL from the email and passes it to a capture program. So far I've had no luck getting the bash script to call _any_ external programs. I can't even write a file to /tmp/, so it's not a filesystem permissions issue. The sieve script has no issues finding and executing the bash script, it just does nothing other than return an exit code. Does sieve put the extprogram script in some kind of sandbox where it has no access to the system? This may not be the best place to find answers to sieve plugin info. If so, can someone point me in the right direction?

3 2

How do you scale dovecot for good performance with Roundcube webmailer in front? (hitting limits without exhausting resources)
by Malte Schmidt 27 Jan '23

27 Jan '23

Good day, I am currently setting up/debugging a webmailer-only setup using Roundcube (latest version) with Dovecot (2.3.20, latest as of now). Generally speaking the setup performs OK, I wrote a JMeter Roundcube script to test the Roundcube. This includes actions like listing mails and fetching them. I am hitting a somehow dubious limit of 600 req/s though. (This includes all kinds of HTTP calls to Roundcube, not only the ones triggering IMAP). When the dovecot becomes unavailable, the performance without mails jumps to 7700 req/s. Testing is done with 4 JMeter-servers and one client. My setup is a Dovecot with MySQL (Percona XtraDB) backend. Mails are encrypted with mail_crypt and EC keys. Authentication is done in parallel (auth_cache_verify_with_workers=yes). Where possible min_available_processes have been set equal to the threads available on the Dovecot machine (64). Hardware is a 64 thread Xeon CPU at 2.10 GHz, 96 GB RAM, SSDs as backing storage IOPS read 40000/write 13000. What settings do you recommend and how was your experience with Roundcube and its performance in general (what should be possible with that kind of HW?)? Best regards and thanks in advance!

3 3

[REVISIONS] How to install SSL Certificate on Dovecot and Postfix
by Turritopsis Dohrnii Teo En Ming 27 Jan '23

27 Jan '23

Subject: [REVISIONS] How to install SSL Certificate on Dovecot and Postfix Good day from Singapore, Author: Mr. Turritopsis Dohrnii Teo En Ming (TARGETED INDIVIDUAL) Country: Singapore Date of Implementation: 6 Jan 2023 Friday SECTION ON DOVECOT =================== # cd /etc/dovecot/conf.d # nano 10-ssl.conf ssl = yes ssl_cert = </home/teo-en-ming-corp/2023.crt ssl_key = </home/teo-en-ming-corp/2023.key ssl_ca = </home/teo-en-ming-corp/inter2023.crt # nano /etc/dovecot/dovecot.conf protocols = imap pop3 !include conf.d/*.conf SECTION ON POSTFIX =================== # nano /etc/postfix/main.cf smtpd_use_tls = yes smtpd_tls_auth_only = yes smtpd_tls_key_file = /etc/postfix/2023.key smtpd_tls_cert_file = /etc/postfix/chain2023.crt smtpd_tls_CAfile = /etc/postfix/inter2023.crt Note: chain2023.crt is made by combining 2023.crt and inter2023.crt # nano /etc/postfix/master.cf submission inet n - n - - smtpd smtps inet n - n - - smtpd tlsmgr unix - - n 1000? 1 tlsmgr That's all. Regards, Mr. Turritopsis Dohrnii Teo En Ming Targeted Individual in Singapore Blogs: https://tdtemcerts.blogspot.com https://tdtemcerts.wordpress.com

1 0

LDAP scheme for Dovecot
by Daniel Betschart 24 Jan '23

24 Jan '23

I use an LDAP server for user administration, the users can manage themselves with the LDAP Account Manager (LAM). I would like to give the possibility to be able to define the quota per user. LAM provides support for certain schemes, but the qmail scheme is missing in the free variant. So I used the Courier scheme. Now, while LAM correctly stores the value in bytes, it appends the letter S. Unfortunately, the mail server Dovecot cannot do anything with this letter S. Is there a better scheme for Dovecot? I haven't found any until now. Or can I remove the letter S at the end in the Dovecot configuration file via regex?

1 0

Why does doveadm always run doveconf?
by Bert Van de Poel 21 Jan '23

21 Jan '23

Dear fellow Dovecot users, I've recently been aiding in the fixing up of the old dovecot_stats_ munin plugin. Currently, it still parses the output of doveadm oldstats, as it is quite an old script. Regardless of any feelings we may all have about oldstats, I was quite surprised to find that doveadm requires quite broad privileges (in my case root privileges) to function properly. It seems that any call to doveadm, even for "doveadm oldstats dump domain" runs doveconf and will attempt to fully parse my configuration including trying to read SSL/TLS certificates. Due to this choice, the fact the FIFO of oldstats can be given low privileges, doveadm still has to be invoked with high privileges or it will fail at the stage of verifying configuration. Now I'm wondering why it's the case that a command such as "doveadm oldstats dump domain" is invoking doveconf and therefore has these kinds of limitations. While for basically all non-stats functions of doveadm, running as root (or similar) makes a lot of sense, I'd argue it doesn't for oldstats (and maybe also the new stats?), which simply talk to a socket. Is there a certain reasoning behind this, or is this accidental behaviour because of the standard operations doveadm always performs? Any elaboration would be more than welcome! Kind regards, Bert

2 3

Different username for passdb and userdb
by support+dovecot＠shellworld.net 21 Jan '23

21 Jan '23

Hello I am attempting to use an external IMAP server for authentication, on Dovecot 2.3.16 (7e2e900c1a), running on Ubuntu 22.04. The external server requires usernames of the format: user@domain However, my local users, where the mail is actually drawn from, are of the format: user (passwd file driven). I was able to log in with just "user", and have it both authenticate remotely, and access local mail, using: passdb { driver = imap args = host=remotehost.com ssl=imaps port=993 user=%n@%d ssl_ca_dir=/etc/ssl/certs } userdb { driver = passwd args = blocking=no } However, the remote SMTP server, which I will not be proxying, requires the same user@domain format for usernames. I would rather not ask users to use "user@domain" for SMTP, and "user" for IMAP. They should only have to use "user@domain" for login everywhere. Is there a way to do this? The docs suggest so (AuthDatabase.PasswdFile.txt), but if so I must be botching it. Things I have tried: passdb { driver = imap args = host=remotehost.com ssl=imaps port=993 ssl_ca_dir=/etc/ssl/certs } userdb { driver = passwd args = blocking=no override_fields = username_format=%n } I also tried: override_fields = user=%n Or, alternatively to any override_fields: args = blocking=no username_format=%n Lastly, I even tried this whole different approach: userdb { driver = passwd-file args = blocking=no username_format=%n /etc/passwd } The following is logged no matter which of those I try: auth: imapc(remotehost.com:993): Connected to #.#.#.#:993 (local #.#.#.#:35088) auth: Error: passwd(user(a)domain,#.#.#.#,<...>): user not found from userdb imap(274049): Error: auth-master: login: request [...]: Login auth request failed: Authenticated user not found from userdb, auth lookup id=... (auth connected 10 msecs ago, request took 1 msecs, client-pid=274038 client-id=1) imap-login: Disconnected: Internal login failure (pid=274038 id=1): user=<user@domain>, method=PLAIN, rip=#.#.#.#, lip=#.#.#.#, mpid=274049, TLS, session=<...> (The last attempt got a slightly varied log message, but quite similar: auth: Error: passwd-file(user(a)domain#.#.#.#,<...>): user not found from userdb ) Any help with this would be much appreciated. Thanks! Luke

1 1

submission_host auth
by k v 18 Jan '23

18 Jan '23

When using dovecot container with sieve plugin there is no sendmail to use for sending email for sieve redirect action for example. We can use submission_host instead https://doc.dovecot.org/settings/core/#core_setting-submission_host but there is no way to specify credentials for auth in remote MTA. Submission_relay_* settings e.g. submission_relay_master_user relate to dovecot submission service. Using something like permit_mynetworks in remote MTA is not acceptable for security reasons. Is it possible to add authorization in the remote MTA using submission_host?

2 4

dovecot replication - new and cur folders on mx1 and mx2
by Tomaz Kavcic 18 Jan '23

18 Jan '23

Hello, I have a question in regards to specific dovecot replication behaviour and I'm just wondering if this is actually an expected/normal behaviour, or just a version issue. I'm using dovecot 2.3.16 which is packed by default with latest Ubuntu 22.04.1 LTS server release. I setup dovecot replication pair (mx1 - mx2) which is working ok. MX1 has priority 10, MX2 has priority 20. I use maildir (postfix + dovecot lmtp). The "strange" behaviour is this. When new mail arrives, it's by default delivered into "new" folder inside user directory. This email is then replicated to both servers (mx1 and mx2). When I login to mx1 via IMAP client (roundcube, outlook, etc.) that specific email is moved from "new" to "cur" folder on server mx1 and it's flagged also with "S", which probably means read flag. On server mx2, that email filename is also flagged with "S", but the email stays inside the "new" folder and it's not moved to "cur". If I want this email to be moved to "cur" on mx2 server, I have to login to that IMAP server as well, click on that email (which is already flagged as read), and after click, the email is also moved to "cur" on server mx2. Simply said, all new mails on mx1 server are moved to "cur" when accessed, but the stay in "new" folder on server mx2 until they're physically accessed there as well. Is this normal behaviour? I tried setup with TCP and SSH replication, and the situation is the same in all cases. Lastly, I tried TCPS (with SSL) as well, but that option has issues in 2.3.16, which is probably known already as I found multiple posts about these issues in this version. Thank you in advance for your answer and kind regards, Tomaz Kavcic. --- As suggested by mr. Timo Sarainen, this should be synced, so I'm posting doveconf -n as attachment for both servers as well.

3 3

Quota Clone Plugin
by MK 17 Jan '23

17 Jan '23

Hello Everybody, just a short question, maybe someone used this plugin and can give me a short answer. I have configured dovecot Quota Clone Plugin to copy quota information into a MySQL Database. Works finde, but dovecot writes the quota information only to the database if the quota is triggert by new email or something else like this. So I don't have all my user in the MySQL Database. Is there any command I can use that can trigger dovecot to write the quota information of all the users to the database one time, so that I have all my user quota information copied in the database? I have tried "doveadm quota recalc -A" but it took quite a long time and there is a very high I/O Load on the server, so I stopped it. I don't think this is what I want to do. Maybe there is another way. For all of you who don't know this plugin. https://doc.dovecot.org/configuration_manual/quota_clone_plugin/ Greetings, Oliver

3 3

hostname in director_mail_servers setting
by k v 16 Jan '23

16 Jan '23

director_mail_servers setting uses IP Adresses as values https://doc.dovecot.org/settings/core/#core_setting-director_mail_servers As described in the documentation, hostnames are converted to addresses when the configuration is read https://doc.dovecot.org/settings/types/#ip-addresses This is acceptable in host or virtual machine environment, but becomes a problem in a containerized environment. When any backend container is restarted, its address will change and users related to this backend can no longer connect, but backend (available with new IP address) can process request for example, director_mail_servers = dovecot-1 dovecot-2 dovecot-3 becomes in runtime (with one successfully connectetd user foo(a)example.com) doveadm director status mail server ip tag vhosts state state changed users 10.0.71.3 100 up - 0 10.0.71.4 100 up - 1 10.0.71.5 100 up - 0 where dovecot-1 10.0.71.3, dovecot-2 10.0.71.4, dovecot-3 10.0.71.5 When dovevecot-2 backend container restarts, and becomes new IP address, user can't connect to related backend: imap-login: Info: proxy(foo@example.com,10.0.71.4:143): Started proxying to <10.0.71.4> (<dovecot-2>) (0.009 secs) imap-login: Error: proxy(foo@example.com,10.0.71.4:143): connect(10.0.71.4, 143) failed: No route to host (after 28 secs, 3 reconnects, local=10.0.71.13:41066) My suggestion to developers: resolve backend hostnames to IP address on every request to director_mail_servers It's not about dovemon service with active health checks from dovecot pro, just dynamic hostname resolve

2 1

Error: Mailbox INBOX: file_dotlock_create in directory /var/mail failed: Permission denied
by manmatha 16 Jan '23

16 Jan '23

Hi All, We are running Round cube on top of dovecot and postfix as our email echo system. Main problem we are facing is that, roundcube loads really slow for big inboxes (~5000 emails). I found that, while it loads, imap process goes high in terms of CPU utilization(~90%). I asked it in some roundcube support group, They believe that it is related to dovecot not roundcube. Can you shed any light on this issue. Thanks in advance. Here is $dovecot -n$ output xyz@roundcube-internal-server-1:/etc/dovecot$ dovecot -n # 2.3.16 (7e2e900c1a): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.16 (09c29328) # OS: Linux 5.15.0-1024-kvm x86_64 Ubuntu 22.04.1 LTS # Hostname: roundcube-internal-server-1 auth_mechanisms = plain login disable_plaintext_auth = no listen = * lock_method = dotlock mail_always_cache_fields = date.received mail_cache_min_mail_count = 5000 mail_location = mbox:~/mail:INBOX=/var/mail/%u:INDEX=/var/indexes/isical.ac.in/%n mail_privileged_group = mail mail_sort_max_read_count = 100 mailbox_list_index_include_inbox = yes mailbox_list_index_very_dirty_syncs = yes maildir_very_dirty_syncs = yes mbox_dotlock_change_timeout = 1 mins mbox_lazy_writes = no mbox_write_locks = dotlock fcntl namespace inbox { inbox = yes location = prefix = } passdb { driver = pam } protocols = imap pop3 ssl_cert = </etc/dovecot/private/dovecot.pem ssl_client_ca_dir = /etc/ssl/certs ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { driver = passwd } protocol !indexer-worker { mail_vsize_bg_after_count = 100 } On a different note we are getting error occasionally of the following type. I dont know if they are related. Jan 16 15:36:13 roundcube-internal-server-1 dovecot: imap(xyz)<361270><aqauu17ycsvAqL8/>: Error: unlink(/var/mail/xyz.lock) failed: Permission denied (in file-dotlock.c:195) Jan 16 15:36:13 roundcube-internal-server-1 dovecot: imap(xyz)<361270><aqauu17ycsvAqL8/>: Error: unlink(xyz.lock) failed: Permission denied (in file-dotlock.c:195) Jan 16 15:36:13 roundcube-internal-server-1 dovecot: imap(xyz)<361270><aqauu17ycsvAqL8/>: Error: Mailbox INBOX: file_dotlock_create(xyz) in directory /var/mail failed: Permission denied (euid=10865(xyz) egid=8(mail) missing +w perm: /var/mail, UNIX perms appear ok (ACL/MAC wrong?), dir owned by 0:8 mode=0771)

2 1

Up to date dovecot packages on Ubuntu 22.4LTS
by Gerben Wierda 12 Jan '23

12 Jan '23

I just found out that Ubuntu Linux 22.04 LTS has a dovecot apt package that is 2.3.16. Debian 11 (stable) is at dovecot 2.3.13 with apt. if I looked correctly. Dovecot itself is at 2.3.20. That surprised me (I am new to the Linux distro and package management world) as Ubuntu 22.04 is a Long-Time Support version, and I was expecting packages to be updated as well (as many users will want updated packages. How does that work in the dovecot world? How come macOS MacPorts (2.3.19) has more recent packages than any of the large Debian-based Linuxes? Gerben Wierda (LinkedIn <https://www.linkedin.com/in/gerbenwierda>) R&A IT Strategy <https://ea.rna.nl/> (main site) Book: Chess and the Art of Enterprise Architecture <https://ea.rna.nl/the-book/> Book: Mastering ArchiMate <https://ea.rna.nl/the-book-edition-iii/>

3 2

director: pass different username to proxy than the one that is used for hashing
by alex 12 Jan '23

12 Jan '23

dovecot 2.3.13 Hi, I'm looking for a way to make director use a user@domain that is returned by the database for hashing but actually send the original user@domain in the proxied request. I cannot seem to find a way. I can change the name used for hashing by just returning a different user from the db. but that user is also the one that is send in the proxied request. this is what I have so far: director_username_hash = %L{user} # relevant sql: password_query = SELECT \ username as user, \ # -> this is used for hashing if destuser is not present. = OK NULL as password, \ 'y' as proxy, \ 'y' as nopassword, \ '%n@%d' as destuser \ # -> but as soon as I add this, this is used for hashing = !OK FROM dovecot_data('%n', '%d') Anyone know any clever tricks to accomplish this? Thanks! Alex (background: I've inherited a mail setup where mailboxes have multiple logins. (those all share the same 'home' for their maildirs). I need all of these to go to the same server. Most ideal would be hashing on home '%h' instead of %u :)).

1 0

Living without fdpass / SCM_RIGHTS
by Dengler, Gabriel 10 Jan '23

10 Jan '23

Hello everyone, I wanted to run Dovecot inside Gramine [1]. Gramine is a tool to let normal Linux binaries run with the help of the Intel Software Guard Extensions (SGX) technology [2] in a secure enclave to which the operating system doesn't have an access to. Most parts of Dovecot now run fine, however, Dovecot uses the SCM_RIGHTS flag for the sendmsg system call to exchange file descriptors over Unix sockets [3]. Normally, this feature is available in every Unix, but in Gramine, this is currently not supported [4]. So, according to the logs, the authentication works, but after that, the imap-login process cannot exchange the file descriptor with the imap process. Therefore I wanted to ask if there is a possibility to make Dovecot work without this feature or if this would need fundamental changes in the code structure. Thanks for your help in advance! Best regards, Gabriel References: [1] https://gramineproject.io/ [2] https://de.wikipedia.org/wiki/Software_Guard_Extensions [3] https://github.com/dovecot/core/blob/main/src/lib/fdpass.c#L128 [4] https://github.com/gramineproject/gramine/discussions/1013#discussioncommen…

1 0

Dovecot - mail_crypt - lmtp-server - no password to decrypt the key
by Baljeet Bhinder 09 Jan '23

09 Jan '23

I have been using postfix+dovecot successfully for a while now until I tried mail crypt plugin lately. I tried what is describe here https://doc.dovecot.org/configuration_manual/mail_crypt_plugin/ and I went for global-keys as described here: https://doc.dovecot.org/configuration_manual/mail_crypt_plugin/#global-keys /"A good solution for environments where no user folder sharing is needed is to generate per-user EC key pair and encrypt that with something derived from user’s password."/ I am setting mail_crypt_global_private_key, mail_crypt_global_public_key, mail_crypt_save_version from user_query and userdb_mail_crypt_global_private_key_password from password_query. mail_crypt seems to work fine in imap (I saved a message as draft and it is stored encrypted on the disk), but lmtp complains about "mail_crypt_global_private_key_password unset, no password to decrypt the key" As you can see below in logs that it was able to set all other mail_crypt_ configurations successfully from user_query. However, the password is provided via password_query and I assume lmtp does not read password_query. How else can I provide a password in lmtp? Is my approach correct to begin with? -- Dovecot Configurations -- # using doveconf -n # 2.3.19.1 (9b53102964): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.19 (4eae2f79) # OS: Linux 5.15.0-57-generic x86_64 Ubuntu 20.04.5 LTS # Hostname: mailserver-dovecot-7c9ff7b94b-8ldrr auth_mechanisms = plain login auth_verbose = yes auth_verbose_passwords = yes debug_log_path = /dev/stdout haproxy_trusted_networks = 192.168.0.0/16 10.10.10.0/24 10.10.30.0/24 172.17.0.1/16 hostname = imap.mailserver.k8s.local pop.mailserver.k8s.local info_log_path = /dev/stdout listen = * log_path = /dev/stdout mail_debug = yes mail_gid = 1000 mail_home = /var/vmail/mailboxes/%d/%n mail_location = maildir:~/:LAYOUT=fs mail_plugins = quota mail_crypt mail_privileged_group = mail mail_uid = 1000 managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext imapsieve vnd.dovecot.imapsieve namespace inbox { inbox = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Spam { auto = subscribe autoexpunge = 30 days special_use = \Junk } mailbox Trash { auto = subscribe autoexpunge = 30 days special_use = \Trash } prefix = } passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } plugin { imapsieve_mailbox1_before = file:/var/vmail/sieve/global/learn-spam.sieve imapsieve_mailbox1_causes = COPY APPEND FLAG imapsieve_mailbox1_name = Spam imapsieve_mailbox2_before = file:/var/vmail/sieve/global/learn-ham.sieve imapsieve_mailbox2_causes = COPY APPEND FLAG imapsieve_mailbox2_from = Spam imapsieve_mailbox2_name = * mail_crypt_save_version = 0 quota = maildir:User quota quota_exceeded_message = User %u has exhausted allowed storage space. quota_rule = Junk:ignore quota_rule2 = Trash:storage=+100M quota_warning = storage=90%% quota-warning 90 %u %d quota_warning2 = storage=80%% quota-warning 80 %u %d sieve = file:~/sieve;active=~/.dovecot.sieve sieve_before = /var/vmail/sieve/global/spam-global.sieve sieve_global = /var/vmail/sieve/global/ sieve_global_extensions = +vnd.dovecot.pipe +vnd.dovecot.debug sieve_pipe_bin_dir = /var/vmail/sieve/global sieve_plugins = sieve_imapsieve sieve_extprograms } protocols = " imap lmtp sieve pop3" service auth { inet_listener { port = 25252 } } service imap-login { inet_listener imap { haproxy = yes } inet_listener imaps { haproxy = yes ssl = yes } } service lmtp { executable = lmtp -L inet_listener lmtp { address = 0.0.0.0 port = 24 } } service managesieve-login { inet_listener sieve { port = 4190 } } service pop3-login { inet_listener pop3 { haproxy = yes } inet_listener pop3s { haproxy = yes } } ssl = required ssl_cert = </etc/dovecot/certs/tls.crt ssl_client_ca_dir = /etc/ssl/certs ssl_key = # hidden, use -P to show it ssl_prefer_server_ciphers = yes userdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } protocol lmtp { info_log_path = /dev/stdout log_path = /dev/stdout mail_plugins = quota mail_crypt sieve postmaster_address = <hidden> } protocol imap { mail_plugins = quota mail_crypt quota imap_quota imap_sieve } -- Dovecot Configurations Ends -- -- Password Query -- password_query = \ SELECT username, domain, password, \ '%{sha256:password}' AS userdb_mail_crypt_global_private_key_password \ FROM mailbox \ WHERE username='%u'; -- Password Query Ends-- -- User Query -- user_query = SELECT CONCAT('*:bytes=', 1024) as quota_rule, \ private_key AS mail_crypt_global_private_key, \ public_key AS mail_crypt_global_public_key, \ mail_crypt_save_version AS mail_crypt_save_version \ FROM mailbox \ WHERE username='%u'; -- User Query Ends -- -- Debug Logs -- --- Load Inbox --- imap-login: Info: Login: user=<someone(a)example.com>, method=PLAIN, rip=192.168.49.1, lip=192.168.49.2, mpid=241, TLS, session=<oaoI9sLxVKXAqDEB> imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: Loading modules from directory: /usr/lib/dovecot/modules imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: Module loaded: /usr/lib/dovecot/modules/lib10_mail_crypt_plugin.so imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: Module loaded: /usr/lib/dovecot/modules/lib10_quota_plugin.so imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: Module loaded: /usr/lib/dovecot/modules/lib11_imap_quota_plugin.so imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: Module loaded: /usr/lib/dovecot/modules/lib95_imap_sieve_plugin.so imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: Added userdb setting: plugin/mail_crypt_global_private_key=LS0tLS1CRUd.....LS0tLS0K imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: Added userdb setting: plugin/mail_crypt_global_private_key_password=<hidden> imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: Added userdb setting: plugin/mail_crypt_global_public_key=LS0tLS1CRUd.....LS0tCg== imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: Added userdb setting: plugin/mail_crypt_save_version=2 imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: Added userdb setting: plugin/quota_rule=*:bytes=1024000000 imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: Effective uid=1000, gid=1000, home=/var/vmail/mailboxes/example.com/someone imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: mail_crypt_plugin: mail_crypt_curve setting missing - generating EC keys disabled imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: Quota root: name=User quota backend=maildir args= imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: Quota rule: root=User quota mailbox=* bytes=1024000000 messages=0 imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: Quota rule: root=User quota mailbox=Trash bytes=+104857600 messages=0 imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: Quota warning: bytes=921600000 (90%) messages=0 reverse=no command=quota-warning 90 someone(a)example.com example.com imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: Quota warning: bytes=819200000 (80%) messages=0 reverse=no command=quota-warning 80 someone(a)example.com example.com imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: Quota grace: root=User quota bytes=102400000 (10%) imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: open(/proc/self/io) failed: Permission denied imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: Namespace inbox: type=private, prefix=, sep=, inbox=yes, hidden=no, list=yes, subscriptions=yes location=maildir:~/:LAYOUT=fs imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: fs: root=/var/vmail/mailboxes/example.com/someone, index=, indexpvt=, control=, inbox=/var/vmail/mailboxes/example.com/someone, alt= imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: quota: quota_over_flag check: quota_over_script unset - skipping imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: Mailbox INBOX: Mailbox opened --- Load Inbox Ends --- --- Lmtp --- lmtp(248): Info: Connect from 172.17.0.1 lmtp(someone(a)example.com)<248><e2dcD6TuumP4AAAALzF/Qw>: Debug: auth-master: userdb lookup(someone(a)example.com): Started userdb lookup lmtp(someone(a)example.com)<248><e2dcD6TuumP4AAAALzF/Qw>: Debug: auth-master: conn unix:/var/run/dovecot/auth-userdb: Connecting lmtp(someone(a)example.com)<248><e2dcD6TuumP4AAAALzF/Qw>: Debug: auth-master: conn unix:/var/run/dovecot/auth-userdb (pid=143,uid=0): Client connected (fd=18) imap(someone(a)example.com)<247><WlggG8PxEOvAqDEB>: Debug: Mailbox Sent: Purging (new file_seq=1673195172): creating cache imap(someone(a)example.com)<247><WlggG8PxEOvAqDEB>: Debug: Mailbox Sent: Purging finished, file_seq changed 0 -> 1673195172, size=0 -> 388, max_uid=0 lmtp(someone(a)example.com)<248><e2dcD6TuumP4AAAALzF/Qw>: Debug: auth-master: userdb lookup(someone(a)example.com): auth USER input: someone(a)example.com quota_rule=*:bytes=1024000000 mail_crypt_global_private_key=LS0tLS1CRUd.....LS0tLS0K mail_crypt_global_public_key=LS0tLS1CRUd.....LS0tCg== mail_crypt_save_version=2 lmtp(someone(a)example.com)<248><e2dcD6TuumP4AAAALzF/Qw>: Debug: auth-master: userdb lookup(someone(a)example.com): Finished userdb lookup (username=someone(a)example.com quota_rule=*:bytes=1024000000 mail_crypt_global_private_key=LS0tLS1CRUd.....LS0tLS0K mail_crypt_global_public_key=LS0tLS1CRUd.....LS0tCg== mail_crypt_save_version=2) lmtp(someone(a)example.com)<248><e2dcD6TuumP4AAAALzF/Qw>: Debug: lmtp-server: conn 172.17.0.1:6376 [1]: rcpt someone(a)example.com: Added userdb setting: plugin/mail_crypt_global_private_key=LS0tLS1CRUd.....LS0tLS0K imap(someone(a)example.com)<247><WlggG8PxEOvAqDEB>: Debug: duplicate db: Initialize lmtp(someone(a)example.com)<248><e2dcD6TuumP4AAAALzF/Qw>: Debug: lmtp-server: conn 172.17.0.1:6376 [1]: rcpt someone(a)example.com: Added userdb setting: plugin/mail_crypt_global_public_key=LS0tLS1CRUd.....LS0tCg== imap(someone(a)example.com)<247><WlggG8PxEOvAqDEB>: Debug: sieve: Pigeonhole version 0.5.19 (4eae2f79) initializing lmtp(someone(a)example.com)<248><e2dcD6TuumP4AAAALzF/Qw>: Debug: lmtp-server: conn 172.17.0.1:6376 [1]: rcpt someone(a)example.com: Added userdb setting: plugin/mail_crypt_save_version=2 lmtp(someone(a)example.com)<248><e2dcD6TuumP4AAAALzF/Qw>: Debug: lmtp-server: conn 172.17.0.1:6376 [1]: rcpt someone(a)example.com: Added userdb setting: plugin/quota_rule=*:bytes=1024000000 lmtp(someone(a)example.com)<248><e2dcD6TuumP4AAAALzF/Qw>: Debug: lmtp-server: conn 172.17.0.1:6376 [1]: rcpt someone(a)example.com: Effective uid=1000, gid=1000, home=/var/vmail/mailboxes/example.com/someone lmtp(someone(a)example.com)<248><e2dcD6TuumP4AAAALzF/Qw>: Debug: lmtp-server: conn 172.17.0.1:6376 [1]: rcpt someone(a)example.com: mail_crypt_plugin: mail_crypt_curve setting missing - generating EC keys disabled lmtp(someone(a)example.com)<248><e2dcD6TuumP4AAAALzF/Qw>: Debug: lmtp-server: conn 172.17.0.1:6376 [1]: rcpt someone(a)example.com: Quota root: name=User quota backend=maildir args= lmtp(someone(a)example.com)<248><e2dcD6TuumP4AAAALzF/Qw>: Debug: lmtp-server: conn 172.17.0.1:6376 [1]: rcpt someone(a)example.com: Quota rule: root=User quota mailbox=* bytes=1024000000 messages=0 lmtp(someone(a)example.com)<248><e2dcD6TuumP4AAAALzF/Qw>: Debug: lmtp-server: conn 172.17.0.1:6376 [1]: rcpt someone(a)example.com: Quota rule: root=User quota mailbox=Trash bytes=+104857600 messages=0 lmtp(someone(a)example.com)<248><e2dcD6TuumP4AAAALzF/Qw>: Debug: lmtp-server: conn 172.17.0.1:6376 [1]: rcpt someone(a)example.com: Quota warning: bytes=921600000 (90%) messages=0 reverse=no command=quota-warning 90 someone(a)example.com example.com lmtp(someone(a)example.com)<248><e2dcD6TuumP4AAAALzF/Qw>: Debug: lmtp-server: conn 172.17.0.1:6376 [1]: rcpt someone(a)example.com: Quota warning: bytes=819200000 (80%) messages=0 reverse=no command=quota-warning 80 someone(a)example.com example.com lmtp(someone(a)example.com)<248><e2dcD6TuumP4AAAALzF/Qw>: Debug: lmtp-server: conn 172.17.0.1:6376 [1]: rcpt someone(a)example.com: Quota grace: root=User quota bytes=102400000 (10%) lmtp(248): Error: lmtp-server: conn 172.17.0.1:6376 [1]: rcpt someone(a)example.com: Failed to initialize user: mail_crypt_plugin: mail_crypt_global_private_key: mail_crypt_global_private_key_password unset, no password to decrypt the key lmtp(248): Info: Disconnect from 172.17.0.1: Logged out (state=READY) --- Lmtp Ends --- -- Debug Logs Ends -- Thanks Baljeet Bhinder

3 3

Keycloak Authorization Code Flow
by Gary Horchem 08 Jan '23

08 Jan '23

Can dovecot use Keycloak Authorization Code Flow? I would like to use it instead of Password Resource Grant Flow for better security. Sent from my iPhone

1 0

How to set otp one time password
by weihao.chen＠artisantechnologies.cn 07 Jan '23

07 Jan '23

Dear Everybody: May I ask how to configure dovecot otp one-time verification login, that is, after the user logs in to the mailbox with the password + otp, he can send and receive emails without entering the password + otp again? # This is my settings: # /etc/dovecot/conf.d/10-auth.conf disable_plaintext_auth = yes auth_cache_size = 10M auth_failure_delay = 5 secs auth_ssl_username_from_cert = yes auth_mechanisms = otp !include auth-ldap.conf.ext error logs: ------------------------------- 6952-Jan 06 18:03:01 master: Info: Dovecot v2.3.19.1 (9b53102964) starting up for imap, lmtp (core dumps disabled) 6953-Jan 06 18:03:02 auth: Debug: Loading modules from directory: /usr/lib/dovecot/auth 6954-Jan 06 18:03:02 auth: Debug: Module loaded: /usr/lib/dovecot/auth/lib20_auth_var_expand_crypt.so 6955:Jan 06 18:03:02 auth: Fatal: OTP mechanism can't be supported with given passdbs 6956-Jan 06 18:03:02 master: Error: service(auth): command startup failed, throttling for 2.000 secs 6957-Jan 06 18:03:02 imap-login: Info: Disconnected: Auth process broken (disconnected before auth was ready, waited 0 secs): user=<>, rip=172.30.20.51, lip=172.16.5.111, TLS handshaking, session=<OiDkhZXx7fasHhQz> 6958-Jan 06 18:03:07 auth: Debug: Loading modules from directory: /usr/lib/dovecot/auth 6959-Jan 06 18:03:07 auth: Debug: Module loaded: /usr/lib/dovecot/auth/lib20_auth_var_expand_crypt.so 6960:Jan 06 18:03:07 auth: Fatal: OTP mechanism can't be supported with given passdbs 6961-Jan 06 18:03:07 master: Error: service(auth): command startup failed, throttling for 4.000 secs 6962-Jan 06 18:03:07 imap-login: Info: Disconnected: Auth process broken (disconnected before auth was ready, waited 0 secs): user=<>, rip=172.30.20.51, lip=172.16.5.111, TLS handshaking, session=<qgIyhpXx8PasHhQz> 6963-Jan 06 18:03:11 auth: Debug: Loading modules from directory: /usr/lib/dovecot/auth 6964-Jan 06 18:03:11 auth: Debug: Module loaded: /usr/lib/dovecot/auth/lib20_auth_var_expand_crypt.so 6965:Jan 06 18:03:11 auth: Fatal: OTP mechanism can't be supported with given passdbs 6966-Jan 06 18:03:11 master: Error: service(auth): command startup failed, throttling for 8.000 secs 6967-Jan 06 18:03:11 imap-login: Info: Disconnected: Auth process broken (disconnected before auth was ready, waited 3 secs): user=<>, rip=172.30.20.51, lip=172.16.5.111, TLS, session=<gDdvhpXx8/asHhQz> 6968-Jan 06 18:03:19 auth: Debug: Loading modules from directory: /usr/lib/dovecot/auth 6969-Jan 06 18:03:19 auth: Debug: Module loaded: /usr/lib/dovecot/auth/lib20_auth_var_expand_crypt.so 6970:Jan 06 18:03:19 auth: Fatal: OTP mechanism can't be supported with given passdbs 6971-Jan 06 18:03:19 master: Error: service(auth): command startup failed, throttling for 16.000 secs 6972-Jan 06 18:03:19 imap-login: Info: Disconnected: Auth process broken (disconnected before auth was ready, waited 8 secs): user=<>, rip=172.30.20.51, lip=172.16.5.111, TLS, session=<qp7phpXx9PasHhQz> 6973-Jan 06 18:03:29 imap-login: Info: Disconnected: Connection closed (disconnected before auth was ready, waited 5 secs): user=<>, rip=172.30.20.51, lip=172.16.5.111, TLS, session=<N1qAh5Xx/PasHhQz> 6974-Jan 06 18:03:35 auth: Debug: Loading modules from directory: /usr/lib/dovecot/auth 6975-Jan 06 18:03:35 auth: Debug: Module loaded: /usr/lib/dovecot/auth/lib20_auth_var_expand_crypt.so 6976:Jan 06 18:03:35 auth: Fatal: OTP mechanism can't be supported with given passdbs 6977-Jan 06 18:03:35 master: Error: service(auth): command startup failed, throttling for 32.000 secs 6978-Jan 06 18:04:01 master: Warning: Killed with signal 15 (by pid=2692494 uid=0 code=kill) 6979-Jan 06 18:04:02 master: Info: Dovecot v2.3.19.1 (9b53102964) starting up for imap, lmtp (core dumps disabled) 6980-Jan 06 18:04:09 auth: Debug: Loading modules from directory: /usr/lib/dovecot/auth 6981-Jan 06 18:04:09 auth: Debug: Module loaded: /usr/lib/dovecot/auth/lib20_auth_var_expand_crypt.so 6982:Jan 06 18:04:09 auth: Fatal: OTP mechanism can't be supported with given passdbs 6983-Jan 06 18:04:09 master: Error: service(auth): command startup failed, throttling for 2.000 secs 6984-Jan 06 18:04:09 imap-login: Info: Disconnected: Auth process broken (disconnected before auth was ready, waited 0 secs): user=<>, rip=172.30.20.51, lip=172.16.5.111, TLS handshaking, session=<8VrsiZXxFfesHhQz> 6985-Jan 06 18:04:56 auth: Debug: Loading modules from directory: /usr/lib/dovecot/auth 6986-Jan 06 18:04:56 auth: Debug: Module loaded: /usr/lib/dovecot/auth/lib20_auth_var_expand_crypt.so 6987:Jan 06 18:04:56 auth: Fatal: OTP mechanism can't be supported with given passdbs 6988-Jan 06 18:04:56 master: Error: service(auth): command startup failed, throttling for 4.000 secs 6989-Jan 06 18:05:57 auth: Debug: Loading modules from directory: /usr/lib/dovecot/auth 6990-Jan 06 18:05:57 auth: Debug: Module loaded: /usr/lib/dovecot/auth/lib20_auth_var_expand_crypt.so 6991:Jan 06 18:05:57 auth: Fatal: OTP mechanism can't be supported with given passdbs 6992-Jan 06 18:05:57 master: Error: service(auth): command startup failed, throttling for 8.000 secs 6993-Jan 06 18:06:26 master: Warning: Killed with signal 15 (by pid=2692680 uid=0 code=kill) 6994-Jan 06 18:06:27 log(2692602): Warning: Killed with signal 15 (by pid=1 uid=0 code=kill) 6995-Jan 06 18:06:27 master: Info: Dovecot v2.3.19.1 (9b53102964) starting up for imap, lmtp (core dumps disabled) 6996-Jan 06 18:06:47 auth: Debug: Loading modules from directory: /usr/lib/dovecot/auth 6997-Jan 06 18:06:47 auth: Debug: Module loaded: /usr/lib/dovecot/auth/lib20_auth_var_expand_crypt.so 6998-Jan 06 18:06:47 auth: Debug: Read auth token secret from /var/run/dovecot//auth-token-secret.dat 6999-Jan 06 18:06:47 auth: Error: ldap_bind 7000-Jan 06 18:06:47 auth: Error: ldap_simple_bind 7001-Jan 06 18:06:47 auth: Error: ldap_sasl_bind ------------------------------- if option: auth_mechanisms = plain login Can send and receive emails successfully, but when the otp time expires, you need to re-enter the password + otp, which is unacceptable to the user Looking forward to your reply, Tanks -- nick(Weihao) weihao.chen(a)artisantechnologies.cn

2 1

postfix connects to dovecot lmtp socket, but nothing is delivered
by Gerben Wierda 05 Jan '23

05 Jan '23

I am setting up a new server combination (postfix + dovecot). dovecot's auth service works for postfix. Just lmtp does not and I need to find out why. I don't see anything in the dovecot logging, but I see this on the postfix side (debug) Jan 05 16:11:59 snape postfix/lmtp[127]: connection established Jan 05 16:11:59 snape postfix/lmtp[127]: master_notify: status 0 Jan 05 16:11:59 snape postfix/lmtp[127]: deliver_request_initial: send initial response Jan 05 16:11:59 snape postfix/lmtp[127]: send attr protocol = delivery_request_protocol Jan 05 16:16:59 snape postfix/lmtp[126]: smtp_get: timeout Jan 05 16:16:59 snape postfix/lmtp[126]: connect to subsystem private/defer Jan 05 16:16:59 snape postfix/lmtp[126]: private/defer socket: wanted attribute: protocol Jan 05 16:16:59 snape postfix/lmtp[126]: input attribute name: protocol Jan 05 16:16:59 snape postfix/lmtp[126]: input attribute value: delivery_status_protocol Jan 05 16:16:59 snape postfix/lmtp[126]: private/defer socket: wanted attribute: (list terminator) Jan 05 16:16:59 snape postfix/lmtp[126]: input attribute name: (end) Jan 05 16:16:59 snape postfix/lmtp[126]: send attr nrequest = 0 Jan 05 16:16:59 snape postfix/lmtp[126]: send attr flags = 0 Jan 05 16:16:59 snape postfix/lmtp[126]: send attr queue_id = C71B3D1262 Jan 05 16:16:59 snape postfix/lmtp[126]: send attr original_recipient = sysbh(a)rna.nl Jan 05 16:16:59 snape postfix/lmtp[126]: send attr recipient = sysbh(a)rna.nl Jan 05 16:16:59 snape postfix/lmtp[126]: send attr offset = 18446744073709551615 Jan 05 16:16:59 snape postfix/lmtp[126]: send attr dsn_orig_rcpt = rfc822;sysbh(a)rna.nl Jan 05 16:16:59 snape postfix/lmtp[126]: send attr notify_flags = 0 Jan 05 16:16:59 snape postfix/lmtp[126]: send attr status = 4.4.2 Jan 05 16:16:59 snape postfix/lmtp[126]: send attr diag_type = Jan 05 16:16:59 snape postfix/lmtp[126]: send attr diag_text = Jan 05 16:16:59 snape postfix/lmtp[126]: send attr mta_type = Jan 05 16:16:59 snape postfix/lmtp[126]: send attr mta_mname = Jan 05 16:16:59 snape postfix/lmtp[126]: send attr action = delayed Jan 05 16:16:59 snape postfix/lmtp[126]: send attr reason = conversation with snape.rna.nl[private/lmtp] timed out while receiving the initial server greeting Jan 05 16:16:59 snape postfix/lmtp[126]: private/defer socket: wanted attribute: status Jan 05 16:16:59 snape postfix/lmtp[126]: input attribute name: status Jan 05 16:16:59 snape postfix/lmtp[126]: input attribute value: 0 Jan 05 16:16:59 snape postfix/lmtp[126]: private/defer socket: wanted attribute: (list terminator) Jan 05 16:16:59 snape postfix/lmtp[126]: input attribute name: (end) Jan 05 16:16:59 snape postfix/lmtp[126]: C71B3D1262: to=<sysbh(a)rna.nl>, relay=snape.rna.nl[private/lmtp], delay=300, delays=0.02/0/300/0, dsn=4.4.2, status=deferred (conversation with snape.rna.nl[private/lmtp] timed out while receiving the initial server greeting) Jan 05 16:16:59 snape postfix/lmtp[126]: flush_add: site rna.nl id C71B3D1262 Jan 05 16:16:59 snape postfix/lmtp[126]: match_list_match: rna.nl: no match Jan 05 16:16:59 snape postfix/lmtp[126]: flush_add: site rna.nl id C71B3D1262 status 4 Jan 05 16:16:59 snape postfix/lmtp[126]: deliver_request_final: send: "conversation with snape.rna.nl[private/lmtp] timed out while receiving the initial server greeting" -1 Jan 05 16:16:59 snape postfix/lmtp[126]: send attr status = 4.4.2 Jan 05 16:16:59 snape postfix/lmtp[126]: send attr diag_type = Jan 05 16:16:59 snape postfix/lmtp[126]: send attr diag_text = Jan 05 16:16:59 snape postfix/lmtp[126]: send attr mta_type = Jan 05 16:16:59 snape postfix/lmtp[127]: master_notify: status 1 Jan 05 16:16:59 snape postfix/lmtp[126]: send attr mta_mname = Jan 05 16:16:59 snape postfix/lmtp[127]: connection closed Jan 05 16:16:59 snape postfix/lmtp[126]: send attr action = Jan 05 16:16:59 snape postfix/lmtp[126]: send attr reason = conversation with snape.rna.nl[private/lmtp] timed out while receiving the initial server greeting Jan 05 16:16:59 snape postfix/lmtp[126]: send attr status = 4294967295 Jan 05 16:16:59 snape postfix/lmtp[126]: master_notify: status 1 Jan 05 16:16:59 snape postfix/lmtp[126]: connection closed It seems dovecot doesn't react to whatever postfix is doing on the socket. Another possibility is that the socket doesn't really work and dovecot never gets a connection request. How can I debug this? Might I test if the socket is the problem by running lmtp on the dovecot side on TCP on 127.0.0.1 and have postfix use that? Just to see if it works? If so, how do I tell postfix to do that? In dovecot I have added the tcp: service lmtp { inet_listener lmtp { address = 127.0.0.1 port = 24 } unix_listener /var/spool/postfix/private/lmtp { mode = 0660 user = postfix group = postfix } } service lmtp { executable = lmtp -L } protocol lmtp { info_log_path = /var/log/mail/dovecot-lmtp.log } Any other tips? Gerben Wierda (LinkedIn <https://www.linkedin.com/in/gerbenwierda>) R&A IT Strategy <https://ea.rna.nl/> (main site) Book: Chess and the Art of Enterprise Architecture <https://ea.rna.nl/the-book/> Book: Mastering ArchiMate <https://ea.rna.nl/the-book-edition-iii/>

4 8

Migrating, syncing, maybe load-balancing/failover two dovecot servers?
by Gerben Wierda 05 Jan '23

05 Jan '23

I am in the process of migrating from dovecot on one OS (macOS/darwin) to a new server running dovecot with another OS (Ubuntu Linux 22.4). I have mostly copied/adapted the setup of the old server to the new. I am in the process of finishing that and adding some stuff that still needs to be added/migrated, like rspamd. And the data of course before the new one takes over from the old. I have done a migration before (MacOS X Server dovecot to MacPorts dovecot on macOS), many years ago, I recall that I used dovecot syncing but also rsync and I don't really recall (and anyway, the software has changed since) I have been thinking about keeping them both alive, with one as a failover for the other. They will not share their storage (e.g. NFS), So, I was wondering if I can do something with syncing between instances and dovecot director. I have been looking at the documentation, but a quick scan reveals I cannot locate some sort of tutorial and I am uncertain what will work and what not. If keeping both alive in parallel is too problematic, it is OK to have regular syncing in one direction (old to new) at first and then switch over and have syncing in the other direction (new to old) Can someone enlighten me? Gerben Wierda (LinkedIn <https://www.linkedin.com/in/gerbenwierda>) R&A IT Strategy <https://ea.rna.nl/> (main site) Book: Chess and the Art of Enterprise Architecture <https://ea.rna.nl/the-book/> Book: Mastering ArchiMate <https://ea.rna.nl/the-book-edition-iii/>

4 5

imap and lmtp create different index/control folders
by George Asenov 05 Jan '23

05 Jan '23

Hello, We have migrated our mail server from procmail lda to dovecot lmtp/sieve . dovecot imap create the dir with the email account test(a)s32.teststring.ml for name but lmtp create it as test-s32.someteststring.ml(a)serverhostname.tld I can't figure out how to manipulate nor what username postfix send to dovecot/lmtp or how dovecot/lmtp interpret it. As you will see in the config below there is a separate userdb set for lmtp because it receive the username/envelope from postfix as test-s32.someteststring.ml(a)serverhostname.tld which prevent it to use the pam authentication to verify and use the mail user to deliver email. So I use driver = passwd-file which have the option to configure the format of the username. But this is kind of dirty hack which i do not like. Anyone now how to configure dovecot/lmtp by default to remove the @myserverhostname.tld from the username or configure postfix not to add it? Here is the postfix config: ############################# postconf 2bounce_notice_recipient = postmaster access_map_defer_code = 450 access_map_reject_code = 554 address_verify_cache_cleanup_interval = 12h address_verify_default_transport = $default_transport address_verify_local_transport = $local_transport address_verify_map = btree:$data_directory/verify_cache address_verify_negative_cache = yes address_verify_negative_expire_time = 3d address_verify_negative_refresh_time = 3h address_verify_pending_request_limit = 5000 address_verify_poll_count = ${stress?{1}:{3}} address_verify_poll_delay = 3s address_verify_positive_expire_time = 31d address_verify_positive_refresh_time = 7d address_verify_relay_transport = $relay_transport address_verify_relayhost = $relayhost address_verify_sender = $double_bounce_sender address_verify_sender_dependent_default_transport_maps = $sender_dependent_default_transport_maps address_verify_sender_dependent_relayhost_maps = $sender_dependent_relayhost_maps address_verify_sender_ttl = 0s address_verify_service_name = verify address_verify_transport_maps = $transport_maps address_verify_virtual_transport = $virtual_transport alias_database = hash:/etc/aliases alias_maps = hash:/etc/aliases allow_mail_to_commands = alias, forward allow_mail_to_files = alias, forward allow_min_user = no allow_percent_hack = no allow_untrusted_routing = no alternate_config_directories = always_add_missing_headers = no always_bcc = anvil_rate_time_unit = 60s anvil_status_update_time = 600s append_at_myorigin = yes append_dot_mydomain = ${{$compatibility_level} < {1} ? {yes} : {no}} application_event_drain_time = 100s authorized_flush_users = static:anyone authorized_mailq_users = static:anyone authorized_submit_users = static:anyone backwards_bounce_logfile_compatibility = yes berkeley_db_create_buffer_size = 16777216 berkeley_db_read_buffer_size = 131072 best_mx_transport = biff = yes body_checks = body_checks_size_limit = 51200 bounce_notice_recipient = postmaster bounce_queue_lifetime = 5d bounce_service_name = bounce bounce_size_limit = 50000 bounce_template_file = broken_sasl_auth_clients = yes canonical_classes = envelope_sender, envelope_recipient, header_sender, header_recipient canonical_maps = cleanup_service_name = cleanup command_directory = /usr/sbin command_execution_directory = command_expansion_filter = 1234567890!@%-_=+:,./abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ command_time_limit = 1000s compatibility_level = 2 config_directory = /etc/postfix confirm_delay_cleared = no connection_cache_protocol_timeout = 5s connection_cache_service_name = scache connection_cache_status_update_time = 600s connection_cache_ttl_limit = 2s content_filter = cyrus_sasl_config_path = daemon_directory = /usr/libexec/postfix daemon_table_open_error_is_fatal = no daemon_timeout = 18000s data_directory = /var/lib/postfix debug_peer_level = 2 debug_peer_list = debugger_command = PATH=/bin:/usr/bin:/usr/local/bin:/usr/X11R6/bin ddd $daemon_directory/$process_name $process_id & sleep 5 default_database_type = hash default_delivery_slot_cost = 5 default_delivery_slot_discount = 50 default_delivery_slot_loan = 3 default_delivery_status_filter = default_destination_concurrency_failed_cohort_limit = 1 default_destination_concurrency_limit = 20 default_destination_concurrency_negative_feedback = 1 default_destination_concurrency_positive_feedback = 1 default_destination_rate_delay = 0s default_destination_recipient_limit = 50 default_extra_recipient_limit = 1000 default_filter_nexthop = default_minimum_delivery_slots = 3 default_privs = nobody default_process_limit = 100 default_rbl_reply = $rbl_code Service unavailable; $rbl_class [$rbl_what] blocked using $rbl_domain${rbl_reason?; $rbl_reason} default_recipient_limit = 20000 default_recipient_refill_delay = 5s default_recipient_refill_limit = 100 default_transport = smtp default_transport_rate_delay = 0s default_verp_delimiters = += defer_code = 450 defer_service_name = defer defer_transports = delay_logging_resolution_limit = 2 delay_notice_recipient = postmaster delay_warning_time = 0h deliver_lock_attempts = 20 deliver_lock_delay = 1s destination_concurrency_feedback_debug = no detect_8bit_encoding_header = yes disable_dns_lookups = no disable_mime_input_processing = no disable_mime_output_conversion = no disable_verp_bounces = no disable_vrfy_command = yes dns_ncache_ttl_fix_enable = no dnsblog_reply_delay = 0s dnsblog_service_name = dnsblog dont_remove = 0 double_bounce_sender = double-bounce duplicate_filter_limit = 1000 empty_address_default_transport_maps_lookup_key = <> empty_address_recipient = MAILER-DAEMON empty_address_relayhost_maps_lookup_key = <> enable_idna2003_compatibility = no enable_long_queue_ids = no enable_original_recipient = yes error_delivery_slot_cost = $default_delivery_slot_cost error_delivery_slot_discount = $default_delivery_slot_discount error_delivery_slot_loan = $default_delivery_slot_loan error_destination_concurrency_failed_cohort_limit = $default_destination_concurrency_failed_cohort_limit error_destination_concurrency_limit = $default_destination_concurrency_limit error_destination_concurrency_negative_feedback = $default_destination_concurrency_negative_feedback error_destination_concurrency_positive_feedback = $default_destination_concurrency_positive_feedback error_destination_rate_delay = $default_destination_rate_delay error_destination_recipient_limit = $default_destination_recipient_limit error_extra_recipient_limit = $default_extra_recipient_limit error_initial_destination_concurrency = $initial_destination_concurrency error_minimum_delivery_slots = $default_minimum_delivery_slots error_notice_recipient = postmaster error_recipient_limit = $default_recipient_limit error_recipient_refill_delay = $default_recipient_refill_delay error_recipient_refill_limit = $default_recipient_refill_limit error_service_name = error error_transport_rate_delay = $default_transport_rate_delay execution_directory_expansion_filter = 1234567890!@%-_=+:,./abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ expand_owner_alias = no export_environment = TZ MAIL_CONFIG LANG fallback_transport = fallback_transport_maps = fast_flush_domains = $relay_domains fast_flush_purge_time = 7d fast_flush_refresh_time = 12h fault_injection_code = 0 flush_service_name = flush fork_attempts = 5 fork_delay = 1s forward_expansion_filter = 1234567890!@%-_=+:,./abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ forward_path = $home/.forward${recipient_delimiter}${extension}, $home/.forward frozen_delivered_to = yes hash_queue_depth = 1 hash_queue_names = deferred, defer header_address_token_limit = 10240 header_checks = header_from_format = standard header_size_limit = 102400 helpful_warnings = yes home_mailbox = Maildir/ hopcount_limit = 50 html_directory = no ignore_mx_lookup_error = no import_environment = MAIL_CONFIG MAIL_DEBUG MAIL_LOGTAG TZ XAUTHORITY DISPLAY LANG=C POSTLOG_SERVICE POSTLOG_HOSTNAME in_flow_delay = 1s inet_interfaces = all inet_protocols = ipv4 info_log_address_format = internal initial_destination_concurrency = 5 internal_mail_filter_classes = invalid_hostname_reject_code = 501 ipc_idle = 5s ipc_timeout = 3600s ipc_ttl = 1000s line_length_limit = 2048 lmdb_map_size = 16777216 lmtp_address_preference = any lmtp_address_verify_target = rcpt lmtp_assume_final = no lmtp_balance_inet_protocols = yes lmtp_bind_address = lmtp_bind_address6 = lmtp_body_checks = lmtp_cname_overrides_servername = no lmtp_connect_timeout = 0s lmtp_connection_cache_destinations = lmtp_connection_cache_on_demand = yes lmtp_connection_cache_time_limit = 2s lmtp_connection_reuse_count_limit = 0 lmtp_connection_reuse_time_limit = 300s lmtp_data_done_timeout = 600s lmtp_data_init_timeout = 120s lmtp_data_xfer_timeout = 180s lmtp_defer_if_no_mx_address_found = no lmtp_delivery_slot_cost = $default_delivery_slot_cost lmtp_delivery_slot_discount = $default_delivery_slot_discount lmtp_delivery_slot_loan = $default_delivery_slot_loan lmtp_delivery_status_filter = $default_delivery_status_filter lmtp_destination_concurrency_failed_cohort_limit = $default_destination_concurrency_failed_cohort_limit lmtp_destination_concurrency_limit = $default_destination_concurrency_limit lmtp_destination_concurrency_negative_feedback = $default_destination_concurrency_negative_feedback lmtp_destination_concurrency_positive_feedback = $default_destination_concurrency_positive_feedback lmtp_destination_rate_delay = $default_destination_rate_delay lmtp_destination_recipient_limit = $default_destination_recipient_limit lmtp_discard_lhlo_keyword_address_maps = lmtp_discard_lhlo_keywords = lmtp_dns_reply_filter = lmtp_dns_resolver_options = lmtp_dns_support_level = lmtp_enforce_tls = no lmtp_extra_recipient_limit = $default_extra_recipient_limit lmtp_fallback_relay = lmtp_generic_maps = lmtp_header_checks = lmtp_host_lookup = dns lmtp_initial_destination_concurrency = $initial_destination_concurrency lmtp_lhlo_name = $myhostname lmtp_lhlo_timeout = 300s lmtp_line_length_limit = 998 lmtp_mail_timeout = 300s lmtp_mime_header_checks = lmtp_minimum_delivery_slots = $default_minimum_delivery_slots lmtp_mx_address_limit = 5 lmtp_mx_session_limit = 2 lmtp_nested_header_checks = lmtp_per_record_deadline = no lmtp_pix_workaround_delay_time = 10s lmtp_pix_workaround_maps = lmtp_pix_workaround_threshold_time = 500s lmtp_pix_workarounds = disable_esmtp,delay_dotcrlf lmtp_quit_timeout = 300s lmtp_quote_rfc821_envelope = yes lmtp_randomize_addresses = yes lmtp_rcpt_timeout = 300s lmtp_recipient_limit = $default_recipient_limit lmtp_recipient_refill_delay = $default_recipient_refill_delay lmtp_recipient_refill_limit = $default_recipient_refill_limit lmtp_reply_filter = lmtp_rset_timeout = 20s lmtp_sasl_auth_cache_name = lmtp_sasl_auth_cache_time = 90d lmtp_sasl_auth_enable = no lmtp_sasl_auth_soft_bounce = yes lmtp_sasl_mechanism_filter = lmtp_sasl_password_maps = lmtp_sasl_path = lmtp_sasl_security_options = noplaintext, noanonymous lmtp_sasl_tls_security_options = $lmtp_sasl_security_options lmtp_sasl_tls_verified_security_options = $lmtp_sasl_tls_security_options lmtp_sasl_type = cyrus lmtp_send_dummy_mail_auth = no lmtp_send_xforward_command = no lmtp_sender_dependent_authentication = no lmtp_skip_5xx_greeting = yes lmtp_skip_quit_response = no lmtp_starttls_timeout = 300s lmtp_tcp_port = 24 lmtp_tls_CAfile = lmtp_tls_CApath = lmtp_tls_block_early_mail_reply = no lmtp_tls_cert_file = lmtp_tls_chain_files = lmtp_tls_ciphers = medium lmtp_tls_connection_reuse = no lmtp_tls_dcert_file = lmtp_tls_dkey_file = $lmtp_tls_dcert_file lmtp_tls_eccert_file = lmtp_tls_eckey_file = $lmtp_tls_eccert_file lmtp_tls_enforce_peername = yes lmtp_tls_exclude_ciphers = lmtp_tls_fingerprint_cert_match = lmtp_tls_fingerprint_digest = md5 lmtp_tls_force_insecure_host_tlsa_lookup = no lmtp_tls_key_file = $lmtp_tls_cert_file lmtp_tls_loglevel = 0 lmtp_tls_mandatory_ciphers = medium lmtp_tls_mandatory_exclude_ciphers = lmtp_tls_mandatory_protocols = !SSLv2, !SSLv3 lmtp_tls_note_starttls_offer = no lmtp_tls_per_site = lmtp_tls_policy_maps = lmtp_tls_protocols = !SSLv2, !SSLv3 lmtp_tls_scert_verifydepth = 9 lmtp_tls_secure_cert_match = nexthop lmtp_tls_security_level = lmtp_tls_servername = lmtp_tls_session_cache_database = lmtp_tls_session_cache_timeout = 3600s lmtp_tls_trust_anchor_file = lmtp_tls_verify_cert_match = hostname lmtp_tls_wrappermode = no lmtp_transport_rate_delay = $default_transport_rate_delay lmtp_use_tls = no lmtp_xforward_timeout = 300s local_command_shell = local_delivery_slot_cost = $default_delivery_slot_cost local_delivery_slot_discount = $default_delivery_slot_discount local_delivery_slot_loan = $default_delivery_slot_loan local_delivery_status_filter = $default_delivery_status_filter local_destination_concurrency_failed_cohort_limit = $default_destination_concurrency_failed_cohort_limit local_destination_concurrency_limit = 2 local_destination_concurrency_negative_feedback = $default_destination_concurrency_negative_feedback local_destination_concurrency_positive_feedback = $default_destination_concurrency_positive_feedback local_destination_rate_delay = $default_destination_rate_delay local_destination_recipient_limit = 1 local_extra_recipient_limit = $default_extra_recipient_limit local_header_rewrite_clients = "" local_initial_destination_concurrency = $initial_destination_concurrency local_minimum_delivery_slots = $default_minimum_delivery_slots local_recipient_limit = $default_recipient_limit local_recipient_maps = proxy:unix:passwd.byname $alias_maps local_recipient_refill_delay = $default_recipient_refill_delay local_recipient_refill_limit = $default_recipient_refill_limit local_transport = local:$myhostname local_transport_rate_delay = $default_transport_rate_delay luser_relay = mail_name = Postfix mail_owner = postfix mail_release_date = 20201107 mail_spool_directory = /var/mail mail_version = 3.5.8 mailbox_command = mailbox_command_maps = mailbox_delivery_lock = fcntl, dotlock mailbox_size_limit = 0 mailbox_transport = lmtp:unix:private/dovecot-lmtp mailbox_transport_maps = maillog_file = maillog_file_compressor = gzip maillog_file_prefixes = /var, /dev/stdout maillog_file_rotate_suffix = %Y%m%d-%H%M%S mailq_path = /usr/bin/mailq.postfix manpage_directory = /usr/share/man maps_rbl_domains = maps_rbl_reject_code = 554 masquerade_classes = envelope_sender, header_sender, header_recipient masquerade_domains = masquerade_exceptions = master_service_disable = max_idle = 100s max_use = 100 maximal_backoff_time = 4000s maximal_queue_lifetime = 1d message_drop_headers = bcc, content-length, resent-bcc, return-path message_reject_characters = message_size_limit = 32000000 message_strip_characters = meta_directory = /etc/postfix milter_command_timeout = 30s milter_connect_macros = j {daemon_name} {daemon_addr} v _ milter_connect_timeout = 30s milter_content_timeout = 300s milter_data_macros = i milter_default_action = accept milter_end_of_data_macros = i milter_end_of_header_macros = i milter_header_checks = milter_helo_macros = {tls_version} {cipher} {cipher_bits} {cert_subject} {cert_issuer} milter_macro_daemon_name = $myhostname milter_macro_defaults = milter_macro_v = $mail_name $mail_version milter_mail_macros = i {auth_type} {auth_authen} {auth_author} {mail_addr} {mail_host} {mail_mailer} milter_protocol = 6 milter_rcpt_macros = i {rcpt_addr} {rcpt_host} {rcpt_mailer} milter_unknown_command_macros = mime_boundary_length_limit = 2048 mime_header_checks = $header_checks mime_nesting_limit = 100 minimal_backoff_time = 300s multi_instance_directories = multi_instance_enable = no multi_instance_group = multi_instance_name = multi_instance_wrapper = multi_recipient_bounce_reject_code = 550 mydestination = $myhostname, localhost.$mydomain, localhost, localhost.localdomain mydomain = mydomain.tld myhostname = sub.mydomain.tld mynetworks = 127.0.0.1/32 mynetworks_style = ${{$compatibility_level} < {2} ? {subnet} : {host}} myorigin = $myhostname nested_header_checks = $header_checks newaliases_path = /usr/bin/newaliases.postfix non_fqdn_reject_code = 504 non_smtpd_milters = inet:rspamd.domain.tld:11332 notify_classes = resource, software openssl_path = openssl owner_request_special = yes parent_domain_matches_subdomains = debug_peer_list,fast_flush_domains,mynetworks,permit_mx_backup_networks,qmqpd_authorized_clients,relay_domains,smtpd_access_maps permit_mx_backup_networks = pickup_service_name = pickup pipe_delivery_status_filter = $default_delivery_status_filter plaintext_reject_code = 450 postlog_service_name = postlog postlogd_watchdog_timeout = 10s postmulti_control_commands = reload flush postmulti_start_commands = start postmulti_stop_commands = stop abort drain quick-stop postscreen_access_list = permit_mynetworks postscreen_bare_newline_action = ignore postscreen_bare_newline_enable = no postscreen_bare_newline_ttl = 30d postscreen_blacklist_action = ignore postscreen_cache_cleanup_interval = 12h postscreen_cache_map = btree:$data_directory/postscreen_cache postscreen_cache_retention_time = 7d postscreen_client_connection_count_limit = $smtpd_client_connection_count_limit postscreen_command_count_limit = 20 postscreen_command_filter = postscreen_command_time_limit = ${stress?{10}:{300}}s postscreen_disable_vrfy_command = $disable_vrfy_command postscreen_discard_ehlo_keyword_address_maps = $smtpd_discard_ehlo_keyword_address_maps postscreen_discard_ehlo_keywords = $smtpd_discard_ehlo_keywords postscreen_dnsbl_action = ignore postscreen_dnsbl_max_ttl = ${postscreen_dnsbl_ttl?{$postscreen_dnsbl_ttl}:{1}}h postscreen_dnsbl_min_ttl = 60s postscreen_dnsbl_reply_map = postscreen_dnsbl_sites = postscreen_dnsbl_threshold = 1 postscreen_dnsbl_timeout = 10s postscreen_dnsbl_whitelist_threshold = 0 postscreen_enforce_tls = $smtpd_enforce_tls postscreen_expansion_filter = $smtpd_expansion_filter postscreen_forbidden_commands = $smtpd_forbidden_commands postscreen_greet_action = ignore postscreen_greet_banner = $smtpd_banner postscreen_greet_ttl = 1d postscreen_greet_wait = ${stress?{2}:{6}}s postscreen_helo_required = $smtpd_helo_required postscreen_non_smtp_command_action = drop postscreen_non_smtp_command_enable = no postscreen_non_smtp_command_ttl = 30d postscreen_pipelining_action = enforce postscreen_pipelining_enable = no postscreen_pipelining_ttl = 30d postscreen_post_queue_limit = $default_process_limit postscreen_pre_queue_limit = $default_process_limit postscreen_reject_footer = $smtpd_reject_footer postscreen_reject_footer_maps = $smtpd_reject_footer_maps postscreen_tls_security_level = $smtpd_tls_security_level postscreen_upstream_proxy_protocol = postscreen_upstream_proxy_timeout = 5s postscreen_use_tls = $smtpd_use_tls postscreen_watchdog_timeout = 10s postscreen_whitelist_interfaces = static:all prepend_delivered_header = command, file, forward process_id = 2311500 process_id_directory = pid process_name = postconf propagate_unmatched_extensions = canonical, virtual proxy_interfaces = proxy_read_maps = $local_recipient_maps $mydestination $virtual_alias_maps $virtual_alias_domains $virtual_mailbox_maps $virtual_mailbox_domains $relay_recipient_maps $relay_domains $canonical_maps $sender_canonical_maps $recipient_canonical_maps $relocated_maps $transport_maps $mynetworks $smtpd_sender_login_maps $sender_bcc_maps $recipient_bcc_maps $smtp_generic_maps $lmtp_generic_maps $alias_maps $smtpd_client_restrictions $smtpd_helo_restrictions $smtpd_sender_restrictions $smtpd_relay_restrictions $smtpd_recipient_restrictions $address_verify_sender_dependent_default_transport_maps $address_verify_sender_dependent_relayhost_maps $address_verify_transport_maps $fallback_transport_maps $lmtp_discard_lhlo_keyword_address_maps $lmtp_pix_workaround_maps $lmtp_sasl_password_maps $lmtp_tls_policy_maps $mailbox_command_maps $mailbox_transport_maps $postscreen_discard_ehlo_keyword_address_maps $rbl_reply_maps $sender_dependent_default_transport_maps $sender_dependent_relayhost_maps $smtp_discard_ehlo_keyword_address_maps $smtp_pix_workaround_maps $smtp_sasl_password_maps $smtp_tls_policy_maps $smtpd_discard_ehlo_keyword_address_maps $smtpd_milter_maps $virtual_gid_maps $virtual_uid_maps proxy_write_maps = $smtp_sasl_auth_cache_name $lmtp_sasl_auth_cache_name $address_verify_map $postscreen_cache_map proxymap_service_name = proxymap proxywrite_service_name = proxywrite qmgr_clog_warn_time = 300s qmgr_daemon_timeout = 1000s qmgr_fudge_factor = 100 qmgr_ipc_timeout = 60s qmgr_message_active_limit = 20000 qmgr_message_recipient_limit = 20000 qmgr_message_recipient_minimum = 10 qmqpd_authorized_clients = qmqpd_client_port_logging = no qmqpd_error_delay = 1s qmqpd_timeout = 300s queue_directory = /var/spool/postfix queue_file_attribute_count_limit = 100 queue_minfree = 0 queue_run_delay = 300s queue_service_name = qmgr rbl_reply_maps = readme_directory = /usr/share/doc/postfix/README_FILES receive_override_options = recipient_bcc_maps = recipient_canonical_classes = envelope_recipient, header_recipient recipient_canonical_maps = recipient_delimiter = reject_code = 554 reject_tempfail_action = defer_if_permit relay_clientcerts = relay_delivery_slot_cost = $default_delivery_slot_cost relay_delivery_slot_discount = $default_delivery_slot_discount relay_delivery_slot_loan = $default_delivery_slot_loan relay_destination_concurrency_failed_cohort_limit = $default_destination_concurrency_failed_cohort_limit relay_destination_concurrency_limit = $default_destination_concurrency_limit relay_destination_concurrency_negative_feedback = $default_destination_concurrency_negative_feedback relay_destination_concurrency_positive_feedback = $default_destination_concurrency_positive_feedback relay_destination_rate_delay = $default_destination_rate_delay relay_destination_recipient_limit = $default_destination_recipient_limit relay_domains = ${{$compatibility_level} < {2} ? {$mydestination} : {}} relay_domains_reject_code = 554 relay_extra_recipient_limit = $default_extra_recipient_limit relay_initial_destination_concurrency = $initial_destination_concurrency relay_minimum_delivery_slots = $default_minimum_delivery_slots relay_recipient_limit = $default_recipient_limit relay_recipient_maps = relay_recipient_refill_delay = $default_recipient_refill_delay relay_recipient_refill_limit = $default_recipient_refill_limit relay_transport = relay relay_transport_rate_delay = $default_transport_rate_delay relayhost = relocated_maps = remote_header_rewrite_domain = require_home_directory = no reset_owner_alias = no resolve_dequoted_address = yes resolve_null_domain = no resolve_numeric_domain = no retry_delivery_slot_cost = $default_delivery_slot_cost retry_delivery_slot_discount = $default_delivery_slot_discount retry_delivery_slot_loan = $default_delivery_slot_loan retry_destination_concurrency_failed_cohort_limit = $default_destination_concurrency_failed_cohort_limit retry_destination_concurrency_limit = $default_destination_concurrency_limit retry_destination_concurrency_negative_feedback = $default_destination_concurrency_negative_feedback retry_destination_concurrency_positive_feedback = $default_destination_concurrency_positive_feedback retry_destination_rate_delay = $default_destination_rate_delay retry_destination_recipient_limit = $default_destination_recipient_limit retry_extra_recipient_limit = $default_extra_recipient_limit retry_initial_destination_concurrency = $initial_destination_concurrency retry_minimum_delivery_slots = $default_minimum_delivery_slots retry_recipient_limit = $default_recipient_limit retry_recipient_refill_delay = $default_recipient_refill_delay retry_recipient_refill_limit = $default_recipient_refill_limit retry_transport_rate_delay = $default_transport_rate_delay rewrite_service_name = rewrite rhel_ipv6_normalize = no sample_directory = /usr/share/doc/postfix/samples send_cyrus_sasl_authzid = no sender_bcc_maps = hash:/etc/postfix/bcc sender_canonical_classes = envelope_sender, header_sender sender_canonical_maps = sender_dependent_default_transport_maps = hash:/etc/postfix/dependent sender_dependent_relayhost_maps = sendmail_fix_line_endings = always sendmail_path = /usr/sbin/sendmail.postfix service_name = service_throttle_time = 60s setgid_group = postdrop shlib_directory = /usr/lib64/postfix show_user_unknown_table_name = yes showq_service_name = showq smtp_address_preference = any smtp_address_verify_target = rcpt smtp_always_send_ehlo = yes smtp_balance_inet_protocols = yes smtp_bind_address = smtp_bind_address6 = smtp_body_checks = smtp_cname_overrides_servername = no smtp_connect_timeout = 30s smtp_connection_cache_destinations = smtp_connection_cache_on_demand = yes smtp_connection_cache_time_limit = 2s smtp_connection_reuse_count_limit = 0 smtp_connection_reuse_time_limit = 300s smtp_data_done_timeout = 600s smtp_data_init_timeout = 120s smtp_data_xfer_timeout = 180s smtp_defer_if_no_mx_address_found = no smtp_delivery_slot_cost = $default_delivery_slot_cost smtp_delivery_slot_discount = $default_delivery_slot_discount smtp_delivery_slot_loan = $default_delivery_slot_loan smtp_delivery_status_filter = $default_delivery_status_filter smtp_destination_concurrency_failed_cohort_limit = $default_destination_concurrency_failed_cohort_limit smtp_destination_concurrency_limit = $default_destination_concurrency_limit smtp_destination_concurrency_negative_feedback = $default_destination_concurrency_negative_feedback smtp_destination_concurrency_positive_feedback = $default_destination_concurrency_positive_feedback smtp_destination_rate_delay = $default_destination_rate_delay smtp_destination_recipient_limit = $default_destination_recipient_limit smtp_discard_ehlo_keyword_address_maps = smtp_discard_ehlo_keywords = smtp_dns_reply_filter = smtp_dns_resolver_options = smtp_dns_support_level = smtp_enforce_tls = no smtp_extra_recipient_limit = $default_extra_recipient_limit smtp_fallback_relay = $fallback_relay smtp_generic_maps = smtp_header_checks = smtp_helo_name = $myhostname smtp_helo_timeout = 300s smtp_host_lookup = dns smtp_initial_destination_concurrency = $initial_destination_concurrency smtp_line_length_limit = 998 smtp_mail_timeout = 300s smtp_mime_header_checks = smtp_minimum_delivery_slots = $default_minimum_delivery_slots smtp_mx_address_limit = 5 smtp_mx_session_limit = 2 smtp_nested_header_checks = smtp_never_send_ehlo = no smtp_per_record_deadline = no smtp_pix_workaround_delay_time = 10s smtp_pix_workaround_maps = smtp_pix_workaround_threshold_time = 500s smtp_pix_workarounds = disable_esmtp,delay_dotcrlf smtp_quit_timeout = 300s smtp_quote_rfc821_envelope = yes smtp_randomize_addresses = yes smtp_rcpt_timeout = 300s smtp_recipient_limit = $default_recipient_limit smtp_recipient_refill_delay = $default_recipient_refill_delay smtp_recipient_refill_limit = $default_recipient_refill_limit smtp_reply_filter = smtp_rset_timeout = 20s smtp_sasl_auth_cache_name = smtp_sasl_auth_cache_time = 90d smtp_sasl_auth_enable = no smtp_sasl_auth_soft_bounce = yes smtp_sasl_mechanism_filter = smtp_sasl_password_maps = smtp_sasl_path = smtp_sasl_security_options = noplaintext, noanonymous smtp_sasl_tls_security_options = $smtp_sasl_security_options smtp_sasl_tls_verified_security_options = $smtp_sasl_tls_security_options smtp_sasl_type = cyrus smtp_send_dummy_mail_auth = no smtp_send_xforward_command = no smtp_sender_dependent_authentication = no smtp_skip_5xx_greeting = yes smtp_skip_quit_response = yes smtp_starttls_timeout = 300s smtp_tcp_port = smtp smtp_tls_CAfile = /etc/pki/tls/certs/ca-bundle.crt smtp_tls_CApath = /etc/pki/tls/certs smtp_tls_block_early_mail_reply = no smtp_tls_cert_file = smtp_tls_chain_files = smtp_tls_ciphers = medium smtp_tls_connection_reuse = no smtp_tls_dane_insecure_mx_policy = dane smtp_tls_dcert_file = smtp_tls_dkey_file = $smtp_tls_dcert_file smtp_tls_eccert_file = smtp_tls_eckey_file = $smtp_tls_eccert_file smtp_tls_enforce_peername = yes smtp_tls_exclude_ciphers = RC4, aNULL, EXPORT, LOW, MEDIUM smtp_tls_fingerprint_cert_match = smtp_tls_fingerprint_digest = md5 smtp_tls_force_insecure_host_tlsa_lookup = no smtp_tls_key_file = $smtp_tls_cert_file smtp_tls_loglevel = 0 smtp_tls_mandatory_ciphers = medium smtp_tls_mandatory_exclude_ciphers = smtp_tls_mandatory_protocols = !SSLv2,!SSLv3 smtp_tls_note_starttls_offer = no smtp_tls_per_site = smtp_tls_policy_maps = smtp_tls_protocols = !SSLv2,!SSLv3 smtp_tls_scert_verifydepth = 9 smtp_tls_secure_cert_match = nexthop, dot-nexthop smtp_tls_security_level = may smtp_tls_servername = smtp_tls_session_cache_database = smtp_tls_session_cache_timeout = 3600s smtp_tls_trust_anchor_file = smtp_tls_verify_cert_match = hostname smtp_tls_wrappermode = no smtp_transport_rate_delay = $default_transport_rate_delay smtp_use_tls = no smtp_xforward_timeout = 300s smtpd_authorized_verp_clients = $authorized_verp_clients smtpd_authorized_xclient_hosts = smtpd_authorized_xforward_hosts = smtpd_banner = $myhostname ESMTP $mail_name smtpd_client_auth_rate_limit = 0 smtpd_client_connection_count_limit = 10 smtpd_client_connection_rate_limit = 60 smtpd_client_event_limit_exceptions = ${smtpd_client_connection_limit_exceptions:$mynetworks} smtpd_client_message_rate_limit = 0 smtpd_client_new_tls_session_rate_limit = 0 smtpd_client_port_logging = no smtpd_client_recipient_rate_limit = 0 smtpd_client_restrictions = smtpd_command_filter = smtpd_data_restrictions = smtpd_delay_open_until_valid_rcpt = yes smtpd_delay_reject = yes smtpd_discard_ehlo_keyword_address_maps = smtpd_discard_ehlo_keywords = chunking smtpd_dns_reply_filter = smtpd_end_of_data_restrictions = smtpd_enforce_tls = no smtpd_error_sleep_time = 1s smtpd_etrn_restrictions = smtpd_expansion_filter = \t\40!"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~ smtpd_forbidden_commands = CONNECT GET POST smtpd_hard_error_limit = ${stress?{1}:{20}} smtpd_helo_required = no smtpd_helo_restrictions = smtpd_history_flush_threshold = 100 smtpd_junk_command_limit = ${stress?{1}:{100}} smtpd_log_access_permit_actions = smtpd_milter_maps = smtpd_milters = inet:rspamd.domain.tld:11332 smtpd_noop_commands = smtpd_null_access_lookup_key = <> smtpd_peername_lookup = yes smtpd_per_record_deadline = ${stress?{yes}:{no}} smtpd_policy_service_default_action = 451 4.3.5 Server configuration problem smtpd_policy_service_max_idle = 300s smtpd_policy_service_max_ttl = 1000s smtpd_policy_service_policy_context = smtpd_policy_service_request_limit = 0 smtpd_policy_service_retry_delay = 1s smtpd_policy_service_timeout = 100s smtpd_policy_service_try_limit = 2 smtpd_proxy_ehlo = $myhostname smtpd_proxy_filter = smtpd_proxy_options = smtpd_proxy_timeout = 100s smtpd_recipient_limit = 1000 smtpd_recipient_overshoot_limit = 1000 smtpd_recipient_restrictions = permit_sasl_authenticated, reject_unauth_destination, reject_invalid_hostname, reject_unauth_pipelining, reject_non_fqdn_sender, reject_unknown_sender_domain, reject_non_fqdn_recipient, reject_unknown_recipient_domain, reject_rbl_client zen.spamhaus.org, reject_rhsbl_client dbl.spamhaus.org smtpd_reject_footer = smtpd_reject_footer_maps = smtpd_reject_unlisted_recipient = yes smtpd_reject_unlisted_sender = yes smtpd_relay_restrictions = ${{$compatibility_level} < {1} ? {} : {permit_mynetworks, permit_sasl_authenticated, defer_unauth_destination}} smtpd_restriction_classes = smtpd_sasl_auth_enable = yes smtpd_sasl_authenticated_header = no smtpd_sasl_exceptions_networks = smtpd_sasl_local_domain = smtpd_sasl_path = smtpd smtpd_sasl_response_limit = 12288 smtpd_sasl_security_options = noanonymous smtpd_sasl_service = smtp smtpd_sasl_tls_security_options = $smtpd_sasl_security_options smtpd_sasl_type = cyrus smtpd_sender_login_maps = unionmap:{regexp:/etc/postfix/login_maps.pcre hash:/etc/postfix/virtual} smtpd_sender_restrictions = smtpd_service_name = smtpd smtpd_soft_error_limit = 10 smtpd_starttls_timeout = ${stress?{10}:{300}}s smtpd_timeout = ${stress?{10}:{300}}s smtpd_tls_CAfile = /etc/postfix/postfix.ca.pem smtpd_tls_CApath = smtpd_tls_always_issue_session_ids = yes smtpd_tls_ask_ccert = no smtpd_tls_auth_only = no smtpd_tls_ccert_verifydepth = 9 smtpd_tls_cert_file = smtpd_tls_chain_files = /etc/pki/tls/private/postfix.key,/etc/pki/tls/certs/postfix.pem smtpd_tls_ciphers = medium smtpd_tls_dcert_file = smtpd_tls_dh1024_param_file = smtpd_tls_dh512_param_file = smtpd_tls_dkey_file = $smtpd_tls_dcert_file smtpd_tls_eccert_file = smtpd_tls_eckey_file = $smtpd_tls_eccert_file smtpd_tls_eecdh_grade = auto smtpd_tls_exclude_ciphers = RC4, aNULL, EXPORT, LOW, MEDIUM smtpd_tls_fingerprint_digest = md5 smtpd_tls_key_file = $smtpd_tls_cert_file smtpd_tls_loglevel = 0 smtpd_tls_mandatory_ciphers = high smtpd_tls_mandatory_exclude_ciphers = smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3 smtpd_tls_protocols = !SSLv2,!SSLv3 smtpd_tls_received_header = no smtpd_tls_req_ccert = no smtpd_tls_security_level = may smtpd_tls_session_cache_database = smtpd_tls_session_cache_timeout = 3600s smtpd_tls_wrappermode = no smtpd_upstream_proxy_protocol = smtpd_upstream_proxy_timeout = 5s smtpd_use_tls = yes smtputf8_autodetect_classes = sendmail, verify smtputf8_enable = ${{$compatibility_level} < {1} ? {no} : {yes}} soft_bounce = no stale_lock_time = 500s stress = strict_7bit_headers = no strict_8bitmime = no strict_8bitmime_body = no strict_mailbox_ownership = yes strict_mime_encoding_domain = no strict_rfc821_envelopes = no strict_smtputf8 = no sun_mailtool_compatibility = no swap_bangpath = yes syslog_facility = mail syslog_name = ${multi_instance_name?{$multi_instance_name}:{postfix}} tcp_windowsize = 0 tls_append_default_CA = no tls_daemon_random_bytes = 32 tls_dane_digests = sha512 sha256 tls_disable_workarounds = tls_eecdh_auto_curves = X25519 X448 prime256v1 secp521r1 secp384r1 tls_eecdh_strong_curve = prime256v1 tls_eecdh_ultra_curve = secp384r1 tls_export_cipherlist = aNULL:-aNULL:HIGH:MEDIUM:LOW:EXPORT:+RC4:@STRENGTH tls_fast_shutdown_enable = yes tls_high_cipherlist = aNULL:-aNULL:HIGH:@STRENGTH tls_legacy_public_key_fingerprints = no tls_low_cipherlist = aNULL:-aNULL:HIGH:MEDIUM:LOW:+RC4:@STRENGTH tls_medium_cipherlist = aNULL:-aNULL:HIGH:MEDIUM:+RC4:@STRENGTH tls_null_cipherlist = eNULL:!aNULL tls_preempt_cipherlist = no tls_random_bytes = 32 tls_random_exchange_name = ${data_directory}/prng_exch tls_random_prng_update_period = 3600s tls_random_reseed_period = 3600s tls_random_source = dev:/dev/urandom tls_server_sni_maps = hash:/etc/postfix/vmail_ssl tls_session_ticket_cipher = aes-256-cbc tls_ssl_options = tls_wildcard_matches_multiple_labels = yes tlsmgr_service_name = tlsmgr tlsproxy_client_CAfile = $smtp_tls_CAfile tlsproxy_client_CApath = $smtp_tls_CApath tlsproxy_client_cert_file = $smtp_tls_cert_file tlsproxy_client_chain_files = $smtp_tls_chain_files tlsproxy_client_dcert_file = $smtp_tls_dcert_file tlsproxy_client_dkey_file = $smtp_tls_dkey_file tlsproxy_client_eccert_file = $smtp_tls_eccert_file tlsproxy_client_eckey_file = $smtp_tls_eckey_file tlsproxy_client_enforce_tls = $smtp_enforce_tls tlsproxy_client_fingerprint_digest = $smtp_tls_fingerprint_digest tlsproxy_client_key_file = $smtp_tls_key_file tlsproxy_client_level = $smtp_tls_security_level tlsproxy_client_loglevel = $smtp_tls_loglevel tlsproxy_client_loglevel_parameter = smtp_tls_loglevel tlsproxy_client_per_site = $smtp_tls_per_site tlsproxy_client_policy = $smtp_tls_policy_maps tlsproxy_client_scert_verifydepth = $smtp_tls_scert_verifydepth tlsproxy_client_use_tls = $smtp_use_tls tlsproxy_enforce_tls = $smtpd_enforce_tls tlsproxy_service_name = tlsproxy tlsproxy_tls_CAfile = $smtpd_tls_CAfile tlsproxy_tls_CApath = $smtpd_tls_CApath tlsproxy_tls_always_issue_session_ids = $smtpd_tls_always_issue_session_ids tlsproxy_tls_ask_ccert = $smtpd_tls_ask_ccert tlsproxy_tls_ccert_verifydepth = $smtpd_tls_ccert_verifydepth tlsproxy_tls_cert_file = $smtpd_tls_cert_file tlsproxy_tls_chain_files = $smtpd_tls_chain_files tlsproxy_tls_ciphers = $smtpd_tls_ciphers tlsproxy_tls_dcert_file = $smtpd_tls_dcert_file tlsproxy_tls_dh1024_param_file = $smtpd_tls_dh1024_param_file tlsproxy_tls_dh512_param_file = $smtpd_tls_dh512_param_file tlsproxy_tls_dkey_file = $smtpd_tls_dkey_file tlsproxy_tls_eccert_file = $smtpd_tls_eccert_file tlsproxy_tls_eckey_file = $smtpd_tls_eckey_file tlsproxy_tls_eecdh_grade = $smtpd_tls_eecdh_grade tlsproxy_tls_exclude_ciphers = $smtpd_tls_exclude_ciphers tlsproxy_tls_fingerprint_digest = $smtpd_tls_fingerprint_digest tlsproxy_tls_key_file = $smtpd_tls_key_file tlsproxy_tls_loglevel = $smtpd_tls_loglevel tlsproxy_tls_mandatory_ciphers = $smtpd_tls_mandatory_ciphers tlsproxy_tls_mandatory_exclude_ciphers = $smtpd_tls_mandatory_exclude_ciphers tlsproxy_tls_mandatory_protocols = $smtpd_tls_mandatory_protocols tlsproxy_tls_protocols = $smtpd_tls_protocols tlsproxy_tls_req_ccert = $smtpd_tls_req_ccert tlsproxy_tls_security_level = $smtpd_tls_security_level tlsproxy_use_tls = $smtpd_use_tls tlsproxy_watchdog_timeout = 10s trace_service_name = trace transport_maps = transport_retry_time = 60s trigger_timeout = 10s undisclosed_recipients_header = unknown_address_reject_code = 450 unknown_address_tempfail_action = $reject_tempfail_action unknown_client_reject_code = 450 unknown_helo_hostname_tempfail_action = $reject_tempfail_action unknown_hostname_reject_code = 450 unknown_local_recipient_reject_code = 550 unknown_relay_recipient_reject_code = 550 unknown_virtual_alias_reject_code = 550 unknown_virtual_mailbox_reject_code = 550 unverified_recipient_defer_code = 450 unverified_recipient_reject_code = 450 unverified_recipient_reject_reason = unverified_recipient_tempfail_action = $reject_tempfail_action unverified_sender_defer_code = 450 unverified_sender_reject_code = 450 unverified_sender_reject_reason = unverified_sender_tempfail_action = $reject_tempfail_action verp_delimiter_filter = -=+ virtual_alias_address_length_limit = 1000 virtual_alias_domains = $virtual_alias_maps virtual_alias_expansion_limit = 1000 virtual_alias_maps = hash:/etc/postfix/virtual virtual_alias_recursion_limit = 1000 virtual_delivery_slot_cost = $default_delivery_slot_cost virtual_delivery_slot_discount = $default_delivery_slot_discount virtual_delivery_slot_loan = $default_delivery_slot_loan virtual_delivery_status_filter = $default_delivery_status_filter virtual_destination_concurrency_failed_cohort_limit = $default_destination_concurrency_failed_cohort_limit virtual_destination_concurrency_limit = $default_destination_concurrency_limit virtual_destination_concurrency_negative_feedback = $default_destination_concurrency_negative_feedback virtual_destination_concurrency_positive_feedback = $default_destination_concurrency_positive_feedback virtual_destination_rate_delay = $default_destination_rate_delay virtual_destination_recipient_limit = $default_destination_recipient_limit virtual_extra_recipient_limit = $default_extra_recipient_limit virtual_gid_maps = virtual_initial_destination_concurrency = $initial_destination_concurrency virtual_mailbox_base = virtual_mailbox_domains = $virtual_mailbox_maps virtual_mailbox_limit = 51200000 virtual_mailbox_lock = fcntl, dotlock virtual_mailbox_maps = virtual_minimum_delivery_slots = $default_minimum_delivery_slots virtual_minimum_uid = 100 virtual_recipient_limit = $default_recipient_limit virtual_recipient_refill_delay = $default_recipient_refill_delay virtual_recipient_refill_limit = $default_recipient_refill_limit virtual_transport = virtual virtual_transport_rate_delay = $default_transport_rate_delay virtual_uid_maps = ############################# dovecot config: ############################# doveconf # 2.3.16 (7e2e900c1a): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.16 (09c29328) # OS: Linux 4.18.0-425.3.1.el8.x86_64 x86_64 Rocky Linux release 8.7 (Green Obsidian) # Hostname: m13.domain.tld # NOTE: Send doveconf -n output instead when asking for help. auth_anonymous_username = anonymous auth_cache_negative_ttl = 1 hours auth_cache_size = 0 auth_cache_ttl = 1 hours auth_cache_verify_password_with_worker = no auth_debug = no auth_debug_passwords = no auth_default_realm = auth_failure_delay = 2 secs auth_gssapi_hostname = auth_krb5_keytab = auth_master_user_separator = auth_mechanisms = plain login auth_policy_check_after_auth = yes auth_policy_check_before_auth = yes auth_policy_hash_mech = sha256 auth_policy_hash_nonce = auth_policy_hash_truncate = 12 auth_policy_log_only = no auth_policy_reject_on_fail = no auth_policy_report_after_auth = yes auth_policy_request_attributes = login=%{requested_username} pwhash=%{hashed_password} remote=%{rip} device_id=%{client_id} protocol=%s session_id=%{session} auth_policy_server_api_header = auth_policy_server_timeout_msecs = 2000 auth_policy_server_url = auth_proxy_self = auth_realms = auth_socket_path = auth-userdb auth_ssl_require_client_cert = no auth_ssl_username_from_cert = no auth_stats = no auth_use_winbind = no auth_username_chars = abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ01234567890.-_@ auth_username_format = %Lu auth_username_translation = auth_verbose = no auth_verbose_passwords = no auth_winbind_helper_path = /usr/bin/ntlm_auth auth_worker_max_count = 30 base_dir = /run/dovecot config_cache_size = 1 M debug_log_path = default_client_limit = 1000 default_idle_kill = 1 mins default_internal_group = dovecot default_internal_user = dovecot default_login_user = dovenull default_process_limit = 100 default_vsz_limit = 256 M deliver_log_format = msgid=%m: %$ dict_db_config = director_flush_socket = director_mail_servers = director_max_parallel_kicks = 100 director_max_parallel_moves = 100 director_output_buffer_size = 10 M director_ping_idle_timeout = 30 secs director_ping_max_timeout = 1 mins director_servers = director_user_expire = 15 mins director_user_kick_delay = 2 secs director_username_hash = %u disable_plaintext_auth = no dotlock_use_excl = yes doveadm_allowed_commands = doveadm_api_key = doveadm_http_rawlog_dir = doveadm_password = doveadm_port = 0 doveadm_socket_path = doveadm-server doveadm_ssl = no doveadm_username = doveadm doveadm_worker_count = 0 dsync_alt_char = _ dsync_commit_msgs_interval = 100 dsync_features = dsync_hashed_headers = Date Message-ID dsync_remote_cmd = ssh -l%{login} %{host} doveadm dsync-server -u%u -U first_valid_gid = 1 first_valid_uid = 1000 haproxy_timeout = 3 secs haproxy_trusted_networks = hostname = imap_capability = imap_client_workarounds = imap_fetch_failure = disconnect-immediately imap_hibernate_timeout = 0 imap_id_log = imap_id_retain = no imap_id_send = name * imap_idle_notify_interval = 2 mins imap_literal_minus = no imap_logout_format = in=%i out=%o deleted=%{deleted} expunged=%{expunged} trashed=%{trashed} hdr_count=%{fetch_hdr_count} hdr_bytes=%{fetch_hdr_bytes} body_count=%{fetch_body_count} body_bytes=%{fetch_body_bytes} imap_max_line_length = 64 k imap_metadata = no imap_urlauth_host = imap_urlauth_logout_format = in=%i out=%o imap_urlauth_port = 143 imapc_cmd_timeout = 5 mins imapc_connection_retry_count = 1 imapc_connection_retry_interval = 1 secs imapc_features = imapc_host = imapc_list_prefix = imapc_master_user = imapc_max_idle_time = 29 mins imapc_max_line_length = 0 imapc_password = imapc_port = 143 imapc_rawlog_dir = imapc_sasl_mechanisms = imapc_ssl = no imapc_ssl_verify = yes imapc_user = import_environment = TZ CORE_OUTOFMEM CORE_ERROR info_log_path = instance_name = dovecot last_valid_gid = 0 last_valid_uid = 0 lda_mailbox_autocreate = no lda_mailbox_autosubscribe = no lda_original_recipient_header = libexec_dir = /usr/libexec/dovecot listen = *, :: lmtp_add_received_header = yes lmtp_client_workarounds = lmtp_hdr_delivery_address = final lmtp_proxy = no lmtp_proxy_rawlog_dir = lmtp_rawlog_dir = lmtp_rcpt_check_quota = no lmtp_save_to_detail_mailbox = no lmtp_user_concurrency_limit = 0 lock_method = fcntl log_core_filter = log_debug = log_path = syslog log_timestamp = "%b %d %H:%M:%S " login_access_sockets = login_greeting = Dovecot ready. login_log_format = %$: %s login_log_format_elements = user=<%u> method=%m rip=%r lip=%l mpid=%e %c session=<%{session}> login_plugin_dir = /usr/lib64/dovecot/login login_plugins = login_proxy_max_disconnect_delay = 0 login_proxy_max_reconnects = 3 login_proxy_notify_path = proxy-notify login_proxy_timeout = 30 secs login_source_ips = login_trusted_networks = mail_access_groups = mail_always_cache_fields = mail_attachment_detection_options = mail_attachment_dir = mail_attachment_fs = sis posix mail_attachment_hash = %{sha1} mail_attachment_min_size = 128 k mail_attribute_dict = mail_cache_fields = flags mail_cache_min_mail_count = 0 mail_chroot = mail_debug = no mail_fsync = optimized mail_full_filesystem_access = no mail_gid = mail_home = mail_location = maildir:~/Maildir:INDEX=/var/lib/dovecot-virtualmin/index/%u:CONTROL=/var/lib/dovecot-virtualmin/control/%u mail_log_prefix = "%s(%u)<%{pid}><%{session}>: " mail_max_keyword_length = 50 mail_max_lock_timeout = 0 mail_max_userip_connections = 10 mail_never_cache_fields = imap.envelope mail_nfs_index = no mail_nfs_storage = no mail_plugin_dir = /usr/lib64/dovecot mail_plugins = mail_prefetch_count = 0 mail_privileged_group = mail_save_crlf = no mail_server_admin = mail_server_comment = mail_shared_explicit_inbox = no mail_sort_max_read_count = 0 mail_temp_dir = /tmp mail_temp_scan_interval = 1 weeks mail_uid = mail_vsize_bg_after_count = 0 mailbox_idle_check_interval = 30 secs mailbox_list_index = yes mailbox_list_index_include_inbox = no mailbox_list_index_very_dirty_syncs = no maildir_broken_filename_sizes = no maildir_copy_with_hardlinks = yes maildir_empty_new = no maildir_stat_dirs = no maildir_very_dirty_syncs = no managesieve_client_workarounds = managesieve_implementation_string = Dovecot Pigeonhole managesieve_logout_format = bytes=%i/%o managesieve_max_compile_errors = 5 managesieve_max_line_length = 64 k managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext vacation-seconds imapsieve vnd.dovecot.imapsieve master_user_separator = mbox_dirty_syncs = yes mbox_dotlock_change_timeout = 2 mins mbox_lazy_writes = yes mbox_lock_timeout = 5 mins mbox_md5 = apop3d mbox_min_index_size = 0 mbox_read_locks = fcntl mbox_very_dirty_syncs = no mbox_write_locks = fcntl mdbox_preallocate_space = no mdbox_rotate_interval = 0 mdbox_rotate_size = 10 M mmap_disable = no namespace inbox { disabled = no hidden = no ignore_on_failure = no inbox = yes list = yes location = mailbox Drafts { auto = subscribe autoexpunge = 0 autoexpunge_max_mails = 0 comment = driver = special_use = \Drafts } mailbox Junk { auto = subscribe autoexpunge = 0 autoexpunge_max_mails = 0 comment = driver = special_use = \Junk } mailbox Sent { auto = subscribe autoexpunge = 0 autoexpunge_max_mails = 0 comment = driver = special_use = \Sent } mailbox "Sent Messages" { auto = no autoexpunge = 0 autoexpunge_max_mails = 0 comment = driver = special_use = \Sent } mailbox Trash { auto = subscribe autoexpunge = 0 autoexpunge_max_mails = 0 comment = driver = special_use = \Trash } mailbox spam { auto = subscribe autoexpunge = 0 autoexpunge_max_mails = 0 comment = driver = special_use = \Junk } order = 0 prefix = separator = subscriptions = yes type = private } old_stats_carbon_interval = 30 secs old_stats_carbon_name = old_stats_carbon_server = old_stats_command_min_time = 1 mins old_stats_domain_min_time = 12 hours old_stats_ip_min_time = 12 hours old_stats_memory_limit = 16 M old_stats_session_min_time = 15 mins old_stats_user_min_time = 1 hours passdb { args = auth_verbose = default default_fields = deny = no driver = pam master = no mechanisms = name = override_fields = pass = no result_failure = continue result_internalfail = continue result_success = return-ok skip = never username_filter = } plugin { imapsieve_mailbox1_before = file:/var/lib/dovecot/sieve/learn-spam.sieve imapsieve_mailbox1_causes = COPY APPEND FLAG imapsieve_mailbox1_name = spam imapsieve_mailbox2_before = file:/var/lib/dovecot/sieve/learn-ham.sieve imapsieve_mailbox2_causes = COPY imapsieve_mailbox2_from = spam imapsieve_mailbox2_name = * imapsieve_mailbox3_before = file:/var/lib/dovecot/sieve/learn-spam.sieve imapsieve_mailbox3_causes = COPY APPEND FLAG imapsieve_mailbox3_name = Junk imapsieve_mailbox4_before = file:/var/lib/dovecot/sieve/learn-ham.sieve imapsieve_mailbox4_causes = COPY imapsieve_mailbox4_from = Junk imapsieve_mailbox4_name = * quota = fs:user userquota quota_grace = 100M quota_warning = storage=95%% quota-warning 95 %n %d quota_warning2 = storage=90%% quota-warning 90 %n %d quota_warning3 = storage=80%% quota-warning 80 %n %d sieve = file:~/sieve;active=~/.dovecot.sieve sieve_before = /var/lib/dovecot/sieve/before-global.sieve sieve_extensions = +vacation-seconds sieve_global_extensions = +vnd.dovecot.pipe +vnd.dovecot.environment +vnd.dovecot.debug sieve_pipe_bin_dir = /var/lib/dovecot/sieve sieve_plugins = sieve_extprograms sieve_imapsieve sieve_vacation_default_period = 10d sieve_vacation_max_period = 30d sieve_vacation_min_period = 1h } pop3_client_workarounds = pop3_delete_type = default pop3_deleted_flag = pop3_enable_last = no pop3_fast_size_lookups = no pop3_lock_session = no pop3_logout_format = top=%t/%p, retr=%r/%b, del=%d/%m, size=%s pop3_no_flag_updates = no pop3_reuse_xuidl = no pop3_save_uidl = no pop3_uidl_duplicates = allow pop3_uidl_format = %08Xu%08Xv pop3c_features = pop3c_host = pop3c_master_user = pop3c_password = pop3c_port = 110 pop3c_quick_received_date = no pop3c_rawlog_dir = pop3c_ssl = no pop3c_ssl_verify = yes pop3c_user = %u postmaster_address = postmaster@%{if;%d;ne;;%d;%{hostname}} protocols = imap pop3 lmtp sieve quota_full_tempfail = no rawlog_dir = recipient_delimiter = + rejection_reason = Your message to <%t> was automatically rejected:%n%r rejection_subject = Rejected: %s replication_dsync_parameters = -d -N -l 30 -U replication_full_sync_interval = 1 days replication_max_conns = 10 replicator_host = replicator replicator_port = 0 sendmail_path = /usr/sbin/sendmail service aggregator { chroot = . client_limit = 0 drop_priv_before_exec = no executable = aggregator extra_groups = fifo_listener replication-notify-fifo { group = mode = 0600 user = } group = idle_kill = 0 privileged_group = process_limit = 0 process_min_avail = 0 protocol = service_count = 0 type = unix_listener replication-notify { group = mode = 0600 user = } user = $default_internal_user vsz_limit = 18446744073709551615 B } service anvil { chroot = empty client_limit = 0 drop_priv_before_exec = no executable = anvil extra_groups = group = idle_kill = 4294967295 secs privileged_group = process_limit = 1 process_min_avail = 1 protocol = service_count = 0 type = anvil unix_listener anvil-auth-penalty { group = mode = 0600 user = } unix_listener anvil { group = mode = 0600 user = } user = $default_internal_user vsz_limit = 18446744073709551615 B } service auth-worker { chroot = client_limit = 1 drop_priv_before_exec = no executable = auth -w extra_groups = group = idle_kill = 0 privileged_group = process_limit = 0 process_min_avail = 0 protocol = service_count = 0 type = worker unix_listener auth-worker { group = mode = 0600 user = $default_internal_user } user = vsz_limit = 18446744073709551615 B } service auth { chroot = client_limit = 0 drop_priv_before_exec = no executable = auth extra_groups = group = idle_kill = 0 privileged_group = process_limit = 1 process_min_avail = 0 protocol = service_count = 0 type = unix_listener auth-client { group = mode = 0600 user = $default_internal_user } unix_listener auth-login { group = mode = 0600 user = $default_internal_user } unix_listener auth-master { group = mode = 0600 user = } unix_listener auth-userdb { group = mode = 0666 user = $default_internal_user } unix_listener login/login { group = mode = 0666 user = } unix_listener token-login/tokenlogin { group = mode = 0666 user = } user = $default_internal_user vsz_limit = 18446744073709551615 B } service config { chroot = client_limit = 0 drop_priv_before_exec = no executable = config extra_groups = group = idle_kill = 4294967295 secs privileged_group = process_limit = 0 process_min_avail = 0 protocol = service_count = 0 type = config unix_listener config { group = mode = 0600 user = } user = vsz_limit = 18446744073709551615 B } service dict-async { chroot = client_limit = 0 drop_priv_before_exec = no executable = dict extra_groups = group = idle_kill = 0 privileged_group = process_limit = 0 process_min_avail = 0 protocol = service_count = 0 type = unix_listener dict-async { group = $default_internal_group mode = 0660 user = } user = $default_internal_user vsz_limit = 18446744073709551615 B } service dict { chroot = client_limit = 1 drop_priv_before_exec = no executable = dict extra_groups = group = idle_kill = 0 privileged_group = process_limit = 0 process_min_avail = 0 protocol = service_count = 0 type = unix_listener dict { group = $default_internal_group mode = 0660 user = } user = $default_internal_user vsz_limit = 18446744073709551615 B } service director { chroot = . client_limit = 0 drop_priv_before_exec = no executable = director extra_groups = fifo_listener login/proxy-notify { group = mode = 00 user = } group = idle_kill = 4294967295 secs inet_listener { address = haproxy = no port = 0 reuse_port = no ssl = no } privileged_group = process_limit = 1 process_min_avail = 0 protocol = service_count = 0 type = unix_listener director-admin { group = mode = 0600 user = } unix_listener director-userdb { group = mode = 0600 user = } unix_listener login/director { group = mode = 00 user = } user = $default_internal_user vsz_limit = 18446744073709551615 B } service dns-client { chroot = client_limit = 1 drop_priv_before_exec = no executable = dns-client extra_groups = group = idle_kill = 0 privileged_group = process_limit = 0 process_min_avail = 0 protocol = service_count = 0 type = unix_listener dns-client { group = mode = 0666 user = } unix_listener login/dns-client { group = mode = 0666 user = } user = $default_internal_user vsz_limit = 18446744073709551615 B } service doveadm { chroot = client_limit = 1 drop_priv_before_exec = no executable = doveadm-server extra_groups = $default_internal_group group = idle_kill = 0 privileged_group = process_limit = 0 process_min_avail = 0 protocol = service_count = 1 type = unix_listener doveadm-server { group = mode = 0600 user = } user = vsz_limit = 18446744073709551615 B } service health-check { chroot = client_limit = 1 drop_priv_before_exec = yes executable = script -p health-check.sh extra_groups = group = idle_kill = 0 privileged_group = process_limit = 0 process_min_avail = 0 protocol = service_count = 0 type = user = $default_internal_user vsz_limit = 18446744073709551615 B } service imap-hibernate { chroot = client_limit = 0 drop_priv_before_exec = no executable = imap-hibernate extra_groups = group = idle_kill = 0 privileged_group = process_limit = 0 process_min_avail = 0 protocol = imap service_count = 0 type = unix_listener imap-hibernate { group = $default_internal_group mode = 0660 user = } user = $default_internal_user vsz_limit = 18446744073709551615 B } service imap-login { chroot = login client_limit = 0 drop_priv_before_exec = no executable = imap-login extra_groups = group = idle_kill = 0 inet_listener imap { address = haproxy = no port = 143 reuse_port = no ssl = no } inet_listener imaps { address = haproxy = no port = 993 reuse_port = no ssl = yes } privileged_group = process_limit = 0 process_min_avail = 5 protocol = imap service_count = 0 type = login user = $default_login_user vsz_limit = 18446744073709551615 B } service imap-urlauth-login { chroot = token-login client_limit = 0 drop_priv_before_exec = no executable = imap-urlauth-login extra_groups = group = idle_kill = 0 privileged_group = process_limit = 0 process_min_avail = 0 protocol = imap service_count = 1 type = login unix_listener imap-urlauth { group = mode = 0666 user = } user = $default_login_user vsz_limit = 18446744073709551615 B } service imap-urlauth-worker { chroot = client_limit = 1 drop_priv_before_exec = no executable = imap-urlauth-worker extra_groups = $default_internal_group group = idle_kill = 0 privileged_group = process_limit = 1024 process_min_avail = 0 protocol = imap service_count = 1 type = unix_listener imap-urlauth-worker { group = mode = 0600 user = $default_internal_user } user = vsz_limit = 18446744073709551615 B } service imap-urlauth { chroot = client_limit = 1 drop_priv_before_exec = no executable = imap-urlauth extra_groups = group = idle_kill = 0 privileged_group = process_limit = 1024 process_min_avail = 0 protocol = imap service_count = 1 type = unix_listener token-login/imap-urlauth { group = mode = 0666 user = } user = $default_internal_user vsz_limit = 18446744073709551615 B } service imap { chroot = client_limit = 1 drop_priv_before_exec = no executable = imap extra_groups = $default_internal_group group = idle_kill = 0 privileged_group = process_limit = 400 process_min_avail = 0 protocol = imap service_count = 1 type = unix_listener imap-master { group = mode = 0600 user = } unix_listener login/imap { group = mode = 0666 user = } user = vsz_limit = 18446744073709551615 B } service indexer-worker { chroot = client_limit = 1 drop_priv_before_exec = no executable = indexer-worker extra_groups = $default_internal_group group = idle_kill = 0 privileged_group = process_limit = 10 process_min_avail = 0 protocol = service_count = 0 type = worker unix_listener indexer-worker { group = mode = 0600 user = $default_internal_user } user = vsz_limit = 18446744073709551615 B } service indexer { chroot = client_limit = 0 drop_priv_before_exec = no executable = indexer extra_groups = group = idle_kill = 0 privileged_group = process_limit = 1 process_min_avail = 0 protocol = service_count = 0 type = unix_listener indexer { group = mode = 0666 user = } user = $default_internal_user vsz_limit = 18446744073709551615 B } service ipc { chroot = empty client_limit = 0 drop_priv_before_exec = no executable = ipc extra_groups = group = idle_kill = 0 privileged_group = process_limit = 1 process_min_avail = 0 protocol = service_count = 0 type = unix_listener ipc { group = mode = 0600 user = $default_internal_user } unix_listener login/ipc-proxy { group = mode = 0600 user = $default_login_user } user = $default_internal_user vsz_limit = 18446744073709551615 B } service lmtp { chroot = client_limit = 1 drop_priv_before_exec = no executable = lmtp extra_groups = $default_internal_group group = idle_kill = 0 privileged_group = process_limit = 0 process_min_avail = 0 protocol = lmtp service_count = 0 type = unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 01224 user = postfix } unix_listener lmtp { group = mode = 0666 user = } user = vsz_limit = 18446744073709551615 B } service log { chroot = client_limit = 0 drop_priv_before_exec = no executable = log extra_groups = group = idle_kill = 4294967295 secs privileged_group = process_limit = 1 process_min_avail = 0 protocol = service_count = 0 type = log unix_listener log-errors { group = mode = 0600 user = } user = vsz_limit = 18446744073709551615 B } service managesieve-login { chroot = login client_limit = 0 drop_priv_before_exec = no executable = managesieve-login extra_groups = group = idle_kill = 0 inet_listener sieve { address = haproxy = no port = 4190 reuse_port = no ssl = no } privileged_group = process_limit = 0 process_min_avail = 0 protocol = sieve service_count = 1 type = login user = $default_login_user vsz_limit = 18446744073709551615 B } service managesieve { chroot = client_limit = 1 drop_priv_before_exec = no executable = managesieve extra_groups = group = idle_kill = 0 privileged_group = process_limit = 0 process_min_avail = 0 protocol = sieve service_count = 1 type = unix_listener login/sieve { group = mode = 0666 user = } user = vsz_limit = 18446744073709551615 B } service old-stats { chroot = empty client_limit = 0 drop_priv_before_exec = no executable = old-stats extra_groups = fifo_listener old-stats-mail { group = mode = 0600 user = } fifo_listener old-stats-user { group = mode = 0600 user = } group = idle_kill = 4294967295 secs privileged_group = process_limit = 1 process_min_avail = 0 protocol = service_count = 0 type = unix_listener old-stats { group = mode = 0600 user = } user = $default_internal_user vsz_limit = 18446744073709551615 B } service pop3-login { chroot = login client_limit = 0 drop_priv_before_exec = no executable = pop3-login extra_groups = group = idle_kill = 0 inet_listener pop3 { address = haproxy = no port = 110 reuse_port = no ssl = no } inet_listener pop3s { address = haproxy = no port = 995 reuse_port = no ssl = yes } privileged_group = process_limit = 0 process_min_avail = 0 protocol = pop3 service_count = 1 type = login user = $default_login_user vsz_limit = 18446744073709551615 B } service pop3 { chroot = client_limit = 1 drop_priv_before_exec = no executable = pop3 extra_groups = $default_internal_group group = idle_kill = 0 privileged_group = process_limit = 200 process_min_avail = 0 protocol = pop3 service_count = 1 type = unix_listener login/pop3 { group = mode = 0666 user = } user = vsz_limit = 18446744073709551615 B } service quota-warning { chroot = client_limit = 0 drop_priv_before_exec = no executable = script /var/lib/dovecot/quota-warning.sh extra_groups = group = idle_kill = 0 privileged_group = process_limit = 0 process_min_avail = 0 protocol = service_count = 1 type = unix_listener quota-warning { group = dovecot mode = 0666 user = dovecot } user = vsz_limit = 18446744073709551615 B } service replicator { chroot = client_limit = 0 drop_priv_before_exec = no executable = replicator extra_groups = group = idle_kill = 4294967295 secs privileged_group = process_limit = 1 process_min_avail = 0 protocol = service_count = 0 type = unix_listener replicator-doveadm { group = mode = 00 user = $default_internal_user } unix_listener replicator { group = mode = 0600 user = $default_internal_user } user = vsz_limit = 18446744073709551615 B } service stats { chroot = client_limit = 0 drop_priv_before_exec = no executable = stats extra_groups = group = idle_kill = 4294967295 secs privileged_group = process_limit = 1 process_min_avail = 0 protocol = service_count = 0 type = unix_listener stats-reader { group = mode = 0600 user = } unix_listener stats-writer { group = $default_internal_group mode = 0660 user = } user = $default_internal_user vsz_limit = 18446744073709551615 B } service submission-login { chroot = login client_limit = 0 drop_priv_before_exec = no executable = submission-login extra_groups = group = idle_kill = 0 inet_listener submission { address = haproxy = no port = 587 reuse_port = no ssl = no } privileged_group = process_limit = 0 process_min_avail = 0 protocol = submission service_count = 1 type = login user = $default_login_user vsz_limit = 18446744073709551615 B } service submission { chroot = client_limit = 1 drop_priv_before_exec = no executable = submission extra_groups = $default_internal_group group = idle_kill = 0 privileged_group = process_limit = 1024 process_min_avail = 0 protocol = submission service_count = 1 type = unix_listener login/submission { group = mode = 0666 user = } user = vsz_limit = 18446744073709551615 B } shutdown_clients = yes ssl = yes ssl_alt_cert = ssl_alt_key = ssl_ca = ssl_cert = </etc/pki/dovecot/certs/dovecot.pem ssl_cert_username_field = commonName ssl_cipher_list = PROFILE=SYSTEM ssl_cipher_suites = ssl_client_ca_dir = ssl_client_ca_file = ssl_client_cert = ssl_client_key = ssl_client_require_valid_cert = yes ssl_crypto_device = ssl_curve_list = ssl_dh = ssl_key = # hidden, use -P to show it ssl_key_password = ssl_min_protocol = TLSv1.2 ssl_options = ssl_prefer_server_ciphers = no ssl_require_crl = yes ssl_verify_client_cert = no state_dir = /var/lib/dovecot stats_http_rawlog_dir = stats_writer_socket_path = stats-writer submission_client_workarounds = submission_host = submission_logout_format = in=%i out=%o submission_max_mail_size = 0 submission_max_recipients = 0 submission_relay_command_timeout = 5 mins submission_relay_connect_timeout = 30 secs submission_relay_host = submission_relay_master_user = submission_relay_max_idle_time = 29 mins submission_relay_password = submission_relay_port = 25 submission_relay_rawlog_dir = submission_relay_ssl = no submission_relay_ssl_verify = yes submission_relay_trusted = no submission_relay_user = submission_ssl = no submission_timeout = 30 secs syslog_facility = mail userdb { args = auth_verbose = default default_fields = driver = passwd name = override_fields = result_failure = continue result_internalfail = continue result_success = return-ok skip = never } valid_chroot_dirs = verbose_proctitle = no verbose_ssl = no version_ignore = no protocol lmtp { mail_plugins = " sieve" userdb { args = username_format=%n /etc/passwd driver = passwd-file name = } } protocol imap { mail_plugins = " imap_quota imap_sieve quota" } local_name sub.domain.tld { ssl_cert = </etc/pki/dovecot/certs/sub.domain.tld.pem ssl_key = # hidden, use -P to show it } local_name othersub.domain.tld { ssl_cert = </etc/dovecot/cert.othersub.domain.tld.pem ssl_key = # hidden, use -P to show it } ############################# /etc/passwd ############################# test@s32.someteststring.ml:x:14127:3625:fsadf:/home/s32/homes/test:/dev/null test-s32.someteststring.ml:x:14127:3625:fsadf:/home/s32/homes/test:/dev/null ############################# /etc/postfix/virtual ############################# test(a)s32.someteststring.ml test-s32.someteststring.ml #############################

1 0

submissiond xoauth2 authentication: line too long
by Tobias Florek 04 Jan '23

04 Jan '23

Hi, I am running the latest container image which has dovecot-submissiond 2:2.3.20-3+debian11 I am running into the following problem. I have successfully set up xoauth2 for IMAP and ManageSieve. Now when roundcube tries to send email to submissiond it fails with 500 5.5.2 Line too long This happens right after roundcube sends AUTH XOAUTH2 dXNlcj10ZkBzY2hhZWZmZXItYWcu[...] (a line of length 2149 characters). Reading RFC 4954, section 4 I suppose that this does not look standard compliant. Am I correct? I will raise this issue with roundcube as well. Cheers, Tobi

1 1

CRAM MD5 passwd db permission issue
by Gerben Wierda 04 Jan '23

04 Jan '23

I am busy migrating. I am moving from macOS+MacPorts to Ubuntu+Docker On the old system, I have this in the dovecot config: mail_uid = _dovecot mail_gid = mail mail_privileged_group = mail mail_access_groups = mail This seems weird to me, I think the dovecot user should be in group dovecot only if I understand the docs. On the old system dovecot, postfix, dovenull and rspamd are all members of the mail group. On that system, the cram md5 passwd database (file) has these permissions: drwxr-xr-x 3 root wheel 96 Feb 2 2021 . drwxr-xr-x 22 root admin 704 Jan 4 15:17 .. -rw-r----- 1 root mail 1234 Feb 2 2021 cram-md5.pwd and that has worked like that for many years, basically starting with Mac OS X Server, surviving all kinds of macOS migrations. On my new Ubuntu system I've copied this setup over: drwxr-xr-x 2 root root 4096 Jan 4 09:49 . drwxr-xr-x 7 root root 4096 Jan 4 15:21 .. -rw-r----- 1 root mail 1234 Feb 2 2021 cram-md5.pwd mail_uid = dovecot mail_gid = mail mail_privileged_group = mail mail_access_groups = mail But: Jan 04 15:40:08 auth: Error: passwd-file /etc/dovecot/etc/cram-md5.pwd:open(/etc/dovecot/etc/cram-md5.pwd) failed: Permission denied (euid=91(dovecot) egid=91(dovecot) missing +r perm: /etc/dovecot/etc/cram-md5.pwd, we're not in group 8(mail), dir owned by 0:0 mode=0755) And really, dovecot is in group mail. From /etc/group: mail:x:8:postfix,dovecot dovenull:x:90: dovecot:x:91: And from /etc/passwd: dovenull:x:90:90::/home/dovenull:/usr/sbin/nologin dovecot:x:91:91::/home/dovecot:/usr/sbin/nologin So, that I get this error baffles me. Gerben Wierda (LinkedIn <https://www.linkedin.com/in/gerbenwierda>) R&A IT Strategy <https://ea.rna.nl/> (main site) Book: Chess and the Art of Enterprise Architecture <https://ea.rna.nl/the-book/> Book: Mastering ArchiMate <https://ea.rna.nl/the-book-edition-iii/>

2 1

doveadm proxy list has strange entries
by Tobias Florek 02 Jan '23

02 Jan '23

Hi! I am using dovecot from the latest docker image: Version 2:2.3.20-3+debian11 When getting the proxy list I get the following entries. # doveadm -f flow proxy list username=user(a)example.com proto=imap src ip=10.254.0.13 dest ip=172.23.6.194 port=143 username=username proto=service src ip=src-ip dest ip=dest-ip port=dest-port username=user2(a)example.com proto=imap src ip=10.254.0.13 dest ip=172.23.6.194 port=143 username=username proto=service src ip=src-ip dest ip=dest-ip port=dest-port username=user3(a)example.com proto=imap src ip=10.254.0.13 dest ip=172.23.6.194 port=143 username=username proto=service src ip=src-ip dest ip=dest-ip port=dest-port ... These correspond to the http API's response: # curl -H "Authorization: X-Dovecot-API $(echo -n MY_API_KEY|base64 -w0)" http://localhost:8080/doveadm/v1 -H "Content-Type: application/json" -d '[["proxyList",{},"tag1"]]' | jq [ [ "doveadmResponse", [ { "username": "user(a)example.com", "service": "imap", "src-ip": "10.254.0.13", "dest-ip": "172.23.6.194", "dest-port": "143" }, { "username": "username", "service": "service", "src-ip": "src-ip", "dest-ip": "dest-ip", "dest-port": "dest-port" }, ... ], "tag1" ] ] This does not look right. Cheers, Tobias Florek

3 2

Error: Failed to get quota resource STORAGE: quota-fs: quotactl(Q_GETQUOTA, NFS:/home) failed: No such file or directory
by Jorge Concha C. 01 Jan '23

01 Jan '23

Hello everyone, I'm migrating my dovecot (imap) server from CentOS-6 to RockyLinux-9, but I can't get the QUOTA-FS plugin to work. When trying the "doveadm quota get -u user" command, it returns an error "doveadm(user): Error: Failed to get quota resource STORAGE: quota-fs: quotactl(Q_GETQUOTA, nfs:/home) failed: No such file or directory" If the user has his "$home" on a local drive, everything works fine, but if the user has his $home on a nfs-filesystem, it throws that error. On CentOS-6, everything works fine, with the same users on the same nfs-filesystem. I don't know if it is the product of the OS change or the dovecot version change. CentOS6 -> Dovecot 2.2.10 RockyLinux-9 -> Dovecot 2.3.16 Does anyone have any ideas? Thanks -- Jorge Concha C. Área de Sistemas - CEC U. de Chile

3 12

Iteration failure on passwd-file when listing all users?
by EML 31 Dec '22

31 Dec '22

Dovecot 2.3.16, Ubuntu 22.04. I'm trying to get a list of all dovecot users, on a simple test setup on my local network (which "works", in that I can get IMAP mails from dovecot): passdb { driver = passwd-file args = /var/mail/vhosts/%d/shadow } userdb { driver = passwd-file args = /var/mail/vhosts/%d/passwd } The command 'doveadm user -u foo(a)example.com' correctly shows that user. However, any attempt to wildcard the user fails: # doveadm user -u *(a)example.com Error: auth-master: userdb list: User listing returned failure Fatal: user listing failed The log file shows Error: conn unix:auth-worker (pid=13471,uid=129): auth-worker<1>: passwd-file(*(a)example.com): passwd-file: User iteration isn't currently supported with %variable paths Any ideas? And, if I can get this to work, is this method any better than just reading /var/mail/vhosts/example.com/passwd and extracting the first field to get the user name? Or just finding all the maildir directories in /var/mail/vhosts/example.com? Thanks. If you're interested, I'm doing this so that I can automate postfix setup (by mapping new addresses to known dovecot users in the postfix virtual mailbox file). The vmailbox file might look like: # 'user1' is a known dovecot user foo(a)example.com example.com/user1

3 6

Permissions issue with doveadm mailbox command
by James Moe 31 Dec '22

31 Dec '22

I have been exploring dovecot and came across this: $ sudo doveadm mailbox list doveadm(root): Error: Mail access for users with UID 303 not permitted (see first_valid_uid in config file, uid from mail_uid setting). Hmm. After setting "first_valid_uid = 300": $ sudo doveadm mailbox list doveadm(root)<4380><4VP8EENer2McEQAAvbJltg>: Error: chdir(/root/) failed: Permission denied (euid=303(vmail) egid=303(vmail) missing +x perm: /root, dir owned by 0:0 mode=0700) INBOX I do not understand the error message. The current configuration. (Note I have changed first_valid_uid to its original value.) $ postconf -n # 2.3.15 (0503334ab1): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.15 (e6a84e31) # OS: Linux 5.14.21-150400.24.33-default x86_64 btrfs # Hostname: sma-server3.sma.com auth_mechanisms = plain login base_dir = /var/run/dovecot/ debug_log_path = /data01/var/log/dovecot/dovecot-debug.log disable_plaintext_auth = no first_valid_uid = 1001 info_log_path = /data01/var/log/dovecot/dovecot-info.log log_path = /data01/var/log/dovecot/dovecot.log log_timestamp = %Y-%m-%dT%H:%M:%S mail_gid = vmail mail_location = maildir:/var/mail/vmail/%u/ mail_uid = vmail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { driver = pam } passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } plugin { sieve = file:~/sieve;active=~/.dovecot.sieve } protocols = imap service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } } service log { group = users user = dovecot } ssl = no ssl_cipher_list = ALL:!aNULL:!eNULL:!EXPORT:!DES:!3DES:!MD5:!PSK:!RC4:!ADH:!LOW@STRENGTH ssl_options = no_compression ssl_prefer_server_ciphers = yes userdb { driver = passwd } userdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } -- James Moe moe dot james at sohnen-moe dot com 520.743.3936 Think.

2 1

Permissions for dovecot logging
by James Moe 31 Dec '22

31 Dec '22

dovecot 2.3.15 opensuse LEAP 15.4 I changed logging to use a path rather than syslog. Doing so makes it easier to work with fail2ban. Dovecot fails to start with the error: Can't open log file /data01/var/log/dovecot.log: Permission denied Permissions: drwxrwxr-x 1 root users 104 Feb 25 2018 /data01/ drwxrwxr-x 1 sma-user3x users 102 Dec 17 14:50 /data01/var/ drwxrwxr-x 1 sma-user3x users 146 Dec 27 15:37 /data01/var/log/ drwxrwxr-x 1 dovecot users 22 Dec 27 15:47 /data01/var/log/dovecot/ "dovecot" is a member of "users". What "permission" am I missing? Note: A long time ago I had a problem with programs consuming all available space on the system disk with log or backup files. I have since gotten in the habit of putting log files on a non-system disk. -- James Moe moe dot james at sohnen-moe dot com 520.743.3936 Think.

4 6

Self hosting solution for Christmas
by Andre Rodier 29 Dec '22

29 Dec '22

Hello everyone, Here my present for Christmas: a new version of HomeBox, the self hosted email solution. Feel free to drop comments, create issues, update the docs, etc. I released this quickly before going on vacation, so you may find some issues. However, this is mostly stable, and the code is easy to modify. Also, you can now add and remove components individually, with an Ansible playbook. https://github.com/progmaticltd/homebox System installation and features - Custom Debian installer generation with full disk encryption and fully automatic installation. - Unlock the system upon boot by entering the passphrase through SSH. - Install packages only from Debian stable (Bullseye). - Automatic letsencrypt certificates generation using Lego and DNS challenge. - Automatic security updates (optional). - Centralised authentication with an LDAP users database, SSL certificate, password policies, PAM integration. - AppArmor activated with a profile for all daemons. - XKCD Random passwords generated and saved into pass (or on file system). - Can be used at home, on a dedicated or virtual server hosted online. - Flexible IP address support: IPv4 only, IPv6 only, and IPv4+IPv4 or IPv4+IPv6. - Embedded DNS server, with CAA, DNSSEC and SSHFP (SSH fingerprint) support. - Grade A https sites, HSTS implemented by default. - Automatic configuration of OpenPGP Web Key Directory. - Automatic firewall rules for inbound, outbound and forwarding traffic, using nftables. - Restricted outbound web sites access to the minimum. - Automatic update of DNS keys, DNS servers and glue records on Gandi. Emails - Postfix configuration and installation, with LDAP lookups, internationalised email aliases, fully SSL compliant. - Generate DKIM keys, SPF and DMARC DNS records. The DKIM keys are generated every year. - Automatic copy of sent emails into the sent folder. - Automatic creation of the postmaster account and special email addresses using RFC 2142 specifications. - Dovecot configuration, IMAPS, POP3S, Quotas, ManageSieve. - Simple spam and ham learning by moving emails in and out the Junk folder - Sieve and vacation scripts. - Virtual folders for server search: unread messages, conversations view, all messages, flagged and messages labelled as "important". - Email addresses with recipient delimiter included, e.g. john.doe+lists(a)dbcooper.com. - Optional master user creation, e.g. for families with children or moderated communities. - Server side full text search inside emails, attached documents and files and compressed archives, with better results than GMail. - SOGo webmail with sieve filters management, password change form, Calendar and Address book management, GUI to import other account emails. - Powerful and light antispam system with rspamd and optional access to the web interface. - Antivirus for inbound and outbound emails with clamav (optional). - Automatic configuration for Thunderbird and Outlook using published XML and other clients with special DNS records (RFC 6186). Calendar and Address book - Install and configure a CalDAV / CardDAV server, with automatic discovery (RFC 6186). - Groupware functionality in a web interface, with SOGo. - Recurring events, email alerts, shared address books and calendars. - Mobile devices compatibility: Android, Apple iOS, BlackBerry 10 and Windows mobile through Microsoft ActiveSync. Other optional features - Incremental backups, encrypted, on multiple destination (SFTP, S3, Samba share or USB drive), with email and Jabber reporting. - Jabber server, using ejabberd, with LDAP authentication, direct or offline file transfer and optional server to server communication. - Static web site skeleton configuration, with https certificates and A+ security grade by default. Development - YAML files validation on each commit, using travis-ci. - End to end integration tests for the majority of components. - Playbooks to facilitate the installation or removal of development packages. - Global debug flag to activate the debug mode of all components. - Fully open source Ansible scripts licensed under GPLv3. Merry Christmas, André

4 7

Sieve duplicates
by Ferenc 28 Dec '22

28 Dec '22

Hi list, I’m trying this again from a different account because of lots of SPF warnings. I have Sieve scripts that duplicate e-mails. I don’t want that. My dovecot version is 2.3.4.1 (f79e8e7e4), Pigeonhole version 0.5.4 on Linux 5.4.189-2-pve x86_64 Debian 10.13. My scripts get called on an imap COPY action (imapsieve extension). The mail is fed to an external script (spam/ham training or retraining) via a pipe :copy action (vnd.dovecot.pipe extension). An header is added to keep track of what happened (editheader extension). I use "if header :contains” for my (simple) logic. If contains header X, do this, add header Y. If contains header Y, do that, add header X. I end each "if” part with “keep;" and “stop;” commands. Simple versions of the scripts, without the if-then construct, seem to work ok with imapsieve. As soon as I try to use if-then-else I find a duplicate of the processed e-mail; the original mail seems to be untouched, the duplicate appears to have been processed. With macos mail not all duplicates show up but with Roundcube webmail I can see them all. The scripts are like this: # without if-then require … pipe :copy … addheader … keep; # with if-then require … if header :contains pipe :copy … addheader … keep; stop; if not exists pipe :copy … addheader … keep; stop; keep; The scripts get called from “imapsieve_mailbox1_before” for example. Cheers, Ferenc

2 2

Dovecot v2.3.20 released
by Aki Tuomi 28 Dec '22

28 Dec '22

We are pleased to release v2.3.20 of Dovecot. https://dovecot.org/releases/2.3/dovecot-2.3.20.tar.gz https://dovecot.org/releases/2.3/dovecot-2.3.20.tar.gz.sig Binary packages in https://repo.dovecot.org/ Docker images in https://hub.docker.com/r/dovecot/dovecot Regards, Aki Tuomi Open-Xchange oy -- + Add dsync_features=no-header-hashes. When this setting is enabled and one dsync side doesn't support mail GUIDs (i.e. imapc), there is no fallback to using header hashes. Instead, dsync assumes that all mails with identical IMAP UIDs contains the same mail contents. This can significantly improve dsync performance with some IMAP servers that don't support caching Date/Message-ID headers. + lua: HTTP client has more settings now, see https://doc.dovecot.org/admin_manual/lua/#dovecot.http.client + replicator: "doveadm replicator status" command now outputs when the next sync is expected for the user. - LAYOUT=index: duplicate GUIDs were not cleaned out. Also the list recovery was not optimal. - auth: Assert crash would occur when iterating multiple userdb backends. - director: Logging into director using master user with auth_master_user_separator character redirected user to a wrong backend, unless master_user_separator setting was also set to the same value. Merged these into auth_master_user_separator. - dsync: Couldn't always fix folder GUID conflicts automatically with Maildir format. This resulted in replication repeatedly failing with "Remote lost mailbox GUID". - dsync: Failed to migrate INBOX when using namespace prefix=INBOX/, resulting in "Remote lost mailbox GUID" errors. - dsync: INBOX was created too early with namespace prefix=INBOX/, resulting a GUID conflict. This may have been resolved automatically, but not always. - dsync: v2.3.18 regression: Wrong imapc password with dsync caused Panic: file lib-event.c: line 506 (event_pop_global): assertion failed: (event == current_global_event) - imapc: Requesting STATUS for a mailbox with imapc and INDEXPVT configured did not return correct (private) unseen counts. - lib-dict: Process would crash when committing data to redis without dict proxy. - lib-mail: Corrupted cached BODYSTRUCTURE caused panic during FETCH. Fixes: Panic: file message-part-data.c: line 579 (message_part_is_attachment): assertion failed: (data != NULL). v2.3.13 regression. - lib-storage: mail_attribute_dict with dict-sql failed when it tried to lookup empty dict keys. - lib: ioloop-kqueue was missing include breaking some BSD builds. - lua-http: Dovecot Lua HTTP client could not resolve DNS names in mail processes, because it expected "dns-client" socket to exist in the current directory. - oauth2: Using %{oauth2:name} variables could cause useless introspections. - pop3: Sending POP3 command with ':' character caused an assert-crash. v2.3.18 regression. - replicator: Replication queue had various issues, potentially causing replication requests to become stuck. - stats: Invalid Prometheus label names were created with specific

5 7

Happy Holidays From SCOM.CA Internet Services Inc.
by Paul Kudla 23 Dec '22

23 Dec '22

1 0

Pigeonhole v0.5.20 released
by Aki Tuomi 22 Dec '22

22 Dec '22

We are pleased to release v0.5.20 of Pigeonhole. https://pigeonhole.dovecot.org/releases/2.3/dovecot-2.3-pigeonhole-0.5.20.t… https://pigeonhole.dovecot.org/releases/2.3/dovecot-2.3-pigeonhole-0.5.20.t… Binary packages in https://repo.dovecot.org/ Docker images in https://hub.docker.com/r/dovecot/dovecot Regards, Aki Tuomi Open-Xchange oy -- * No changes - release done to keep version numbers synced.

1 0

OT: Two simultaneous POP3 connections from Outlook
by kjohnson＠eclypse.org 21 Dec '22

21 Dec '22

Hello, I recognize this may be somewhat off-topic, but my search-fu has failed to provide useful results, so I ask for pointers to further information. Today, while examining Dovecot logs, I found a case where the Outlook mail client (probably 2016 or later) on a user's computer opened two simultaneous, or at least overlapping, POP3 connections to Dovecot. This did not go well, naturally. Warning: Transaction log file .../mail/.imap/INBOX/dovecot.index.log was locked for 156 seconds (rotating while syncing) If anyone else has found useful information about this peculiar behavior for an email client, I would be pleased to receive a pointer in that direction. Thank you. Ken

2 1

How is URLAUTH broken, and for how long?
by Andy Balholm 21 Dec '22

21 Dec '22

The documentation for imap_urlauth_host says: > Warning > > URLAUTH in current versions of Dovecot is broken in several ways. > This will be fixed in the future, but activating URLAUTH support > on production systems is not recommended. In what ways is it broken? Is anyone actually working on fixing it? Andy

1 0

Re: SPF DNS Error / R_SPF_DNSFAIL
by Jochen Bern 20 Dec '22

20 Dec '22

On 19.12.22 13:20, Carlos Mogas da Silva wrote: > On Mon, 2022-12-19 at 12:38 +0100, Benny Pedersen wrote: >> Carlos Mogas da Silva skrev den 2022-12-19 11:57: >>> What can cause this error and/or how can I debug it? >> >> try avoid to many dns querys > > Even on a caching dns server? Any ideas on why it is failing? I don't remember it being in an actual RFC, but SPF records are supposed to not require more than 10 DNS queries to fully resolve. https://dmarcian.com/spf-survey/ gives cttexpresso.pt an all-green result, but notes that the "+a:email.reditus.pt" part is inoperational ("no A or AAAA RRs found", in fact, I'm getting an NXDOMAIN for the FQDN). Regards, -- Jochen Bern Systemingenieur Binect GmbH

1 0

SPF DNS Error / R_SPF_DNSFAIL
by Carlos Mogas da Silva 20 Dec '22

20 Dec '22

Hi list. My incoming messages are getting R_SPF_DNSFAIL and an error on the Authentication-Results header: spf=temperror (mail01.r3pek.org: error in processing during lookup of no-reply(a)cttexpresso.pt: DNS error) I see the DNS request on my DNS server and a "working" reply going out. What can cause this error and/or how can I debug it?

4 6

mail filters
by mick.crane 20 Dec '22

20 Dec '22

I'm using what ever is in Debian Bookworm, I'm pretty sure. These filters? I collect from different email addresses like gmail and that. If filter for the "Sent to" email address, move to this directory If "From" contains "blah", move to this other directory. If something is Sent to and also From contains "blah" then I get 2 copies of the message in both filter directories. How can I fix this? regards mick

5 6

feature request: add base64 variable modifier
by alex 19 Dec '22

19 Dec '22

Hi, It would be very convenient to have a base64 variable modifier. Main use-case is to base64-encode passwords when changing your hashing scheme. With a base64 encoding modifier (e.g. %B) something like this would safely work: userdb { driver = prefetch default_fields = plain_pass=%Bw } without things breaking when there are %-characters in the password, and without having to send the plaintext password to the database, as current solutions propose, which is never a good idea. alternative solution: adapt the generic hash-modifier to accept a none/plaintext hashing-scheme and use the base64 output functionality that is already available there. Thanks! Alex

1 0

What do I do with the ".ext?"
by James Moe 18 Dec '22

18 Dec '22

dovecot 2.3.15 opensuse LEAP 15.4 I am installing dovecot and have postfix as the SMTP agent. It also needs to use a MySQL database. In </etc/dovecot> there is the main dovecot.conf file, and a number of other files with the extension ".conf.ext." It is not clear how to use these. I could nothing in the documentation that discusses it. Do I copy one, say dovecot-sql.conf.ext, modify it: - rename the copy without the ".ext?" - or move the copy to the "conf.d" directory, with or without the "ext?" -- James Moe moe dot james at sohnen-moe dot com 520.743.3936 Think.

2 2

2.3.14: stale imap-login processes due to bogus user setup tying up process limit
by Volker Stolz 16 Dec '22

16 Dec '22

I just dealt with an interesting Dovecot issue on our small server, and thought I might share it. I also feel that although in the end it was a configuration error, Dovecot should somehow avoid leaving this processes around and hence filling up the process limit quickly. - set up Dovecot IMAP on Debian buster (either with the older 2.3.x Debian package, or 2.3.14 from the dovecot-repo) - config: ... namespace inbox { inbox = yes location = ... default settings ... ... passdb { args = scheme=HMAC-MD5 username_format=%u /etc/dovecot/users driver = passwd-file } protocols = " imap" ... userdb { args = blocking=no driver = passwd } ... - secret sauce: have a user in the passdb that doesn't have a physical account on the system yet (we were migrating to a new machine). The log-file shows successful authentication for that user (after we flipped DNS to point to this new machine), but over time (2-3 times/day) we were left with an increasing number of `imap-login` processes in state `pre-login`, eventually requiring a dovecot restart. Dialling up process_limits didn't seem to help, we'd just get more of these stale processes. After creating the user on the system, the behaviour reverted to normal, no more stale processes. I do not know what error message that user received on their end, but since we announced we were migrating, they probably just ignored it and thought it as part of the transition. Best, Volker (a happy & long Dovecot user)

3 4

Re: Can't figure out why managesieve (pigeonhole) can't connect
by colin＠colinlikesfood.com 15 Dec '22

15 Dec '22

thank you again. it seems you have seen my paste of config.inc.php. I do not have a config.php: my_user@some_host:/usr/local/www/roundcube/config # ls -l total 67 -rw-r--r-- 1 root wheel 164 Jul 23 15:17 .htaccess -rw-r--r-- 1 root wheel 1867 Nov 22 15:12 config.inc.php -rw-r--r-- 1 root wheel 2943 Jul 23 15:17 config.inc.php.sample -rw-r--r-- 1 root wheel 63790 Oct 29 20:24 defaults.inc.php -rw-r--r-- 1 root wheel 2806 Jul 23 15:17 mimetypes.php my_user@some_host:/usr/local/www/roundcube/config # I have tried changing tls:// to ssl:// and back again (in the line $config['managesieve_host'] = 'tls://obfuscated.domain';) but the error remains the same: roundcube: PHP Error: Connection refused (GET /index.php?_task=settings&_action=plugin.managesieve) roundcube: PHP Error: Unable to connect to managesieve on obfuscated.domain:4190 in /usr/local/www/roundcube/plugins/managesieve/lib/Roundcube/rcube_sieve_engine.php on line 221 (GET /index.php?_task=settings&_action=plugin.managesieve) roundcube: PHP Error: Not currently in AUTHORISATION state (GET /index.php?_task=settings&_action=plugin.managesieve) php: PHP Error: Not currently connected (GET /index.php?_task=settings&_action=plugin.managesieve) roundcube: PHP Error: Connection refused (GET /index.php?_task=settings&_action=plugin.managesieve-action&_framed=1&_nav=hide) roundcube: PHP Error: Unable to connect to managesieve on obfuscated.domain:4190 in /usr/local/www/roundcube/plugins/managesieve/lib/Roundcube/rcube_sieve_engine.php on line 221 (GET /index.php?_task=settings&_action=plugin.managesieve-action&_framed=1&_nav=hide) php: PHP Error: Not currently connected (GET /index.php?_task=settings&_action=plugin.managesieve-action&_framed=1&_nav=hide) roundcube: PHP Error: Connection refused (POST /?_task=settings&_action=plugin.managesieve-save) roundcube: PHP Error: Unable to connect to managesieve on obfuscated.domain:4190 in /usr/local/www/roundcube/plugins/managesieve/lib/Roundcube/rcube_sieve_engine.php on line 221 (POST /?_task=settings&_action=plugin.managesieve-save) i don't understand why it can't connect, this seems to work fine: # gnutls-cli --tofu --starttls -p 4190 10.0.0.91 Processed 142 CA certificate(s). Resolving '10.0.0.91:4190'... Connecting to '10.0.0.91:4190'... - Simple Client Mode: "IMPLEMENTATION" "dovecot" "SIEVE" "fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext" "NOTIFY" "mailto" "SASL" "CRAM-MD5" "STARTTLS" "VERSION" "1.0" OK "Dovecot ready." STARTTLS OK "Begin TLS negotiation now." *** Starting TLS handshake - Certificate type: X.509 - Got a certificate list of 3 certificates. - Certificate[0] info: - subject `CN=obfuscated.domain.com', issuer `CN=R3,O=Let's Encrypt,C=US', serial xxxxxxxxxxxxxxxxxxxxxx, RSA key 2048 bits, signed using RSA-SHA256, activated `yyyy-mm-dd 17:48:15 UTC', expires `yyyy-mm-dd 17:48:14 UTC', pin-sha256="xxxxxxxxxxxxxxxxxxxxxx" Public Key ID: sha1:xxxxxxxxxxxxxxxxxxxxxx sha256:xxxxxxxxxxxxxxxxxxxxxx Public Key PIN: pin-sha256:xxxxxxxxxxxxxxxxxxxxxx - Certificate[1] info: - subject `CN=R3,O=Let's Encrypt,C=US', issuer `CN=ISRG Root X1,O=Internet Security Research Group,C=US', serial xxxxxxxxxxxxxxxxxxxxxx, RSA key 2048 bits, signed using RSA-SHA256, activated `yyyy-mm-dd 00:00:00 UTC', expires `yyyy-mm-dd 16:00:00 UTC', pin-sha256="xxxxxxxxxxxxxxxxxxxxxx" - Certificate[2] info: - subject `CN=ISRG Root X1,O=Internet Security Research Group,C=US', issuer `CN=DST Root CA X3,O=Digital Signature Trust Co.', serial yyyy-mm-dd, RSA key 4096 bits, signed using RSA-SHA256, activated `yyyy-mm-dd 19:14:03 UTC', expires `yyyy-mm-dd 18:14:03 UTC', pin-sha256="xxxxxxxxxxxxxxxxxxxxxx" - Status: The certificate is NOT trusted. The name in the certificate does not match the expected. *** PKI verification of server certificate failed... Host 10.0.0.91 (sieve) has never been contacted before. Its certificate is valid for 10.0.0.91. Are you sure you want to trust it? (y/N): y - Description: (TLS1.3-X.509)-(ECDHE-SECP256R1)-(RSA-PSS-RSAE-SHA256)-(AES-256-GCM) - Session ID: xx:yy:xx:yy:xx:yy... - Options: "IMPLEMENTATION" "dovecot" "SIEVE" "fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext" "NOTIFY" "mailto" "SASL" "CRAM-MD5" "VERSION" "1.0" OK "TLS negotiation successful." On 2022-11-23 13:35, Yassine Chaouche wrote: > also make sure your are editing config.php and not config.inc.php > (which you pasted) > > Yassine. > > Le 23 novembre 2022 8:30:36 PM GMT+01:00, Yassine Chaouche > <a.chaouche(a)algerian-radio.dz> a écrit : > >> good. we have established that the problem shouldn't be on dovecot's >> side. i suspect roundcube is misconfigured or can't connect for some >> reason. I believe someone mentioned SSL and TLS support problem in RC >> for a specific version? can you try without? also can you paste RC >> config? >> >> Yassine.

5 6

Kerberos/GSSAPI auth weirdness?
by r3pek 14 Dec '22

14 Dec '22

Hi list! I'm migrating my server into a new REALM (INT.R3PEK.ORG) from an old one (R3PEK.ORG) This is a completely new install and configuration, so no leftovers exits. The machine is correctly register into the REALM and users are able to login without a problem. Now, when I try to login using a Kerberos ticket, for some reason that I can't understand, dovecot is looking for a ticket on the old REALM. Maybe because of the email domain (which stayed the same)? This is the error message I see on the clients: "Failed to authenticate: Server krbtgt/R3PEK.ORG(a)INT.R3PEK.ORG" The one it should be looking for is krbtgt/INT.R3PEK.ORG(a)INT.R3PEK.ORG, but I can't seem to figure out where the problem is. # doveconf | grep -i realm auth_default_realm = INT.R3PEK.ORG auth_realms = INT.R3PEK.ORG What do I need to change to make this work?

1 0

sasl service for other app
by Henry R 13 Dec '22

13 Dec '22

can dovecot run as a general sasl service for other apps? such as webdav. Thanks.

6 10

Backups
by Doug Hardie 11 Dec '22

11 Dec '22

I started to investigate using doveadm backup to backup my mail system. I have a small number of users and the mail store is not large. It uses maildir format. I setup a test system that is not connected to the internet and started up dovecot. I used the following command to backup one user: doveadm backup -u ben remote:test ben is the user is in the mail store. Test is the actual server name. That worked just fine. The maildir was copied completely (as best as I can tell with ls). Then I tried the second user: doveadm backup -u jean remote:test This gives 2 error messages: doveadm(jean)[]<McRYOFI0jGN1MwAAmC+70w>: Error: Mailbox INBOX: Failed to get attribute vendor/vendor.dovecot/pvt/server/sieve/files/.dovecot: Mailbox attributes not enabled doveadm(jean)[]<0IwxIlI0jGMgUwAAZU03Dg>: Error: Remote command returned error 65: ssh test doveadm dsync-server -ujean -U In addition, the maildir directories are created, but there are no emails in any of them (e.g., cur). What is the problem with the 2nd and why does it behave differently from the first? -- Doug

4 8

Sieve duplicates
by Ferenc 09 Dec '22

09 Dec '22

Hi list, I have Sieve scripts that unintentionally duplicate e-mails. My dovecot version is 2.3.4.1 (f79e8e7e4), Pigeonhole version 0.5.4 on Linux 5.4.189-2-pve x86_64 Debian 10.13. My scripts get called on an imap COPY action (imapsieve extension). The mail is fed to an external script (spam/ham training) via a pipe :copy action (vnd.dovecot.pipe extension). An header is added to keep track of what happened (editheader extension). I use "if header :contains” for my (simple) logic. If contains header X, do this, add header Y. If contains header Y, do that, add header X. I end each "if” part with keep; and stop; commands. Simple versions of this script, without the if-then construct, seem to work ok. As soon as I try to use if-then-else I find a duplicate of the processed e-mail; one that seems to be untouched, one that appears to have been processed. I hope I’m making myself clear… # without if-then require … pipe :copy … addheader … keep; # with if-then require … if header :contains pipe :copy … addheader … keep; stop; if not exists pipe :copy … addheader … keep; stop; keep; The scripts get called from for instance imapsieve_mailbox1_before. Cheers, Ferenc

1 0

Seen Flags per User
by Maurice Kunze 08 Dec '22

08 Dec '22

Hello, i want to configure seen flags per user for shared public mailboxes in dovecot. I have added the INDEVPVT Option to the location parameter in the namespace and restarted the services and the server. Unfortunately nothing changed and there are still global seen flags in the configuration. In a post i read that i have to manually add some files to the location but this isnt specified in the documentation. below is the version we use and the config. dovecot --version 2.3.13 (89f716dc2) dovecot -n # 2.3.13 (89f716dc2): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.13 (cdd19fe3) # OS: Linux 5.10.0-17-amd64 x86_64 Debian 11.4 ext4 # Hostname: <SERVERNAME> auth_debug = yes auth_debug_passwords = yes auth_verbose = yes auth_verbose_passwords = plain mail_debug = yes mail_gid = vmail mail_location = maildir:/var/mail/user mail_plugins = acl mail_privileged_group = vmail mail_uid = vmail namespace { list = yes location = maildir:/var/mail/public:INDEXPVT=/var/mail/public prefix = public/ separator = / subscriptions = no type = public } namespace { list = yes location = maildir:/var/mail/user/%u/Maildir:INDEX=/var/mail/user/%u/shared/%u:CONTROL=/var/mail/user/%u/shared/%u prefix = shared/%%u/ separator = / subscriptions = no type = shared } namespace inbox { hidden = no inbox = yes list = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = separator = / subscriptions = yes type = private } passdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } plugin { acl = vfile acl_anyone = allow acl_shared_dict = file:/var/mail/database/shared-mailboxes.db } protocols = " imap" service stats { unix_listener stats-reader { group = vmail mode = 0660 user = vmail } unix_listener stats-writer { group = vmail mode = 0660 user = vmail } } ssl_cert = </var/ssl/dove.crt ssl_client_ca_dir = /etc/ssl/certs ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } protocol imap { mail_plugins = acl imap_acl }

2 5

access dict in lua auth script
by Tobias Florek 08 Dec '22

08 Dec '22

Hi! I want to access a configured dictionary in a lua authentication script. Unfortunately the documentation <https://doc.dovecot.org/admin_manual/lua/> does mention a dict object but no way to get one. I also did not find any lua tests in dovecot's source code. Is using the built-in dict not supported? Cheers, Tobias Florek

2 2

moving messages between namespaces go into purge
by Marc 07 Dec '22

07 Dec '22

I think it would be nice to have an option where the moving of messages between namespaces (by automated server scripts) would not result in messages ending up in the 'purge' queue. Currently when you move these copied messages, they end up in the purge queue combined with messages that users deleted. I am more or less forced to purge the mailbox after moving GB's while I prefer not to do this, because I would like to keep the opportunity to recover from the purge queue. Maybe there is a way to 'deduplicate' this purge queue?

3 4

How to configure Dovecot with Keycloak correctly
by Gary Horchem 07 Dec '22

07 Dec '22

Hello I’m trying to configure Dovecot with Keycloak I’m using the proxy with password grant method. Here’s my dovecot-oauth2.plain.conf.ext grant_url = https://server-1.gary-springfield-mo.net/realms/sso/protocol/openid-connect… client_id = dovecot client_secret = WtZ5uZsBi2QPfh1EWuMWjUVGNNT4HEGR introspection_url = https://server-1.gary-springfield-mo.net/realms/sso/protocol/openid-connect… introspection_mode = post use_grant_password = yes debug = yes username_attribute = username pass_attrs = host=server-1:8181 proxy=y proxy_mech=xoauth2 pass=%{oauth2:access_token} And my dovecot-oauth2.token.conf.ext grant_url = https://server-1.gary-springfield-mo.net/realms/sso/protocol/openid-connect… client_id = dovecot client_secret = WtZ5uZsBi2QPfh1EWuMWjUVGNNT4HEGR tokeninfo_url = https://server-1.gary-springfield-mo.net/realms/sso/protocol/openid-connect… introspection_url = https://server-1.gary-springfield-mo.net/realms/sso/protocol/openid-connect… introspection_mode = post use_grant_password = no debug = yes username_attribute = username pass_attrs = pass=%{oauth2:access_token} Do I also need to configure the dovecot-oauth2.conf.ext Sent from my iPhone

2 1

lmtp with sieve editheader Panic: file edit-mail.c: line 1809 (merge_from_parent): assertion failed
by Matthias Lay 06 Dec '22

06 Dec '22

Hi, I have experienced a crash in lmtp delivery on some mails when sieve editheader plugin is used. The first one was an "analytics mail" from azure exchange. I stripped down the mail to the relevant parts that trigger this error. log message: lmtp(johnd)<27019><VM4XLJVVj2OLaQAA/TOvIg>: Error: Raw backtrace: /usr/lib/dovecot/libdovecot.so.0(backtrace_append+0x42) [0x7f3048ca0b72] -> /usr/lib/dovecot/libdovecot.so.0(backtrace_get+0x1e) [0x7f3048ca0c8e] -> /usr/lib/dovecot/libdovecot.so.0(+0xff5eb) [0x7f3048cad5eb] -> /usr/lib/dovecot/libdovecot.so.0(+0xff681) [0x7f3048cad681] -> /usr/lib/dovecot/libdovecot.so.0(+0x542c4) [0x7f3048c022c4] -> /usr/lib/dovecot/libdovecot-sieve.so.0(+0x2e11d) [0x7f304841811d] -> /usr/lib/dovecot/libdovecot.so.0(i_stream_read_memarea+0x74) [0x7f3048cb92d4] -> /usr/lib/dovecot/libdovecot.so.0(+0x10eb05) [0x7f3048cbcb05] -> /usr/lib/dovecot/libdovecot.so.0(+0x10f0a9) [0x7f3048cbd0a9] -> /usr/lib/dovecot/libdovecot.so.0(i_stream_read_memarea+0x74) [0x7f3048cb92d4] -> /usr/lib/dovecot/libdovecot.so.0(i_stream_read+0x3a) [0x7f3048cb94ba] -> /usr/lib/dovecot/libdovecot.so.0(+0x112f51) [0x7f3048cc0f51] -> /usr/lib/dovecot/libdovecot.so.0(i_stream_read_memarea+0x74) [0x7f3048cb92d4] -> /usr/lib/dovecot/libdovecot.so.0(i_stream_read+0x3a) [0x7f3048cb94ba] -> /usr/lib/dovecot/libdovecot.so.0(i_stream_read_data+0x3d) [0x7f3048cb9ddd] -> /usr/lib/dovecot/libdovecot.so.0(io_stream_copy+0x74) [0x7f3048cd28f4] -> /usr/lib/dovecot/libdovecot.so.0(o_stream_send_istream+0x4f) [0x7f3048cd25ef] -> /usr/lib/dovecot/libdovecot-storage.so.0(index_storage_save_continue+0x29) [0x7f3048e5dd39] -> /usr/lib/dovecot/libdovecot-storage.so.0(maildir_save_continue+0x20) [0x7f3048e07930] -> /usr/lib/dovecot/libdovecot-storage.so.0(mailbox_save_continue+0x3a) [0x7f3048ddff3a] -> /usr/lib/dovecot/libdovecot-storage.so.0(mail_storage_copy+0xb1) [0x7f3048dd0b71] -> /usr/lib/dovecot/libdovecot-lda.so.0(+0x475b) [0x7f3048eed75b] -> /usr/lib/dovecot/libdovecot-storage.so.0(+0x6439f) [0x7f3048de039f] -> /usr/lib/dovecot/libdovecot-sieve.so.0(+0x52ff4) [0x7f304843cff4] -> /usr/lib/dovecot/libdovecot-sieve.so.0(+0x473e9) [0x7f30484313e9] -> /usr/lib/dovecot/libdovecot-sieve.so.0(+0x482a0) [0x7f30484322a0] -> /usr/lib/dovecot/libdovecot-sieve.so.0(sieve_result_execute+0x1af) [0x7f3048432fbf] -> /usr/lib/dovecot/libdovecot-sieve.so.0(sieve_multiscript_finish+0x218) [0x7f3048446f38] -> /usr/lib/dovecot/lib90_sieve_plugin.so(+0x4030) [0x7f3048ba9030] -> /usr/lib/dovecot/libdovecot-lda.so.0(mail_deliver+0x16f) [0x7f3048eee8ef] lmtp(johnd)<27019><VM4XLJVVj2OLaQAA/TOvIg>: Fatal: master: service(lmtp): child 27019 killed with signal 6 (core dumps disabled - https://dovecot.org/bugreport.html#coredumps) the sieve script only has one addheader line require ["editheader","fileinto","body", "include"]; addheader :last "X-Long-Duration" "XXX"; I will attach doveconf and the lmtp communication. inserted to lmtp with: socat - UNIX-CONNECT:$lmtp_socket <<<"$(<$file)" greetz Matze

1 0

Sieve: fileinto a subfolder of inbox
by Federico Fanton 05 Dec '22

05 Dec '22

Hi everyone! I'm trying to write a sieve script that moves emails to a *subfolder* of the inbox. My script: require ["envelope", "fileinto", "mailbox"]; if anyof( address "to" "support(a)domain.cc", address "cc" "support(a)domain.cc", envelope "to" "support(a)domain.cc" ) { fileinto :create "INBOX.support"; } But this creates a new "support" folder BESIDE the inbox, not INSIDE it. I've tried replacing "INBOX.support" with "INBOX/support" but then I get an error: "Name must not have '/' characters" Is there something else I could try? Here is the output of dovecot -n: # 2.3.4.1 (f79e8e7e4): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.4 () # OS: Linux 4.19.0-21-amd64 x86_64 Debian 10.0 ext4 auth_mechanisms = plain login lda_mailbox_autosubscribe = yes mail_location = maildir:/home/vmail/maildir/%d/%n/Maildir mail_plugins = " zlib lazy_expunge" mail_privileged_group = vmail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext namespace { hidden = yes list = no location = maildir:/home/vmail/maildir/%d/%n/Maildir/expunged prefix = .EXPUNGED/ separator = / } namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { driver = pam } passdb { args = scheme=SHA1 /etc/dovecot/users.conf driver = passwd-file } plugin { lazy_expunge = .EXPUNGED/ sieve = file:~/sieve;active=~/.dovecot.sieve sieve_vacation_default_period = 1d sieve_vacation_to_header_ignore_envelope = yes } protocols = imap sieve service auth { executable = /usr/lib/dovecot/auth unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } unix_listener /var/spool/postfix/private/dovecot-auth { group = postfix mode = 0660 user = postfix } unix_listener auth-master { group = vmail mode = 0600 user = vmail } } service doveadm { inet_listener { port = 24242 } } service imap-login { process_limit = 200 } service stats { unix_listener stats-reader { group = vmail mode = 0660 user = vmail } unix_listener stats-writer { group = vmail mode = 0660 user = vmail } } ssl_cipher_list = ALL:!LOW:!SSLv2:ALL:!aNULL:!ADH:!eNULL:!EXP:RC4+RSA:+HIGH:+MEDIUM ssl_client_ca_dir = /etc/ssl/certs ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { driver = passwd } userdb { args = uid=1001 gid=1001 home=/home/vmail/maildir/%d/%n allow_all_users=yes driver = static } protocol lda { mail_plugins = " zlib lazy_expunge sieve" } protocol imap { imap_client_workarounds = delay-newmail mail_max_userip_connections = 20 } local 192.168.2.0/24 { doveadm_allowed_commands = sieve list,sieve get,sieve put,sieve activate,sieve deactivate doveadm_password = # hidden, use -P to show it } Many thanks for your time!

3 4

Backups and disaster recovery
by GDS 04 Dec '22

04 Dec '22

Hello all! After reading some of the past threads on backups, I was wondering if I could get a sanity check... I run a Maildir configuration for a small (10 mailboxes) mail server. Using "doveadm backup", for each mailbox I do: - Weekly full backups and then copy the files to a network-based filesystem.- Daily incremental backups and then copy the files to a network-based filesystem. My recovery assumption is that in case of hardware failure, I would re-set up the mail service and for each mailbox I will recover at the right directory the latest full mailbox backup and on top of it, each incremental backup to the latest day. Does this sound like a sound strategy? Also, I was thinking of setting up a second dovecot server on another server and replicating my primary on an hourly basis to decrease recovery time. But I looked at mbsync and it seems to require mailbox login/password for each mailbox (which I don't have). Is there an alternative? Thank you!

4 4

HIGHESTMODSEQ not increasing
by Ronny Forberger 04 Dec '22

04 Dec '22

Hi, I have a problem with my Dovecot IMAP Server on Debian Linux. I migrated it from FreeBSD to Debian, but since then the HIGHESTMODSEQ value for INBOX is not increasing, when I receive new e-mail. This causes my Groupware not to report any new e-mail via ActiveSync. Here is the protocol transscript: [I] <~>-> openssl s_client -crlf -connect mail.forberger-online.de:993 CONNECTED(00000003) [...] --- read R BLOCK * OK [CAPABILITY IMAP4rev1 SASL-IR LOGIN-REFERRALS ID ENABLE IDLE LITERAL+ AUTH=PLAIN AUTH=LOGIN] Dovecot (Debian) ready. A LOGIN REDACTED REDACTED A OK [CAPABILITY IMAP4rev1 SASL-IR LOGIN-REFERRALS ID ENABLE IDLE SORT SORT=DISPLAY THREAD=REFERENCES THREAD=REFS THREAD=ORDEREDSUBJECT MULTIAPPEND URL-PARTIAL CATENATE UNSELECT CHILDREN NAMESPACE UIDPLUS LIST-EXTENDED I18NLEVEL=1 CONDSTORE QRESYNC ESEARCH ESORT SEARCHRES WITHIN CONTEXT=SEARCH LIST-STATUS BINARY MOVE SNIPPET=FUZZY PREVIEW=FUZZY STATUS=SIZE SAVEDATE LITERAL+ NOTIFY SPECIAL-USE] Logged in A SELECT INBOX (CONDSTORE) * FLAGS (\Answered \Flagged \Deleted \Seen \Draft $MDNSent Junk NonJunk $label4 $label1 $label2 $label3 $label5 Old $Forwarded NOTJUNK $has_cal) * OK [PERMANENTFLAGS (\Answered \Flagged \Deleted \Seen \Draft $MDNSent Junk NonJunk $label4 $label1 $label2 $label3 $label5 Old $Forwarded NOTJUNK $has_cal \*)] Flags permitted. * 7286 EXISTS * 0 RECENT * OK [UIDVALIDITY 1291740963] UIDs valid * OK [UIDNEXT 158448] Predicted next UID * OK [HIGHESTMODSEQ 190086] Highest A OK [READ-WRITE] Select completed (0.001 + 0.000 secs). A SELECT INBOX (CONDSTORE) * FLAGS (\Answered \Flagged \Deleted \Seen \Draft $MDNSent Junk NonJunk $label4 $label1 $label2 $label3 $label5 Old $Forwarded NOTJUNK $has_cal) * OK [PERMANENTFLAGS (\Answered \Flagged \Deleted \Seen \Draft $MDNSent Junk NonJunk $label4 $label1 $label2 $label3 $label5 Old $Forwarded NOTJUNK $has_cal \*)] Flags permitted. * 7288 EXISTS * 0 RECENT * OK [UIDVALIDITY 1291740963] UIDs valid * OK [UIDNEXT 158450] Predicted next UID * OK [HIGHESTMODSEQ 190086] Highest A OK [READ-WRITE] Select completed (0.002 + 0.000 + 0.001 secs). The Groupware's IMAP client library is reporting, that MODSEQ is not increasing. It stays at 190086, nevertheless I receive new e-mail. I have tried the commands doveadm index and doveadm force-resync on the INBOX, without any change. My filesystem where the mailboxes reside is on ext4. Can you help me what is wrong? Best regards, Ronny Forberger -- Ronny Forberger ronnyforberger(a)ronnyforberger.de

1 1

Some info to configure OAuth2 using Keycloak
by Gary Horchem 02 Dec '22

02 Dec '22

Hello I’m about to configure and test Dovecot with Keycloak. When do you use the dovecot-oauth2.token.conf.ext and/or dovecot-oauth2.plain.conf.ext over dovecot-oauth2.token.conf.ext Thanks. and/or Sent from my iPhone

2 1

Doveadm Move Query
by Simon B 01 Dec '22

01 Dec '22

I have a production Dovecot problem and although I searched the mailing lists, I could not find an answer and I hope you can give me a quick answer/pointer in the right direction. I have mails for a user (user(a)domain.net) under /var/spool/mail/virtual/ domain.net/user and I want to move ALL the mails to /var/spool/mail/virtual/domain.com/user If I use #doveadm -Dv move -u user(a)domain.net Maildir:/var/spool/mail/virtual/ domain.net/user Maildir:/var/spool/mail/virtual/domain.com/user ALL I get doveadm(root): Fatal: Unknown argument MAILDIR:/var/spool/mail/virtual/ domain.com/user if I use #doveadm -Dv move -u user(a)domain.net Maildir:/var/spool/mail/virtual/ domain.net/user /var/spool/mail/virtual/domain.com/user ALL doveadm(root): Fatal: Unknown argument /var/spool/mail/virtual/ domain.com/user What the hell am I doing wrong!? :) Thanks. Simon

3 3

Can't figure out why managesieve (pigeonhole) can't connect
by colin＠colinlikesfood.com 27 Nov '22

27 Nov '22

Subject line says it all? I am using Roundcube, and every time i click on "filters" i get RC's "unable to connect to server" message. This might be an SQL error, but i can't figure out how to pull the relevant logs yet. Please see below and any advice you have is so very appreciated SYSLOG: ------------------- Nov 22 10:29:27 mail roundcube[66295]: <keirks4p> PHP Error: Connection refused (GET /index.php?_task=settings&_action=plugin.managesieve) Nov 22 10:29:27 mail roundcube[66295]: <keirks4p> PHP Error: Unable to connect to managesieve on obfuscated.domain:4190 in /usr/local/www/roundcube/plugins/managesieve/lib/Roundcube/rcube_sieve_engine.php on line 221 (GET /index.php?_task=settings&_action=plugin.managesieve) Nov 22 10:29:27 mail roundcube[66295]: <keirks4p> PHP Error: Not currently in AUTHORISATION state (GET /index.php?_task=settings&_action=plugin.managesieve) Nov 22 10:29:27 mail php[66295]: <keirks4p> PHP Error: Not currently connected (GET /index.php?_task=settings&_action=plugin.managesieve) Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> PHP Error: Connection refused (GET /index.php?_task=settings&_action=plugin.managesieve-action&_framed=1&_nav=hide) Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> PHP Error: Unable to connect to managesieve on obfuscated.domain:4190 in /usr/local/www/roundcube/plugins/managesieve/lib/Roundcube/rcube_sieve_engine.php on line 221 (GET /index.php?_task=settings&_action=plugin.managesieve-action&_framed=1&_nav=hide) Nov 22 10:29:31 mail php[66295]: <keirks4p> PHP Error: Not currently connected (GET /index.php?_task=settings&_action=plugin.managesieve-action&_framed=1&_nav=hide) Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> PHP Error: Connection refused (POST /?_task=settings&_action=plugin.managesieve-save) Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> PHP Error: Unable to connect to managesieve on obfuscated.domain:4190 in /usr/local/www/roundcube/plugins/managesieve/lib/Roundcube/rcube_sieve_engine.php on line 221 (POST /?_task=settings&_action=plugin.managesieve-save) Nov 22 10:29:43 mail roundcube[71055]: PHP Warning: Trying to access array offset on value of type null in /usr/local/www/roundcube/plugins/managesieve/lib/Roundcube/rcube_sieve_engine.php on line 1065 Nov 22 10:29:43 mail php[71055]: <keirks4p> PHP Error: Not currently connected (POST /?_task=settings&_action=plugin.managesieve-save) DOVECOT.LOG: ------------------- Nov 22 10:28:58 mail roundcube[66297]: <keirks4p> [43CD] C: A0008 LOGOUT Nov 22 10:28:58 mail dovecot[8514]: imap(obfuscated(a)user.name)<8609><XgBCqxHusXAKAAAB>: Disconnected: Logged out in=219 out=1045 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0 Nov 22 10:28:58 mail roundcube[66297]: <keirks4p> [43CD] S: * BYE Logging out Nov 22 10:28:58 mail roundcube[66297]: <keirks4p> [43CD] S: A0008 OK Logout completed (0.001 + 0.000 secs). Nov 22 10:29:25 mail roundcube[66295]: <keirks4p> [1] SELECT "vars", "ip", "changed", datetime('now') AS ts, CASE WHEN "changed" < datetime('now', '-600 seconds') THEN 1 ELSE 0 END AS expired FROM "session" WHERE "sess_id" = 'keirks4pbepr17um9mvj1qsvt2'; Nov 22 10:29:25 mail roundcube[66295]: <keirks4p> [2] SELECT * FROM "users" WHERE "user_id" = '2'; Nov 22 10:29:25 mail roundcube[66295]: <keirks4p> [3] UPDATE "session" SET "changed" = datetime('now'), "vars" = 'bGFuZ3VhZ2V8czo1OiJlbl9VUyI7aW1hcF9uYW1lc3BhY2V8YTo0OntzOjg6InBlcnNvbmFsIjthOjE6e2k6MDthOjI6e2k6MDtzOjA6IiI7aToxO3M6MToiLyI7fX1zOjU6Im90aGVyIjtOO3M6Njoic2hhcmVkIjtOO3M6MTA6InByZWZpeF9vdXQiO3M6MDoiIjt9aW1hcF9kZWxpbWl0ZXJ8czoxOiIvIjtpbWFwX2xpc3RfY29uZnxhOjI6e2k6MDtOO2k6MTthOjA6e319dXNlcl9pZHxpOjI7dXNlcm5hbWV8czoyNDoiY29saW5AY29saW5saWtlc2Zvb2QuY29tIjtzdG9yYWdlX2hvc3R8czoxODoiY29saW5saWtlc2Zvb2QuY29tIjtzdG9yYWdlX3BvcnR8aToxNDM7c3RvcmFnZV9zc2x8czozOiJ0bHMiO3Bhc3N3b3JkfHM6NDQ6ImNYOCt0VmJXV010VEMxRTlXQVB4ZjVOSlU1bWlKa2ZveC8xRWpuZVB2Ym89Ijtsb2dpbl90aW1lfGk6MTY2OTA2MzM4OTt0aW1lem9uZXxzOjE1OiJBbWVyaWNhL0NoaWNhZ28iO2F1dGhfc2VjcmV0fHM6MjY6ImNHdkc4ZWR5QmFmNWJITVpISG5sTEY3ZmpZIjtyZXF1ZXN0X3Rva2VufHM6MzI6IkM5VXlNNVBMUnhSeERiVm9HTlNMNjdVZ05NaWE4WVZGIjt0YXNrfHM6ODoic2V0dGluZ3MiO3NraW5fY29uZmlnfGE6Nzp7czoxNzoic3VwcG9ydGVkX2xheW91dHMiO2E6MTp7aTowO3M6MTA6IndpZGVzY3JlZW4iO31zOjIyOiJqcXVlcnlfdWlfY29sb3JzX3RoZW1lIjtzOjk6ImJvb3RzdHJhcCI7czoxODoiZW1iZWRfY3NzX2xvY2F0aW9uIjtzOjE3OiIvc3R5bGVzL2VtYmVkLmNzcyI7c zoxOToiZWRpdG9yX2Nzc19sb2NhdGlvbiI7czoxNzoiL3N0eWxlcy9lbWJlZC5jc3MiO3M6MTc6ImRhcmtfbW9kZV9zdXBwb3J0IjtiOjE7czoyNjoibWVkaWFfYnJvd3Nlcl9jc3NfbG9jYXRpb24iO3M6NDoibm9uZSI7czoyMToiYWRkaXRpb25hbF9sb2dvX3R5cGVzIjthOjM6e2k6MDtzOjQ6ImRhcmsiO2k6MTtzOjU6InNtYWxsIjtpOjI7czoxMDoic21hbGwtZGFyayI7fX1pbWFwX2hvc3R8czoxODoiY29saW5saWtlc2Zvb2QuY29tIjttYm94fHM6NToiSU5CT1giO3NvcnRfY29sfHM6MDoiIjtzb3J0X29yZGVyfHM6NDoiREVTQyI7U1RPUkFHRV9USFJFQUR8YTozOntpOjA7czoxMDoiUkVGRVJFTkNFUyI7aToxO3M6NDoiUkVGUyI7aToyO3M6MTQ6Ik9SREVSRURTVUJKRUNUIjt9U1RPUkFHRV9RVU9UQXxiOjA7U1RPUkFHRV9MSVNULUVYVEVOREVEfGI6MTtsaXN0X2F0dHJpYnxhOjc6e3M6NDoibmFtZSI7czo4OiJtZXNzYWdlcyI7czoyOiJpZCI7czoxMToibWVzc2FnZWxpc3QiO3M6NToiY2xhc3MiO3M6NDI6Imxpc3RpbmcgbWVzc2FnZWxpc3Qgc29ydGhlYWRlciBmaXhlZGhlYWRlciI7czoxNToiYXJpYS1sYWJlbGxlZGJ5IjtzOjIyOiJhcmlhLWxhYmVsLW1lc3NhZ2VsaXN0IjtzOjk6ImRhdGEtbGlzdCI7czoxMjoibWVzc2FnZV9saXN0IjtzOjE0OiJkYXRhLWxhYmVsLW1zZyI7czoxODoi Nov 22 10:29:27 mail roundcube[66295]: <keirks4p> [1] SELECT "vars", "ip", "changed", datetime('now') AS ts, CASE WHEN "changed" < datetime('now', '-600 seconds') THEN 1 ELSE 0 END AS expired FROM "session" WHERE "sess_id" = 'keirks4pbepr17um9mvj1qsvt2'; Nov 22 10:29:27 mail roundcube[66295]: <keirks4p> [2] SELECT * FROM "users" WHERE "user_id" = '2'; Nov 22 10:29:27 mail roundcube[66295]: <keirks4p> PHP Error: Connection refused (GET /index.php?_task=settings&_action=plugin.managesieve) Nov 22 10:29:27 mail roundcube[66295]: <keirks4p> PHP Error: Unable to connect to managesieve on obfuscated.domain:4190 in /usr/local/www/roundcube/plugins/managesieve/lib/Roundcube/rcube_sieve_engine.php on line 221 (GET /index.php?_task=settings&_action=plugin.managesieve) Nov 22 10:29:27 mail roundcube[66295]: <keirks4p> PHP Error: Not currently in AUTHORISATION state (GET /index.php?_task=settings&_action=plugin.managesieve) Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [1] SELECT "vars", "ip", "changed", datetime('now') AS ts, CASE WHEN "changed" < datetime('now', '-600 seconds') THEN 1 ELSE 0 END AS expired FROM "session" WHERE "sess_id" = 'keirks4pbepr17um9mvj1qsvt2'; Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [2] SELECT * FROM "users" WHERE "user_id" = '2'; Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> PHP Error: Connection refused (GET /index.php?_task=settings&_action=plugin.managesieve-action&_framed=1&_nav=hide) Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> PHP Error: Unable to connect to managesieve on obfuscated.domain:4190 in /usr/local/www/roundcube/plugins/managesieve/lib/Roundcube/rcube_sieve_engine.php on line 221 (GET /index.php?_task=settings&_action=plugin.managesieve-action&_framed=1&_nav=hide) Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] Connecting to tls://obfuscated.domain:143... Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] S: * OK [CAPABILITY IMAP4rev1 SASL-IR LOGIN-REFERRALS ID ENABLE IDLE LITERAL+ STARTTLS LOGINDISABLED AUTH=CRAM-MD5] Dovecot ready. Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] C: A0001 STARTTLS Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] S: A0001 OK Begin TLS negotiation now. Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] C: A0002 CAPABILITY Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] S: * CAPABILITY IMAP4rev1 SASL-IR LOGIN-REFERRALS ID ENABLE IDLE LITERAL+ LOGINDISABLED AUTH=CRAM-MD5 Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] S: A0002 OK Pre-login capabilities listed, post-login capabilities have more. Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] C: A0003 AUTHENTICATE CRAM-MD5 Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] S: + PDI3MjU4Mjg1ODUxMTkzMTEuMTY2OTEzNDU3MUBtYWlsPg== Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] C: ****** [74] Nov 22 10:29:31 mail dovecot[8514]: imap-login: Login: user=<obfuscated(a)user.name>, method=CRAM-MD5, rip=10.0.0.1, lip=10.0.0.91, mpid=8639, TLS, session=<51k6rRHuw5gKAAAB> Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] S: A0003 OK [CAPABILITY IMAP4rev1 SASL-IR LOGIN-REFERRALS ID ENABLE IDLE SORT SORT=DISPLAY THREAD=REFERENCES THREAD=REFS THREAD=ORDEREDSUBJECT MULTIAPPEND URL-PARTIAL CATENATE UNSELECT CHILDREN NAMESPACE UIDPLUS LIST-EXTENDED I18NLEVEL=1 CONDSTORE QRESYNC ESEARCH ESORT SEARCHRES WITHIN CONTEXT=SEARCH LIST-STATUS BINARY MOVE SNIPPET=FUZZY PREVIEW=FUZZY PREVIEW STATUS=SIZE SAVEDATE LITERAL+ NOTIFY SPECIAL-USE] Logged in Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] C: A0004 ID ("name" "Roundcube" "version" "1.6.0" "php" "8.0.25" "os" "FreeBSD" "command" "/index.php?_task=settings&_action=plugin.managesieve-action&_framed=1&_nav=hide") Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] S: * ID ("name" "Dovecot") Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] S: A0004 OK ID completed (0.001 + 0.000 secs). Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] C: A0005 LIST (SUBSCRIBED) "" "*" Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] S: * LIST (\Subscribed) "/" Drafts Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] S: * LIST (\Subscribed) "/" Junk Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] S: * LIST (\Subscribed) "/" Sent Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] S: * LIST (\Subscribed) "/" Trash Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] S: * LIST (\Subscribed) "/" INBOX/NAS-Alerts Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] S: * LIST (\Subscribed) "/" INBOX/email-reports Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] S: A0005 OK List completed (0.001 + 0.000 secs). Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [3] UPDATE "session" SET "changed" = datetime('now'), "vars" = 'bGFuZ3VhZ2V8czo1OiJlbl9VUyI7aW1hcF9uYW1lc3BhY2V8YTo0OntzOjg6InBlcnNvbmFsIjthOjE6e2k6MDthOjI6e2k6MDtzOjA6IiI7aToxO3M6MToiLyI7fX1zOjU6Im90aGVyIjtOO3M6Njoic2hhcmVkIjtOO3M6MTA6InByZWZpeF9vdXQiO3M6MDoiIjt9aW1hcF9kZWxpbWl0ZXJ8czoxOiIvIjtpbWFwX2xpc3RfY29uZnxhOjI6e2k6MDtOO2k6MTthOjA6e319dXNlcl9pZHxpOjI7dXNlcm5hbWV8czoyNDoiY29saW5AY29saW5saWtlc2Zvb2QuY29tIjtzdG9yYWdlX2hvc3R8czoxODoiY29saW5saWtlc2Zvb2QuY29tIjtzdG9yYWdlX3BvcnR8aToxNDM7c3RvcmFnZV9zc2x8czozOiJ0bHMiO3Bhc3N3b3JkfHM6NDQ6ImNYOCt0VmJXV010VEMxRTlXQVB4ZjVOSlU1bWlKa2ZveC8xRWpuZVB2Ym89Ijtsb2dpbl90aW1lfGk6MTY2OTA2MzM4OTt0aW1lem9uZXxzOjE1OiJBbWVyaWNhL0NoaWNhZ28iO2F1dGhfc2VjcmV0fHM6MjY6ImNHdkc4ZWR5QmFmNWJITVpISG5sTEY3ZmpZIjtyZXF1ZXN0X3Rva2VufHM6MzI6IkM5VXlNNVBMUnhSeERiVm9HTlNMNjdVZ05NaWE4WVZGIjt0YXNrfHM6ODoic2V0dGluZ3MiO3NraW5fY29uZmlnfGE6Nzp7czoxNzoic3VwcG9ydGVkX2xheW91dHMiO2E6MTp7aTowO3M6MTA6IndpZGVzY3JlZW4iO31zOjIyOiJqcXVlcnlfdWlfY29sb3JzX3RoZW1lIjtzOjk6ImJvb3RzdHJhcCI7czoxODoiZW1iZWRfY3NzX2xvY2F0aW9uIjtzOjE3OiIvc3R5bGVzL2VtYmVkLmNzcyI7c zoxOToiZWRpdG9yX2Nzc19sb2NhdGlvbiI7czoxNzoiL3N0eWxlcy9lbWJlZC5jc3MiO3M6MTc6ImRhcmtfbW9kZV9zdXBwb3J0IjtiOjE7czoyNjoibWVkaWFfYnJvd3Nlcl9jc3NfbG9jYXRpb24iO3M6NDoibm9uZSI7czoyMToiYWRkaXRpb25hbF9sb2dvX3R5cGVzIjthOjM6e2k6MDtzOjQ6ImRhcmsiO2k6MTtzOjU6InNtYWxsIjtpOjI7czoxMDoic21hbGwtZGFyayI7fX1pbWFwX2hvc3R8czoxODoiY29saW5saWtlc2Zvb2QuY29tIjttYm94fHM6NToiSU5CT1giO3NvcnRfY29sfHM6MDoiIjtzb3J0X29yZGVyfHM6NDoiREVTQyI7U1RPUkFHRV9USFJFQUR8YTozOntpOjA7czoxMDoiUkVGRVJFTkNFUyI7aToxO3M6NDoiUkVGUyI7aToyO3M6MTQ6Ik9SREVSRURTVUJKRUNUIjt9U1RPUkFHRV9RVU9UQXxiOjA7U1RPUkFHRV9MSVNULUVYVEVOREVEfGI6MTtsaXN0X2F0dHJpYnxhOjc6e3M6NDoibmFtZSI7czo4OiJtZXNzYWdlcyI7czoyOiJpZCI7czoxMToibWVzc2FnZWxpc3QiO3M6NToiY2xhc3MiO3M6NDI6Imxpc3RpbmcgbWVzc2FnZWxpc3Qgc29ydGhlYWRlciBmaXhlZGhlYWRlciI7czoxNToiYXJpYS1sYWJlbGxlZGJ5IjtzOjIyOiJhcmlhLWxhYmVsLW1lc3NhZ2VsaXN0IjtzOjk6ImRhdGEtbGlzdCI7czoxMjoibWVzc2FnZV9saXN0IjtzOjE0OiJkYXRhLWxhYmVsLW1zZyI7czoxODoi Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] C: A0006 LOGOUT Nov 22 10:29:31 mail dovecot[8514]: imap(obfuscated(a)user.name)<8639><51k6rRHuw5gKAAAB>: Disconnected: Logged out in=215 out=821 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0 Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] S: * BYE Logging out Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] S: A0006 OK Logout completed (0.001 + 0.000 secs). Nov 22 10:29:42 mail roundcube[71055]: <keirks4p> [1] SELECT "vars", "ip", "changed", datetime('now') AS ts, CASE WHEN "changed" < datetime('now', '-600 seconds') THEN 1 ELSE 0 END AS expired FROM "session" WHERE "sess_id" = 'keirks4pbepr17um9mvj1qsvt2'; Nov 22 10:29:42 mail roundcube[71055]: <keirks4p> [2] SELECT * FROM "users" WHERE "user_id" = '2'; Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> PHP Error: Connection refused (POST /?_task=settings&_action=plugin.managesieve-save) Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> PHP Error: Unable to connect to managesieve on obfuscated.domain:4190 in /usr/local/www/roundcube/plugins/managesieve/lib/Roundcube/rcube_sieve_engine.php on line 221 (POST /?_task=settings&_action=plugin.managesieve-save) Nov 22 10:29:43 mail roundcube[71055]: PHP Warning: Trying to access array offset on value of type null in /usr/local/www/roundcube/plugins/managesieve/lib/Roundcube/rcube_sieve_engine.php on line 1065 Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] Connecting to tls://obfuscated.domain:143... Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] S: * OK [CAPABILITY IMAP4rev1 SASL-IR LOGIN-REFERRALS ID ENABLE IDLE LITERAL+ STARTTLS LOGINDISABLED AUTH=CRAM-MD5] Dovecot ready. Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] C: A0001 STARTTLS Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] S: A0001 OK Begin TLS negotiation now. Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] C: A0002 CAPABILITY Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] S: * CAPABILITY IMAP4rev1 SASL-IR LOGIN-REFERRALS ID ENABLE IDLE LITERAL+ LOGINDISABLED AUTH=CRAM-MD5 Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] S: A0002 OK Pre-login capabilities listed, post-login capabilities have more. Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] C: A0003 AUTHENTICATE CRAM-MD5 Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] S: + PDE2NjcxMDUwNTU2NDcwMTMuMTY2OTEzNDU4M0BtYWlsPg== Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] C: ****** [74] Nov 22 10:29:43 mail dovecot[8514]: imap-login: Login: user=<obfuscated(a)user.name>, method=CRAM-MD5, rip=10.0.0.1, lip=10.0.0.91, mpid=8644, TLS, session=<677prRHu4aAKAAAB> Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] S: A0003 OK [CAPABILITY IMAP4rev1 SASL-IR LOGIN-REFERRALS ID ENABLE IDLE SORT SORT=DISPLAY THREAD=REFERENCES THREAD=REFS THREAD=ORDEREDSUBJECT MULTIAPPEND URL-PARTIAL CATENATE UNSELECT CHILDREN NAMESPACE UIDPLUS LIST-EXTENDED I18NLEVEL=1 CONDSTORE QRESYNC ESEARCH ESORT SEARCHRES WITHIN CONTEXT=SEARCH LIST-STATUS BINARY MOVE SNIPPET=FUZZY PREVIEW=FUZZY PREVIEW STATUS=SIZE SAVEDATE LITERAL+ NOTIFY SPECIAL-USE] Logged in Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] C: A0004 ID ("name" "Roundcube" "version" "1.6.0" "php" "8.0.25" "os" "FreeBSD" "command" "/") Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] S: * ID ("name" "Dovecot") Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] S: A0004 OK ID completed (0.001 + 0.000 secs). Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] C: A0005 LIST (SUBSCRIBED) "" "*" Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] S: * LIST (\Subscribed) "/" Drafts Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] S: * LIST (\Subscribed) "/" Junk Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] S: * LIST (\Subscribed) "/" Sent Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] S: * LIST (\Subscribed) "/" Trash Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] S: * LIST (\Subscribed) "/" INBOX/NAS-Alerts Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] S: * LIST (\Subscribed) "/" INBOX/email-reports Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] S: A0005 OK List completed (0.001 + 0.000 secs). Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] C: A0006 LOGOUT Nov 22 10:29:43 mail dovecot[8514]: imap(obfuscated(a)user.name)<8644><677prRHu4aAKAAAB>: Disconnected: Logged out in=137 out=821 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0 Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] S: * BYE Logging out Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] S: A0006 OK Logout completed (0.001 + 0.000 secs). DOVECOT INFO: ------------------------ # dovecot --version 2.3.19.1 (9b53102964) # dovecot -n # 2.3.19.1 (9b53102964): /usr/local/etc/dovecot/dovecot.conf # Pigeonhole version 0.5.19 (4eae2f79) # OS: FreeBSD 13.1-RELEASE-p2 amd64 zfs # Hostname: localhost auth_mechanisms = cram-md5 first_valid_gid = 10000 first_valid_uid = 10000 mail_location = maildir:/var/mail/users/%u managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext namespace inbox { inbox = yes location = mailbox Drafts { auto = create special_use = \Drafts } mailbox Junk { auto = create special_use = \Junk } mailbox Sent { auto = create special_use = \Sent } mailbox Trash { auto = create special_use = \Trash } prefix = separator = / } passdb { args = username_format=%u /usr/local/etc/dovecot/users driver = passwd-file } plugin { sieve = file:/usr/local/etc/dovecot/sieve;active=/usr/local/etc/dovecot/sieve/.dovecot.sieve sieve_before = /usr/local/etc/dovecot/sieve/before-global.sieve sieve_default = /usr/local/etc/dovecot/sieve/default.sieve sieve_global = /usr/local/etc/dovecot/sieve/global/ } protocols = imap lmtp sieve service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0666 user = postfix } } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0660 user = postfix } } service managesieve-login { inet_listener sieve { port = 4190 } } ssl_cert = </usr/local/etc/letsencrypt/live/obfuscated.domain/fullchain.pem ssl_cipher_list = HIGH:!aNULL:!AES128:!SSLv2 ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it syslog_facility = local1 userdb { args = username_format=%u /usr/local/etc/dovecot/users driver = passwd-file } protocol lmtp { mail_plugins = " sieve" } protocol sieve { info_log_path = /var/log/dovecot-sieve.log log_path = /var/log/dovecot-sieve-errors.log managesieve_implementation_string = dovecot managesieve_max_line_length = 64 k } THANKS! Colin

5 9

bug: ARGON2 hash selection incompatible with LDAP
by Krisztián Szegi 25 Nov '22

25 Nov '22

Good day to all, this is my first post to the mailing list! I'd like to report that non-binding auth to (Open)LDAP doesn't work if the latter hashes passwords with ARGON2. Although dovecot (I am using http://2.3.19.1) does support ARGON2 with libsodium, but it doesn't recoginize hashes beginning "{ARGON2}$argon2id$" stored (and hashed, using ppolicy module's hashCleartext) by OpenLDAP. Now, I understand that ARGON2I, -D, and -ID are not compatible, but the ACTUAL algorithm is there between the two $. Furthermore, I think dovecot is in the minority here, I haven't met any software that specifies the ARGON2 subtype between {}. BTW, I haven't met any software that hashes passwords with ARGON2, but not with the ARGON2ID subtype (where libsodium is available, which also seems to be the standard here), as THAT is the recommended one anyway. I patched the rpm in OpenSUSE repo to alias {ARGON2} to {ARGON2ID}: https://build.opensuse.org/package/view_file/home:Samonitari:branches:openS… Could we get something like this (but maybe more correct) into the official source? Maybe a config switch to alias it runtime? Thanks for the attention: Krisztián

3 3

Dovecot and TLSv1 on ubuntu 22.04
by Six002 24 Nov '22

24 Nov '22

Hello, I have ubuntu 22.04, dovecot 2.3.16 and old email client (Outlook 2013) and their dont support TLSv1_2. In dovecot 10-ssl.conf i put: ssl_min_protocol = TLSv1, in openssl.cnf i have: openssl_conf = default_conf [ default_conf ] ssl_conf = ssl_section [ssl_section] system_default = ssl_default_sectq [ssl_default_sect] MinProtocol = TLSv1CipherString = DEFAULT:@SECLEVEL=1 but when i check openssl s_client -connect localhost:993 -tls1_1 have output: CONNECTED(00000003) 803BD26AC67F0000:error:0A000126:SSL routines:ssl3_read_n:unexpected eof while reading:../ssl/record/rec_layer_s3.c:308: --- no peer certificate available --- No client certificate CA names sent --- SSL handshake has read 0 bytes and written 111 bytes Verification: OK --- New, (NONE), Cipher is (NONE) Secure Renegotiation IS NOT supported Compression: NONE Expansion: NONE No ALPN negotiated SSL-Session: Protocol : TLSv1.1 Cipher : 0000 Session-ID: Session-ID-ctx: Master-Key: PSK identity: None PSK identity hint: None SRP username: None Start Time: 1668602712 Timeout : 7200 (sec) Verify return code: 0 (ok) Extended master secret: no --- version tls1_2 and 1_3 works fine. What I doing wrong?Thanks for help.

3 2

compiled sieve files svbin ?
by jeremy ardley 23 Nov '22

23 Nov '22

Hi, I have recently started using claws mail to manage my user sieve scripts using server dovecot-sieve_1%3a2.3.13+dfsg1-2_arm64.deb I originally edited ~/.dovecot.sieve to hold my script and I recall that ~/.dovecot.svbin was automatically generated on first use. (either that or I have forgotten that I had used sievec) Later I used claws mail to generate sieve scripts but they were written into directory ~/sieve/ In experimentation I changed ~/.dovecot.sieve into a link to my principal script ~/sieve/main.sieve The oddity now is that sieve seems to be working when there is no compiled version Should I expect a compiled .svbin version to be generated from claws client? Or generated by first run of the sieve server on the user account? Or should I manage the scripts with claws, but log in to the server later to generate the .svbin versions? In any event what effect does not having a .svbin version have on typical small installation? -- Jeremy

2 1

Can't figure out why managesieve (pigeonhole) can't connect
by colin＠colinlikesfood.com 22 Nov '22

22 Nov '22

Subject line says it all? I am using Roundcube, and every time i click on "filters" i get RC's "unable to connect to server" message. This might be an SQL error, but i can't figure out how to pull the relevant logs yet. Please see below and any advice you have is so very appreciated SYSLOG: ------------------- Nov 22 10:29:27 mail roundcube[66295]: <keirks4p> PHP Error: Connection refused (GET /index.php?_task=settings&_action=plugin.managesieve) Nov 22 10:29:27 mail roundcube[66295]: <keirks4p> PHP Error: Unable to connect to managesieve on obfuscated.domain:4190 in /usr/local/www/roundcube/plugins/managesieve/lib/Roundcube/rcube_sieve_engine.php on line 221 (GET /index.php?_task=settings&_action=plugin.managesieve) Nov 22 10:29:27 mail roundcube[66295]: <keirks4p> PHP Error: Not currently in AUTHORISATION state (GET /index.php?_task=settings&_action=plugin.managesieve) Nov 22 10:29:27 mail php[66295]: <keirks4p> PHP Error: Not currently connected (GET /index.php?_task=settings&_action=plugin.managesieve) Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> PHP Error: Connection refused (GET /index.php?_task=settings&_action=plugin.managesieve-action&_framed=1&_nav=hide) Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> PHP Error: Unable to connect to managesieve on obfuscated.domain:4190 in /usr/local/www/roundcube/plugins/managesieve/lib/Roundcube/rcube_sieve_engine.php on line 221 (GET /index.php?_task=settings&_action=plugin.managesieve-action&_framed=1&_nav=hide) Nov 22 10:29:31 mail php[66295]: <keirks4p> PHP Error: Not currently connected (GET /index.php?_task=settings&_action=plugin.managesieve-action&_framed=1&_nav=hide) Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> PHP Error: Connection refused (POST /?_task=settings&_action=plugin.managesieve-save) Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> PHP Error: Unable to connect to managesieve on obfuscated.domain:4190 in /usr/local/www/roundcube/plugins/managesieve/lib/Roundcube/rcube_sieve_engine.php on line 221 (POST /?_task=settings&_action=plugin.managesieve-save) Nov 22 10:29:43 mail roundcube[71055]: PHP Warning: Trying to access array offset on value of type null in /usr/local/www/roundcube/plugins/managesieve/lib/Roundcube/rcube_sieve_engine.php on line 1065 Nov 22 10:29:43 mail php[71055]: <keirks4p> PHP Error: Not currently connected (POST /?_task=settings&_action=plugin.managesieve-save) DOVECOT.LOG: ------------------- Nov 22 10:28:58 mail roundcube[66297]: <keirks4p> [43CD] C: A0008 LOGOUT Nov 22 10:28:58 mail dovecot[8514]: imap(obfuscated(a)user.name)<8609><XgBCqxHusXAKAAAB>: Disconnected: Logged out in=219 out=1045 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0 Nov 22 10:28:58 mail roundcube[66297]: <keirks4p> [43CD] S: * BYE Logging out Nov 22 10:28:58 mail roundcube[66297]: <keirks4p> [43CD] S: A0008 OK Logout completed (0.001 + 0.000 secs). Nov 22 10:29:25 mail roundcube[66295]: <keirks4p> [1] SELECT "vars", "ip", "changed", datetime('now') AS ts, CASE WHEN "changed" < datetime('now', '-600 seconds') THEN 1 ELSE 0 END AS expired FROM "session" WHERE "sess_id" = 'keirks4pbepr17um9mvj1qsvt2'; Nov 22 10:29:25 mail roundcube[66295]: <keirks4p> [2] SELECT * FROM "users" WHERE "user_id" = '2'; Nov 22 10:29:25 mail roundcube[66295]: <keirks4p> [3] UPDATE "session" SET "changed" = datetime('now'), "vars" = 'bGFuZ3VhZ2V8czo1OiJlbl9VUyI7aW1hcF9uYW1lc3BhY2V8YTo0OntzOjg6InBlcnNvbmFsIjthOjE6e2k6MDthOjI6e2k6MDtzOjA6IiI7aToxO3M6MToiLyI7fX1zOjU6Im90aGVyIjtOO3M6Njoic2hhcmVkIjtOO3M6MTA6InByZWZpeF9vdXQiO3M6MDoiIjt9aW1hcF9kZWxpbWl0ZXJ8czoxOiIvIjtpbWFwX2xpc3RfY29uZnxhOjI6e2k6MDtOO2k6MTthOjA6e319dXNlcl9pZHxpOjI7dXNlcm5hbWV8czoyNDoiY29saW5AY29saW5saWtlc2Zvb2QuY29tIjtzdG9yYWdlX2hvc3R8czoxODoiY29saW5saWtlc2Zvb2QuY29tIjtzdG9yYWdlX3BvcnR8aToxNDM7c3RvcmFnZV9zc2x8czozOiJ0bHMiO3Bhc3N3b3JkfHM6NDQ6ImNYOCt0VmJXV010VEMxRTlXQVB4ZjVOSlU1bWlKa2ZveC8xRWpuZVB2Ym89Ijtsb2dpbl90aW1lfGk6MTY2OTA2MzM4OTt0aW1lem9uZXxzOjE1OiJBbWVyaWNhL0NoaWNhZ28iO2F1dGhfc2VjcmV0fHM6MjY6ImNHdkc4ZWR5QmFmNWJITVpISG5sTEY3ZmpZIjtyZXF1ZXN0X3Rva2VufHM6MzI6IkM5VXlNNVBMUnhSeERiVm9HTlNMNjdVZ05NaWE4WVZGIjt0YXNrfHM6ODoic2V0dGluZ3MiO3NraW5fY29uZmlnfGE6Nzp7czoxNzoic3VwcG9ydGVkX2xheW91dHMiO2E6MTp7aTowO3M6MTA6IndpZGVzY3JlZW4iO31zOjIyOiJqcXVlcnlfdWlfY29sb3JzX3RoZW1lIjtzOjk6ImJvb3RzdHJhcCI7czoxODoiZW1iZWRfY3NzX2xvY2F0aW9uIjtzOjE3OiIvc3R5bGVzL2VtYmVkLmNzcyI7c zoxOToiZWRpdG9yX2Nzc19sb2NhdGlvbiI7czoxNzoiL3N0eWxlcy9lbWJlZC5jc3MiO3M6MTc6ImRhcmtfbW9kZV9zdXBwb3J0IjtiOjE7czoyNjoibWVkaWFfYnJvd3Nlcl9jc3NfbG9jYXRpb24iO3M6NDoibm9uZSI7czoyMToiYWRkaXRpb25hbF9sb2dvX3R5cGVzIjthOjM6e2k6MDtzOjQ6ImRhcmsiO2k6MTtzOjU6InNtYWxsIjtpOjI7czoxMDoic21hbGwtZGFyayI7fX1pbWFwX2hvc3R8czoxODoiY29saW5saWtlc2Zvb2QuY29tIjttYm94fHM6NToiSU5CT1giO3NvcnRfY29sfHM6MDoiIjtzb3J0X29yZGVyfHM6NDoiREVTQyI7U1RPUkFHRV9USFJFQUR8YTozOntpOjA7czoxMDoiUkVGRVJFTkNFUyI7aToxO3M6NDoiUkVGUyI7aToyO3M6MTQ6Ik9SREVSRURTVUJKRUNUIjt9U1RPUkFHRV9RVU9UQXxiOjA7U1RPUkFHRV9MSVNULUVYVEVOREVEfGI6MTtsaXN0X2F0dHJpYnxhOjc6e3M6NDoibmFtZSI7czo4OiJtZXNzYWdlcyI7czoyOiJpZCI7czoxMToibWVzc2FnZWxpc3QiO3M6NToiY2xhc3MiO3M6NDI6Imxpc3RpbmcgbWVzc2FnZWxpc3Qgc29ydGhlYWRlciBmaXhlZGhlYWRlciI7czoxNToiYXJpYS1sYWJlbGxlZGJ5IjtzOjIyOiJhcmlhLWxhYmVsLW1lc3NhZ2VsaXN0IjtzOjk6ImRhdGEtbGlzdCI7czoxMjoibWVzc2FnZV9saXN0IjtzOjE0OiJkYXRhLWxhYmVsLW1zZyI7czoxODoi Nov 22 10:29:27 mail roundcube[66295]: <keirks4p> [1] SELECT "vars", "ip", "changed", datetime('now') AS ts, CASE WHEN "changed" < datetime('now', '-600 seconds') THEN 1 ELSE 0 END AS expired FROM "session" WHERE "sess_id" = 'keirks4pbepr17um9mvj1qsvt2'; Nov 22 10:29:27 mail roundcube[66295]: <keirks4p> [2] SELECT * FROM "users" WHERE "user_id" = '2'; Nov 22 10:29:27 mail roundcube[66295]: <keirks4p> PHP Error: Connection refused (GET /index.php?_task=settings&_action=plugin.managesieve) Nov 22 10:29:27 mail roundcube[66295]: <keirks4p> PHP Error: Unable to connect to managesieve on obfuscated.domain:4190 in /usr/local/www/roundcube/plugins/managesieve/lib/Roundcube/rcube_sieve_engine.php on line 221 (GET /index.php?_task=settings&_action=plugin.managesieve) Nov 22 10:29:27 mail roundcube[66295]: <keirks4p> PHP Error: Not currently in AUTHORISATION state (GET /index.php?_task=settings&_action=plugin.managesieve) Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [1] SELECT "vars", "ip", "changed", datetime('now') AS ts, CASE WHEN "changed" < datetime('now', '-600 seconds') THEN 1 ELSE 0 END AS expired FROM "session" WHERE "sess_id" = 'keirks4pbepr17um9mvj1qsvt2'; Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [2] SELECT * FROM "users" WHERE "user_id" = '2'; Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> PHP Error: Connection refused (GET /index.php?_task=settings&_action=plugin.managesieve-action&_framed=1&_nav=hide) Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> PHP Error: Unable to connect to managesieve on obfuscated.domain:4190 in /usr/local/www/roundcube/plugins/managesieve/lib/Roundcube/rcube_sieve_engine.php on line 221 (GET /index.php?_task=settings&_action=plugin.managesieve-action&_framed=1&_nav=hide) Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] Connecting to tls://obfuscated.domain:143... Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] S: * OK [CAPABILITY IMAP4rev1 SASL-IR LOGIN-REFERRALS ID ENABLE IDLE LITERAL+ STARTTLS LOGINDISABLED AUTH=CRAM-MD5] Dovecot ready. Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] C: A0001 STARTTLS Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] S: A0001 OK Begin TLS negotiation now. Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] C: A0002 CAPABILITY Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] S: * CAPABILITY IMAP4rev1 SASL-IR LOGIN-REFERRALS ID ENABLE IDLE LITERAL+ LOGINDISABLED AUTH=CRAM-MD5 Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] S: A0002 OK Pre-login capabilities listed, post-login capabilities have more. Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] C: A0003 AUTHENTICATE CRAM-MD5 Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] S: + PDI3MjU4Mjg1ODUxMTkzMTEuMTY2OTEzNDU3MUBtYWlsPg== Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] C: ****** [74] Nov 22 10:29:31 mail dovecot[8514]: imap-login: Login: user=<obfuscated(a)user.name>, method=CRAM-MD5, rip=10.0.0.1, lip=10.0.0.91, mpid=8639, TLS, session=<51k6rRHuw5gKAAAB> Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] S: A0003 OK [CAPABILITY IMAP4rev1 SASL-IR LOGIN-REFERRALS ID ENABLE IDLE SORT SORT=DISPLAY THREAD=REFERENCES THREAD=REFS THREAD=ORDEREDSUBJECT MULTIAPPEND URL-PARTIAL CATENATE UNSELECT CHILDREN NAMESPACE UIDPLUS LIST-EXTENDED I18NLEVEL=1 CONDSTORE QRESYNC ESEARCH ESORT SEARCHRES WITHIN CONTEXT=SEARCH LIST-STATUS BINARY MOVE SNIPPET=FUZZY PREVIEW=FUZZY PREVIEW STATUS=SIZE SAVEDATE LITERAL+ NOTIFY SPECIAL-USE] Logged in Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] C: A0004 ID ("name" "Roundcube" "version" "1.6.0" "php" "8.0.25" "os" "FreeBSD" "command" "/index.php?_task=settings&_action=plugin.managesieve-action&_framed=1&_nav=hide") Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] S: * ID ("name" "Dovecot") Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] S: A0004 OK ID completed (0.001 + 0.000 secs). Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] C: A0005 LIST (SUBSCRIBED) "" "*" Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] S: * LIST (\Subscribed) "/" Drafts Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] S: * LIST (\Subscribed) "/" Junk Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] S: * LIST (\Subscribed) "/" Sent Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] S: * LIST (\Subscribed) "/" Trash Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] S: * LIST (\Subscribed) "/" INBOX/NAS-Alerts Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] S: * LIST (\Subscribed) "/" INBOX/email-reports Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] S: A0005 OK List completed (0.001 + 0.000 secs). Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [3] UPDATE "session" SET "changed" = datetime('now'), "vars" = 'bGFuZ3VhZ2V8czo1OiJlbl9VUyI7aW1hcF9uYW1lc3BhY2V8YTo0OntzOjg6InBlcnNvbmFsIjthOjE6e2k6MDthOjI6e2k6MDtzOjA6IiI7aToxO3M6MToiLyI7fX1zOjU6Im90aGVyIjtOO3M6Njoic2hhcmVkIjtOO3M6MTA6InByZWZpeF9vdXQiO3M6MDoiIjt9aW1hcF9kZWxpbWl0ZXJ8czoxOiIvIjtpbWFwX2xpc3RfY29uZnxhOjI6e2k6MDtOO2k6MTthOjA6e319dXNlcl9pZHxpOjI7dXNlcm5hbWV8czoyNDoiY29saW5AY29saW5saWtlc2Zvb2QuY29tIjtzdG9yYWdlX2hvc3R8czoxODoiY29saW5saWtlc2Zvb2QuY29tIjtzdG9yYWdlX3BvcnR8aToxNDM7c3RvcmFnZV9zc2x8czozOiJ0bHMiO3Bhc3N3b3JkfHM6NDQ6ImNYOCt0VmJXV010VEMxRTlXQVB4ZjVOSlU1bWlKa2ZveC8xRWpuZVB2Ym89Ijtsb2dpbl90aW1lfGk6MTY2OTA2MzM4OTt0aW1lem9uZXxzOjE1OiJBbWVyaWNhL0NoaWNhZ28iO2F1dGhfc2VjcmV0fHM6MjY6ImNHdkc4ZWR5QmFmNWJITVpISG5sTEY3ZmpZIjtyZXF1ZXN0X3Rva2VufHM6MzI6IkM5VXlNNVBMUnhSeERiVm9HTlNMNjdVZ05NaWE4WVZGIjt0YXNrfHM6ODoic2V0dGluZ3MiO3NraW5fY29uZmlnfGE6Nzp7czoxNzoic3VwcG9ydGVkX2xheW91dHMiO2E6MTp7aTowO3M6MTA6IndpZGVzY3JlZW4iO31zOjIyOiJqcXVlcnlfdWlfY29sb3JzX3RoZW1lIjtzOjk6ImJvb3RzdHJhcCI7czoxODoiZW1iZWRfY3NzX2xvY2F0aW9uIjtzOjE3OiIvc3R5bGVzL2VtYmVkLmNzcyI7c zoxOToiZWRpdG9yX2Nzc19sb2NhdGlvbiI7czoxNzoiL3N0eWxlcy9lbWJlZC5jc3MiO3M6MTc6ImRhcmtfbW9kZV9zdXBwb3J0IjtiOjE7czoyNjoibWVkaWFfYnJvd3Nlcl9jc3NfbG9jYXRpb24iO3M6NDoibm9uZSI7czoyMToiYWRkaXRpb25hbF9sb2dvX3R5cGVzIjthOjM6e2k6MDtzOjQ6ImRhcmsiO2k6MTtzOjU6InNtYWxsIjtpOjI7czoxMDoic21hbGwtZGFyayI7fX1pbWFwX2hvc3R8czoxODoiY29saW5saWtlc2Zvb2QuY29tIjttYm94fHM6NToiSU5CT1giO3NvcnRfY29sfHM6MDoiIjtzb3J0X29yZGVyfHM6NDoiREVTQyI7U1RPUkFHRV9USFJFQUR8YTozOntpOjA7czoxMDoiUkVGRVJFTkNFUyI7aToxO3M6NDoiUkVGUyI7aToyO3M6MTQ6Ik9SREVSRURTVUJKRUNUIjt9U1RPUkFHRV9RVU9UQXxiOjA7U1RPUkFHRV9MSVNULUVYVEVOREVEfGI6MTtsaXN0X2F0dHJpYnxhOjc6e3M6NDoibmFtZSI7czo4OiJtZXNzYWdlcyI7czoyOiJpZCI7czoxMToibWVzc2FnZWxpc3QiO3M6NToiY2xhc3MiO3M6NDI6Imxpc3RpbmcgbWVzc2FnZWxpc3Qgc29ydGhlYWRlciBmaXhlZGhlYWRlciI7czoxNToiYXJpYS1sYWJlbGxlZGJ5IjtzOjIyOiJhcmlhLWxhYmVsLW1lc3NhZ2VsaXN0IjtzOjk6ImRhdGEtbGlzdCI7czoxMjoibWVzc2FnZV9saXN0IjtzOjE0OiJkYXRhLWxhYmVsLW1zZyI7czoxODoi Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] C: A0006 LOGOUT Nov 22 10:29:31 mail dovecot[8514]: imap(obfuscated(a)user.name)<8639><51k6rRHuw5gKAAAB>: Disconnected: Logged out in=215 out=821 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0 Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] S: * BYE Logging out Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] S: A0006 OK Logout completed (0.001 + 0.000 secs). Nov 22 10:29:42 mail roundcube[71055]: <keirks4p> [1] SELECT "vars", "ip", "changed", datetime('now') AS ts, CASE WHEN "changed" < datetime('now', '-600 seconds') THEN 1 ELSE 0 END AS expired FROM "session" WHERE "sess_id" = 'keirks4pbepr17um9mvj1qsvt2'; Nov 22 10:29:42 mail roundcube[71055]: <keirks4p> [2] SELECT * FROM "users" WHERE "user_id" = '2'; Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> PHP Error: Connection refused (POST /?_task=settings&_action=plugin.managesieve-save) Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> PHP Error: Unable to connect to managesieve on obfuscated.domain:4190 in /usr/local/www/roundcube/plugins/managesieve/lib/Roundcube/rcube_sieve_engine.php on line 221 (POST /?_task=settings&_action=plugin.managesieve-save) Nov 22 10:29:43 mail roundcube[71055]: PHP Warning: Trying to access array offset on value of type null in /usr/local/www/roundcube/plugins/managesieve/lib/Roundcube/rcube_sieve_engine.php on line 1065 Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] Connecting to tls://obfuscated.domain:143... Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] S: * OK [CAPABILITY IMAP4rev1 SASL-IR LOGIN-REFERRALS ID ENABLE IDLE LITERAL+ STARTTLS LOGINDISABLED AUTH=CRAM-MD5] Dovecot ready. Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] C: A0001 STARTTLS Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] S: A0001 OK Begin TLS negotiation now. Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] C: A0002 CAPABILITY Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] S: * CAPABILITY IMAP4rev1 SASL-IR LOGIN-REFERRALS ID ENABLE IDLE LITERAL+ LOGINDISABLED AUTH=CRAM-MD5 Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] S: A0002 OK Pre-login capabilities listed, post-login capabilities have more. Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] C: A0003 AUTHENTICATE CRAM-MD5 Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] S: + PDE2NjcxMDUwNTU2NDcwMTMuMTY2OTEzNDU4M0BtYWlsPg== Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] C: ****** [74] Nov 22 10:29:43 mail dovecot[8514]: imap-login: Login: user=<obfuscated(a)user.name>, method=CRAM-MD5, rip=10.0.0.1, lip=10.0.0.91, mpid=8644, TLS, session=<677prRHu4aAKAAAB> Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] S: A0003 OK [CAPABILITY IMAP4rev1 SASL-IR LOGIN-REFERRALS ID ENABLE IDLE SORT SORT=DISPLAY THREAD=REFERENCES THREAD=REFS THREAD=ORDEREDSUBJECT MULTIAPPEND URL-PARTIAL CATENATE UNSELECT CHILDREN NAMESPACE UIDPLUS LIST-EXTENDED I18NLEVEL=1 CONDSTORE QRESYNC ESEARCH ESORT SEARCHRES WITHIN CONTEXT=SEARCH LIST-STATUS BINARY MOVE SNIPPET=FUZZY PREVIEW=FUZZY PREVIEW STATUS=SIZE SAVEDATE LITERAL+ NOTIFY SPECIAL-USE] Logged in Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] C: A0004 ID ("name" "Roundcube" "version" "1.6.0" "php" "8.0.25" "os" "FreeBSD" "command" "/") Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] S: * ID ("name" "Dovecot") Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] S: A0004 OK ID completed (0.001 + 0.000 secs). Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] C: A0005 LIST (SUBSCRIBED) "" "*" Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] S: * LIST (\Subscribed) "/" Drafts Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] S: * LIST (\Subscribed) "/" Junk Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] S: * LIST (\Subscribed) "/" Sent Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] S: * LIST (\Subscribed) "/" Trash Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] S: * LIST (\Subscribed) "/" INBOX/NAS-Alerts Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] S: * LIST (\Subscribed) "/" INBOX/email-reports Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] S: A0005 OK List completed (0.001 + 0.000 secs). Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] C: A0006 LOGOUT Nov 22 10:29:43 mail dovecot[8514]: imap(obfuscated(a)user.name)<8644><677prRHu4aAKAAAB>: Disconnected: Logged out in=137 out=821 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0 Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] S: * BYE Logging out Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] S: A0006 OK Logout completed (0.001 + 0.000 secs). DOVECOT INFO: ------------------------ # dovecot --version 2.3.19.1 (9b53102964) # dovecot -n # 2.3.19.1 (9b53102964): /usr/local/etc/dovecot/dovecot.conf # Pigeonhole version 0.5.19 (4eae2f79) # OS: FreeBSD 13.1-RELEASE-p2 amd64 zfs # Hostname: localhost auth_mechanisms = cram-md5 first_valid_gid = 10000 first_valid_uid = 10000 mail_location = maildir:/var/mail/users/%u managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext namespace inbox { inbox = yes location = mailbox Drafts { auto = create special_use = \Drafts } mailbox Junk { auto = create special_use = \Junk } mailbox Sent { auto = create special_use = \Sent } mailbox Trash { auto = create special_use = \Trash } prefix = separator = / } passdb { args = username_format=%u /usr/local/etc/dovecot/users driver = passwd-file } plugin { sieve = file:/usr/local/etc/dovecot/sieve;active=/usr/local/etc/dovecot/sieve/.dovecot.sieve sieve_before = /usr/local/etc/dovecot/sieve/before-global.sieve sieve_default = /usr/local/etc/dovecot/sieve/default.sieve sieve_global = /usr/local/etc/dovecot/sieve/global/ } protocols = imap lmtp sieve service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0666 user = postfix } } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0660 user = postfix } } service managesieve-login { inet_listener sieve { port = 4190 } } ssl_cert = </usr/local/etc/letsencrypt/live/obfuscated.domain/fullchain.pem ssl_cipher_list = HIGH:!aNULL:!AES128:!SSLv2 ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it syslog_facility = local1 userdb { args = username_format=%u /usr/local/etc/dovecot/users driver = passwd-file } protocol lmtp { mail_plugins = " sieve" } protocol sieve { info_log_path = /var/log/dovecot-sieve.log log_path = /var/log/dovecot-sieve-errors.log managesieve_implementation_string = dovecot managesieve_max_line_length = 64 k } THANKS! Colin

3 5

Event 0x560045857eb0 leaked
by support＠openmbox.net 18 Nov '22

18 Nov '22

what do these logs mean in mail.log? Nov 18 10:23:03 mx dovecot: auth: Warning: Event 0x560045857eb0 leaked (parent=(nil)): auth-client-connection.c:338 Nov 18 10:23:03 mx dovecot: auth: Warning: Event 0x560045894390 leaked (parent=(nil)): auth-client-connection.c:338 Nov 18 10:23:03 mx dovecot: auth: Warning: Event 0x56004589d3e0 leaked (parent=(nil)): auth-client-connection.c:338 Nov 18 10:23:03 mx dovecot: auth: Warning: Event 0x56004588f810 leaked (parent=(nil)): auth-client-connection.c:338 Nov 18 10:23:03 mx dovecot: auth: Warning: Event 0x560045857240 leaked (parent=(nil)): auth-client-connection.c:338 Nov 18 10:23:03 mx dovecot: auth: Warning: Event 0x56004589cfd0 leaked (parent=(nil)): auth-client-connection.c:338 Nov 18 10:23:03 mx dovecot: auth: Warning: Event 0x56004586b130 leaked (parent=(nil)): auth-client-connection.c:338 I am using this version dovecot in a ubunto 20.04 box. # dovecot --version 2.3.7.2 (3c910f64b) thanks.

1 0

Dovecot 2.2 to 2.3 migration
by Markus Wienhöfer 17 Nov '22

17 Nov '22

Hi, we are currently using Dovecot 2.2 (from the Ubuntu 18.04 repos) and would like to migrate to 2.3 I have read the migration documentation regarding the configuration changes. Apart from that, is it feasible/possible to change from Ubuntu to official Dovecot repositories and upgrade the dovecot package this way? Or is there anything else we should be aware of? Best regards Markus

3 3

Doveadm backup stateful synchronization trouble
by dovecot＠f-hamelin.fr 16 Nov '22

16 Nov '22

Hi, The non-blocking error is: doveadm(user1s@domain): Error: Saved sync state is invalid, falling back to full sync: Invalid base64 data This error occurs every time on my test machine (no traffic, only a few test messages). That error sometime also occurs on my production system, but not each time. The command I used for the first time is : doveadm backup -A -s "" -d > state.txt After that there is a daily calls (as vmail user, my config only handle virtual users) to : doveadm backup -A -s "$(<state.txt)" -d > state.txt.tmp && mv state.txt.tmp state.txt doveconf -n output is available at https://www.f-hamelin.fr/pub/doveadm-backup-doveconf.txt Any help will be welcomed Best regards, Franck

1 0

OAUTH2 local validation
by Felix Auringer 16 Nov '22

16 Nov '22

Hello, <https://doc.dovecot.org/configuration_manual/authentication/oauth2/#local-v…> describes how to set up local validation for OAUTH2 with dovecot. This works fine as long as the keys are not rotated. In my experience, it is common for a client to try to validate a token with the cached key and update the cached keys when the local validation fails (e.g. via the /auth/realms/<realm>/protocol/openid-connect/certs endpoint in Keycloak). This way, the client does not need to fetch new keys periodically but only when the old ones expired. If I understand it correctly, Dovecot reads the keys from a defined path but does not care how to update them. Did you have a nice way in mind how the keys should be refreshed when deciding not to do that in dovecot? Are you planning to add automatic refreshing of local validation keys to dovecot? I am running dovecot in Docker and one way would be a cron job on the host that fetches new keys and updates the files inside the container via docker exec. It would work but it's not really a nice solution because from outside dovecot, the information whether the old keys are no longer valid, is not available and the whole process needs to run periodically (and thus way more often than actually necessary). Best regards, Felix Auringer --- Gesellschaft für interkulturelles Zusammenleben gGmbH (GIZ) Felix Auringer IT Reformationsplatz 2 13597 Berlin Tel: 030/513 0100 00; Fax: 030/513 0100 09 www.giz.berlin; felix.auringer(a)giz.berlin Amtsgericht Charlottenburg HRB 200872 B Geschäftsführerin: Dr. Britta Marschke

2 1

Re: bug: ARGON2 hash selection incompatible with LDAP
by Krisztián Szegi 16 Nov '22

16 Nov '22

"Michael Ströder" michael(a)stroeder.com – 15 November 2022 15:00 > On 11/15/22 13:45, Krisztián Szegi wrote: >> I'd like to report that non-binding auth to (Open)LDAP doesn't work >> if the latter hashes passwords with ARGON2. > Could you please elaborate why using LDAP bind is a problem for you? > > Ciao, Michael. > > Fair enough question! I cannot specify bind_dn template due to mismatched mail addresses and user DNs, and I thought that that would be suboptimal due to re-binding. I am a bit confused about how to optimize LDAP lookups now (static files not option :), re-reading the docs it just made me question more things - auth_bind_dn cannot be given in my case, as a fixed starting point - auth_bind adds a temporary binding (using pass_filter) - can I use userdb prefetch? Docs say I cannot if I use bind with template, but I am not using the latter. So the search for the user's dn during auth IS the passdb lookup? - assuming I am correct, I should give back stuff with passdb lookup: or do I? - Must I give back userid an guid? 10-mail.conf has "vmail" for both, as mail accounts don't have UNIX ones linked to them... - same for home? There is no default I've given until userdb lookup. Just specify a global mail_home with variables, and get on with life? -if I should give back one, should I pass it with default_fields = userdb_home (currently I specify it under default_fields:home in userdb lookup as LDAP doesn't override home). The docs are confusing around userdb. The main thing what is not clear that they CAN override fields on a per-user basis, but must they provide them for non-extra fields, when there are global settings for those? Thanks! BTW, thanks for the great software all of you. Michael, I've come across some of your work, you have my respect!

3 2

Accessing Shared Mailbox not working
by Quiwy 15 Nov '22

15 Nov '22

Hi, I'm new on this mailing list and I'm struggling with the configuration of shared mailboxes. I've followed the following documentation page : https://doc.dovecot.org/configuration_manual/shared_mailboxes/shared_mailbo… and manage to had it working for something like 2 minutes, but then changed a parameter and can't get it back working (and of course I don't remember which one it was). I'm using dovecot 2.3.13 . user@hostname:~# dovecot -n # 2.3.13 (89f716dc2): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.13 (cdd19fe3) # OS: Linux 5.10.0-19-amd64 x86_64 Debian 11.5 # Hostname: hostname auth_mechanisms = plain login dict { acl = mysql:/etc/dovecot/dovecot-dict-sql.conf.ext } mail_debug = yes mail_home = /var/vmail/%d/%n mail_location = maildir:~/ mail_plugins = acl mail_privileged_group = mail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext namespace { list = yes location = maildir:/var/mail/vmail/%%d/%%n/Maildir:INDEXPVT=/var/mail/vmail/%%d/%%n/Maildir/shared/%n prefix = shared/%%u/ separator = / subscriptions = no type = shared } namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = separator = / type = private } passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } plugin { acl = vfile acl_shared_dict = proxy::acl sieve = file:~/sieve;active=~/.dovecot.sieve } protocols = " imap sieve" service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } unix_listener auth-userdb { mode = 0600 user = vmail } user = dovecot } ssl_cert = </etc/letsencrypt/live/domain/fullchain.pem ssl_client_ca_dir = /etc/ssl/certs ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { args = uid=vmail gid=vmail home=/var/mail/vmail/%d/%n driver = static } protocol imap { mail_plugins = acl imap_acl imap_acl } protocol lda { mail_plugins = acl sieve } This is the content of dovecot-dict-sql.conf.ext : cat dovecot-dict-sql.conf.ext # This file is commonly accessed via dict {} section in dovecot.conf connect = host=localhost dbname=my_dbname user=my_admin_db_user password=my_password map { pattern = shared/shared-boxes/user/$to/$from table = user_shares value_field = dummy fields { from_user = $from to_user = $to } } map { pattern = shared/shared-boxes/anyone/$from table = anyone_shares value_field = dummy fields { from_user = $from } } Now, I have configured some rigth through SOGo interface as I need to use it. With doveadm I can see the good rights : doveadm acl get -u user1@domain INBOX ID Global Rights user=user2(a)devops.algoo.net lookup read user=user3(a)devops.algoo.net admin create delete expunge insert lookup post read write write-deleted write-seen This this the output I have from journalctl -f command with debug enabled when trying to access to the shared folder within SOGo : Nov 15 17:51:14 hostname dovecot[269267]: imap-login: Login: user=<user3@domain>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, mpid=270025, secured, session=<UL//KYXt7ul/AAAB> Nov 15 17:51:14 hostname dovecot[269267]: imap(user3user3@domain)<270025><UL//KYXt7ul/AAAB>: Debug: Loading modules from directory: /usr/lib/dovecot/modules Nov 15 17:51:14 hostname dovecot[269267]: imap(user3@domain)<270025><UL//KYXt7ul/AAAB>: Debug: Module loaded: /usr/lib/dovecot/modules/lib01_acl_plugin.so Nov 15 17:51:14 hostname dovecot[269267]: imap(user3@domain)<270025><UL//KYXt7ul/AAAB>: Debug: Module loaded: /usr/lib/dovecot/modules/lib02_imap_acl_plugin.so Nov 15 17:51:14 hostname dovecot[269267]: imap(user3@domain)<270025><UL//KYXt7ul/AAAB>: Debug: Effective uid=5000, gid=5000, home=/var/mail/vmail/domain/user3 Nov 15 17:51:14 hostname dovecot[269267]: imap(user3@domain)<270025><UL//KYXt7ul/AAAB>: Debug: Namespace inbox: type=private, prefix=, sep=/, inbox=yes, hidden=no, list=yes, subscriptions=yes location=maildir:~/ Nov 15 17:51:14 hostname dovecot[269267]: imap(user3@domain)<270025><UL//KYXt7ul/AAAB>: Debug: maildir++: root=/var/mail/vmail/domain/user3, index=, indexpvt=, control=, inbox=/var/mail/vmail/domain/user3, alt= Nov 15 17:51:14 hostname dovecot[269267]: imap(user3@domain)<270025><UL//KYXt7ul/AAAB>: Debug: acl: initializing backend with data: vfile Nov 15 17:51:14 hostname dovecot[269267]: imap(user3@domain)<270025><UL//KYXt7ul/AAAB>: Debug: acl: acl username = user3@domain Nov 15 17:51:14 hostname dovecot[269267]: imap(user3@domain)<270025><UL//KYXt7ul/AAAB>: Debug: acl: owner = 1 Nov 15 17:51:14 hostname dovecot[269267]: imap(user3@domain)<270025><UL//KYXt7ul/AAAB>: Debug: acl vfile: Global ACLs disabled Nov 15 17:51:14 hostname dovecot[269267]: imap(user3@domain)<270025><UL//KYXt7ul/AAAB>: Debug: Namespace : type=shared, prefix=shared/%u/, sep=/, inbox=no, hidden=no, list=yes, subscriptions=no location=maildir:/var/mail/vmail/%d/%n/Maildir:INDEXPVT=/var/mail/vmail/%d/%n/Maildir/shared/user3 Nov 15 17:51:14 hostname dovecot[269267]: imap(user3@domain)<270025><UL//KYXt7ul/AAAB>: Debug: shared: root=/run/dovecot, index=, indexpvt=, control=, inbox=, alt= Nov 15 17:51:14 hostname dovecot[269267]: imap(user3@domain)<270025><UL//KYXt7ul/AAAB>: Debug: acl: initializing backend with data: vfile Nov 15 17:51:14 hostname dovecot[269267]: imap(user3@domain)<270025><UL//KYXt7ul/AAAB>: Debug: acl: acl username = user3@domain Nov 15 17:51:14 hostname dovecot[269267]: imap(user3@domain)<270025><UL//KYXt7ul/AAAB>: Debug: acl: owner = 0 Nov 15 17:51:14 hostname dovecot[269267]: imap(user3@domain)<270025><UL//KYXt7ul/AAAB>: Debug: acl vfile: Global ACLs disabled Nov 15 17:51:14 hostname dovecot[269267]: imap(user3@domain)<270025><UL//KYXt7ul/AAAB>: Debug: Mailbox INBOX/folder_i_want_to_share_from_user1_to_user3: Mailbox opened because: SELECT Nov 15 17:51:14 hostname dovecot[269267]: imap(user3@domain)<270025><UL//KYXt7ul/AAAB>: Debug: acl vfile: reading file /var/mail/vmail/domain/user3/.INBOX.folder_i_want_to_share_from_user1_to_user3/dovecot-acl Nov 15 17:51:14 hostname dovecot[269267]: imap(user3@domain)<270025><UL//KYXt7ul/AAAB>: Logged out in=140 out=1521 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0 Nov 15 17:51:15 hostname dovecot[269267]: imap-login: Login: user=<user3@domain>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, mpid=270028, secured, session=<IDgGKoXt/Ol/AAAB> Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270028><IDgGKoXt/Ol/AAAB>: Debug: Loading modules from directory: /usr/lib/dovecot/modules Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270028><IDgGKoXt/Ol/AAAB>: Debug: Module loaded: /usr/lib/dovecot/modules/lib01_acl_plugin.so Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270028><IDgGKoXt/Ol/AAAB>: Debug: Module loaded: /usr/lib/dovecot/modules/lib02_imap_acl_plugin.so Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270028><IDgGKoXt/Ol/AAAB>: Debug: Effective uid=5000, gid=5000, home=/var/mail/vmail/domain/user3 Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270028><IDgGKoXt/Ol/AAAB>: Debug: Namespace inbox: type=private, prefix=, sep=/, inbox=yes, hidden=no, list=yes, subscriptions=yes location=maildir:~/ Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270028><IDgGKoXt/Ol/AAAB>: Debug: maildir++: root=/var/mail/vmail/domain/user3, index=, indexpvt=, control=, inbox=/var/mail/vmail/domain/user3, alt= Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270028><IDgGKoXt/Ol/AAAB>: Debug: acl: initializing backend with data: vfile Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270028><IDgGKoXt/Ol/AAAB>: Debug: acl: acl username = user3@domain Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270028><IDgGKoXt/Ol/AAAB>: Debug: acl: owner = 1 Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270028><IDgGKoXt/Ol/AAAB>: Debug: acl vfile: Global ACLs disabled Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270028><IDgGKoXt/Ol/AAAB>: Debug: Namespace : type=shared, prefix=shared/%u/, sep=/, inbox=no, hidden=no, list=yes, subscriptions=no location=maildir:/var/mail/vmail/%d/%n/Maildir:INDEXPVT=/var/mail/vmail/%d/%n/Maildir/shared/user3 Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270028><IDgGKoXt/Ol/AAAB>: Debug: shared: root=/run/dovecot, index=, indexpvt=, control=, inbox=, alt= Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270028><IDgGKoXt/Ol/AAAB>: Debug: acl: initializing backend with data: vfile Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270028><IDgGKoXt/Ol/AAAB>: Debug: acl: acl username = user3@domain Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270028><IDgGKoXt/Ol/AAAB>: Debug: acl: owner = 0 Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270028><IDgGKoXt/Ol/AAAB>: Debug: acl vfile: Global ACLs disabled Nov 15 17:51:15 hostname dovecot[269267]: imap-login: Login: user=<user3@domain>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, mpid=270029, secured, session=<7mIGKoXtAOp/AAAB> Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270029><7mIGKoXtAOp/AAAB>: Debug: Loading modules from directory: /usr/lib/dovecot/modules Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270029><7mIGKoXtAOp/AAAB>: Debug: Module loaded: /usr/lib/dovecot/modules/lib01_acl_plugin.so Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270029><7mIGKoXtAOp/AAAB>: Debug: Module loaded: /usr/lib/dovecot/modules/lib02_imap_acl_plugin.so Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270029><7mIGKoXtAOp/AAAB>: Debug: Effective uid=5000, gid=5000, home=/var/mail/vmail/domain/user3 Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270029><7mIGKoXtAOp/AAAB>: Debug: Namespace inbox: type=private, prefix=, sep=/, inbox=yes, hidden=no, list=yes, subscriptions=yes location=maildir:~/ Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270029><7mIGKoXtAOp/AAAB>: Debug: maildir++: root=/var/mail/vmail/domain/user3, index=, indexpvt=, control=, inbox=/var/mail/vmail/domain/user3, alt= Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270029><7mIGKoXtAOp/AAAB>: Debug: acl: initializing backend with data: vfile Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270029><7mIGKoXtAOp/AAAB>: Debug: acl: acl username = user3@domain Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270029><7mIGKoXtAOp/AAAB>: Debug: acl: owner = 1 Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270029><7mIGKoXtAOp/AAAB>: Debug: acl vfile: Global ACLs disabled Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270029><7mIGKoXtAOp/AAAB>: Debug: Namespace : type=shared, prefix=shared/%u/, sep=/, inbox=no, hidden=no, list=yes, subscriptions=no location=maildir:/var/mail/vmail/%d/%n/Maildir:INDEXPVT=/var/mail/vmail/%d/%n/Maildir/shared/user3 Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270029><7mIGKoXtAOp/AAAB>: Debug: shared: root=/run/dovecot, index=, indexpvt=, control=, inbox=, alt= Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270029><7mIGKoXtAOp/AAAB>: Debug: acl: initializing backend with data: vfile Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270029><7mIGKoXtAOp/AAAB>: Debug: acl: acl username = user3@domain Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270029><7mIGKoXtAOp/AAAB>: Debug: acl: owner = 0 Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270029><7mIGKoXtAOp/AAAB>: Debug: acl vfile: Global ACLs disabled Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270029><7mIGKoXtAOp/AAAB>: Debug: acl vfile: file /var/mail/vmail/domain/user3/dovecot-acl not found Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270029><7mIGKoXtAOp/AAAB>: Debug: acl vfile: reading file /var/mail/vmail/domain/user3/.INBOX.folder_i_want_to_share_from_user1_to_user3/dovecot-acl Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270028><IDgGKoXt/Ol/AAAB>: Debug: Mailbox INBOX: Mailbox opened because: SELECT Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270028><IDgGKoXt/Ol/AAAB>: Debug: acl vfile: file /var/mail/vmail/domain/user3/dovecot-acl not found Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270029><7mIGKoXtAOp/AAAB>: Debug: maildir++: root=/var/mail/vmail/domain/user1/Maildir, index=, indexpvt=/var/mail/vmail/domain/user1/Maildir/shared/user3, control=, inbox=/var/mail/vmail/domain/user1/Maildir, alt= Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270029><7mIGKoXtAOp/AAAB>: Debug: acl: initializing backend with data: vfile Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270029><7mIGKoXtAOp/AAAB>: Debug: acl: acl username = user1@domain Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270029><7mIGKoXtAOp/AAAB>: Debug: acl: owner = 1 Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270029><7mIGKoXtAOp/AAAB>: Debug: acl vfile: Global ACLs disabled Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270029><7mIGKoXtAOp/AAAB>: Debug: maildir++: root=/var/mail/vmail/domain/user1/Maildir, index=, indexpvt=/var/mail/vmail/domain/user1/Maildir/shared/user3, control=, inbox=/var/mail/vmail/domain/user1/Maildir, alt= Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270029><7mIGKoXtAOp/AAAB>: Debug: acl: initializing backend with data: vfile Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270029><7mIGKoXtAOp/AAAB>: Debug: acl: acl username = user3@domain Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270029><7mIGKoXtAOp/AAAB>: Debug: acl: owner = 0 Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270029><7mIGKoXtAOp/AAAB>: Debug: acl vfile: Global ACLs disabled Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270029><7mIGKoXtAOp/AAAB>: Debug: acl: Mailbox not in dovecot-acl-list: shared/user1@domain Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270029><7mIGKoXtAOp/AAAB>: Debug: acl vfile: file /var/mail/vmail/domain/user1/Maildir/dovecot-acl not found Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270029><7mIGKoXtAOp/AAAB>: Debug: Namespace shared/: Using permissions from : mode=0700 gid=default Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270028><IDgGKoXt/Ol/AAAB>: Logged out in=198 out=1581 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0 Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270029><7mIGKoXtAOp/AAAB>: Logged out in=125 out=1417 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0 Nov 15 17:51:15 hostname dovecot[269267]: imap-login: Login: user=<user3@domain>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, mpid=270033, secured, session=<B4gIKoXtDOp/AAAB> Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270033><B4gIKoXtDOp/AAAB>: Debug: Loading modules from directory: /usr/lib/dovecot/modules Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270033><B4gIKoXtDOp/AAAB>: Debug: Module loaded: /usr/lib/dovecot/modules/lib01_acl_plugin.so Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270033><B4gIKoXtDOp/AAAB>: Debug: Module loaded: /usr/lib/dovecot/modules/lib02_imap_acl_plugin.so Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270033><B4gIKoXtDOp/AAAB>: Debug: Effective uid=5000, gid=5000, home=/var/mail/vmail/domain/user3 Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270033><B4gIKoXtDOp/AAAB>: Debug: Namespace inbox: type=private, prefix=, sep=/, inbox=yes, hidden=no, list=yes, subscriptions=yes location=maildir:~/ Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270033><B4gIKoXtDOp/AAAB>: Debug: maildir++: root=/var/mail/vmail/domain/user3, index=, indexpvt=, control=, inbox=/var/mail/vmail/domain/user3, alt= Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270033><B4gIKoXtDOp/AAAB>: Debug: acl: initializing backend with data: vfile Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270033><B4gIKoXtDOp/AAAB>: Debug: acl: acl username = user3@domain Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270033><B4gIKoXtDOp/AAAB>: Debug: acl: owner = 1 Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270033><B4gIKoXtDOp/AAAB>: Debug: acl vfile: Global ACLs disabled Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270033><B4gIKoXtDOp/AAAB>: Debug: Namespace : type=shared, prefix=shared/%u/, sep=/, inbox=no, hidden=no, list=yes, subscriptions=no location=maildir:/var/mail/vmail/%d/%n/Maildir:INDEXPVT=/var/mail/vmail/%d/%n/Maildir/shared/user3 Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270033><B4gIKoXtDOp/AAAB>: Debug: shared: root=/run/dovecot, index=, indexpvt=, control=, inbox=, alt= Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270033><B4gIKoXtDOp/AAAB>: Debug: acl: initializing backend with data: vfile Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270033><B4gIKoXtDOp/AAAB>: Debug: acl: acl username = user3@domain Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270033><B4gIKoXtDOp/AAAB>: Debug: acl: owner = 0 Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270033><B4gIKoXtDOp/AAAB>: Debug: acl vfile: Global ACLs disabled Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270033><B4gIKoXtDOp/AAAB>: Debug: Mailbox INBOX/folder_i_want_to_share_from_user1_to_user3: Mailbox opened because: SELECT Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270033><B4gIKoXtDOp/AAAB>: Debug: acl vfile: reading file /var/mail/vmail/domain/user3/.INBOX.folder_i_want_to_share_from_user1_to_user3/dovecot-acl Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270033><B4gIKoXtDOp/AAAB>: Logged out in=313 out=2117 deleted=0 expunged=0 trashed=0 hdr_count=1 hdr_bytes=2 body_count=0 body_bytes=0 Nov 15 17:51:15 hostname dovecot[269267]: imap-login: Login: user=<user3@domain>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, mpid=270037, secured, session=<nRkMKoXtFup/AAAB> Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270037><nRkMKoXtFup/AAAB>: Debug: Loading modules from directory: /usr/lib/dovecot/modules Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270037><nRkMKoXtFup/AAAB>: Debug: Module loaded: /usr/lib/dovecot/modules/lib01_acl_plugin.so Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270037><nRkMKoXtFup/AAAB>: Debug: Module loaded: /usr/lib/dovecot/modules/lib02_imap_acl_plugin.so Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270037><nRkMKoXtFup/AAAB>: Debug: Effective uid=5000, gid=5000, home=/var/mail/vmail/domain/user3 Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270037><nRkMKoXtFup/AAAB>: Debug: Namespace inbox: type=private, prefix=, sep=/, inbox=yes, hidden=no, list=yes, subscriptions=yes location=maildir:~/ Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270037><nRkMKoXtFup/AAAB>: Debug: maildir++: root=/var/mail/vmail/domain/user3, index=, indexpvt=, control=, inbox=/var/mail/vmail/domain/user3, alt= Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270037><nRkMKoXtFup/AAAB>: Debug: acl: initializing backend with data: vfile Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270037><nRkMKoXtFup/AAAB>: Debug: acl: acl username = user3@domain Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270037><nRkMKoXtFup/AAAB>: Debug: acl: owner = 1 Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270037><nRkMKoXtFup/AAAB>: Debug: acl vfile: Global ACLs disabled Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270037><nRkMKoXtFup/AAAB>: Debug: Namespace : type=shared, prefix=shared/%u/, sep=/, inbox=no, hidden=no, list=yes, subscriptions=no location=maildir:/var/mail/vmail/%d/%n/Maildir:INDEXPVT=/var/mail/vmail/%d/%n/Maildir/shared/user3 Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270037><nRkMKoXtFup/AAAB>: Debug: shared: root=/run/dovecot, index=, indexpvt=, control=, inbox=, alt= Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270037><nRkMKoXtFup/AAAB>: Debug: acl: initializing backend with data: vfile Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270037><nRkMKoXtFup/AAAB>: Debug: acl: acl username = user3@domain Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270037><nRkMKoXtFup/AAAB>: Debug: acl: owner = 0 Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270037><nRkMKoXtFup/AAAB>: Debug: acl vfile: Global ACLs disabled Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270037><nRkMKoXtFup/AAAB>: Debug: Mailbox INBOX: Mailbox opened because: SELECT Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270037><nRkMKoXtFup/AAAB>: Debug: acl vfile: file /var/mail/vmail/domain/user3/dovecot-acl not found Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270037><nRkMKoXtFup/AAAB>: Debug: Mailbox INBOX/folder_i_want_to_share_from_user1_to_user3: Mailbox opened because: SELECT Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270037><nRkMKoXtFup/AAAB>: Debug: acl vfile: reading file /var/mail/vmail/domain/user3/.INBOX.folder_i_want_to_share_from_user1_to_user3/dovecot-acl Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270037><nRkMKoXtFup/AAAB>: Logged out in=218 out=1925 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0 I tried with thunderbird too but no folders appears neither. Do you have any clue on which parameter do I need to change in order to get it working? Thank you very much for any help provided. Quiwy

1 0

R: Dovecot 2.3 shared namespace issues
by Stefano Cecconello 15 Nov '22

15 Nov '22

Hello, My bad, the OS was ubuntu 20.04 and not 22.04 . After further tinkering\testing, it seems that removing the " acl_ignore_namespace = shared/* " setting did the trick, now we're getting the correct ACL on client side . Without it we can see the folder with the right permissions : Logging as user01 : shared\Sharer01\INBOX : '[NONEXISTENT] Mailbox doesn't exist: shared/test.imapsharer01(a)td01.testdomain.it/INBOX'' shared\Sharer01\subfolder01 ( RW ) : 'shared/test.imapsharer01(a)td01.testdomain.it/subfolder01 test.imapuser01(a)td01.testdomain.it akxeilprwtscd '] shared\Sharer01\subfolder02ro ( RO ) : '[NOPERM] You lack administrator privileges on this mailbox' Logging on Thunderbird and other IMAP clients ( sylpheed\claws ) as user01 : - It list correctly the shared folders as subscribed folders ; - can't view the mail contents of the sharer INBOX, as desired ; - show the total elements of the sharer INBOX, even if the user01 didnt have access ; If the config is correct, this is somehow what we're trying to accomplish, i have some concerns regarding how it is possible to show the total messages of the remote INBOX without having any privileges . Maybe is something related to the index of that INBOX folder that is somewhat read by the accessing user even if IMAP-wise didnt have any ACL \ rights . I still dont understand why enabling the acl_ignore_namespace setting, results in a : - remote INBOX full control, even if it was not defined in any acl ; - subfolders ACL applied correctly Hope that someone can shed a light on it . Thanks Stefano

1 0

Re: bug: ARGON2 hash selection incompatible with LDAP
by Krisztián Szegi 15 Nov '22

15 Nov '22

Sorry, I wanted to post from this alias, but From-Address isn't saved with my drafts :) I failed to recognize during my patchwork that the verification function is the same for ARGON2I and -ID: both call `verify_argon2`, which in turn calls `libsodium's crypto_pwhash_str_verify`. In the new light this, there is no "harm" in my patch: - If backend gives back "{ARGON2}...", dovecot verifies with the same call anyway, regardless of what subtype it actually is, i.e.: {ARGON2I} will work too. - If dovecot generates the hash, the prefix will be the one set by the config's default hash, so for backwards comp., "{ARGON2ID}" could be used if someone wants that. Dovecot will succeed in verifying {ARGON2} generated by itself as well. "Aki Tuomi" aki.tuomi(a)open-xchange.com – 15 November 2022 13:55 > > On 15/11/2022 14:45 EET Krisztián Szegi <oni-dono(a)mszk.eu> wrote: > > > > > > Good day to all, > > > > this is my first post to the mailing list! > > > > I'd like to report that non-binding auth to (Open)LDAP doesn't work if the latter hashes passwords with ARGON2. > > > > Although dovecot (I am using http://2.3.19.1) does support ARGON2 with libsodium, but it doesn't recoginize hashes beginning "{ARGON2}$argon2id$" stored (and hashed, using ppolicy module's hashCleartext) by OpenLDAP. > > > > Now, I understand that ARGON2I, -D, and -ID are not compatible, but the ACTUAL algorithm is there between the two $. > > Furthermore, I think dovecot is in the minority here, I haven't met any software that specifies the ARGON2 subtype between {}. > > BTW, I haven't met any software that hashes passwords with ARGON2, but not with the ARGON2ID subtype (where libsodium is available, which also seems to be the standard here), as THAT is the recommended one anyway. > > > > I patched the rpm in OpenSUSE repo to alias {ARGON2} to {ARGON2ID}: > > https://build.opensuse.org/package/view_file/home:Samonitari:branches:openS… > > > > Could we get something like this (but maybe more correct) into the official source? > > Maybe a config switch to alias it runtime? > > > > Thanks for the attention: > > Krisztián > > Hi! > > Thanks for your report. I think it makes sense, we'll see what we can do about this. > > Aki > >

1 0

Dovecot 2.3 shared namespace issues
by Stefano Cecconello 15 Nov '22

15 Nov '22

Hello, We're trying to configure the shared mailbox feature\namespace on a dovecot 2.3 installation . OS : Ubuntu 22.04 x64 Dovecot : 2:2.3.19.1-2+ubuntu20.04 Our test enviroment is based on a dovecot frontend ( director + proxy ) and a dovecot backend ( auth and storage ), later we will think about increasing the number of backends and frontends ( if we got it right, as we plan to use multiple backends, we should use imapc in order to bind the sharer and the accessing user to the same backend ) . On dovecot backend we've configured the new shared namespace, as stated in the documentation ( https://doc.dovecot.org/configuration_manual/shared_mailboxes/shared_mailbox es/#user-shared-mailboxes ) : -- Dovecot conf -------------------- # Maildir's location is under home dir, which is returned by userdb. mail_location = maildir:~/Maildir:VOLATILEDIR=/tmp_lock/%2.256Nu/%u # Quota, mail_log plugins enabled everywhere mail_plugins = quota notify acl fts fts_lucene mail_log mailbox_alias virtual # Default namespace namespace { hidden = no inbox = yes location = prefix = separator = / type = private mailbox Sent { special_use = \Sent auto = create } mailbox Trash { special_use = \Trash auto = create } mailbox Drafts { special_use = \Drafts auto = create } mailbox SPAM { special_use = \Junk auto = create } } # namespace used by virtual search namespace { prefix = VrtSearch. separator = / location = virtual:/etc/dovecot-common-backend/virtual:INDEX=~/virtual hidden = yes subscriptions = no inbox = no list = no } # IMAP SHARING FEATURE service dict { unix_listener dict { mode = 0600 user = vpopmail group = vchkpw } } plugin { acl = vfile acl_ignore_namespace = shared/* acl_shared_dict = proxy::acl-mysql } dict { acl-mysql = mysql:/etc/dovecot-common-backend/dovecot-dict-sql.conf.ext } # namespace used for IMAP sharing feature namespace { type = shared separator = / prefix = shared/%%u/ location = maildir:%%h/Maildir:INDEX=~/Maildir/shared/%%u list = children subscriptions = no } -- Dovecot dict sql -------------------- # IMAP SHARING FEATURE connect = host=x.x.x.x dbname=xxxxxx user=xxxxxx password=xxxxxx map { pattern = shared/shared-boxes/user/$to/$from table = imap_user_shares value_field = dummy fields { from_user = $from to_user = $to } } map { pattern = shared/shared-boxes/anyone/$from table = imap_anyone_shares value_field = dummy fields { from_user = $from } } -- Dict DB contents -------------------- mysql> select * from imap_user_shares; +------------------------------------------+-------------------------------- --------+-------+ | from_user | to_user | dummy | +------------------------------------------+-------------------------------- --------+-------+ | test.imapsharer01(a)td01.testdomain.it | test.imapuser01(a)td01.testdomain.it | 1 | +------------------------------------------+-------------------------------- --------+-------+ For our tests, we've : - created two users test.imapsharer01(a)td01.testdomain.it test.imapuser01(a)td01.testdomain.it - Created two INBOX subfolders on the sharer01 user, giving user01 those permissions : subfolder01 giving to user01 Full control subfolder02ro giving to user01 list and read - logging as user01 with thunderbird, we see the shared namespace tree : shared test.imapsharer01(a)td01.testdomain.it subfolder01 subfolder02 we're able to see the contents of each folder, even the INBOX . Checking the folder properties, thunderbird reports that the user01 has full control on the INBOX of shared01 . If we try to check the ACL via python script ( imaplib.gestacl ) or via doveadm, we can see that the sharer01 INBOX has no rights for user01 . But via thunderbird ( or other email clients ) we can delete emails . ACL - sharer01 accessing its folder ('OK', [b'INBOX test.imapsharer01(a)td01.testdomain.it lrwstipekxacd']) ('OK', [b'subfolder01 test.imapuser01(a)td01.testdomain.it akxeilprwtscd test.imapsharer01(a)td01.testdomain.it lrwstipekxacd']) ('OK', [b'subfolder02ro test.imapuser01(a)td01.testdomain.it lr test.imapsharer01(a)td01.testdomain.it lrwstipekxacd']) ACL - user01 accessing sharer01 folders ('OK', [b'shared/test.imapsharer01(a)td01.testdomain.it/INBOX']) ('OK', [b'shared/test.imapsharer01(a)td01.testdomain.it/subfolder01 test.imapuser01(a)td01.testdomain.it akxeilprwtscd']) ('OK', [b'shared/test.imapsharer01(a)td01.testdomain.it/subfolder02ro test.imapuser01(a)td01.testdomain.it lr']) Testing with doveadm shows the correct ACL : # doveadm -c /etc/dovecot-backend01/dovecot.conf acl debug -u test.imapuser01(a)td01.testdomain.it shared/test.imapsharer01(a)td01.testdomain.it/INBOX doveadm(test.imapuser01(a)td01.testdomain.it): Info: Mailbox 'INBOX' is in namespace 'shared/test.imapsharer01(a)td01.testdomain.it/' doveadm(test.imapuser01(a)td01.testdomain.it): Info: Mailbox path: /home/vpopmail/domains/td01.testdomain.it/dccm4584.imapsharer01/Maildir doveadm(test.imapuser01(a)td01.testdomain.it): Info: All message flags are shared across users in mailbox doveadm(test.imapuser01(a)td01.testdomain.it): Info: User test.imapuser01(a)td01.testdomain.it has no rights for mailbox doveadm(test.imapuser01(a)td01.testdomain.it): Error: User test.imapuser01(a)td01.testdomain.it is missing 'lookup' right doveadm(test.imapuser01(a)td01.testdomain.it): Info: Mailbox shared/test.imapsharer01(a)td01.testdomain.it/INBOX is NOT visible in LIST # doveadm -c /etc/dovecot-backend01/dovecot.conf acl debug -u test.imapuser01(a)td01.testdomain.it shared/test.imapsharer01(a)td01.testdomain.it/subfolder01 doveadm(test.imapuser01(a)td01.testdomain.it): Info: Mailbox 'subfolder01' is in namespace 'shared/test.imapsharer01(a)td01.testdomain.it/' doveadm(test.imapuser01(a)td01.testdomain.it): Info: Mailbox path: /home/vpopmail/domains/td01.testdomain.it/dccm4584.imapsharer01/Maildir/.sub folder01 doveadm(test.imapuser01(a)td01.testdomain.it): Info: All message flags are shared across users in mailbox doveadm(test.imapuser01(a)td01.testdomain.it): Info: User test.imapuser01(a)td01.testdomain.it has rights: lookup read write write-seen write-deleted insert post expunge create delete admin doveadm(test.imapuser01(a)td01.testdomain.it): Info: Mailbox found from dovecot-acl-list doveadm(test.imapuser01(a)td01.testdomain.it): Info: User test.imapsharer01(a)td01.testdomain.it found from ACL shared dict doveadm(test.imapuser01(a)td01.testdomain.it): Info: Mailbox shared/test.imapsharer01(a)td01.testdomain.it/subfolder01 is visible in LIST # doveadm -c /etc/dovecot-backend01/dovecot.conf acl debug -u test.imapuser01(a)td01.testdomain.it shared/test.imapsharer01(a)td01.testdomain.it/subfolder02ro doveadm(test.imapuser01(a)td01.testdomain.it): Info: Mailbox 'subfolder02ro' is in namespace 'shared/test.imapsharer01(a)td01.testdomain.it/' doveadm(test.imapuser01(a)td01.testdomain.it): Info: Mailbox path: /home/vpopmail/domains/td01.testdomain.it/dccm4584.imapsharer01/Maildir/.sub folder02ro doveadm(test.imapuser01(a)td01.testdomain.it): Info: All message flags are shared across users in mailbox doveadm(test.imapuser01(a)td01.testdomain.it): Info: User test.imapuser01(a)td01.testdomain.it has rights: lookup read doveadm(test.imapuser01(a)td01.testdomain.it): Info: Mailbox found from dovecot-acl-list doveadm(test.imapuser01(a)td01.testdomain.it): Info: User test.imapsharer01(a)td01.testdomain.it found from ACL shared dict doveadm(test.imapuser01(a)td01.testdomain.it): Info: Mailbox shared/test.imapsharer01(a)td01.testdomain.it/subfolder02ro is visible in LIST in the debug log we can see the delete operation : Nov 15 10:53:25 imap(357716 test.imapuser01@td01.testdomain.it):Debug: Mailbox Trash: Mailbox opened Nov 15 10:53:25 imap(357716 test.imapuser01@td01.testdomain.it):Debug: acl vfile: file /home/vpopmail/domains/td01.testdomain.it/dccm4584.imapuser01/Maildir/.Trash /dovecot-acl not found Nov 15 10:53:25 imap(357716 test.imapuser01@td01.testdomain.it):Debug: Mailbox shared/test.imapsharer01(a)td01.testdomain.it: Mailbox opened Nov 15 10:53:25 imap(357716 test.imapuser01@td01.testdomain.it):Debug: Mailbox Trash: Adding field flags to cache for the first time (uid=0) Nov 15 10:53:25 imap(357716 test.imapuser01@td01.testdomain.it):Debug: Mailbox Trash: saving UID 0: Opened mail because: header Message-ID (Cache file is unusable) Nov 15 10:53:25 imap(357716 test.imapuser01@td01.testdomain.it):Debug: Mailbox Trash: Adding field hdr.Message-ID to cache for the first time (uid=0) Nov 15 10:53:25 imap(357716 test.imapuser01@td01.testdomain.it):Debug: Mailbox shared/test.imapsharer01(a)td01.testdomain.it: UID 1: Expunge requested Nov 15 10:53:25 imap(357716 test.imapuser01@td01.testdomain.it):Debug: Mailbox Trash: Purging (new file_seq=1668506005): creating cache Nov 15 10:53:25 imap(357716 test.imapuser01@td01.testdomain.it):Debug: Mailbox Trash: Purging finished, file_seq changed 0 -> 1668506005, size=0 -> 412, max_uid=0 Nov 15 10:53:25 imap(357716 test.imapuser01@td01.testdomain.it):Info: copy from shared/test.imapsharer01(a)td01.testdomain.it: box=Trash, uid=1, msgid=<mnid2m.1.24789225.57389.0.1127444.c495198613._(a)nl.aruba.it> Nov 15 10:53:25 imap(357716 test.imapuser01@td01.testdomain.it):Info: expunge: box=shared/test.imapsharer01(a)td01.testdomain.it, uid=1, msgid=<mnid2m.1.24789225.57389.0.1127444.c495198613._(a)nl.aruba.it> Nov 15 10:53:26 imap(357716 test.imapuser01@td01.testdomain.it):Debug: Mailbox shared/test.imapsharer01(a)td01.testdomain.it: UID 1: Mail expunged After we delete a message, we cannot find it on the Trash folders ( user01 or sharer01 ) . Are we missing something ? Thanks Stefano

1 0

Questions around mailcrypt and LDAP
by Andre Rodier 15 Nov '22

15 Nov '22

Hello, all. I read carefully the messages about mailcrypt on the mailing list, especially this response from Aki: > It's best suited for securing external storage such as NFS or object storage. > There are possibilities to encrypt the key using user's password, but this > takes careful planning. The keys can also come from userdb , e.g. LDAP. I am able to extend the LDAP schema of my OpenLDAP server to store a key into LDAP attribute for each user. In this case, would it be enough for Dovecot to encrypt the messages when they arrive ? Maybe I misunderstand the documentation. Even when using user keys protected by a password, the Dovecot LMTP process should be able to encrypt the emails with user’s public key, without a password, no ? Ideally, I would like to store user's emails encrypted, so each users cannot access other user's emails. I don't need folder sharing. Thanks for your advice. Kind regards, André Rodier

2 2

Dovecot not offering TLSv1.2 after a few minutes
by Markus Wienhöfer 14 Nov '22

14 Nov '22

I have a very strange problem with one of our Dovecot servers (2.2.33.2) on Ubuntu 18.04. The current configuration allows for TLSv1 to TLSv1.3 connections. I can verify those using testssl.sh, the tests will succeed (although correctly mentioning, that TLSv1 and TLSv1.1 should be disabled). Running the tests again after about 5 minutes, the results are different. TLSv1.2 now shows "not offered and downgraded to a weaker protocol". Has anybody experienced a similar problem before? Best regards Markus

2 1

Dovecot 2.3.19.1: BUG: Mailbox renaming algorithm got into a potentially infinite loop, aborting
by Ralf Becker 14 Nov '22

14 Nov '22

I found this from 2019 on the list: https://www.mail-archive.com/dovecot@dovecot.org/msg78898.html Timo mentioned it's tracked internally as DOP-1501, but I could find nothing about it being fixed on the (public) list. Any news about that and is the workaround of deleting dovecot.mailbox.log* and dovecot.list.index* still the recommendation, when running into this bug. Ralf -- Ralf Becker EGroupware GmbH [www.egroupware.org] Handelsregister HRB Kaiserslautern 3587 Geschäftsführer Birgit und Ralf Becker Leibnizstr. 17, 67663 Kaiserslautern, Germany Telefon +49 631 31657-0

2 2

Submission: track authenticated_user
by itanguy＠univ-brest.fr 10 Nov '22

10 Nov '22

Hello, We would like to use Dovecot Submission to have less queues to maintain. The relayhost (Postfix) after Dovecot routes mail by sender_map, so authenticated user, not the "mail from" because . For what we've seen, we can't use receive header to retrieve this authenticated_user. Example of header : Received: from mailhost ([0.0.0.0]) by submission.host with ESMTPSA id submission-id (envelope-from<myadress(a)example.com>) for<myadress(a)example.com>; Thu, 9 Nov 2022 08:27:41 +0000 So we've thought to use X-client, but reading the doc seems that's not the a good way : /https://doc.dovecot.org/settings/core// - submission_relay_trusted If enabled, the relay server is trusted. Determines whether we try to send (Postfix-specific) XCLIENT data to the relay server (only if enabled). But, XCLIENT for Submission seems to not transfer LOGIN : /https://doc.dovecot.org/settings/core/ / XCLIENT command can be used to override: Session ID Client IP and port (|%{rip}|,|%{rport}|) HELO - Overrides what the client sent earlier in the EHLO command LOGIN - Currently unused PROTO - Currently unused |forward_*| fields can be sent to auth process’s passdb lookup The trust is always checked against the connecting IP address. Except if HAProxy is used, then the original client IP address is used. Do you know another way to inform the relayhost of submission of the authenticated_user? Thanks Ismaël TANGUY

2 1

SSL error
by Ruben Safir 10 Nov '22

10 Nov '22

Hello I am getting this error and I have no idea why. openssh is upto date client bash-5.1$ fetchmail --ssl -p POP3 -uruben mail2.boroparkmd.com Enter password for ruben(a)mail2.boroparkmd.com: fetchmail: Server certificate verification error: self signed certificate fetchmail: Missing trust anchor certificate: /C=US/ST=NY/L=Brooklyn/O=Dovecot/OU=mail servuces/CN=*.boroparkmd.com/emailAddress=ruben@mrbrklyn.com fetchmail: This could mean that the root CA's signing certificate is not in the trusted CA certificate location, or that c_rehash needs to be run on the certificate directory. For details, please see the documentation of --sslcertpath and --sslcertfile in the manual page. See README.SSL for details. fetchmail: OpenSSL reported: error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed fetchmail: mail2.boroparkmd.com: SSL connection failed. fetchmail: socket error while fetching from ruben(a)mail2.boroparkmd.com fetchmail: Query status=2 (SOCKET) Server: Nov 9 09:36:13 mail2 dovecot[25838]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:0A000412:SSL routines::sslv3 alert bad certificate: SSL alert number 42 (no auth attempts in 1 secs): user=<>, rip=96.57.23.83, lip=96.57.23.84, TLS handshaking: SSL_accept() failed: error:0A000412:SSL routines::sslv3 alert bad certificate: SSL alert number 42, session=<MBsPlArtPtxgORdT> -- So many immigrant groups have swept through our town that Brooklyn, like Atlantis, reaches mythological proportions in the mind of the world - RI Safir 1998 http://www.mrbrklyn.com DRM is THEFT - We are the STAKEHOLDERS - RI Safir 2002 http://www.nylxs.com - Leadership Development in Free Software http://www2.mrbrklyn.com/resources - Unpublished Archive http://www.coinhangout.com - coins! http://www.brooklyn-living.com Being so tracked is for FARM ANIMALS and extermination camps, but incompatible with living as a free human being. -RI Safir 2013

4 6

Help with configuration?
by Ellie McNeill 10 Nov '22

10 Nov '22

Hi, I'm running my own mail server on Debian 11 with exim and Dovecot 2.3.13. I have it working, but I'm seeking advice on further customising my setup. I'm using the Maildir++ format with some personal folders. I use IMAP to retrieve mail and Dovecot's submission server to send mail. 1. I want to have incoming emails automatically placed in certain folders instead of 'Inbox' based on certain criteria. For example, I want all emails from PayPal to go into the 'PayPal' folder and all emails from the Debian mailing list to go into the 'Debian' folder. Can dovecot do this for me and what is the best approach? 2. When I delete an email using my user client, it is only 'marked' as deleted (Thunderbird places a scored line through it, and a 'T' is added to the filename in the Maildir). How can I get dovecot to automatically move mail marked 'deleted' to the Trash folder each time? I also want further delete operations on any mail in the 'Trash' folder to be permanently deleted. 3. I want to hide my client IP address from the headers when submitting mail to Dovecot's submissiond, but I can't seem to find any way to disable this. I would prefer that recipients only see the server IP address, but not the IP address of the mail client which submitted it. Regards, Ellie PS - When signing up for the mailing list, there was no selection ability on the question "Would you like to get replies to your mails only to the list, ie. add a Reply-To header?"

5 5

Re: SSL error
by Joseph Tam 10 Nov '22

10 Nov '22

Ruben Safir <ruben(a)mrbrklyn.com> wrote: > > This got nothing to with LE or own CA. Bottom line is, you need to > > add your own CA to the cert tore (ideally) > > what is a cert tore? Someone has probably already replied to this, but it's a typo: the OP wanted to say "store". The certificate you created was used to sign itself ("self signed") and thus, asserts its own validity. If you need *other* people to trust your SSL service, you should sign your certificate using a third party authority (e.g. LetsEncrypt) to sign it. Most internet users will have these third party signing authority's certificates in their certificate store to validate your service certificate. If this is for your own personal use (i.e. you don't care about trust since you know it's your own certificate), you have to add your self-signed certificate into *your* system's certificate authority store so that your mail reader does not complain about an untrusted certificate. Clear? Joseph Tam <jtam.home(a)gmail.com>

1 0

doveadm backup|sync works for every folder but INBOX
by Ralf Becker 09 Nov '22

09 Nov '22

I'm trying to migrate an old Cyrus 2.5 server to Dovecot 2.3.19 using doveadm backup -R, which works for all folders but the INBOX itself, which always stays empty. The Cyrus side uses altnamespace:no and unixhierarchysep:no, it's used as imapc: remote in doveadm backup -R with imapc_list_prefix=INBOX Dovecot uses the following namespace to migrate into: namespace inboxes { inbox = yes location = mailbox Sent { auto = subscribe special_use = \Sent } ### some more folders omitted ### prefix = INBOX/ separator = / subscriptions = no } I use the following command line for the migration: doveadm -o imapc_features='rfc822.size fetch-headers' -o mail_prefetch_count=20 -o namespace/subs/location=mbox:/var/dovecot/subs -o imapc_user='someuser' -o imapc_password='secret' -o imapc_host=<cyrus-ip> -o imapc_list_prefix=INBOX -D backup -f -n INBOX/ -R -u someuser@somedomain imapc: The debug output contains the following lines: Nov 02 10:16:01 dsync(someuser@somedomain): Debug: brain S: Namespace INBOX/ has location imapc: Nov 02 10:16:01 dsync(someuser@somedomain): Debug: brain M: Local mailbox tree: INBOX guid=d8d5a3122bce5f63ef9101001ebfc848 uid_validity=1667223083 uid_next=1 subs=no last_change=0 last_subs=0 Nov 02 10:16:01 dsync(someuser@somedomain): Debug: brain S: Local mailbox tree: INBOX guid=c92f64f79f0d1ed01e6d5b314f04886c uid_validity=1577952633 uid_next=32691 subs=no last_change=0 last_subs=0 Nov 02 10:16:28 dsync(someuser@somedomain): Warning: Mailbox changes caused a desync. You may want to run dsync again: Remote lost mailbox GUID c92f64f79f0d1ed01e6d5b314f04886c (maybe it was just deleted?) The Cyrus server is solely used for the migration, no access from anywhere else! doveadm mailbox status -u someuser@somedomain all INBOX reports: INBOX messages=0 recent=0 uidnext=1 uidvalidity=1667223083 unseen=0 highestmodseq=1 vsize=0 guid=d8d5a3122bce5f63ef9101001ebfc848 firstsaved=never As all other folders seem ok, I blamed the failure with the INBOX on the imapc_list_prefix and altnamespace:no and tried, adding the INBOX content with an other doveadm sync run: doveadm -o imapc_features='rfc822.size fetch-headers' -o mail_prefetch_count=20 -o namespace/subs/location=mbox:/var/dovecot/subs -o imapc_user='someuser' -o imapc_password='secret' -o imapc_host=<cyrus-ip> -D sync -1 -f -m INBOX -n INBOX/ -R -u someuser@somedomain imapc: That gives the following output: Nov 02 10:55:45 dsync(someuser@somedomain): Debug: brain S: Namespace INBOX/ has location imapc: Nov 02 10:55:45 dsync(someuser@somedomain): Debug: brain M: Local mailbox tree: INBOX guid=d8d5a3122bce5f63ef9101001ebfc848 uid_validity=1667223083 uid_next=1 subs=no last_change=0 last_subs=0 Nov 02 10:55:45 dsync(someuser@somedomain): Debug: brain S: Local mailbox tree: INBOX guid=c92f64f79f0d1ed01e6d5b314f04886c uid_validity=1577952633 uid_next=32691 subs=no last_change=0 last_subs=0 Nov 02 10:55:45 dsync(someuser@somedomain): Debug: brain M: Remote mailbox tree: INBOX guid=c92f64f79f0d1ed01e6d5b314f04886c uid_validity=1577952633 uid_next=32691 subs=no last_change=0 last_subs=0 Nov 02 10:55:45 dsync(someuser@somedomain): Debug: brain S: Remote mailbox tree: INBOX guid=d8d5a3122bce5f63ef9101001ebfc848 uid_validity=1667223083 uid_next=1 subs=no last_change=0 last_subs=0 Nov 02 10:55:45 dsync(someuser@somedomain): Debug: brain M: Mailbox INBOX: local=d8d5a3122bce5f63ef9101001ebfc848/0/1, remote=c92f64f79f0d1ed01e6d5b314f04886c/0/1: GUIDs conflict - will be merged later Nov 02 10:55:45 dsync(someuser@somedomain): Debug: Mailbox INBOX: Mailbox opened Nov 02 10:55:45 dsync(someuser@somedomain): Debug: brain M: Changing mailbox INBOX GUID d8d5a3122bce5f63ef9101001ebfc848 -> c92f64f79f0d1ed01e6d5b314f04886c Nov 02 10:55:45 dsync(someuser@somedomain): Debug: dict(file): Waiting for dict to finish pending operations Nov 02 10:55:45 dsync(someuser@somedomain): Debug: brain S: Remote mailbox tree deletion: guid=c8882c0029ce5f63a9aa0000ca9feb0b type=mailbox timestamp=1667223081 name= local update=not found Nov 02 10:55:45 dsync(someuser@somedomain): Debug: brain S: Mailbox INBOX: local=c92f64f79f0d1ed01e6d5b314f04886c/0/1, remote=d8d5a3122bce5f63ef9101001ebfc848/0/1: GUIDs conflict - will be merged later Nov 02 10:55:45 dsync(someuser@somedomain): Debug: Mailbox INBOX: Mailbox opened Nov 02 10:55:45 dsync(someuser@somedomain): Debug: brain S: Ignore nonexistent mailbox GUID c92f64f79f0d1ed01e6d5b314f04886c with -1 sync Nov 02 10:55:45 dsync(someuser@somedomain): Debug: brain S: We don't have mailbox c92f64f79f0d1ed01e6d5b314f04886c Nov 02 10:55:45 dsync(someuser@somedomain): Debug: brain M: Ignoring missing remote box GUID c92f64f79f0d1ed01e6d5b314f04886c Nov 02 10:55:45 dsync(someuser@somedomain): Debug: dict(file): Waiting for dict to finish pending operations Nov 02 10:55:45 dsync(someuser@somedomain): Debug: dict(file): dict destroyed Nov 02 10:55:45 dsync(someuser@somedomain): Debug: dict(file): Waiting for dict to finish pending operations Nov 02 10:55:45 dsync(someuser@somedomain): Debug: dict(file): dict destroyed Nov 02 10:55:45 dsync(someuser@somedomain): Debug: imapc(10.44.88.3:143): Disconnected Nov 02 10:55:45 dsync(someuser@somedomain): Debug: User session is finished Nov 02 10:55:45 dsync(someuser@somedomain): Debug: dict(file): dict destroyed Nov 02 10:55:45 dsync(someuser@somedomain): Debug: dict(file): Waiting for dict to finish pending operations Nov 02 10:55:45 dsync(someuser@somedomain): Debug: dict(file): dict destroyed Nov 02 10:55:45 doveadm(40708): Debug: auth-master: conn unix:/run/dovecot/auth-userdb (pid=1,uid=0): Disconnected: Connection closed (fd=9) doveadm mailbox status -u someuser@somedomain all INBOX INBOX messages=0 recent=0 uidnext=1 uidvalidity=1667223083 unseen=0 highestmodseq=1 vsize=0 guid=c92f64f79f0d1ed01e6d5b314f04886c firstsaved=never The interesting part is that INBOX somehow seems to have two different GUIDs, depending on how I sync it (compare the two doveadm mailbox status outputs). In a tcpdump of the IMAP trafic I can see a STATUS "INBOX" (UIDNEXT UIDVALIDITY) but no EXAMINE "INBOX" or something else I would expect from the sync. I can provide the full output of doveadm backup/sync and a pcap of the IMAP trafic, but not to the public list. Any idea what's wrong with the sync of the INBOX or other suggestions / imapc parameters to use? Ralf -- Ralf Becker EGroupware GmbH [www.egroupware.org] Handelsregister HRB Kaiserslautern 3587 Geschäftsführer Birgit und Ralf Becker Leibnizstr. 17, 67663 Kaiserslautern, Germany Telefon +49 631 31657-0

3 17

"Mailbox isn't a valid MBOX file" Error
by Elise 06 Nov '22

06 Nov '22

Running currently two local mailclients: Outlook 2021 and Thunderbird 102.4.2 When using TB and remove a message on my main account, I get this error: [CANNOT] Mailbox isn't a valid mailbox On any other TB configured email accounts I can remove messages without any problems. First I thought that Outlook might block removal on messages, but the issue appears as well if I close that mail client. Can you tell what is causing this problem? Best regards, Jos Chrispijn

5 4

Any update on lazy load SNI?
by Pierre Allétru 03 Nov '22

03 Nov '22

Hi folks, We need to use SNI with Dovecot at a relatively large scale and I was wondering if there's any update on the ability to: 1 - Lazy load SNI certificates when they are needed instead of loading them all at once during startup/reload, thus taking a lot of memory and being very slow. 2 - Not having to reload Dovecot every time a new domain cert is added in conf. 3 - Or at least have Dovecot keep processing clients while the slow reload happens. This has been asked already in a 2016 thread: https://www.dovecot.org/pipermail/dovecot/2016-November/106075.html. Regarding point 3 there's a reply from Aki saying it was in the internal tasklist ( https://www.dovecot.org/pipermail/dovecot/2016-November/106089.html) Anybody knows if some progress has been made on these subjects? I can't anything in the docs or any recent information anywhere else. Thanks, -- Pierre Allétru 06 70 55 08 35 pierre.alletru(a)gmail.com

2 2

how to limit a global disk quota
by linuxguy＠gmx.net 03 Nov '22

03 Nov '22

1 0

The end of Dovecot Director?
by Steff Majeur 02 Nov '22

02 Nov '22

I recently stumbled upon the following commit on the Dovecot core Github repository: https://github.com/dovecot/core/commit/4a187116dc2311804be22724007d35732300… Apparently, Dovecot Director is going to be removed in the next major version of Dovecot and the commercial Dovecot cluster architecture will be its successor: https://github.com/dovecot/documentation/blob/a85b742ec4fc2744db30a6943b3c2… This would be a huge blow for many organizations around the world that are currently using Dovecot with Director in a shared storage environment. Can anyone of the Dovecot developers maybe enlighten us about the future of Dovecot? - Will there still be the Director feature in the next community release of Dovecot? - If not, will there be a community feature that is on par with the current Director feature? - For how long will Dovecot version 2.3 still be supported (security fixes, bug fixes)? Is there any EOL plan? Thanks for any clarification! Steff

31 56

Dovecot does not start on MacOS Monterey
by Doro Rose 30 Oct '22

30 Oct '22

Hi, this is a duplicate of the "Dovecot does not start on MacOS Monterey 12.01" thread. I’m still seeing this on dovecot 2.3.19.1. Is there a recommended workaround? The last post in that thread indicated that some modifications in `./src/lib/restrict-process-size.c` might be necessary. Best regards Doro

3 6

how to configure imapsieve to be used per user
by Marc 29 Oct '22

29 Oct '22

I only see configurations that are active for all users, how to configure this in the user sieve rules. I only need this for specific users.

7 11

oauth2 + postgres = Panic: file http-client.c: line 646 (http_client_context_close)
by Sebastiano Degan 27 Oct '22

27 Oct '22

I could to reply to the original thread: https://www.mail-archive.com/dovecot@dovecot.org/msg85204.html But I managed to get a stack trace of the error: root@mail:~ # lldb /usr/local/libexec/dovecot/auth (lldb) target create "/usr/local/libexec/dovecot/auth" Current executable set to '/usr/local/libexec/dovecot/auth' (x86_64). (lldb) run Process 54354 launched: '/usr/local/libexec/dovecot/auth' (x86_64) Error: stats: open(old-stats-user) failed: No such file or directory Panic: file http-client.c: line 646 (http_client_context_close): assertion failed: (cctx->clients_list == NULL) Process 54354 stopped * thread #1, name = 'auth', stop reason = signal SIGABRT frame #0: 0x000000080159f33a libc.so.7`__sys_thr_kill + 10 libc.so.7`__sys_thr_kill: -> 0x80159f33a <+10>: jb 0x80159d498 0x80159f340 <+16>: retq 0x80159f341: int3 0x80159f342: int3 (lldb) bt all * thread #1, name = 'auth', stop reason = signal SIGABRT * frame #0: 0x000000080159f33a libc.so.7`__sys_thr_kill + 10 frame #1: 0x0000000801517c74 libc.so.7`__raise + 52 frame #2: 0x00000008015c9109 libc.so.7`abort + 73 frame #3: 0x00000008012e606b libdovecot.so.0`default_fatal_finish(type=LOG_TYPE_PANIC, status=0) at failures.c:465:3 frame #4: 0x00000008012e3f7c libdovecot.so.0`fatal_handler_real(ctx=0x00007fffffffe610, format="file %s: line %d (%s): assertion failed: (%s)", args=0x00007fffffffe5f0) at failures.c:477:2 frame #5: 0x00000008012e3f14 libdovecot.so.0`default_fatal_handler(ctx=0x00007fffffffe610, format="file %s: line %d (%s): assertion failed: (%s)", args=0x00007fffffffe5f0) at failures.c:485:2 frame #6: 0x00000008012e4253 libdovecot.so.0`i_panic(format="file %s: line %d (%s): assertion failed: (%s)") at failures.c:530:2 frame #7: 0x000000080124f2ed libdovecot.so.0`http_client_context_close(cctx=0x000000080205c048) at http-client.c:646:2 frame #8: 0x000000080124ef22 libdovecot.so.0`http_client_global_context_ioloop_switched(prev_ioloop=0x0000000802030640) at http-client.c:710:3 frame #9: 0x00000008013102e4 libdovecot.so.0`io_loop_set_current(ioloop=0x0000000000000000) at ioloop.c:982:4 frame #10: 0x00000000010aa0be auth`driver_pgsql_set_state(db=0x0000000802092200, state=SQL_DB_STATE_IDLE) at driver-pgsql.c:103:3 frame #11: 0x00000000010a9ff0 auth`connect_callback(db=0x0000000802092200) at driver-pgsql.c:206:3 frame #12: 0x000000080130f3b2 libdovecot.so.0`io_loop_call_io(io=0x00000008020105c0) at ioloop.c:737:2 frame #13: 0x0000000801313e0b libdovecot.so.0`io_loop_handler_run_internal(ioloop=0x0000000802030640) at ioloop-kqueue.c:164:4 frame #14: 0x000000080130fa15 libdovecot.so.0`io_loop_handler_run(ioloop=0x0000000802030640) at ioloop.c:789:2 frame #15: 0x000000080130f8fa libdovecot.so.0`io_loop_run(ioloop=0x0000000802030640) at ioloop.c:762:3 frame #16: 0x00000000010a7eef auth`driver_pgsql_wait(_db=0x0000000802092200) at driver-pgsql.c:1279:3 frame #17: 0x00000000010a4c59 auth`sql_wait(db=0x0000000802092200) at sql-api.c:820:3 frame #18: 0x00000000010a7fc0 auth`driver_pgsql_get_flags(db=0x0000000802092200) at driver-pgsql.c:306:3 frame #19: 0x00000000010a2fa9 auth`sql_get_flags(db=0x0000000802092200) at sql-api.c:171:10 frame #20: 0x00000000010a585e auth`driver_sqlpool_get_flags(_db=0x0000000802092000) at driver-sqlpool.c:450:9 frame #21: 0x00000000010a2fa9 auth`sql_get_flags(db=0x0000000802092000) at sql-api.c:171:10 frame #22: 0x000000000108c675 auth`passdb_sql_init(_module=0x0000000802041ca8) at passdb-sql.c:281:10 frame #23: 0x000000000107d577 auth`passdb_init(passdb=0x0000000802041ca8) at passdb.c:247:3 frame #24: 0x0000000001052a89 auth`auth_passdb_init(passdb=0x0000000802041ba8) at auth.c:308:2 frame #25: 0x0000000001051dbc auth`auth_init(auth=0x0000000802041b70) at auth.c:322:3 frame #26: 0x0000000001051d21 auth`auths_init at auth.c:427:3 frame #27: 0x0000000001050610 auth`main_init at main.c:242:2 frame #28: 0x00000000010503ad auth`main(argc=1, argv=0x00007fffffffeaf8) at main.c:391:2 frame #29: 0x000000000104ff7d auth`_start(ap=<unavailable>, cleanup=<unavailable>) at crt1_c.c:75:7

1 0

Mailing list IMAP archive.
by dovecot＠ptld.com 27 Oct '22

27 Oct '22

I am trying to use the IMAP mailing list archive described on https://www.dovecot.org/mailing-lists/ Is this feature still functioning? Using Thunderbird i get an error message that the connection was refused. I don't know if Thunderbird isn't functioning properly (with handling no password) or if the service is down. My end goal is i want to search the archive for solutions before asking the list. Is there a browser based option to search the archives? I didn't see a search option on https://dovecot.org/pipermail/dovecot/

3 3

Re: The end of Dovecot Director?
by William Edwards 27 Oct '22

27 Oct '22

> Op 27 okt. 2022 om 04:25 heeft Timo Sirainen <timo(a)sirainen.com> het volgende geschreven: > > Director never worked especially well, and for most use cases it's just unnecessarily complex. I think usually it could be replaced with: > > * Database (sql/ldap/whatever) containing user -> backend table. > * Configure Dovecot proxy to use this database as passdb. > * For HA change dovemon to update the database if backend is down to move users elsewhere > * When backend comes up, move users into it. Set delay_until extra field for user in passdb to 5 seconds into future and kick the user in its old backend (e.g. via doveadm HTTP API). > > All this can be done with existing Dovecot. Should be much easier to build a project doing this than forking director. This is my train of thought as well. I believe the following would suffice for most setups. A database with: - Current vhost count per backend server. Alternatively, count the temporary user mappings. - Backend servers. - Temporary user mappings between user - backend server. This database is accessible by all Dovecot proxies in case there’s multiple. Steps when receiving a login: - Check if a temporary user mapping exists. - If so, proxy to the backend server in the temporary mapping. (To do: clean up mappings.) - If not, pick the backend server with the lowest vhost count, create a temporary mapping, then increase the vhost count of the chosen backend server. A monitoring service up/downs backend servers. E.g. by checking the port that we proxy to for each backend server. When a backend server is set to down, kick the user to force a reconnection. (Is that how Director ‘moves’ users?)

2 2

Catch all for Metadata storage in SQL database
by Steffen Kaiser 27 Oct '22

27 Oct '22

Hi, the https://doc.dovecot.org/configuration_manual/imap_metadata/ sample uses mail_attribute_dict = file:%h/Maildir/dovecot-attributes which stores all keys=value pairs in the file. http://dovecot.2317879.n4.nabble.com/Dovecot-v2-3-9-3-HTTP-API-Endpoint-for… uses a SQL dict, however very specific ones. How can I use a SQL dict to store _all_ keys, as with a file based storage? I cannot find a documentation for "pattern" specification, that works as "catch all", in order to store anything not catched by patterns into the database. https://wiki.dovecot.org/Dictionary does not give any hint (in my eyes). -- Steffen Kaiser

3 4

Dynamically set LDAP user namespace using two attributes
by Thomas Leuxner 26 Oct '22

26 Oct '22

Hi, I’m looking for a way to use two LDAP attributes to create a user-specific namespace to be expunged e.g. mailExpungeTrash=namespace/inbox/mailbox/%{ldap:mailTrashMailbox}/autoexpunge I can create the namespace fine returning the full string to be expunged: mailExpungeTrash=namespace/inbox/mailbox/Deleted\_Messages/autoexpunge However I want to alter the namespace using a second LDAP attribute like: mailExpungeTrash=namespace/inbox/mailbox/%{ldap:mailTrashMailbox}/autoexpunge Regards Thomas

1 0

Re: ot: how to t/s TBird problems ?
by Joseph Tam 26 Oct '22

26 Oct '22

Voytek Eymont) wrote: > yesterday it was > --------------- > I'm still experiencing a 40 second delay to retrieve emails for > xxx If *this* is the problem you saw (and not the 2 hour delay mentioned further in the thread), you can get a hint where the problem lies if you see a 40s gap in the session logs: it will tell you who was doing what when the pause happened (e.g. during authentication? During LIST fetch? During message fetch?) For example, if dovecot was busy mulching through a large INBOX rebuilding indices, I can see how it can chew up 40s under some circumstances. Joseph Tam <jtam.home(a)gmail.com>

2 1

how to clean virtual users correctly
by Henry R 26 Oct '22

26 Oct '22

Hello I removed the user in static userdb file, and deleted /var/mail/vhosts/$domain/$user dir. when I recreated the user, the system dirs (sent, draft etc) disappeared. Anything wrong here? Thank you. -- Henry R https://openmbox.net/

2 1

Re: ot: how to t/s TBird problems ?
by Joseph Tam 23 Oct '22

23 Oct '22

Voytek Eymont writes: > I've enabled logging as per your suggestion: > > -rw------- 1 vmail vmail 127 Oct 16 21:38 20221016-213738.25640.1.in > -rw------- 1 vmail vmail 8546603 Oct 16 21:38 20221016-213738.25640.1.out > -rw------- 1 vmail vmail 96 Oct 16 21:58 20221016-215757.26075.1.in > -rw------- 1 vmail vmail 8343463 Oct 16 21:58 20221016-215757.26075.1.out > > # cat 20221016-213738.25640.1.in > 1665916659.491025 STAT > 1665916659.550829 LIST > 1665916676.430794 UIDL > 1665916693.761281 RETR 114437 > 1665916694.440965 QUIT > # cat 20221016-215757.26075.1.in > 1665917878.786953 STAT > 1665917878.863136 LIST > 1665917905.610805 UIDL > 1665917924.491198 QUIT > # > > what should I look in the .out file ? > > some of the file is like: > .... > 1665916661.234807 114436 70097 > 1665916661.234814 114437 154498 > 1665916661.234821 . > 1665916676.430870 +OK > 1665916676.981415 1 000024b95283283a > 1665916676.981459 2 000024ba5283283a > .... > > 1665916679.434297 114436 00033fcf5283283a > 1665916679.434327 114437 00033fd05283283a > 1665916679.434349 . > 1665916694.048139 +OK 154498 octets > 1665916694.048199 Return-Path: <buyer-notice14.g(a)mail.aliexpress.com> > .... I haven't seen anyone else replying, but there doesn't seem anything anomalous with the output. The session commands-repliesd is is more or less what I expect, although to make sense of this, you'll have to splice the input and output files together using timestamps to see the sequential flow of data. I forget what the symptoms you originally reported, but theoretically, you could simulate either client or server by feeding in the above data and see how the other end behaves. If dovecot is serving out the correct data, then TB is somehow misinterpreting it. > on an uneducated guess, the mailbox is just 'too large' ? > POP has difficulty handling so many files ? Typically, if some resource limit is hit, one side or the other will create a log or notification. Your INBOX is large, but not outrageous. You can test it directly by creating smaller subsets of the INBOX messages and see if the problem goes away. Joseph Tam <jtam.home(a)gmail.com>

5 4

Office 365 SSL issue
by Ervin Hegedüs 23 Oct '22

23 Oct '22

Hi there, I have a bit old Dovecot instance (Ubuntu 14.04 - there is no chance to upgrade it), with these versions of packages: * Dovecot: 2.2.9 * OpenSSL: 1.0.1f Few days ago a client noticed me, that he can't reach his mails through his Office 365. He uses POP3S. I tried to set up a same client for this Dovecot server, but when I configured the POP3 protocoll, after the settings check Office says: Your server does not support the connection encryption type you have specified. Try changing the encryption method. Contact your mail server ... While the client was trying, I see these lines in the log: Oct 21 16:12:18 mail dovecot: pop3-login: Debug: SSL: where=0x10, ret=1: before/accept initialization [192.168.8.133] Oct 21 16:12:18 mail dovecot: pop3-login: Debug: SSL: where=0x2001, ret=1: before/accept initialization [192.168.8.133] Oct 21 16:12:18 mail dovecot: pop3-login: Debug: SSL: where=0x2001, ret=1: SSLv3 read client hello A [192.168.8.133] Oct 21 16:12:18 mail dovecot: pop3-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write server hello A [192.168.8.133] Oct 21 16:12:18 mail dovecot: pop3-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write certificate A [192.168.8.133] Oct 21 16:12:18 mail dovecot: pop3-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write key exchange A [192.168.8.133] Oct 21 16:12:18 mail dovecot: pop3-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write server done A [192.168.8.133] Oct 21 16:12:18 mail dovecot: pop3-login: Debug: SSL: where=0x2001, ret=1: SSLv3 flush data [192.168.8.133] Oct 21 16:12:18 mail dovecot: pop3-login: Debug: SSL: where=0x2002, ret=-1: SSLv3 read client certificate A [192.168.8.133] Oct 21 16:12:18 mail dovecot: pop3-login: Debug: SSL: where=0x2002, ret=-1: SSLv3 read client certificate A [192.168.8.133] Oct 21 16:12:18 mail dovecot: pop3-login: Warning: SSL failed: where=0x2002: SSLv3 read client certificate A [192.168.8.133] Oct 21 16:12:18 mail dovecot: pop3-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=192.168.8.133, lip=192.168.8.21, TLS handshaking: Disconnected, session=<9sWMB4zr+ADAqAiF> Which is weird, because I disabled SSLv3. Here is the (relevant) config: ssl_cert = </etc/dovecot/dovecot.crt ssl_key = </etc/dovecot/dovecot.key ssl_dh_parameters_length = 2048 ssl_protocols = !SSLv2 !SSLv3 ssl_cipher_list = ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA verbose_ssl = yes When I check the supported encryption type with nmap, I get this: $ nmap --script ssl-enum-ciphers -p 995 192.168.8.21 Starting Nmap 7.80 ( https://nmap.org ) at 2022-10-22 10:20 CEST Nmap scan report for 192.168.8.21 Host is up (0.021s latency). PORT STATE SERVICE 995/tcp open pop3s | ssl-enum-ciphers: | TLSv1.0: | ciphers: | TLS_DHE_RSA_WITH_AES_128_CBC_SHA (dh 2048) - A | ... | TLSv1.1: | ciphers: | TLS_DHE_RSA_WITH_AES_128_CBC_SHA (dh 2048) - A | ... | TLSv1.2: | ciphers: | TLS_DHE_RSA_WITH_AES_128_CBC_SHA (dh 2048) - A | ,,, |_ least strength: C When I check the traffic with tcpdump, I see that client uses TLSv1.2: https://www.dropbox.com/s/k8wqzg5xzki5p23/pop3_traffic.png Only the one client who reported the problem, and my test client can't reach the server - other (about) 400 users can (but I don't know with what kind of types of clients - most use Thunderbird). What can I do? How can I fix this problem? As I wrote, this problem has came few days ago suddenly... Thanks, a.

4 5

Change password schema and post-login script
by Christos Chatzaras 23 Oct '22

23 Oct '22

Hello, Question #1: For version 2.3.19.1 these commands use BLF-CRYPT, right? doveadm pw doveadm pw -s CRYPT Question #2: I want to change password schema for current users. For users using POP3 or IMAP I can do it using a post-login script. I have some accounts used only to send e-mails using Postfix, so no POP3/IMAP logins for these accounts. Is any way to change password schema for these accounts? My config: # 2.3.19.1 (9b53102964): /usr/local/etc/dovecot/dovecot.conf # Pigeonhole version 0.5.19 (4eae2f79) # OS: FreeBSD 13.1-RELEASE-p2 amd64 zfs # Hostname: server2.example.com auth_master_user_separator = * auth_mechanisms = plain login auth_verbose = yes default_process_limit = 225 disable_plaintext_auth = no first_valid_gid = 0 first_valid_uid = 1001 mail_location = maildir:/home/mail/%d/%n:INDEX=/tmpfs/dovecot_%u:CONTROL=/var/mail/%d/%n mail_privileged_group = mail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext imapsieve vnd.dovecot.imapsieve namespace inbox { inbox = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk { auto = subscribe special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Messages" { auto = no special_use = \Sent } mailbox Trash { auto = subscribe special_use = \Trash } prefix = } passdb { args = /usr/local/etc/dovecot/passwd.master driver = passwd-file master = yes result_success = continue } passdb { args = /usr/local/etc/dovecot/passwd.suspended deny = yes driver = passwd-file } passdb { args = /usr/local/etc/dovecot/passwd driver = passwd-file } plugin { imapsieve_mailbox1_before = file:/usr/local/lib/dovecot/sieve/report-spam.sieve imapsieve_mailbox1_causes = COPY imapsieve_mailbox1_name = Junk imapsieve_mailbox2_before = file:/usr/local/lib/dovecot/sieve/report-ham.sieve imapsieve_mailbox2_causes = COPY imapsieve_mailbox2_from = Junk imapsieve_mailbox2_name = * quota = maildir:User quota quota_max_mail_size = 100M quota_rule = *:storage=2048M quota_status_nouser = DUNNO quota_status_overquota = 552 5.2.2 Mailbox is full quota_status_success = DUNNO quota_warning = storage=80%% quota-warning 80 %u sieve = file:~/sieve;active=~/sieve.active sieve_before = /usr/local/lib/dovecot/sieve/antispam.sieve sieve_global_extensions = +vnd.dovecot.pipe sieve_pipe_bin_dir = /usr/local/lib/dovecot/sieve sieve_plugins = sieve_imapsieve sieve_extprograms } protocols = imap pop3 lmtp sieve service auth { client_limit = 1125 unix_listener auth-client { group = postfix mode = 0660 user = postfix } } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } service managesieve-login { inet_listener sieve { address = 127.0.0.1 port = 4190 } } service quota-status { client_limit = 1 executable = quota-status -p postfix inet_listener { port = 12340 } } service quota-warning { executable = script /root/cretapanel/quota-warning.sh unix_listener quota-warning { mode = 0666 user = dovecot } } ssl_cert = </etc/ssl/certs/mail.pem ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it ssl_min_protocol = TLSv1.2 userdb { args = /usr/local/etc/dovecot/passwd driver = passwd-file } verbose_proctitle = yes protocol imap { imap_client_workarounds = delay-newmail tb-extra-mailbox-sep mail_max_userip_connections = 20 mail_plugins = quota imap_quota imap_sieve imap_zlib } protocol pop3 { mail_plugins = quota pop3_client_workarounds = outlook-no-nuls oe-ns-eoh pop3_uidl_format = %08Xu%08Xv } protocol lda { postmaster_address = postmaster(a)example.com sendmail_path = /usr/sbin/sendmail } protocol lmtp { mail_plugins = quota sieve postmaster_address = postmaster(a)example.com }

3 2

dovecot mailing list (this mailing list), DKIM, SPF and DMARC
by Lev Serebryakov 22 Oct '22

22 Oct '22

My domain (serebrtyajov.spb.ru) has all these "new" e-mail technologies configured. It works fine till I write to this mailing list. After that I've got several DMARC reports about "spam" from my domain. All these reports are about my mailing list post. I don't have such problems with other mailing lists (FreeBSD ones, OpenJDK ones, and others). Looks like mailing list software for this mailing list is misconfigured. I'm sure, I'll get new after this message. -- // Black Lion AKA Lev Serebryakov

15 38

lmtp userdb can't resolve users
by George Asenov 21 Oct '22

21 Oct '22

Hello, I use postfix with dovecot as an lmtp LDA with unix users and multiple domain names and mailboxes in Maildir format placed in domain directory like: /home/mainuser/homes/user(a)domain.tld/Maildir or /home/mainuser/domains/domain2.tld/homes/user(a)domain2.tld/Maildir which have the main user as a group and user@domain.tld/user@domain2.tld as owner Postfix have virtual_alias_maps = hash:/etc/postfix/virtual there in virtual file there is map like: user(a)domain.tld user-domain(a)domain.tld and in /etc/passwd there are actually 2 users with the same home dir and same UID/GID (only the username is different) and in postfix mailbox_transport = lmtp:unix:private/dovecot-lmtp The issue is that when postfix passes the email for local delivery to dovecot lmtp it sends the username as user-domain.tld(a)serverhostname.tld but dovecot is configured with !include auth-system.conf.ext can't resolve this username thus fails to deliver. I've found a workaround in the net to use custom userdb just for lmtp like this: protocol lmtp { mail_plugins = $mail_plugins sieve userdb { driver = passwd-file args = username_format=%n /etc/passwd } } which works but produce some warnings because there is the root user (ID 0) and actually is a dirty workaround Is there more elegant solution??

2 1

sieve script is too large (max 1048576 bytes)
by Marc 19 Oct '22

19 Oct '22

In what section of the config is this limited? I assume it is related to this >go1.13 memory model that allocates quite a lot of vsz?

3 3

mdbox vs. maildir format
by Michael 19 Oct '22

19 Oct '22

hey, i am considering changing my mailbox format from maildir to mdbox. the reason for this is mainly, b/c i have (a) multiple large mailboxes with tens of thousands of mail files, and (b) most of these mails files have a size significantly smaller than the sector size of the disk. so, since the emails themselves are only about nGB large, the disk space used is at least twice as much, if not even three times. i know, hard disk space is 'cheap', but still... but then i read at https://doc.dovecot.org/admin_manual/mailbox_formats/dbox/ the following: [...] you must not lose the dbox index files, as they can’t be regenerated without data loss. so, raid is mandatory, which is already the case, but what about backup? how can i achieve a backup/snapshot of both, the mdbox (nfs share) and the index files (local raid) and assure they are consistent? greetings...

7 9

Unseen field reported by imap status command returns wrong count for shared mailboxes on dovecot cluster
by Nikolaos Pyrgiotis 19 Oct '22

19 Oct '22

Hello, We recently migrated our mail server to a dovecot cluster of 5nodes, a dovecot proxy, 2directors and 2dovecot backends. All dovecot nodes run version 2.19.1. We use a glusterfs mounted volume on the backends forthe mail storage. We noticed that when issuing the IMAP command to check forUNSEEN messages formails on the shared namespace instead of seeing the value of the unseen messages of the user that the mailbox has been shared to, the value of the unseen messages of the owner of the mailbox is returned. This behavior causes thunderbird when getting new messages forshared mailboxes, to show briefly all messages of the mailbox as unseen forthe user before showing the correct unseen count forthe shared mailbox. The mail location of the shared mailboxes is defined with imapc storage type as described inthe documentation. Is this a dovecot bug? Can we configure a different dovecot configuration setting so that imap status command reports the correct unseen field count when mail location is an imapc storage location? An examples is given below when running doveadm command from one the 2 dovecot directors: When issuing the status command we see that the unseen count is 2: root@doved0-rmt0-cn1:/etc/cron.d# doveadm mailbox status -u npyrgiotis all shared.sysadmins doveadm(npyrgiotis): Info: remote(10.101.0.71:8080): doveadm(npyrgiotis(a)domie02.com)<19078><9l8IJTb+GWOGSgAAEU9A+w>: imapc(10.101.0.75:143): Connected to 10.101.0.75:143 (local 10.101.0.71:33476) shared.sysadmins messages=2 recent=0 uidnext=3 uidvalidity=1662640492 unseen=2 highestmodseq=3 vsize=3950 guid=c92f64f79f0d1ed01e6d5b314f04886c firstsaved=1662643853 shared.sysadmins messages=2recent=0uidnext=3uidvalidity=1662640492unseen=2highestmodseq=3vsize=3950guid=c92f64f79f0d1ed01e6d5b314f04886c firstsaved=1662643853 But when fetching the emails of the mailboxes we can see that the \Seen flag is set for both emails root@doved0-rmt0-cn1:/etc/cron.d# doveadm fetch -u npyrgiotis flags mailbox shared.sysadmins ALL doveadm(npyrgiotis): Info: remote(10.101.0.71:8080): doveadm(npyrgiotis(a)domie02.com)<19074><e7rWDgj+GWOCSgAAEU9A+w>: imapc(10.101.0.75:143): Connected to 10.101.0.75:143 (local 10.101.0.71:38750) flags: \Seen flags: \Seen Below i post the dovecot configuration of one of the two dovecot backends: # 2.3.19.1 (9b53102964): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.19 (4eae2f79) # OS: Linux 5.10.0-17-amd64 x86_64 Debian 11.4 # Hostname: doveb0-rmt0-cn1 auth_cache_negative_ttl = 5mins auth_cache_size = 50M auth_debug = yes auth_default_realm = example.com auth_master_user_separator = * auth_mechanisms = plain login auth_verbose = yes auth_worker_max_count = 16 disable_plaintext_auth = no first_valid_uid = 499 hostname = smtp.example.com imapc_features = fetch-bodystructure fetch-headers rfc822.size search modseq acl delay-login imapc_host = 10.101.0.75 imapc_password = # hidden, use -P to show it imapc_sasl_mechanisms = plain login imapc_ssl = starttls imapc_ssl_verify = no last_valid_uid = 499 lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes login_greeting = You have successfully logged into example.com IMAP server login_trusted_networks = 10.101.0.73 10.101.0.74 mail_always_cache_fields = flags hdr.* date.received date.sent mail_cache_fields = flags date.received guid size.physical size.virtual imap.bodystructure body.snippet mail_debug = yes mail_fsync = always mail_plugins = " notify mail_log zlib acl" mail_privileged_group = mail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext mdbox_rotate_size = 200M mmap_disable = yes namespace example { list = children location = imapc:~/shared/%%n:INDEXPVT=~/shared-pvt/%%n prefix = shared.%%n. separator = . subscriptions = no type = shared } namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Spam.Virus { auto = subscribe } mailbox Spam { auto = subscribe } mailbox Trash { special_use = \Trash } prefix = separator = . subscriptions = yes type = private } passdb { args = password=#hidden_use-P_to_show# driver = static master = yes override_fields = allow_real_nets=127.0.0.0/8,local,10.101.0.73,10.101.0.74 userdb_acl_user=%{auth_user} userdb_namespace/example/disabled=yes result_success = continue } passdb { args = password=#hidden_use-P_to_show# driver = static override_fields = allow_real_nets=127.0.0.0/8,local,10.101.0.73,10.101.0.74 result_success = continue } passdb { args = /etc/dovecot/dovecot-ldap-users.conf.ext driver = ldap } passdb { args = /etc/dovecot/dovecot-ldap-groups.conf.ext driver = ldap } plugin { acl = vfile:/etc/dovecot/global-acls/%d/master-dovecot-acl:cache_secs=300 acl_defaults_from_inbox = yes acl_globals_only = no acl_shared_dict = file:/var/dovecot-acl/%d/shared-mailboxes.db imap_compress_deflate_level = 6 mail_log_events = flag_change mail_log_fields = uid box flags sieve = file:~/sieve;active=~/sieve/%n.sieve sieve_before = /var/vmail/global-sieve/global.sieve sieve_env_email_address = %u sieve_env_mailbox_prefix = %{userdb:mailbox_prefix} sieve_global = /var/vmail/sieve sieve_global_extensions = +editheader +vnd.dovecot.environment zlib_save = zstd zlib_save_level = 5 } protocols = " imap lmtp sieve submission" service auth-worker { user = dovecot } service auth { unix_listener auth-userdb { group = mail mode = 0666 user = vmail } } service doveadm { inet_listener dovadm-dom-mgmt { address = 10.100.1.71 port = 8080 ssl = no } inet_listener dovadm-dom { address = 10.101.0.71 port = 8080 ssl = no } vsz_limit = 256M } service imap-login { inet_listener imap-dom { address = 10.101.0.71 port = 143 ssl = no } inet_listener imap { port = 0 } inet_listener imaps-dom { address = 10.101.0.71 port = 993 ssl = yes } inet_listener imaps { port = 0 } process_limit = 400 process_min_avail = 2 service_count = 20 vsz_limit = 512M } service imap { process_limit = 2048 process_min_avail = 0 service_count = 1 vsz_limit = 4G } service lmtp { inet_listener lmtp-dom { address = 10.101.0.71 port = 24 ssl = no } process_limit = 0 process_min_avail = 0 service_count = 0 unix_listener lmtp { mode = 0666 } vsz_limit = 256M } service managesieve-login { inet_listener sieve-dom { address = 10.101.0.71 port = 4190 ssl = no } inet_listener sieve { port = 0 } process_limit = 0 process_min_avail = 0 service_count = 0 vsz_limit = 64M } service managesieve { process_limit = 1024 process_min_avail = 0 service_count = 1 vsz_limit = 256M } service submission-login { inet_listener submission-dom { address = 10.101.0.71 port = 587 ssl = no } inet_listener submission { port = 0 } inet_listener submissions-dom { address = 10.101.0.71 port = 465 ssl = yes } process_limit = 250 process_min_avail = 2 service_count = 1 vsz_limit = 256M } service submission { process_limit = 1024 process_min_avail = 0 service_count = 1 vsz_limit = 256M } ssl = required ssl_cert = </etc/ssl/certs/doveb0-rmt0-cn1.mail.rmt.example.com.pem ssl_client_ca_dir = /etc/ssl/certs ssl_key = # hidden, use -P to show it submission_max_mail_size = 30000k submission_relay_host = 10.101.0.7 submission_relay_port = 587 submission_relay_ssl = starttls submission_relay_ssl_verify = no submission_relay_trusted = yes userdb { driver = prefetch } userdb { args = /etc/dovecot/dovecot-ldap-users.conf.ext driver = ldap } userdb { args = /etc/dovecot/dovecot-ldap-groups.conf.ext driver = ldap } protocol lmtp { mail_plugins = " notify mail_log zlib acl sieve acl" } protocol lda { mail_plugins = " notify mail_log zlib acl sieve acl" } protocol imap { mail_max_userip_connections = 100 mail_plugins = " notify mail_log zlib acl" } protocol sieve { mail_max_userip_connections = 40 } protocol submission { mail_max_userip_connections = 70 } local10.101.0.71 { doveadm_allowed_commands = doveadm_password = # hidden, use -P to show it } local10.100.1.71 { doveadm_allowed_commands = doveadm_password = # hidden, use -P to show it } Thank you, Nikolaos Pyrgiotis

2 3

is it possible to add a custom special use mailbox
by Marc 18 Oct '22

18 Oct '22

Currently I am using this to try and catch everything in Sent. mailbox Sent { special_use = \Sent auto = create } mailbox "Sent Items" { special_use = \Sent auto = no } mailbox "Sent Messages" { special_use = \Sent auto = no } I would like to have something mailbox Test { special_use = \Test auto = create } mailbox "Test Items" { special_use = \Test auto = no } mailbox "testing" { special_use = \Test auto = no }

1 1

Dovecot mail-crypt webmail can't read encrypted messages
by Serveria Support 18 Oct '22

18 Oct '22

I'm trying to setup Dovecot with mail-crypt plugin with per-user encryption. I have configured mail-crypt plugin as per official guide here: https://doc.dovecot.org/configuration_manual/mail_crypt_plugin/ After that I created a user and an encrypted key by running this command: doveadm -o \plugin/mail_crypt_private_password=12345 mailbox cryptokey generate -u mail(a)example.org -URf (replacing dummy data ofc) I can log in to webmail (and Dovecot) just fine, emails are getting sent and delivered. I have also checked the storage and the messages seem to be stored encrypted. However, I can't read the emails in webmail (just headers can be seen) and in Dovecot logs I can see the following error: failed: Private key not available: Cannot decrypt key ### Cannot decrypt key ### <8632: Password not available (FETCH RFC822.HEADER) There seems to be an issue with mySQL query. The query I'm using (Select username as "user", password,"%w" as userdb_mail_crypt_private_password from mailbox;) seems to work just fine, when run from mysql prompt it outputs the usernames and passwords, but the error is still there (Cannot decrypt key ### Password not available). Any ideas? What am I missing?

16 70

sieve script not modifying header
by Marc 17 Oct '22

17 Oct '22

From the command line the sieve script is modifying the header like this: su testuser -s '/bin/bash' -c 'cat test.msg | /usr/lib64/dovecot/sieve-execute/sieve-test' However when executing via dovecot, the header stays unchanged require ["copy","fileinto","vacation","vnd.dovecot.execute","editheader"]; # rule:[testing2] if not execute :pipe "sieve-test" { } Any idea what I am forgetting to configure/allow?

1 1

adding caldav/carddav next to dovecot
by Marc 16 Oct '22

16 Oct '22

I hope it is ok to post this off-topic question here. I was wondering if there are here environments running that offer next to dovecot also calendar and contacts services. In the past I was testing a bit with the one from Apple, but I think it is being discontinued because of converting the python 2 code. I am looking for some experience with a setup provisioning >10k users. Not that I have such requirement, but I want to know if the solution is stable, efficient and optionally can scale. I need something efficient, because I do not have to many resources and high iops available. I also do not want any other other 'crap' just the cal (and card) dav solution. https://github.com/1and1/cosmo This looks interesting (used 1und1 in Germany?) but not big community https://sabre.io/dav/install/ This is in php ...

13 21

Re: ot: how to t/s TBird problems ?
by Joseph Tam 16 Oct '22

16 Oct '22

> I recently upgraded my Thunderbird email client and have experienced > problems since. > It appears that when Tbird polls for new messages it gets held up > waiting for a response from the server > I'm using POP port 995. > Any ideas as to why I'm having a problem ? > ------------------- > > how to investigate such issue ? I suspect you'll need to do session logging e.g. protocol pop3 { ... rawlog_dir = /writable/logdir/%u } then mkdir /writable/logdir/user chmod 0777 /writable/logdir/user to obtain session transcripts of what server/client are doing. I don't see any obvious errors from the logs that indicate any failure. I do see the INBOX is rather large so maybe a timeout is involved. Joseph Tam <jtam.home(a)gmail.com>

2 1

Multidomain ssl config ?
by Maurizio Caloro 16 Oct '22

16 Oct '22

on postfix now this seems to run, and with dovecot i need also handle this two domains, but appairing this error messages. like: Jun 29 20:49:28 Dovecot/imap-login: Info: Disconnected (no auth attempts in 0 secs): user=<>, rip=a.b.c.d, lip=37.120.190.188, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines: ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<FdklDjkdfrkfi> Running with Debian Buster # dovecot --version 2.3.4.1 (f79e8e7e4) # nmail.caloro.ch local_name nmail.caloro.ch { ssl_cert = </etc/letsencrypt/live/nmail.caloro.ch/privkey.pem ssl_key = </etc/letsencrypt/live/nmail.caloro.ch/fullchain.pem } # nmail.calm-ness.ch local_name nmail.calm-ness.ch { ssl_cert = </etc/letsencrypt/live/nmail.calm-ness.ch/privkey.pem ssl_key = </etc/letsencrypt/live/nmail.calm-ness.ch/fullchain.pem } thanks for possible help

6 5

Re: LDAP just for passdb
by Francis Augusto Medeiros-Logeay 14 Oct '22

14 Oct '22

Again, a bit more reading got me to adding this to my passdb config: username_filter = *(a)domain-a.com This way, I can control which domains get to authenticate via my ldap backend, which gives me time to design a good way of saving other attributes there. If anyone have other ways of doing this, ie., having multiple domains on ldap/freeipa and getting an elegant integration with Dovecot, I’d be glad to hear. Best, Francis > On 14 Oct 2022, at 21:58, dovecot-request(a)dovecot.org wrote: > > I actually saw that it was possible, and it works, but I came across another problem and I wonder if you have any tips about it: > > On my current dovecot setup, I use SQL as the backend. So I have the following users: > > francis(a)domain-a.com <mailto:francis@domain-a.com> <mailto:francis@domaina.com> > francis(a)domain-b.com <mailto:francis@domain-b.com> <mailto:francis@domain-b.com> > > Those are separate users which their own mailboxes. > > However, I have a freeipa that is configured for the `domain-a.com <http://domain-a.com/> <http://domain-a.com/>` realm. However, since I am using `%n` for the uid search: > > auth_bind_userdn = uid=%n,cn=users,cn=accounts,dc=domain-a,dc=com > And > pass_filter = (&(objectClass=posixAccount)(uid=%n)) > > It of course leads up to both users above being able to authenticate with the same password. > > Is there a way to limit ldap authentication to just one domain, or perform a search where both username and domain are checked? I could use the `mail``attribute to filter users, but I imagine that if two users have the same mail configured, I?d run into trouble?. > > Best, > > Francis > >> On 14 Oct 2022, at 20:08, dovecot-request(a)dovecot.org <mailto:dovecot-request@dovecot.org> wrote: >> >> Hi, >> >> I couldn't find it in the documentation, so I was wondering - is it >> possible to configure Dovecot to use LDAP for passdb and keep using SQL >> for userdb? >> >> I would like to do that before I come up with a good strategy to expand >> my ldap schema to support other mail attributes for virtual domains, >> aliases, etc. >> >> I am currently using FreeIPA. >> >> Best, >> >> Francis >

1 0

Re: LDAP just for passdb
by Francis Augusto Medeiros-Logeay 14 Oct '22

14 Oct '22

I actually saw that it was possible, and it works, but I came across another problem and I wonder if you have any tips about it: On my current dovecot setup, I use SQL as the backend. So I have the following users: francis(a)domain-a.com <mailto:francis@domaina.com> francis(a)domain-b.com <mailto:francis@domain-b.com> Those are separate users which their own mailboxes. However, I have a freeipa that is configured for the `domain-a.com <http://domain-a.com/>` realm. However, since I am using `%n` for the uid search: auth_bind_userdn = uid=%n,cn=users,cn=accounts,dc=domain-a,dc=com And pass_filter = (&(objectClass=posixAccount)(uid=%n)) It of course leads up to both users above being able to authenticate with the same password. Is there a way to limit ldap authentication to just one domain, or perform a search where both username and domain are checked? I could use the `mail``attribute to filter users, but I imagine that if two users have the same mail configured, I’d run into trouble…. Best, Francis > On 14 Oct 2022, at 20:08, dovecot-request(a)dovecot.org wrote: > > Hi, > > I couldn't find it in the documentation, so I was wondering - is it > possible to configure Dovecot to use LDAP for passdb and keep using SQL > for userdb? > > I would like to do that before I come up with a good strategy to expand > my ldap schema to support other mail attributes for virtual domains, > aliases, etc. > > I am currently using FreeIPA. > > Best, > > Francis

1 0

LDAP just for passdb
by Francis Augusto Medeiros-Logeay 14 Oct '22

14 Oct '22

Hi, I couldn't find it in the documentation, so I was wondering - is it possible to configure Dovecot to use LDAP for passdb and keep using SQL for userdb? I would like to do that before I come up with a good strategy to expand my ldap schema to support other mail attributes for virtual domains, aliases, etc. I am currently using FreeIPA. Best, Francis

1 0

"make check" fail at test_program_refused
by A. Schulze 14 Oct '22

14 Oct '22

Hello, I moved my buildsystem to an other platform (I do not fully control) and now receive this error on "make check" Error: program tcp:127.0.0.2:42027: connect(::1) failed: Connection refused test_program_refused ................................................. : FAILED The build run on jenkins buildnodex spawn up on a kubernetes cluster. What I noticed so far: the buildnode opereate ipv4 only but has an entry in /etc/hosts: 127.0.0.1 c4a84c76f0d6 ::1 c4a84c76f0d6 Maybe that's the glitch ... I tried dovecot-2.3.15 and 2.3.19.1. Both fail (only the portnumber differ) Is there an option to disable only one specific test? I dislike to skip "make check" at all. Andreas

1 1

what are the options to 'interact' with a dovecot imap user
by Marc 14 Oct '22

14 Oct '22

I am looking for a user friendly way to have a user to tell the 'server' to either store or remove an email address. a. My first thought was to use imapsieve for this and have an imap sieve plugin store/remove the email address of the message that is being dragged into a predefined monitored folder. This would work with any imap client b. I was thinking about the message Flagged[1]. I am curious how would I be able to detect this (in sieve)? This does not seem to be stored in the source of the message. Although every client seems to support it, it would probably conflict with every day use cases. c. Then you have these colours and/or categories. But these do not seem to propagate across clients. Where are these even stored? Any ideas on how this can be done? [1] https://www.rfc-editor.org/rfc/rfc3501#section-2.3.2

1 0

Director hashing
by Dan Conway 14 Oct '22

14 Oct '22

Hello all, I have a 2 node director setup that uses checkpassword for authentication as well as backend assignment through director tags. director_servers = 192.168.1.10 192.168.1.20 director_mail_servers = 192.168.2.10@srv1 192.168.2.11@srv2 checkpassword writes the following to Dovecot on successful authentication: proxy=y\tdirector_tag=<tag>\tport=<port>ssl=yes\tdestuser=<email>\t This seems to work just fine. However, when I attempt to view a users current hash/initial config: # doveadm director status "user(a)domain.com" Current: n/a (expires -1) Hashed: Initial config: I get null data. There does appear to be a hash mapping of some sort however: # doveadm director map -u user(a)domain.com 1140334690 # doveadm director map -h 1140334690 user(a)domain.com The use of doveadm director move has no effect. doveadm reports it moved the user, but it does not: # doveadm -v director move "user(a)domain.com" 192.168.2.11 Info: User hash 1140334690 moved to 192.168.2.11 When using checkpassword and supplying fields to Dovecot, should I also be including another field to populate hashes for director? I could be missing something obvious in the docs. I'm on version 2.3.18 (9dd8408c18). I have not included dovecot.conf due to the size. If someone needs to see it I can supply it.

1 0

Thunderbird can't connect to Dovecot (bad certificate: SSL alert number 42) - sni
by Paul Kudla (SCOM.CA Internet Services Inc.) 12 Oct '22

12 Oct '22

Good morning to all i guess things have changed yet again to keep this simple : i buy a certificate (example) : mail.paulkudla.net i generated the key / csr as per normal using data = '/usr/local/bin/openssl req -new -key /tmp/temp.key -out /tmp/temp.csr -subj "/C=%s/ST=%s/L=%s/O=%s/CN=%s"' %(country,state,location,organization,self.domain) please note the above is done in django (yes i am running thunderbird v102) i go buy the certificate i database the CRT & CA CSR is : -----BEGIN CERTIFICATE REQUEST----- MIICpzCCAY8CAQAwYjELMAkGA1UEBhMCQ0ExEDAOBgNVBAgMB09udGFyaW8xDzAN BgNVBAcMBldoaXRieTETMBEGA1UECgwKUGF1bCBLdWRsYTEbMBkGA1UEAwwSbWFp bC5wYXVsa3VkbGEubmV0MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA mSWAdwbxwjkjALQa4UdgOBHcFJDA5XkGI/8SswotYMnzjRAAE4S88vUTO3ltMasY rprEvWEiEzUrRon3hh1ZZguV775fNCbyKUGKwGLKPDpmKxYCsE4gi2z7LKY13wSv lLE8++Hqvt3cmZZ+wxWP/hy6LcS/6PvUPgN7S+cEC5TNLQ6VRZdpSGolRCrN9hsN 15GWYEQ/zcLW2PeCWav9DOr6NHBRE+fruDy3jFT0TkHWf3H+GKB0/RZ0agMJcEGc ZLdJ1LkvNAn6gslppm3otZyu7XTvY9qZXcYOlMN0KL3a3488OwXTwWJHEN58eCMc juax1f7ad8Z/+Pi+OFwfWQIDAQABoAAwDQYJKoZIhvcNAQELBQADggEBAFgL24yi WPat73tg1fANvutWXa2WEXeegqOawqvsV74lcyqMes8yhxiz/niOAt3oOLmViRF4 VlorgUwL0eAxtNeY4lgURW6XM5oz8TBINnPPohSAuDL9azLV1U1+M/vAvLs+LRd9 7wfVCN5bov7y735u2w38GAjmXJCBdoc+glUa+eGd5WH2+r/QQW/lRqVTDq+arqNk 9DTZc73gDCDmV45vTtbrlLnOxtmpqaQKsoFCCJW8OWaaDXfc8I+TdClVsThsbrWu iz1/QClBPbKvfufNb+asTQSCDeJFc2EynDSE1yeYzliMLo+77ZoMqJPvI9IJCuj5 yq88NESoIYaO6Do= -----END CERTIFICATE REQUEST----- CRT is : -----BEGIN CERTIFICATE----- MIIGRTCCBS2gAwIBAgIRAKTmHoDG9LF3heBvAT8gZkYwDQYJKoZIhvcNAQELBQAw gY8xCzAJBgNVBAYTAkdCMRswGQYDVQQIExJHcmVhdGVyIE1hbmNoZXN0ZXIxEDAO BgNVBAcTB1NhbGZvcmQxGDAWBgNVBAoTD1NlY3RpZ28gTGltaXRlZDE3MDUGA1UE AxMuU2VjdGlnbyBSU0EgRG9tYWluIFZhbGlkYXRpb24gU2VjdXJlIFNlcnZlciBD QTAeFw0yMjA2MTYwMDAwMDBaFw0yMzA2MTYyMzU5NTlaMB0xGzAZBgNVBAMTEm1h aWwucGF1bGt1ZGxhLm5ldDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB AJklgHcG8cI5IwC0GuFHYDgR3BSQwOV5BiP/ErMKLWDJ840QABOEvPL1Ezt5bTGr GK6axL1hIhM1K0aJ94YdWWYLle++XzQm8ilBisBiyjw6ZisWArBOIIts+yymNd8E r5SxPPvh6r7d3JmWfsMVj/4cui3Ev+j71D4De0vnBAuUzS0OlUWXaUhqJUQqzfYb DdeRlmBEP83C1tj3glmr/Qzq+jRwURPn67g8t4xU9E5B1n9x/higdP0WdGoDCXBB nGS3SdS5LzQJ+oLJaaZt6LWcru1072PamV3GDpTDdCi92t+PPDsF08FiRxDefHgj HI7msdX+2nfGf/j4vjhcH1kCAwEAAaOCAwswggMHMB8GA1UdIwQYMBaAFI2MXsRU rYrhd+mb+ZsF4bgBjWHhMB0GA1UdDgQWBBROA5NFqfrlHGbkp9v1JBxZe0fZsDAO BgNVHQ8BAf8EBAMCBaAwDAYDVR0TAQH/BAIwADAdBgNVHSUEFjAUBggrBgEFBQcD AQYIKwYBBQUHAwIwSQYDVR0gBEIwQDA0BgsrBgEEAbIxAQICBzAlMCMGCCsGAQUF BwIBFhdodHRwczovL3NlY3RpZ28uY29tL0NQUzAIBgZngQwBAgEwgYQGCCsGAQUF BwEBBHgwdjBPBggrBgEFBQcwAoZDaHR0cDovL2NydC5zZWN0aWdvLmNvbS9TZWN0 aWdvUlNBRG9tYWluVmFsaWRhdGlvblNlY3VyZVNlcnZlckNBLmNydDAjBggrBgEF BQcwAYYXaHR0cDovL29jc3Auc2VjdGlnby5jb20wNQYDVR0RBC4wLIISbWFpbC5w YXVsa3VkbGEubmV0ghZ3d3cubWFpbC5wYXVsa3VkbGEubmV0MIIBfQYKKwYBBAHW eQIEAgSCAW0EggFpAWcAdgCt9776fP8QyIudPZwePhhqtGcpXc+xDCTKhYY069yC igAAAYFsxJHxAAAEAwBHMEUCIQDxa9L+JaMJJImKuYPmfCAwJOiGXwECgtruOegv vPqGpwIgWW8B0SWqVNPEFBveoBlIZF3jjj4nQIzYi2LnLizoVDMAdQB6MoxU2Lct tiDqOOBSHumEFnAyE4VNO9IrwTpXo1LrUgAAAYFsxJHJAAAEAwBGMEQCIDIgNptW Qum0KFyemHNTTfonlq4FvWTgzR1AGUnOgotPAiAAiwyN9MjZNiP76P3fel6BqEqj jwnSVleJR1DgLIoyPQB2AOg+0No+9QY1MudXKLyJa8kD08vREWvs62nhd31tBr1u AAABgWzEkYoAAAQDAEcwRQIgOYjevKp5RI+c0JhIi6JflaxiNokRTSeXN6LrdIVt Cf8CIQCG+aLreYVV8xCPV0skr0ats5zMf5PLPN2y8EIxGPPNVTANBgkqhkiG9w0B AQsFAAOCAQEAJX544qDTgkGGLUOher7tH7yUgEhQFYkBDAirO37MXrhtuzH6pGSp XfYVNB9e2ydprfmLDh8O8oTaXpaQfp/jwK3U0GfvG57MfdQTLOunpWnCjaMUPUcv jPU90/mXc5oWlO5iJ6jPDkS/x47K03P6vftSr7AMwnLq4kYwuG9fHLslMHhoojen 9S2G1QjKVp5jkFecmQib+JOZV9Ub9r6iumHICfdcSO+tyBL2IDqWDQhuAVUXgyOV 11O9ZgikoeRhgsMhwiQA1z/Fs6Xqx/XCs6nUciebRiQuuHYm/PUG2H+tg0sLhJ6L ntIEhjjkumL0oJEfDidP/8wmrsPuwfSDCQ== -----END CERTIFICATE----- CA (INTER) : -----BEGIN CERTIFICATE----- MIIGEzCCA/ugAwIBAgIQfVtRJrR2uhHbdBYLvFMNpzANBgkqhkiG9w0BAQwFADCB iDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0pl cnNleSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNV BAMTJVVTRVJUcnVzdCBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMTgx MTAyMDAwMDAwWhcNMzAxMjMxMjM1OTU5WjCBjzELMAkGA1UEBhMCR0IxGzAZBgNV BAgTEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4GA1UEBxMHU2FsZm9yZDEYMBYGA1UE ChMPU2VjdGlnbyBMaW1pdGVkMTcwNQYDVQQDEy5TZWN0aWdvIFJTQSBEb21haW4g VmFsaWRhdGlvbiBTZWN1cmUgU2VydmVyIENBMIIBIjANBgkqhkiG9w0BAQEFAAOC AQ8AMIIBCgKCAQEA1nMz1tc8INAA0hdFuNY+B6I/x0HuMjDJsGz99J/LEpgPLT+N TQEMgg8Xf2Iu6bhIefsWg06t1zIlk7cHv7lQP6lMw0Aq6Tn/2YHKHxYyQdqAJrkj eocgHuP/IJo8lURvh3UGkEC0MpMWCRAIIz7S3YcPb11RFGoKacVPAXJpz9OTTG0E oKMbgn6xmrntxZ7FN3ifmgg0+1YuWMQJDgZkW7w33PGfKGioVrCSo1yfu4iYCBsk Haswha6vsC6eep3BwEIc4gLw6uBK0u+QDrTBQBbwb4VCSmT3pDCg/r8uoydajotY uK3DGReEY+1vVv2Dy2A0xHS+5p3b4eTlygxfFQIDAQABo4IBbjCCAWowHwYDVR0j BBgwFoAUU3m/WqorSs9UgOHYm8Cd8rIDZsswHQYDVR0OBBYEFI2MXsRUrYrhd+mb +ZsF4bgBjWHhMA4GA1UdDwEB/wQEAwIBhjASBgNVHRMBAf8ECDAGAQH/AgEAMB0G A1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAbBgNVHSAEFDASMAYGBFUdIAAw CAYGZ4EMAQIBMFAGA1UdHwRJMEcwRaBDoEGGP2h0dHA6Ly9jcmwudXNlcnRydXN0 LmNvbS9VU0VSVHJ1c3RSU0FDZXJ0aWZpY2F0aW9uQXV0aG9yaXR5LmNybDB2Bggr BgEFBQcBAQRqMGgwPwYIKwYBBQUHMAKGM2h0dHA6Ly9jcnQudXNlcnRydXN0LmNv bS9VU0VSVHJ1c3RSU0FBZGRUcnVzdENBLmNydDAlBggrBgEFBQcwAYYZaHR0cDov L29jc3AudXNlcnRydXN0LmNvbTANBgkqhkiG9w0BAQwFAAOCAgEAMr9hvQ5Iw0/H ukdN+Jx4GQHcEx2Ab/zDcLRSmjEzmldS+zGea6TvVKqJjUAXaPgREHzSyrHxVYbH 7rM2kYb2OVG/Rr8PoLq0935JxCo2F57kaDl6r5ROVm+yezu/Coa9zcV3HAO4OLGi H19+24rcRki2aArPsrW04jTkZ6k4Zgle0rj8nSg6F0AnwnJOKf0hPHzPE/uWLMUx RP0T7dWbqWlod3zu4f+k+TY4CFM5ooQ0nBnzvg6s1SQ36yOoeNDT5++SR2RiOSLv xvcRviKFxmZEJCaOEDKNyJOuB56DPi/Z+fVGjmO+wea03KbNIaiGCpXZLoUmGv38 sbZXQm2V0TP2ORQGgkE49Y9Y3IBbpNV9lXj9p5v//cWoaasm56ekBYdbqbe4oyAL l6lFhd2zi+WJN44pDfwGF/Y4QA5C5BIG+3vzxhFoYt/jmPQT2BVPi7Fp2RBgvGQq 6jG35LWjOhSbJuMLe/0CjraZwTiXWTb2qHSihrZe68Zk6s+go/lunrotEbaGmAhY LcmsJWTyXnW0OMGuf1pGg+pRyrbxmRE1a6Vqe8YAsOf4vmSyrcjC8azjUeqkk+B5 yOGBQMkKW+ESPMFgKuOXwIlCypTPRpgSabuY0MLTDXJLR27lk8QyKGOHQ+SwMj4K 00u/I5sUKUErmgQfky3xxzlIPK1aEn8= -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- MIIFgTCCBGmgAwIBAgIQOXJEOvkit1HX02wQ3TE1lTANBgkqhkiG9w0BAQwFADB7 MQswCQYDVQQGEwJHQjEbMBkGA1UECAwSR3JlYXRlciBNYW5jaGVzdGVyMRAwDgYD VQQHDAdTYWxmb3JkMRowGAYDVQQKDBFDb21vZG8gQ0EgTGltaXRlZDEhMB8GA1UE AwwYQUFBIENlcnRpZmljYXRlIFNlcnZpY2VzMB4XDTE5MDMxMjAwMDAwMFoXDTI4 MTIzMTIzNTk1OVowgYgxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpOZXcgSmVyc2V5 MRQwEgYDVQQHEwtKZXJzZXkgQ2l0eTEeMBwGA1UEChMVVGhlIFVTRVJUUlVTVCBO ZXR3b3JrMS4wLAYDVQQDEyVVU0VSVHJ1c3QgUlNBIENlcnRpZmljYXRpb24gQXV0 aG9yaXR5MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAgBJlFzYOw9sI s9CsVw127c0n00ytUINh4qogTQktZAnczomfzD2p7PbPwdzx07HWezcoEStH2jnG vDoZtF+mvX2do2NCtnbyqTsrkfjib9DsFiCQCT7i6HTJGLSR1GJk23+jBvGIGGqQ Ijy8/hPwhxR79uQfjtTkUcYRZ0YIUcuGFFQ/vDP+fmyc/xadGL1RjjWmp2bIcmfb IWax1Jt4A8BQOujM8Ny8nkz+rwWWNR9XWrf/zvk9tyy29lTdyOcSOk2uTIq3XJq0 tyA9yn8iNK5+O2hmAUTnAU5GU5szYPeUvlM3kHND8zLDU+/bqv50TmnHa4xgk97E xwzf4TKuzJM7UXiVZ4vuPVb+DNBpDxsP8yUmazNt925H+nND5X4OpWaxKXwyhGNV icQNwZNUMBkTrNN9N6frXTpsNVzbQdcS2qlJC9/YgIoJk2KOtWbPJYjNhLixP6Q5 D9kCnusSTJV882sFqV4Wg8y4Z+LoE53MW4LTTLPtW//e5XOsIzstAL81VXQJSdhJ WBp/kjbmUZIO8yZ9HE0XvMnsQybQv0FfQKlERPSZ51eHnlAfV1SoPv10Yy+xUGUJ 5lhCLkMaTLTwJUdZ+gQek9QmRkpQgbLevni3/GcV4clXhB4PY9bpYrrWX1Uu6lzG KAgEJTm4Diup8kyXHAc/DVL17e8vgg8CAwEAAaOB8jCB7zAfBgNVHSMEGDAWgBSg EQojPpbxB+zirynvgqV/0DCktDAdBgNVHQ4EFgQUU3m/WqorSs9UgOHYm8Cd8rID ZsswDgYDVR0PAQH/BAQDAgGGMA8GA1UdEwEB/wQFMAMBAf8wEQYDVR0gBAowCDAG BgRVHSAAMEMGA1UdHwQ8MDowOKA2oDSGMmh0dHA6Ly9jcmwuY29tb2RvY2EuY29t L0FBQUNlcnRpZmljYXRlU2VydmljZXMuY3JsMDQGCCsGAQUFBwEBBCgwJjAkBggr BgEFBQcwAYYYaHR0cDovL29jc3AuY29tb2RvY2EuY29tMA0GCSqGSIb3DQEBDAUA A4IBAQAYh1HcdCE9nIrgJ7cz0C7M7PDmy14R3iJvm3WOnnL+5Nb+qh+cli3vA0p+ rvSNb3I8QzvAP+u431yqqcau8vzY7qN7Q/aGNnwU4M309z/+3ri0ivCRlv79Q2R+ /czSAaF9ffgZGclCKxO/WIu6pKJmBHaIkU4MiRTOok3JMrO66BQavHHxW/BBC5gA CiIDEOUMsfnNkjcZ7Tvx5Dq2+UUTJnWvu6rvP3t3O9LEApE9GQDTF1w52z97GA1F zZOFli9d31kWTz9RvdVFGD/tSo7oBmF0Ixa1DVBzJ0RHfxBdiSprhTEUxOipakyA vGp4z7h/jnZymQyd/teRCBaho1+V -----END CERTIFICATE----- sni.conf : local_name mail.paulkudla.net { ssl_key = /programs/common/getssl.cert -c mail.paulkudla.net -q yes ssl_cert = /programs/common/getssl.cert -c mail.paulkudla.net -q yes ssl_ca = /programs/common/getssl.cert -c mail.paulkudla.net -q yes } please note getssl.cert above is a program that returns the keys from the database - worked perfectly fine before. basically what do i have to add to what file (csr, cert, ca) to get the sni to work again for mail.paulkudla.net so based on the mail lists So in you example a valid .csr now contains: CN = example.com SAN.1 = example.com SAN.2 = www.example.com etc. Of course you could also have: CN = www.example.com SAN.1 = www.example.com SAN.2 = example.com what do i modify (and how) ???? the above says to modify the csr ? please keep in mind that the cert purchased is only for the name : mail.paulkudla.net thus i fail to see why it is throwing error 42, however this seems to be a patch to thunderbird as well i did not have to change the servers base ssl stuff (*.scom.ca) so that is still working or will that need to be updated as well eventually postfix is perfectly fine ????? Note from sni.conf (ssl config file) - aka *.scom.ca is ok ?? : ssl = yes verbose_ssl = yes ssl_dh =</usr/local/etc/dovecot/dh-4096.pem ssl_prefer_server_ciphers = yes #ssl_min_protocol = TLSv1.2 #Default *.scom.ca ssl_key =</usr/local/etc/dovecot/scom.pem ssl_cert =</usr/local/etc/dovecot/scom.pem ssl_ca =</usr/local/etc/dovecot/scom.pem -- Happy Tuesday !!! Thanks - paul Paul Kudla Scom.ca Internet Services <http://www.scom.ca> 004-1009 Byron Street South Whitby, Ontario - Canada L1N 4S3 Toronto 416.642.7266 Main 1.866.411.7266 Fax 1.888.892.7266 Email paul(a)scom.ca

3 6

One-off backup
by Ian Evans 11 Oct '22

11 Oct '22

I run a small email server for me and the missus. Six dovecot users. Our host is migrating our server instance. They usually (99.9999% lol) go off without a hitch. As we don't have dovecot running elsewhere, I'm assuming doveadm is the wrong tool. If we want to make a one-off backup prior to the migration, is shutting down postfix and running tar czf mailstorage.tgz /path/to/mail okay? Thanks.

8 9

grabbing multiple patterns from allof
by Marc 11 Oct '22

11 Oct '22

Anyone an idea how you should grab multiple matches from allof? if allof ( true, header :regex "Subject" "(test).*(test2)", envelope :matches "from" "*" )

2 1

Static build problems
by Jacob Welsh 09 Oct '22

09 Oct '22

I'm attempting to build the latest Dovecot, version 2.3.19.1, on Gales Linux, a distribution based on musl libc with all static linking. After working around some expected troubles to generate configure, such as the libtool and iconv.m4 dependencies, the build appeared to complete successfully. But on closer inspection, the plugins were installed as a bunch of .a and .la files rather than getting linked into any of the binaries, as would be necessary to actually use them. I determined that the probe for dynamic module support (DOVECOT_MODULES defined in 'm4/modules.m4') had returned a false positive: in the static configuration musl includes a stub dlopen() that always returns failure at runtime, so a compile-and-link-only test is not predictive. Libtool itself is affected in the same way, but it comes with the --disable-shared option which usually makes things works fine. Short of a proper solution (perhaps removing modules.m4 and going instead by what libtool already determined, since you've decided to depend on it anyway), I stubbed out modules.m4 to simply return the correct result for this platform, thus: AC_DEFUN([DOVECOT_MODULES], [ have_modules=no AC_SUBST(MODULE_LIBS) AC_SUBST(DLLIB) ]) Now the build is failing due to the absence of a function that's defined only when HAVE_MODULES is true: libtool: link: gcc -I../../src/lib -I../../src/lib-test -I../../src/lib-ssl-iostream -DDCRYPT_MODULE_DIR=\"/gales/pkg/dovecot-0.0-2.3.19.1/lib/dovecot\" -DDCRYPT_SRC_DIR=\"../../src/lib-dcrypt\" -std=gnu99 -g -O1 -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=2 -Wall -W -Wmissing-prototypes -Wmissing-declarations -Wpointer-arith -Wchar-subscripts -Wformat=2 -Wbad-function-cast -fno-builtin-strftime -Wstrict-aliasing=2 -Wl,--whole-archive -Wl,../lib-ssl-iostream/.libs/libssl_iostream.a -Wl,--no-whole-archive -o test-stream test_stream-dcrypt.o test_stream-istream-decrypt.o test_stream-ostream-encrypt.o test_stream-test-stream.o ../lib-ssl-iostream/.libs/libssl_iostream.a ../lib-test/.libs/libtest.a ../lib/.libs/liblib.a test_crypto-dcrypt.o: In function `dcrypt_initialize': /home/user/gales-linux/gports/dovecot/build/dovecot-2.3.19.1/src/lib-dcrypt/dcrypt.c:34: undefined reference to `module_dir_try_load_missing' collect2: error: ld returned 1 exit status make[3]: *** [Makefile:664: test-crypto] Error 1 I noticed commit d21897832a443d139d56b1fb1c86d8f76e5f77f3 from 2009, "Fixed compiling without module support", and clearly it's supposed to work since the #ifdefs are there, but I begin to suspect that nobody's actually tested this branch of the configuration tree recently. Further, looking through the automakefiles I'm not finding how the plugin libraries are supposed to work at all in this case and I begin to fear that they simply... aren't. Say it ain't so? Jacob

2 3

rspamd results
by Benny Pedersen 09 Oct '22

09 Oct '22

Results for file: 2 (0.0633 seconds) [Metric: default] Action: add header Spam: true Score: 3.99 / 30.00 Symbol: ARC_REJECT (1.00)[signature check failed: fail, {[1] = sig:dovecot.org:reject}] Symbol: DKIM_TRACE (0.00)[junc.eu:-] Symbol: DMARC_POLICY_SOFTFAIL (0.10)[junc.eu : No valid SPF, none] Symbol: FROM_HAS_DN (0.00) Symbol: FROM_NEQ_ENVFROM (0.00)[me(a)junc.eu, dovecot-bounces(a)dovecot.org] Symbol: HAS_LIST_UNSUB (-0.01) Symbol: HAS_ORG_HEADER (0.00) Symbol: HFILTER_HOSTNAME_UNKNOWN (2.50) Symbol: MAILLIST (-0.20)[mailman] Symbol: MID_RHS_MATCH_FROM (0.00) Symbol: MIME_GOOD (-0.10)[text/plain] Symbol: MIME_TRACE (0.00)[0:+] Symbol: RCPT_COUNT_ONE (0.00)[1] Symbol: RCVD_COUNT_SEVEN (0.00)[7] Symbol: RCVD_IN_DNSWL_MED (-0.40)[172.104.150.56:received, 94.237.105.223:received] Symbol: RCVD_NO_TLS_LAST (0.10) Symbol: RCVD_VIA_SMTP_AUTH (0.00) Symbol: R_DKIM_REJECT (1.00)[junc.eu:s=default] Symbol: TO_DN_NONE (0.00) Message-ID: 38f38a585892368901bd47944ca617ab(a)junc.eu just to be sure its not a fail in spamassassin with dkim_invalid ARC-Authentication-Results: i=1; talvi.dovecot.org; dkim=pass header.d=junc.eu header.s=default header.b=rodgOLEw; spf=pass (talvi.dovecot.org: domain of me(a)junc.eu designates 172.104.150.56 as permitted sender) smtp.mailfrom=me(a)junc.eu; dmarc=pass (policy=none) header.from=junc.eu where is the problem ? i will report fuglu dkim signing non existing headers in a moment if that my fault cc: is non existing here but are still signed, why did ARC verify not find this problem ?

1 0

imapsieve removeflag ignored
by Slavko 08 Oct '22

08 Oct '22

Hi, i have working SPAM reporting implementend by imapsieve in debian's 2.3.13 dovecot. Recently i decide to add personal spam filter by bogofilter and use logic to learn/unlearn SPAM/HAM based on message flags. Here is example of moving message from Junk folder (the opossite logic is similar): if hasflag "$Junk" { execute :pipe "bogofilter" ["-Sn"]; removeflag "$Junk"; debug_log "Learned HAM (and unlearned)"; } else { execute :pipe "bogofilter" ["-n"]; debug_log "Learned HAM (only)"; } # mark as learned addflag "$NotJunk"; report ... When i move message, the debug lines in log shows, that logic works and flag is added as expected, but the other flag is not removed. Thus after moving mail from Junk, which has $Junk flag, it has both flags, the $Junk and $NotJunk. I tried to move removeflag action outside of condition and add it just before addflag, but the result is the same. For now i do not know if here is something wrong in my script, or i did some other mistake. On IRC cmouse tell, that removeflag was fixed in some early version (2.3.5 or so), but it doesn't work here. Please, how i can get it working? regards PS: please CC me, i am not subscribed -- Slavko https://www.slavino.sk/

2 2

oauth2 passdb user authentication with PLAIN
by Simon 05 Oct '22

05 Oct '22

2 2

Replacing antispam plugin with IMAPSieve not 100% correct?
by Marc 04 Oct '22

04 Oct '22

I think this page[1] is not correct If you configure this option: imapsieve_mailbox1_before = file:/usr/lib/dovecot/sieve/report-spam.sieve the file report-spam.svbin cannot be created because users cannot write there. [1] https://doc.dovecot.org/configuration_manual/howto/antispam_with_sieve/#how…

3 2

Using sqlite as dict for last_auth plugin
by Oleg petol 04 Oct '22

04 Oct '22

Hi! It is required to collect statistics about the time of the last IMAP and POP3 login of the user and the delivery of letters to him via lmtp. The last-login plugin is perfect. But I don't want to use heavy databases as the mail system service is served by the Oracle DB. The most suitable option, as I see, is to store statistics in the sqlite DB, but after going through all the options in the configuration file, I could not use sqlite. When writing in configuration: plugin { driver=sqlite last_login_dict = sqlite:statsdb last_login_key = last-login/%s/%u/%r last_login_precision = ms } I am getting an error: Oct 4 17:01:41 nms4 dovecot: imap(new_ver_test(a)test2.aroma.ru)<154597><q0VJ5jXq9o4KAQDI>: Error: last_login_dict: dict_init(sqlite:statsdb) failed: Unknown dict module: sqlite I did the last-login plugin setup exactly according to the instructions: https://doc.dovecot.org/configuration_manual/mail_location/obox/last_login_… I am using standard debian packages. Desperate, I built latest dovecot version from source, but got exactly the same error. Tell me, please, is it possible to use a dictionary in sqlite format to collect last-login plugin statistics? And how should I describe it in the configuration file? Sincerely, Oleg Additional Information: # /sbin/dovecot --build-options Build options: ioloop=epoll notify=inotify openssl io_block_size=8192 SQL driver plugins: mysql postgresql sqlite Passdb: checkpassword ldap pam passwd passwd-file shadow sql Userdb: checkpassword ldap(plugin) passwd prefetch passwd-file sql # /sbin/dovecot -n # 2.3.13 (89f716dc2): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.13 (cdd19fe3) # OS: Linux 5.10.0-18-amd64 x86_64 Debian 11.5 # Hostname: nms4.some.host auth_default_realm = some.host auth_verbose = yes dict { statsdb = sqlite:/etc/dovecot/dovecot-dict-sql.conf.ext } disable_plaintext_auth = no first_valid_uid = 89 mail_debug = yes mail_gid = vmail mail_location = maildir:~/Maildir mail_plugins = quota mail_privileged_group = mail mail_uid = vmail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = username_format=%u /etc/postfix/vusers.conf driver = passwd-file } plugin { driver = sqlite last_login_dict = sqlite:statsdb last_login_key = # hidden, use -P to show it last_login_precision = ms quota = maildir quota_grace = 10%% sieve = file:~/sieve;active=~/.dovecot.sieve } protocols = " imap lmtp sieve pop3 sieve" service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0666 user = postfix } unix_listener auth-userdb { group = vmail user = vmail } } service lmtp { executable = lmtp -L inet_listener lmtp { address = 10.1.0.187 port = 24 } process_min_avail = 5 unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } user = vmail } service managesieve-login { inet_listener sieve { port = 4190 } } ssl_cert = </etc/letsencrypt/live/some.host/fullchain.pem ssl_client_ca_dir = /etc/ssl/certs ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { args = username_format=%u /etc/postfix/vusers.conf driver = passwd-file override_fields = uid=vmail gid=vmail } protocol lmtp { info_log_path = /var/log/dovecot-lmtp.log mail_plugins = quota sieve quota last_login } protocol imap { mail_plugins = quota imap_quota last_login } protocol sieve { managesieve_max_line_length = 64 k } protocol pop3 { mail_plugins = quota last_login } -- /petol http://kab.tv/rus

1 0

Re: Pigeonhole redirect is adding a message-id header when it already exists
by hi＠zakaria.website 02 Oct '22

02 Oct '22

On 2022-10-01 22:59, michael.zork(a)feierfighter.de wrote: > Hi Zakaria, > > I'm very happy about your email to the mailing list, I thought I'm > alone with my problem, and it's nice to see that the problem might be > a bug/problem in pigeonhole. I was not sure about it because I didn't > get a technical answer from that German provider, so I didn't know it > it's a bug in pigeonhole or not. I didn't have time to investigate, > thanks for your time to investigate and pinpoint to the line of code > where the problem might be! > > Back then, a few months ago, I disabled the "Message-Id duplicate > check" because of this problem. > > It's just a problem of <0.001% of the emails, most systems generate > valid Message-IDs. Maybe Alibaba/Aliexpress is the biggest one who > generates invalid Message-Ids... > > It would be awesome if you could also try to contact > Alibaba/Aliexpress, and tell them the problem. Maybe they fix it if > multiple people report it. But I doubt it. > > Let's see what the Dovecot guys say to this problem. Maybe the best > solution is to remove the invalid Message-Id before adding a new one. > > Michael > > Am 01-Oct-2022 18:24:05 +0200 schrieb hi(a)zakaria.website: > >> On 2022-10-01 12:49, michael.zork(a)feierfighter.de wrote: >>> Hi there, >>> >>> I can confirm this behavior. A few months ago I introduced a >> milter >>> which is checking for multiple headers when the RFC says that >> there >>> just should be one of them For example "Message-Id". >>> >>> I found the described problem in an email coming from Alibaba, >> which >>> had an invalid "Message-Id" header. It didn't contain an "@" sign >> or >>> similar. It was RFC-invalid. >>> >>> This email was sent from Alibaba to a German email provider. There >> was >>> a redirect at that email provider, pointing to my mailserver. >>> >>> My server rejected the email because there were 2 "Message-Id" >>> headers: The original invalid "Message-Id" header from Alibaba, >> and a >>> new "Message-Id" header from the German provider, which seems to >> have >>> been added during the redirect. There were "Dovecot-sieve" headers >> in >>> that mail, so my guess was that it happened because of >>> Dovecot-sieve/pigeonhole implementation. >>> >>> I contacted the email provider, asking for help. Asking if it >> really >>> is a bug in pigeonhole (or maybe some other system at that >> provider, >>> who knows). And I contacted Alibaba, so they fix the invalid >>> "Message-Id". I got responses from both, but until now, as far as >> I >>> can see, it has not been fixed. >>> >>> The best fix would be (if it really is a bug in pigeonhole), if >>> pigeonhole fixes the problem, then it's fixed for all users of >>> Dovecot. I guess Alibaba is not the only sender with an invalid >>> "Message-ID" header, but that's the only one I saw. >>> >>> Michael >>> >>> Am 01-Oct-2022 14:00:45 +0200 schrieb sriccio(a)swisscenter.com: >>> >>>>> You wrote in the original email the message was rejected. Sorry >> I >>>> don't have login access to my gmail test account anymore since >> the >>>> google @#$%@#$% wanted to have me add a phone number. >>>> >>>> In my original post I said that gmail was rejecting the forwards >>>> because >>>> of duplicate headers, and that the duplicate header seems to be a >>>> Message-ID added by pigeonhole when it's "not happy" with the >>>> original >>>> mail Message-ID. >>>> >>>> I probably failed to explain the issue clearly and sorry for >> that. >>>> >>>> Thank you anyway for trying to help :) >> >> Hi Michael, >> >> I just wanted to say sorry, that I sent this empty email by mistake >> intending nothing else. >> >> Anyhow, thanks so much for your valuable input, it's very much >> appreciated. >> >> Zakaria. Good Morning Michael, No problem. Although, to be clear I didnt point out anything, but its Sébastien and the credit shall go for him. Also, by the way in EXIM MTA, there is verify syntax condition in data acl, which checks all email headers and validate that they are standards compliant and reject sending any email beforehand to your issue which has non-compliant header and offers the ability to remove such headers with condition handling e.g. if contained any Sieve header, to request removing message id headers with headers_remove and add compliant one with add_header, and I guess this will mitigate any mail service provider rejection issue. If you are postfix user and considering switching, let me know, I might be able to help. Zakaria.

1 0

Matching Addresses in Sieve
by Doug Hardie 01 Oct '22

01 Oct '22

I have an email with the following header line: From: 'Thank you!Kohls' <Kohls-MNc(a)FeedbackKohlsOpinionRequestedlxecrftHO.com> I am trying to match that with: if address :contains "from" "Thank you!Kohls" { addflag "\\Seen"; fileinto "Junk"; stop; } However, the matching portion of the from address is only the section between < and >. Since there are changing sections that are different for each email, I can't use that. I wanted to match the stuff before <. I have tried numerous formats for the if statement but none of them have worked. What is the proper way to make that match work? Thanks, -- Doug

2 2

new feature: sieve forward plugin
by Marc 26 Sep '22

26 Sep '22

As this page[1] describes a more often occurring problem of forwarding messages from servers that are not included in the spf records. Maybe there should be a plugin that offers this forward functionality. Something like get the spf records of the sender check if there is a -all then apply the sender substitution. https://doc.dovecot.org/configuration_manual/sieve/configuring_auto_forward…

4 4

Vmail Home
by Silvio Siefke 26 Sep '22

26 Sep '22

Hello, I use Opensmtpd with Dovecot LMTP. All this run but one point I not understand. I use Virtual Users, with System User vmail, home is /var/vmail but dovecot stored message in path /home/vmail/<domain>/user. In configuration files is /var/vmail (dovecot users). Thx for help Silvio ---- cat /etc/passwd | grep vmail vmail:x:2000:2000:Vmail Directory and User:/var/vmail:/usr/sbin/nologin ---- dovecot -n # 2.3.13 (89f716dc2): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.13 (cdd19fe3) # OS: Linux 5.10.0-18-amd64 x86_64 Debian 11.5 # Hostname: asia.sisi-systems.ovh default_vsz_limit = 1 G doveadm_password = # hidden, use -P to show it doveadm_port = 20000 mail_gid = vmail mail_location = maildir:~/Maildir mail_plugins = " notify replication" mail_privileged_group = vmail mail_uid = vmail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext imapsieve vnd.dovecot.imapsieve namespace inbox { inbox = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Sent { auto = subscribe special_use = \Sent } mailbox Spam { auto = subscribe special_use = \Junk } mailbox Trash { auto = subscribe special_use = \Trash } prefix = } passdb { args = scheme=SHA512-CRYPT username_format=%u /etc/dovecot/users driver = passwd-file } plugin { imapsieve_mailbox1_before = file:/var/vmail/sieve/global/learn-spam.sieve imapsieve_mailbox1_causes = COPY imapsieve_mailbox1_name = Spam imapsieve_mailbox2_before = file:/var/vmail/sieve/global/learn-ham.sieve imapsieve_mailbox2_causes = COPY imapsieve_mailbox2_from = Spam imapsieve_mailbox2_name = * mail_replica = tcp:192.168.1.112 quota = maildir:User quota quota_exceeded_message = Benutzer %u hat das Speichervolumen überschritten. / User %u has exhausted allowed storage space. sieve = file:/var/vmail/sieve/%d/%n/scripts;active=/var/vmail/sieve/%d/%n/active-script.sieve sieve_before = /var/vmail/sieve/global/spam-global.sieve sieve_global_extensions = +vnd.dovecot.pipe +vnd.dovecot.environment sieve_pipe_bin_dir = /usr/bin sieve_plugins = sieve_imapsieve sieve_extprograms } protocols = lmtp imap pop3 sieve service aggregator { fifo_listener replication-notify-fifo { user = vmail } unix_listener replication-notify { user = vmail } } service doveadm { inet_listener { port = 20000 } } service imap-login { inet_listener imap { port = 143 } vsz_limit = 1 G } service lmtp { unix_listener lmtp { group = vmail user = vmail } } service managesieve-login { inet_listener sieve { port = 4190 ssl = yes } } service managesieve { process_limit = 1024 } service pop3-login { inet_listener pop3 { port = 110 } inet_listener pop3s { port = 995 ssl = yes } } service replicator { process_min_avail = 1 unix_listener replicator-doveadm { mode = 0600 user = vmail } } ssl = required ssl_cert = </etc/lego/certificates/imap.sisi-systems.ovh.crt ssl_cipher_list = ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384 ssl_client_ca_dir = /etc/ssl/certs ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it ssl_min_protocol = TLSv1.2 userdb { args = username_format=%u /etc/dovecot/users driver = passwd-file override_fields = uid=vmail gid=vmail home=/home/vmail/%d/%n } protocol imap { imap_idle_notify_interval = 29 mins mail_max_userip_connections = 20 mail_plugins = " notify replication quota imap_quota imap_sieve" } protocol lmtp { mail_plugins = " notify replication sieve notify push_notification" postmaster_address = network(a)sisi-systems.ovh } protocol pop3 { mail_max_userip_connections = 10 mail_plugins = " notify replication" }

2 1

Custom post login scripting variables via ID command
by hi＠zakaria.website 26 Sep '22

26 Sep '22

Hi there, I wonder if dovecot would consider this feature request. In post login scripting, given USER, IP, LOCAL_IP, and userdb lookup fields, are only available, I want to push additional variables from web mail to dovecot using ID commands yet I looked at the source in imap-login-cmd-id.c and script-login.c it seems to be possible while I'm not an expert in C and IMAP standards and not sure if its something would break the standards. I hope the dev team to consider this and if anyone have a workaround or an idea with I can start to patch a workaround myself, please let me know as it would be very much appreciated. With thanks. Zakaria.

3 4

what sieve variables / syntax is available to sieve scripts.
by Marc 25 Sep '22

25 Sep '22

1. where can I find all variables like "imap.user" like in mentioned on page[2] 2. I have the impression that variables like "${from}" are all being set from scanning the whole email again seeing these "if matches" statements. Is that not super inefficient? I would assume that such variables would be set and made available upon the receipt of a message. 3. What is the point of this: if environment :matches "imap.user" "*" { set "username" "${1}"; } pipe :copy "sa-learn-ham.sh" [ "${username}" ]; Why can't I just use: pipe :copy "sa-learn-ham.sh" [ "imap.user" ]; [1] require [ "vnd.dovecot.pipe", "copy", "variables" ]; if header :matches "subject" "*" { set "subject" "${1}"; } if header :matches "from" "*" { set "from" "${1}"; } pipe :args [ "USER(a)DOMAIN.TLD", "${from}", "${subject}" ] :copy :try "jabber_notify.sh" ; from page https://wiki.dovecot.org/Pigeonhole/Sieve/Plugins/Pipe [2] if environment :matches "imap.user" "*" { set "username" "${1}"; } pipe :copy "sa-learn-spam.sh" [ "${username}" ]; https://doc.dovecot.org/configuration_manual/howto/antispam_with_sieve/#how…

1 0

test sieve plugin(?) development
by Marc 24 Sep '22

24 Sep '22

Say for testing purposes I would like to add sender email addresses to a database file (eg gdbm) per user. How would I go about doing this? Do I need to create something like in https://github.com/dovecot/pigeonhole/tree/src/lib-sieve/plugins Or can I just create a go binary, and parse data to it? Is there not something like a hello world example for this?

1 0

Duplicate UID warning in dsync backups
by Doug 23 Sep '22

23 Sep '22

Hi, Running dovecot version 2.3.18 with mdbox storage. I run daily backups using dsync on the same server into maildir format. Several times per week I will get an error like the one below that prevents backups from completing. The error is always on my user, never any of my other couple dozen users. dsync(doug): Warning: Deleting mailbox 'INBOX': UID=133060 already exists locally for a different mail: GUIDs don't match (1657786027.M158587P19048.maildev.domain.com vs 581a08178e8ecf62f04700002bad4ea1) dsync(doug): Error: Couldn't delete mailbox INBOX: INBOX can't be deleted. Subsequent backups typically have a slightly different error. dsync(doug): Warning: Deleting mailbox 'INBOX': UID=132994 GUID=407c871b0ec1c562b51000002bad4ea1 is missing locally dsync(doug): Error: Couldn't delete mailbox INBOX: INBOX can't be deleted. Notice the UID and GUID are different from the first error. At this point I will identify 407c871b0ec1c562b51000002bad4ea1 in the source mailbox, and move it to another folder. More often than not that clears things up. The backup command I am using is dsync -u doug all backup maildir:/home/doug/.mailbkup/mailboxes My questions are: Is the "locally" referring to the source or the target of the backup? What might be causing this problem? What the heck is this guid: 1657786027.M158587P19048.maildev.domain.com" Note: The server is actually named mail.domain.com, not maildev.domain.com All file names in the backup maildir have mail.domain.com in them No files exist in the target maildir directory that begin with 1657786027* My original migration from mbox format to mdbox was tested and run on a server named maildev.domain.com. Is that why I am seeing a reference to maildev here? Is that name cached somewhere? Can it be corrected? Does it matter? Are there any options I should add to the dsync command to fix this problem? -- Doug

1 1

pigeonhole (manage)sieve directory permissions
by Peter Gervai 22 Sep '22

22 Sep '22

Hello, I've tried to find info (apart from looking at the sources) but it seems this isn't mentioned anywhere. The setting plugin { sieve = file:~/sievedir;active=~/.sievefilter } names the directory where the scripts are stored and the symlink pointing at one. Right now the sievedir seems to be created 0700 plus some - probably inherited - g+s. How could I change mode (to 02770 preferably)? Also the script files are created 0600 by managesieve which really would be nice to be 0660 instead. The main problem is that external programs shall stat() .sievefilter but they only share groups. Thanks, g

1 0

Outlook 365 MUA produces dovecot changing filename on some mailbox
by Emilio Augusto Lazo Zaia 21 Sep '22

21 Sep '22

Hello I have a setup on which dovecot is the server in a domain on which mailboxes are >20GB, some of them are 150GB or more. When reconfiguring _some_ mailboxes with Outlook 365 (configuring a previously used mailbox on a new PC), the process takes too long even if mail visibility on Outlook is 3 months. Inspecting at INBOX cur directory I did note that the 'ls' command shows the last file listed is a file from year 2020, 2019 or whatever not being the last received mail; that means the alphabetical ordering of 'ls' is showing past years after the last received mail, i.e. dovecot changed the epoch in filename. This only happens with Outlook. Following is an excerpt of ls: -rw-r--r-- 1 coord.ventas ventas 544765 sep 9 10:57 1662769412.M329925P1259441.xyz.com,S=544765,W=552045:2, -rw-r--r-- 1 coord.ventas ventas 163491 sep 5 12:14 1662769412.M74257P1259441.xyz.com,S=163491,W=165846:2,S -rw-r--r-- 1 coord.ventas ventas 3043536 sep 9 12:02 1662769412.M777084P1259441.xyz.com,S=3043536,W=3083246:2, -rw-r--r-- 1 coord.ventas ventas 161002 feb 27 2020 1662874173.M608062P1282222.xyz.com,S=161002,W=163373:2,S -rw-r--r-- 1 coord.ventas ventas 2230491 feb 27 2020 1662874176.M281294P1282222.xyz.com,S=2230491,W=2259506:2,S -rw-r--r-- 1 coord.ventas ventas 167925 feb 27 2020 1662874176.M741229P1282222.xyz.com,S=167925,W=170373:2,S The process of renaming files is continuous until all folder was reread and renamed every file on it. If I issue 'lsof' (with grep) I see the file that is being renamed passing through tmp/ directory and after that, the file is placed under new/ directory (I guess) and Outlook sees a new email to sync, making the sync process too long... mails that have been synced are resynced... Take a look at the timestamp on filenames: 1662769412 corresponds to "Fri Sep 9 20:23:32 -04 2022" and 1662874176 corresponds to Sun Sep 11 01:29:36 -04 2022 but mails were neither sent nor received on that dates. What is Outlook requesting imap server to do and how to avoid this? Thanks -- Emilio Augusto Lazo Zaia

4 6

Debug logging: dovecot-lda command line?
by EML 20 Sep '22

20 Sep '22

Is there some way to configure logging so that I can see the command line that's passed to dovecot-lda? I'm on 2.3.16. Thanks.

1 1

Replicator Failure
by David Morsberger 20 Sep '22

20 Sep '22

Hello, I recently noticed the following errors in my log file and replicator status shows all accounts failed. I am seeing the same error on both hosts. "dovecot: doveadm(name(a)domain.com): Fatal: connect(192.168.1.250:12345) failed: Interrupted system call” # doveadm replicator status Queued 'sync' requests 0 Queued 'high' requests 0 Queued 'low' requests 0 Queued 'failed' requests 0 Queued 'full resync' requests 0 Waiting 'failed' requests 8 Total number of known users 8 Replication used to work and I do not know when it started failing. I restarted dovecot on both hosts to no avail. Any idea on how to get more information and resolve this issue? I cannot find anything else in the logs David

1 2

doveadm-search finds emails, but IMAP search fails to find any
by Philip Warner 20 Sep '22

20 Sep '22

Using dovecot 2.3.7.2 with solr 8.11.2 when I do: doveadm search -u user mailbox INBOX subject "something" I get multiple mail ID's. When I start a manual IMAP session and login as that user, select INBOX, and try the command: . search subject "something" It returns zero mail ID's; this is consistent across all searches using IMAP - no results returned, no matter what I search for in IMAP. The dovecot -n command returns: # 2.3.7.2 (3c910f64b): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.7.2 () # OS: Linux 5.4.0-125-generic x86_64 Ubuntu 20.04.5 LTS # Hostname: WITHELD mail_location = maildir:~/Mail mail_plugins = " fts fts_solr virtual" mail_privileged_group = mail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext namespace { location = virtual:~/Mail/virtual prefix = virtual. separator = . } namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } mailbox virtual.All { comment = All my messages special_use = \All } prefix = } passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } passdb { driver = pam } plugin { fts = solr fts_autoindex = yes fts_enforced = yes fts_solr = url=http://localhost:8983/solr/dovecot/ sieve = file:~/sieve;active=~/.dovecot.sieve } protocols = " imap lmtp sieve pop3 sieve" service imap { vsz_limit = 4 G } service index-worker { vsz_limit = 2 G } service indexer-worker { vsz_limit = 2 G } service lmtp { inet_listener lmtp { address = 127.0.0.1 port = 24 } } ssl_cert = </etc/letsencrypt/live/WITHELD/fullchain.pem ssl_client_ca_dir = /etc/ssl/certs ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } userdb { driver = passwd } protocol lmtp { mail_plugins = " fts fts_solr virtual sieve" postmaster_address = WITHELD } protocol lda { mail_plugins = " fts fts_solr virtual sieve" } protocol imap { mail_max_userip_connections = 40 } -

2 3

Panic: file mail-index-transaction-finish.c: line 185
by tobisworld＠gmail.com 20 Sep '22

20 Sep '22

Hi list I have weird issue with my Dovecot 2.3.17.1 (476cd46418) When deleting a certain amount of messages from my INBOX via my MUA (Evolution) all over sudden dovecot starts to panic Panic: file mail-index-transaction-finish.c: line 185 (mail_index_transaction_get_uid): assertion failed: (seq <= t->view- >map->hdr.messages_count) imap(REDACTED)<24075><P0/vLkXUNt4KQmMB>: Error: Raw backtrace: /usr/lib64/dovecot/libdovecot.so.0(backtrace_append+0x42) [0x7f09274d4142] -> /usr/lib64/dovecot/libdovecot.so.0(backtrace_get+0x1e) [0x7f09274d424e] -> /usr/lib64/dovecot/libdovecot.so.0(+0xf72fe) [0x7f09274e22fe] -> /usr/lib64/dovecot/libdovecot.so.0(+0xf73a1) [0x7f09274e23a1] -> /usr/lib64/dovecot/libdovecot.so.0(i_fatal+0) [0x7f0927430e38] -> /usr/lib64/dovecot/libdovecot-storage.so.0(+0xf438d) [0x7f092789d38d] - > /usr/lib64/dovecot/libdovecot-storage.so.0(+0xf43da) [0x7f092789d3da] -> /usr/lib64/dovecot/libdovecot- storage.so.0(mail_index_transaction_finish+0x177) [0x7f092789da87] -> /usr/lib64/dovecot/libdovecot-storage.so.0(+0xf9ad6) [0x7f09278a2ad6] - > /usr/lib64/dovecot/libdovecot- storage.so.0(mail_index_transaction_commit_full+0x9d) [0x7f09278a2fad] -> /usr/lib64/dovecot/libdovecot- storage.so.0(mail_index_transaction_commit+0x1c) [0x7f09278a306c] -> /usr/lib64/dovecot/libdovecot- storage.so.0(mail_cache_set_seq_corrupted_reason+0x61) [0x7f092788c921] -> /usr/lib64/dovecot/libdovecot- storage.so.0(mail_set_mail_cache_corrupted+0xed) [0x7f09277fbbbd] -> /usr/lib64/dovecot/libdovecot-storage.so.0(+0x7a3e9) [0x7f09278233e9] - > /usr/lib64/dovecot/libdovecot-storage.so.0(+0x7a6b0) [0x7f09278236b0] -> /usr/lib64/dovecot/libdovecot- storage.so.0(mail_get_physical_size+0x38) [0x7f09277e8ba8] -> /usr/libexec/dovecot//lib20_mail_log_plugin.so(+0x2465) [0x7f09263dd465] -> /usr/libexec/dovecot//lib15_notify_plugin.so(notify_contexts_mail_copy+ 0x5c) [0x7f09265e13ec] -> /usr/libexec/dovecot//lib15_notify_plugin.so(+0x25d4) [0x7f09265e25d4] -> /usr/libexec/dovecot//lib10_quota_plugin.so(+0x102ae) [0x7f09269f92ae] -> /usr/libexec/dovecot//lib01_acl_plugin.so(+0xef3e) [0x7f0926c10f3e] -> /usr/lib64/dovecot/libdovecot- storage.so.0(+0x50c4c) [0x7f09277f9c4c] -> /usr/lib64/dovecot/libdovecot-storage.so.0(mailbox_move+0x58) [0x7f09277f9ec8] -> dovecot/imap(+0x1175b) [0x55a2c0ea575b] -> dovecot/imap(command_exec+0x64) [0x55a2c0eb3f04] -> dovecot/imap(+0x1dde2) [0x55a2c0eb1de2] -> dovecot/imap(+0x1de71) [0x55a2c0eb1e71] -> dovecot/imap(+0x1e039) [0x55a2c0eb2039] -> dovecot/imap(client_handle_input+0x205) [0x55a2c0eb22f5] -> dovecot/imap(client_input+0x79) [0x55a2c0eb28d9] imap(REDACTED)<24075><P0/vLkXUNt4KQmMB>: Fatal: master: service(imap): child 24075 killed with signal 6 (core dumps disabled - https://dovecot.org/bugreport.html#coredumps) >From that point on ANY access to INBOX from my MUA causes the error. The only way that I found to get around is to unsubscribe the INBOX folder and subscribe again. Then the error is gone until I delete a bunch of messages again. The error only occurs if I delete the messages within short time or select multiple (about 20msg at once). If I delete them one-by-one always waiting for expunge message in dovecot logs to appear then I can delete as many as I want. I have not verified with other MUA but in Evolution I can reproduce the issue. Cheers and have a good one tobi

4 14

Thunderbird can't connect to Dovecot (bad certificate: SSL alert number 42)
by Meikel 19 Sep '22

19 Sep '22

Hi folks, on a Rocky Linux 8.6 based home server I run Dovecot with an account that I use as an archive. Archive means, that from different Thunderbird instances I connect to that Dovecot via IMAPS to move emails there, that I want to keep. Since some days from all Thunderbird instances I can no longer connect to that Dovecot account. In /var/log/maillog of the server I see Sep 14 06:39:54 server3 dovecot[2033173]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14094412:SSL routines:ssl3_read_bytes:sslv3 alert bad certificate: SSL alert number 42 (no auth attempts in 0 secs): user=<>, rip=192.168.177.105, lip=192.168.177.13, TLS handshaking: SSL_accept() failed: error:14094412:SSL routines:ssl3_read_bytes:sslv3 alert bad certificate: SSL alert number 42, session=<dL1luJvokK3AqLFp> I found that Openssl alert number 42 might be a problem with the SSL certificate (which certificate?) but also might be an expired SSL certificate (which certificate?). As on the Dovecot installation I work with a self signed certificat. I created a new self signed certificate yesterday with an expiry not before year 2032. That did not help, I see the same messages when I try to connect from Thunderbird. Just to see how Thunderbird is involved in the problem I installed Claws-Mail. From Claws-Mail I do NOT have those problems, I can access to Dovecot via IMAPS as expected. I do not understand why all my Thunderbird installations can no longer access Dovecot via IMAPS. This worked fine for about 18 months. I can't prove but I think on beginning of month it worked fine. Something happened meanwhile. If there is a problem with an SSL certificate (bad certificate: SSL alert number 42), which certificate makes the problem? The certificate used by Dovecot or some certificate used in Thunderbird? About installation: cat /etc/redhat-release Rocky Linux release 8.6 (Green Obsidian) dovecot --version 2.3.16 (7e2e900c1a) sudo dovecot -n # 2.3.16 (7e2e900c1a): /etc/dovecot/dovecot.conf # OS: Linux 4.18.0-372.19.1.el8_6.x86_64 x86_64 Rocky Linux release 8.6 (Green Obsidian) # Hostname: ....... auth_debug = yes auth_mechanisms = plain login auth_verbose = yes first_valid_uid = 1000 mail_debug = yes mail_gid = vmail mail_location = maildir:~/Maildir mail_privileged_group = vmail mail_uid = vmail mbox_write_locks = fcntl namespace { inbox = yes location = mailbox Archives { special_use = \Archive } prefix = INBOX/ separator = / type = private } passdb { args = scheme=CRYPT username_format=%u /etc/dovecot/users driver = passwd-file } protocols = imap service imap-login { inet_listener imap { port = 0 } } ssl = required ssl_cert = </etc/dovecot/......crt ssl_cipher_list = PROFILE=SYSTEM ssl_key = # hidden, use -P to show it userdb { args = username_format=%u /etc/dovecot/users driver = passwd-file } verbose_proctitle = yes I used the following command to recreate the SSL certificate for Dovecot: sudo openssl req -x509 -nodes -days 3650 -newkey rsa:4096 -keyout /etc/dovecot/......key -out /etc/dovecot/......crt And with the command openssl s_client -crlf -connect .....:993 I can successfully connect to Dovecot and "simulate" a minimal IMAP-Session: * OK [CAPABILITY IMAP4rev1 SASL-IR LOGIN-REFERRALS ID ENABLE IDLE LITERAL+ AUTH=PLAIN AUTH=LOGIN] Dovecot ready a login meikel.archive@..... topsecret a OK [CAPABILITY IMAP4rev1 SASL-IR LOGIN-REFERRALS ID ENABLE IDLE SORT SORT=DISPLAY THREAD=REFERENCES THREAD=REFS THREAD=ORDEREDSUBJECT MULTIAPPEND URL-PARTIAL CATENATE UNSELECT CHILDREN NAMESPACE UIDPLUS LIST-EXTENDED I18NLEVEL=1 CONDSTORE QRESYNC ESEARCH ESORT SEARCHRES WITHIN CONTEXT=SEARCH LIST-STATUS BINARY MOVE SNIPPET=FUZZY PREVIEW=FUZZY LITERAL+ NOTIFY SPECIAL-USE] Logged in a logout * BYE Logging out a OK Logout completed (0.001 + 0.000 secs). closed I have the problem with different Thunderbird installations on various operating systems (Windows 10, Fedora Linux 36 XFCE). Regards, Meikel

10 13

Bug report: TLS SNI for LDAP userdb/passdb
by Tobias Wolter 18 Sep '22

18 Sep '22

Cheers, Dovecot 2.3.4.1 (Debian stable) here, and the changelog does not offer any hope of salvation, so a bug report it is. The LDAP connections for userdb/passdb do not support SNI via TLS. Simple construct to reproduce this: 0.) Have a.pem with SAN `foo.example.com`, b.pem with `bar.example.com` 1.) Configure haproxy frontend with `bind *:636 ssl crt /foo/a.pem ssl crt /foo/b.pem` 2.) Try to use ldaps://bar.example.com/ in passdb, receive "auth: Error: LDAP: Can't connect to server: ldaps://bar.example.com" Expectation, of course, would be for this to work; most libraries should support it, it's probably just a matter of convincing the appropriate binding. Kind regards, -towo

4 4

Client for a Windows User ?
by White, Daniel E. (GSFC-770.0)[AEGIS] 13 Sep '22

13 Sep '22

Specifically, Windows 2016 server I suggested Thunderbird. Is there anything else ? Is this current ? https://wiki.dovecot.org/Clients

6 6

Overquota flag and auth caching
by Christian Rößner 13 Sep '22

13 Sep '22

Hello, I like the over quota flag mechanism in Dovecot. I found out that I get in trouble if a user gets over quota and I have turned on auth caching, because the cache does not automatically invalidate a user while toggling the flag. The cache still serves the old state. The result is that mails are still accepted, even a user went over quota resulting in bounces. Workaround is to flush a user from inside the toggle script, which solves the bounce problem, but it prevents the user from getting under quota before the user is flushed from the cache again. What is the correct way to use the over quota flag and which solutions can be taken to invalidate the user? Is it possible to do this in a Lua user backend? Any other method? Thanks in advance Christian Rößner -- Rößner-Network-Solutions Zertifizierter ITSiBe / CISO Karl-Bröger-Str. 10, 36304 Alsfeld Fax: +49 6631 78823409, Mobil: +49 171 9905345 USt-IdNr.: DE225643613, https://roessner.website PGP fingerprint: 658D 1342 B762 F484 2DDF 1E88 38A5 4346 D727 94E5

2 1

Re: Sieve Symlink Creation
by dovecot＠ptld.com 13 Sep '22

13 Sep '22

> On 09-12-2022 12:16 pm, hi(a)zakaria.website wrote: > > It seems that dovecot doesn't understand the relative format and requires absolute format, per the documentation example. Perhaps find the code which parses the absolute path, and compile your own dovecot build, which can understand the path format you want? I did not find that. I want to learn more, can you link me the dovecot documentation you found explaining how absolute paths are required for sieve? > On 2022-08-25 13:32, dovecot(a)ptld.com wrote: >> The first time when the sieve files and folders get created, the active symlink is created as a full absolute path >> >> .active_sieve -> /mnt/email/domain/user/_sieve/filters.sieve >> >> After that, if you disable and enable the rule set the symlink gets recreated as relative >> >> .active_sieve -> filters.sieve >> >> How can i have the symlink always created as a relative path even on first time creation? >> Having a full absolute path over a mounted NSF is fragile. >> >> Dovecot 2.3.16 >> Pigeonhole 2.3.16 >> >> mail_home = /mnt/email/%d/%n/_dovecot >> mail_location = maildir:/mnt/email/%d/%n/_folders:INDEX=/mnt/email/%d/%n/_dovecot:CONTROL=/mnt/email/%d/%n/_dovecot >> plugin { >> sieve = file:~/../_sieve;active=~/../_sieve/.active_sieve >> sieve_max_script_size = 1M >> sieve_max_actions = 32 >> sieve_max_redirects = 4 >> sieve_quota_max_scripts = 20 >> sieve_quota_max_storage = 5M >> sieve_vacation_min_period = 1d >> sieve_vacation_use_original_recipient = no >> sieve_vacation_dont_check_recipient = no >> sieve_vacation_send_from_recipient = no >> sieve_redirect_envelope_from = sender >> sieve_user_email = %u >> }

2 1

real duplicates of some e-mails / dovecot-2.3.19
by Götz Reinicke 13 Sep '22

13 Sep '22

Hi, we have the issue, that some(!) e-mails we receive are duplicated when processed by dovecot and stored to the users inbox. The mails are binary identical, same message ID, same size etc. diff sees no difference …. For now we only see that it happens do small mails max. +- 5k in size. And in dose not happen for all mails, but some are spam, some are internal mails some are newsletter which are expected…. and it happens for different users. Dose anyone have/had a similar issue? Any suggestion or idea would be helpful. Thanks . Götz

2 1

Handling imap from outlook 365
by Todd Krein 12 Sep '22

12 Sep '22

I apologize if this has been answered before, but... Microsoft Outlook 365 doesn't allow a user to specify the account name for an imap acout, only the email address. Thus fred(a)smith.com<mailto:fred@smith.com> tries to log in as "fred(a)smith.com<mailto:fred@smith.com>" rather than "fred". Has anyone seen a way to fix this (Microsoft help boards are silent), perhaps by stripping the "@smith.com" during the logon procedure? Thanks, Todd Todd Krein | VP Hardware o:650.566.6657 m:408.857.0556 [Ooma_email_sig_11_ooma.jpg] ooma.com<http://ooma.com> _______________________________________ Ooma Confidential and Proprietary (including attachments if any)

3 2

Outlook 365 (RE: dovecot Digest, Vol 233, Issue 20)
by Todd Krein 12 Sep '22

12 Sep '22

Emilio, Thanks for the suggestions, but neither of these worked for me. Manual setup on Outlook 365 (I think as opposed to Outlook 202x), doesn't let you set the account name directly. It's being "helpful." Interestingly enough, if you set up as POP3, it realizes the account name is wrong and lets you enter it once you try to sync. Not so with IMAP. I was able to create the new account on the control panel, but outlook365 ignores all those accounts. Cheers, Todd -----Original Message----- ---------------------------------------------------------------------- Message: 1 Date: Sun, 11 Sep 2022 01:53:21 -0400 From: Emilio Augusto Lazo Zaia <emiliolazozaia(a)gmail.com> To: dovecot(a)dovecot.org Subject: Re: Solved (RE: Handling imap from outlook 365) Message-ID: <5eb6d25f-f9a9-88c5-db01-9306d0925a9c(a)gmail.com> Content-Type: text/plain; charset="utf-8"; Format="flowed" Manual setup or go to Windows Control Panel, Mail / Outlook section and the new account dialog should be like earlier versions of Office... hth Emilio Augusto Lazo Zaia On 9/9/22 16:18, Todd Krein wrote: > > (Sorry for the format, not sure how to reply to a single email in a > digest) > > ?[HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\setup] > > "DisableOffice365SimplifiedAccountCreation"=dword:00000001 > > and then chosen manual setup?? That lets us specify 'fred' as the username. > > Ken > > ? > > Ken, > > ????????????? OMG, you are a godsend. Yes, that fixed it completely! > > ????????????? Where do I send the beer? > > ????????????? Best regards, > > ????????????? Todd > > *Todd Krein *| VP Hardware > > o:650.566.6657 ? m:408.857.0556 > > Ooma_email_sig_11_ooma.jpg > > ooma.com <http://ooma.com> > > _______________________________________ > > Ooma Confidential and Proprietary (including attachments if any) >

1 0

Solved (RE: Handling imap from outlook 365)
by Todd Krein 11 Sep '22

11 Sep '22

(Sorry for the format, not sure how to reply to a single email in a digest) "[HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\setup] "DisableOffice365SimplifiedAccountCreation"=dword:00000001 and then chosen manual setup? That lets us specify 'fred' as the username. Ken " Ken, OMG, you are a godsend. Yes, that fixed it completely! Where do I send the beer? Best regards, Todd Todd Krein | VP Hardware o:650.566.6657 m:408.857.0556 [Ooma_email_sig_11_ooma.jpg] ooma.com<http://ooma.com> _______________________________________ Ooma Confidential and Proprietary (including attachments if any)

2 1

Unclear how to get both user and domain quotas to work
by Hans van Zijst 10 Sep '22

10 Sep '22

Hi, First of all: my apologies for this long message. I'm trying to post all the information anybody could need to help me on my way. What I'm trying to make is an installation where both users and domains can have quotas. Ideally I would configure a quota for a domain and set a quota of 0 for all users within that domain, so that mail will be accepted up to the point where the domain quota is reached. Setting up user quota was fairly easy, there's lots of documentation around and examples to take inspiration from. Not so much for domain quota however, or I'm really bad at searching the Net. I'm running Debian Bullseye here: MariaDB 10.5.12 Dovecot 2.3.13 Postfixadmin 3.3.10 I want to use dictionaries in MySQL, because eventually this will be a platform with several Dovecot and Postfix servers. At this time I'm only running one Dovecot installation and a few Postfix servers (two for communication with the outside world and one to do the virus and spam scanning). My current setup for user quota is how Postfixadmin wants it: MariaDB [postfixadmin]> desc quota2; +----------+--------------+------+-----+---------+-------+ | Field | Type | Null | Key | Default | Extra | +----------+--------------+------+-----+---------+-------+ | username | varchar(100) | NO | PRI | NULL | | | bytes | bigint(20) | NO | | 0 | | | messages | int(11) | NO | | 0 | | +----------+--------------+------+-----+---------+-------+ 3 rows in set (0.001 sec) In /etc/dovecot/conf.d/90-quota.conf I have this: plugin { quota = dict:User quota::proxy::sqlquota quota_rule = *:bytes=1024M quota_rule2 = Trash:bytes=+100M quota_vsizes = yes quota_status_success = DUNNO quota_status_nouser = DUNNO quota_status_overquota = "552 5.2.2 Mailbox is full" } dict { sqlquota = mysql:/etc/dovecot/dovecot-dict-sql.conf.ext } The SQL-configuration /etc/dovecot/dovecot-dict-sql.conf.ext is this: connect = host=... dbname=... user=... password=... map { pattern = priv/quota/storage table = quota2 username_field = username value_field = bytes } map { pattern = priv/quota/messages table = quota2 username_field = username value_field = messages } map { pattern = shared/expire/$user/$mailbox table = expires value_field = expire_stamp fields { username = $user mailbox = $mailbox } } I use LMTP to accept mail from Postfix; the quota-plugin is activated for LMTP, so every incoming mail should be counted. This works like a charm: if I don't configure a quota for a user, he gets the default 1GB, if I override it in Postfixadmin, then that's what he gets. I'm running quota-status on a TCP-port, so the gateway SMTP-servers can connect to Dovecot for a quotacheck to decide whether to accept or reject an incoming message. Again, this works flawlessly. I can't find any serious documentation about this mapping thing. In particular, what's with that "pattern"? All I can find in the documentation is: "The dict key must match exactly priv/quota/storage. The dict keys are hardcoded in the Dovecot code, so depending on what functionality you’re configuring you need to know the available dict keys used it." -- https://doc.dovecot.org/configuration_manual/dict/#dict-sql If anyone can point me at better documentation than the actual source code: please! I browsed through the quota-plugin source code, but I'm not a programmer and couldn't find what I thought I was looking for. That said, I'm not sure where I got the third "map" from, with the shared/expire pattern. I seem to have forgotten to document that bit of my journey. Now, domain quotas... I've tried all kinds of stuff, but at the moment I'm stuck with something that seems to almost work. I added a second quota root: plugin { quota2 = dict:Domain quota:%d:proxy::sqldomainquota quota2_rule = *:bytes=1024M quota2_status_success = DUNNO quota2_status_nouser = DUNNO quota2_status_overquota = "552 5.2.2 Domain quota exceeded" quota2_vsizes = yes } dict { sqldomainquota = mysql:/etc/dovecot/dovecot-dict-sql.conf.ext } This dict refers to the same mapping as the one for user quotas, and I think that's the way it should be. Please correct me if I'm wrong. This creates a new user in the quota2 table, by the name of just the domain. Unfortunately, it simply fills it with the numbers from the first user it can find in that domain, not all users in that domain combined. What I think I should do, is change something in the dict so that it sums up all users in that domain, something like this: SELECT SUM(bytes) FROM quota2 WHERE username LIKE '%@domain'; Problem is that I can't find anything useful online with regards to this, I'm not even sure if I'm thinking in the right direction here. Any hints, suggestions or corrections? Or pointers to articles or documentation I might have missed? Kind regards, Hans

2 1

Re: Dead links at https://wiki.dovecot.org/Migration/MailFormat
by Joseph Tam 10 Sep '22

10 Sep '22

> These links: > > http://dag.wieers.com/rpm/packages/pine/pine-4.64-3.el4.rf.i386.rpm > http://staff.washington.edu/chappa/pine/info/maildir.html > > on this page > > https://wiki.dovecot.org/Migration/MailFormat > > at the Dovecot wiki do not lead to useful results. I lost the context of this thread, but if you're looking for mailutil or the older pine stuff, the project has forked inti alpine and you can find the source tarball at https://alpineapp.email/ Joseph Tam <jtam.home(a)gmail.com>

1 0

Old-stats plugin and fifo_listener permissions
by Grant Keller 10 Sep '22

10 Sep '22

Hello, Currently working on using the old-stats plugin in dovecot version 2.3.10.1. What file permissions are recommended for the old-stats-mail and old-stats-user sockets? I was seeing a lack of data from the doveadm oldstats dump command until I adjusted the default config to the following: service old-stats { fifo_listener old-stats-mail { group = mode = 0666 user = root } fifo_listener old-stats-user { group = mode = 0666 user = } } Not totally clear on which processes need read or write on those so any advice is appreciated.

1 0

Managesieve not working
by Francis Augusto Medeiros-Logeay 09 Sep '22

09 Sep '22

Hi, I am running dovecot 2.3.7.2 on ubuntu, and have a replication setup. I noticed that managesieve doesn't seem to be working. On my backup MX, doing a telnet to 4190 gets me the proper greetings, but doing the same on my main server just gave me the normal telnet "Escape character is..." I get the following info on the server: root@d0ba5bb19b6b:/# doveadm service status managesieve name: managesieve process_count: 0 process_avail: 0 process_limit: 1024 client_limit: 1 throttle_secs: 0 exit_failure_last: 0 exit_failures_in_sec: 0 last_drop_warning: 0 listen_pending: n listening: y doveadm_stop: n But when attempting to connect, it doesn't work. Any advice? Best, Francis

5 11

Dead links at https://wiki.dovecot.org/Migration/MailFormat
by kjohnson＠eclypse.org 09 Sep '22

09 Sep '22

Hi, These links: http://dag.wieers.com/rpm/packages/pine/pine-4.64-3.el4.rf.i386.rpm http://staff.washington.edu/chappa/pine/info/maildir.html on this page https://wiki.dovecot.org/Migration/MailFormat at the Dovecot wiki do not lead to useful results. The dag.wieers.com link seems to redirect to a server at packages.sw.be that does not exist (or does not answer today). Not archived at Wayback Machine as far as I can tell. The washington.edu link returns a 404. This page does appear to be archived by the Wayback Machine, but many of the captures reported by the Wayback Machine actually return no results. I have not checked every capture. I did find a capture from 4 Oct 2008 that does have content. This is the link to that capture. https://web.archive.org/web/20081004145454/http://staff.washington.edu/chap… Perhaps someone who attends to the Dovecot Wiki will find this information helpful in updating that page in a useful way. Regards, Ken

1 0

Re: Re: Unable to set quota-fs plugin [fixed]
by Jorge Concha C. 08 Sep '22

08 Sep '22

Hello, This solution don't work for me (in Rocky Linux 8 and 9). Do you know other solutions? Or maybe an additional step is necessary? Thanks > The issue was in the systemd service file. The option PrivateDevices was > setted. It prevents the service to have access to physical devices. I > removed this option and from there, quota is reported without errors. > > Thanks for your support > > Regards, > > - > Eric Grammatico _/) > Jorge Concha C. Area de Sistemas CEC - U. de Chile

2 2