- dovecot - dovecot.org

Mailing list is being Spam Filtered by O-365
by White, Daniel E. (GSFC-770.0)[AEGIS] 20 Apr '23

20 Apr '23

Is there any chance that SPF and DKIM records could be added to appear in the headers ? The gubba-mint folks are getting extremely medieval about email security.

2 1

Request - extra variable in passdb for logging
by Bogusław Juza 20 Apr '23

20 Apr '23

Hi Staff, I'm creating the dovecot configuration for multiple user passwords e-mail site. It's working well, but I've one problem - I can't log, which password was used. I'm using auth-sql, the query looks like: password_query = \ SELECT `users`.`email` AS `user`, \ `shadow`.`passwd` AS `password`, \ FROM `shadow` WHERE `shadow`.`email` = '%u' AND \ ( ('%r'='127.0.0.1' AND `shadow`.`webmail`<>0) OR \ ('%r'<>'127.0.0.1' AND `shadow`.`imap`<>0 AND \ `shadow`.`hash`='%{sha512;rounds=5000:password}') \ ) LIMIT 1 The hash from random generated application password works as the selector, which password should be checked. It works fine, but in the log I have got only the e-mail and both IP addresses. I need to log one more information - which password was used (`shadow`.`id` column). It would be a great feature to have one more extra variable, which I could set in this query and which goes directly to log and nowhere else. I have tried something like: password_query = \ SELECT CONCAT(`users`.`email`,'#',`shadow`.`id`) AS `user`, ... and then "repair it" in user_query: SELECT `email` AS `user` WHERE `email` = REGEXP_SUBSTR('%u','[^#]+') and it even works well, except postfix-auth, which received email with #number as the username and it was problematic. So I'm kindly asking for this extra variable in next versions of Dovecot ;) Bogusław Juza

2 1

last_login plugin and $remote_ip
by Fabrizio Cuseo 19 Apr '23

19 Apr '23

Good morning. I am planning a dovecot system with: - 3 x glusterfs servers (with 2 volumes, 1 ssd for short term mail, and 1 with bigger hdd for long term archive mail) - 1 x mysql server (another server with active replica will be added) - 3 x mbox servers (with dovecot pop/imap/lmpt/sieve/postfix) - 3 x dovecot proxy/directors for pop3/imap/smtp - 4 x proxmox mail gateway for antispam/antivirus in front of smtp servers - 1 x centralized syslog server All have private ip addresses, and in front there is a firewall with HA_proxy to make high availability and load balancing. My only problem now is using last_login plugin; i have configured on the mailbox servers on pop3/imap, but the ip address that is written on mysql is the proxy/director address, not the real client ip address. No results using real_remote_ip. Apr 19 09:14:31 mailbox-01 dovecot: pop3-login: Login: user=<username(a)domain.it>, method=PLAIN, rip=172.16.27.31, lip=172.16.27.21, mpid=19723, session=<42nHLKv5JsqsEBsf> Apr 19 09:14:31 mailproxy-01 dovecot: pop3-login: proxy(username@domain.it,172.16.27.21:110): Started proxying to 172.16.27.21 (1.978 secs): user=<username(a)domain.it>, method=PLAIN, rip=212.66.96.188, lip=172.16.27.31, session=<u4+wLKv5ZUjUQmC8> Apr 19 09:14:34 mailbox-01 dovecot: pop3(username(a)domain.it)<19723><42nHLKv5JsqsEBsf>: Disconnected: Logged out top=0/0, retr=0/0, del=0/37, size=115779706 Apr 19 09:14:34 mailproxy-01 dovecot: pop3-login: proxy(username@domain.it,172.16.27.21:110): Disconnected by server (0s idle, in=45, out=82): user=<username(a)domain.it>, method=PLAIN, rip=212.66.96.188, lip=172.16.27.31, session=<u4+wLKv5ZUjUQmC8> in db I have last_ip: 172.16.27.31, not 212.66.96.188 ------------- dovecot -n # 2.3.16 (7e2e900c1a): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.16 (09c29328) # OS: Linux 5.15.0-69-generic x86_64 Ubuntu 22.04.2 LTS # Hostname: mailbox-01 auth_default_realm = XXXXXXXX.it default_client_limit = 2500 dict { mysql = mysql:/etc/dovecot/dovecot-dict-sql.conf.ext sieve = mysql:/etc/dovecot/dict-sieve-sql.conf sql = mysql:/etc/dovecot/dovecot-dict-sql.conf.ext } disable_plaintext_auth = no doveadm_api_key = # hidden, use -P to show it first_valid_gid = 89 first_valid_uid = 89 imap_client_workarounds = tb-extra-mailbox-sep delay-newmail login_greeting = Welcome to mail server mail_fsync = always mail_gid = 89 mail_location = mbox:~/mail:INBOX=/var/mail/%u mail_plugins = quota mail_privileged_group = mail mail_uid = 89 mailbox_list_index_very_dirty_syncs = yes mdbox_rotate_size = 128 M mmap_disable = yes namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = separator = . } passdb { driver = pam } passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } plugin { last_login_dict = proxy::sql last_login_key = # hidden, use -P to show it last_login_precision = ms quota = count:User quota quota_clone_dict = proxy::mysql quota_grace = 50M quota_rule2 = Trash:storage=+100M quota_vsizes = yes quota_warning = storage=95%% quota-warning 95 %u quota_warning2 = storage=80%% quota-warning 80 %u sieve = dict:proxy::sieve;name=active sieve_extensions = +vacation-seconds sieve_vacation_default_period = 7d sieve_vacation_max_period = 30d sieve_vacation_min_period = 1h } pop3_client_workarounds = outlook-no-nuls oe-ns-eoh protocols = " imap lmtp pop3" service dict { unix_listener dict { group = mail2023 mode = 0660 user = mail2023 } } service doveadm { inet_listener { port = 2425 } inet_listener http { port = 8080 } unix_listener doveadm-server { user = mail2023 } } service imap { process_limit = 1024 } service lmtp { inet_listener lmtp { port = 24 } unix_listener /var/spool/postfix/private/dovecot-lmtp { group = mail2023 mode = 0666 user = mail2023 } } service pop3 { process_limit = 250 } service quota-warning { executable = script /usr/local/bin/quota-warning.sh unix_listener quota-warning { mode = 0666 user = mail2023 } user = mail2023 } service stats { unix_listener stats-reader { group = mail2023 mode = 0660 user = mail2023 } unix_listener stats-writer { group = mail2023 mode = 0660 user = mail2023 } } ssl_cert = </etc/dovecot/private/dovecot.pem ssl_client_ca_dir = /etc/ssl/certs ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { driver = passwd } userdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } protocol lmtp { mail_plugins = quota sieve quota quota_clone } protocol !indexer-worker { mail_vsize_bg_after_count = 100 } protocol lda { mail_plugins = quota sieve quota quota_clone } protocol imap { mail_max_userip_connections = 10 mail_plugins = quota quota imap_quota quota_clone last_login } protocol pop3 { mail_max_userip_connections = 2 mail_plugins = quota quota quota_clone last_login } in dovecot-dict-sql.conf.ext there is: map { pattern = shared/last-login/$service/$user/$remote_ip table = mail_last_login value_field = last_access value_type = uint fields { userid = $user service = $service last_ip = $remote_ip } } -- --- Fabrizio Cuseo - mailto:f.cuseo@panservice.it

2 2

Re: Mailing list update
by Peter Wienemann 19 Apr '23

19 Apr '23

Dear Aki, On 12.04.23 13:31, Aki Tuomi via dovecot wrote: > We finally managed to move from mailman2 to mailman3, and mail archives are now at https://dovecot.org/mailman3/archives and they can be now searched, too. thanks for this. > Please let us know if you have face any issues with the mailing list and we'll look into it. Is there a way to keep old links to archived messages (such as https://dovecot.org/pipermail/dovecot/<year>-<month>/<message-id>.html) intact? Best regards, Peter

3 3

Custom SASL authentication
by David Koski 19 Apr '23

19 Apr '23

Hello, I'm looking for a good way to apply a custom hash to passwords. My hope is to add passwords to a (MySQL) database: INSERT INTO users (user='joblo', pass=MYHASH('plain-password').. For SASL authentication, my thought first was to apply the same hash to the issued password and compare it with the hashed password in the database. I soon discovered the sql driver supplied by Dovecot doesn't provide that ability, unless I'm missing something. I'm looking for documentation on how to implement a custom authentication script if needed. Regards, David Koski dkoski(a)sutinen.com

4 6

imap Error: rename failed: Too many links
by Andrey Repin 18 Apr '23

18 Apr '23

Greetings, All! I'm facing a problem with one particular directory in a mailbox. The exact error line is: Apr 7 12:00:21 mxs dovecot: imap(vera): Error: rename(/home/vera/.mail/INBOX/Майя Николаевна/new/1678353168.M710968P25673.mxs.ads.ccenter.lan,S=5442,W=5513:2,ST, /home/vera/.mail/INBOX/Майя Николаевна/cur/1678353168.M710968P25673.mxs.ads.ccenter.lan,S=5442,W=5513:2,ST) failed: Too many links The rest of the mailbox behave correctly, as I can tell, but this specific subdir fails to report unread mail correctly. What are the options to fix it? # dovecot --version 2.2.22 (fe789d2) Config is in attachment, but I doubt it is of any interest. -- With best regards, Andrey Repin Friday, April 7, 2023 16:37:09 Sorry for my terrible english...

4 6

Maildir compression
by Jose David Bravo A 18 Apr '23

18 Apr '23

Hello, I would like to compress the maildir of some of our users, I'm thinking to use this script: [ https://github.com/George-NG/dovecot-maildir-compress/blob/master/dovecot-m… | https://github.com/George-NG/dovecot-maildir-compress/blob/master/dovecot-m… ] My question is, how dovecot will calculate the quota for that user after the compression? will dovecot calculate the quota of that user using the real size of the message file after compression, or the plain size before compression? Is it necessary to recreate the index of that maildir after the compression is made? If so, what command should I use? Thank you! Jose Bravo

2 1

Confusion re doveadm pw and protected private keys
by Paul Kroitor 18 Apr '23

18 Apr '23

Hello, It seems from this thread at letsencrypt : https://community.letsencrypt.org/t/changing-permissions-for-pem-files/19656 1 (see especially second post from _az) that doveadm pw now parses all files in the config, even ones not relevant to the pw aspect of the request. If it's not able to access all the files, it terminates prematurely with exit code 89. The result, at least for anyone using letsencrypt / certbot, is that doveadm pw fatally fails unless run as root, because the config includes the private key, which has permissions 600 root root. This makes the dovecot pw functionality unusable for web apps that want to calculate a password hash using it (e.g. RoundCube's password change feature). My understanding is that dovecot only really needs the private key for its main functionality, when it's running as root, and that there's no reason doveadm pw, which should (presumably) often be run as a regular user, needs access to it. Is this the intended behavior, or have I got something wrong? Thanks for all help, Paul

2 1

Shared / Public mailbox
by Stephane MAGNIER 15 Apr '23

15 Apr '23

Hi I wish to create a share mailbox ( well.. Apparently, this is a public mailbox). Let's say I have 2 users : user1 & user2 and the need to share a mailbox for "general inquiries" emails.. Despite of the 2 users' account creation ( user1 & user2) , should I create a third email account ( info1) for general inquiries for instance and instruct Dovecot that this mail box has to be shared ? In that case, logically, I have to declare into: "15-Mailboxes.conf" |namespace { type = public separator = / prefix = Public/ location = maildir:|||/var/spool2/mail|/info1/:CONTROL=/var/spool2/mail/Maildir/info1:INDEX=|||/var/spool2/mail|/info1 # Allow users to subscribe to the public folders. subscriptions = yes } | |and add a file : /etc/dovecot/dovecot-acl| || ||||/var/spool2/mail|/info1/| user=user1,user2 lrwstipekxa ||/var/spool2/mail|/info1|/* user=user1,user2 lrwstipekxa and add the plugin : plugin { acl = vfile }|| Is that the way to do it ? 2) Now what is the difference between a shared and Public mailbox ? I can see that the plugin is slightly different : |acl_shared_dict| <https://doc.dovecot.org/settings/plugin/acl-plugin/#plugin_setting-acl-acl_…> For me a "public"email folder is for sharing emails.. My understanding is: general email account can be shared ( like info1 in my example).. this is called a public mailbox.( specific email account, shared between users). So what is called a "Shared mailbox" ????? Thanks for your help ?

4 5

Mailing list update
by Aki Tuomi 13 Apr '23

13 Apr '23

Hi all! We finally managed to move from mailman2 to mailman3, and mail archives are now at https://dovecot.org/mailman3/archives and they can be now searched, too. Please let us know if you have face any issues with the mailing list and we'll look into it. Regards, Aki Tuomi Open-Xchange oy

4 9

Mailing list changes.
by dovecot＠ptld.com 13 Apr '23

13 Apr '23

I noticed starting today the Sender: header is no longer included on the mailing list. I used to use the Sender: header in sieve rules for sorting. Now the list emails only come From: rando email addresses. On the postfix mailing list it replaces the From: header with the list address instead of keeping the original email author. Is this the future intended behavior? Or can we get a Sender: or From: header to contain the list address for sorting?

3 3

Dovecot restoration.... problem
by Stephane Magnier 13 Apr '23

13 Apr '23

Hi, In the past, I've done a Dovecot Backup with a Rsync cmd... every day Today I need to get back these mailboxes.. and doesn't work out 1) first of all, I tried to make a simple copy... Now way . Couldn't access the INBOX Do you think that it could work that way ? I don't need to synchronized every minute. once a day is OK for me. 2) I did use the instruction doveadm --import -u user1 maildir:/home/user1/mail/ "" ALL It did start copying but apparently cannot got until the end... but noting visible onto Thunderbird... I didn't do any synchro between 2 dovecot servers. I just need to make a copy some times to times and rsync seemed to be a good option. But now, How can I get back online ??? Thanks

2 1

decrypt.rb
by Dave 11 Apr '23

11 Apr '23

Per the Dovecot site here: https://wiki.dovecot.org/Plugins/MailCrypt ... the "decrypt.rb" ruby script can be used to decrypt a Dovecot-encrypted message file from the command line. The script sort of runs successfully for me, in the sense that it doesn't error out, but it doesn't show the decrypted message. I've called it like so: decrypt.rb -k <PATH_TO_DOVECOT_KEYFILE> -f ./encrypted_message But when I do it just displays the info below and exits (I've subbed <DATA> tags for the actual data): ------------------[OUTPUT]----------------------- Key(s) (total: 1) - Key type : EC - Key digest: <DATA1> - Peer key : <DATA2> - Encrypted : <DATA3> - Kd hash : <DATA4> ------------------------------------------------------- I've tried specifying an output file as well, per the script's command line options, but the output file is 0 bytes. Does anyone have any suggestions? I *think* I'm using it the way it's intended to be used, but maybe I'm not?! -Dave

5 14

None
by None 11 Apr '23

11 Apr '23

... - maildir: change it to use '/' as hierarchy separator to allow '.' characters (for usernames in shared folders) ... Now changing the separator in the maildir-storage.c is trivial (even though it "can't" be changed :-), but fixing the resultant breakage in maildir-list.c needs a little more understanding. Timo, could you give me some pointers? I can see that I need to work out what imap_match_init() does. My motivation is to follow up on an earlier thread about reusing .mailboxlist files as .subscription files, preferably without rewriting them to replace the slashes with something else. Thanks -- Charlie

1 0

None
by None 11 Apr '23

11 Apr '23

checking IMAP connection. Based on that experimentation, it seems that when I try to verify certificate files with openssl, all checks out, but when I try to check thing through IMAPS, things go ugly (see log below). If I try same openssl s_client command on my web server, it gets everything correctly. As result from this one, I've even tried to use certificate from my web server with IMAP and even then openssl keeps on saying that there is bad record mac. Is this bug in dovecot's SSL handling or have I managed to mess something in my setup? URLS: CA cert: http://jylitalo.homeip.net/ca/ca.crt IMAPD cert: http://jylitalo.homeip.net/ca/imapd.crt [log starts] bash-2.05a$ openssl verify -CAfile /usr/local/www/data/ca/ca.crt /etc/ssl/certs/imapd.crt /etc/ssl/certs/imapd.crt: OK bash-2.05a$ openssl s_client -host localhost -port 993 -CAfile /usr/local/www/data/ca/ca.crt -verify -debug verify depth is 0 CONNECTED(00000003) depth=1 /C=FI/ST=Finland/L=Helsinki/O=Juha Ylitalo/CN=Juha Ylitalo/Email=jylitalo(a)iki.fi verify return:1 depth=0 /C=FI/ST=Finland/O=Juha Ylitalo/CN=coat.st-paul/Email=jylitalo(a)iki.fi verify return:1 47169:error:140943FC:SSL routines:SSL3_READ_BYTES:sslv3 alert bad record mac:/usr/src/secure/lib/libssl/../../../crypto/openssl/crypto/../ssl/s3_pkt.c:1046:SSL alert number 20 47169:error:140790E5:SSL routines:SSL23_WRITE:ssl handshake failure:/usr/src/secure/lib/libssl/../../../crypto/openssl/crypto/../ssl/s23_lib.c:226: bash-2.05a$ [log ends] -- Juha Ylitalo juha.o.ylitalo(a)nokia.com <work e-mail> +358 40 562 6152 http://linux.nokia.com/~jylitalo/ <work www>

1 0

None
by None 11 Apr '23

11 Apr '23

while (rename(src, dest) < 0 && count < 2) { if (errno != EEXIST) { rename can never return EEXIST in errno. maildir-save.c, line 124. /* move the file into new/ directory - syncing will pick it up from there */ if (rename(tmp_path, new_path) == 0) failed = FALSE; Here you can lose emails if the new/ folder contains a message whose base name is equal. The only way to avoid this is: 1) use link and unlink, not rename 2) leave messages that have a time_t part equal to or higher than time(NULL). Anyway, Maildir has a strict consistency criteria which says that all messages that are linked from tmp/ into new/ _must_ use time(NULL) plus a number that is guaranteed not to lapse within one second, and which does not collide with other messages in new/. new/ is the single entry point into cur/, and messages in new/ can not be "older" than the messages in cur/. The simple reasoning for this is that you can never guarantee that there is no message in cur/ that has the same base name, but perhaps different flags. It follows that when moving a message from new/ to cur/, it is required that the server only picks messages that are older than one second. Andy -- Andreas Aardal Hanssen http://www.andreas.hanssen.name/gpg

1 0

auth-worker fatal signal 11 core dump
by Anthony Carrico 07 Apr '23

07 Apr '23

I'm testing out dovecot/tls/openldap(via portunus). It seems to work fine. I can access Maildir with Thunderbird as expected. However according to the logs, auth-worker crashes when slapd closes: Apr 04 22:11:56 silver slapd[1745983]: conn=1054 op=1 UNBIND Apr 04 22:11:56 silver slapd[1745983]: conn=1054 fd=14 closed Apr 04 22:11:56 silver slapd[1745983]: conn=1053 op=2 UNBIND Apr 04 22:11:56 silver slapd[1745983]: conn=1053 fd=13 closed Apr 04 22:11:56 silver dovecot[2083465]: auth-worker: Fatal: master: service(auth-worker): child 2084984 killed with signal 11 (core dumped) Apr 04 22:11:56 silver dovecot[2083465]: auth: Fatal: master: service(auth): child 2084981 killed with signal 11 (core dumped) Here is the configuration. It is a minimal setup, just testing ldap for passdb: # 2.3.19.1 (9b53102964): /etc/dovecot/dovecot.conf # OS: Linux 6.1.7 x86_64 NixOS 22.11 (Raccoon) btrfs # Hostname: silver auth_mechanisms = plain login base_dir = /run/dovecot2 default_internal_group = dovecot2 default_internal_user = dovecot2 mail_location = maildir:/home/%n/Maildir:INBOX=/var/spool/mail/%n:INDEX=/var/lib/dovecot/indexes/%n:LAYOUT=Maildir++ passdb { args = /var/lib/dovecot/etc/dovecot-ldap.conf.ext driver = ldap } pop3_uidl_format = %08Xv%08Xu protocols = imap sendmail_path = /run/wrappers/bin/sendmail service auth { user = root } ssl_ca = </var/certs/.minica/cert.pem ssl_cert = </var/certs/silver/cert.pem ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { driver = passwd } Here is the ldap config: uris = ldaps://silver tls_ca_cert_file = "/var/certs/.minica/cert.pem" auth_bind = yes auth_bind_userdn = uid=%u,ou=users,dc=silver base = dc=silver Here is the stack trace: PID: 2084981 (auth) UID: 0 (root) GID: 0 (root) Signal: 11 (SEGV) Timestamp: Tue 2023-04-04 22:11:56 EDT (11h ago) Command Line: dovecot/auth Executable: /nix/store/s72dc8pc6g70dscya8ggsvn61rnfhixy-dovecot-2.3.19.1/libexec/dovecot/auth Control Group: /system.slice/dovecot2.service Unit: dovecot2.service Slice: system.slice Hostname: silver Storage: /var/lib/systemd/coredump/core.auth.0.9fed479ad6ac4f0e8c2d5f290d9ea3f5.2084981.1680660716000000.zst (present) Disk Size: 324.7K Message: Process 2084981 (auth) of user 0 dumped core. Module linux-vdso.so.1 with build-id 7aefd45ed44b5302cf82d7b5093cd9b882b8bc8a Module legacy.so with build-id fdd26faf7ff15c8fa78ef2091d38c5fb886da146 Module libscram.so.3 without build-id. Module libdb-5.3.so without build-id. Module libsasldb.so.3 without build-id. Module libplain.so.3 without build-id. Module libotp.so.3 without build-id. Module liblogin.so.3 without build-id. Module libgssapiv2.so.3 without build-id. Module libkeyutils.so.1 without build-id. Module libkrb5support.so.0 without build-id. Module libcom_err.so.3 without build-id. Module libk5crypto.so.3 without build-id. Module libkrb5.so.3 without build-id. Module libgssapi_krb5.so.2 without build-id. Module libgs2.so.3 without build-id. Module libdigestmd5.so.3 without build-id. Module libcrammd5.so.3 without build-id. Module libanonymous.so.3 without build-id. Module libresolv.so.2 with build-id 6bcddb1dd1be5b345df903815f364e5d967ae0ef Module libdl.so.2 with build-id 2e86539e324ffb14e185718fd284d3f3f2568f06 Module libm.so.6 with build-id 5cc630080219b350d8f9e4573c65d2dd931ea978 Module libz.so.1 without build-id. Module ld-linux-x86-64.so.2 with build-id 3be2bc3749163683f612e0fb8169ce51f75742fe Module libcrypto.so.3 with build-id ca321413716a256baa08042cb3f3c07a90cc82ce Module libssl.so.3 with build-id 4bf2aae91a0d91b0ca0a6fe1ab29b2b7653a17f6 Module libsasl2.so.3 without build-id. Module libaudit.so.1 without build-id. Module libc.so.6 with build-id 3d6884d200ead572b7b89a4133f645c7a3c039ed Module libpthread.so.0 with build-id 0f7050f6ef81222c7290351dfa67e5e062c797bf Module libsqlite3.so.0 with build-id 174a69054606e27a1c555838b07035346e83bfb0 Module libsodium.so.23 with build-id 1c1e5b232aa14bf5c942b3568bf70713da9ad11f Module liblber.so.2 without build-id. Module libldap.so.2 without build-id. Module libpam.so.0 without build-id. Module libcrypt.so.1 without build-id. Module libdovecot.so.0 without build-id. Module libstats_auth.so without build-id. Module auth without build-id. Stack trace of thread 2084981: #0 0x00007f824e28e824 pthread_rwlock_rdlock(a)GLIBC_2.2.5 (libc.so.6 + 0x8e824) #1 0x00007f824de312d9 CRYPTO_THREAD_read_lock (libcrypto.so.3 + 0x2312d9) #2 0x00007f824de1ea57 ossl_lib_ctx_get_data (libcrypto.so.3 + 0x21ea57) #3 0x00007f824de2d460 ossl_provider_deregister_child_cb (libcrypto.so.3 + 0x22d460) #4 0x00007f824de1e960 OSSL_LIB_CTX_free (libcrypto.so.3 + 0x21e960) #5 0x00007f824d8d4801 legacy_teardown (legacy.so + 0x7801) #6 0x00007f824de2ebfd ossl_provider_free (libcrypto.so.3 + 0x22ebfd) #7 0x00007f824ddf535b evp_cipher_free_int (libcrypto.so.3 + 0x1f535b) #8 0x00007f824e4cd46c SSL_CTX_free (libssl.so.3 + 0x3d46c) #9 0x00007f824e7852f5 ldap_int_tls_destroy (libldap.so.2 + 0x3d2f5) #10 0x00007f824e9ddbde _dl_fini (ld-linux-x86-64.so.2 + 0x5bde) #11 0x00007f824e2400c5 __run_exit_handlers (libc.so.6 + 0x400c5) #12 0x00007f824e24024e exit (libc.so.6 + 0x4024e) #13 0x00007f824e229255 __libc_start_call_main (libc.so.6 + 0x29255) #14 0x00007f824e229309 __libc_start_main@@GLIBC_2.34 (libc.so.6 + 0x29309) #15 0x000055b07d5c7675 _start (auth + 0x18675) ELF object binary architecture: AMD x86-64 As you can see, it seems to be crashing in the exit-handlers. Anyway, I thought I should report the crash I was observing. Thank you -- Anthony Carrico

2 4

Error: /proc/self/status is larger than expected
by Elisamuel Resto Donate 06 Apr '23

06 Apr '23

Hello, Writing to get some insight as to how I might rid myself of a the pesky error message on the subject. Every binary throws out that error, every LMTP delivery... basically every time any dovecot binary is executed. I am unsure if this is configuration related or not, but intuition says it is an issue with a kernel feature or compiler issue. I saw the error message in the source code (file ), but I don't understand enough of the dovecot architecture or what the code itself is doing in this case. Below and excerpt of a few lines of logs. Since I don't know what specifically this would relate to (and I don't quite remember the command to send the "safe" version of the configuration), I am sending this message in hopes that whatever is needed can be asked and I will provide it. Regards, -Sam [... postfix and rspamd output...] Mar 20 22:17:02 gaia postfix/qmgr[21403]: 4PgcGQ33LfzdT4h: from=<list(a)someml.tld>, size=12064, nrcpt=1 (queue active) Mar 20 22:17:02 gaia postfix/smtpd[18941]: disconnect from some.list.server[1.2.3.4] ehlo=2 starttls=1 mail=1 rcpt=1 data=1 quit=1 commands=7 Mar 20 22:17:02 gaia dovecot: lmtp(18954): Error: /proc/self/status is larger than expected Mar 20 22:17:02 gaia dovecot: lmtp(18954): Connect from local Mar 20 22:17:02 gaia dovecot: lmtp(sam(a)samresto.dev)<18954><vbRKLa4hGWQKSgAAw1YR2w>: Error: /proc/self/status is larger than expected Mar 20 22:17:02 gaia dovecot: message repeated 2 times: [ lmtp(sam(a)samresto.dev)<18954><vbRKLa4hGWQKSgAAw1YR2w>: Error: /proc/self/status is larger than expected] Mar 20 22:17:02 gaia dovecot: lmtp(sam(a)samresto.dev)<18954><vbRKLa4hGWQKSgAAw1YR2w>: sieve: msgid=<84cf4a75-db54-f33c-cea2-f4772cd182d8(a)samresto.dev>: fileinto action: stored mail into mailbox 'Lists/Folder' Mar 20 22:17:02 gaia dovecot: lmtp(sam(a)samresto.dev)<18954><vbRKLa4hGWQKSgAAw1YR2w>: Error: /proc/self/status is larger than expected Mar 20 22:17:02 gaia dovecot: indexer-worker(sam(a)samresto.dev)<18956><vbRKLa4hGWQKSgAAw1YR2w:RtkiMa4hGWQMSgAAw1YR2w>: Error: /proc/self/status is larger than expected Mar 20 22:17:02 gaia postfix/lmtp[18943]: 4PgcGQ33LfzdT4h: to=<sam(a)samresto.dev>, relay=wyvern.samresto.dev[private/dovecot-lmtp], delay=0.4, delays=0.31/0/0.01/0.07, dsn=2.0.0, status=sent (250 2.0.0 <sam(a)samresto.dev> vbRKLa4hGWQKSgAAw1YR2w Saved) Mar 20 22:17:02 gaia dovecot: lmtp(18954): Disconnect from local: Logged out (state=READY) Mar 20 22:17:02 gaia dovecot: lmtp(18954): Error: /proc/self/status is larger than expected Mar 20 22:17:02 gaia postfix/qmgr[21403]: 4PgcGQ33LfzdT4h: removed

6 11

Email not working
by Michael Hooker 05 Apr '23

05 Apr '23

Hi, First of all may I say I am not an expert on Dovecot so please forgive me if the answer to my query is obvious. After upgrading from Ubuntu 20.04 to 22.04 my email is not working. root@mail:~# doveconf -n # 2.3.16 (7e2e900c1a): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.16 (09c29328) # OS: Linux 5.15.0-60-generic x86_64 Ubuntu 22.04.1 LTS # Hostname: mail.odysseytours.nz auth_debug = yes auth_mechanisms = plain login auth_username_format = %{if;%d;eq;mail.odysseytours.nz;%Ln;%Lu} listen = *, :: mail_debug = yes mail_location = mbox:~/mail:INBOX=/var/mail/%u mail_privileged_group = mail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { driver = pam } plugin { sieve = file:~/sieve;active=~/.dovecot.sieve } protocols = " imap lmtp sieve pop3" service stats { unix_listener stats-reader { group = vmail mode = 0660 user = vmail } unix_listener stats-writer { group = vmail mode = 0660 user = vmail } } ssl_cert = </etc/dovecot/private/dovecot.pem ssl_cipher_list = EECDH+CHACHA20:EECDH+AESGCM:EDH+AESGCM:AES256+EECDH ssl_client_ca_dir = /etc/ssl/certs ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { args = blocking=no driver = passwd } root@mail:~# doveadm user -f 'username' '*' nobody mike systemd-coredump sogo vmail mlmmj iredadmin iredapd snapd-range-524288-root snap_daemon Error: auth-master: userdb list: User listing returned failure Fatal: user listing failed root@mail:~# doveadm index -A -q \* doveadm(nobody): Error: mkdir(/nonexistent/mail/.imap) failed: Permission denied (euid=65534(nobody) egid=65534(nogroup)) doveadm(systemd-coredump): Error: mkdir(//mail/.imap) failed: Permission denied (euid=999(systemd-coredump) egid=999(systemd-coredump) missing +w perm: /, dir owned by 0:0 mode=0755) doveadm(snapd-range-524288-root): Error: mkdir(/nonexistent/mail/.imap) failed: Permission denied (euid=524288(snapd-range-524288-root) egid=524288(snapd-range-524288-root)) doveadm(snap_daemon): Error: mkdir(/nonexistent/mail/.imap) failed: Permission denied (euid=584788(snap_daemon) egid=584788(snap_daemon)) doveadm(3015804): Error: auth-master: userdb list: User listing returned failure doveadm: Error: Failed to iterate through some use Contents of /etc/dovecot/conf.d/10-auth.conf with all comments removed: auth_username_format=%{if;%d;eq;mail.odysseytours.nz;%Ln;%Lu} #https://serverfault.com/questions/260488/dovecot-user-lookup-fails-when-using-usernamedomain-format auth_mechanisms = plain login !include auth-system.conf.ext Contents of /etc/dovecot/conf.d/auth-system.conf.ext with all comments removed: passdb { driver = pam } userdb { driver = passwd ##https://doc.dovecot.org/configuration_manual/authentication/passwd/#authentication-passwd args = blocking=no } It says "Authentication failure (Password mismatch?)" but its definitely the correct password. root@mail:/home/mike# doveadm log errors Feb 22 02:43:48 Error: auth: passwd(postmaster(a)odysseytours.nz): getpwnam() failed: Address Don't know what this error means. root@mail:/home/mike# doveadm log errors Feb 22 02:43:48 Error: auth: passwd(postmaster(a)odysseytours.nz): getpwnam() failed: Address family not supported by protocol Don't know what this error means. Any help would be greatly appreciated.

2 1

Wildcard delivery from Postfix to Dovecot LDA issues
by EML 01 Apr '23

01 Apr '23

[apologies for postfix/dovecot cross-post] How, exactly, do postfix and dovecot communicate when postfix attempts to determine whether to deliver a message to the dovecot LDA, or to bounce it? In other words, how does postfix decide to bounce foo, and deliver bar, in these log messages: postfix/pipe[11857]: 933BCA071A: to=<foo(a)example.com>, relay=dovecot, ... status=bounced (user unknown) postfix/pipe[12266]: 8AD51A071A: to=<bar(a)example.com>, relay=dovecot, ... status=sent (delivered via dovecot service) The reason I ask is that the obvious answer with the main.cf setup doesn't appear to be sufficient, and dovecot appears to check whether or not the recipient exists in the userdb passwd file before allowing delivery. I have postfix set up for virtual hosts, as follows: virtual_mailbox_domains = example.com, sub.example.com virtual_mailbox_maps = hash:/var/www1/vdomains virtual_transport = dovecot where vdomains contains: bar(a)sub.example.com example.com/test/ bar(a)example.com example.com/test/ @sub.example.com example.com/test/ @example.com example.com/test/ postfix will deliver to bar(a)example.com, but not foo(a)example.com. I can't deliver anything to the subdomain. The interesting thing is that 'bar' already has a dovecot mailbox (the 'test' mailbox), but 'foo' doesn't. If this is correct, how do I do wildcard deliveries to dovecot, particularly for the subdomain?

2 2

Dovecot error invalid service_fd
by Michel Verdier 30 Mar '23

30 Mar '23

Hi all On debian stable, dovecot 2.3.13+dfsg1-2+deb11u1 and postfix 3.5.17-0+deb11u1 I set postfix sending mails to dovecot for mailbox storage: mailbox_transport = lmtp:unix:private/dovecot-lmtp dovecot listen with lmtp: service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { mode = 0666 user = postfix group = postfix } } passdb { driver = pam args = session=yes cache_key=%u%r%l dovecot } userdb { driver = passwd } # ls -l /var/spool/postfix/private/dovecot-lmtp srw-rw-rw- 1 postfix postfix 0 27 mars 11:24 /var/spool/postfix/private/dovecot-lmtp I get logs like this: postfix/lmtp[271076]: 6DB551008B3C1: to=..., relay=...[private/dovecot-lmtp], delay=0.7, delays=0.29/0.04/0.11/0.26, dsn=2.0.0, status=sent (250 2.0.0 ... postfix/qmgr[197419]: 6DB551008B3C1: removed dovecot: lmtp(271077): Disconnect from local: Client has quit the connection (state=READY) dovecot: log(253615): Error: Received master input for invalid service_fd 27: 27 271079 BYE I identify 271079 as the pid for dovecot auth worker process. If I add a timeout in dovecot: service auth-worker { idle_kill = 10s } Then I see error log coming 10 seconds after the end of every lmtp connexion from postfix. There is no other log messages around even with debug enable in dovecot. And mails are correctly delivered. Am I missing something or is this to be ignored? Cheers

1 0

Dovecot submission proxy constraints
by Peter Wienemann 29 Mar '23

29 Mar '23

Dear Dovecot experts, in 2017 Stephan Bosch mentioned in an email about the Dovecot submission proxy [0]: "The current implementation does require that the proxy has direct access to the user's mailbox for BURL (e.g. by running it on the same host as imap), but that restriction should be resolved soon, allowing for more complex setups." Is the mentioned restriction (access to mailbox) still valid in 2023 or has this constraint been lifted in the meantime? Best regards, Peter [0] https://dovecot.org/pipermail/dovecot/2017-December/110282.html

1 0

How to use dovecot with more recent versions of solr (8x, 9x)?
by jkdv＠w3.org 27 Mar '23

27 Mar '23

Hello, dovecot version 2.3.13 (89f716dc2) The dovecot solr installation guide [1] gives links and configuration info for sorl 7.7.0. However, sorl was deprecated some time ago. Those links to 7.7.0 don't work anymore. Sorl is currently available in versions 8.11.2 and 9.1.1 [3]. Specifically, one section in the guide states [2]: [[ Install schema.xml and solrconfig.xml Copy doc/solr-config-7.7.0.xml and doc/solr-schema-7.7.0.xml (Since Dovecot 2.3.6+) to /var/solr/data/dovecot/conf/ as solrconfig.xml and schema.xml. The managed-schema file is generated based on schema.xml. ]] Could someone confirm me if those 7.7.0 configuration files are compatible with 8.11.2? A diff between those files and the ones from the 8.11.2 dist reveal some changes, starting from the LuceneVersion. If they are not compatible, could someone tell me what changes were done in the doc/solr files that need to be replicated in the 8.x and 9.x versions? The doc is very opaque there as it only states that you should replace those files but doesn't go into details as to why, making it confusing on how to upgrade to a new version of solr. It would be great if the dovecot/solr doc page could be upgraded to reflect the new versions of solr. Thanks in advance for your help, --jose [1] https://doc.dovecot.org/configuration_manual/fts/solr/ [2] https://doc.dovecot.org/configuration_manual/fts/solr/#solr-configuration [3] https://downloads.apache.org/lucene/solr/

2 1

doveadm expunge unnecessarily tries to access TLS key
by Jesper Dybdal 27 Mar '23

27 Mar '23

I have just upgraded my Debian Buster (Dovecot 2.3.4, I think it was) to Bullseye (Dovecot 2.3.13). The Dovecot server works fine, which of course is the really important thing. But I have a cron job that cleans up all old mail from the mailbox that I use for my mobile phone by running "doveadm expunge" every night. That worked fine in 2.3.4, but now it fails: > jdmobile@nuser:~$ doveadm expunge mailbox '*' before 25d > doveconf: Fatal: Error in configuration file > /etc/dovecot/conf.d/10-ssl.conf line 23: ssl_cert: Can't open file > /etc/letsencrypt/live/nuser.dybdal.dk/fullchain.pem: Permission denied Of course, doveadm cannot access the TLS key when running as a normal user. But why should it try to access that key at all when I have just asked it to clean up my own files in my own Maildir? Is there a way to make it not try to access that key and do its job anyway? Or another way to delete old mail? (I could give it a "-u jdmobile" option and run it as root - but I really like to run things like that as a non-privileged user, so I won't make a stupid mistake that destroys the wrong mailbox.) Thanks, Jesper -- Jesper Dybdal https://www.dybdal.dk

2 2

Dovecot LTO build failure
by Arjen de Korte 26 Mar '23

26 Mar '23

In openSUSE Tumbleweed (and several other distributions as well), packages are build by default with linktime optimization (LTO) enabled. This didn´t work for Dovecot, so until now LTO was disabled for Dovecot. There is a way to make it work though, see the following link: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=997513#20 So far a fix has not made it to upstream, the latest version 2.3.30 still fails to build without this patch. Is there any news to report regarding this?

2 1

Re: User authentication using local file
by Horst Simon 23 Mar '23

23 Mar '23

OS environment: Linux qnap-nas 5.10.60-qnap #1 SMP Thu Jan 12 04:39:10 CST 2023 x86_64 GNU/Linux I enabled "auth-passwdfile.conf.ext” in 10-auth.conf #!include auth-deny.conf.ext #!include auth-master.conf.ext #!include auth-system.conf.ext #!include auth-sql.conf.ext #!include auth-ldap.conf.ext !include auth-passwdfile.conf.ext #!include auth-checkpassword.conf.ext #!include auth-static.conf.ext In this file I have following entries and I don’t know what to enter for userdb passdb { driver = passwd-file args = /opt/local/etc/dovecot/users } userdb { driver = passwd-file #args = username_format=%u /opt/local/etc/dovecot/users # Default fields that can be overridden by passwd-file #default_fields = quota_rule=*:storage=1G # Override fields from passwd-file #override_fields = home=/home/virtual/%u } In the users file I have 2 users defined as follow: user1:{SSHA512}<encrypted password>:::::: user2:{SSHA512}<encrypted password:::::: Dovecot gives following error message on startup: Mar 23 08:50:30 master: Info: Dovecot v2.3.20 (80a5ac675d) starting up for imap, lmtp, sieve (core dumps disabled) Mar 23 08:50:30 auth: Debug: Loading modules from directory: /opt/local/lib/dovecot/auth Mar 23 08:50:30 auth: Debug: Module loaded: /opt/local/lib/dovecot/auth/lib20_auth_var_expand_crypt.so Mar 23 08:50:30 auth: Fatal: userdb passwd-file: Missing args I don’t know what arguments I have to enter for userdb Horst > On 22 Mar 2023, at 23:00, Narcis Garcia > > Please, specify OS environment, Dovecot version, and what options did > you try. > > > El 22/3/23 a les 4:52, Horst Simon ha escrit: >> I try to configure to have user authenticate to a local file called >> users, with their mailboxes in ../../spool/dovecot, not in their home >> directories. I have this working correctly with pam authentication on >> different servers(openSuse and macOS). This server has no pam >> authentication so I need to use a local file, but I can not make any >> sense of the documentation, can someone please help on which files I >> need to change and to which values. >> I tried several options but getting all kind of errors with UID. >> >> Horst >> > > -- > > Narcis Garcia > > __________ > I'm using this dedicated address because personal addresses aren't > masked enough at this mail public archive. Public archive administrator > should fix this against automated addresses collectors. > > > ------------------------------ > > Subject: Digest Footer > > _______________________________________________ > dovecot mailing list > dovecot(a)dovecot.org > https://dovecot.org/mailman/listinfo/dovecot > > > ------------------------------ > > End of dovecot Digest, Vol 239, Issue 36 > ****************************************

2 4

User authentication using local file
by Horst Simon 22 Mar '23

22 Mar '23

I try to configure to have user authenticate to a local file called users, with their mailboxes in ../../spool/dovecot, not in their home directories. I have this working correctly with pam authentication on different servers(openSuse and macOS). This server has no pam authentication so I need to use a local file, but I can not make any sense of the documentation, can someone please help on which files I need to change and to which values. I tried several options but getting all kind of errors with UID. Horst

2 1

Re: Error: Can't load SSL certificate
by Horst Simon 22 Mar '23

22 Mar '23

The others are on openSUSE 15.4 and macOS, all are binary installs Entware build options Build options: ioloop=epoll openssl io_block_size=8192 SQL drivers: mysql Passdb: checkpassword ldap passwd passwd-file shadow sql Userdb: checkpassword ldap passwd prefetch passwd-file sql macOS build options Build options: ioloop=kqueue notify=kqueue openssl io_block_size=8192 SQL drivers: mysql Passdb: checkpassword pam passwd passwd-file sql Userdb: checkpassword passwd prefetch passwd-file sql openSUSE build options Build options: ioloop=epoll notify=inotify openssl io_block_size=8192 SQL driver plugins: mysql postgresql sqlite Passdb: checkpassword ldap pam passwd passwd-file shadow sql Userdb: checkpassword ldap(plugin) passwd prefetch passwd-file sql The libz.so are for OpenSUSE and the QNap in the same directories withe the same permissions The macOS does not have a libz.so, this dovecot was build by macports. All servers are running dovecot with the same user accounts. At the moment I will look into this issue later and will try to authenticate without using SSL. On the MACs and openSUSE I authenticate using pam, the QNAP does not use pam so I want to authenticate using a local password file, but I have problems to set it up correctly I have changed it 10-auth.conf to use auth-passwdfile.conf.ext and created a password file called userdb. I don’t know what else to change and what exactly should be in the userdb file. The log only shows Mar 20 23:52:45 auth: Debug: auth client connected (pid=6966) Mar 20 23:52:45 imap-login: Info: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=192.168.117.5, lip=192.168.117.2, session=<AhJNZ1T3GcDAqHUF> I need to fix this first before I can enable SSL again. Maybe I should open a new threat Horst > > My suggests to look for: > > 1. Are your other servers setups installed from "Entware for QNAP" too? > 2. Do your other servers have libz.so* located under /opt/lib/ too? > 3. Did you compare owner and permissions of every libz.so* file between > servers too? > 4. Are other servers running Dovecot with same user account? > > > El 20/3/23 a les 4:01, Horst Simon ha escrit: >> I try to logon to map using dovecot with SSL required. I get following >> entries in the log:Mar 20 13:49:30 auth: Debug: Loading modules from >> directory: /opt/lib/dovecot/modules/auth >> Mar 20 13:49:30 auth: Debug: Module loaded: >> /opt/lib/dovecot/modules/auth/lib20_auth_var_expand_crypt.so >> Mar 20 13:49:30 auth: Debug: Read auth token secret from >> /opt/var/run/dovecot/auth-token-secret.dat >> Mar 20 13:49:30 auth: Debug: passwd-file /opt/etc/dovecot/userdb:Read 1 >> users in 0 secs >> Mar 20 13:49:30 auth: Debug: auth client connected (pid=26120) >> Mar 20 13:49:30 imap-login: Error: Failed to initialize SSL server >> context: Can't load SSL certificate (ssl_cert setting): >> error:12800067:DSO support routines::could not load the shared library: >> filename(libz.so): libz.so: cannot open shared object file: No such file >> or directory, error:12800067:DSO support routines::could not load the >> shared library: user=<>, rip=192.168.117.5, lip=192.168.117.2, >> session=<eX3e+Uv3k8DAqHUF> >> Mar 20 13:49:30 imap-login: Info: Disconnected: TLS initialization >> failed. (no auth attempts in 0 secs): user=<>, rip=192.168.117.5, >> lip=192.168.117.2, session=<eX3e+Uv3k8DAqHUF >> >> The library files exist in the include directory >> [/opt] # find . -name libz* -print >> >> ./lib/opkg/info/libzstd.control >> >> ./lib/opkg/info/libzstd.list >> >> ./lib/libz.so >> >> ./lib/libz.so.1 >> >> ./lib/libz.so.1.2.13 >> >> ./lib/libzstd.so >> >> ./lib/libzstd.so.1 >> >> ./lib/libzstd.so.1.5.2 >> >> ./lib/libz.a >> >> >> Have the dovecot settings the same on other servers and it works, >> Dovecot is v2.3.18, installed from Entware for QNAP. Any help?appreciated. >> >> Horst >> >> >> > > -- > > Narcis Garcia >

1 1

ot: how to t/s TBird problems ?
by Voytek Eymont 22 Mar '23

22 Mar '23

I have a Dovecot/Postfix/MariaDB on a Centos, just have a user ask me: ------------------ I recently upgraded my Thunderbird email client and have experienced problems since. It appears that when Tbird polls for new messages it gets held up waiting for a response from the server I'm using POP port 995. Any ideas as to why I'm having a problem ? ------------------- how to investigate such issue ? CentOS release 6.10 (Final) # dovecot --version 2.3.11.3 (502c39af9) load average on server 0.05/0.01 user log shows like: Oct 12 10:08:50 pop3-login: Info: Login: user=<user(a)tld.com.au>, method=PLAIN, rip=49.111.222.333, lip=103.xxx.yyy.zzz, mpid=17371, TLS, session=<E83xW8rqDPkxw3EW> Oct 12 10:09:34 pop3(user(a)tld.com.au)<17371><E83xW8rqDPkxw3EW>: Info: Disconnected: Logged out top=0/0, retr=0/0, del=0/114194, size=10616009472 Oct 12 10:14:36 imap-login: Info: Login: user=<user(a)tld.com.au>, method=PLAIN, rip=49.111.222.333, lip=103.xxx.yyy.zzz, mpid=17460, TLS, session=<ftiLcMrqR/gxw3EW> Oct 12 10:14:37 imap(user(a)tld.com.au)<17460><ftiLcMrqR/gxw3EW>: Info: Logged out in=152 out=69724 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=1 body_bytes=68628 Oct 12 10:28:27 pop3-login: Info: Login: user=<user(a)tld.com.au>, method=PLAIN, rip=49.111.222.333, lip=103.xxx.yyy.zzz, mpid=17714, TLS, session=<+WsXosrqK/gxw3EW> Oct 12 10:29:16 pop3(user(a)tld.com.au)<17714><+WsXosrqK/gxw3EW>: Info: Disconnected: Logged out top=0/0, retr=1/76174, del=0/114195, size=10616085600 Oct 12 10:32:19 imap-login: Info: Login: user=<user(a)tld.com.au>, method=PLAIN, rip=49.111.222.333, lip=103.xxx.yyy.zzz, mpid=17817, TLS, session=<bZftr8rqq/gxw3EW> Oct 12 10:32:20 imap(user(a)tld.com.au)<17817><bZftr8rqq/gxw3EW>: Info: Logged out in=153 out=135592 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=1 body_bytes=134503 Oct 12 10:45:58 imap-login: Info: Login: user=<user(a)tld.com.au>, method=PLAIN, rip=49.111.222.333, lip=103.xxx.yyy.zzz, mpid=18081, TLS, session=<U3674Mrqzfgxw3EW> Oct 12 10:45:59 imap(user(a)tld.com.au)<18081><U3674Mrqzfgxw3EW>: Info: Logged out in=152 out=24602 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=1 body_bytes=23514 Oct 12 10:48:49 pop3-login: Info: Login: user=<user(a)tld.com.au>, method=PLAIN, rip=49.111.222.333, lip=103.xxx.yyy.zzz, mpid=18135, TLS, session=<y1/r6srqtPsxw3EW> Oct 12 10:49:53 pop3(user(a)tld.com.au)<18135><y1/r6srqtPsxw3EW>: Info: Disconnected: Logged out top=0/0, retr=2/166190, del=0/114197, size=10616251743 Oct 12 10:50:42 imap(user(a)tld.com.au)<3274><cr10yqTqifgxw3EW>: Info: Logged out in=192516 out=5957294 deleted=0 expunged=0 trashed=0 hdr_count=263 hdr_bytes=358656 body_count=126 body_bytes=5110403 Oct 12 10:50:42 imap(user(a)tld.com.au)<3271><hLl0yqTqh/gxw3EW>: Info: Logged out in=78324 out=58677 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0 Voytek

4 3

iPhone Mail clients generate high Solr I/O
by Alessio Cecchi 22 Mar '23

22 Mar '23

Hi, I'm running a mail server with Dovecot 2.3.20 and Apache Solr as FTS backend. It seems that iPhone/iPad Mail clients are generating some IMAP searches, especially on header Message-ID, that are increasing our Solr I/O load, especially during the night. Are these kind of queries normal? What are they? You can find some logs below. Dovecot logs: Mar 13 21:06:14 dovecot: imap-login: Login: user=<user@domain>, method=PLAIN, rip=x.x.x.x, lip=z.z.z.z, mpid=11263, secured, session=<PQSppM32gePCBJGh> Mar 13 21:06:14 dovecot: imap(user@domain) session=<PQSppM32gePCBJGh>: ID sent: name=iPhone Mail, version=20D67, os=iOS, os-version=16.3.1 (20D67) Mar 13 21:06:14 dovecot: imap(user@domain) session=<PQSppM32gePCBJGh>: Disconnected: Logged out in=207 out=1128 deleted=0 expunged=0 autoexpunged=0 trashed=0 appended=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0 Solr logs: 2023-03-13 21:06:14.411 INFO (qtp1671846437-1652) [ x:dovecot] o.a.s.c.S.Request [dovecot] webapp=/solr path=/select params={q={!lucene+q.op%3DAND}hdr:<DB8P189MB08692AE65580C36C3B7D6F53C1F59(a)domain6.tld>+OR+hdr:<\!\%26\!AAAAAAAAAAAYAAAAAAAAAI\/Oo\%2BConZZMkCvmEY7yWqjCgAAAEAAAAP968Yud4n1LmhwJxWgTURQBAAAAAA%3D%3D(a)domain5.tld>+OR+hdr:<CALEb\-gfyeQ1zJhjGKS3V8Rn3gk3byNa9co9nOU1L2BtUtKO0aw(a)domain7.tld>+OR+hdr:<AS4P195MB1790AA65F5F367F3CF0888BEDEA19(a)domain5.tld>+OR+hdr:<24E36A6E5BB2410C8090482B3E1EB40F(a)domain8.tld>&fl=uid,score&sort=uid+asc&fq=%2Bbox:d0f433254ee1b161c82c00002e1056c4+%2Buser:user@domain&rows=88&wt=xml} hits=0 status=0 QTime=275 2023-03-13 21:06:14.511 INFO (qtp1671846437-1628) [ x:dovecot] o.a.s.c.S.Request [dovecot] webapp=/solr path=/select params={q={!lucene+q.op%3DAND}hdr:<af03d59c\-2cd5\-1165\-aea5\-6ce7cfe16a89(a)domain.tld>+OR+hdr:<CAJbcrLvxCOGy6fcKBuhuu9B1SALwm9opS\-\-O\-kcMd3nevKrf1A(a)domain7.tld>+OR+hdr:<00eb01d8c8dc$caa8a580$5ff9f080$(a)domain1.tld>+OR+hdr:<VE1PR08MB4846DD525845DC743D47ED52EEBA9(a)domain7.tld>+OR+hdr:<00c701d8bb83$f307bc70$d9173550$(a)domain1.tld>&fl=uid,score&sort=uid+asc&fq=%2Bbox:d0f433254ee1b161c82c00002e1056c4+%2Buser:user@domain&rows=88&wt=xml} hits=0 status=0 QTime=59 2023-03-13 21:06:14.714 INFO (qtp1671846437-1652) [ x:dovecot] o.a.s.c.S.Request [dovecot] webapp=/solr path=/select params={q={!lucene+q.op%3DAND}hdr:<AS4P195MB179002723893D3932AF83A4CDEA29(a)domain5.tld>+OR+hdr:<F3112D85FDF144319FB0ABE348A75AE5(a)domain8.tld>+OR+hdr:<AM9PR10MB510032098A44B16182C9AAF39C4D9(a)domain8.tld>+OR+hdr:<\!\%26\!AAAAAAAAAAAYAAAAAAAAAI\/Oo\%2BConZZMkCvmEY7yWqjCgAAAEAAAADl2MLfkWRxJjQW\%2B3dOhZn0BAAAAAA%3D%3D(a)domain5.tld>+OR+hdr:<CAJbcrLtAEjLO0wbK5AAp8a3p0iRaoUeKA1wsD2ppDFeMnhL\-kA(a)domain7.tld>&fl=uid,score&sort=uid+asc&fq=%2Bbox:d0f433254ee1b161c82c00002e1056c4+%2Buser:user@domain&rows=88&wt=xml} hits=0 status=0 QTime=178 2023-03-13 21:06:14.771 INFO (qtp1671846437-1628) [ x:dovecot] o.a.s.c.S.Request [dovecot] webapp=/solr path=/select params={q={!lucene+q.op%3DAND}hdr:<DU0P189MB208990AA60E3EB5CB2F9BE98DCD39@domain>+OR+hdr:<DDA00A9A19CE4864AD87EF31B0E2113F(a)domain8.tld>+OR+hdr:<GV1PR01MB882049EDFF560AF4F4444F4BB1EE9(a)domain7.tld>&fl=uid,score&sort=uid+asc&fq=%2Bbox:d0f433254ee1b161c82c00002e1056c4+%2Buser:user@domain&rows=88&wt=xml} hits=0 status=0 QTime=34 2023-03-13 21:06:14.899 INFO (qtp1671846437-1652) [ x:dovecot] o.a.s.c.S.Request [dovecot] webapp=/solr path=/select params={q={!lucene+q.op%3DAND}hdr:<AS4P195MB1790922D3154E37AEF263FD1DEDF9(a)domain5.tld>+OR+hdr:<02E5E16DF27945B6A764F49A5D9E055E(a)domain8.tld>+OR+hdr:<CAEK\-5TdF_f%3Dn\%2BL1VWj3EVP9i%3DQe\%2BWaYcW%3DFNy8GSLfE5O1U7dw(a)domain7.tld>+OR+hdr:<4edb1720076ab71575067b0fc2b5d96c(a)domain2.tld>+OR+hdr:<1657012847.68884591(a)domain6.tld>&fl=uid,score&sort=uid+asc&fq=%2Bbox:4830f5144ee1b161c82c00002e1056c4+%2Buser:user@domain&rows=1&wt=xml} hits=0 status=0 QTime=46 Thanks -- Alessio Cecchi Postmaster @http://www.qboxmail.it https://www.linkedin.com/in/alessice

2 1

Import collection of files containing one raw message each into dovecot
by Markus Schönhaber 21 Mar '23

21 Mar '23

Hi, given a bunch of files, each containing the raw source of a single email message. There's no structural or naming scheme like Maildir or something. Is there a (easy) way to import those mails into dovecot? AIUI doveadm import needs a source location in a supported mailbox format - which doesn't seem applicable here. -- Regards mks

2 2

"doveadm altmove -r" not working ?
by Benoit Branciard 21 Mar '23

21 Mar '23

Hello, I have some trouble using "doveadm altmove -r". Regular "doveadm altmove" is OK, selected mails were moved to alternate storage as expected. But I can't manage to get them back to original location, "doveadm altmove -r" has no effect. We are using Dovecot 2.3.4 (Debian Buster package). mail_location = mdbox:~/mdbox:DIRNAME=_@@_dbox-Mails_@@_:ALT=/slow%h/mdbox doveadm altmove -u myuser since 90d -> some message files are created under /slow/my/homedir/mdbox/storage doveadm altmove -r -u myuser all -> message files are still sitting under /slow/my/homedir/mdbox/storage, none were created into /my/homedir/mdbox/storage. Is there some known issues with doveadm altmove in this version ? Or am I missing something ? I can share more config details if needed. -- Benoit BRANCIARD Université Paris 1 Panthéon-Sorbonne - DSIUN-SIS B405 - Centre PMF - 90 rue de Tolbiac - 75013 Paris Tel. 01 44 07 89 68 http://dsiun.univ-paris1.fr

4 5

Read-only / archive mode for IMAP mailboxes?
by Rᴇɴᴇ́ Pꜰᴇɪꜰꜰᴇʀ 20 Mar '23

20 Mar '23

Hello! We are currently exploring email archiving solutions. Is there a way to use an IMAP mailbox in read-only / archive mode? The requirement is that delibveries of new emails should be possible (via SMTP/LMTP), but no messages should be deleted via IMAP access. Frankly I don't think this works, but maybe some of you have tried this already. Regards, René. -- )\._.,--....,'``. fL Let GNU/Linux work for you while you take a nap. /, _.. \ _\ (`._ ,. R. Pfeiffer <lynx at luchs.at> + https://web.luchs.at/ `._.-(,_..'--(,_..'`-.;.' - System administration + Consulting + Teaching - 📨 Got mail delivery problems? https://web.luchs.at/information/blockedmail.php 📯 Complete contact information: https://web.luchs.at/kontakt/ 🔏 Download latest GPG/PGP keys: https://web.luchs.at/kontakt/gpg.asc ⛔ W͇A͇R͇N͇I͇N͇G͇:͇ ͇D͇O͇ ͇_͇N͇O͇T͇_͇ ͇S͇E͇N͇D͇ ͇E͇M͇A͇I͇L͇S͇ ͇W͇I͇T͇H͇ ͇H͇T͇M͇L͇ ͇C͇O͇N͇T͇E͇N͇T͇ ͇T͇O͇ ͇M͇Y͇ ͇E͇M͇A͇I͇L͇ ͇A͇D͇D͇R͇E͇S͇S͇!͇ ⛔

3 3

Remote backup of IMAP user fails with dsync_remote epoll_ctl error
by dml＠plumeriahale.net 20 Mar '23

20 Mar '23

I’m trying backup a user’s IMAP folders from a system running dovecot 2.1.7. to a system running dovecot 2.3.19.1. After much perusing of the web and Dovecot documentation I tried this: 1) On the 2.1.7 host set up the doveadm server to listen on TCP port 2425 and defined a doveadm_password value 2) Issued the following command on the 2.13.19.1 system: doveadm -o doveadm_password=<password> backup -R -u <username> -S <host>:2425 tcp:<host> 3) The command returned the following errors: Error: doveadm server disconnected before handshake: EOF Error: Command backup failed for <username>: EOF 4) In the Dovecot log on the 2.1.7 system I found the following error message: dsync(<username>): Error: user <username>: Initialization failed: Namespace '': Unknown mail storage driver tcp dovecot: dsync(<username>): Fatal: User init failed A couple of questions: 1) I thought that setting up doveadm-server as an inet_listener (with a password) meant that all communications (including the backup) occurred over that link - is that not correct? Or does SSH also need to be enabled as well? 2) Am I specifying the arguments correctly? The definition of the destination argument is confusing in the documentation - if doveadm is trying to backup a user’s IMAP mailboxes from a remote source, and you’ve already specified the information needed to connect to the remote sources doveadm-server why would the source need to be specified again via the TCP: argument?

1 0

Disable folder creation for details username
by Robert Blayzor 20 Mar '23

20 Mar '23

This may be more of a CPanel issue than Dovecot but CPanel uses Dovecot and not sure if this is a knob we have available in Dovecot or we need to reach out to Cpanel directly to see if this is some custom code they added to their distros. Anyway, W/R/T emails sent with dtails/ + addresses ie: foo+bar(a)mydomain.com And with LDA/LMTP, in Cpanel by default the detials part, in this case "bar" will be created in it's own folder. Automatically. To us, this can be an attack vector/DOS from a malicious actor so we want to turn it off. We understand there is: lda_mailbox_autocreate Which we have yes, as we do want to create mailboxes automatically when the first message comes in, but not these folders. I don't know if this folder autocreation on detail part is a Dovecot thing, or specific to Cpanel. It appears CPanel has a patch/code to option to turn it off, but it's only on a per mailbox basis. We want to turn this behavior off globally. As far as I know, CPanel doesn't release whatever patches they made to make this happen, asking here if anyone has experience with this before we start chasing them for answers. -- inoc.net!rblayzor XMPP: rblayzor.AT.inoc.net PGP: https://pgp.inoc.net/rblayzor/

2 2

Dovecot unified event filtering
by Felix Auringer 20 Mar '23

20 Mar '23

Hello, I have an issue with debug logging when using a custom plugin for Dovecot. In my plugin, I create a child event of the session's user event: ```c struct event *plugin_event = event_create(list->ns->user->event); event_set_name(plugin_event, "oidc_shared_mailboxes_plugin"); event_set_min_log_level(plugin_event, LOG_TYPE_WARNING); event_set_append_log_prefix(plugin_event, "oidc-shared-mailboxes-plugin: "); ``` I then use passthrough events like the following: ``` e_debug(event_create_passthrough(data->event)->event(), "Modified mailbox_list_iter_init was called."); e_warning(event_create_passthrough(event)->event(), "Did not find required key 'roles' in the JWT body."); ``` `e_warning` and `e_error` work fine. If I understand the documentation for the unified event filtering (https://doc.dovecot.org/configuration_manual/event_filter/#unified-filter-l…) correctly, I should be able to enable debug logging for with `log_debug = event="oidc_shared_mailboxes_plugin"`. However, this setting has no influence on the logging behavior. The setting I have to set for the debug logging to work is `mail_debug = yes` (I do not have to set `log_debug` at all). Is this intended behavior or am I doing something wrong? Best regards, Felix Auringer Here is the output of `dovecot -n` (I removed the passdb, userdb, namespace, service, and managesieve settings as they cluttered the output): ``` # 2.3.19 (b3ad6004dc): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.19 (4eae2f79) # OS: Linux 5.10.0-15-amd64 x86_64 Debian 11.6 # Hostname: c3dd5b346d22 auth_mechanisms = plain login xoauth2 oauthbearer debug_log_path = /dev/stdout disable_plaintext_auth = no first_valid_uid = 1000 info_log_path = /dev/stdout last_valid_uid = 1000 log_debug = event="oidc_shared_mailboxes_plugin" log_path = /dev/stdout login_greeting = Hello there! .... GIZ Mail! mail_location = maildir:~/mail mail_plugins = " oidc_shared_mailboxes" plugin { oidc_shared_mailboxes_client_id = dovecot-test } protocols = imap lmtp ``` --- Gesellschaft für interkulturelles Zusammenleben gGmbH (GIZ) Felix Auringer IT Reformationsplatz 2 13597 Berlin Tel: 030/513 0100 00; Fax: 030/513 0100 09 www.giz.berlin; felix.auringer(a)giz.berlin Amtsgericht Charlottenburg HRB 200872 B Geschäftsführerin: Dr. Britta Marschke

2 1

Error: Can't load SSL certificate
by Horst Simon 20 Mar '23

20 Mar '23

I try to logon to map using dovecot with SSL required. I get following entries in the log:Mar 20 13:49:30 auth: Debug: Loading modules from directory: /opt/lib/dovecot/modules/auth Mar 20 13:49:30 auth: Debug: Module loaded: /opt/lib/dovecot/modules/auth/lib20_auth_var_expand_crypt.so Mar 20 13:49:30 auth: Debug: Read auth token secret from /opt/var/run/dovecot/auth-token-secret.dat Mar 20 13:49:30 auth: Debug: passwd-file /opt/etc/dovecot/userdb:Read 1 users in 0 secs Mar 20 13:49:30 auth: Debug: auth client connected (pid=26120) Mar 20 13:49:30 imap-login: Error: Failed to initialize SSL server context: Can't load SSL certificate (ssl_cert setting): error:12800067:DSO support routines::could not load the shared library: filename(libz.so): libz.so: cannot open shared object file: No such file or directory, error:12800067:DSO support routines::could not load the shared library: user=<>, rip=192.168.117.5, lip=192.168.117.2, session=<eX3e+Uv3k8DAqHUF> Mar 20 13:49:30 imap-login: Info: Disconnected: TLS initialization failed. (no auth attempts in 0 secs): user=<>, rip=192.168.117.5, lip=192.168.117.2, session=<eX3e+Uv3k8DAqHUF The library files exist in the include directory [/opt] # find . -name libz* -print ./lib/opkg/info/libzstd.control ./lib/opkg/info/libzstd.list ./lib/libz.so ./lib/libz.so.1 ./lib/libz.so.1.2.13 ./lib/libzstd.so ./lib/libzstd.so.1 ./lib/libzstd.so.1.5.2 ./lib/libz.a Have the dovecot settings the same on other servers and it works, Dovecot is v2.3.18, installed from Entware for QNAP. Any help appreciated. Horst

2 1

Can't seem to setup remote access to doveadmI'm using
by dml＠plumeriahale.net 18 Mar '23

18 Mar '23

I’m running version 2.1.7 under Raspbian Wheezy (and have been for a number of years). I want to allow one of my other computers to remotely issue doveadm commands to my server but can’t seem to find the right way to add an inet listener to permit this. Using ‘doveconf -a’ I’ve found the default service definition for doveadm-server. So I copied that and added it to the dovecot configuration with an inet listener section added to it. But that was rejected as a duplicate service definition when I restarted dovecot. I then tried specifying a “host:port” value for the doveadm_socket_path value but that didn’t work as no listening socket at that port appeared when I restarted dovecot. I can’t seem to find in any of the dovecot documentation a way to do this and there seems to be nothing like a “Here’s how to setup doveadm remote access” section in the documentation (which would be most helpful). How can I get doveadm-server to listen not only locally (as it’s already doing) but also open an inet port for remote access?

3 2

Re: [EXT] Re: Corrupted sizes using zlib plugin
by Tim Evers 16 Mar '23

16 Mar '23

Am 06.03.23 um 16:45 schrieb Aki Tuomi: >> On 06/03/2023 16:52 EET Tim Evers <te-ml-ext(a)artfiles.de> wrote: >> >> >> Am 06.03.23 um 15:29 schrieb Aki Tuomi: >>>> On 06/03/2023 15:56 EET Tim Evers <te-ml-ext(a)artfiles.de> wrote: >>>> >>>> >>>> Am 06.03.23 um 14:49 schrieb Aki Tuomi: >>>>>> On 06/03/2023 15:45 EET Tim Evers <te-ml-ext(a)artfiles.de> wrote: >>>>>> >>>>>> >>>>>> Am 06.03.23 um 14:00 schrieb Aki Tuomi: >>>>>>>> On 06/03/2023 13:06 EET Tim Evers <te-ml-ext(a)artfiles.de> wrote: >>>>>>>> >>>>>>>> >>>>>>>> Am 06.03.23 um 11:59 schrieb Aki Tuomi: >>>>>>>> >>>>>>>>>> On 06/03/2023 12:44 EET Tim Evers <te-ml-ext(a)artfiles.de> wrote: >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> Am 06.03.23 um 11:42 schrieb Aki Tuomi: >>>>>>>>>> >>>>>>>>>>>> On 06/03/2023 12:32 EET Tim Evers <te-ml-ext(a)artfiles.de> wrote: >>>>>>>>>>>> >>>>>>>>>>>> >>>>>>>>>>>> Hi, >>>>>>>>>>>> >>>>>>>>>>>> since I did not get any feedback on my bug report post regarding >>>>>>>>>>>> corrupted sizes while using zlib >>>>>>>>>>>> (https://dovecot.org/pipermail/dovecot/2023-February/126105.html) I >>>>>>>>>>>> would like to confirm that this bug report reached someone in charge. >>>>>>>>>>>> >>>>>>>>>>>> Or if not - I would kindly ask for directions on how to post it in a way >>>>>>>>>>>> that spawns some action. >>>>>>>>>>>> >>>>>>>>>>>> Thx >>>>>>>>>>>> >>>>>>>>>>>> Tim >>>>>>>>>>> Can you try erasing dovecot.index.cache and see if the problem fixes itself? It's possible your cache contains invalid values from old errors. >>>>>>>>>>> >>>>>>>>>>> Aki >>>>>>>>>> Did that already several times (other dovecot.index.* files too). The >>>>>>>>>> only thing that helps is actually deleting the dovecot-uidlist file but >>>>>>>>>> the problem returns. >>>>>>>>>> >>>>>>>>>> Tim >>>>>>>>> I think it's because the value on the filename is wrong. The filename contains the virtual and physical size. >>>>>>>>> >>>>>>>>> Can you try if https://github.com/dovecot/tools/blob/main/maildir-size-fix.pl fixes your issue? >>>>>>>>> >>>>>>>>> Aki >>>>>>>> Quoting >>>>>>>> >>>>>>>> https://doc.dovecot.org/configuration_manual/zlib_plugin/ : >>>>>>>> >>>>>>>> "All mails must have ,|S=<size>|in their filename where <size> contains >>>>>>>> the original uncompressed mail size, otherwise there will be problems >>>>>>>> with quota calculation as well as other potential random failures." >>>>>>>> >>>>>>>> And the script you send: >>>>>>>> >>>>>>>> "# Check if the files are compressed. Use the uncompressed size for S=size." >>>>>>>> >>>>>>>> Which it does in my example. S= contains the uncompressed size, not the >>>>>>>> size on disk. Is this not correct? All Files are written exclusively by >>>>>>>> dovecot, no other software is involved. >>>>>>>> >>>>>>>> Tim >>>>>>> Can you send output from `doveconf -n`? I am having suspicion that zlib plugin isn't always involved in your config, which causes the compressed file to be cached wrongly. Especially it feels like your IMAP protocol does not have compression on while LMTP does. >>>>>>> >>>>>>> Aki >>>>>> Actually it is the other way round (I removed zlib from lmtp to reduce >>>>>> the impact of the problem): >>>>>> >>>>>> # 2.3.20 (80a5ac675d): /etc/dovecot/dovecot.conf >>>>>> # Pigeonhole version 0.5.20 (149edcf2) >>>>>> # OS: Linux 4.15.0-204-generic x86_64 Ubuntu 18.04.6 LTS >>>>>> # Hostname: node2.mst27.artfiles.de >>>>>> auth_verbose = yes >>>>>> auth_worker_max_count = 1000 >>>>>> default_client_limit = 5000 >>>>>> dict { >>>>>> sqlquota = mysql:/etc/dovecot/dovecot-dict-sql.conf.ext >>>>>> } >>>>>> disable_plaintext_auth = no >>>>>> import_environment = TZ CLUSTERNAME >>>>>> lda_mailbox_autocreate = yes >>>>>> lda_mailbox_autosubscribe = yes >>>>>> mail_location = maildir:~/Maildir >>>>>> mail_plugins = " mail_log notify old_stats" >>>>>> mailbox_idle_check_interval = 10 mins >>>>>> maildir_broken_filename_sizes = yes >>>>>> managesieve_notify_capability = mailto >>>>>> managesieve_sieve_capability = fileinto reject envelope >>>>>> encoded-character vacation subaddress comparator-i;ascii-numeric >>>>>> relational regex imap4flags copy include variables body enotify >>>>>> environment mailbox date index ihave duplicate mime foreverypart >>>>>> extracttext editheader imapsieve vnd.dovecot.imapsieve >>>>>> namespace inbox { >>>>>> inbox = yes >>>>>> location = >>>>>> mailbox Drafts { >>>>>> auto = subscribe >>>>>> special_use = \Drafts >>>>>> } >>>>>> mailbox Junk { >>>>>> auto = subscribe >>>>>> special_use = \Junk >>>>>> } >>>>>> mailbox Sent { >>>>>> auto = subscribe >>>>>> special_use = \Sent >>>>>> } >>>>>> mailbox "Sent Messages" { >>>>>> special_use = \Sent >>>>>> } >>>>>> mailbox Trash { >>>>>> auto = subscribe >>>>>> special_use = \Trash >>>>>> } >>>>>> prefix = INBOX. >>>>>> separator = . >>>>>> } >>>>>> passdb { >>>>>> args = /etc/dovecot/dovecot-sql.conf.ext >>>>>> driver = sql >>>>>> } >>>>>> plugin { >>>>>> imapsieve_mailbox1_before = file:~/af_report-spam.sieve >>>>>> imapsieve_mailbox1_causes = COPY >>>>>> imapsieve_mailbox1_name = INBOX.Junk >>>>>> imapsieve_mailbox2_before = file:~/af_report-ham.sieve >>>>>> imapsieve_mailbox2_causes = COPY >>>>>> imapsieve_mailbox2_from = INBOX.Junk >>>>>> imapsieve_mailbox2_name = * >>>>>> quota = dict:User quota::proxy::sqlquota >>>>>> quota_rule = *:storage=0:messages=0 >>>>>> sieve = file:~/sieve;active=~/.dovecot.sieve >>>>>> sieve_before = file:~/af_master.sieve >>>>>> sieve_before2 = file:~/af_konto.sieve >>>>>> sieve_before3 = file:~/af_domain.sieve >>>>>> sieve_before4 = file:~/af_spamfilter.sieve >>>>>> sieve_extensions = +editheader >>>>>> sieve_filter_bin_dir = /usr/local/bin/sieve >>>>>> sieve_global_extensions = +vnd.dovecot.pipe +vnd.dovecot.filter >>>>>> +vnd.dovecot.environment >>>>>> sieve_max_redirects = 100 >>>>>> sieve_pipe_bin_dir = /usr/local/bin/sieve >>>>>> sieve_plugins = sieve_imapsieve sieve_extprograms >>>>>> stats_refresh = 30 secs >>>>>> zlib_save = gz >>>>>> zlib_save_level = 6 >>>>>> } >>>>>> pop3_no_flag_updates = yes >>>>>> protocols = " imap lmtp sieve pop3" >>>>>> service anvil { >>>>>> client_limit = 6203 >>>>>> } >>>>>> service auth-worker { >>>>>> process_limit = 1000 >>>>>> } >>>>>> service auth { >>>>>> client_limit = 6300 >>>>>> } >>>>>> service dict { >>>>>> process_limit = 500 >>>>>> unix_listener dict { >>>>>> group = vmail >>>>>> mode = 0600 >>>>>> user = vmail >>>>>> } >>>>>> } >>>>>> service imap-login { >>>>>> process_limit = 4000 >>>>>> process_min_avail = 0 >>>>>> service_count = 0 >>>>>> vsz_limit = 512 M >>>>>> } >>>>>> service imap { >>>>>> client_limit = 1 >>>>>> process_limit = 4000 >>>>>> vsz_limit = 1 G >>>>>> } >>>>>> service lmtp { >>>>>> inet_listener lmtp { >>>>>> address = 127.0.0.1 >>>>>> port = 10024 >>>>>> } >>>>>> process_limit = 80 >>>>>> process_min_avail = 20 >>>>>> vsz_limit = 2 G >>>>>> } >>>>>> service pop3-login { >>>>>> process_limit = 2000 >>>>>> service_count = 0 >>>>>> vsz_limit = 512 M >>>>>> } >>>>>> service pop3 { >>>>>> client_limit = 1 >>>>>> process_limit = 2000 >>>>>> vsz_limit = 1 G >>>>>> } >>>>>> service stats { >>>>>> fifo_listener stats-mail { >>>>>> mode = 0600 >>>>>> user = vmail >>>>>> } >>>>>> } >>>>>> ssl_cert = </etc/dovecot/private/dovecot.pem >>>>>> ssl_client_ca_dir = /etc/ssl/certs >>>>>> ssl_key = # hidden, use -P to show it >>>>>> submission_host = smtp4.artfiles.de >>>>>> syslog_facility = local5 >>>>>> userdb { >>>>>> args = /etc/dovecot/dovecot-sql.conf.ext >>>>>> driver = sql >>>>>> } >>>>>> protocol lmtp { >>>>>> mail_plugins = " mail_log notify old_stats sieve quota" >>>>>> } >>>>>> protocol imap { >>>>>> mail_max_userip_connections = 50 >>>>>> mail_plugins = " mail_log notify old_stats quota imap_quota >>>>>> imap_sieve zlib imap_old_stats" >>>>>> rawlog_dir = /var/log/rawlog/%u >>>>>> } >>>>>> protocol pop3 { >>>>>> mail_max_userip_connections = 50 >>>>>> mail_plugins = " mail_log notify old_stats zlib" >>>>>> } >>>>> It will probably compound on the issue though, especially when rebuilding caches and indexes, as it will record the sizes wrong. I'm not sure if this is *really* the issue, but it's most likely culprit. The 8192 is very odd number to have there, which either indicates that the zlib plugin is not consistently used, or you have some issues with the gz library itself. >>>>> >>>>> Aki >>>> Not sure if I understand this - shouldn't dovecot always note the >>>> decompressed size in cache and filename regardless if it's compressed or >>>> not? >>>> >>>> I just removed the zlib plugin from lmtp to reduce the footprint of the >>>> problem. The problem itself showed up first while lmtp zlib was on. >>>> >>>> Tim >>> It is complaining about the **physical** size though, that is, the amount stored on disk. If you have a dovecot process which is unaware of compression, it can record the wrong size for the file. >>> >>> Aki >> OK, I see. Another thing I noticed: The uidlist entry for a suspicious >> number of these problematic files contains what looks like a GUID: >> >> G1674674677.M641373P33277.node2 >> >> If I remove the uidlist and let dovecot recreate it, it is usually gone. >> Might that be an indicator of some other process writing to the uidlist >> file? the GUID is not mentioned in the dovecot docs as far as I can see. >> >> Tim > It sure sounds like that. > > Aki OK, for future reference: I think I found the issue. There was a periodic doveadm quotacheck job that was unaware of the zlib compression. I fixed that and no new corruption occured (though I still see errors from already corrupted cache data - that will hopefully dry up over time). However: I have still no idea why dovecot is complaining about the index.* files. It seems that the source of the wrong data is the dovecot-uidlist. Also I don't see why the quotacheck cmd (doveadm quota recalc -u <>) **sometimes** updates the dovecot-uidlist file. The quota itself is stored in a sql dict. Thanks to all who provided their input and especially Aki for the support! Tim

1 0

Postfix : root and system user authentication
by Aymeric Agon-Rambosson 16 Mar '23

16 Mar '23

Hello everyone, >From what I understand of the documentation, it is impossible to log in to the dovecot server as root, or as any user not in the interval between first_valid_uid and last_valid_uid. I have been able to verify this. However, when we have a postfix server on the same machine, that delegates authentication to dovecot SASL according to the configuration described at https://doc.dovecot.org/configuration_manual/howto/postfix_and_dovecot_sasl/, we can indeed log in as root on the postfix server. Proof (/var/log/mail.log with auth=debug) : Mar 13 20:16:37 ricorambo dovecot: auth: Debug: client in: AUTH#0111#011PLAIN#011service=smtp#011nologin#011lip=<redacted>#011rip=<redacted>#011secured#011resp=<hidden> Mar 13 20:16:37 ricorambo dovecot: auth: Debug: pam(root,<redacted>): Performing passdb lookup Mar 13 20:16:37 ricorambo dovecot: auth-worker(136499): Debug: Loading modules from directory: /usr/lib/dovecot/modules/auth Mar 13 20:16:37 ricorambo dovecot: auth-worker(136499): Debug: Module loaded: /usr/lib/dovecot/modules/auth/lib20_auth_var_expand_crypt.so Mar 13 20:16:37 ricorambo dovecot: auth-worker(136499): Debug: conn unix:auth-worker (pid=136444,uid=111): Server accepted connection (fd=13) Mar 13 20:16:37 ricorambo dovecot: auth-worker(136499): Debug: conn unix:auth-worker (pid=136444,uid=111): Sending version handshake Mar 13 20:16:37 ricorambo dovecot: auth-worker(136499): Debug: conn unix:auth-worker (pid=136444,uid=111): auth-worker<1>: Handling PASSV request Mar 13 20:16:37 ricorambo dovecot: auth-worker(136499): Debug: conn unix:auth-worker (pid=136444,uid=111): auth-worker<1>: pam(root,<redacted>): Performing passdb lookup Mar 13 20:16:37 ricorambo dovecot: auth-worker(136499): Debug: conn unix:auth-worker (pid=136444,uid=111): auth-worker<1>: pam(root,<redacted>): lookup service=dovecot Mar 13 20:16:37 ricorambo dovecot: auth-worker(136499): Debug: conn unix:auth-worker (pid=136444,uid=111): auth-worker<1>: pam(root,<redacted>): #1/1 style=1 msg=Password: Mar 13 20:16:37 ricorambo dovecot: auth-worker(136499): Debug: conn unix:auth-worker (pid=136444,uid=111): auth-worker<1>: pam(root,<redacted>): Finished passdb lookup Mar 13 20:16:37 ricorambo dovecot: auth-worker(136499): Debug: conn unix:auth-worker (pid=136444,uid=111): auth-worker<1>: Finished Mar 13 20:16:37 ricorambo dovecot: auth: Debug: pam(root,<redacted>): Finished passdb lookup Mar 13 20:16:37 ricorambo dovecot: auth: Debug: auth(root,<redacted>): Auth request finished Mar 13 20:16:37 ricorambo dovecot: auth: Debug: client passdb out: OK#0111#011user=root#011 At this moment, the smtps client connecting to postfix produces "Authentication successful" and we can continue. In contrast, when we try to login to dovecot directly as root, we have the following : Mar 13 20:28:38 ricorambo dovecot: auth: Debug: client in: AUTH#0111#011PLAIN#011service=imap#011secured=tls#011session=<redacted>#011lip=<redacted>#011rip=<redacted>#011lport=993#011rport=52004#011local_name=mail.ricorambo.su#011resp=<hidden> Mar 13 20:28:38 ricorambo dovecot: auth: Debug: pam(root,<redacted>,<redacted>): Performing passdb lookup Mar 13 20:28:38 ricorambo dovecot: auth-worker(137089): Debug: Loading modules from directory: /usr/lib/dovecot/modules/auth Mar 13 20:28:38 ricorambo dovecot: auth-worker(137089): Debug: Module loaded: /usr/lib/dovecot/modules/auth/lib20_auth_var_expand_crypt.so Mar 13 20:28:38 ricorambo dovecot: auth-worker(137089): Debug: conn unix:auth-worker (pid=137079,uid=111): Server accepted connection (fd=13) Mar 13 20:28:38 ricorambo dovecot: auth-worker(137089): Debug: conn unix:auth-worker (pid=137079,uid=111): Sending version handshake Mar 13 20:28:38 ricorambo dovecot: auth-worker(137089): Debug: conn unix:auth-worker (pid=137079,uid=111): auth-worker<1>: Handling PASSV request Mar 13 20:28:38 ricorambo dovecot: auth-worker(137089): Debug: conn unix:auth-worker (pid=137079,uid=111): auth-worker<1>: pam(root,<redacted>,<redacted>): Performing passdb lookup Mar 13 20:28:38 ricorambo dovecot: auth-worker(137089): Debug: conn unix:auth-worker (pid=137079,uid=111): auth-worker<1>: pam(root,<redacted>,<redacted>): lookup service=dovecot Mar 13 20:28:38 ricorambo dovecot: auth-worker(137089): Debug: conn unix:auth-worker (pid=137079,uid=111): auth-worker<1>: pam(root,<redacted>,<redacted>): #1/1 style=1 msg=Password: Mar 13 20:28:38 ricorambo dovecot: auth-worker(137089): Debug: conn unix:auth-worker (pid=137079,uid=111): auth-worker<1>: pam(root,<redacted>,<redacted>): Finished passdb lookup Mar 13 20:28:38 ricorambo dovecot: auth-worker(137089): Debug: conn unix:auth-worker (pid=137079,uid=111): auth-worker<1>: Finished Mar 13 20:28:38 ricorambo dovecot: auth: Debug: pam(root,<redacted>,<eU8pHs32JMuE40wF>): Finished passdb lookup Mar 13 20:28:38 ricorambo dovecot: auth: Debug: auth(root,<redacted>,<eU8pHs32JMuE40wF>): Auth request finished Mar 13 20:28:38 ricorambo dovecot: auth: Debug: client passdb out: OK#0111#011user=root#011#011original_user=root(a)ricorambo.su Mar 13 20:28:38 ricorambo dovecot: auth: Debug: master in: REQUEST#<redacted> Mar 13 20:28:38 ricorambo dovecot: auth: Debug: passwd(root,<redacted>,<redacted>): Performing userdb lookup Mar 13 20:28:38 ricorambo dovecot: auth-worker(137089): Debug: conn unix:auth-worker (pid=137079,uid=111): auth-worker<2>: Handling USER request Mar 13 20:28:38 ricorambo dovecot: auth-worker(137089): Debug: conn unix:auth-worker (pid=137079,uid=111): auth-worker<2>: passwd(root,<redacted>,<redacted>): Performing userdb lookup Mar 13 20:28:38 ricorambo dovecot: auth-worker(137089): Debug: conn unix:auth-worker (pid=137079,uid=111): auth-worker<2>: passwd(root,<redacted>,<redacted>): lookup Mar 13 20:28:38 ricorambo dovecot: auth-worker(137089): Debug: conn unix:auth-worker (pid=137079,uid=111): auth-worker<2>: passwd(root,<redacted>,<redacted>): Finished userdb lookup Mar 13 20:28:38 ricorambo dovecot: auth-worker(137089): Debug: conn unix:auth-worker (pid=137079,uid=111): auth-worker<2>: Finished Mar 13 20:28:38 ricorambo dovecot: auth: Debug: passwd(root,<redacted>,<redacted>): Finished userdb lookup Mar 13 20:28:38 ricorambo dovecot: auth: Debug: master userdb out: USER#<redacted> Mar 13 20:28:38 ricorambo dovecot: imap-login: Login: user=<root>, method=PLAIN, rip=<redacted>, lip=192.168.1.22, mpid=137090, TLS, session=<redacted> Mar 13 20:28:38 ricorambo dovecot: imap(root): Error: Invalid settings in userdb: userdb returned 0 as uid Mar 13 20:28:38 ricorambo dovecot: imap(root): Warning: Event 0xaaab0e9db2a0 leaked (parent=0xaaab0e9cdc80): mail-storage-service.c:1336 Mar 13 20:28:38 ricorambo dovecot: imap(root): Warning: Event 0xaaab0e9cdc80 leaked (parent=(nil)): main.c:246 At this moment, the imap client produces "Internal server error" and finishes. Steps to reproduce : - Delegate SASL authentication from postfix to dovecot as such : /etc/postfix/master.cf smtps inet n - y - - smtpd -o syslog_name=postfix/smtps -o smtpd_tls_wrappermode=yes -o smtpd_sasl_auth_enable=yes -o smtpd_relay_restrictions=permit_sasl_authenticated,reject -o smtpd_recipient_restrictions=permit_sasl_authenticated,reject -o smtpd_sasl_type=dovecot -o smtpd_sasl_path=private/auth and of course : /etc/dovecot/conf.d/10-master.conf unix_listener /var/spool/postfix/private/auth { mode = 0660 user = postfix group = postfix } - login to your server, port 465, with a client like openssl : openssl s_client -connect mail.example.org:465 EHLO whateveryouwant AUTH PLAIN \0root\0password (in base 64, ofc) You should be able to login, and produce the first log trace I have included. My question is, is this a feature or a bug ? The hardcoded impossibility to login as root to dovecot, and the honouring of the variables {first,last}_valid_{u,g}id, are those specific to login to dovecot directly, or should they be applicable to any other process that has delegated its authentication to dovecot ? If this is a feature, that is if postfix cannot profit from the variables {first,last}_valid_{u,g}id (or the hardcoded forbidding of root) through dovecot sasl : - This should maybe made more obvious somewhere in the documentation. - What would be the good way to prevent root login to postfix, when authentication is delegated to dovecot ? The dovecot version is 2.3.13 (89f716dc2) The system is the following : Linux 5.10.0-21-arm64 #1 SMP Debian 5.10.162-1 (2023-01-21) aarch64 GNU/Linux Thank you in advance for your time. I have included the output of dovecot -n for reference. Best regards, Aymeric

6 10

Build dovecot from source
by Horst Simon 16 Mar '23

16 Mar '23

I am sorry if this is not the correct list for asking this. T try to build dovecot 2.3.20 from source on a QNAP NAS, which is a linux variant. There is an dovecot available, but this does not include a pigeonhole sieve, that’s why I try to build it from source. The configure script works fine, but the make fails as follows: *** Warning: Linking the executable test-http-payload against the loadable module *** libssl_iostream_openssl.so is not portable! libtool: link: gcc -std=gnu99 -g -O2 -fstack-protector-strong -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=2 -mfunction-return=keep -mindirect-branch=keep -Wall -W -Wmissing-prototypes -Wmissing-declarations -Wpointer-arith -Wchar-subscripts -Wformat=2 -Wbad-function-cast -fno-builtin-strftime -Wstrict-aliasing=2 -Wl,--as-needed -o .libs/test-http-payload test-http-payload.o -Wl,--export-dynamic -L/share/CACHEDEV1_DATA/.qpkg/Entware/lib -L/share/CACHEDEV1_DATA/.qpkg/Apache81/lib ./.libs/libhttp.a ../lib-dns/.libs/libdns.a ../lib-ssl-iostream/.libs/libssl_iostream.a ../lib-master/.libs/libmaster.a ../lib-auth/.libs/libauth.a ../lib-settings/.libs/libsettings.a ../lib-test/.libs/libtest.a ../lib/.libs/liblib.a -ldl ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so -Wl,-rpath -Wl,/opt/lib/dovecot /opt/bin/ld: ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so: undefined reference to `ENGINE_set_default@OPENSSL_1_1_0' /opt/bin/ld: ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so: undefined reference to `ENGINE_init@OPENSSL_1_1_0' /opt/bin/ld: ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so: undefined reference to `ENGINE_load_builtin_engines@OPENSSL_1_1_0' /opt/bin/ld: ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so: undefined reference to `ENGINE_free@OPENSSL_1_1_0' /opt/bin/ld: ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so: undefined reference to `ENGINE_finish@OPENSSL_1_1_0' /opt/bin/ld: ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so: undefined reference to `ENGINE_by_id@OPENSSL_1_1_0' collect2: error: ld returned 1 exit status make[3]: *** [Makefile:892: test-http-payload] Error 1 make[3]: Leaving directory '/share/CACHEDEV1_DATA/temp/dovecot-2.3.20/src/lib-http' make[2]: *** [Makefile:573: all-recursive] Error 1 make[2]: Leaving directory '/share/CACHEDEV1_DATA/temp/dovecot-2.3.20/src' make[1]: *** [Makefile:702: all-recursive] Error 1 make[1]: Leaving directory '/share/CACHEDEV1_DATA/temp/dovecot-2.3.20' make: *** [Makefile:546: all] Error 2 I already asked in the GitHub forum, but haven’t received any answers, that why I m asking here if anyone can help me to get it working. Horst

1 0

Bug with lmtp_save_to_detail_mailbox
by Dejan 15 Mar '23

15 Mar '23

> lmtp_save_to_detail_mailbox = yes Plus-delivery conflicts with existing, reserved files such as "subscriptions": Message for kim+subscriptions@ results in: lmtp(kim(a)***.com)<14493><SK7sEvaHEWSdOAAAvAYmHA>: Error: ....stat(/var/mails/***/kim/Maildir/subscriptions/tmp) failed: Not a directory Version: 2.3.18

2 4

dovecot crash with Panic: file istream-header-filter.c: line 663
by Patrick Mansfield 13 Mar '23

13 Mar '23

Hi - I'm hitting a crash in dovecot, I get this logged followed by a terse stack trace and systemd-coredump details not included here - full gdb stack trace and more details are further down: Mar 12 10:32:26 goffin dovecot[8269]: imap-login: Login: user=<patman>, method=PLAIN, rip=192.168.1.4, lip=192.168.1.1, mpid=8477, TLS, session=<5RvGYLf2RrDAqAEE> Mar 12 10:32:26 goffin audit[8304]: USER_AUTH pid=8304 uid=0 auid=4294967295 ses=4294967295 subj=kernel msg='op=PAM:authentication grantors=pam_usertype,pam_localuser,pam_unix acct="patman" exe="/usr/libexec/dovecot/auth" hostname=192.168.1.4 addr=192.168.1.4 terminal=dovecot res=success' Mar 12 10:32:26 goffin audit[8304]: USER_ACCT pid=8304 uid=0 auid=4294967295 ses=4294967295 subj=kernel msg='op=PAM:accounting grantors=pam_unix,pam_localuser acct="patman" exe="/usr/libexec/dovecot/auth" hostname=192.168.1.4 addr=192.168.1.4 terminal=dovecot res=success' Mar 12 10:32:26 goffin dovecot[8269]: imap-login: Login: user=<patman>, method=PLAIN, rip=192.168.1.4, lip=192.168.1.1, mpid=8479, TLS, session=<PnHKYLf2SrDAqAEE> Mar 12 10:32:27 goffin dovecot[8269]: imap(patman)<8452><r+ynYLf2PrDAqAEE>: Panic: file istream-header-filter.c: line 663 (i_stream_header_filter_snapshot_free): assertion failed: (snapshot->mstream->snapshot_pending) Mar 12 10:32:27 goffin audit[8452]: ANOM_ABEND auid=4294967295 uid=1000 gid=1000 ses=4294967295 subj=kernel pid=8452 comm="imap" exe="/usr/libexec/dovecot/imap" sig=6 res=1 email client is fairemail version 1.2042a on android, but an older version had the same problem. I mainly use fairemail to read emails on my phone, and that is working fine but I noticed that deleted emails were not actually getting deleted, that it has a bunch of "pending operations" it has were not running, and that dovecot has been crashing like this since about feb 2 (over a month ago). I can't figure out what changed at that time, but my cert says it should have expired over a year ago, but the cert as created 26 months ago. log files only go back to Feb 5 so just missed that. I generated a new cert but it's still crashing (I probably still need to do something on the client side or my setup is broken). I assume there is something wrong or some "snapshot" thing that's stuck, but since it's crashing I can't figure out what the undelysing problem is. Thanks for any help. More details: -------------------------------------------------------------------------------- # dovecot --version 2.3.20 (80a5ac675d) Running with up to date fedora core 37. -------------------------------------------------------------------------------- # dovecot -n # 2.3.20 (80a5ac675d): /etc/dovecot/dovecot.conf # OS: Linux 6.1.15-200.fc37.x86_64 x86_64 Fedora release 37 (Thirty Seven) # Hostname: specu mail_location = mbox:~/Mail:INBOX=~/Mail/inbox mbox_write_locks = fcntl namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { driver = pam } ssl = required ssl_cert = </etc/pki/dovecot/certs/dovecot.pem ssl_cipher_list = PROFILE=SYSTEM ssl_key = # hidden, use -P to show it userdb { driver = passwd } -------------------------------------------------------------------------------- gdb backtrace via coredumpctl debug PID: Core was generated by `dovecot/imap'. Program terminated with signal SIGABRT, Aborted. --Type <RET> for more, q to quit, c to continue without paging-- #0 __pthread_kill_implementation (threadid=<optimized out>, signo=signo@entry=6, no_tid=no_tid@entry=0) at pthread_kill.c:44 44 return INTERNAL_SYSCALL_ERROR_P (ret) ? INTERNAL_SYSCALL_ERRNO (ret) : 0; (gdb) bt #0 __pthread_kill_implementation (threadid=<optimized out>, signo=signo@entry=6, no_tid=no_tid@entry=0) at pthread_kill.c:44 #1 0x00007fa3840afec3 in __pthread_kill_internal (signo=6, threadid=<optimized out>) at pthread_kill.c:78 #2 0x00007fa38405fa76 in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26 #3 0x00007fa3840497fc in __GI_abort () at abort.c:79 #4 0x00007fa3847541e3 in default_fatal_finish (status=0, type=LOG_TYPE_PANIC) at ../lib/failures.c:465 #5 fatal_handler_real (ctx=<optimized out>, format=<optimized out>, args=<optimized out>) at ../lib/failures.c:477 #6 0x00007fa3847ff5f7 in i_internal_fatal_handler (ctx=<optimized out>, format=<optimized out>, args=<optimized out>) at ../lib/failures.c:879 #7 0x00007fa3847540e1 in i_panic (format=0x7fa384844040 "file %s: line %d (%s): assertion failed: (%s)") at ../lib/failures.c:530 #8 0x00007fa38474fdf8 in i_stream_header_filter_snapshot_free (_snapshot=<optimized out>) at ../lib-mail/istream-header-filter.c:663 #9 i_stream_header_filter_snapshot_free (_snapshot=0x56150ea92250) at ../lib-mail/istream-header-filter.c:655 #10 0x00007fa38480cb6c in i_stream_snapshot_free (_snapshot=_snapshot@entry=0x56150ea9d2a0) at ../lib/istream.c:253 #11 0x00007fa38480cc14 in i_stream_unref (stream=0x56150ea9d338) at ../lib/istream.c:66 #12 0x00007fa3847dd179 in message_parse_header_deinit (_ctx=_ctx@entry=0x56150ea9d0c8) at ../lib-mail/message-header-parser.c:52 #13 0x00007fa3847deea1 in preparsed_parse_next_header (ctx=0x56150ea9d050, block_r=0x7ffc8222ca70) at ../lib-mail/message-parser-from-parts.c:310 #14 0x00007fa3847dfedc in message_parser_parse_next_block (ctx=ctx@entry=0x56150ea9d050, block_r=block_r@entry=0x7ffc8222ca70) at ../lib-mail/message-parser.c:838 #15 0x00007fa3847e0029 in message_parser_parse_header (ctx=0x56150ea9d050, hdr_size=hdr_size@entry=0x56150ea5ff00, callback=callback@entry=0x7fa3849aa3f0 <index_mail_parse_part_header_cb>, context=context@entry=0x56150ea5fc78) at ../lib-mail/message-parser.c:877 #16 0x00007fa3849aa60a in index_mail_parse_headers_internal (mail=mail@entry=0x56150ea5fc78, headers=headers@entry=0x0) at index/index-mail-headers.c:465 #17 0x00007fa3849aa71e in index_mail_parse_headers (mail=0x56150ea5fc78, headers=0x0, reason=<optimized out>) at index/index-mail-headers.c:499 #18 0x00007fa3849b021e in index_mail_parse_bodystructure_full (mail=0x56150ea5fc78, field=MAIL_CACHE_IMAP_BODYSTRUCTURE) at index/index-mail.c:1491 #19 0x00007fa3849b02b3 in index_mail_parse_bodystructure (mail=mail@entry=0x56150ea5fc78, field=field@entry=MAIL_CACHE_IMAP_BODYSTRUCTURE) at index/index-mail.c:1515 #20 0x00007fa3849b06cd in index_mail_get_special (_mail=0x56150ea5fc78, field=<optimized out>, value_r=0x7ffc8222cbe0) at index/index-mail.c:1713 #21 0x00007fa38492fa1e in mail_get_special (mail=<optimized out>, field=field@entry=MAIL_FETCH_IMAP_BODYSTRUCTURE, value_r=value_r@entry=0x7ffc8222cbe0) at /usr/src/debug/dovecot-2.3.20-1.fc37.x86_64/src/lib-storage/mail.c:418 #22 0x000056150dcf458c in fetch_bodystructure (ctx=0x56150ea57530, mail=<optimized out>, context=<optimized out>) at /usr/src/debug/dovecot-2.3.20-1.fc37.x86_64/src/imap/imap-fetch.c:740 #23 0x000056150dcfa3f3 in imap_fetch_more_int (ctx=ctx@entry=0x56150ea57530, cancel=false) at /usr/src/debug/dovecot-2.3.20-1.fc37.x86_64/src/imap/imap-fetch.c:562 #24 0x000056150dcfa6cd in imap_fetch_more (ctx=0x56150ea57530, cmd=0x56150ea57368) at /usr/src/debug/dovecot-2.3.20-1.fc37.x86_64/src/imap/imap-fetch.c:617 #25 0x000056150dceed11 in cmd_fetch (cmd=0x56150ea57368) at /usr/src/debug/dovecot-2.3.20-1.fc37.x86_64/src/imap/cmd-fetch.c:382 #26 0x000056150dcf79a5 in command_exec (cmd=cmd@entry=0x56150ea57368) at /usr/src/debug/dovecot-2.3.20-1.fc37.x86_64/src/imap/imap-commands.c:201 #27 0x000056150dcfd712 in client_command_input (cmd=<optimized out>, cmd@entry=0x56150ea57368) at /usr/src/debug/dovecot-2.3.20-1.fc37.x86_64/src/imap/imap-client.c:1232 #28 0x000056150dcfd7b8 in client_command_input (cmd=<optimized out>) at /usr/src/debug/dovecot-2.3.20-1.fc37.x86_64/src/imap/imap-client.c:1302 #29 0x000056150dcfdc05 in client_handle_next_command (remove_io_r=<synthetic pointer>, client=0x56150ea567f8) at /usr/src/debug/dovecot-2.3.20-1.fc37.x86_64/src/imap/imap-client.c:1344 #30 client_handle_input (client=client@entry=0x56150ea567f8) at /usr/src/debug/dovecot-2.3.20-1.fc37.x86_64/src/imap/imap-client.c:1358 #31 0x000056150dcfdfd4 in client_input (client=0x56150ea567f8) at /usr/src/debug/dovecot-2.3.20-1.fc37.x86_64/src/imap/imap-client.c:1402 #32 0x00007fa3848183ad in io_loop_call_io (io=0x56150ea890b0) at ../lib/ioloop.c:737 #33 0x00007fa38481973a in io_loop_handler_run_internal (ioloop=ioloop@entry=0x56150ea2def0) at ../lib/ioloop-epoll.c:222 #34 0x00007fa3848197e4 in io_loop_handler_run (ioloop=ioloop@entry=0x56150ea2def0) at ../lib/ioloop.c:789 #35 0x00007fa3848199a0 in io_loop_run (ioloop=0x56150ea2def0) at ../lib/ioloop.c:762 #36 0x00007fa384788bf7 in master_service_run (service=0x56150ea2dd40, callback=callback@entry=0x56150dd00ae0 <client_connected>) at ../lib-master/master-service.c:869 #37 0x000056150dce9c4d in main (argc=<optimized out>, argv=<optimized out>) at /usr/src/debug/dovecot-2.3.20-1.fc37.x86_64/src/imap/main.c:566 (gdb)

3 6

Option to disable client-initiated renegotiation
by Serg 13 Mar '23

13 Mar '23

Hello, is there any way to disallow client-initiated renegotiation at the dovecot? I haven't found any mention of this feature within source code as well as at the documentation. I am asking about it because without this feature mail server is vulnerable to a TLS renegotiation DoS attack which can consume a lot of CPU and is harder to combat comparing to a basic TLS connections flood.

2 1

bug: usersfile very weird behaviour regarding path to mbox
by Mikel Pérez 13 Mar '23

13 Mar '23

dovecot --version 2.3.20 (80a5ac675d) having the following setup: (1) aioria:/srv/franper/mail # cat /etc/dovecot/users ***snip*** ventas-respaldo@franper.net:*snip*:1001:1000::/srv/franper/mail/ventas (2) aioria:/srv/franper/mail # ls -lha total 0 drwxr-x---. 1 1001 1000 238 Mar 13 05:07 . drwxr-sr-x. 1 1000 1001 62 Oct 24 21:29 .. ***snip*** drwxr-x---. 1 1001 1000 578 Mar 4 18:53 ventas drwx------. 1 1001 1000 246 Mar 13 05:07 ventas-respaldo (3) aioria:/srv/franper/mail # date -u Mon Mar 13 05:09:06 UTC 2023 where (1) I'm trying to expose the contents of the mbox ventas as ventas-respaldo(a)franper.net, well, for some reason it disregards that I'm pointing at /srv/franper/mail/ventas BUT does take the directory path at /srv/franper/mail and then constructs a /srv/franper/mail/ventas-respaldo path, which you can confirm with (2) showing ventas-respaldo modification date being today's date (3) because a client (Thunderbird 103 if you're interested but I think that it's not its fault at all) tried accessing ventas-respaldo(a)franper.net which should have pointed to /srv/franper/mail/ventas but instead did this very weird thing. Nowhere in /etc/dovecot/users do I have a line pointing to /srv/franper/mail/ventas-respaldo. dovecut just generates it somehow. dovecot -n: # 2.3.20 (80a5ac675d): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.20 (149edcf2) # OS: Linux 6.2.1-1-default x86_64 ## (OpenSUSE micro OS) # Hostname: aioria disable_plaintext_auth = no mail_location = maildir:/srv/franper/mail/%n managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables b ody enotify environment mailbox date index ihave duplicate mime foreverypart extracttext namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = scheme=CRYPT username_format=%u /etc/dovecot/users driver = passwd-file } plugin { sieve = file:~/sieve;active=~/.dovecot.sieve } ssl = required ssl_cert = <*snip* ssl_cipher_list = ALL:!DH:!kRSA:!SRP:!kDHd:!DSS:!aNULL:!eNULL:!EXPORT:!DES:!3DES:!MD5:!PSK:!RC4:!ADH:!LOW@STRENGTH ssl_key = # hidden, use -P to show it ssl_options = no_compression ssl_prefer_server_ciphers = yes userdb { args = username_format=%u /etc/dovecot/users driver = passwd-file } tell me if you need the sysreport tar and big thanks

1 0

set imap flags in user sieve scripts
by spi 11 Mar '23

11 Mar '23

Hi all Could anyone lead me into the right direction please? I use 'addflag ...' or 'fileinto :flags ...' in global sieve scripts to flag and sort incoming mail - that works. Trying to do that with custom user scripts doesn't work - I get the error that imap4flags only can be used in global scripts. Is there any way to get incoming mails labled and sorted by user sieve scripts? So something like this for a particular user doesn't work: if address :domain "From" "whatever.com"{ fileinto :flags ["\\todo"] "working/whatever"; } -- Cheers spi

3 4

Inconsistent filtering with debugging
by Christian Wolf 11 Mar '23

11 Mar '23

Hello, I have the problem, that I have a Postfix/Dovecot combination running with Sieve activated. The sieve script is running in general as some messages get filtered and moved to the appropriate folders. Now, I see that for the envelope filter, the behavior differs depending if I am debugging the rules or if the mails are received in a regular way. I have something like this: require "envelope"; # ... if envelope :is "to" "foo(a)subdaomin.example.com" { fileinto "INBOX.bar"; stop; } # ... The thing is if I call sieve-filter on the INBOX, I get the information that the mail is to be moved to the appropriate folder. However during delivery the mail is not moved there. Other rules in the script are working so it is installed in general. Of course, I could send mails to the mail address for testing but I have no clue on where to look for issues, especially as the "main debugging tool" for the rules (sieve-filter) is strangely behaving differently. The reason, I wanted to use the envelope was because the mails are delivered to foo(a)subdomain.example.com. From there, some virtual aliases are forwarded to a cental account bar(a)example.net using postfix virtual aliases. Thus, the Delivered-To header is always showing the value bar(a)example.net which is not suited for filtering. I could filter the Received headers but hoped for a more "high level" solution. Can you give me any advice? Christian

3 3

Winbind auhentication
by Luciano Mannucci 10 Mar '23

10 Mar '23

Helo all! I'm trying to set up a dovecot server so that it authenticates local user via /etc/passwd (I'm on a Freebsd 13.1) and via winbindd for those that it cannot find localy. The samba suite is alive and well, postfix gets happily mail from domain users and saves it with correct name and permissions from the windows domain. If I try to authenticate a domain user via wbinfo it works, with dovecot it doesn't. I guess I'v forgot something in the dovecot config... :) Here is my doveconf -n: # 2.3.20 (80a5ac675d): /usr/local/etc/dovecot/dovecot.conf # Pigeonhole version 0.5.20 (149edcf2) # OS: FreeBSD 13.1-RELEASE-p5 powerpc ufs # Hostname: numeron.mcs.it auth_cache_size = 30 k auth_debug_passwords = yes auth_mechanisms = plain ntlm login auth_use_winbind = yes auth_username_format = %n auth_winbind_helper_path = /usr/local/bin/ntlm_auth default_client_limit = 1128 default_vsz_limit = 712 M disable_plaintext_auth = no first_valid_uid = 0 info_log_path = /var/log/dovecot/logfile.info listen = * lock_method = flock log_path = /var/log/dovecot/logfile login_greeting = Dovecot at Nameron Ready. mail_location = mbox:/var/spool/dovecot/%u:INBOX=/var/mail/%u mail_plugins = fts managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext passdb { driver = passwd } protocols = imap pop3 service replication-notify-fifo { name = aggregator } service anvil-auth-penalty { name = anvil } service auth-worker { name = auth-worker } service auth-client { user = root name = auth } service config { name = config } service dict-async { name = dict-async } service dict { name = dict } service login/proxy-notify { name = director } service dns-client { name = dns-client } service doveadm-server { name = doveadm } service imap-hibernate { name = imap-hibernate } service imap { service_count = 0 name = imap-login } service imap-urlauth { name = imap-urlauth-login } service imap-urlauth-worker { name = imap-urlauth-worker } service token-login/imap-urlauth { name = imap-urlauth } service imap-master { name = imap } service indexer-worker { name = indexer-worker } service indexer { name = indexer } service ipc { name = ipc } service lmtp { name = lmtp } service log-errors { name = log } service sieve { name = managesieve-login } service login/sieve { name = managesieve } service old-stats-mail { name = old-stats } service pop3 { process_limit = 255 service_count = 1 name = pop3-login } service login/pop3 { name = pop3 } service replicator-doveadm { name = replicator } service login/stats-writer { unix_listener { group = mail mode = 0666 user = dovecot path = stats-reader } unix_listener { group = mail mode = 0666 user = dovecot path = stats-writer } name = stats } service submission { name = submission-login } service login/submission { name = submission } ssl = no userdb { driver = passwd } protocol pop3 { pop3_client_workarounds = outlook-no-nuls oe-ns-eoh pop3_enable_last = yes pop3_uidl_format = %08Xu%08Xv service replication-notify-fifo { name = aggregator } service anvil-auth-penalty { name = anvil } service auth-worker { name = auth-worker } service auth-client { name = auth } service config { name = config } service dict-async { name = dict-async } service dict { name = dict } service login/proxy-notify { name = director } service dns-client { name = dns-client } service doveadm-server { name = doveadm } service imap-hibernate { name = imap-hibernate } service imap { name = imap-login } service imap-urlauth { name = imap-urlauth-login } service imap-urlauth-worker { name = imap-urlauth-worker } service token-login/imap-urlauth { name = imap-urlauth } service imap-master { name = imap } service indexer-worker { name = indexer-worker } service indexer { name = indexer } service ipc { name = ipc } service lmtp { name = lmtp } service log-errors { name = log } service sieve { name = managesieve-login } service login/sieve { name = managesieve } service old-stats-mail { name = old-stats } service pop3 { name = pop3-login } service login/pop3 { name = pop3 } service replicator-doveadm { name = replicator } service login/stats-writer { name = stats } service submission { name = submission-login } service login/submission { name = submission } } protocol lda { debug_log_path = /var/log/dovecot/lda-debug.log info_log_path = /var/log/dovecot/lda.info log_path = /var/log/dovecot/lda.err mail_debug = yes postmaster_address = l(a)mcs.it service replication-notify-fifo { name = aggregator } service anvil-auth-penalty { name = anvil } service auth-worker { name = auth-worker } service auth-client { name = auth } service config { name = config } service dict-async { name = dict-async } service dict { name = dict } service login/proxy-notify { name = director } service dns-client { name = dns-client } service doveadm-server { name = doveadm } service imap-hibernate { name = imap-hibernate } service imap { name = imap-login } service imap-urlauth { name = imap-urlauth-login } service imap-urlauth-worker { name = imap-urlauth-worker } service token-login/imap-urlauth { name = imap-urlauth } service imap-master { name = imap } service indexer-worker { name = indexer-worker } service indexer { name = indexer } service ipc { name = ipc } service lmtp { name = lmtp } service log-errors { name = log } service sieve { name = managesieve-login } service login/sieve { name = managesieve } service old-stats-mail { name = old-stats } service pop3 { name = pop3-login } service login/pop3 { name = pop3 } service replicator-doveadm { name = replicator } service login/stats-writer { name = stats } service submission { name = submission-login } service login/submission { name = submission } } root@numeron:~# Thanks for any hint, Luciano. -- /"\ /Via A. Salaino, 7 - 20144 Milano (Italy) \ / ASCII RIBBON CAMPAIGN / PHONE : +39 02485781 FAX: +39 0248028247 X AGAINST HTML MAIL / E-MAIL: posthamster(a)sublink.sublink.ORG / \ AND POSTINGS / WWW: http://www.lesassaie.IT/

2 2

NFS and performances
by tomate aceite 10 Mar '23

10 Mar '23

Thanks!!!!

1 0

how to setup timestamp
by tomate aceite 10 Mar '23

10 Mar '23

*Thanks** Alessio Cecchi*

1 0

index locally
by tomate aceite 10 Mar '23

10 Mar '23

Thanks guys for all the help. I will check if i can do a rsync script.

1 0

Backend doesn't support GUIDs
by Jose Celestino 09 Mar '23

09 Mar '23

Hi, Have some old dboxes where doveadm sync fails with "Backend doesn't support GUIDs, sync with header hashes instead". The error is right after reading from the folder dovecot.index.log.2. The dovecot version is 2.3.10. Any fix/workaround for the error?

1 0

how to setup timestamp
by tomate aceite 08 Mar '23

08 Mar '23

Does anyone got any example about how to implement delay_until = timestamp ? I am not sure where i can setup it. Thanks!

2 1

Missing mailboxes after migration from Maildir -> mdbox
by A 08 Mar '23

08 Mar '23

I migrated from existing dovecot Maildir to dbox. After adding separator to the namespace it migrated all Inbox mails, but the other mailboxes like user-created ones and "Junk", "Sent" and so on has not been migrated. Any advice would be helpful, here is my dovconf: https://pastebin.com/rDSeBcLe My migration I made using: 1. Edit dovecot.conf with new mdbox and adding separator 2. dsync mirror per user with old maildir:~/mail 3. missing mailboxes: tried with doveadm sync also with -f mode and specified mailboxes. No luck. dsync -v -u admin@(removed) mirror maildir:~/mail mail_home = /var/vmail/mailboxes/%d/%n #mail_location = maildir:~/mail:LAYOUT=fs mail_location=mdbox:~/mdbox My directorys: root@mail:/var/vmail/mailboxes/example.de/admin# ls -l insgesamt 56 drwxrwx--- 2 vmail vmail 4096 8. Mär 01:14 cur -rw-rw---- 1 vmail vmail 160 8. Mär 01:14 dovecot.index.log -rw-rw---- 1 vmail vmail 3712 8. Mär 01:14 dovecot.list.index.log -rw-rw---- 1 vmail vmail 96 8. Mär 01:14 dovecot.mailbox.log -rw-rw---- 1 vmail vmail 51 8. Mär 01:14 dovecot-uidlist -rw-rw---- 1 vmail vmail 8 8. Mär 01:14 dovecot-uidvalidity -r--r--r-- 1 vmail vmail 0 8. Mär 00:57 dovecot-uidvalidity.6407cf6d drwxrwx--- 20 vmail vmail 4096 8. Mär 02:51 mail drwx------ 7 vmail vmail 4096 8. Mär 13:52 mailboxes drwx------ 13 vmail vmail 4096 8. Mär 02:36 Maildir drwx------ 5 vmail vmail 4096 8. Mär 04:20 mdbox drwxrwx--- 2 vmail vmail 4096 8. Mär 01:14 new -rw-rw---- 1 vmail vmail 28 8. Mär 01:14 subscriptions drwxrwx--- 2 vmail vmail 4096 8. Mär 01:14 tmp drwxrwx--- 2 vmail vmail 4096 8. Mär 00:57 xapian-indexes root@mail:/var/vmail/mailboxes/example.de/admin/mail# ls -l insgesamt 87576 drwxrwx--- 2 vmail vmail 9113600 8. Mär 02:20 cur -rw-rw---- 1 vmail vmail 1602296 8. Mär 02:20 dovecot.index -rw-rw---- 1 vmail vmail 73030876 8. Mär 02:41 dovecot.index.cache -rw-rw---- 1 vmail vmail 441656 8. Mär 02:39 dovecot.index.log -rw-rw---- 1 vmail vmail 83568 8. Mär 02:20 dovecot.index.log.2 -rwxrwx--- 1 vmail vmail 206490 17. Jun 2019 dovecot.index.thread -rwxrwx--- 1 vmail vmail 51 2. Aug 2019 dovecot-keywords -rw-rw---- 1 vmail vmail 1392 8. Mär 01:25 dovecot.list.index -rw-rw---- 1 vmail vmail 6712 8. Mär 02:41 dovecot.list.index.log -rwxrwx--- 1 vmail vmail 1464 8. Mär 02:20 dovecot.mailbox.log -rw-rw---- 1 vmail vmail 4875528 8. Mär 02:20 dovecot-uidlist -rwxrwx--- 1 vmail vmail 8 8. Mär 01:25 dovecot-uidvalidity -rwxrwx--- 1 vmail vmail 0 17. Jun 2019 dovecot-uidvalidity.5a6912f0 drwxrwx--- 5 vmail vmail 4096 7. Mär 20:14 Drafts -rw-rw---- 1 vmail vmail 49 6. Mär 11:10 maildirsize drwxrwx--- 5 vmail vmail 4096 7. Mär 20:44 'Mailling Listen' drwxrwx--- 2 vmail vmail 204800 8. Mär 00:04 new drwxrwx--- 5 vmail vmail 4096 7. Mär 20:14 Sent drwxrwx--- 5 vmail vmail 4096 7. Mär 20:44 Spam drwxrwx--- 5 vmail vmail 4096 26. Feb 19:44 'SPF Fail' -rw-rw---- 1 vmail vmail 23 8. Mär 02:20 subscriptions drwxrwx--- 2 vmail vmail 4096 8. Mär 02:20 tmp drwxrwx--- 5 vmail vmail 4096 26. Feb 19:12 Trash drwxrwx--- 5 vmail vmail 4096 7. Mär 22:30 ubb drwxrwx--- 10 vmail vmail 4096 27. Feb 18:44 xapian-indexes

1 0

index locally
by tomate aceite 08 Mar '23

08 Mar '23

Hello, Do you know if is possible to store indexes locally instead of NFS in dovecot 2.2.7 ? Thanks.

3 2

Dovecot "Mailbox sharing between users".
by Jobst Schmalenbach 07 Mar '23

07 Mar '23

Hi I have appended the important bits of my server configuration to the end of this email I am trying to get "Mailbox sharing between users" to work. For starters it is very hard to follow the doc only https://doc.dovecot.org/configuration_manual/shared_mailboxes/shared_mailbo… without an actual example. I tried to use this (sorry in German) https://dokuwiki.tachtler.net/doku.php?id=tachtler:dovecot_shares and this got me a little further down the track. I followed the instructions required for the dovecot config files. Restarted dovecot, not errors displayed in the logs. I have got access to two user accounts, say USER1 and USER2. I executed this lines doveadm acl set -u USER1 INBOX user=USER2 admin create delete expunge insert lookup post read write write-deleted write-seen doveadm acl set -u USER2 INBOX user=USER1 admin create delete expunge insert lookup post read write write-deleted write-seen and created (just to be sure) two folders for each user /home/USER1/Mail/shared/USER1 /home/USER1/Mail/shared/USER2 /home/USER2/Mail/shared/USER1 /home/USER2/Mail/shared/USER2 The tried to create a mailboxes like so /home/USER1/Mail/shared/USER1/testa /home/USER1/Mail/shared/USER2/testb /home/USER2/Mail/shared/USER1/testa /home/USER2/Mail/shared/USER2/testb They are not created and no error is displayed - even looking at the dovecot logs. What I see in the folders for BOTH users though (for every folder) dovecot.list.index.log On the command line I can see the .imap files and do a 'ls -alR' in the folders, but no created mbox. I can definitely see the folders, but I cannot create a mbox file. What am I doing wrong? Help please. --------------------------------------------------------------------------------------------------------------------------------------------------------------- Here are the important configuration items # 2.3.16 (7e2e900c1a): /etc/dovecot/dovecot.conf # OS: Linux 4.18.0-425.13.1.el8_7.x86_64 x86_64 AlmaLinux release 8.7 (Stone Smilodon) xfs namespace shared { list = children location = maildir:~/Mail/:INDEX=~/Mail/shared/%%u:CONTROL=~/Mail/shared/ prefix = shared/%%u/ separator = / subscriptions = yes type = shared } mail_location = mbox:/home/%u/Mail/:INBOX=/var/mail/%u mail_plugins = acl passdb { driver = pam } plugin { acl = vfile acl_shared_dict = file:/var/lib/dovecot/db/shared-mailboxes.db } service auth { unix_listener auth-userdb { group = dovecot mode = 0777 user = dovecot } } protocol imap { mail_plugins = " acl imap_acl" } --

1 0

Flags/tags lost when moving e-mails to another folder
by Alexis Ben Miloud--Josselin 06 Mar '23

06 Mar '23

Hi, I have an issue with e-mail tags/flags. The IMAP user is using Thunderbird or Roundcube with Thunderbird tags. When the user (with an IMAP client) moves an e-mail from a folder to another, tags set on the e-mail are lost. When we check the filesystem, we can see the "a" tag: -rw-rw---- 2 test mailusers 2498 Dec 29 15:31 'cur/1676643827.M563793P15241.<HOSTNAME>,S=2498,W=2551:2,a' When we move the e-mail to another folder, the tag disappear: -rw-rw---- 2 test mailusers 2498 Dec 29 15:31 '.test/cur/1676644340.M214404P22014.<HOSTNAME>,S=2498,W=2551:2,' In both folders, the dovecot-keywords file is: 0 $LABEL1 The problem appeared after a major system upgrade (Debian 9 to 10). Dovecot version went from 2.2.27 to 2.3.4.1. Some system informations: # dovecot --version 2.3.4.1 (f79e8e7e4) # cat /etc/debian_version 10.13 # uname -a Linux <HOSTNAME> 4.19.0-23-amd64 #1 SMP Debian 4.19.269-1 (2022-12-20) x86_64 GNU/Linux # findmnt /var TARGET SOURCE FSTYPE OPTIONS /var /dev/vda3 ext4 rw,nosuid,relatime # findmnt /home TARGET SOURCE FSTYPE OPTIONS /home /dev/vdb ext4 rw,nosuid,nodev,noexec,relatime The output of `dovecot -n output` is here (link expires in one year): https://paste.evolix.org/?96d46acaea638568#56g7AQLuzJxxy4xintpexJCPgiAAG23c… Here are the operations I see on an e-mail file using strace: 15507 link("/home/test/Maildir/cur/1672326270.M619318P11927.<HOSTNAME>,S=2498,W=2551:2,Sa", "/home/test/Maildir/.test/tmp/1672326456.M737812P15507.<HOSTNAME>") = 0 15507 rename("/home/test/Maildir/.test/tmp/1672326456.M737812P15507.<HOSTNAME>", "/home/test/Maildir/.test/cur/1672326456.M737813P15507.<HOSTNAME>,S=2498,W=2551:2,S") = 0 15507 unlink("/home/test/Maildir/cur/1672326270.M619318P11927.<HOSTNAME>,S=2498,W=2551:2,Sa") = 0 Setting mbox_lazy_writes to yes and/or unsetting mail_cache_fields doesn't change anything. Any idea of what I am missing? Could this be a bug in Dovecot? Thanks in advance, -- Alexis Ben Miloud--Josselin <abenmiloud(a)evolix.fr> Evolix - Hébergement et Infogérance Open Source Marseille (37 rue Guibal, Pôle Média, 13003) / Paris / Montréal http://evolix.com | Twitter: @Evolix @EvolixNOC | http://blog.evolix.com

2 2

Re: Corrupted sizes using zlib plugin
by Tim Evers 06 Mar '23

06 Mar '23

Am 06.03.23 um 11:42 schrieb Aki Tuomi: >> On 06/03/2023 12:32 EET Tim Evers <te-ml-ext(a)artfiles.de> wrote: >> >> >> Hi, >> >> since I did not get any feedback on my bug report post regarding >> corrupted sizes while using zlib >> (https://dovecot.org/pipermail/dovecot/2023-February/126105.html) I >> would like to confirm that this bug report reached someone in charge. >> >> Or if not - I would kindly ask for directions on how to post it in a way >> that spawns some action. >> >> Thx >> >> Tim > Can you try erasing dovecot.index.cache and see if the problem fixes itself? It's possible your cache contains invalid values from old errors. > > Aki Did that already several times (other dovecot.index.* files too). The only thing that helps is actually deleting the dovecot-uidlist file but the problem returns. Tim

2 3

Corrupted sizes using zlib plugin
by Tim Evers 06 Mar '23

06 Mar '23

Hi, since I did not get any feedback on my bug report post regarding corrupted sizes while using zlib (https://dovecot.org/pipermail/dovecot/2023-February/126105.html) I would like to confirm that this bug report reached someone in charge. Or if not - I would kindly ask for directions on how to post it in a way that spawns some action. Thx Tim

2 1

Setting up the mail-crypt plugin with virtual accounts that have no home directories
by Jeremy 05 Mar '23

05 Mar '23

Hi again, I am using dovecot 2.3.16, along with postfix and a PostgreSQL database for managing virtual accounts. After an initial topic from me about encrypting already existent mail, I could now use some pointers on how to set up the mail-crypt plugin for pure virtual accounts (i.e. that have no matching system users and/or home directories. I hope somebody can clarify a few things that are not entirely clear to me yet. After doing my own research, I believe the following should be possible: I'd like to use the password of virtual email accounts to let dovecot encrypt/decrypt the keys needed to encrypt/decrypt the mail in the relevant folders. As per the documentation @ https://doc.dovecot.org/configuration_manual/mail_crypt_plugin/ I believe this would be all the configuration I need: # Config mail_attribute_dict = file:%h/Maildir/dovecot-attributes mail_plugins = $mail_plugins mail_crypt plugin { mail_crypt_curve = secp521r1 # or some other preferred curve mail_crypt_save_version = 2 mail_crypt_require_encrypted_user_key = yes # necessary for encrypting keys with user password } # File: /etc/dovecot/dovecot-sql.conf.ext password_query = SELECT \ email as user, password, \ '%w' AS userdb_mail_crypt_private_password \ FROM virtual_users WHERE email='%u'; My first question is: Is it possible to configure mail_attribute_dict in such a way as to not use home directories. Since I only use virtual accounts, without those accounts having home directories, can I somehow tell dovecot to save the attributes into the PostsreSQL database, for instance? If not, can you suggest another approach, without having to create home directories for virtual users? My second question is: The documentation warns about not using password directly in the above SQL query: > Choosing encryption key > DO NOT use password directly. It can contain % which is interpreted as > variable expansion and can cause errors. Does this refer to not accidentally substituting '%w' with password? In other words, if I leave the above query as is, should I be good, even if plain text passwords of users potentially have % signs in them? Or would I need to take further measurements? (The passwords in my database are already hashed, by the way). I hope somebody can offer some guidance on this. Thanks.

2 7

bug report: imap-login not killed
by Sacha 05 Mar '23

05 Mar '23

Hi, We have growing imap-login processes until we reach the max processes. This occurs when a particular user have a login error due to our LDAP misconfiguration: --- Mar 4 14:59:33 hera dovecot[2226963]: auth: Error: plain(john.doe,XX.XX.XX.XX,<13C0eBP2354lqXpO>): user not found from any userdbs Mar 4 14:59:33 hera dovecot[2226963]: imap: Error: auth-master: login: request [1001652225]: Login auth request failed: Authenticated user not found from userdb, auth lookup id=1001652225 (auth connected 2 msecs ago, request took 1 msecs, client-pid=2235348 client-id=1) Mar 4 14:59:33 hera dovecot[2226963]: imap-login: Internal login failure (pid=2235348 id=1): user=<ohn.doe>, method=PLAIN, rip=XX.XX.XX.XX, lip=18 5.233.100.1, mpid=2235359, TLS, session=<13C0eBP2354lqXpO> --- The origin of is issue is when passdb finds the user and userdb not. The result is imap-login processes with no timeout growing until we reach the max processes. * OS version Debian stable - Bullseye * Dovecot version dpkg -l |grep dovecot ii dovecot-antispam 2.0+20171229-1+b7 amd64 Dovecot plugins for training spam filters ii dovecot-common 1:2.1.7-7+deb7u1 all Transitional package for dovecot ii dovecot-core 1:2.3.13+dfsg1-2+deb11u1 amd64 secure POP3/IMAP server - core files ii dovecot-core-dbgsym 1:2.3.13+dfsg1-2+deb11u1 amd64 debug symbols for dovecot-core ii dovecot-imapd 1:2.3.13+dfsg1-2+deb11u1 amd64 secure POP3/IMAP server - IMAP daemon ii dovecot-imapd-dbgsym 1:2.3.13+dfsg1-2+deb11u1 amd64 debug symbols for dovecot-imapd ii dovecot-ldap 1:2.3.13+dfsg1-2+deb11u1 amd64 secure POP3/IMAP server - LDAP support ii dovecot-managesieved 1:2.3.13+dfsg1-2+deb11u1 amd64 secure POP3/IMAP server - ManageSieve server ii dovecot-mysql 1:2.3.13+dfsg1-2+deb11u1 amd64 secure POP3/IMAP server - MySQL support ii dovecot-pop3d 1:2.3.13+dfsg1-2+deb11u1 amd64 secure POP3/IMAP server - POP3 daemon ii dovecot-sieve 1:2.3.13+dfsg1-2+deb11u1 amd64 secure POP3/IMAP server - Sieve filters support * doveconf -n --- # 2.3.13 (89f716dc2): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.13 (cdd19fe3) doveconf: Warning: service auth { client_limit=1000 } is lower than required under max. load (4096) doveconf: Warning: service anvil { client_limit=1000 } is lower than required under max. load (4099) # OS: Linux 5.10.0-21-cloud-amd64 x86_64 Debian 11.6 ext4 # Hostname: XXX auth_mechanisms = plain login default_process_limit = 1024 first_valid_gid = 8 first_valid_uid = 109 last_valid_gid = 8 last_valid_uid = 109 login_greeting = XXX listening. mail_access_groups = mail mail_gid = 8 mail_location = maildir:/srv/vmail/%d/%n mail_privileged_group = mail mail_uid = 109 managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy i nclude variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext imapflags notify imapsieve vnd.dovecot.imapsieve vnd.dovecot.filter namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = /etc/dovecot/dovecot-ldap.conf driver = ldap } passdb { args = /etc/dovecot/dovecot-ldap-girondix.conf driver = ldap } passdb { args = /etc/dovecot/dovecot-oauth2.conf.ext driver = oauth2 mechanisms = xoauth2 oauthbearer } plugin { quota_rule = *:storage=100M quota_rule2 = Trash:storage=10%% recipient_delimiter = + sieve = /srv/vmail/%d/%n/dovecot.sieve sieve_default = /var/lib/dovecot/sieve/default.sieve sieve_dir = /srv/vmail/%d/%n/sieve sieve_extensions = +notify +imapflags +vnd.dovecot.filter sieve_filter_bin_dir = /usr/lib/dovecot/sieve-filter sieve_global_extensions = +vnd.dovecot.pipe sieve_max_script_size = 1M sieve_pipe_bin_dir = /etc/dovecot/sieve sieve_pipe_socket_dir = sieve-pipe sieve_plugins = sieve_imapsieve sieve_extprograms sieve_redirect_envelope_from = orig_recipient } protocols = imap pop3 sieve service auth { unix_listener /var/spool/postfix/private/auth { group = mail mode = 0600 user = postfix } unix_listener auth-master { group = mail mode = 0660 user = vmail } unix_listener auth-userdb { group = mail mode = 0600 user = vmail } } service imap-login { inet_listener imap { port = 0 } } service imap { vsz_limit = 1 G } service lmtp { executable = lmtp -L process_min_avail = 2 } service pop3-login { inet_listener pop3 { port = 0 } } ssl_cert = </srv/letsencrypt/pem/mail.aquilenet.fr.pem ssl_client_ca_dir = /etc/ssl/certs ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { args = /etc/dovecot/dovecot-ldap.conf driver = ldap } userdb { args = /etc/dovecot/dovecot-ldap-girondix.conf driver = ldap } protocol lmtp { auth_username_format = %n info_log_path = /var/log/dovecot-lmtp.log mail_plugins = " sieve" } protocol lda { mail_plugins = " mailbox_alias sieve" } protocol imap { imap_client_workarounds = delay-newmail tb-extra-mailbox-sep imap_idle_notify_interval = 30 secs mail_max_userip_connections = 50 mail_plugins = quota mailbox_alias imap_quota } protocol pop3 { mail_plugins = quota mailbox_alias acl pop3_client_workarounds = outlook-no-nuls oe-ns-eoh } ---

2 2

Multiple scripts with postlogin
by Dan Conway 03 Mar '23

03 Mar '23

Hello, I'm having trouble understanding how to execute separate scripts with postlogin. According to the documentation, it should be as simple as: You can run multiple post-login scripts by just giving multiple scripts as parameters to|script-login|, for example: executable = script-login rawlog /usr/local/bin/postlogin.sh /usr/local/bin/postlogin2.sh Given this information, I supplied two scripts to service imap-postlogin below: service imap { executable = imap imap-postlogin } service imap-postlogin { executable = script-login -d rawlog /usr/local/bin/postlogin.pl /usr/local/bin/postlogin2.pl user = $default_internal_user unix_listener imap-postlogin { } } Both scripts simply print "Script 1" and "Script 2" to STDERR. Here is what they look like: #!/usr/bin/perl use strict; use warnings; print STDERR "Script 1\n"; system("/usr/lib/dovecot/script-login"); After logging in, only the first script is executed. The second one is ignored. I tried not executing "/usr/lib/dovecot/script-login" in the first script, in hopes that it would execute the second script, but it only denies the connection after printing "Script 1" imap-postlogin: Error: Script 1 imap(<user>): Error: Post-login script denied access to user <user> Am I missing something? Thanks.

2 1

OAuth2: local validation with RFC9068 tokens
by Tomas Habarta 01 Mar '23

01 Mar '23

Hello, my IdP is kind of progressive and implemented RFC9068, where all access tokens now come with typ "at+JWT". Since the setup has used local validation, I had to switch and currently use introspection endpoint. Looked around at the src and there seems to be relatively simple check of the token typ checking the only fixed value of "JWT" -- do you think you could consider tuning it a little bit so that local validation works also with such tokens? I am not an expert on OAuth2 so have no idea whether this is a valid request, but think that such a token is still JWT but has the required structure per RFC, which should not anyhow be in collision with a simple "JWT" typ. Saying that, I would not wonder if the statement is not correct :) Many thanks, Tomas

1 0

Can't receive mail before connecting with mutt and sending mail
by efeizbudak 01 Mar '23

01 Mar '23

Hi everyone, I've recently set up an email server. I also have mail crypt plugin and the users are set up through pam. The problem is that whenever I set up a new user, it can send mail but not receive it until the account is connected with mutt and at least one mail is sent. I've noticed that the mail_attribute_dict file is also not set up before doing this. One peculiar thing about all this is that if an account is connected through the stock android email app, the same "send email to get email" trick does not work. How can I debug this? Thank you! -- All the best, Efe The funny quote of this email is trivial and left as an exercise.

1 0

"sh: doveadm: command not found" with doveadm -Dv backup -R
by James Brown 01 Mar '23

01 Mar '23

I’m moving from an old mail server to a new one. On the new one, trying to transfer mailboxes from the old machine using doveadm. It fails saying it can’f find doveadm: % sudo doveadm -Dv backup -R -u myuser(a)bordo.com.au remote:mail.bordo.com.au Password: Debug: Loading modules from directory: /usr/local/lib/dovecot/doveadm Debug: Skipping module doveadm_acl_plugin, because dlopen() failed: dlopen(/usr/local/lib/dovecot/doveadm/lib10_doveadm_acl_plugin.so, 0x000A): symbol not found in flat namespace '_acl_backend_nonowner_lookups_iter_deinit' (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_quota_plugin, because dlopen() failed: dlopen(/usr/local/lib/dovecot/doveadm/lib10_doveadm_quota_plugin.so, 0x000A): symbol not found in flat namespace '_quota_get_resource' (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_fts_plugin, because dlopen() failed: dlopen(/usr/local/lib/dovecot/doveadm/lib20_doveadm_fts_plugin.so, 0x000A): symbol not found in flat namespace '_fts_backend_lookup' (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_mail_crypt_plugin, because dlopen() failed: dlopen(/usr/local/lib/dovecot/doveadm/libdoveadm_mail_crypt_plugin.so, 0x000A): symbol not found in flat namespace '_mail_crypt_acl_secure_sharing_enabled' (this is usually intentional, so just ignore this message) Feb 28 12:42:02 Debug: Loading modules from directory: /usr/local/lib/dovecot/doveadm Feb 28 12:42:02 Debug: Skipping module doveadm_acl_plugin, because dlopen() failed: dlopen(/usr/local/lib/dovecot/doveadm/lib10_doveadm_acl_plugin.so, 0x000A): symbol not found in flat namespace '_acl_backend_nonowner_lookups_iter_deinit' (this is usually intentional, so just ignore this message) Feb 28 12:42:02 Debug: Skipping module doveadm_quota_plugin, because dlopen() failed: dlopen(/usr/local/lib/dovecot/doveadm/lib10_doveadm_quota_plugin.so, 0x000A): symbol not found in flat namespace '_quota_get_resource' (this is usually intentional, so just ignore this message) Feb 28 12:42:02 Debug: Skipping module doveadm_fts_plugin, because dlopen() failed: dlopen(/usr/local/lib/dovecot/doveadm/lib20_doveadm_fts_plugin.so, 0x000A): symbol not found in flat namespace '_fts_backend_lookup' (this is usually intentional, so just ignore this message) Feb 28 12:42:02 Debug: Skipping module doveadm_mail_crypt_plugin, because dlopen() failed: dlopen(/usr/local/lib/dovecot/doveadm/libdoveadm_mail_crypt_plugin.so, 0x000A): symbol not found in flat namespace '_mail_crypt_acl_secure_sharing_enabled' (this is usually intentional, so just ignore this message) Feb 28 12:42:02 doveadm(myuser(a)bordo.com.au)<76814><>: Debug: auth-master: userdb lookup(myuser(a)bordo.com.au): Started userdb lookup Feb 28 12:42:02 doveadm(myuser(a)bordo.com.au)<76814><>: Debug: auth-master: conn unix:/usr/local/var/run/dovecot/auth-userdb: Connecting Feb 28 12:42:02 doveadm(myuser(a)bordo.com.au)<76814><>: Debug: auth-master: conn unix:/usr/local/var/run/dovecot/auth-userdb (uid=0): Client connected (fd=9) Feb 28 12:42:02 doveadm(myuser(a)bordo.com.au)<76814><>: Debug: auth-master: userdb lookup(myuser(a)bordo.com.au): auth USER input: myuser(a)bordo.com.au home=/usr/local/virtual/bordo.com.au/myuser mail=maildir:/usr/local/virtual/bordo.com.au/myuser uid=102 gid=102 quota=*:storage=0 Feb 28 12:42:02 doveadm(myuser(a)bordo.com.au)<76814><>: Debug: auth-master: userdb lookup(myuser(a)bordo.com.au): Finished userdb lookup (username=myuser(a)bordo.com.au home=/usr/local/virtual/bordo.com.au/myuser mail=maildir:/usr/local/virtual/bordo.com.au/myuser uid=102 gid=102 quota=*:storage=0) Feb 28 12:42:02 doveadm(myuser(a)bordo.com.au)<76814><>: Debug: Added userdb setting: mail=maildir:/usr/local/virtual/bordo.com.au/myuser Feb 28 12:42:02 doveadm(myuser(a)bordo.com.au)<76814><>: Debug: Added userdb setting: plugin/quota=*:storage=0 Feb 28 12:42:02 doveadm(myuser(a)bordo.com.au): Debug: Effective uid=102, gid=102, home=/usr/local/virtual/bordo.com.au/myuser Feb 28 12:42:02 doveadm(myuser(a)bordo.com.au): Debug: open(/proc/self/stat) failed: No such file or directory Feb 28 12:42:02 doveadm(myuser(a)bordo.com.au): Debug: open(/proc/self/io) failed: No such file or directory Feb 28 12:42:02 doveadm(myuser(a)bordo.com.au): Debug: Namespace inbox: type=private, prefix=, sep=, inbox=yes, hidden=no, list=yes, subscriptions=yes location=maildir:/usr/local/virtual/bordo.com.au/myuser Feb 28 12:42:02 doveadm(myuser(a)bordo.com.au): Debug: maildir++: root=/usr/local/virtual/bordo.com.au/myuser, index=, indexpvt=, control=, inbox=/usr/local/virtual/bordo.com.au/myuser, alt= Feb 28 12:42:02 doveadm(myuser(a)bordo.com.au): Debug: brain M: Namespace has location maildir:/usr/local/virtual/bordo.com.au/myuser Feb 28 12:42:02 doveadm(myuser(a)bordo.com.au): Debug: Mailbox INBOX: Couldn't open mailbox in list index: Mailbox not found Feb 28 12:42:02 doveadm(myuser(a)bordo.com.au): Debug: Namespace : Using permissions from /usr/local/virtual/bordo.com.au/myuser: mode=0700 gid=default (root(a)mail.bordo.com.au) Password: sh: doveadm: command not found Feb 28 12:42:06 dsync-local(myuser(a)bordo.com.au)<SJq/Iepb/WMOLAEAiJz6GQ>: Error: read(mail.bordo.com.au) failed: EOF (version not received) Feb 28 12:42:06 dsync-local(myuser(a)bordo.com.au)<SJq/Iepb/WMOLAEAiJz6GQ>: Error: Remote command returned error 127: ssh mail.bordo.com.au doveadm dsync-server -umyuser(a)bordo.com.au -U Feb 28 12:42:06 dsync-local(myuser(a)bordo.com.au)<SJq/Iepb/WMOLAEAiJz6GQ>: Debug: User session is finished Feb 28 12:42:06 dsync-local(myuser(a)bordo.com.au)<SJq/Iepb/WMOLAEAiJz6GQ>: Debug: auth-master: conn unix:/usr/local/var/run/dovecot/auth-userdb (uid=0): Disconnected: Connection closed (fd=9) Does this mean the remote machine can’t fine doveadm? (Both machines are running macOS) I could probably transfer the mailboxes using rsync, but I thought that doveadm was a better way. Thanks, James.

2 2

Re: Auth variables unknown variable -- about to go crazy
by efeizbudak 28 Feb '23

28 Feb '23

1 0

Auth variables unknown variable -- about to go crazy
by efeizbudak 28 Feb '23

28 Feb '23

Hi everyone, I'm trying to configure my email server to encrypt mails on a per user basis. I have the following in my conf: mail_plugins = $mail_plugins mail_crypt mail_attribute_dict = file:%h/Mail/dovecot-attributes plugin { mail_crypt_curve = secp521r1 mail_crypt_save_version = 2 mail_crypt_require_encrypted_user_key = yes mail_crypt_private_password = %N{password} } And I'm getting %password unknown variable error. I use pam to store the passwords. All I want is to be able to hash the user password and use that to encrypt/decrypt the keys. Can someone _please_ help me? -- All the best, Efe The funny quote of this email is trivial and left as an exercise.

2 1

re: "Timeout (180s) while waiting for lock for transaction log file" since 2.3 upgrade?
by graeme vetterlein 26 Feb '23

26 Feb '23

This is an old thread (but still the best search match for the error message). Several other people pointed at NFS, so it got me to look. Indeed what appear to happen (for me at least) was .... The folders being imapped, some of them were on a NFSv3 mount. The NFS server had been shutdown. The imap process appeared to hang (presumably trying to read from the defunct NFS mount point) this held the lock , so other imap processes (possibly not using NFS) hung awaiting the lock. The "fix" was to bing the NFS server back online ...and as it turned out restart a number of things like autofs and dovecot (Normally NFS clients just carry on, so the timeout must have affected things) My long-term fix came from: https://docs.oracle.com/cd/E19620-01/805-5233/z400163399f/index.html Namely to add -soft in /etc/auto_master This should cause a "fail" instead of a hang. -- Graeme

1 0

Cannot reach documentation site
by Ken Bass 26 Feb '23

26 Feb '23

doc.dovecot.org does not have a DNS entry. It worked a few days ago, but not now.

3 3

quota groups
by Ken Young 26 Feb '23

26 Feb '23

Hello, How can I set up groups to give each group a different quota? for example, group A has mail storage 1GB, and users in this group get 1GB quota etc. Thanks. Ken Y

1 0

Small suggestion for improvement of pigeonhole/imapsieve documentation
by Matthias Petermann 25 Feb '23

25 Feb '23

Hello all, this is my first post on this list and I would like to introduce myself briefly. My name is Matthias and I am from Saxony in Germany. I'm working with Unix and mail systems for a long time - actually with focus for NetBSD and Cyrus IMAP. Occasionally I also use Dovecot, which has several reasons. Today, one of the reasons was that I would like to trigger Sieve scripts when moving mail within mailbox folders - i.e. at an unspecified time after the actual mail arrival. In doing so, I came across the imapsieve extension for Pigeonhole fairly quickly and decided that the administrative Sieve scripts in imapsieve were exactly what I needed. However, despite having debug logging fully up, I couldn't figure out until just now why my sieve script wasn't running despite having IMAP events logged. Even intentionally defining an invalid script did not result in an error, so it seemed to be ignored altogether. Until I just now came across that I seem to have misunderstood the documentation. The template shown for the imapsieve_mailboxXXX_ parameters suggested to me that a sequence number of three digits must / can be specified here. Thus, I started numbering my parameters with imapsieve_mailbox001. However, while researching in various forums, I came across only examples that use imapsieve_mailbox1_ as the first parameter. In desperation I tried this out - now it works for me, too. Long story short - I don't know if I'm the only one who has made this mistake so far. A little hint in the documentation[1] would have helped me, how the XXX is meant exactly. I am referring to this section: ``` This setting configures the name of a mailbox for which administrator scripts are configured. The `XXX’ in this setting is a sequence number, which allows configuring multiple associations between Sieve scripts and mailboxes. The settings defined hereafter with matching sequence numbers apply to the mailbox named by this setting. The sequence of configured mailboxes ends at the first missing imapsieve_mailboxXXX_name setting. This setting supports wildcards with a syntax compatible with the IMAP LIST command, meaning that this setting can apply to multiple or even all (“*”) mailboxes. ``` What do you think about adding a small explanatory sentence to the documentation? For example: ``` This setting configures the name of a mailbox for which administrator scripts are configured. The `XXX’ in this setting is a sequence number, which allows configuring multiple associations between Sieve scripts and mailboxes. The sequence number must begin with the digit 1 without preceding zeros and may have a maximum of three digits. The settings defined hereafter with matching sequence numbers apply to the mailbox named by this setting. The sequence of configured mailboxes ends at the first missing imapsieve_mailboxXXX_name setting. This setting supports wildcards with a syntax compatible with the IMAP LIST command, meaning that this setting can apply to multiple or even all (“*”) mailboxes. ``` Many greetings Matthias [1] https://doc.dovecot.org/configuration_manual/sieve/plugins/imapsieve/

1 0

Restored mail folders conflict with renamed original ones
by Nikolaos Milas 24 Feb '23

24 Feb '23

Hello, We are running Dovecot 2.3.18 (together with Postfix) on CentOS 7. It uses a Maildir structure. We have a user who has organized his mailbox as shows up at the end of this mail. The user had forgotten that he had renamed his "Grants Active \ European" (.Grants Active.European) folder to "Grants Active \ International" (.Grants Active.International), he thought that it was lost and requested a restore of "Grants Active \ European" (with all of its subfolders) from backup. Since we did that (using a simple "cp -rp" from a backup, observing timestamps, ownership and permissions), mail client software won't see "European" mail folder in "Grants Active" mail folder; "International" mail folder shows up but only with two folders, those which do not exist in "European" branch (obviously, these were created later). I have tried to run the command "doveadm index -u userx Grants\ Active" and likewise for each and every mail subfolder under "Grants\ Active"; I have also tried deleting the dovecot.index.cache and dovecot.index.log from the latter ("Grants\ Active") and then run: doveadm -vD force-resync -u userx Grants\ Active but it didn't do the trick: Mail clients are still stuck as I explained. In the end, I thought that the snag might be that mail folders that are not appearing have identical (duplicate) UIDs; As an example: [root@mailx .Grants Active.European]# cat dovecot-uidlist 3 V1548680759 N1 G64e70a1130343f61003c0000715faa8d [root@mailx .Grants Active.European]# cd .. [root@mailx Maildir]# cd .Grants\ Active.International [root@mailx .Grants Active.International]# cat dovecot-uidlist 3 V1548680759 N1 G64e70a1130343f61003c0000715faa8d If so, how should we overcome this issue? I guess I could simply delete the restored folders to return to an acceptable state? If nevertheless we need to restore the ".European" mail folder from a backup (as it was before getting renamed), what would be the right way to do so? Is there another way to resolve the issue without deleting the restored mail folders? Here is the list of mail folders in this mailbox (I have intentionally removed lots of them, to reduce irrelevant content; this mailbox includes a large number of mail folders): # doveadm mailbox list -u userx IGARSS 2024 IAC2022 Junk ... Junk E-mail INBOX.EMISSION ... Trash Trash.Equality Trash.sadf ... Grants Active Grants Active.European Grants Active.European.URBAN RELEAF Grants Active.European.SMURBS Grants Active.European.SMURBS.In Kind Grants Active.European.SMURBS.Final Reports Grants Active.European.RI-URBANS Grants Active.European.QA4EO Grants Active.European.ATMO-ACCESS Grants Active.European.IGOSP Grants Active.European.GAUSS Grants Active.European.E-SHAPE Grants Active.European.CIROCCO Grants Active.European.InCASE Grants Active.European.EIFFEL Grants Active.European.ARSINOE Grants Active.International Grants Active.International.2324 Grants Active.International.GAUSS Grants Active.International.CIROCCO Grants Active.International.IGOSP Grants Active.International.ATMO-ACCESS Grants Active.International.URBAN RELEAF Grants Active.International.InCASE Grants Active.International.ARSINOE Grants Active.International.RI-URBANS Grants Active.International.E-SHAPE Grants Active.International.EIFFEL Grants Active.International.QA4EO Grants Active.International.SMURBS Grants Active.International.SMURBS.Final Reports Grants Active.International.SMURBS.In Kind Grants Active.International.India Grants Active.Urban ReLeaf Grants Active.National Grants Active.National.ΑΓ ΠΑΡΑΣΚΕΥΗ Grants Active.National.ΠΕΤΡΟΥΠΟΛΗ Grants Active.National.CLIMATTICA Grants Active.National.ΝΑΥΠΛΙΟ Grants Active.National.ΕΔΒΜ Grants Active.National.PANGEA Grants Active.National.ΕΛΙΔΕΚ Grants Active.National.ΕΛΙΔΕΚ.OXONIAN - Δέσποινα Grants Active.National.ΕΛΙΔΕΚ.Νασια PhD Grants Active.National.CLIMPACT Sent ... INBOX Please, provide some guidance on what we should do to make these mail folders work correctly again. Sorry, I am not very knowledgeable on mail inner architecture and operations; please let me know if you need additional info. Thanks in advance, Nick

2 6

How to get a server listed in the IMAP Test wiki?
by Leander Beernaert 24 Feb '23

24 Feb '23

Hey, We recently announced Gluon (https://github.com/ProtonMail/gluon/) our IMAP server library we are using in Proton Bridge(https://github.com/ProtonMail/proton-bridge). We would love to have it have it listed in the IMAP Server Compliancy Status wiki page (https://imapwiki.org/ImapTest/ServerStatus) What do we need to do or whom do we need to contact to make this happen? Additionally, We have been using running imaptest (https://github.com/dovecot/imaptest) against our server library, but due to variety of configuration parameters, we would really appreciate it (if possible) if someone could point out to us the test setup used to validate each of those servers. Thank you in advance for your time. Kind Regards, Leander Beernaert Proton AG

4 6

creating a mailbox via imap
by Gabriele Bulfon 23 Feb '23

23 Feb '23

Hi, is there any way with Dovecot to open an admin imap connection and create a brand new mailbox? With Cyrus imapd I can do this by connecting as the Cyrus admin user and then create a folder "user/newuser(a)domain.tld". Thanks Gabriele Sonicle S.r.l. : http://www.sonicle.com Music: http://www.gabrielebulfon.com eXoplanets : https://gabrielebulfon.bandcamp.com/album/exoplanets

3 2

doveadm sending invalid AUTHENTICATE to uw-imap
by Chris Candreva 23 Feb '23

23 Feb '23

I'm migrating a legacy uw-imap system to Dovecot, on a Rocky (RHEL) 8 server running Dovecot 2.3.16-3 from their repos. I am using a master user to import all users for an imaps connection from the old server to the new. On a trial run however, it worked for about half the users. Half are giving an error of the form: dsync(user): Error: imapc(host:993): Command '1 AUTHENTICATE PLAIN xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx' failed with BAD: 1 Missing or invalid argument to AUTHENTICATE I can't seem to get the IMAP command for the users that did work. However, on the face of it, that is an invalid AUTHENTICATE command. If I take that string and brake it up into (what I've googled is) the proper form of multi-command form of 1 AUTHENTICATE PLAIN + xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx then the login succeeds. I have not been able to find anyone else with this problem in my search. Is this a known issue, is there a way to force the multi-line AUTHENTICATE, something else I'm missing ? Any help is appreciate on this! -Chris -- --- ======================================================================== Chris Candreva -- chris(a)westnet.com -- http://www.westnet.com/~chris

3 4

Redundant Database, Pgsql ?
by Paul Kudla 23 Feb '23

23 Feb '23

I am aware that there are provising for redundant database connections Basically i was working on my main db server (which is also a mail sever) I current have this in the dovecot-pgsql.conf ______________________________________________________________________ driver = pgsql connect = host=localhost port=5433 dbname=scom_billing user=pgsql password=xxxxxxxxx default_pass_scheme = PLAIN password_query = SELECT username as user, password FROM email_users WHERE username = '%u' and password <> 'alias' and status = True and destination = '%u' user_query = SELECT home, uid, gid FROM email_users WHERE username = '%u' and password <> 'alias' and status = True and destination = '%u' #iterate_query = SELECT user, password FROM email_users WHERE username = '%u' and password <> 'alias' and status = True and destination = '%u' iterate_query = SELECT "username" as user, domain FROM email_users WHERE status = True and alias_flag = False _______________________________________________________________________ Basically I have replicaed servers all over the place but mail18 (because dovecot only knows of one db instance) went down as well. May I please get some guidance on what to add to talk to another postgresql server (i have 6 replicated servers so would probably want a couple worst case issue) -- Happy Sunday !!! Thanks - paul Paul Kudla Scom.ca Internet Services <http://www.scom.ca> 004-1009 Byron Street South Whitby, Ontario - Canada L1N 4S3 Toronto 416.642.7266 Main 1.866.411.7266 Fax 1.888.892.7266 Email paul(a)scom.ca

10 13

Can I encrypt already existant unencrypted mail before I start using the mail-crypt plugin?
by mailinglist-subscriptions 23 Feb '23

23 Feb '23

Hi, I am using dovecot 2.3.16, along with postfix and a PostgreSQL database for managing virtual accounts. I'd like to start using the mail-crypt plugin. However, I'm having a bit some difficulty understanding the documentation at https://doc.dovecot.org/configuration_manual/mail_crypt_plugin to reach my goal. I plan to ask questions about those issues by starting new threads in this mailing list. But before I even come to that, I'd like to investigate the following: The above documentation only addresses a clean install and doesn't seem to mention encrypting already existent unencrypted mails, like my server has. Is it possible to encrypt those before I start using the mail-crypt plugin, such that it will be able to decrypt those messages as well? If it is, I am assuming that how I would go about achieving that will be very dependent on the ultimate configuration I have in mind (pub/priv keys, etc.). So I don't expect a full-fledged guide. However, if you could perhaps give a general overview of what would be needed to achieve this, I would very much appreciate that. Thank you.

4 4

Re: Auth-worker, unknown scheme ARGON2ID
by James Brown 22 Feb '23

22 Feb '23

On 21 Feb 2023, at 10:12 pm, James Brown <jlbrown(a)bordo.com.au> wrote: > > The new one has Dovecot compiled with same configure options, same configuration files, but fails to authenticate: > > Feb 21 21:51:03 master: Info: Dovecot v2.3.20 (80a5ac675d) starting up for imap, pop3 (core dumps disabled) > Feb 21 21:51:33 auth-worker(11701): Error: conn unix:auth-worker (uid=214): auth-worker<1>: sql(jlbrown@bordo.com.au,::1,<bRgbkDP2udEBAAAAAAAAAAAAAAAAAAB>): Unknown scheme ARGON2ID > > ./configure --with-ssl=openssl --with-mysql > > Was what I used to compile. > > Using OpenSSL 3.0.8. New server is running macOS 13.2.1 Ventura. > > (Have also installed libsodium 1.0.18_1) > > Any help would be most appreciated. > > thanks, > > James. I’ve spent ages on this and am getting really desperate! :-( CPPFLAGS=-I/opt/homebrew/Cellar/openssl(a)3/3.0.8/include LDFLAGS=-L/opt/homebrew/opt/openssl@3/lib ./configure --with-ssl=openssl --with-mysql ... Install prefix . : /usr/local File offsets ... : 64bit I/O polling .... : kqueue I/O notifys .... : kqueue SSL ............ : yes (OpenSSL) GSSAPI ......... : no passdbs ........ : static passwd passwd-file pam checkpassword sql : -shadow -bsdauth -ldap userdbs ........ : static prefetch passwd passwd-file checkpassword sql sudo doveadm pw -l SHA1 SSHA512 SCRAM-SHA-256 BLF-CRYPT PLAIN HMAC-MD5 OTP SHA512 SHA DES-CRYPT CRYPT SSHA MD5-CRYPT PLAIN-MD4 PLAIN-MD5 SCRAM-SHA-1 CLEAR CLEARTEXT SSHA256 MD5 PBKDF2 SHA256 CRAM-MD5 PLAIN-TRUNC SMD5 DIGEST-MD5 LDAP-MD5 How do I get ARGON2I, ARGON2ID in that list? Has anybody got Dovecot to work on recent macOS with these password schemes? Any hints? Thanks, James.

2 8

Auth-worker, unknown scheme ARGON2ID
by James Brown 21 Feb '23

21 Feb '23

On my current mail server I was able to upgrade everyone’s password scheme to ARGON2ID with no issues, I just had to have: service auth { vsz_limit = 0 } This was an older version of macOS than the new server I’m trying to migrate to. The new one has Dovecot compiled with same configure options, same configuration files, but fails to authenticate: Feb 21 21:51:03 master: Info: Dovecot v2.3.20 (80a5ac675d) starting up for imap, pop3 (core dumps disabled) Feb 21 21:51:33 auth-worker(11701): Error: conn unix:auth-worker (uid=214): auth-worker<1>: sql(jlbrown@bordo.com.au,::1,<bRgbkDP2udEBAAAAAAAAAAAAAAAAAAB>): Unknown scheme ARGON2ID ./configure --with-ssl=openssl --with-mysql Was what I used to compile. Using OpenSSL 3.0.8. New server is running macOS 13.2.1 Ventura. (Have also installed libsodium 1.0.18_1) Any help would be most appreciated. thanks, James.

1 0

service(imap-login): Fatal: setrlimit(RLIMIT_DATA, 268435456): Invalid argument macOS
by James Brown 21 Feb '23

21 Feb '23

I fixed the issue with Dovecot not starting on macOS Ventura by adding this to 10-master.conf: service log { vsz_limit = 0 } But now when I try to login via Imap on port 143 I get the same error for imap-login: Feb 20 15:55:41 imap-login: Error: Feb 20 15:55:41 service(imap-login): Fatal: setrlimit(RLIMIT_DATA, 268435456): Invalid argument Feb 20 15:55:41 imap-login: Fatal: master: service(imap-login): child 11781 returned error 89 (Fatal failure) Feb 20 15:55:41 master: Error: service(imap-login): command startup failed, throttling for 60.000 secs Feb 20 16:13:04 imap-login: Error: Feb 20 16:13:04 service(imap-login): Fatal: setrlimit(RLIMIT_DATA, 268435456): Invalid argument Feb 20 16:13:04 imap-login: Fatal: master: service(imap-login): child 20370 returned error 89 (Fatal failure) Feb 20 16:13:04 master: Error: service(imap-login): command startup failed, throttling for 60.000 secs Config: sudo /usr/local/sbin/dovecot -n # 2.3.20 (80a5ac675d): /usr/local/etc/dovecot/dovecot.conf # OS: Darwin 22.3.0 arm64 apfs # Hostname: mail-server-mac-studio.local auth_mechanisms = plain login auth_verbose = yes auth_verbose_passwords = yes default_internal_group = mail default_internal_user = _dovecot default_login_user = _dovenull first_valid_gid = 0 first_valid_uid = 102 last_valid_gid = 501 last_valid_uid = 105 log_path = /var/log/dovecot.log mail_gid = 102 mail_location = maildir:/usr/local/virtual/%d/%u mail_uid = 102 namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = /usr/local/etc/dovecot/dovecot-sql.conf.ext driver = sql } protocols = imap pop3 service auth { unix_listener /var/spool/postfix/private/auth { group = _postfix mode = 0660 user = _postfix } unix_listener auth-userdb { mode = 0660 user = _vmail } } service imap-login { vsz_limit = 0 } service log { vsz_limit = 0 } ssl_cert = </etc/letsencrypt/live/mail.bordo.com.au/fullchain.pem ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { driver = prefetch } userdb { args = /usr/local/etc/dovecot/dovecot-sql.conf.ext driver = sql } protocol imap { mail_max_userip_connections = 40 } Quitting Dovecot and restarting and I now get: Feb 20 17:01:11 master: Info: Dovecot v2.3.20 (80a5ac675d) starting up for imap, pop3 (core dumps disabled) Feb 20 17:01:11 master: Error: service(anvil): command startup failed, throttling for 2.000 secs Then trying to connect on port 143 log says: Feb 20 17:20:08 master: Error: service(config): command startup failed, throttling for 2.000 secs Feb 20 17:20:08 config: Error: Feb 20 17:20:08 service(config): Fatal: setrlimit(RLIMIT_DATA, 268435456): Invalid argument Feb 20 17:20:08 anvil: Fatal: master: service(anvil): child 43250 returned error 89 (Fatal failure) Feb 20 17:20:08 config: Fatal: master: service(config): child 52530 returned error 89 (Fatal failure) Feb 20 17:20:08 stats: Fatal: master: service(stats): child 52531 returned error 89 (Fatal failure) Feb 20 17:20:08 stats: Error: Feb 20 17:20:08 service(stats): Fatal: setrlimit(RLIMIT_DATA, 268435456): Invalid argument Feb 20 17:20:08 master: Error: service(stats): command startup failed, throttling for 2.000 secs Feb 20 17:20:10 config: Error: Feb 20 17:20:10 service(config): Fatal: setrlimit(RLIMIT_DATA, 268435456): Invalid argument Feb 20 17:20:10 config: Fatal: master: service(config): child 52532 returned error 89 (Fatal failure) Feb 20 17:20:10 master: Error: service(config): command startup failed, throttling for 4.000 secs Feb 20 17:20:10 imap-login: Fatal: Error reading configuration: read(/usr/local/var/run/dovecot/config) failed: EOF - Also failed to read config by executing doveconf: /usr/local/var/run/dovecot/config is a UNIX socket (path is from CONFIG_FILE environment) Feb 20 17:20:10 master: Error: service(imap-login): command startup failed, throttling for 2.000 secs Any suggestions? This is really driving me crazy! thanks, James.

2 1

Get correct subjects in summary but wrong article body after transitioning between servers
by Steinar Bang 19 Feb '23

19 Feb '23

I am transitioning between servers (both debian 11.6 with dovecot 2.3.13) and I'm seeing some strange behaviour after the transition: it seems like dovecot is listing the correct subject for the test messages I'm sending in what's shown in my MUA's summary. But the body of the message is an old message. Dovecot is serving messages from Maildir folders in the users' home directories. And I may have messed up some things here: I rsynced the maildirs and then still got some deliveries both places when the MX records were in transition, so I did a belated rsync, thinking that "Maildir can handle that". But I weren't thinking about the dovecot files, ie: drwx------ 2 sb sb 155648 Feb 11 06:43 cur -rw------- 1 sb sb 30 Nov 23 18:14 dovecot-keywords -rw------- 1 sb sb 116407 Feb 11 06:43 dovecot-uidlist -rw------- 1 sb sb 8 Feb 28 2022 dovecot-uidvalidity -rw------- 1 sb sb 0 Mar 17 2011 dovecot-uidvalidity.4d821095 -rw------- 1 sb sb 38016 Jan 31 15:38 dovecot.index -rw------- 1 sb sb 203852 Feb 5 21:37 dovecot.index.cache -rw------- 1 sb sb 15076 Feb 11 06:43 dovecot.index.log -rw------- 1 sb sb 6424 Feb 4 08:06 dovecot.list.index -rw------- 1 sb sb 7796 Feb 11 06:43 dovecot.list.index.log -rw------- 1 sb sb 3048 Mar 6 2022 dovecot.mailbox.log drwx------ 2 sb sb 4096 Feb 11 06:43 new -rw------- 1 sb sb 738 Mar 6 2022 subscriptions drwx------ 2 sb sb 4096 Feb 6 22:05 tmp Are there any of these that could have been adversely affected by the rsync? Will regenerating these files fix the behaviour where I get the wrong article when fetching them? What is the best way to regenerate them? Can these feil be safely deleted and will be autogenerated? (I also see that some of these files are quite old. I had another server transition in 2017, so the files from 2011 has been rsynced into that server and not touched since) Thanks! - Steinar

1 2

Roundcube <-> Dovecot timeouts under very moderate load on big Dovecot nodes
by Malte Schmidt 18 Feb '23

18 Feb '23

Due to a recent topic regarding the performance of the Roundcube webmailer with Dovecot as a backend, I set up imapproxy successfully, shrinking the response latency of the webmailer heavily, which is great. However, I still encounter strange timeouts on some requests when Roundcube tries to access Dovecot. Be it for authentication or to FETCH data. I run the tests/benchmarks via distributed JMeter from 4 nodes, they access the webmailer which in turn accesses the Dovecot via imapproxy. There are 16 different mailaccounts spread over two dovecot nodes with the first one acting as a proxy if the account resides on the second. The problems start at around 100 concurrent users and gets worse the more users are added. The timeouts make up for a small percentage of the requests (0.0something percent). The timeout is reached after 30 seconds of Dovecot not answering, due to the timeout set in the webserver the webmailer is running on. Now I am wondering how to further debug this and what could be the reason. Some requests towards Dovecot are certainly taking longer than 30 seconds, while the average request takes mostly less than 1. The Dovecot is running on two big hardware machines with 48 cores, 96G memory and SSD storage. The load on the Dovecot nodes while the test is running is minimal. Best regards, M. Schmidt

1 0

dovecot_login accepts blank password for exim smtp auth
by Jeff Rogers 18 Feb '23

18 Feb '23

Hi all, I recently discovered a configuration issue on my system where a system user account had a blank rather than invalid or disabled password in the passwd/shadow database. The user could not be logged into through login/telnet/ssh because it was marked as a system account (uid < 100). Dovecot also would not authenticate the user for the same reason. However, I'm using exim using dovecot_login for authentication, and that would authenticate the user with a blank and allow me to be used as an open relay. This is clearly a config issue on my part (since fixed), but should dovecot_login guard against blank passwords or system users just as a normal login does? I'm running dovecot 2.2.36 (1f10bfa63) Exim version 4.96 I don't know which software supplies the dovecot_login connenector. The SMTP session would include AUTH LOGIN 334 VXNlcm5hbWU6 cG9zdGZpeA== 334 UGFzc3dvcmQ6 <-- nothing, just a return here 235 Authentication succeeded DONE

2 1

Special authentication use case
by Philippe MARASSE 17 Feb '23

17 Feb '23

Folks, I'm trying to configure dovecot SASL with two use cases : - First with XOAUTH2 : I've managed to get it working, pretty right out of the box, developers have done a great job :-) - Second with Client TLS Certificate with no luck. Let me explain, the certificate brought by the client does not have any clue of associated email, I have to check that username (=email) sent by the client is really related to some information included in the certificate (I have to extract the OU and then lookup into a table of authorized mails for that OU). Is it possible to do that with dovecot ? I think yes but I'm looking for direction to achieve that. Lua maybe ? Our configuration : - OS : Debian 11 $ /usr/sbin/dovecot --version 2.3.13 (89f716dc2) Regards. -- Philippe MARASSE Responsable pôle Infrastructures - DSIO Centre Hospitalier Henri Laborit CS 10587 - 370 avenue Jacques Cœur 86021 Poitiers Cedex Tel : 05.49.44.57.19

1 1

Re: SOLVED: Re: Dovecot does not start on MacOS 12.01, and now 13.2.1 - RLIMIT_DATA
by James Brown 17 Feb '23

17 Feb '23

Sorry, replying to an old thread found on mail-archive.com <http://mail-archive.com/>, so it’s not threaded email. https://www.mail-archive.com/dovecot@dovecot.org/msg84776.html I have just installed Dovecot onto Mac Studio running Ventura (macOS 13.2.1) and get the same error with Dovecot 2.3.20: service(log): Fatal: setrlimit(RLIMIT_DATA, 268435456): Invalid argument Adding the ’service log’ stanza to 10-master.conf fixed the issue. Is this still the correct way to handle it? If so it would be great to have it documented somewhere. Just lucky I found the above mail thread. Thanks, James. Hi! That solution is bit overly broad way to solve this, I would instead recommend service log { vsz_limit = 0 } so that only service log is affected. Aki > On 31/10/2021 20:36 Don Feliciano <don.felici...(a)icloud.com> wrote: > > > > A kind person who isn’t on the mailing list share the solution to this with > me: > > default_vsz_limit = 0 > > > > On Oct 28, 2021, at 12:12 PM, Don Feliciano <don.felici...(a)icloud.com> > > wrote: > > > > > > Warning: fd limit (ulimit -n) is lower than required under max. load (256 < > > 1000), because of default_client_limit > > Oct 28 12:08:48 service(log): Fatal: setrlimit(RLIMIT_DATA, 268435456): > > Invalid argument > > > > > > > On Oct 27, 2021, at 11:08 AM, Don Feliciano <don.felici...(a)icloud.com> > > > wrote: > > > > > > I've been happily running Dovecot on my Mac for many years (installed via > > > Homebrew). After upgrading to Monterey (MacOS 12.01), it no longer starts: > > > > > > $ sw_vers > > > ProductName: macOS > > > ProductVersion: 12.0.1 > > > BuildVersion: 21A559 > > > > > > $ uname -a > > > Darwin dfelicia-mac 21.1.0 Darwin Kernel Version 21.1.0: Wed Oct 13 > > > 17:33:23 PDT 2021; root:xnu-8019.41.5~1/RELEASE_X86_64 x86_64 > > > > > > $ sudo dovecot -F > > > Oct 27 10:11:18 service(log): Fatal: setrlimit(RLIMIT_DATA, 268435456): > > > Invalid argument

1 0

Could not override "mail_location" with "userdb_mail" statment in "/etc/passwd"
by Xavier 17 Feb '23

17 Feb '23

Hi, ** Using Dovecot 2.2.22 and Postfix 3.1.0 ** I plan to migrate all accounts on my server from mbox to maildir storage but before i want to make some tests on dedicated accounts. To do so i want to overide the general "mail_location" ( mail_location = mbox:~/mail:INBOX=/var/mail/%u ) with "maildir:~/Maildir" only for some test accounts. To do so i modified my "/etc/passwd" file using something like that : testm2m_mydomain.tld:x:2122:2122::/home/mail/testm2m_mydomain.tld:/bin/false:userdb_mail=maildir:~/Maildir Also tried testm2m_mydomain.tld:x:2122:2122::/home/mail/testm2m_mydomain.tld:/bin/false::userdb_mail=maildir:~/Maildir And as mentioned in the doc (https://wiki.dovecot.org/LDA/Postfix) i added -d "$USER" in my Postfix "mailbox_command" but it don't seem to work (my new mail_location for this test user is is not taken into account). When i try to make an "doveadm user testm2m_mydomain.tld" i get this : 8<-------------------------------- field value uid 2122 gid 2122 home /home/mail/testm2m_mydomain.tld mail mbox:~/mail:INBOX=/var/mail/testm2m_mydomain.tld system_groups_user testm2m_mydomain.tld 8<-------------------------------- My modification is not taken into account ... Any help is welcome ! /Xavier

2 4

dovecot director how to obtain hashed
by tomate aceite 16 Feb '23

16 Feb '23

Morning again! Working with my directors node. Does anybody now how to obtain a list of all users hashes? I know how to obtain for one user example: *doveadm director status user@domain* I am looking to a way or command to take a list of hashed epired (1)#: doveadm director status manolito@mydomain > Current: 10.X.X.108 (expires 2023-02-17 12:17:59) > Hashed: 10.X.X.108 > Initial config: 10.X.X.108 > Where are stored the hashed ? To lock for the info , etc... Thanks in advance!!!

1 0

Error: Broken file dovecot-uidlist
by Sohin Vyacheslav 16 Feb '23

16 Feb '23

Hi All, In mail.log are exists error messages "Error: Broken file /data/mail/vhosts/domain.com/user(a)domain.com/Maildir/dovecot-uidlist line XX: Invalid data: for some email accounts. For example, dovecot-uidlist line 21197: Invalid data: When I open line 21197 in editor: # vim +21197 dovecot-uidlist 1750207 :1676454069.M698819P4439.mail-b,S=963716,W=976359 and then check this file size # ls -l /data/mail/vhosts/domain.com/user@domain.com/Maildir/cur/1676454069.M698819P4439.mail-b,S=963716,W=976359:2,S -rw------- 1 vmail vmail 963716 Feb 15 10:41 I see that size is the same: 963176 bytes. So what exactly mentioned in error message "dovecot-uidlist line 21197: Invalid data:"? -- Best wishes Sohin Vyacheslav

3 6

Corrupted sizes in cache once again
by Tim Evers 15 Feb '23

15 Feb '23

Hi, I run a fairly large Dovecot Installation (around 100k mailboxes) on several servers. gzip compression is on. Every once in a while I get the dreaded "cache corruption" messages in the log: Error: Corrupted record in index cache file /[redacted]/Maildir/dovecot.index.cache: UID 3868: Broken physical size in mailbox INBOX: read(zlib(/[redacted]/Maildir/cur/1674129792.M797543P21755.node2,S=8099,W=8276:2,)) failed: Cached message size smaller than expected (2877 < 8099, box=INBOX, UID=3868) Error: Corrupted record in index cache file /[redacted]/Maildir/dovecot.index.cache: UID 3875: Broken physical size in mailbox INBOX: read(zlib(/[redacted]/Maildir/cur/1674212201.M985809P29112.node2,S=13907,W=14121:2,)) failed: Cached message size smaller than expected (5533 < 8192, box=INBOX, UID=3875) The first entry shows 2877 (size on disk) vs. 8099 (real size unzipped, also in the filename: S=8099). The second entry shows 5533 (size on disk) vs. 8192 - this is not correct in any way. Size on disk is 13907 as noted in the filename. Both mails were delivered trough LMTP and retrieved by the POP3 service. Anyone with an idea what might be happening here? I've read all available info in the doc and in the previous discussions / bug reports, but nothing seems to match my case. And where does that 8192 come from - it looks suspicious? Version is 2.3.7.2 (Ubuntu 20.04) doveconf -n excerpt: protocol lmtp { mail_plugins = " old_stats mail_log notify zlib sieve quota" } protocol imap { mail_max_userip_connections = 50 mail_plugins = " old_stats mail_log notify zlib imap_old_stats quota imap_quota imap_sieve" } protocol pop3 { mail_max_userip_connections = 50 mail_plugins = " old_stats mail_log notify zlib" } Tim

5 12

Error: Corrupted index cache file
by Sohin Vyacheslav 15 Feb '23

15 Feb '23

Hi All, In mail.log exists an error messages "Error: Corrupted index cache file /data/mail/vhosts/domain.com/user(a)domain.com/Maildir/dovecot.index.cache: invalid record size" for some accounts. I tried these steps to fix it: 1. Running commands # doveadm -D -v index -u user(a)domain.com INBOX # doveadm -v force-resync -u user(a)domain.com INBOX after this I saw that the following files are updated in ../Maildir/: dovecot.index.cache dovecot.index.log dovecot-uidlist But after some time error messages occurred again. 2. Added NFS mount option 'nordirplus' to /etc/fstab with remount /data partition, add 'mmap_disable = yes' and 'mail_fsync = always' to 10-mail.conf as advised on https://doc.dovecot.org/configuration_manual/nfs/ (because /data partition mounted via NFS); 3. Renaming 3 files with/without Dovecot service pre-stop. # mv dovecot.index old.dovecot.index # mv dovecot.index.cache old.dovecot.index.cache # mv dovecot.index.log old.dovecot.index.log Unfortunately, all done steps didn't fix issue. What is the proper way to fix corrupted index cache errors? dovecot package: 1:2.2.33.2-1ubuntu4.8 (Ubuntu-18.04). p.s. for some of email accounts also exists error messages "Error: Broken file ../Maildir/dovecot-uidlist line ###: Invalid data:" besides mentioned cache error. -- Best wishes Sohin Vyacheslav

4 7

NFS and performances
by tomate aceite 15 Feb '23

15 Feb '23

Hello, i have some question about NFS, dovecot director, and imap settings. I was reading all dovecot documentation ad mail lists, but some aspect are not clear to me. I am looking for performance / tunning my infra to work in a more efficient way because we experiences some issues some days ago. This is my infra: I got an infra with 2 dovecot-directors and 3 imap backend. I got all the emails stored in a common NFS share filer to all the imap nodes. ( Index are locally stored in each imap node.) My NFS mount options: (0)#: nfsstat -m /data/mail from myipaddress:/export/mail/maildirs > Flags: > rw,nosuid,noexec,noatime,vers=3,rsize=1048576,wsize=1048576,namlen=255,hard,nordirplus,proto=tcp,timeo=600,retrans=2,sec=sys,mountaddr=10.0.0.205,mountvers=3,mountport=20048,mountproto=tcp,local_lock=none,addr=10.0.0.205 > *Questions*: ( https://wiki.dovecot.org/PerformanceTuning , https://doc.dovecot.org/configuration_manual/nfs/ >> i am following these steps ) 1) Is my NFS correct setup with the mount options well optimized ? Not sure if someone is using the same flags that me or got a better recomendation to used. 2) Set *mmap_disable = yes ??? * >> This must be set to yes if you store indexes to shared filesystems. In my case i got them locally in each imap node not in NFS share folder. I got setup mmap_disable = no , is this correct? I think no is the correct option here with indexes locally. because i can read here: https://wiki1.dovecot.org/NFS > > >> High performance NFS setup with indexes on local disk (see below for > benefits): > > mmap_disable = no > 3) Set* mail_fsync = always ???* Documentation: https://wiki.dovecot.org/PerformanceTuning always > > Use fsync after all disk writes. > > Recommended for NFS to make sure there aren’t any delayed write()s. > 3.a) where i can setup this option *mail_fsync = always , *because i run doveconf -n in director, and imap nodes, and they are not showing nothing. 3.b) *In which node ? *Do i need to add the setting in dovecot.conf in *director node or in imap node or in both ?* Not sure if this is the correct way: This is an attemp of setup, not sure if is correct? 0)#: doveconf -n > # 2.3.13 (89f716dc2): /etc/dovecot/dovecot.conf > # Pigeonhole version 0.5.13 (cdd19fe3) > # OS: Linux 5.10.0-20-amd64 x86_64 Debian 11.6 > > mail_debug = yes > mail_fsync = always > mail_max_userip_connections = 20 > mail_nfs_storage = yes > mail_plugins = " notify mail_log" > mail_privileged_group = mail > > > > protocol lmtp { > mail_fsync = always > mail_plugins = " notify mail_log sieve mail_lua push_notification > push_notification_lua" > plugin { > ... > } > 4) Do not set *mail_nfs_index *or *mail_nfs_storage* (i.e. keep them as no) ????? First option make sense but the second one not. https://doc.dovecot.org/settings/core/#core_setting-mail_nfs_storage mail_nfs_storage >>> >>> Default: no >>> >>> Values: Boolean >>> >>> Flush NFS caches whenever it is necessary to do so. >>> >> > This setting should only be enabled if you are using multiple servers > on NFS. > So should be possible to enable this option *mail_nfs_storage = yes ?????* 4) I got this setting in *dovecot-sql.conf ( director ) * driver = mysql > connect = host=myserver.X dbname=maildb user=dovecot > password=XXXXXXXXXXXXXXXX > default_pass_scheme = SHA > password_query = select login as user, crypt_sha1 as password, home as > userdb_home, uid AS userdb_uid, gid AS userdb_gid, > concat(maildir,':INDEX=/data/indexes/',login) as userdb_mail from mailbox > left join aliases on aliases.systemid = aliasid where login = '%u' and > inactive = 0; > user_query = select home, maildir as mail, uid, gid from mailbox left join > aliases on aliases.systemid = aliasid where login = '%u' and inactive = 0; > iterate_query = select distinct login as user from mailbox; > I would like to implement * ITERINDEX* and probably *VOLATILEDIR *but not sure if this is the correct change or if i need to change something into the database. from: password_query = select login as user, crypt_sha1 as password, home as > userdb_home, uid AS userdb_uid, gid AS userdb_gid, > concat(maildir,':INDEX=/data/indexes/',login) as userdb_mail from mailbox > left join aliases on aliases.systemid = aliasid where login = '%u' and > inactive = 0; > to: password_query = select login as user, crypt_sha1 as password, home as > userdb_home, uid AS userdb_uid, gid AS userdb_gid, > concat(maildir,':INDEX=/data/indexes/',login,':ITERINDEX',':VOLATILEDIR=/tmp/%2.256Nu/%u',login) > as userdb_mail from mailbox left join aliases on aliases.systemid = aliasid > where login = '%u' and inactive = 0; > But not sure if is working correctly, * i checked debuging* in my imap node in this way: auth_verbose = yes > auth_verbose_passwords = no > auth_debug = yes > auth_debug_passwords = yes > mail_debug = yes > verbose_ssl = yes > This is the output log: Feb 15 09:32:53 my-imap-server dovecot: auth: Debug: sql(manolo1(a)mydomain,10.X.X.109,<eWEh7bj09N4KAjxt>): cache hit: {SHA}8376922a27e83b9eadcdec3596a70bf6c4db5730#011user=manolo1@mydomain #011userdb_home=/data/mail/tmydomain/users/manolo1#011userdb_uid=700#011userdb_gid=700#011userdb_mail=/data/mail/mydomain/users/manolo1/Maildir/:INDEX=/data/indexes/manolo1@mydomain :ITERINDEX:VOLATILEDIR=/tmp/3a/manolo1@mydomain *Not sure if is correct the output or should i need to change something into the database or this change only afect locally?* 5) *mailbox_list_index = yes ???* Mailbox list indexes can be used to optimize IMAP STATUS commands. They are > also required for IMAP NOTIFY extension to be enabled. > *It is this option necesary to add? in order to work with ITERINDEX option ?* https://www.mail-archive.com/dovecot@dovecot.org/msg75035.html ( i see your answer to this post ) 6) *What is the best way to do a maintenance in a backend?* The last time i flushed all the user in a director from a backend node to do a maintenance, after the maintenance done i rebalanced the director cluster, but the next day when user started tp connect we got high peak I/O , etc with a lot of problems, because new users in this backend node were re-indexes o creating new indexes. *Are there any way to do in a safer way? *Without loosing the hashed for the directors nodes. Thanks in advance!!!!!!!

3 2

Hide local IP from non delivery notifications
by Claudio Corvino 15 Feb '23

15 Feb '23

Hi everyone, I have an external MTA configured with Postfix that delivers email to an internal IMAP/LMTP Dovecot server configured to bind an LDAP to check if users exist. If the user does not exist, my MX sends a non delivery notification, and into the e-mail there's the local IP address of the Dovecot server. I can't find a way to remove or hide that IP, here is an example of line that contains the IP (with X) that I would like to hide/remove: *"The mail system<user@domain>: host hostname.domain.com <http://hostname.domain.com>[XXX.XXX.XXX.XXX] said: 550"* Thanks in advance! Cheers -- Claudio

5 6

crash when trying to upgrade from 2.0.x to 2.3.x
by Eugene M. Zheganin 15 Feb '23

15 Feb '23

Hello, I'm trying to migrate dovecot mail database from 2.0.9 on Linux to 2.3.20 on FreeBSD. I've rsync'd the entire database, grabbed all the configs, changed the paths and permission, but when trying to access the mail from Thunderbird I have reproducible crash in the logs: ===Cut=== Feb 14 17:12:10 it-r-support dovecot[5888]: auth-worker(6378): Debug: mysql(localhost): Finished query 'SELECT maildir, 1143 AS uid, 1143 AS gid FROM mailbox WHERE username = 'zheganin-em(a)alamics.ru' AND active = '1'' in 0 msecs Feb 14 17:12:10 it-r-support dovecot[5888]: auth-worker(6378): Debug: conn unix:auth-worker (uid=143): auth-worker<16>: sql(zheganin-em(a)alamics.ru,192.168.57.177,<oE2zjKn0FTXAqDmx>): Finished userdb lookup Feb 14 17:12:10 it-r-support dovecot[5888]: auth-worker(6378): Debug: conn unix:auth-worker (uid=143): auth-worker<16>: Finished Feb 14 17:12:10 it-r-support dovecot[5888]: auth: Debug: sql(zheganin-em(a)alamics.ru,192.168.57.177,<oE2zjKn0FTXAqDmx>): Finished userdb lookup Feb 14 17:12:10 it-r-support dovecot[5888]: auth: Debug: master userdb out: USER 1282408449zheganin-em(a)alamics.ru maildir=alamics.ru/zheganin-em/ uid=1143 gid=1143 auth_mech=PLAIN auth_token=15cceab95e1251ea97a8e5ff62c70d1b7a76c96f Feb 14 17:12:10 it-r-support dovecot[5888]: imap-login: Login: user=<zheganin-em(a)alamics.ru>, method=PLAIN, rip=192.168.57.177, lip=172.16.11.13, mpid=6405, session=<oE2zjKn0FTXAqDmx> Feb 14 17:12:10 it-r-support dovecot[5888]: imap(zheganin-em(a)alamics.ru)<6405><oE2zjKn0FTXAqDmx>: Panic: file array.c: line 10 (array_idx_modifiable_i): assertion failed: (idx < array->buffer->used / array->element_size) Feb 14 17:12:10 it-r-support dovecot[5888]: imap(zheganin-em(a)alamics.ru)<6405><oE2zjKn0FTXAqDmx>: Fatal: master: service(imap): child 6405 killed with signal 6 (core dumped) ===Cut=== There's an older thread here mentioning that probably doveadm force-resync would help, but it doesn't fix this. Is there something that could be done here ? I've also reported this in the FreeBSD bugtracker, but just in case decided to ask here too. Backtrace: ===Cut=== # lldb /usr/local/libexec/dovecot/imap --core imap-6404.core (lldb) target create "/usr/local/libexec/dovecot/imap" --core "imap-6404.core" Core file '/var/cores/imap-6404.core' (x86_64) was loaded. (lldb) bt * thread #1, name = 'imap', stop reason = signal SIGABRT * frame #0: 0x000000001151133a libc.so.7`__sys_thr_kill + 10 frame #1: 0x0000000011489c74 libc.so.7`__raise + 52 frame #2: 0x000000001153b109 libc.so.7`abort + 73 frame #3: 0x000000001137a336 libdovecot.so.0`___lldb_unnamed_symbol5855 + 150 frame #4: 0x0000000011378ad1 libdovecot.so.0`___lldb_unnamed_symbol5844 + 49 frame #5: 0x0000000011379881 libdovecot.so.0`___lldb_unnamed_symbol5846 + 33 frame #6: 0x0000000011378ceb libdovecot.so.0`i_panic + 187 frame #7: 0x000000001136a514 libdovecot.so.0`array_idx_modifiable_i + 100 frame #8: 0x0000000012054a78 lib20_fts_plugin.so`fts_user_autoindex_exclude + 72 frame #9: 0x0000000012051b3b lib20_fts_plugin.so`fts_mailbox_allocated + 267 frame #10: 0x000000001113ad0b libdovecot-storage.so.0`hook_mailbox_allocated + 155 frame #11: 0x0000000011134491 libdovecot-storage.so.0`mailbox_alloc + 449 frame #12: 0x0000000001044311 imap`cmd_select_full + 353 frame #13: 0x000000000104cd92 imap`command_exec + 178 frame #14: 0x000000000104b64a imap`___lldb_unnamed_symbol1265 + 58 frame #15: 0x000000000104b7b6 imap`___lldb_unnamed_symbol1265 + 422 frame #16: 0x000000000104a151 imap`client_handle_input + 465 frame #17: 0x00000000010488a8 imap`client_input + 120 frame #18: 0x00000000113936df libdovecot.so.0`io_loop_call_io + 111 frame #19: 0x0000000011396214 libdovecot.so.0`io_loop_handler_run_internal + 388 frame #20: 0x0000000011393dea libdovecot.so.0`io_loop_handler_run + 378 frame #21: 0x0000000011393c28 libdovecot.so.0`io_loop_run + 88 frame #22: 0x00000000112f6208 libdovecot.so.0`master_service_run + 24 frame #23: 0x000000000105af67 imap`main + 1383 frame #24: 0x000000000103c11d imap`_start + 269 (lldb) ===Cut=== Same backtrace in GDB: ===Cut=== # gdb /usr/local/libexec/dovecot/imap --core imap-6404.core GNU gdb (GDB) 12.1 [GDB v12.1 for FreeBSD] Copyright (C) 2022 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html> This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type "show copying" and "show warranty" for details. This GDB was configured as "x86_64-portbld-freebsd13.1". Type "show configuration" for configuration details. For bug reporting instructions, please see: <https://www.gnu.org/software/gdb/bugs/>. Find the GDB manual and other documentation resources online at: <http://www.gnu.org/software/gdb/documentation/>. For help, type "help". Type "apropos word" to search for commands related to "word"... Reading symbols from /usr/local/libexec/dovecot/imap... (No debugging symbols found in /usr/local/libexec/dovecot/imap) [New LWP 100485] warning: Could not load shared library symbols for [vdso]. Do you need "set solib-search-path" or "set sysroot"? Core was generated by `dovecot/imap'. Program terminated with signal SIGABRT, Aborted. Sent by thr_kill() from pid 6404 and user 1143. #0 0x000000001151133a in thr_kill () from /lib/libc.so.7 (gdb) bt full #0 0x000000001151133a in thr_kill () from /lib/libc.so.7 No symbol table info available. #1 0x0000000011489c74 in raise () from /lib/libc.so.7 No symbol table info available. #2 0x000000001153b109 in abort () from /lib/libc.so.7 No symbol table info available. #3 0x000000001137a336 in ?? () from /usr/local/lib/dovecot/libdovecot.so.0 No symbol table info available. #4 0x0000000011378ad1 in ?? () from /usr/local/lib/dovecot/libdovecot.so.0 No symbol table info available. #5 0x0000000011379881 in ?? () from /usr/local/lib/dovecot/libdovecot.so.0 No symbol table info available. #6 0x0000000011378ceb in i_panic () from /usr/local/lib/dovecot/libdovecot.so.0 No symbol table info available. #7 0x000000001136a514 in array_idx_modifiable_i () from /usr/local/lib/dovecot/libdovecot.so.0 No symbol table info available. #8 0x0000000012054a78 in fts_user_autoindex_exclude () from /usr/local/lib/dovecot/lib20_fts_plugin.so No symbol table info available. #9 0x0000000012051b3b in fts_mailbox_allocated () from /usr/local/lib/dovecot/lib20_fts_plugin.so No symbol table info available. #10 0x000000001113ad0b in hook_mailbox_allocated () from /usr/local/lib/dovecot/libdovecot-storage.so.0 No symbol table info available. #11 0x0000000011134491 in mailbox_alloc () from /usr/local/lib/dovecot/libdovecot-storage.so.0 No symbol table info available. #12 0x0000000001044311 in cmd_select_full () No symbol table info available. #13 0x000000000104cd92 in command_exec () No symbol table info available. #14 0x000000000104b64a in ?? () No symbol table info available. #15 0x000000000104b7b6 in ?? () No symbol table info available. #16 0x000000000104a151 in client_handle_input () No symbol table info available. #17 0x00000000010488a8 in client_input () No symbol table info available. #18 0x00000000113936df in io_loop_call_io () from /usr/local/lib/dovecot/libdovecot.so.0 No symbol table info available. #19 0x0000000011396214 in io_loop_handler_run_internal () from /usr/local/lib/dovecot/libdovecot.so.0 No symbol table info available. #20 0x0000000011393dea in io_loop_handler_run () from /usr/local/lib/dovecot/libdovecot.so.0 No symbol table info available. #21 0x0000000011393c28 in io_loop_run () from /usr/local/lib/dovecot/libdovecot.so.0 No symbol table info available. --Type <RET> for more, q to quit, c to continue without paging-- #22 0x00000000112f6208 in master_service_run () from /usr/local/lib/dovecot/libdovecot.so.0 No symbol table info available. #23 0x000000000105af67 in main () No symbol table info available. (gdb) ===Cut=== Thanks. Eugene.

2 3

Feature Request: login_trusted_networks to take FQDN
by Sean Gallagher 15 Feb '23

15 Feb '23

In a previous post to this list I described a problem I was having validating client certificates on inet_listener lmtp connections. Subject: "Please Help: Dovecot ssl_ca selection based on remote IP address filtering not working." The problem there was that Dovecot does not "inspect" the subject name on the client certificate on LMTP connections. As such Any valid certificate will pass. In this context "valid" means the same as OpenSSL SSL_set_verify( ,SSL_VERIFY_PEER, ). I.e. the certificate chain is well formed and can be traced back to a trusted root. It does not say anything about the peer's identity. I propose here, that the "login_trusted_networks" setting be allowed to take a domain name - possibly with wildcards. Then the name on the client certificate could be checked against login_trusted_networks in much the same way that web browsers work. If you tell your web browser that you want to connect to www.example.com, the browser will check that the server's certificate matches "www.example.com". In the present case, if you tell Dovecot (through the login_trusted_networks setting) to allow connections from "smtp.example.com", then Dovecot could check the name on the client's certificate matches "smtp.example.com". More generally, example.com could issue client certificates with names matching "*.mua.example.com". Then you could tell Dovecot to allow connections from "*.mua.example.com" through the login_trusted_networks setting. These usages could largely replace the IP host and CIDR subnet usages currently allowed in the login_trusted_networks setting but both could exist side by side. Of course, more elaborate schemes could be devised involving database lookups, but the outlined proposal would be relatively easy to implement and cover a good majority of use cases. The alternative is to force the use of application-specific certificate authorities, or just ignore it and hope that no one knows how to spoof network traffic. That's My two cents... Sean. -- This email has been checked for viruses by AVG antivirus software. www.avg.com

1 0

IMAP folder subscription on Apple/Mac Mail
by Alex 13 Feb '23

13 Feb '23

Hi, We have a user with an iPhone who can't see their maildir mailboxes on dovecot-2.3.20 on fedora37. I've created a "subscriptions" file with all maildir mailboxes with the proper format (converted from mboxes using mb2md), but the user can only see their inbox. It appears this may be a known problem? https://wiki.dovecot.org/Clients Perhaps it's a problem with my "subscriptions" file, despite being able to see all mailboxes using K-9 on my android? Ideas for troubleshooting would be greatly appreciated.

1 1

Re: Pigeonhole Sieve Vacation Reply-To peculiarity with inbound AWS-SES
by Dr. Rolf Jansen 11 Feb '23

11 Feb '23

> Am 08.02.2023 um 20:03 schrieb Michael Peddemors <michael(a)linuxmagic.com>: > > Dovecot vacation message issues.. > Tough for any system to do correctly. > >> The problem here is that inbound mails from third parties utilizing AWS-SES come in with an unpersonalized envelope address and SES takes returns to this as bounce messages and changes the body's From: to „MAILER-DAEMON(a)xx-zzzz-1.amazonses.xn--com-5o0a, which is not even our MAILER-DAEMON but the one of the receiver of our reply. So the receiver gets no chance to know from the headers the identity of whom replied - he may assume it from the context the actual message, though. > > We addressed this by NOT returning vacation messages to systems that don't use 'proper' values in the MAIL FROM.. Eg Mailing Lists, Sender Rewrite schemes, and a slurry of other rules. Who is we? Your organization or the Pigeonhole developers? Actually, the question is, whether this is addressed somewhere in Pigeonhole’s code already? > But the problem is that if you are using the header From, or Reply-To etc, it's too easy to be sending to forged email addresses. > > Vacation bombing attacks for instance.. You got a point here, and of course I want to prevent this. > Now, there are legitimate cases of the MAIL FROM and header from not aligning, so it is best to send to the MAIL FROM addresses.. IF you don't send it to certain MAIL FROM formats, usually by not responding to anything with mailing list identifiers, auto-suppress headers, and a few others, you only end up with clean MAIL FROM to respond to. From the point of the view of our industrial customers, who are operating processes with our chemicals, this consideration is irrelevant. If they inform a production issue by mail to the responsible service technician, they expect an immediate response, since a production stop is unacceptable. OoO notices play a role here, because we would inform alternative addresses and fone numbers for attending the support case. That said, with Pigeonhole, we are almost there. > But if you have an example that is particularly bothering you, and represents your problem, we can walk through that as an example. I send an email from an account of a mail server (Postfix/Dovecot - outbound relay SES) running on an AWS-EC2 instance in São Paulo (Brazil) to another mail address of mine of a mail server (Postfix/Dovecot direct MX) on an AWS-EC2 instance in Frankfurt Germany, and here the Pigeonhole’s vacation reply is activated. In the following I changed my real mail address in Brazil to rolf(a)example.br and the real one in Germany to rolf(a)example.de: The Point of view of the both involved Postfixes of said transactions are: Sender (Brazil): postfix/submission/smtpd[29165]: 97006638E8: client=201-68-62-42.dsl.telesp.net.br[201.68.62.42], sasl_method=CRAM-MD5, sasl_username=rolf(a)example.br postfix/cleanup[29182]: 97006638E8: message-id=<707A1777-8F09-4335-99BA-70C0367C129A(a)example.br> postfix/qmgr[2058]: 97006638E8: from=<rolf(a)example.br>, size=39626, nrcpt=1 (queue active) postfix/smtp[29183]: 97006638E8: to=<rolf(a)example.de>, relay=email-smtp.sa-east-1.amazonaws.com[52.67.192.29]:587, delay=0.37, delays=0.05/0.01/0.13/0.18, dsn=2.0.0, status=sent (250 Ok 010301863b0211fe-9416f5b2-7e18-4c03-a5e5-2204dd7946f8-000000) Receiver (Germany): postfix/smtpd[86956]: connect from d215-2.smtp-out.sa-east-1.amazonses.com[23.249.215.2] postfix/smtpd[86956]: A44AB676E3: client=d215-2.smtp-out.sa-east-1.amazonses.com[23.249.215.2] postfix/cleanup[86957]: A44AB676E3: message-id=<010301863b0211fe-9416f5b2-7e18-4c03-a5e5-2204dd7946f8-000000(a)sa-east-1.amazonses.com> postfix/qmgr[915]: A44AB676E3: from=<010301863b0211fe-9416f5b2-7e18-4c03-a5e5-2204dd7946f8-000000(a)sa-east-1.amazonses.com>, size=40862, nrcpt=1 (queue active) postfix/local[86958]: A44AB676E3: passing <rolf(a)example.de> to transport=lmtp postfix/lmtp[86959]: A44AB676E3: to=<rolf(a)example.de>, relay=mail.example.de[private/dovecot-lmtp], delay=0.94, delays=0.83/0.01/0.04/0.07, dsn=2.0.0, status=sent (250 2.0.0 <rolf(a)example.de> +/goFGgl5mOwUwEAEYr/fg Saved) Sender of the OoO (Germany): postfix/qmgr[915]: 60242676F0: from=<rolf(a)example.de>, size=1177, nrcpt=1 (queue active) postfix/cleanup[86957]: 60242676F0: message-id=<dovecot-sieve-1676027240-343352-0(a)example.de> postfix/pickup[62932]: 60242676F0: uid=xxxx from=<rolf(a)example.de> postfix/smtp[86963]: 60242676F0: to=<010301863b0211fe-9416f5b2-7e18-4c03-a5e5-2204dd7946f8-000000(a)sa-east-1.amazonses.com>, relay=email-smtp.eu-central-1.amazonaws.com[3.74.180.161]:587, delay=0.31, delays=0.01/0.02/0.13/0.15, dsn=2.0.0, status=sent (250 Ok 010701863b022070-bb3e4541-8306-4438-b649-8879ec8ff666-000000) Receiver of the OoO notice (Brazil): postfix/smtpd[29184]: connect from d215-244.smtp-out.sa-east-1.amazonses.com[23.249.215.244] postfix/smtpd[29184]: 5F1346394E: client=d215-244.smtp-out.sa-east-1.amazonses.com[23.249.215.244] postfix/cleanup[29182]: 5F1346394E: message-id=<010301863b022c93-9842f45a-85ec-419f-8199-00e027888394-000000(a)sa-east-1.amazonses.com> postfix/qmgr[2058]: 5F1346394E: from=<>, size=3150, nrcpt=1 (queue active) postfix/local[29185]: 5F1346394E: passing <rolf(a)example.br> to transport=lmtp postfix/lmtp[29186]: 5F1346394E: to=<rolf(a)example.br>, relay=mail.example.br[private/dovecot-lmtp], delay=0.05, delays=0.01/0.01/0.02/0.01, dsn=2.0.0, status=sent (250 2.0.0 <rolf(a)example.br> RRZHGWwl5mMDcgAAjZNhtw Saved) The headers of the received OoO message (I removed the DKIM stuff for clarity) are: Return-Path: <> Delivered-To: rolf(a)example.br Received: from mail.example.br by example.br with LMTP id RRZHGWwl5mMDcgAAjZNhtw (envelope-from <>) for <rolf(a)example.br>; Fri, 10 Feb 2023 08:07:24 -0300 Received: from d215-244.smtp-out.sa-east-1.amazonses.com (d215-244.smtp-out.sa-east-1.amazonses.com [23.249.215.244]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.example.br (Postfix) with ESMTPS id 5F1346394E for <rolf(a)example.br>; Fri, 10 Feb 2023 08:07:24 -0300 (-03) DKIM-Signature: ... X-Sieve: Pigeonhole Sieve 0.5.20 (149edcf2) Message-ID: <010301863b022c93-9842f45a-85ec-419f-8199-00e027888394-000000(a)sa-east-1.amazonses.com> Date: Fri, 10 Feb 2023 11:07:23 +0000 From: MAILER-DAEMON(a)sa-east-1.amazonses.com To: rolf(a)example.br Subject: Out of Office - automatic notice In-Reply-To: <010301863b0211fe-9416f5b2-7e18-4c03-a5e5-2204dd7946f8-000000(a)sa-east-1.amazonses.com> References: <010301863b0211fe-9416f5b2-7e18-4c03-a5e5-2204dd7946f8-000000(a)sa-east-1.amazonses.com> Auto-Submitted: auto-replied (vacation) Precedence: bulk X-Auto-Response-Suppress: All MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit Feedback-ID: 1.sa-east-1.E7DnIghDRHBvwjrx2QL73gyWAj+NYISxiq7bqOVD27E=:AmazonSES X-SES-Outgoing: 2023.02.10-23.249.215.244 Note how there is not a single reference of the real origin of the OoO message, rolf(a)example.de. Instead we see From: MAILER-DAEMON(a)sa-east-1.amazonses.com. The receiver of this message need to guess the real address from the outside context. The actual problem is that Pigeonhole responds to to=<010301863b0211fe-9416f5b2-7e18-4c03-a5e5-2204dd7946f8-000000(a)sa-east-1.amazonses.com> instead of to=<rolf(a)example.de>. Amazon SES of the original sender (not our relay) takes this as a bounce and changes the relevant headers. This is not under our control. Perhaps this could be mitigated by adding a Reply-To: header which informs the original sender. Then the receiver of the OoO noice would at least have a reference to what and whom this is about. Best regards Rolf > On 2023-02-08 13:21, Dr. Rolf Jansen wrote: >> Am 08.02.2023 um 12:57 schrieb Michael Peddemors <michael(a)linuxmagic.com>: >>> On 2023-02-08 07:47, Dr. Rolf Jansen wrote: >>>> Am 08.02.2023 um 12:23 schrieb Michael Peddemors <michael(a)linuxmagic.com>: >>>>> On 2023-02-07 14:57, Dr. Rolf Jansen wrote: >>>>>> Am 07.02.2023 um 19:49 schrieb Michael Peddemors <michael(a)linuxmagic.com>: >>>>>>> On 2023-02-07 13:33, jeremy ardley wrote: >>>>>>>> On 8/2/23 05:08, Dr. Rolf Jansen wrote: >>>>>>>>> Am 07.02.2023 um 17:54 schrieb jeremy ardley<jeremy(a)ardley.org>: >>>>>>>>>> On 7/2/23 22:01, Dr. Rolf Jansen wrote: >>>>>>>>>> To begin with, usage of Amazons Simple Email Service (SES) is mandatory for outgoing mails from AWS-EC2 instances. >>>>>>>>>> I run AWS-EC2 instances using postfix to send a receive mail. They can send direct assuming I set up suitable SPF, but they typically forward mail to another host under my control that is not on AWS to use as the outgoing server. >>>>>>>>> OK, that’s another use case. Many do use a full fledged Postfix/Dovecot installation. However the outgoing port 25 into the internet is blocked by AWS, and therefore we may either use a third party relay for our outgoing emails or may use SES, which is not that bad - except some unusual peculiarities. >>>>>>>>> >>>>>>>> This is off topic, but to be precise: >>>>>>>> - AWS throttles but does not block traffic to a *destination* port 25. >>>>>>>> - The *origin* port on the EC2 instance is an unprivilged port, not port 25 >>>>>>>> - If you use a relayhost you typically send from an unprivilged EC2 port to port 587 on the relay host >>>>>>>> Jeremy >>>>>>> >>>>>>> And if you DO intend to send out to port 25, remember to update the PTR on your EC2 instance. >>>>>> I respond off-list. Generally a good hint but it’s like trying to bath salts (https://en.wikipedia.org/wiki/Bath_salts) when you are taking a shower. >>>>>> https://aws.amazon.com/premiumsupport/knowledge-center/ec2-port-25-throttle/ >>>>>> Although the link text (ec2-port-25-throttle) suggests throttling, it is actually blocking - read the text. This cannot be removed from standard EC2 instances. >>>>>> This also corresponds to my experience. On the console of an AWS-EC2 instance, I entered just now: >>>>>> telnet cyclaero.com 25 >>>>>> This hangs until timeout. At the same time cyclaero.com received emails from the internet on port 25. >>>>>> Trying 3.126.110.101... >>>>>> telnet: connect to address 3.126.110.101: Operation timed out >>>>>> telnet: Unable to connect to remote host >>>>> >>>>> There are a lot of malicous or compromised EC2 instances..It is good they block port by default, and the one day delay before unblocking (you can request it) helps stop those short term spam instances. >>>>> >>>>> Now, wish they blocked port 587 by default ;) >>>>> >>>>> Or at least tracked the attacks. >>>>> >>>>> Strange though, that people still try to set up email on EC2, doesn't make sense, and it isn't the cheapest alternative.

5 8

Please Help: Dovecot ssl_ca selection based on remote IP address filtering not working.
by Sean Gallagher 11 Feb '23

11 Feb '23

Hi All, I hope this is the correct place to post this. If not, apologies. I am in the process of updating my company's email servers and am trying to put Dovecot into an Alpine Linux container, hosted on ProxMox. In my setup, local mail deliveries via LMTP can come from the MSA (for intra-company mail) and an MTA (for inbound mail). The LMTP data is sent over IPv4 and is protected by TLS. Client certificates are used to authenticate sources. I wanted to prevent Dovecot from accepting LMTP from any other source and the method I came up with to do this was to use filtering on the "remote" address. I would create a "Fake" CA that had never signed a certificate and use that to evaluate the certificate presented by incoming connections from addresses other than the two legitimate sources. This would cause all connections from "bad" addresses to be rejected. This seemed simple enough on paper but Dovecot just isn't playing along. It seems that no matter what I do, I cannot get "remote" filtering to switch the "ssl_ca" parameter. I have put together a test bed to demonstrate. I then use openssl s_client to attempt to connect to the test bed container. I've attached the instructions to build the test bed from scratch. In all cases s_client reports "Acceptable client certificate CA names" "CN = Fake CA" I.e. it want's a certificate from the CA that has never signed a certificate and never will. Why not do the obvious thing? I use LDAP to authenticate individual users and the user name will be reported over LMTP. So to use the normal authentication mechanisms to authenticate the connection source, I would need to do two LDAP lookups, one for the connecting machine and one for the mail recipient. It is not clear if this is possible from the documentation.. *Questions:* Is config file filtering broken or am I doing it wrong? Is it possible to provide a different "ssl_ca" based on the remote IP address? Is there an easier way to restrict LMTP connections to specific remote IP addresses? p.s. Filtering just doesn't work like it's supposed to. Someone should look at that (especially multi-level) .. See this: https://dovecot.org/pipermail/dovecot/2016-June/104770.html Any help would be greatly appreciated. I am at my wits' end with this. -- This email has been checked for viruses by AVG antivirus software. www.avg.com

1 1

Why does creating a mailbox create it in all namespaces?
by e 10 Feb '23

10 Feb '23

When I create a mailbox using CREATE, it creates it in all namespaces? Is that supposed to happen? Look: ``` a namespace * NAMESPACE (("" "/")("Other/" "/")) NIL NIL a OK Namespace completed (0.001 + 0.000 secs). a list "" * * LIST (\HasNoChildren) "/" Other * LIST (\HasNoChildren) "/" INBOX a OK List completed (0.001 + 0.000 secs). a create Other/Drafts a OK Create completed (0.003 + 0.000 + 0.002 secs). a list "" * * LIST (\HasNoChildren) "/" Drafts * LIST (\HasChildren) "/" Other * LIST (\HasNoChildren) "/" Other/Drafts * LIST (\HasNoChildren) "/" INBOX a OK List completed (0.001 + 0.000 secs). ``` This is my namespace configuration ``` namespace { prefix = inbox = yes separator = / } namespace { prefix = Other/ separator = / } ``` And dovecot version is 2.3.7.2

2 1

doveadm: Error: Mailbox INBOX: Deleting corrupted cache: Cache file too large
by Ralf Hildebrandt 09 Feb '23

09 Feb '23

Hi! Upon issuing a % doveadm import -u restore(a)backup.invalid mdbox:/home/storage/mdbox I'm getting a: doveadm(restore(a)backup.invalid): Error: Mailbox INBOX: Deleting corrupted cache: Cache file too largea doveadm(restore(a)backup.invalid): Error: Corrupted dbox file /home/restore/mdbox/storage/m.7 (around offset=41602004): msg header has bad magic value doveadm(restore(a)backup.invalid): Error: Corrupted dbox file /home/restore/mdbox/storage/m.8 (around offset=17193748): msg header has bad magic value message -- but the process keeps running! Should I worry? dovecot packages: 2.3.20-3+ubuntu20.04 -- Ralf Hildebrandt Geschäftsbereich IT | Abteilung Netzwerk Charité - Universitätsmedizin Berlin Campus Benjamin Franklin Hindenburgdamm 30 | D-12203 Berlin Tel. +49 30 450 570 155 | Fax: +49 30 450 570 962 ralf.hildebrandt(a)charite.de | https://www.charite.de

1 0

Pigeonhole Sieve Vacation Reply-To peculiarity with inbound AWS-SES
by Dr. Rolf Jansen 08 Feb '23

08 Feb '23

To begin with, usage of Amazons Simple Email Service (SES) is mandatory for outgoing mails from AWS-EC2 instances. The Pro is, it does work and we may utilize email relays with high reputation for our outgoing mails at no additional costs. The Con's are that (A) SES does not relay mails with empty <> MAIL FROM addresses and (B) it fiddles with the envelope addresses of the relayed mails. Anyway this is out of our control, and while I could avoid (A) by switching the e-mail service provider, I still have no control over (B) because this affects replying to emails from others using AWS-SES. Problem A) The empty-MAIL-FROM may be effectively addressed by setting Pigeonhole’s sieve_vacation_send_from_recipient to ‚yes‘. Problem B) Pigeonhole Vacation utilizes the senders envelope address of the inbound message as the reply-address. The problem here is that inbound mails from third parties utilizing AWS-SES come in with an unpersonalized envelope address and SES takes returns to this as bounce messages and changes the body's From: to „MAILER-DAEMON(a)xx-zzzz-1.amazonses.xn--com-5o0a, which is not even our MAILER-DAEMON but the one of the receiver of our reply. So the receiver gets no chance to know from the headers the identity of whom replied - he may assume it from the context the actual message, though. I found the setting sieve_vacation_to_header_ignore_envelope, which was introduced in 2017 (https://dovecot.org/list/dovecot-cvs/2017-August/028917.html) My finding is, that this resolves the problem only half way. For a local workaround, I changed Line 1119 of cmd-vacation.c https://github.com/dovecot/pigeonhole/blob/34431d7a67474c00d5b0554f5d45b867… to: struct smtp_address real_to; if (smtp_address_init_from_msg(&real_to, &reply_to) >= 0) sctx = sieve_smtp_start_single(senv, &real_to, smtp_from, &output); else sctx = sieve_smtp_start_single(senv, smtp_to, smtp_from, &output); That in place and setting sieve_vacation_to_header_ignore_envelope to ‚yes‘, effectively resolves problem B as well. Best regards Rolf Jansen

6 10

Ubuntu packages for 22.04 LTS?
by Ralf Hildebrandt 06 Feb '23

06 Feb '23

Hi! I recently updated from 20.04 -> 22.04 and wondered if packages specifically for 22.04 were available. https://doc.dovecot.org/installation_guide/dovecot_community_repositories/u… doesn't seem list any... Neiter does https://repo.dovecot.org -- Ralf Hildebrandt Geschäftsbereich IT | Abteilung Netzwerk Charité - Universitätsmedizin Berlin Campus Benjamin Franklin Hindenburgdamm 30 | D-12203 Berlin Tel. +49 30 450 570 155 | Fax: +49 30 450 570 962 ralf.hildebrandt(a)charite.de | https://www.charite.de

2 2

problem converting mailbox to maildir with doveadm
by Kenneth Irving 05 Feb '23

05 Feb '23

Hello. I have an email server for testing purposes, using postfix 3.5.17 and dovecot 2.3.13. Initially, I configured postfix to use mailboxes, but now I've changed it to maildir. Emails arrive fine, and dovecot manages them well by pop3 or imap. No problems there. But I still have a lot of emails in different mailboxes which I'd like to convert to maildir. I found mb2md, which seems to do a pretty good job. Once the mailbox is converted, dovecot manages the emails without a problem. But I also wanted to learn how to use doveadm to convert mailboxes to maildir format. I read all the documentation I could find and tried to learn how this command works. I tried different combinations, but couldn't convert mailboxes to maildir. I always get error messages. I've been unable to understand why. I tried to sync, backup, and import, to no avail. I also tried dsync, which seems to have a different syntax, with the same result. Sorry for bothering you, but if you could explain to me how this command works, I'd be very grateful. Example: I have a user, let's say joe, who has a mailbox in /var/mail/joe and I'd like to transfer those emails to /home/joe/Maildir How do I use doveadm in this situation? Best regards Kenneth

3 4

IMAP tuning for Outlook 365
by Artur Pydo 02 Feb '23

02 Feb '23

Hello, I'm looking for advices on IMAP config tuning for best user experience with Outlook 365. I'm currently using dovecot 2.3.4.1 (f79e8e7e4) provided with Debian 10. One of my users has Outlook 365 and an IMAP mailbox of large size with several folders (more than 3GB). From time to time as his main inbox folder is growing he can see some problems with its Outlook application. Sometimes it freezes during mailbox synchronisation, sometimes he can't see new incoming emails. I wonder if there is some specific workarounds for an up-to-date Outlook in Dovecot or if you can suggests some config setup adjustments (timeouts, idleing ...) to avoid problems in his Outlook. Most of the config are defaults. But I can provide relevant parts of the config if needed. I have this workaround activated for a long time: imap_client_workarounds = delay-newmail By the way, I also have a big IMAP mailbox. Can't see any server specific problem while connecting with Thunderbird to this Dovecot server. -- Best regards, Artur

4 3

Dovecot gzip u.files on sdboxes
by Jose Celestino 01 Feb '23

01 Feb '23

Hi, I was wondering if it's possible to lighten the process of converting sdbox mailboxes to zlib by, instead of using dsync (that brings much more io, copying from alt - and copying of unneeded data as we have many mails already compressed from activating zlib a couble of years ago) just compressing each of the u files. By compression of the u files I mean opening the uncompressed u file for reading, a u.temp file for writting and: 1. copy the dbox message header from u to u.tmp 2. compress the plain message and write it to u.tmp 3. fix the message_size_hex on the u.tmp dbox message header to the new, compressed size 4. copy the dbox metadata from u to u.tmp with Zphysical_size added 5. copy the u stat times to u.tmp 6. replace u with u.tmp Is the message_size_hex stored anywhere else (indexes) that may cause this to not work? Thank you.

2 1

Add Userdb extra field to existing configuration settings, not overriding them
by Stefano Cecconello 27 Jan '23

27 Jan '23

Hi, If i understood correctly the extra field feature ( https://doc.dovecot.org/configuration_manual/authentication/user_database_ex tra_fields/ ), any extra field that is passed from a SQL query will overwrite any existing settings on the dovecot.conf configuration file ( if present ) . For example, if i want to enable a plugin ( ex: acl ) on a per user basis, i would add a column\field ( ex: "acl_enabled" = 1 ) into my auth DB , then add into the dovecot password\user queries : . IF(acl_enabled = 0, NULL, 'acl imap_acl') AS mail_plugins . While having in the dovecot.conf this setting : . mail_plugins = quota notify protocol imap mail_plugins = $mail_plugins imap_quota . >From my test, this combination will lead to having the logging users with acl_enabled=1, a mail_plugins list of acl and imap_acl only, without the quota and notify plugins . If i change the acl_value to 0, the returned mail_plugins list is empty and it will not overrive\overwrite the dovecot.conf mail_plugins configuration . If it's correct, there is a way to merge both settings, like having in the dovecot.conf a minimal\base subset of settings and adding any additional values via SQL queries ? Thanks and best regards Stefano

2 1

sieve_extprograms plugin calling bash script
by Tom 27 Jan '23

27 Jan '23

I receive an email a few times a week containing a URL for a live stream which starts within a minute after receiving the email. I want to automate capturing the whole stream. I've been trying to write a sieve script which uses the sieve extprograms plugin to call a bash script that parses the URL from the email and passes it to a capture program. So far I've had no luck getting the bash script to call _any_ external programs. I can't even write a file to /tmp/, so it's not a filesystem permissions issue. The sieve script has no issues finding and executing the bash script, it just does nothing other than return an exit code. Does sieve put the extprogram script in some kind of sandbox where it has no access to the system? This may not be the best place to find answers to sieve plugin info. If so, can someone point me in the right direction?

3 2

How do you scale dovecot for good performance with Roundcube webmailer in front? (hitting limits without exhausting resources)
by Malte Schmidt 27 Jan '23

27 Jan '23

Good day, I am currently setting up/debugging a webmailer-only setup using Roundcube (latest version) with Dovecot (2.3.20, latest as of now). Generally speaking the setup performs OK, I wrote a JMeter Roundcube script to test the Roundcube. This includes actions like listing mails and fetching them. I am hitting a somehow dubious limit of 600 req/s though. (This includes all kinds of HTTP calls to Roundcube, not only the ones triggering IMAP). When the dovecot becomes unavailable, the performance without mails jumps to 7700 req/s. Testing is done with 4 JMeter-servers and one client. My setup is a Dovecot with MySQL (Percona XtraDB) backend. Mails are encrypted with mail_crypt and EC keys. Authentication is done in parallel (auth_cache_verify_with_workers=yes). Where possible min_available_processes have been set equal to the threads available on the Dovecot machine (64). Hardware is a 64 thread Xeon CPU at 2.10 GHz, 96 GB RAM, SSDs as backing storage IOPS read 40000/write 13000. What settings do you recommend and how was your experience with Roundcube and its performance in general (what should be possible with that kind of HW?)? Best regards and thanks in advance!

3 3

[REVISIONS] How to install SSL Certificate on Dovecot and Postfix
by Turritopsis Dohrnii Teo En Ming 27 Jan '23

27 Jan '23

Subject: [REVISIONS] How to install SSL Certificate on Dovecot and Postfix Good day from Singapore, Author: Mr. Turritopsis Dohrnii Teo En Ming (TARGETED INDIVIDUAL) Country: Singapore Date of Implementation: 6 Jan 2023 Friday SECTION ON DOVECOT =================== # cd /etc/dovecot/conf.d # nano 10-ssl.conf ssl = yes ssl_cert = </home/teo-en-ming-corp/2023.crt ssl_key = </home/teo-en-ming-corp/2023.key ssl_ca = </home/teo-en-ming-corp/inter2023.crt # nano /etc/dovecot/dovecot.conf protocols = imap pop3 !include conf.d/*.conf SECTION ON POSTFIX =================== # nano /etc/postfix/main.cf smtpd_use_tls = yes smtpd_tls_auth_only = yes smtpd_tls_key_file = /etc/postfix/2023.key smtpd_tls_cert_file = /etc/postfix/chain2023.crt smtpd_tls_CAfile = /etc/postfix/inter2023.crt Note: chain2023.crt is made by combining 2023.crt and inter2023.crt # nano /etc/postfix/master.cf submission inet n - n - - smtpd smtps inet n - n - - smtpd tlsmgr unix - - n 1000? 1 tlsmgr That's all. Regards, Mr. Turritopsis Dohrnii Teo En Ming Targeted Individual in Singapore Blogs: https://tdtemcerts.blogspot.com https://tdtemcerts.wordpress.com

1 0

LDAP scheme for Dovecot
by Daniel Betschart 24 Jan '23

24 Jan '23

I use an LDAP server for user administration, the users can manage themselves with the LDAP Account Manager (LAM). I would like to give the possibility to be able to define the quota per user. LAM provides support for certain schemes, but the qmail scheme is missing in the free variant. So I used the Courier scheme. Now, while LAM correctly stores the value in bytes, it appends the letter S. Unfortunately, the mail server Dovecot cannot do anything with this letter S. Is there a better scheme for Dovecot? I haven't found any until now. Or can I remove the letter S at the end in the Dovecot configuration file via regex?

1 0

Why does doveadm always run doveconf?
by Bert Van de Poel 21 Jan '23

21 Jan '23

Dear fellow Dovecot users, I've recently been aiding in the fixing up of the old dovecot_stats_ munin plugin. Currently, it still parses the output of doveadm oldstats, as it is quite an old script. Regardless of any feelings we may all have about oldstats, I was quite surprised to find that doveadm requires quite broad privileges (in my case root privileges) to function properly. It seems that any call to doveadm, even for "doveadm oldstats dump domain" runs doveconf and will attempt to fully parse my configuration including trying to read SSL/TLS certificates. Due to this choice, the fact the FIFO of oldstats can be given low privileges, doveadm still has to be invoked with high privileges or it will fail at the stage of verifying configuration. Now I'm wondering why it's the case that a command such as "doveadm oldstats dump domain" is invoking doveconf and therefore has these kinds of limitations. While for basically all non-stats functions of doveadm, running as root (or similar) makes a lot of sense, I'd argue it doesn't for oldstats (and maybe also the new stats?), which simply talk to a socket. Is there a certain reasoning behind this, or is this accidental behaviour because of the standard operations doveadm always performs? Any elaboration would be more than welcome! Kind regards, Bert

2 3

Different username for passdb and userdb
by support+dovecot＠shellworld.net 21 Jan '23

21 Jan '23

Hello I am attempting to use an external IMAP server for authentication, on Dovecot 2.3.16 (7e2e900c1a), running on Ubuntu 22.04. The external server requires usernames of the format: user@domain However, my local users, where the mail is actually drawn from, are of the format: user (passwd file driven). I was able to log in with just "user", and have it both authenticate remotely, and access local mail, using: passdb { driver = imap args = host=remotehost.com ssl=imaps port=993 user=%n@%d ssl_ca_dir=/etc/ssl/certs } userdb { driver = passwd args = blocking=no } However, the remote SMTP server, which I will not be proxying, requires the same user@domain format for usernames. I would rather not ask users to use "user@domain" for SMTP, and "user" for IMAP. They should only have to use "user@domain" for login everywhere. Is there a way to do this? The docs suggest so (AuthDatabase.PasswdFile.txt), but if so I must be botching it. Things I have tried: passdb { driver = imap args = host=remotehost.com ssl=imaps port=993 ssl_ca_dir=/etc/ssl/certs } userdb { driver = passwd args = blocking=no override_fields = username_format=%n } I also tried: override_fields = user=%n Or, alternatively to any override_fields: args = blocking=no username_format=%n Lastly, I even tried this whole different approach: userdb { driver = passwd-file args = blocking=no username_format=%n /etc/passwd } The following is logged no matter which of those I try: auth: imapc(remotehost.com:993): Connected to #.#.#.#:993 (local #.#.#.#:35088) auth: Error: passwd(user(a)domain,#.#.#.#,<...>): user not found from userdb imap(274049): Error: auth-master: login: request [...]: Login auth request failed: Authenticated user not found from userdb, auth lookup id=... (auth connected 10 msecs ago, request took 1 msecs, client-pid=274038 client-id=1) imap-login: Disconnected: Internal login failure (pid=274038 id=1): user=<user@domain>, method=PLAIN, rip=#.#.#.#, lip=#.#.#.#, mpid=274049, TLS, session=<...> (The last attempt got a slightly varied log message, but quite similar: auth: Error: passwd-file(user(a)domain#.#.#.#,<...>): user not found from userdb ) Any help with this would be much appreciated. Thanks! Luke

1 1

submission_host auth
by k v 18 Jan '23

18 Jan '23

When using dovecot container with sieve plugin there is no sendmail to use for sending email for sieve redirect action for example. We can use submission_host instead https://doc.dovecot.org/settings/core/#core_setting-submission_host but there is no way to specify credentials for auth in remote MTA. Submission_relay_* settings e.g. submission_relay_master_user relate to dovecot submission service. Using something like permit_mynetworks in remote MTA is not acceptable for security reasons. Is it possible to add authorization in the remote MTA using submission_host?

2 4

dovecot replication - new and cur folders on mx1 and mx2
by Tomaz Kavcic 18 Jan '23

18 Jan '23

Hello, I have a question in regards to specific dovecot replication behaviour and I'm just wondering if this is actually an expected/normal behaviour, or just a version issue. I'm using dovecot 2.3.16 which is packed by default with latest Ubuntu 22.04.1 LTS server release. I setup dovecot replication pair (mx1 - mx2) which is working ok. MX1 has priority 10, MX2 has priority 20. I use maildir (postfix + dovecot lmtp). The "strange" behaviour is this. When new mail arrives, it's by default delivered into "new" folder inside user directory. This email is then replicated to both servers (mx1 and mx2). When I login to mx1 via IMAP client (roundcube, outlook, etc.) that specific email is moved from "new" to "cur" folder on server mx1 and it's flagged also with "S", which probably means read flag. On server mx2, that email filename is also flagged with "S", but the email stays inside the "new" folder and it's not moved to "cur". If I want this email to be moved to "cur" on mx2 server, I have to login to that IMAP server as well, click on that email (which is already flagged as read), and after click, the email is also moved to "cur" on server mx2. Simply said, all new mails on mx1 server are moved to "cur" when accessed, but the stay in "new" folder on server mx2 until they're physically accessed there as well. Is this normal behaviour? I tried setup with TCP and SSH replication, and the situation is the same in all cases. Lastly, I tried TCPS (with SSL) as well, but that option has issues in 2.3.16, which is probably known already as I found multiple posts about these issues in this version. Thank you in advance for your answer and kind regards, Tomaz Kavcic. --- As suggested by mr. Timo Sarainen, this should be synced, so I'm posting doveconf -n as attachment for both servers as well.

3 3

Quota Clone Plugin
by MK 17 Jan '23

17 Jan '23

Hello Everybody, just a short question, maybe someone used this plugin and can give me a short answer. I have configured dovecot Quota Clone Plugin to copy quota information into a MySQL Database. Works finde, but dovecot writes the quota information only to the database if the quota is triggert by new email or something else like this. So I don't have all my user in the MySQL Database. Is there any command I can use that can trigger dovecot to write the quota information of all the users to the database one time, so that I have all my user quota information copied in the database? I have tried "doveadm quota recalc -A" but it took quite a long time and there is a very high I/O Load on the server, so I stopped it. I don't think this is what I want to do. Maybe there is another way. For all of you who don't know this plugin. https://doc.dovecot.org/configuration_manual/quota_clone_plugin/ Greetings, Oliver

3 3

hostname in director_mail_servers setting
by k v 16 Jan '23

16 Jan '23

director_mail_servers setting uses IP Adresses as values https://doc.dovecot.org/settings/core/#core_setting-director_mail_servers As described in the documentation, hostnames are converted to addresses when the configuration is read https://doc.dovecot.org/settings/types/#ip-addresses This is acceptable in host or virtual machine environment, but becomes a problem in a containerized environment. When any backend container is restarted, its address will change and users related to this backend can no longer connect, but backend (available with new IP address) can process request for example, director_mail_servers = dovecot-1 dovecot-2 dovecot-3 becomes in runtime (with one successfully connectetd user foo(a)example.com) doveadm director status mail server ip tag vhosts state state changed users 10.0.71.3 100 up - 0 10.0.71.4 100 up - 1 10.0.71.5 100 up - 0 where dovecot-1 10.0.71.3, dovecot-2 10.0.71.4, dovecot-3 10.0.71.5 When dovevecot-2 backend container restarts, and becomes new IP address, user can't connect to related backend: imap-login: Info: proxy(foo@example.com,10.0.71.4:143): Started proxying to <10.0.71.4> (<dovecot-2>) (0.009 secs) imap-login: Error: proxy(foo@example.com,10.0.71.4:143): connect(10.0.71.4, 143) failed: No route to host (after 28 secs, 3 reconnects, local=10.0.71.13:41066) My suggestion to developers: resolve backend hostnames to IP address on every request to director_mail_servers It's not about dovemon service with active health checks from dovecot pro, just dynamic hostname resolve

2 1

Error: Mailbox INBOX: file_dotlock_create in directory /var/mail failed: Permission denied
by manmatha 16 Jan '23

16 Jan '23

Hi All, We are running Round cube on top of dovecot and postfix as our email echo system. Main problem we are facing is that, roundcube loads really slow for big inboxes (~5000 emails). I found that, while it loads, imap process goes high in terms of CPU utilization(~90%). I asked it in some roundcube support group, They believe that it is related to dovecot not roundcube. Can you shed any light on this issue. Thanks in advance. Here is $dovecot -n$ output xyz@roundcube-internal-server-1:/etc/dovecot$ dovecot -n # 2.3.16 (7e2e900c1a): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.16 (09c29328) # OS: Linux 5.15.0-1024-kvm x86_64 Ubuntu 22.04.1 LTS # Hostname: roundcube-internal-server-1 auth_mechanisms = plain login disable_plaintext_auth = no listen = * lock_method = dotlock mail_always_cache_fields = date.received mail_cache_min_mail_count = 5000 mail_location = mbox:~/mail:INBOX=/var/mail/%u:INDEX=/var/indexes/isical.ac.in/%n mail_privileged_group = mail mail_sort_max_read_count = 100 mailbox_list_index_include_inbox = yes mailbox_list_index_very_dirty_syncs = yes maildir_very_dirty_syncs = yes mbox_dotlock_change_timeout = 1 mins mbox_lazy_writes = no mbox_write_locks = dotlock fcntl namespace inbox { inbox = yes location = prefix = } passdb { driver = pam } protocols = imap pop3 ssl_cert = </etc/dovecot/private/dovecot.pem ssl_client_ca_dir = /etc/ssl/certs ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { driver = passwd } protocol !indexer-worker { mail_vsize_bg_after_count = 100 } On a different note we are getting error occasionally of the following type. I dont know if they are related. Jan 16 15:36:13 roundcube-internal-server-1 dovecot: imap(xyz)<361270><aqauu17ycsvAqL8/>: Error: unlink(/var/mail/xyz.lock) failed: Permission denied (in file-dotlock.c:195) Jan 16 15:36:13 roundcube-internal-server-1 dovecot: imap(xyz)<361270><aqauu17ycsvAqL8/>: Error: unlink(xyz.lock) failed: Permission denied (in file-dotlock.c:195) Jan 16 15:36:13 roundcube-internal-server-1 dovecot: imap(xyz)<361270><aqauu17ycsvAqL8/>: Error: Mailbox INBOX: file_dotlock_create(xyz) in directory /var/mail failed: Permission denied (euid=10865(xyz) egid=8(mail) missing +w perm: /var/mail, UNIX perms appear ok (ACL/MAC wrong?), dir owned by 0:8 mode=0771)

2 1

Up to date dovecot packages on Ubuntu 22.4LTS
by Gerben Wierda 12 Jan '23

12 Jan '23

I just found out that Ubuntu Linux 22.04 LTS has a dovecot apt package that is 2.3.16. Debian 11 (stable) is at dovecot 2.3.13 with apt. if I looked correctly. Dovecot itself is at 2.3.20. That surprised me (I am new to the Linux distro and package management world) as Ubuntu 22.04 is a Long-Time Support version, and I was expecting packages to be updated as well (as many users will want updated packages. How does that work in the dovecot world? How come macOS MacPorts (2.3.19) has more recent packages than any of the large Debian-based Linuxes? Gerben Wierda (LinkedIn <https://www.linkedin.com/in/gerbenwierda>) R&A IT Strategy <https://ea.rna.nl/> (main site) Book: Chess and the Art of Enterprise Architecture <https://ea.rna.nl/the-book/> Book: Mastering ArchiMate <https://ea.rna.nl/the-book-edition-iii/>

3 2

director: pass different username to proxy than the one that is used for hashing
by alex 12 Jan '23

12 Jan '23

dovecot 2.3.13 Hi, I'm looking for a way to make director use a user@domain that is returned by the database for hashing but actually send the original user@domain in the proxied request. I cannot seem to find a way. I can change the name used for hashing by just returning a different user from the db. but that user is also the one that is send in the proxied request. this is what I have so far: director_username_hash = %L{user} # relevant sql: password_query = SELECT \ username as user, \ # -> this is used for hashing if destuser is not present. = OK NULL as password, \ 'y' as proxy, \ 'y' as nopassword, \ '%n@%d' as destuser \ # -> but as soon as I add this, this is used for hashing = !OK FROM dovecot_data('%n', '%d') Anyone know any clever tricks to accomplish this? Thanks! Alex (background: I've inherited a mail setup where mailboxes have multiple logins. (those all share the same 'home' for their maildirs). I need all of these to go to the same server. Most ideal would be hashing on home '%h' instead of %u :)).

1 0

Living without fdpass / SCM_RIGHTS
by Dengler, Gabriel 10 Jan '23

10 Jan '23

Hello everyone, I wanted to run Dovecot inside Gramine [1]. Gramine is a tool to let normal Linux binaries run with the help of the Intel Software Guard Extensions (SGX) technology [2] in a secure enclave to which the operating system doesn't have an access to. Most parts of Dovecot now run fine, however, Dovecot uses the SCM_RIGHTS flag for the sendmsg system call to exchange file descriptors over Unix sockets [3]. Normally, this feature is available in every Unix, but in Gramine, this is currently not supported [4]. So, according to the logs, the authentication works, but after that, the imap-login process cannot exchange the file descriptor with the imap process. Therefore I wanted to ask if there is a possibility to make Dovecot work without this feature or if this would need fundamental changes in the code structure. Thanks for your help in advance! Best regards, Gabriel References: [1] https://gramineproject.io/ [2] https://de.wikipedia.org/wiki/Software_Guard_Extensions [3] https://github.com/dovecot/core/blob/main/src/lib/fdpass.c#L128 [4] https://github.com/gramineproject/gramine/discussions/1013#discussioncommen…

1 0

Dovecot - mail_crypt - lmtp-server - no password to decrypt the key
by Baljeet Bhinder 09 Jan '23

09 Jan '23

I have been using postfix+dovecot successfully for a while now until I tried mail crypt plugin lately. I tried what is describe here https://doc.dovecot.org/configuration_manual/mail_crypt_plugin/ and I went for global-keys as described here: https://doc.dovecot.org/configuration_manual/mail_crypt_plugin/#global-keys /"A good solution for environments where no user folder sharing is needed is to generate per-user EC key pair and encrypt that with something derived from user’s password."/ I am setting mail_crypt_global_private_key, mail_crypt_global_public_key, mail_crypt_save_version from user_query and userdb_mail_crypt_global_private_key_password from password_query. mail_crypt seems to work fine in imap (I saved a message as draft and it is stored encrypted on the disk), but lmtp complains about "mail_crypt_global_private_key_password unset, no password to decrypt the key" As you can see below in logs that it was able to set all other mail_crypt_ configurations successfully from user_query. However, the password is provided via password_query and I assume lmtp does not read password_query. How else can I provide a password in lmtp? Is my approach correct to begin with? -- Dovecot Configurations -- # using doveconf -n # 2.3.19.1 (9b53102964): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.19 (4eae2f79) # OS: Linux 5.15.0-57-generic x86_64 Ubuntu 20.04.5 LTS # Hostname: mailserver-dovecot-7c9ff7b94b-8ldrr auth_mechanisms = plain login auth_verbose = yes auth_verbose_passwords = yes debug_log_path = /dev/stdout haproxy_trusted_networks = 192.168.0.0/16 10.10.10.0/24 10.10.30.0/24 172.17.0.1/16 hostname = imap.mailserver.k8s.local pop.mailserver.k8s.local info_log_path = /dev/stdout listen = * log_path = /dev/stdout mail_debug = yes mail_gid = 1000 mail_home = /var/vmail/mailboxes/%d/%n mail_location = maildir:~/:LAYOUT=fs mail_plugins = quota mail_crypt mail_privileged_group = mail mail_uid = 1000 managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext imapsieve vnd.dovecot.imapsieve namespace inbox { inbox = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Spam { auto = subscribe autoexpunge = 30 days special_use = \Junk } mailbox Trash { auto = subscribe autoexpunge = 30 days special_use = \Trash } prefix = } passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } plugin { imapsieve_mailbox1_before = file:/var/vmail/sieve/global/learn-spam.sieve imapsieve_mailbox1_causes = COPY APPEND FLAG imapsieve_mailbox1_name = Spam imapsieve_mailbox2_before = file:/var/vmail/sieve/global/learn-ham.sieve imapsieve_mailbox2_causes = COPY APPEND FLAG imapsieve_mailbox2_from = Spam imapsieve_mailbox2_name = * mail_crypt_save_version = 0 quota = maildir:User quota quota_exceeded_message = User %u has exhausted allowed storage space. quota_rule = Junk:ignore quota_rule2 = Trash:storage=+100M quota_warning = storage=90%% quota-warning 90 %u %d quota_warning2 = storage=80%% quota-warning 80 %u %d sieve = file:~/sieve;active=~/.dovecot.sieve sieve_before = /var/vmail/sieve/global/spam-global.sieve sieve_global = /var/vmail/sieve/global/ sieve_global_extensions = +vnd.dovecot.pipe +vnd.dovecot.debug sieve_pipe_bin_dir = /var/vmail/sieve/global sieve_plugins = sieve_imapsieve sieve_extprograms } protocols = " imap lmtp sieve pop3" service auth { inet_listener { port = 25252 } } service imap-login { inet_listener imap { haproxy = yes } inet_listener imaps { haproxy = yes ssl = yes } } service lmtp { executable = lmtp -L inet_listener lmtp { address = 0.0.0.0 port = 24 } } service managesieve-login { inet_listener sieve { port = 4190 } } service pop3-login { inet_listener pop3 { haproxy = yes } inet_listener pop3s { haproxy = yes } } ssl = required ssl_cert = </etc/dovecot/certs/tls.crt ssl_client_ca_dir = /etc/ssl/certs ssl_key = # hidden, use -P to show it ssl_prefer_server_ciphers = yes userdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } protocol lmtp { info_log_path = /dev/stdout log_path = /dev/stdout mail_plugins = quota mail_crypt sieve postmaster_address = <hidden> } protocol imap { mail_plugins = quota mail_crypt quota imap_quota imap_sieve } -- Dovecot Configurations Ends -- -- Password Query -- password_query = \ SELECT username, domain, password, \ '%{sha256:password}' AS userdb_mail_crypt_global_private_key_password \ FROM mailbox \ WHERE username='%u'; -- Password Query Ends-- -- User Query -- user_query = SELECT CONCAT('*:bytes=', 1024) as quota_rule, \ private_key AS mail_crypt_global_private_key, \ public_key AS mail_crypt_global_public_key, \ mail_crypt_save_version AS mail_crypt_save_version \ FROM mailbox \ WHERE username='%u'; -- User Query Ends -- -- Debug Logs -- --- Load Inbox --- imap-login: Info: Login: user=<someone(a)example.com>, method=PLAIN, rip=192.168.49.1, lip=192.168.49.2, mpid=241, TLS, session=<oaoI9sLxVKXAqDEB> imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: Loading modules from directory: /usr/lib/dovecot/modules imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: Module loaded: /usr/lib/dovecot/modules/lib10_mail_crypt_plugin.so imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: Module loaded: /usr/lib/dovecot/modules/lib10_quota_plugin.so imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: Module loaded: /usr/lib/dovecot/modules/lib11_imap_quota_plugin.so imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: Module loaded: /usr/lib/dovecot/modules/lib95_imap_sieve_plugin.so imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: Added userdb setting: plugin/mail_crypt_global_private_key=LS0tLS1CRUd.....LS0tLS0K imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: Added userdb setting: plugin/mail_crypt_global_private_key_password=<hidden> imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: Added userdb setting: plugin/mail_crypt_global_public_key=LS0tLS1CRUd.....LS0tCg== imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: Added userdb setting: plugin/mail_crypt_save_version=2 imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: Added userdb setting: plugin/quota_rule=*:bytes=1024000000 imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: Effective uid=1000, gid=1000, home=/var/vmail/mailboxes/example.com/someone imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: mail_crypt_plugin: mail_crypt_curve setting missing - generating EC keys disabled imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: Quota root: name=User quota backend=maildir args= imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: Quota rule: root=User quota mailbox=* bytes=1024000000 messages=0 imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: Quota rule: root=User quota mailbox=Trash bytes=+104857600 messages=0 imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: Quota warning: bytes=921600000 (90%) messages=0 reverse=no command=quota-warning 90 someone(a)example.com example.com imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: Quota warning: bytes=819200000 (80%) messages=0 reverse=no command=quota-warning 80 someone(a)example.com example.com imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: Quota grace: root=User quota bytes=102400000 (10%) imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: open(/proc/self/io) failed: Permission denied imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: Namespace inbox: type=private, prefix=, sep=, inbox=yes, hidden=no, list=yes, subscriptions=yes location=maildir:~/:LAYOUT=fs imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: fs: root=/var/vmail/mailboxes/example.com/someone, index=, indexpvt=, control=, inbox=/var/vmail/mailboxes/example.com/someone, alt= imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: quota: quota_over_flag check: quota_over_script unset - skipping imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: Mailbox INBOX: Mailbox opened --- Load Inbox Ends --- --- Lmtp --- lmtp(248): Info: Connect from 172.17.0.1 lmtp(someone(a)example.com)<248><e2dcD6TuumP4AAAALzF/Qw>: Debug: auth-master: userdb lookup(someone(a)example.com): Started userdb lookup lmtp(someone(a)example.com)<248><e2dcD6TuumP4AAAALzF/Qw>: Debug: auth-master: conn unix:/var/run/dovecot/auth-userdb: Connecting lmtp(someone(a)example.com)<248><e2dcD6TuumP4AAAALzF/Qw>: Debug: auth-master: conn unix:/var/run/dovecot/auth-userdb (pid=143,uid=0): Client connected (fd=18) imap(someone(a)example.com)<247><WlggG8PxEOvAqDEB>: Debug: Mailbox Sent: Purging (new file_seq=1673195172): creating cache imap(someone(a)example.com)<247><WlggG8PxEOvAqDEB>: Debug: Mailbox Sent: Purging finished, file_seq changed 0 -> 1673195172, size=0 -> 388, max_uid=0 lmtp(someone(a)example.com)<248><e2dcD6TuumP4AAAALzF/Qw>: Debug: auth-master: userdb lookup(someone(a)example.com): auth USER input: someone(a)example.com quota_rule=*:bytes=1024000000 mail_crypt_global_private_key=LS0tLS1CRUd.....LS0tLS0K mail_crypt_global_public_key=LS0tLS1CRUd.....LS0tCg== mail_crypt_save_version=2 lmtp(someone(a)example.com)<248><e2dcD6TuumP4AAAALzF/Qw>: Debug: auth-master: userdb lookup(someone(a)example.com): Finished userdb lookup (username=someone(a)example.com quota_rule=*:bytes=1024000000 mail_crypt_global_private_key=LS0tLS1CRUd.....LS0tLS0K mail_crypt_global_public_key=LS0tLS1CRUd.....LS0tCg== mail_crypt_save_version=2) lmtp(someone(a)example.com)<248><e2dcD6TuumP4AAAALzF/Qw>: Debug: lmtp-server: conn 172.17.0.1:6376 [1]: rcpt someone(a)example.com: Added userdb setting: plugin/mail_crypt_global_private_key=LS0tLS1CRUd.....LS0tLS0K imap(someone(a)example.com)<247><WlggG8PxEOvAqDEB>: Debug: duplicate db: Initialize lmtp(someone(a)example.com)<248><e2dcD6TuumP4AAAALzF/Qw>: Debug: lmtp-server: conn 172.17.0.1:6376 [1]: rcpt someone(a)example.com: Added userdb setting: plugin/mail_crypt_global_public_key=LS0tLS1CRUd.....LS0tCg== imap(someone(a)example.com)<247><WlggG8PxEOvAqDEB>: Debug: sieve: Pigeonhole version 0.5.19 (4eae2f79) initializing lmtp(someone(a)example.com)<248><e2dcD6TuumP4AAAALzF/Qw>: Debug: lmtp-server: conn 172.17.0.1:6376 [1]: rcpt someone(a)example.com: Added userdb setting: plugin/mail_crypt_save_version=2 lmtp(someone(a)example.com)<248><e2dcD6TuumP4AAAALzF/Qw>: Debug: lmtp-server: conn 172.17.0.1:6376 [1]: rcpt someone(a)example.com: Added userdb setting: plugin/quota_rule=*:bytes=1024000000 lmtp(someone(a)example.com)<248><e2dcD6TuumP4AAAALzF/Qw>: Debug: lmtp-server: conn 172.17.0.1:6376 [1]: rcpt someone(a)example.com: Effective uid=1000, gid=1000, home=/var/vmail/mailboxes/example.com/someone lmtp(someone(a)example.com)<248><e2dcD6TuumP4AAAALzF/Qw>: Debug: lmtp-server: conn 172.17.0.1:6376 [1]: rcpt someone(a)example.com: mail_crypt_plugin: mail_crypt_curve setting missing - generating EC keys disabled lmtp(someone(a)example.com)<248><e2dcD6TuumP4AAAALzF/Qw>: Debug: lmtp-server: conn 172.17.0.1:6376 [1]: rcpt someone(a)example.com: Quota root: name=User quota backend=maildir args= lmtp(someone(a)example.com)<248><e2dcD6TuumP4AAAALzF/Qw>: Debug: lmtp-server: conn 172.17.0.1:6376 [1]: rcpt someone(a)example.com: Quota rule: root=User quota mailbox=* bytes=1024000000 messages=0 lmtp(someone(a)example.com)<248><e2dcD6TuumP4AAAALzF/Qw>: Debug: lmtp-server: conn 172.17.0.1:6376 [1]: rcpt someone(a)example.com: Quota rule: root=User quota mailbox=Trash bytes=+104857600 messages=0 lmtp(someone(a)example.com)<248><e2dcD6TuumP4AAAALzF/Qw>: Debug: lmtp-server: conn 172.17.0.1:6376 [1]: rcpt someone(a)example.com: Quota warning: bytes=921600000 (90%) messages=0 reverse=no command=quota-warning 90 someone(a)example.com example.com lmtp(someone(a)example.com)<248><e2dcD6TuumP4AAAALzF/Qw>: Debug: lmtp-server: conn 172.17.0.1:6376 [1]: rcpt someone(a)example.com: Quota warning: bytes=819200000 (80%) messages=0 reverse=no command=quota-warning 80 someone(a)example.com example.com lmtp(someone(a)example.com)<248><e2dcD6TuumP4AAAALzF/Qw>: Debug: lmtp-server: conn 172.17.0.1:6376 [1]: rcpt someone(a)example.com: Quota grace: root=User quota bytes=102400000 (10%) lmtp(248): Error: lmtp-server: conn 172.17.0.1:6376 [1]: rcpt someone(a)example.com: Failed to initialize user: mail_crypt_plugin: mail_crypt_global_private_key: mail_crypt_global_private_key_password unset, no password to decrypt the key lmtp(248): Info: Disconnect from 172.17.0.1: Logged out (state=READY) --- Lmtp Ends --- -- Debug Logs Ends -- Thanks Baljeet Bhinder

3 3

Keycloak Authorization Code Flow
by Gary Horchem 08 Jan '23

08 Jan '23

Can dovecot use Keycloak Authorization Code Flow? I would like to use it instead of Password Resource Grant Flow for better security. Sent from my iPhone

1 0

How to set otp one time password
by weihao.chen＠artisantechnologies.cn 07 Jan '23

07 Jan '23

Dear Everybody: May I ask how to configure dovecot otp one-time verification login, that is, after the user logs in to the mailbox with the password + otp, he can send and receive emails without entering the password + otp again? # This is my settings: # /etc/dovecot/conf.d/10-auth.conf disable_plaintext_auth = yes auth_cache_size = 10M auth_failure_delay = 5 secs auth_ssl_username_from_cert = yes auth_mechanisms = otp !include auth-ldap.conf.ext error logs: ------------------------------- 6952-Jan 06 18:03:01 master: Info: Dovecot v2.3.19.1 (9b53102964) starting up for imap, lmtp (core dumps disabled) 6953-Jan 06 18:03:02 auth: Debug: Loading modules from directory: /usr/lib/dovecot/auth 6954-Jan 06 18:03:02 auth: Debug: Module loaded: /usr/lib/dovecot/auth/lib20_auth_var_expand_crypt.so 6955:Jan 06 18:03:02 auth: Fatal: OTP mechanism can't be supported with given passdbs 6956-Jan 06 18:03:02 master: Error: service(auth): command startup failed, throttling for 2.000 secs 6957-Jan 06 18:03:02 imap-login: Info: Disconnected: Auth process broken (disconnected before auth was ready, waited 0 secs): user=<>, rip=172.30.20.51, lip=172.16.5.111, TLS handshaking, session=<OiDkhZXx7fasHhQz> 6958-Jan 06 18:03:07 auth: Debug: Loading modules from directory: /usr/lib/dovecot/auth 6959-Jan 06 18:03:07 auth: Debug: Module loaded: /usr/lib/dovecot/auth/lib20_auth_var_expand_crypt.so 6960:Jan 06 18:03:07 auth: Fatal: OTP mechanism can't be supported with given passdbs 6961-Jan 06 18:03:07 master: Error: service(auth): command startup failed, throttling for 4.000 secs 6962-Jan 06 18:03:07 imap-login: Info: Disconnected: Auth process broken (disconnected before auth was ready, waited 0 secs): user=<>, rip=172.30.20.51, lip=172.16.5.111, TLS handshaking, session=<qgIyhpXx8PasHhQz> 6963-Jan 06 18:03:11 auth: Debug: Loading modules from directory: /usr/lib/dovecot/auth 6964-Jan 06 18:03:11 auth: Debug: Module loaded: /usr/lib/dovecot/auth/lib20_auth_var_expand_crypt.so 6965:Jan 06 18:03:11 auth: Fatal: OTP mechanism can't be supported with given passdbs 6966-Jan 06 18:03:11 master: Error: service(auth): command startup failed, throttling for 8.000 secs 6967-Jan 06 18:03:11 imap-login: Info: Disconnected: Auth process broken (disconnected before auth was ready, waited 3 secs): user=<>, rip=172.30.20.51, lip=172.16.5.111, TLS, session=<gDdvhpXx8/asHhQz> 6968-Jan 06 18:03:19 auth: Debug: Loading modules from directory: /usr/lib/dovecot/auth 6969-Jan 06 18:03:19 auth: Debug: Module loaded: /usr/lib/dovecot/auth/lib20_auth_var_expand_crypt.so 6970:Jan 06 18:03:19 auth: Fatal: OTP mechanism can't be supported with given passdbs 6971-Jan 06 18:03:19 master: Error: service(auth): command startup failed, throttling for 16.000 secs 6972-Jan 06 18:03:19 imap-login: Info: Disconnected: Auth process broken (disconnected before auth was ready, waited 8 secs): user=<>, rip=172.30.20.51, lip=172.16.5.111, TLS, session=<qp7phpXx9PasHhQz> 6973-Jan 06 18:03:29 imap-login: Info: Disconnected: Connection closed (disconnected before auth was ready, waited 5 secs): user=<>, rip=172.30.20.51, lip=172.16.5.111, TLS, session=<N1qAh5Xx/PasHhQz> 6974-Jan 06 18:03:35 auth: Debug: Loading modules from directory: /usr/lib/dovecot/auth 6975-Jan 06 18:03:35 auth: Debug: Module loaded: /usr/lib/dovecot/auth/lib20_auth_var_expand_crypt.so 6976:Jan 06 18:03:35 auth: Fatal: OTP mechanism can't be supported with given passdbs 6977-Jan 06 18:03:35 master: Error: service(auth): command startup failed, throttling for 32.000 secs 6978-Jan 06 18:04:01 master: Warning: Killed with signal 15 (by pid=2692494 uid=0 code=kill) 6979-Jan 06 18:04:02 master: Info: Dovecot v2.3.19.1 (9b53102964) starting up for imap, lmtp (core dumps disabled) 6980-Jan 06 18:04:09 auth: Debug: Loading modules from directory: /usr/lib/dovecot/auth 6981-Jan 06 18:04:09 auth: Debug: Module loaded: /usr/lib/dovecot/auth/lib20_auth_var_expand_crypt.so 6982:Jan 06 18:04:09 auth: Fatal: OTP mechanism can't be supported with given passdbs 6983-Jan 06 18:04:09 master: Error: service(auth): command startup failed, throttling for 2.000 secs 6984-Jan 06 18:04:09 imap-login: Info: Disconnected: Auth process broken (disconnected before auth was ready, waited 0 secs): user=<>, rip=172.30.20.51, lip=172.16.5.111, TLS handshaking, session=<8VrsiZXxFfesHhQz> 6985-Jan 06 18:04:56 auth: Debug: Loading modules from directory: /usr/lib/dovecot/auth 6986-Jan 06 18:04:56 auth: Debug: Module loaded: /usr/lib/dovecot/auth/lib20_auth_var_expand_crypt.so 6987:Jan 06 18:04:56 auth: Fatal: OTP mechanism can't be supported with given passdbs 6988-Jan 06 18:04:56 master: Error: service(auth): command startup failed, throttling for 4.000 secs 6989-Jan 06 18:05:57 auth: Debug: Loading modules from directory: /usr/lib/dovecot/auth 6990-Jan 06 18:05:57 auth: Debug: Module loaded: /usr/lib/dovecot/auth/lib20_auth_var_expand_crypt.so 6991:Jan 06 18:05:57 auth: Fatal: OTP mechanism can't be supported with given passdbs 6992-Jan 06 18:05:57 master: Error: service(auth): command startup failed, throttling for 8.000 secs 6993-Jan 06 18:06:26 master: Warning: Killed with signal 15 (by pid=2692680 uid=0 code=kill) 6994-Jan 06 18:06:27 log(2692602): Warning: Killed with signal 15 (by pid=1 uid=0 code=kill) 6995-Jan 06 18:06:27 master: Info: Dovecot v2.3.19.1 (9b53102964) starting up for imap, lmtp (core dumps disabled) 6996-Jan 06 18:06:47 auth: Debug: Loading modules from directory: /usr/lib/dovecot/auth 6997-Jan 06 18:06:47 auth: Debug: Module loaded: /usr/lib/dovecot/auth/lib20_auth_var_expand_crypt.so 6998-Jan 06 18:06:47 auth: Debug: Read auth token secret from /var/run/dovecot//auth-token-secret.dat 6999-Jan 06 18:06:47 auth: Error: ldap_bind 7000-Jan 06 18:06:47 auth: Error: ldap_simple_bind 7001-Jan 06 18:06:47 auth: Error: ldap_sasl_bind ------------------------------- if option: auth_mechanisms = plain login Can send and receive emails successfully, but when the otp time expires, you need to re-enter the password + otp, which is unacceptable to the user Looking forward to your reply, Tanks -- nick(Weihao) weihao.chen(a)artisantechnologies.cn

2 1

postfix connects to dovecot lmtp socket, but nothing is delivered
by Gerben Wierda 05 Jan '23

05 Jan '23

I am setting up a new server combination (postfix + dovecot). dovecot's auth service works for postfix. Just lmtp does not and I need to find out why. I don't see anything in the dovecot logging, but I see this on the postfix side (debug) Jan 05 16:11:59 snape postfix/lmtp[127]: connection established Jan 05 16:11:59 snape postfix/lmtp[127]: master_notify: status 0 Jan 05 16:11:59 snape postfix/lmtp[127]: deliver_request_initial: send initial response Jan 05 16:11:59 snape postfix/lmtp[127]: send attr protocol = delivery_request_protocol Jan 05 16:16:59 snape postfix/lmtp[126]: smtp_get: timeout Jan 05 16:16:59 snape postfix/lmtp[126]: connect to subsystem private/defer Jan 05 16:16:59 snape postfix/lmtp[126]: private/defer socket: wanted attribute: protocol Jan 05 16:16:59 snape postfix/lmtp[126]: input attribute name: protocol Jan 05 16:16:59 snape postfix/lmtp[126]: input attribute value: delivery_status_protocol Jan 05 16:16:59 snape postfix/lmtp[126]: private/defer socket: wanted attribute: (list terminator) Jan 05 16:16:59 snape postfix/lmtp[126]: input attribute name: (end) Jan 05 16:16:59 snape postfix/lmtp[126]: send attr nrequest = 0 Jan 05 16:16:59 snape postfix/lmtp[126]: send attr flags = 0 Jan 05 16:16:59 snape postfix/lmtp[126]: send attr queue_id = C71B3D1262 Jan 05 16:16:59 snape postfix/lmtp[126]: send attr original_recipient = sysbh(a)rna.nl Jan 05 16:16:59 snape postfix/lmtp[126]: send attr recipient = sysbh(a)rna.nl Jan 05 16:16:59 snape postfix/lmtp[126]: send attr offset = 18446744073709551615 Jan 05 16:16:59 snape postfix/lmtp[126]: send attr dsn_orig_rcpt = rfc822;sysbh(a)rna.nl Jan 05 16:16:59 snape postfix/lmtp[126]: send attr notify_flags = 0 Jan 05 16:16:59 snape postfix/lmtp[126]: send attr status = 4.4.2 Jan 05 16:16:59 snape postfix/lmtp[126]: send attr diag_type = Jan 05 16:16:59 snape postfix/lmtp[126]: send attr diag_text = Jan 05 16:16:59 snape postfix/lmtp[126]: send attr mta_type = Jan 05 16:16:59 snape postfix/lmtp[126]: send attr mta_mname = Jan 05 16:16:59 snape postfix/lmtp[126]: send attr action = delayed Jan 05 16:16:59 snape postfix/lmtp[126]: send attr reason = conversation with snape.rna.nl[private/lmtp] timed out while receiving the initial server greeting Jan 05 16:16:59 snape postfix/lmtp[126]: private/defer socket: wanted attribute: status Jan 05 16:16:59 snape postfix/lmtp[126]: input attribute name: status Jan 05 16:16:59 snape postfix/lmtp[126]: input attribute value: 0 Jan 05 16:16:59 snape postfix/lmtp[126]: private/defer socket: wanted attribute: (list terminator) Jan 05 16:16:59 snape postfix/lmtp[126]: input attribute name: (end) Jan 05 16:16:59 snape postfix/lmtp[126]: C71B3D1262: to=<sysbh(a)rna.nl>, relay=snape.rna.nl[private/lmtp], delay=300, delays=0.02/0/300/0, dsn=4.4.2, status=deferred (conversation with snape.rna.nl[private/lmtp] timed out while receiving the initial server greeting) Jan 05 16:16:59 snape postfix/lmtp[126]: flush_add: site rna.nl id C71B3D1262 Jan 05 16:16:59 snape postfix/lmtp[126]: match_list_match: rna.nl: no match Jan 05 16:16:59 snape postfix/lmtp[126]: flush_add: site rna.nl id C71B3D1262 status 4 Jan 05 16:16:59 snape postfix/lmtp[126]: deliver_request_final: send: "conversation with snape.rna.nl[private/lmtp] timed out while receiving the initial server greeting" -1 Jan 05 16:16:59 snape postfix/lmtp[126]: send attr status = 4.4.2 Jan 05 16:16:59 snape postfix/lmtp[126]: send attr diag_type = Jan 05 16:16:59 snape postfix/lmtp[126]: send attr diag_text = Jan 05 16:16:59 snape postfix/lmtp[126]: send attr mta_type = Jan 05 16:16:59 snape postfix/lmtp[127]: master_notify: status 1 Jan 05 16:16:59 snape postfix/lmtp[126]: send attr mta_mname = Jan 05 16:16:59 snape postfix/lmtp[127]: connection closed Jan 05 16:16:59 snape postfix/lmtp[126]: send attr action = Jan 05 16:16:59 snape postfix/lmtp[126]: send attr reason = conversation with snape.rna.nl[private/lmtp] timed out while receiving the initial server greeting Jan 05 16:16:59 snape postfix/lmtp[126]: send attr status = 4294967295 Jan 05 16:16:59 snape postfix/lmtp[126]: master_notify: status 1 Jan 05 16:16:59 snape postfix/lmtp[126]: connection closed It seems dovecot doesn't react to whatever postfix is doing on the socket. Another possibility is that the socket doesn't really work and dovecot never gets a connection request. How can I debug this? Might I test if the socket is the problem by running lmtp on the dovecot side on TCP on 127.0.0.1 and have postfix use that? Just to see if it works? If so, how do I tell postfix to do that? In dovecot I have added the tcp: service lmtp { inet_listener lmtp { address = 127.0.0.1 port = 24 } unix_listener /var/spool/postfix/private/lmtp { mode = 0660 user = postfix group = postfix } } service lmtp { executable = lmtp -L } protocol lmtp { info_log_path = /var/log/mail/dovecot-lmtp.log } Any other tips? Gerben Wierda (LinkedIn <https://www.linkedin.com/in/gerbenwierda>) R&A IT Strategy <https://ea.rna.nl/> (main site) Book: Chess and the Art of Enterprise Architecture <https://ea.rna.nl/the-book/> Book: Mastering ArchiMate <https://ea.rna.nl/the-book-edition-iii/>

4 8

Migrating, syncing, maybe load-balancing/failover two dovecot servers?
by Gerben Wierda 05 Jan '23

05 Jan '23

I am in the process of migrating from dovecot on one OS (macOS/darwin) to a new server running dovecot with another OS (Ubuntu Linux 22.4). I have mostly copied/adapted the setup of the old server to the new. I am in the process of finishing that and adding some stuff that still needs to be added/migrated, like rspamd. And the data of course before the new one takes over from the old. I have done a migration before (MacOS X Server dovecot to MacPorts dovecot on macOS), many years ago, I recall that I used dovecot syncing but also rsync and I don't really recall (and anyway, the software has changed since) I have been thinking about keeping them both alive, with one as a failover for the other. They will not share their storage (e.g. NFS), So, I was wondering if I can do something with syncing between instances and dovecot director. I have been looking at the documentation, but a quick scan reveals I cannot locate some sort of tutorial and I am uncertain what will work and what not. If keeping both alive in parallel is too problematic, it is OK to have regular syncing in one direction (old to new) at first and then switch over and have syncing in the other direction (new to old) Can someone enlighten me? Gerben Wierda (LinkedIn <https://www.linkedin.com/in/gerbenwierda>) R&A IT Strategy <https://ea.rna.nl/> (main site) Book: Chess and the Art of Enterprise Architecture <https://ea.rna.nl/the-book/> Book: Mastering ArchiMate <https://ea.rna.nl/the-book-edition-iii/>

4 5

imap and lmtp create different index/control folders
by George Asenov 05 Jan '23

05 Jan '23

Hello, We have migrated our mail server from procmail lda to dovecot lmtp/sieve . dovecot imap create the dir with the email account test(a)s32.teststring.ml for name but lmtp create it as test-s32.someteststring.ml(a)serverhostname.tld I can't figure out how to manipulate nor what username postfix send to dovecot/lmtp or how dovecot/lmtp interpret it. As you will see in the config below there is a separate userdb set for lmtp because it receive the username/envelope from postfix as test-s32.someteststring.ml(a)serverhostname.tld which prevent it to use the pam authentication to verify and use the mail user to deliver email. So I use driver = passwd-file which have the option to configure the format of the username. But this is kind of dirty hack which i do not like. Anyone now how to configure dovecot/lmtp by default to remove the @myserverhostname.tld from the username or configure postfix not to add it? Here is the postfix config: ############################# postconf 2bounce_notice_recipient = postmaster access_map_defer_code = 450 access_map_reject_code = 554 address_verify_cache_cleanup_interval = 12h address_verify_default_transport = $default_transport address_verify_local_transport = $local_transport address_verify_map = btree:$data_directory/verify_cache address_verify_negative_cache = yes address_verify_negative_expire_time = 3d address_verify_negative_refresh_time = 3h address_verify_pending_request_limit = 5000 address_verify_poll_count = ${stress?{1}:{3}} address_verify_poll_delay = 3s address_verify_positive_expire_time = 31d address_verify_positive_refresh_time = 7d address_verify_relay_transport = $relay_transport address_verify_relayhost = $relayhost address_verify_sender = $double_bounce_sender address_verify_sender_dependent_default_transport_maps = $sender_dependent_default_transport_maps address_verify_sender_dependent_relayhost_maps = $sender_dependent_relayhost_maps address_verify_sender_ttl = 0s address_verify_service_name = verify address_verify_transport_maps = $transport_maps address_verify_virtual_transport = $virtual_transport alias_database = hash:/etc/aliases alias_maps = hash:/etc/aliases allow_mail_to_commands = alias, forward allow_mail_to_files = alias, forward allow_min_user = no allow_percent_hack = no allow_untrusted_routing = no alternate_config_directories = always_add_missing_headers = no always_bcc = anvil_rate_time_unit = 60s anvil_status_update_time = 600s append_at_myorigin = yes append_dot_mydomain = ${{$compatibility_level} < {1} ? {yes} : {no}} application_event_drain_time = 100s authorized_flush_users = static:anyone authorized_mailq_users = static:anyone authorized_submit_users = static:anyone backwards_bounce_logfile_compatibility = yes berkeley_db_create_buffer_size = 16777216 berkeley_db_read_buffer_size = 131072 best_mx_transport = biff = yes body_checks = body_checks_size_limit = 51200 bounce_notice_recipient = postmaster bounce_queue_lifetime = 5d bounce_service_name = bounce bounce_size_limit = 50000 bounce_template_file = broken_sasl_auth_clients = yes canonical_classes = envelope_sender, envelope_recipient, header_sender, header_recipient canonical_maps = cleanup_service_name = cleanup command_directory = /usr/sbin command_execution_directory = command_expansion_filter = 1234567890!@%-_=+:,./abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ command_time_limit = 1000s compatibility_level = 2 config_directory = /etc/postfix confirm_delay_cleared = no connection_cache_protocol_timeout = 5s connection_cache_service_name = scache connection_cache_status_update_time = 600s connection_cache_ttl_limit = 2s content_filter = cyrus_sasl_config_path = daemon_directory = /usr/libexec/postfix daemon_table_open_error_is_fatal = no daemon_timeout = 18000s data_directory = /var/lib/postfix debug_peer_level = 2 debug_peer_list = debugger_command = PATH=/bin:/usr/bin:/usr/local/bin:/usr/X11R6/bin ddd $daemon_directory/$process_name $process_id & sleep 5 default_database_type = hash default_delivery_slot_cost = 5 default_delivery_slot_discount = 50 default_delivery_slot_loan = 3 default_delivery_status_filter = default_destination_concurrency_failed_cohort_limit = 1 default_destination_concurrency_limit = 20 default_destination_concurrency_negative_feedback = 1 default_destination_concurrency_positive_feedback = 1 default_destination_rate_delay = 0s default_destination_recipient_limit = 50 default_extra_recipient_limit = 1000 default_filter_nexthop = default_minimum_delivery_slots = 3 default_privs = nobody default_process_limit = 100 default_rbl_reply = $rbl_code Service unavailable; $rbl_class [$rbl_what] blocked using $rbl_domain${rbl_reason?; $rbl_reason} default_recipient_limit = 20000 default_recipient_refill_delay = 5s default_recipient_refill_limit = 100 default_transport = smtp default_transport_rate_delay = 0s default_verp_delimiters = += defer_code = 450 defer_service_name = defer defer_transports = delay_logging_resolution_limit = 2 delay_notice_recipient = postmaster delay_warning_time = 0h deliver_lock_attempts = 20 deliver_lock_delay = 1s destination_concurrency_feedback_debug = no detect_8bit_encoding_header = yes disable_dns_lookups = no disable_mime_input_processing = no disable_mime_output_conversion = no disable_verp_bounces = no disable_vrfy_command = yes dns_ncache_ttl_fix_enable = no dnsblog_reply_delay = 0s dnsblog_service_name = dnsblog dont_remove = 0 double_bounce_sender = double-bounce duplicate_filter_limit = 1000 empty_address_default_transport_maps_lookup_key = <> empty_address_recipient = MAILER-DAEMON empty_address_relayhost_maps_lookup_key = <> enable_idna2003_compatibility = no enable_long_queue_ids = no enable_original_recipient = yes error_delivery_slot_cost = $default_delivery_slot_cost error_delivery_slot_discount = $default_delivery_slot_discount error_delivery_slot_loan = $default_delivery_slot_loan error_destination_concurrency_failed_cohort_limit = $default_destination_concurrency_failed_cohort_limit error_destination_concurrency_limit = $default_destination_concurrency_limit error_destination_concurrency_negative_feedback = $default_destination_concurrency_negative_feedback error_destination_concurrency_positive_feedback = $default_destination_concurrency_positive_feedback error_destination_rate_delay = $default_destination_rate_delay error_destination_recipient_limit = $default_destination_recipient_limit error_extra_recipient_limit = $default_extra_recipient_limit error_initial_destination_concurrency = $initial_destination_concurrency error_minimum_delivery_slots = $default_minimum_delivery_slots error_notice_recipient = postmaster error_recipient_limit = $default_recipient_limit error_recipient_refill_delay = $default_recipient_refill_delay error_recipient_refill_limit = $default_recipient_refill_limit error_service_name = error error_transport_rate_delay = $default_transport_rate_delay execution_directory_expansion_filter = 1234567890!@%-_=+:,./abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ expand_owner_alias = no export_environment = TZ MAIL_CONFIG LANG fallback_transport = fallback_transport_maps = fast_flush_domains = $relay_domains fast_flush_purge_time = 7d fast_flush_refresh_time = 12h fault_injection_code = 0 flush_service_name = flush fork_attempts = 5 fork_delay = 1s forward_expansion_filter = 1234567890!@%-_=+:,./abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ forward_path = $home/.forward${recipient_delimiter}${extension}, $home/.forward frozen_delivered_to = yes hash_queue_depth = 1 hash_queue_names = deferred, defer header_address_token_limit = 10240 header_checks = header_from_format = standard header_size_limit = 102400 helpful_warnings = yes home_mailbox = Maildir/ hopcount_limit = 50 html_directory = no ignore_mx_lookup_error = no import_environment = MAIL_CONFIG MAIL_DEBUG MAIL_LOGTAG TZ XAUTHORITY DISPLAY LANG=C POSTLOG_SERVICE POSTLOG_HOSTNAME in_flow_delay = 1s inet_interfaces = all inet_protocols = ipv4 info_log_address_format = internal initial_destination_concurrency = 5 internal_mail_filter_classes = invalid_hostname_reject_code = 501 ipc_idle = 5s ipc_timeout = 3600s ipc_ttl = 1000s line_length_limit = 2048 lmdb_map_size = 16777216 lmtp_address_preference = any lmtp_address_verify_target = rcpt lmtp_assume_final = no lmtp_balance_inet_protocols = yes lmtp_bind_address = lmtp_bind_address6 = lmtp_body_checks = lmtp_cname_overrides_servername = no lmtp_connect_timeout = 0s lmtp_connection_cache_destinations = lmtp_connection_cache_on_demand = yes lmtp_connection_cache_time_limit = 2s lmtp_connection_reuse_count_limit = 0 lmtp_connection_reuse_time_limit = 300s lmtp_data_done_timeout = 600s lmtp_data_init_timeout = 120s lmtp_data_xfer_timeout = 180s lmtp_defer_if_no_mx_address_found = no lmtp_delivery_slot_cost = $default_delivery_slot_cost lmtp_delivery_slot_discount = $default_delivery_slot_discount lmtp_delivery_slot_loan = $default_delivery_slot_loan lmtp_delivery_status_filter = $default_delivery_status_filter lmtp_destination_concurrency_failed_cohort_limit = $default_destination_concurrency_failed_cohort_limit lmtp_destination_concurrency_limit = $default_destination_concurrency_limit lmtp_destination_concurrency_negative_feedback = $default_destination_concurrency_negative_feedback lmtp_destination_concurrency_positive_feedback = $default_destination_concurrency_positive_feedback lmtp_destination_rate_delay = $default_destination_rate_delay lmtp_destination_recipient_limit = $default_destination_recipient_limit lmtp_discard_lhlo_keyword_address_maps = lmtp_discard_lhlo_keywords = lmtp_dns_reply_filter = lmtp_dns_resolver_options = lmtp_dns_support_level = lmtp_enforce_tls = no lmtp_extra_recipient_limit = $default_extra_recipient_limit lmtp_fallback_relay = lmtp_generic_maps = lmtp_header_checks = lmtp_host_lookup = dns lmtp_initial_destination_concurrency = $initial_destination_concurrency lmtp_lhlo_name = $myhostname lmtp_lhlo_timeout = 300s lmtp_line_length_limit = 998 lmtp_mail_timeout = 300s lmtp_mime_header_checks = lmtp_minimum_delivery_slots = $default_minimum_delivery_slots lmtp_mx_address_limit = 5 lmtp_mx_session_limit = 2 lmtp_nested_header_checks = lmtp_per_record_deadline = no lmtp_pix_workaround_delay_time = 10s lmtp_pix_workaround_maps = lmtp_pix_workaround_threshold_time = 500s lmtp_pix_workarounds = disable_esmtp,delay_dotcrlf lmtp_quit_timeout = 300s lmtp_quote_rfc821_envelope = yes lmtp_randomize_addresses = yes lmtp_rcpt_timeout = 300s lmtp_recipient_limit = $default_recipient_limit lmtp_recipient_refill_delay = $default_recipient_refill_delay lmtp_recipient_refill_limit = $default_recipient_refill_limit lmtp_reply_filter = lmtp_rset_timeout = 20s lmtp_sasl_auth_cache_name = lmtp_sasl_auth_cache_time = 90d lmtp_sasl_auth_enable = no lmtp_sasl_auth_soft_bounce = yes lmtp_sasl_mechanism_filter = lmtp_sasl_password_maps = lmtp_sasl_path = lmtp_sasl_security_options = noplaintext, noanonymous lmtp_sasl_tls_security_options = $lmtp_sasl_security_options lmtp_sasl_tls_verified_security_options = $lmtp_sasl_tls_security_options lmtp_sasl_type = cyrus lmtp_send_dummy_mail_auth = no lmtp_send_xforward_command = no lmtp_sender_dependent_authentication = no lmtp_skip_5xx_greeting = yes lmtp_skip_quit_response = no lmtp_starttls_timeout = 300s lmtp_tcp_port = 24 lmtp_tls_CAfile = lmtp_tls_CApath = lmtp_tls_block_early_mail_reply = no lmtp_tls_cert_file = lmtp_tls_chain_files = lmtp_tls_ciphers = medium lmtp_tls_connection_reuse = no lmtp_tls_dcert_file = lmtp_tls_dkey_file = $lmtp_tls_dcert_file lmtp_tls_eccert_file = lmtp_tls_eckey_file = $lmtp_tls_eccert_file lmtp_tls_enforce_peername = yes lmtp_tls_exclude_ciphers = lmtp_tls_fingerprint_cert_match = lmtp_tls_fingerprint_digest = md5 lmtp_tls_force_insecure_host_tlsa_lookup = no lmtp_tls_key_file = $lmtp_tls_cert_file lmtp_tls_loglevel = 0 lmtp_tls_mandatory_ciphers = medium lmtp_tls_mandatory_exclude_ciphers = lmtp_tls_mandatory_protocols = !SSLv2, !SSLv3 lmtp_tls_note_starttls_offer = no lmtp_tls_per_site = lmtp_tls_policy_maps = lmtp_tls_protocols = !SSLv2, !SSLv3 lmtp_tls_scert_verifydepth = 9 lmtp_tls_secure_cert_match = nexthop lmtp_tls_security_level = lmtp_tls_servername = lmtp_tls_session_cache_database = lmtp_tls_session_cache_timeout = 3600s lmtp_tls_trust_anchor_file = lmtp_tls_verify_cert_match = hostname lmtp_tls_wrappermode = no lmtp_transport_rate_delay = $default_transport_rate_delay lmtp_use_tls = no lmtp_xforward_timeout = 300s local_command_shell = local_delivery_slot_cost = $default_delivery_slot_cost local_delivery_slot_discount = $default_delivery_slot_discount local_delivery_slot_loan = $default_delivery_slot_loan local_delivery_status_filter = $default_delivery_status_filter local_destination_concurrency_failed_cohort_limit = $default_destination_concurrency_failed_cohort_limit local_destination_concurrency_limit = 2 local_destination_concurrency_negative_feedback = $default_destination_concurrency_negative_feedback local_destination_concurrency_positive_feedback = $default_destination_concurrency_positive_feedback local_destination_rate_delay = $default_destination_rate_delay local_destination_recipient_limit = 1 local_extra_recipient_limit = $default_extra_recipient_limit local_header_rewrite_clients = "" local_initial_destination_concurrency = $initial_destination_concurrency local_minimum_delivery_slots = $default_minimum_delivery_slots local_recipient_limit = $default_recipient_limit local_recipient_maps = proxy:unix:passwd.byname $alias_maps local_recipient_refill_delay = $default_recipient_refill_delay local_recipient_refill_limit = $default_recipient_refill_limit local_transport = local:$myhostname local_transport_rate_delay = $default_transport_rate_delay luser_relay = mail_name = Postfix mail_owner = postfix mail_release_date = 20201107 mail_spool_directory = /var/mail mail_version = 3.5.8 mailbox_command = mailbox_command_maps = mailbox_delivery_lock = fcntl, dotlock mailbox_size_limit = 0 mailbox_transport = lmtp:unix:private/dovecot-lmtp mailbox_transport_maps = maillog_file = maillog_file_compressor = gzip maillog_file_prefixes = /var, /dev/stdout maillog_file_rotate_suffix = %Y%m%d-%H%M%S mailq_path = /usr/bin/mailq.postfix manpage_directory = /usr/share/man maps_rbl_domains = maps_rbl_reject_code = 554 masquerade_classes = envelope_sender, header_sender, header_recipient masquerade_domains = masquerade_exceptions = master_service_disable = max_idle = 100s max_use = 100 maximal_backoff_time = 4000s maximal_queue_lifetime = 1d message_drop_headers = bcc, content-length, resent-bcc, return-path message_reject_characters = message_size_limit = 32000000 message_strip_characters = meta_directory = /etc/postfix milter_command_timeout = 30s milter_connect_macros = j {daemon_name} {daemon_addr} v _ milter_connect_timeout = 30s milter_content_timeout = 300s milter_data_macros = i milter_default_action = accept milter_end_of_data_macros = i milter_end_of_header_macros = i milter_header_checks = milter_helo_macros = {tls_version} {cipher} {cipher_bits} {cert_subject} {cert_issuer} milter_macro_daemon_name = $myhostname milter_macro_defaults = milter_macro_v = $mail_name $mail_version milter_mail_macros = i {auth_type} {auth_authen} {auth_author} {mail_addr} {mail_host} {mail_mailer} milter_protocol = 6 milter_rcpt_macros = i {rcpt_addr} {rcpt_host} {rcpt_mailer} milter_unknown_command_macros = mime_boundary_length_limit = 2048 mime_header_checks = $header_checks mime_nesting_limit = 100 minimal_backoff_time = 300s multi_instance_directories = multi_instance_enable = no multi_instance_group = multi_instance_name = multi_instance_wrapper = multi_recipient_bounce_reject_code = 550 mydestination = $myhostname, localhost.$mydomain, localhost, localhost.localdomain mydomain = mydomain.tld myhostname = sub.mydomain.tld mynetworks = 127.0.0.1/32 mynetworks_style = ${{$compatibility_level} < {2} ? {subnet} : {host}} myorigin = $myhostname nested_header_checks = $header_checks newaliases_path = /usr/bin/newaliases.postfix non_fqdn_reject_code = 504 non_smtpd_milters = inet:rspamd.domain.tld:11332 notify_classes = resource, software openssl_path = openssl owner_request_special = yes parent_domain_matches_subdomains = debug_peer_list,fast_flush_domains,mynetworks,permit_mx_backup_networks,qmqpd_authorized_clients,relay_domains,smtpd_access_maps permit_mx_backup_networks = pickup_service_name = pickup pipe_delivery_status_filter = $default_delivery_status_filter plaintext_reject_code = 450 postlog_service_name = postlog postlogd_watchdog_timeout = 10s postmulti_control_commands = reload flush postmulti_start_commands = start postmulti_stop_commands = stop abort drain quick-stop postscreen_access_list = permit_mynetworks postscreen_bare_newline_action = ignore postscreen_bare_newline_enable = no postscreen_bare_newline_ttl = 30d postscreen_blacklist_action = ignore postscreen_cache_cleanup_interval = 12h postscreen_cache_map = btree:$data_directory/postscreen_cache postscreen_cache_retention_time = 7d postscreen_client_connection_count_limit = $smtpd_client_connection_count_limit postscreen_command_count_limit = 20 postscreen_command_filter = postscreen_command_time_limit = ${stress?{10}:{300}}s postscreen_disable_vrfy_command = $disable_vrfy_command postscreen_discard_ehlo_keyword_address_maps = $smtpd_discard_ehlo_keyword_address_maps postscreen_discard_ehlo_keywords = $smtpd_discard_ehlo_keywords postscreen_dnsbl_action = ignore postscreen_dnsbl_max_ttl = ${postscreen_dnsbl_ttl?{$postscreen_dnsbl_ttl}:{1}}h postscreen_dnsbl_min_ttl = 60s postscreen_dnsbl_reply_map = postscreen_dnsbl_sites = postscreen_dnsbl_threshold = 1 postscreen_dnsbl_timeout = 10s postscreen_dnsbl_whitelist_threshold = 0 postscreen_enforce_tls = $smtpd_enforce_tls postscreen_expansion_filter = $smtpd_expansion_filter postscreen_forbidden_commands = $smtpd_forbidden_commands postscreen_greet_action = ignore postscreen_greet_banner = $smtpd_banner postscreen_greet_ttl = 1d postscreen_greet_wait = ${stress?{2}:{6}}s postscreen_helo_required = $smtpd_helo_required postscreen_non_smtp_command_action = drop postscreen_non_smtp_command_enable = no postscreen_non_smtp_command_ttl = 30d postscreen_pipelining_action = enforce postscreen_pipelining_enable = no postscreen_pipelining_ttl = 30d postscreen_post_queue_limit = $default_process_limit postscreen_pre_queue_limit = $default_process_limit postscreen_reject_footer = $smtpd_reject_footer postscreen_reject_footer_maps = $smtpd_reject_footer_maps postscreen_tls_security_level = $smtpd_tls_security_level postscreen_upstream_proxy_protocol = postscreen_upstream_proxy_timeout = 5s postscreen_use_tls = $smtpd_use_tls postscreen_watchdog_timeout = 10s postscreen_whitelist_interfaces = static:all prepend_delivered_header = command, file, forward process_id = 2311500 process_id_directory = pid process_name = postconf propagate_unmatched_extensions = canonical, virtual proxy_interfaces = proxy_read_maps = $local_recipient_maps $mydestination $virtual_alias_maps $virtual_alias_domains $virtual_mailbox_maps $virtual_mailbox_domains $relay_recipient_maps $relay_domains $canonical_maps $sender_canonical_maps $recipient_canonical_maps $relocated_maps $transport_maps $mynetworks $smtpd_sender_login_maps $sender_bcc_maps $recipient_bcc_maps $smtp_generic_maps $lmtp_generic_maps $alias_maps $smtpd_client_restrictions $smtpd_helo_restrictions $smtpd_sender_restrictions $smtpd_relay_restrictions $smtpd_recipient_restrictions $address_verify_sender_dependent_default_transport_maps $address_verify_sender_dependent_relayhost_maps $address_verify_transport_maps $fallback_transport_maps $lmtp_discard_lhlo_keyword_address_maps $lmtp_pix_workaround_maps $lmtp_sasl_password_maps $lmtp_tls_policy_maps $mailbox_command_maps $mailbox_transport_maps $postscreen_discard_ehlo_keyword_address_maps $rbl_reply_maps $sender_dependent_default_transport_maps $sender_dependent_relayhost_maps $smtp_discard_ehlo_keyword_address_maps $smtp_pix_workaround_maps $smtp_sasl_password_maps $smtp_tls_policy_maps $smtpd_discard_ehlo_keyword_address_maps $smtpd_milter_maps $virtual_gid_maps $virtual_uid_maps proxy_write_maps = $smtp_sasl_auth_cache_name $lmtp_sasl_auth_cache_name $address_verify_map $postscreen_cache_map proxymap_service_name = proxymap proxywrite_service_name = proxywrite qmgr_clog_warn_time = 300s qmgr_daemon_timeout = 1000s qmgr_fudge_factor = 100 qmgr_ipc_timeout = 60s qmgr_message_active_limit = 20000 qmgr_message_recipient_limit = 20000 qmgr_message_recipient_minimum = 10 qmqpd_authorized_clients = qmqpd_client_port_logging = no qmqpd_error_delay = 1s qmqpd_timeout = 300s queue_directory = /var/spool/postfix queue_file_attribute_count_limit = 100 queue_minfree = 0 queue_run_delay = 300s queue_service_name = qmgr rbl_reply_maps = readme_directory = /usr/share/doc/postfix/README_FILES receive_override_options = recipient_bcc_maps = recipient_canonical_classes = envelope_recipient, header_recipient recipient_canonical_maps = recipient_delimiter = reject_code = 554 reject_tempfail_action = defer_if_permit relay_clientcerts = relay_delivery_slot_cost = $default_delivery_slot_cost relay_delivery_slot_discount = $default_delivery_slot_discount relay_delivery_slot_loan = $default_delivery_slot_loan relay_destination_concurrency_failed_cohort_limit = $default_destination_concurrency_failed_cohort_limit relay_destination_concurrency_limit = $default_destination_concurrency_limit relay_destination_concurrency_negative_feedback = $default_destination_concurrency_negative_feedback relay_destination_concurrency_positive_feedback = $default_destination_concurrency_positive_feedback relay_destination_rate_delay = $default_destination_rate_delay relay_destination_recipient_limit = $default_destination_recipient_limit relay_domains = ${{$compatibility_level} < {2} ? {$mydestination} : {}} relay_domains_reject_code = 554 relay_extra_recipient_limit = $default_extra_recipient_limit relay_initial_destination_concurrency = $initial_destination_concurrency relay_minimum_delivery_slots = $default_minimum_delivery_slots relay_recipient_limit = $default_recipient_limit relay_recipient_maps = relay_recipient_refill_delay = $default_recipient_refill_delay relay_recipient_refill_limit = $default_recipient_refill_limit relay_transport = relay relay_transport_rate_delay = $default_transport_rate_delay relayhost = relocated_maps = remote_header_rewrite_domain = require_home_directory = no reset_owner_alias = no resolve_dequoted_address = yes resolve_null_domain = no resolve_numeric_domain = no retry_delivery_slot_cost = $default_delivery_slot_cost retry_delivery_slot_discount = $default_delivery_slot_discount retry_delivery_slot_loan = $default_delivery_slot_loan retry_destination_concurrency_failed_cohort_limit = $default_destination_concurrency_failed_cohort_limit retry_destination_concurrency_limit = $default_destination_concurrency_limit retry_destination_concurrency_negative_feedback = $default_destination_concurrency_negative_feedback retry_destination_concurrency_positive_feedback = $default_destination_concurrency_positive_feedback retry_destination_rate_delay = $default_destination_rate_delay retry_destination_recipient_limit = $default_destination_recipient_limit retry_extra_recipient_limit = $default_extra_recipient_limit retry_initial_destination_concurrency = $initial_destination_concurrency retry_minimum_delivery_slots = $default_minimum_delivery_slots retry_recipient_limit = $default_recipient_limit retry_recipient_refill_delay = $default_recipient_refill_delay retry_recipient_refill_limit = $default_recipient_refill_limit retry_transport_rate_delay = $default_transport_rate_delay rewrite_service_name = rewrite rhel_ipv6_normalize = no sample_directory = /usr/share/doc/postfix/samples send_cyrus_sasl_authzid = no sender_bcc_maps = hash:/etc/postfix/bcc sender_canonical_classes = envelope_sender, header_sender sender_canonical_maps = sender_dependent_default_transport_maps = hash:/etc/postfix/dependent sender_dependent_relayhost_maps = sendmail_fix_line_endings = always sendmail_path = /usr/sbin/sendmail.postfix service_name = service_throttle_time = 60s setgid_group = postdrop shlib_directory = /usr/lib64/postfix show_user_unknown_table_name = yes showq_service_name = showq smtp_address_preference = any smtp_address_verify_target = rcpt smtp_always_send_ehlo = yes smtp_balance_inet_protocols = yes smtp_bind_address = smtp_bind_address6 = smtp_body_checks = smtp_cname_overrides_servername = no smtp_connect_timeout = 30s smtp_connection_cache_destinations = smtp_connection_cache_on_demand = yes smtp_connection_cache_time_limit = 2s smtp_connection_reuse_count_limit = 0 smtp_connection_reuse_time_limit = 300s smtp_data_done_timeout = 600s smtp_data_init_timeout = 120s smtp_data_xfer_timeout = 180s smtp_defer_if_no_mx_address_found = no smtp_delivery_slot_cost = $default_delivery_slot_cost smtp_delivery_slot_discount = $default_delivery_slot_discount smtp_delivery_slot_loan = $default_delivery_slot_loan smtp_delivery_status_filter = $default_delivery_status_filter smtp_destination_concurrency_failed_cohort_limit = $default_destination_concurrency_failed_cohort_limit smtp_destination_concurrency_limit = $default_destination_concurrency_limit smtp_destination_concurrency_negative_feedback = $default_destination_concurrency_negative_feedback smtp_destination_concurrency_positive_feedback = $default_destination_concurrency_positive_feedback smtp_destination_rate_delay = $default_destination_rate_delay smtp_destination_recipient_limit = $default_destination_recipient_limit smtp_discard_ehlo_keyword_address_maps = smtp_discard_ehlo_keywords = smtp_dns_reply_filter = smtp_dns_resolver_options = smtp_dns_support_level = smtp_enforce_tls = no smtp_extra_recipient_limit = $default_extra_recipient_limit smtp_fallback_relay = $fallback_relay smtp_generic_maps = smtp_header_checks = smtp_helo_name = $myhostname smtp_helo_timeout = 300s smtp_host_lookup = dns smtp_initial_destination_concurrency = $initial_destination_concurrency smtp_line_length_limit = 998 smtp_mail_timeout = 300s smtp_mime_header_checks = smtp_minimum_delivery_slots = $default_minimum_delivery_slots smtp_mx_address_limit = 5 smtp_mx_session_limit = 2 smtp_nested_header_checks = smtp_never_send_ehlo = no smtp_per_record_deadline = no smtp_pix_workaround_delay_time = 10s smtp_pix_workaround_maps = smtp_pix_workaround_threshold_time = 500s smtp_pix_workarounds = disable_esmtp,delay_dotcrlf smtp_quit_timeout = 300s smtp_quote_rfc821_envelope = yes smtp_randomize_addresses = yes smtp_rcpt_timeout = 300s smtp_recipient_limit = $default_recipient_limit smtp_recipient_refill_delay = $default_recipient_refill_delay smtp_recipient_refill_limit = $default_recipient_refill_limit smtp_reply_filter = smtp_rset_timeout = 20s smtp_sasl_auth_cache_name = smtp_sasl_auth_cache_time = 90d smtp_sasl_auth_enable = no smtp_sasl_auth_soft_bounce = yes smtp_sasl_mechanism_filter = smtp_sasl_password_maps = smtp_sasl_path = smtp_sasl_security_options = noplaintext, noanonymous smtp_sasl_tls_security_options = $smtp_sasl_security_options smtp_sasl_tls_verified_security_options = $smtp_sasl_tls_security_options smtp_sasl_type = cyrus smtp_send_dummy_mail_auth = no smtp_send_xforward_command = no smtp_sender_dependent_authentication = no smtp_skip_5xx_greeting = yes smtp_skip_quit_response = yes smtp_starttls_timeout = 300s smtp_tcp_port = smtp smtp_tls_CAfile = /etc/pki/tls/certs/ca-bundle.crt smtp_tls_CApath = /etc/pki/tls/certs smtp_tls_block_early_mail_reply = no smtp_tls_cert_file = smtp_tls_chain_files = smtp_tls_ciphers = medium smtp_tls_connection_reuse = no smtp_tls_dane_insecure_mx_policy = dane smtp_tls_dcert_file = smtp_tls_dkey_file = $smtp_tls_dcert_file smtp_tls_eccert_file = smtp_tls_eckey_file = $smtp_tls_eccert_file smtp_tls_enforce_peername = yes smtp_tls_exclude_ciphers = RC4, aNULL, EXPORT, LOW, MEDIUM smtp_tls_fingerprint_cert_match = smtp_tls_fingerprint_digest = md5 smtp_tls_force_insecure_host_tlsa_lookup = no smtp_tls_key_file = $smtp_tls_cert_file smtp_tls_loglevel = 0 smtp_tls_mandatory_ciphers = medium smtp_tls_mandatory_exclude_ciphers = smtp_tls_mandatory_protocols = !SSLv2,!SSLv3 smtp_tls_note_starttls_offer = no smtp_tls_per_site = smtp_tls_policy_maps = smtp_tls_protocols = !SSLv2,!SSLv3 smtp_tls_scert_verifydepth = 9 smtp_tls_secure_cert_match = nexthop, dot-nexthop smtp_tls_security_level = may smtp_tls_servername = smtp_tls_session_cache_database = smtp_tls_session_cache_timeout = 3600s smtp_tls_trust_anchor_file = smtp_tls_verify_cert_match = hostname smtp_tls_wrappermode = no smtp_transport_rate_delay = $default_transport_rate_delay smtp_use_tls = no smtp_xforward_timeout = 300s smtpd_authorized_verp_clients = $authorized_verp_clients smtpd_authorized_xclient_hosts = smtpd_authorized_xforward_hosts = smtpd_banner = $myhostname ESMTP $mail_name smtpd_client_auth_rate_limit = 0 smtpd_client_connection_count_limit = 10 smtpd_client_connection_rate_limit = 60 smtpd_client_event_limit_exceptions = ${smtpd_client_connection_limit_exceptions:$mynetworks} smtpd_client_message_rate_limit = 0 smtpd_client_new_tls_session_rate_limit = 0 smtpd_client_port_logging = no smtpd_client_recipient_rate_limit = 0 smtpd_client_restrictions = smtpd_command_filter = smtpd_data_restrictions = smtpd_delay_open_until_valid_rcpt = yes smtpd_delay_reject = yes smtpd_discard_ehlo_keyword_address_maps = smtpd_discard_ehlo_keywords = chunking smtpd_dns_reply_filter = smtpd_end_of_data_restrictions = smtpd_enforce_tls = no smtpd_error_sleep_time = 1s smtpd_etrn_restrictions = smtpd_expansion_filter = \t\40!"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~ smtpd_forbidden_commands = CONNECT GET POST smtpd_hard_error_limit = ${stress?{1}:{20}} smtpd_helo_required = no smtpd_helo_restrictions = smtpd_history_flush_threshold = 100 smtpd_junk_command_limit = ${stress?{1}:{100}} smtpd_log_access_permit_actions = smtpd_milter_maps = smtpd_milters = inet:rspamd.domain.tld:11332 smtpd_noop_commands = smtpd_null_access_lookup_key = <> smtpd_peername_lookup = yes smtpd_per_record_deadline = ${stress?{yes}:{no}} smtpd_policy_service_default_action = 451 4.3.5 Server configuration problem smtpd_policy_service_max_idle = 300s smtpd_policy_service_max_ttl = 1000s smtpd_policy_service_policy_context = smtpd_policy_service_request_limit = 0 smtpd_policy_service_retry_delay = 1s smtpd_policy_service_timeout = 100s smtpd_policy_service_try_limit = 2 smtpd_proxy_ehlo = $myhostname smtpd_proxy_filter = smtpd_proxy_options = smtpd_proxy_timeout = 100s smtpd_recipient_limit = 1000 smtpd_recipient_overshoot_limit = 1000 smtpd_recipient_restrictions = permit_sasl_authenticated, reject_unauth_destination, reject_invalid_hostname, reject_unauth_pipelining, reject_non_fqdn_sender, reject_unknown_sender_domain, reject_non_fqdn_recipient, reject_unknown_recipient_domain, reject_rbl_client zen.spamhaus.org, reject_rhsbl_client dbl.spamhaus.org smtpd_reject_footer = smtpd_reject_footer_maps = smtpd_reject_unlisted_recipient = yes smtpd_reject_unlisted_sender = yes smtpd_relay_restrictions = ${{$compatibility_level} < {1} ? {} : {permit_mynetworks, permit_sasl_authenticated, defer_unauth_destination}} smtpd_restriction_classes = smtpd_sasl_auth_enable = yes smtpd_sasl_authenticated_header = no smtpd_sasl_exceptions_networks = smtpd_sasl_local_domain = smtpd_sasl_path = smtpd smtpd_sasl_response_limit = 12288 smtpd_sasl_security_options = noanonymous smtpd_sasl_service = smtp smtpd_sasl_tls_security_options = $smtpd_sasl_security_options smtpd_sasl_type = cyrus smtpd_sender_login_maps = unionmap:{regexp:/etc/postfix/login_maps.pcre hash:/etc/postfix/virtual} smtpd_sender_restrictions = smtpd_service_name = smtpd smtpd_soft_error_limit = 10 smtpd_starttls_timeout = ${stress?{10}:{300}}s smtpd_timeout = ${stress?{10}:{300}}s smtpd_tls_CAfile = /etc/postfix/postfix.ca.pem smtpd_tls_CApath = smtpd_tls_always_issue_session_ids = yes smtpd_tls_ask_ccert = no smtpd_tls_auth_only = no smtpd_tls_ccert_verifydepth = 9 smtpd_tls_cert_file = smtpd_tls_chain_files = /etc/pki/tls/private/postfix.key,/etc/pki/tls/certs/postfix.pem smtpd_tls_ciphers = medium smtpd_tls_dcert_file = smtpd_tls_dh1024_param_file = smtpd_tls_dh512_param_file = smtpd_tls_dkey_file = $smtpd_tls_dcert_file smtpd_tls_eccert_file = smtpd_tls_eckey_file = $smtpd_tls_eccert_file smtpd_tls_eecdh_grade = auto smtpd_tls_exclude_ciphers = RC4, aNULL, EXPORT, LOW, MEDIUM smtpd_tls_fingerprint_digest = md5 smtpd_tls_key_file = $smtpd_tls_cert_file smtpd_tls_loglevel = 0 smtpd_tls_mandatory_ciphers = high smtpd_tls_mandatory_exclude_ciphers = smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3 smtpd_tls_protocols = !SSLv2,!SSLv3 smtpd_tls_received_header = no smtpd_tls_req_ccert = no smtpd_tls_security_level = may smtpd_tls_session_cache_database = smtpd_tls_session_cache_timeout = 3600s smtpd_tls_wrappermode = no smtpd_upstream_proxy_protocol = smtpd_upstream_proxy_timeout = 5s smtpd_use_tls = yes smtputf8_autodetect_classes = sendmail, verify smtputf8_enable = ${{$compatibility_level} < {1} ? {no} : {yes}} soft_bounce = no stale_lock_time = 500s stress = strict_7bit_headers = no strict_8bitmime = no strict_8bitmime_body = no strict_mailbox_ownership = yes strict_mime_encoding_domain = no strict_rfc821_envelopes = no strict_smtputf8 = no sun_mailtool_compatibility = no swap_bangpath = yes syslog_facility = mail syslog_name = ${multi_instance_name?{$multi_instance_name}:{postfix}} tcp_windowsize = 0 tls_append_default_CA = no tls_daemon_random_bytes = 32 tls_dane_digests = sha512 sha256 tls_disable_workarounds = tls_eecdh_auto_curves = X25519 X448 prime256v1 secp521r1 secp384r1 tls_eecdh_strong_curve = prime256v1 tls_eecdh_ultra_curve = secp384r1 tls_export_cipherlist = aNULL:-aNULL:HIGH:MEDIUM:LOW:EXPORT:+RC4:@STRENGTH tls_fast_shutdown_enable = yes tls_high_cipherlist = aNULL:-aNULL:HIGH:@STRENGTH tls_legacy_public_key_fingerprints = no tls_low_cipherlist = aNULL:-aNULL:HIGH:MEDIUM:LOW:+RC4:@STRENGTH tls_medium_cipherlist = aNULL:-aNULL:HIGH:MEDIUM:+RC4:@STRENGTH tls_null_cipherlist = eNULL:!aNULL tls_preempt_cipherlist = no tls_random_bytes = 32 tls_random_exchange_name = ${data_directory}/prng_exch tls_random_prng_update_period = 3600s tls_random_reseed_period = 3600s tls_random_source = dev:/dev/urandom tls_server_sni_maps = hash:/etc/postfix/vmail_ssl tls_session_ticket_cipher = aes-256-cbc tls_ssl_options = tls_wildcard_matches_multiple_labels = yes tlsmgr_service_name = tlsmgr tlsproxy_client_CAfile = $smtp_tls_CAfile tlsproxy_client_CApath = $smtp_tls_CApath tlsproxy_client_cert_file = $smtp_tls_cert_file tlsproxy_client_chain_files = $smtp_tls_chain_files tlsproxy_client_dcert_file = $smtp_tls_dcert_file tlsproxy_client_dkey_file = $smtp_tls_dkey_file tlsproxy_client_eccert_file = $smtp_tls_eccert_file tlsproxy_client_eckey_file = $smtp_tls_eckey_file tlsproxy_client_enforce_tls = $smtp_enforce_tls tlsproxy_client_fingerprint_digest = $smtp_tls_fingerprint_digest tlsproxy_client_key_file = $smtp_tls_key_file tlsproxy_client_level = $smtp_tls_security_level tlsproxy_client_loglevel = $smtp_tls_loglevel tlsproxy_client_loglevel_parameter = smtp_tls_loglevel tlsproxy_client_per_site = $smtp_tls_per_site tlsproxy_client_policy = $smtp_tls_policy_maps tlsproxy_client_scert_verifydepth = $smtp_tls_scert_verifydepth tlsproxy_client_use_tls = $smtp_use_tls tlsproxy_enforce_tls = $smtpd_enforce_tls tlsproxy_service_name = tlsproxy tlsproxy_tls_CAfile = $smtpd_tls_CAfile tlsproxy_tls_CApath = $smtpd_tls_CApath tlsproxy_tls_always_issue_session_ids = $smtpd_tls_always_issue_session_ids tlsproxy_tls_ask_ccert = $smtpd_tls_ask_ccert tlsproxy_tls_ccert_verifydepth = $smtpd_tls_ccert_verifydepth tlsproxy_tls_cert_file = $smtpd_tls_cert_file tlsproxy_tls_chain_files = $smtpd_tls_chain_files tlsproxy_tls_ciphers = $smtpd_tls_ciphers tlsproxy_tls_dcert_file = $smtpd_tls_dcert_file tlsproxy_tls_dh1024_param_file = $smtpd_tls_dh1024_param_file tlsproxy_tls_dh512_param_file = $smtpd_tls_dh512_param_file tlsproxy_tls_dkey_file = $smtpd_tls_dkey_file tlsproxy_tls_eccert_file = $smtpd_tls_eccert_file tlsproxy_tls_eckey_file = $smtpd_tls_eckey_file tlsproxy_tls_eecdh_grade = $smtpd_tls_eecdh_grade tlsproxy_tls_exclude_ciphers = $smtpd_tls_exclude_ciphers tlsproxy_tls_fingerprint_digest = $smtpd_tls_fingerprint_digest tlsproxy_tls_key_file = $smtpd_tls_key_file tlsproxy_tls_loglevel = $smtpd_tls_loglevel tlsproxy_tls_mandatory_ciphers = $smtpd_tls_mandatory_ciphers tlsproxy_tls_mandatory_exclude_ciphers = $smtpd_tls_mandatory_exclude_ciphers tlsproxy_tls_mandatory_protocols = $smtpd_tls_mandatory_protocols tlsproxy_tls_protocols = $smtpd_tls_protocols tlsproxy_tls_req_ccert = $smtpd_tls_req_ccert tlsproxy_tls_security_level = $smtpd_tls_security_level tlsproxy_use_tls = $smtpd_use_tls tlsproxy_watchdog_timeout = 10s trace_service_name = trace transport_maps = transport_retry_time = 60s trigger_timeout = 10s undisclosed_recipients_header = unknown_address_reject_code = 450 unknown_address_tempfail_action = $reject_tempfail_action unknown_client_reject_code = 450 unknown_helo_hostname_tempfail_action = $reject_tempfail_action unknown_hostname_reject_code = 450 unknown_local_recipient_reject_code = 550 unknown_relay_recipient_reject_code = 550 unknown_virtual_alias_reject_code = 550 unknown_virtual_mailbox_reject_code = 550 unverified_recipient_defer_code = 450 unverified_recipient_reject_code = 450 unverified_recipient_reject_reason = unverified_recipient_tempfail_action = $reject_tempfail_action unverified_sender_defer_code = 450 unverified_sender_reject_code = 450 unverified_sender_reject_reason = unverified_sender_tempfail_action = $reject_tempfail_action verp_delimiter_filter = -=+ virtual_alias_address_length_limit = 1000 virtual_alias_domains = $virtual_alias_maps virtual_alias_expansion_limit = 1000 virtual_alias_maps = hash:/etc/postfix/virtual virtual_alias_recursion_limit = 1000 virtual_delivery_slot_cost = $default_delivery_slot_cost virtual_delivery_slot_discount = $default_delivery_slot_discount virtual_delivery_slot_loan = $default_delivery_slot_loan virtual_delivery_status_filter = $default_delivery_status_filter virtual_destination_concurrency_failed_cohort_limit = $default_destination_concurrency_failed_cohort_limit virtual_destination_concurrency_limit = $default_destination_concurrency_limit virtual_destination_concurrency_negative_feedback = $default_destination_concurrency_negative_feedback virtual_destination_concurrency_positive_feedback = $default_destination_concurrency_positive_feedback virtual_destination_rate_delay = $default_destination_rate_delay virtual_destination_recipient_limit = $default_destination_recipient_limit virtual_extra_recipient_limit = $default_extra_recipient_limit virtual_gid_maps = virtual_initial_destination_concurrency = $initial_destination_concurrency virtual_mailbox_base = virtual_mailbox_domains = $virtual_mailbox_maps virtual_mailbox_limit = 51200000 virtual_mailbox_lock = fcntl, dotlock virtual_mailbox_maps = virtual_minimum_delivery_slots = $default_minimum_delivery_slots virtual_minimum_uid = 100 virtual_recipient_limit = $default_recipient_limit virtual_recipient_refill_delay = $default_recipient_refill_delay virtual_recipient_refill_limit = $default_recipient_refill_limit virtual_transport = virtual virtual_transport_rate_delay = $default_transport_rate_delay virtual_uid_maps = ############################# dovecot config: ############################# doveconf # 2.3.16 (7e2e900c1a): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.16 (09c29328) # OS: Linux 4.18.0-425.3.1.el8.x86_64 x86_64 Rocky Linux release 8.7 (Green Obsidian) # Hostname: m13.domain.tld # NOTE: Send doveconf -n output instead when asking for help. auth_anonymous_username = anonymous auth_cache_negative_ttl = 1 hours auth_cache_size = 0 auth_cache_ttl = 1 hours auth_cache_verify_password_with_worker = no auth_debug = no auth_debug_passwords = no auth_default_realm = auth_failure_delay = 2 secs auth_gssapi_hostname = auth_krb5_keytab = auth_master_user_separator = auth_mechanisms = plain login auth_policy_check_after_auth = yes auth_policy_check_before_auth = yes auth_policy_hash_mech = sha256 auth_policy_hash_nonce = auth_policy_hash_truncate = 12 auth_policy_log_only = no auth_policy_reject_on_fail = no auth_policy_report_after_auth = yes auth_policy_request_attributes = login=%{requested_username} pwhash=%{hashed_password} remote=%{rip} device_id=%{client_id} protocol=%s session_id=%{session} auth_policy_server_api_header = auth_policy_server_timeout_msecs = 2000 auth_policy_server_url = auth_proxy_self = auth_realms = auth_socket_path = auth-userdb auth_ssl_require_client_cert = no auth_ssl_username_from_cert = no auth_stats = no auth_use_winbind = no auth_username_chars = abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ01234567890.-_@ auth_username_format = %Lu auth_username_translation = auth_verbose = no auth_verbose_passwords = no auth_winbind_helper_path = /usr/bin/ntlm_auth auth_worker_max_count = 30 base_dir = /run/dovecot config_cache_size = 1 M debug_log_path = default_client_limit = 1000 default_idle_kill = 1 mins default_internal_group = dovecot default_internal_user = dovecot default_login_user = dovenull default_process_limit = 100 default_vsz_limit = 256 M deliver_log_format = msgid=%m: %$ dict_db_config = director_flush_socket = director_mail_servers = director_max_parallel_kicks = 100 director_max_parallel_moves = 100 director_output_buffer_size = 10 M director_ping_idle_timeout = 30 secs director_ping_max_timeout = 1 mins director_servers = director_user_expire = 15 mins director_user_kick_delay = 2 secs director_username_hash = %u disable_plaintext_auth = no dotlock_use_excl = yes doveadm_allowed_commands = doveadm_api_key = doveadm_http_rawlog_dir = doveadm_password = doveadm_port = 0 doveadm_socket_path = doveadm-server doveadm_ssl = no doveadm_username = doveadm doveadm_worker_count = 0 dsync_alt_char = _ dsync_commit_msgs_interval = 100 dsync_features = dsync_hashed_headers = Date Message-ID dsync_remote_cmd = ssh -l%{login} %{host} doveadm dsync-server -u%u -U first_valid_gid = 1 first_valid_uid = 1000 haproxy_timeout = 3 secs haproxy_trusted_networks = hostname = imap_capability = imap_client_workarounds = imap_fetch_failure = disconnect-immediately imap_hibernate_timeout = 0 imap_id_log = imap_id_retain = no imap_id_send = name * imap_idle_notify_interval = 2 mins imap_literal_minus = no imap_logout_format = in=%i out=%o deleted=%{deleted} expunged=%{expunged} trashed=%{trashed} hdr_count=%{fetch_hdr_count} hdr_bytes=%{fetch_hdr_bytes} body_count=%{fetch_body_count} body_bytes=%{fetch_body_bytes} imap_max_line_length = 64 k imap_metadata = no imap_urlauth_host = imap_urlauth_logout_format = in=%i out=%o imap_urlauth_port = 143 imapc_cmd_timeout = 5 mins imapc_connection_retry_count = 1 imapc_connection_retry_interval = 1 secs imapc_features = imapc_host = imapc_list_prefix = imapc_master_user = imapc_max_idle_time = 29 mins imapc_max_line_length = 0 imapc_password = imapc_port = 143 imapc_rawlog_dir = imapc_sasl_mechanisms = imapc_ssl = no imapc_ssl_verify = yes imapc_user = import_environment = TZ CORE_OUTOFMEM CORE_ERROR info_log_path = instance_name = dovecot last_valid_gid = 0 last_valid_uid = 0 lda_mailbox_autocreate = no lda_mailbox_autosubscribe = no lda_original_recipient_header = libexec_dir = /usr/libexec/dovecot listen = *, :: lmtp_add_received_header = yes lmtp_client_workarounds = lmtp_hdr_delivery_address = final lmtp_proxy = no lmtp_proxy_rawlog_dir = lmtp_rawlog_dir = lmtp_rcpt_check_quota = no lmtp_save_to_detail_mailbox = no lmtp_user_concurrency_limit = 0 lock_method = fcntl log_core_filter = log_debug = log_path = syslog log_timestamp = "%b %d %H:%M:%S " login_access_sockets = login_greeting = Dovecot ready. login_log_format = %$: %s login_log_format_elements = user=<%u> method=%m rip=%r lip=%l mpid=%e %c session=<%{session}> login_plugin_dir = /usr/lib64/dovecot/login login_plugins = login_proxy_max_disconnect_delay = 0 login_proxy_max_reconnects = 3 login_proxy_notify_path = proxy-notify login_proxy_timeout = 30 secs login_source_ips = login_trusted_networks = mail_access_groups = mail_always_cache_fields = mail_attachment_detection_options = mail_attachment_dir = mail_attachment_fs = sis posix mail_attachment_hash = %{sha1} mail_attachment_min_size = 128 k mail_attribute_dict = mail_cache_fields = flags mail_cache_min_mail_count = 0 mail_chroot = mail_debug = no mail_fsync = optimized mail_full_filesystem_access = no mail_gid = mail_home = mail_location = maildir:~/Maildir:INDEX=/var/lib/dovecot-virtualmin/index/%u:CONTROL=/var/lib/dovecot-virtualmin/control/%u mail_log_prefix = "%s(%u)<%{pid}><%{session}>: " mail_max_keyword_length = 50 mail_max_lock_timeout = 0 mail_max_userip_connections = 10 mail_never_cache_fields = imap.envelope mail_nfs_index = no mail_nfs_storage = no mail_plugin_dir = /usr/lib64/dovecot mail_plugins = mail_prefetch_count = 0 mail_privileged_group = mail_save_crlf = no mail_server_admin = mail_server_comment = mail_shared_explicit_inbox = no mail_sort_max_read_count = 0 mail_temp_dir = /tmp mail_temp_scan_interval = 1 weeks mail_uid = mail_vsize_bg_after_count = 0 mailbox_idle_check_interval = 30 secs mailbox_list_index = yes mailbox_list_index_include_inbox = no mailbox_list_index_very_dirty_syncs = no maildir_broken_filename_sizes = no maildir_copy_with_hardlinks = yes maildir_empty_new = no maildir_stat_dirs = no maildir_very_dirty_syncs = no managesieve_client_workarounds = managesieve_implementation_string = Dovecot Pigeonhole managesieve_logout_format = bytes=%i/%o managesieve_max_compile_errors = 5 managesieve_max_line_length = 64 k managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext vacation-seconds imapsieve vnd.dovecot.imapsieve master_user_separator = mbox_dirty_syncs = yes mbox_dotlock_change_timeout = 2 mins mbox_lazy_writes = yes mbox_lock_timeout = 5 mins mbox_md5 = apop3d mbox_min_index_size = 0 mbox_read_locks = fcntl mbox_very_dirty_syncs = no mbox_write_locks = fcntl mdbox_preallocate_space = no mdbox_rotate_interval = 0 mdbox_rotate_size = 10 M mmap_disable = no namespace inbox { disabled = no hidden = no ignore_on_failure = no inbox = yes list = yes location = mailbox Drafts { auto = subscribe autoexpunge = 0 autoexpunge_max_mails = 0 comment = driver = special_use = \Drafts } mailbox Junk { auto = subscribe autoexpunge = 0 autoexpunge_max_mails = 0 comment = driver = special_use = \Junk } mailbox Sent { auto = subscribe autoexpunge = 0 autoexpunge_max_mails = 0 comment = driver = special_use = \Sent } mailbox "Sent Messages" { auto = no autoexpunge = 0 autoexpunge_max_mails = 0 comment = driver = special_use = \Sent } mailbox Trash { auto = subscribe autoexpunge = 0 autoexpunge_max_mails = 0 comment = driver = special_use = \Trash } mailbox spam { auto = subscribe autoexpunge = 0 autoexpunge_max_mails = 0 comment = driver = special_use = \Junk } order = 0 prefix = separator = subscriptions = yes type = private } old_stats_carbon_interval = 30 secs old_stats_carbon_name = old_stats_carbon_server = old_stats_command_min_time = 1 mins old_stats_domain_min_time = 12 hours old_stats_ip_min_time = 12 hours old_stats_memory_limit = 16 M old_stats_session_min_time = 15 mins old_stats_user_min_time = 1 hours passdb { args = auth_verbose = default default_fields = deny = no driver = pam master = no mechanisms = name = override_fields = pass = no result_failure = continue result_internalfail = continue result_success = return-ok skip = never username_filter = } plugin { imapsieve_mailbox1_before = file:/var/lib/dovecot/sieve/learn-spam.sieve imapsieve_mailbox1_causes = COPY APPEND FLAG imapsieve_mailbox1_name = spam imapsieve_mailbox2_before = file:/var/lib/dovecot/sieve/learn-ham.sieve imapsieve_mailbox2_causes = COPY imapsieve_mailbox2_from = spam imapsieve_mailbox2_name = * imapsieve_mailbox3_before = file:/var/lib/dovecot/sieve/learn-spam.sieve imapsieve_mailbox3_causes = COPY APPEND FLAG imapsieve_mailbox3_name = Junk imapsieve_mailbox4_before = file:/var/lib/dovecot/sieve/learn-ham.sieve imapsieve_mailbox4_causes = COPY imapsieve_mailbox4_from = Junk imapsieve_mailbox4_name = * quota = fs:user userquota quota_grace = 100M quota_warning = storage=95%% quota-warning 95 %n %d quota_warning2 = storage=90%% quota-warning 90 %n %d quota_warning3 = storage=80%% quota-warning 80 %n %d sieve = file:~/sieve;active=~/.dovecot.sieve sieve_before = /var/lib/dovecot/sieve/before-global.sieve sieve_extensions = +vacation-seconds sieve_global_extensions = +vnd.dovecot.pipe +vnd.dovecot.environment +vnd.dovecot.debug sieve_pipe_bin_dir = /var/lib/dovecot/sieve sieve_plugins = sieve_extprograms sieve_imapsieve sieve_vacation_default_period = 10d sieve_vacation_max_period = 30d sieve_vacation_min_period = 1h } pop3_client_workarounds = pop3_delete_type = default pop3_deleted_flag = pop3_enable_last = no pop3_fast_size_lookups = no pop3_lock_session = no pop3_logout_format = top=%t/%p, retr=%r/%b, del=%d/%m, size=%s pop3_no_flag_updates = no pop3_reuse_xuidl = no pop3_save_uidl = no pop3_uidl_duplicates = allow pop3_uidl_format = %08Xu%08Xv pop3c_features = pop3c_host = pop3c_master_user = pop3c_password = pop3c_port = 110 pop3c_quick_received_date = no pop3c_rawlog_dir = pop3c_ssl = no pop3c_ssl_verify = yes pop3c_user = %u postmaster_address = postmaster@%{if;%d;ne;;%d;%{hostname}} protocols = imap pop3 lmtp sieve quota_full_tempfail = no rawlog_dir = recipient_delimiter = + rejection_reason = Your message to <%t> was automatically rejected:%n%r rejection_subject = Rejected: %s replication_dsync_parameters = -d -N -l 30 -U replication_full_sync_interval = 1 days replication_max_conns = 10 replicator_host = replicator replicator_port = 0 sendmail_path = /usr/sbin/sendmail service aggregator { chroot = . client_limit = 0 drop_priv_before_exec = no executable = aggregator extra_groups = fifo_listener replication-notify-fifo { group = mode = 0600 user = } group = idle_kill = 0 privileged_group = process_limit = 0 process_min_avail = 0 protocol = service_count = 0 type = unix_listener replication-notify { group = mode = 0600 user = } user = $default_internal_user vsz_limit = 18446744073709551615 B } service anvil { chroot = empty client_limit = 0 drop_priv_before_exec = no executable = anvil extra_groups = group = idle_kill = 4294967295 secs privileged_group = process_limit = 1 process_min_avail = 1 protocol = service_count = 0 type = anvil unix_listener anvil-auth-penalty { group = mode = 0600 user = } unix_listener anvil { group = mode = 0600 user = } user = $default_internal_user vsz_limit = 18446744073709551615 B } service auth-worker { chroot = client_limit = 1 drop_priv_before_exec = no executable = auth -w extra_groups = group = idle_kill = 0 privileged_group = process_limit = 0 process_min_avail = 0 protocol = service_count = 0 type = worker unix_listener auth-worker { group = mode = 0600 user = $default_internal_user } user = vsz_limit = 18446744073709551615 B } service auth { chroot = client_limit = 0 drop_priv_before_exec = no executable = auth extra_groups = group = idle_kill = 0 privileged_group = process_limit = 1 process_min_avail = 0 protocol = service_count = 0 type = unix_listener auth-client { group = mode = 0600 user = $default_internal_user } unix_listener auth-login { group = mode = 0600 user = $default_internal_user } unix_listener auth-master { group = mode = 0600 user = } unix_listener auth-userdb { group = mode = 0666 user = $default_internal_user } unix_listener login/login { group = mode = 0666 user = } unix_listener token-login/tokenlogin { group = mode = 0666 user = } user = $default_internal_user vsz_limit = 18446744073709551615 B } service config { chroot = client_limit = 0 drop_priv_before_exec = no executable = config extra_groups = group = idle_kill = 4294967295 secs privileged_group = process_limit = 0 process_min_avail = 0 protocol = service_count = 0 type = config unix_listener config { group = mode = 0600 user = } user = vsz_limit = 18446744073709551615 B } service dict-async { chroot = client_limit = 0 drop_priv_before_exec = no executable = dict extra_groups = group = idle_kill = 0 privileged_group = process_limit = 0 process_min_avail = 0 protocol = service_count = 0 type = unix_listener dict-async { group = $default_internal_group mode = 0660 user = } user = $default_internal_user vsz_limit = 18446744073709551615 B } service dict { chroot = client_limit = 1 drop_priv_before_exec = no executable = dict extra_groups = group = idle_kill = 0 privileged_group = process_limit = 0 process_min_avail = 0 protocol = service_count = 0 type = unix_listener dict { group = $default_internal_group mode = 0660 user = } user = $default_internal_user vsz_limit = 18446744073709551615 B } service director { chroot = . client_limit = 0 drop_priv_before_exec = no executable = director extra_groups = fifo_listener login/proxy-notify { group = mode = 00 user = } group = idle_kill = 4294967295 secs inet_listener { address = haproxy = no port = 0 reuse_port = no ssl = no } privileged_group = process_limit = 1 process_min_avail = 0 protocol = service_count = 0 type = unix_listener director-admin { group = mode = 0600 user = } unix_listener director-userdb { group = mode = 0600 user = } unix_listener login/director { group = mode = 00 user = } user = $default_internal_user vsz_limit = 18446744073709551615 B } service dns-client { chroot = client_limit = 1 drop_priv_before_exec = no executable = dns-client extra_groups = group = idle_kill = 0 privileged_group = process_limit = 0 process_min_avail = 0 protocol = service_count = 0 type = unix_listener dns-client { group = mode = 0666 user = } unix_listener login/dns-client { group = mode = 0666 user = } user = $default_internal_user vsz_limit = 18446744073709551615 B } service doveadm { chroot = client_limit = 1 drop_priv_before_exec = no executable = doveadm-server extra_groups = $default_internal_group group = idle_kill = 0 privileged_group = process_limit = 0 process_min_avail = 0 protocol = service_count = 1 type = unix_listener doveadm-server { group = mode = 0600 user = } user = vsz_limit = 18446744073709551615 B } service health-check { chroot = client_limit = 1 drop_priv_before_exec = yes executable = script -p health-check.sh extra_groups = group = idle_kill = 0 privileged_group = process_limit = 0 process_min_avail = 0 protocol = service_count = 0 type = user = $default_internal_user vsz_limit = 18446744073709551615 B } service imap-hibernate { chroot = client_limit = 0 drop_priv_before_exec = no executable = imap-hibernate extra_groups = group = idle_kill = 0 privileged_group = process_limit = 0 process_min_avail = 0 protocol = imap service_count = 0 type = unix_listener imap-hibernate { group = $default_internal_group mode = 0660 user = } user = $default_internal_user vsz_limit = 18446744073709551615 B } service imap-login { chroot = login client_limit = 0 drop_priv_before_exec = no executable = imap-login extra_groups = group = idle_kill = 0 inet_listener imap { address = haproxy = no port = 143 reuse_port = no ssl = no } inet_listener imaps { address = haproxy = no port = 993 reuse_port = no ssl = yes } privileged_group = process_limit = 0 process_min_avail = 5 protocol = imap service_count = 0 type = login user = $default_login_user vsz_limit = 18446744073709551615 B } service imap-urlauth-login { chroot = token-login client_limit = 0 drop_priv_before_exec = no executable = imap-urlauth-login extra_groups = group = idle_kill = 0 privileged_group = process_limit = 0 process_min_avail = 0 protocol = imap service_count = 1 type = login unix_listener imap-urlauth { group = mode = 0666 user = } user = $default_login_user vsz_limit = 18446744073709551615 B } service imap-urlauth-worker { chroot = client_limit = 1 drop_priv_before_exec = no executable = imap-urlauth-worker extra_groups = $default_internal_group group = idle_kill = 0 privileged_group = process_limit = 1024 process_min_avail = 0 protocol = imap service_count = 1 type = unix_listener imap-urlauth-worker { group = mode = 0600 user = $default_internal_user } user = vsz_limit = 18446744073709551615 B } service imap-urlauth { chroot = client_limit = 1 drop_priv_before_exec = no executable = imap-urlauth extra_groups = group = idle_kill = 0 privileged_group = process_limit = 1024 process_min_avail = 0 protocol = imap service_count = 1 type = unix_listener token-login/imap-urlauth { group = mode = 0666 user = } user = $default_internal_user vsz_limit = 18446744073709551615 B } service imap { chroot = client_limit = 1 drop_priv_before_exec = no executable = imap extra_groups = $default_internal_group group = idle_kill = 0 privileged_group = process_limit = 400 process_min_avail = 0 protocol = imap service_count = 1 type = unix_listener imap-master { group = mode = 0600 user = } unix_listener login/imap { group = mode = 0666 user = } user = vsz_limit = 18446744073709551615 B } service indexer-worker { chroot = client_limit = 1 drop_priv_before_exec = no executable = indexer-worker extra_groups = $default_internal_group group = idle_kill = 0 privileged_group = process_limit = 10 process_min_avail = 0 protocol = service_count = 0 type = worker unix_listener indexer-worker { group = mode = 0600 user = $default_internal_user } user = vsz_limit = 18446744073709551615 B } service indexer { chroot = client_limit = 0 drop_priv_before_exec = no executable = indexer extra_groups = group = idle_kill = 0 privileged_group = process_limit = 1 process_min_avail = 0 protocol = service_count = 0 type = unix_listener indexer { group = mode = 0666 user = } user = $default_internal_user vsz_limit = 18446744073709551615 B } service ipc { chroot = empty client_limit = 0 drop_priv_before_exec = no executable = ipc extra_groups = group = idle_kill = 0 privileged_group = process_limit = 1 process_min_avail = 0 protocol = service_count = 0 type = unix_listener ipc { group = mode = 0600 user = $default_internal_user } unix_listener login/ipc-proxy { group = mode = 0600 user = $default_login_user } user = $default_internal_user vsz_limit = 18446744073709551615 B } service lmtp { chroot = client_limit = 1 drop_priv_before_exec = no executable = lmtp extra_groups = $default_internal_group group = idle_kill = 0 privileged_group = process_limit = 0 process_min_avail = 0 protocol = lmtp service_count = 0 type = unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 01224 user = postfix } unix_listener lmtp { group = mode = 0666 user = } user = vsz_limit = 18446744073709551615 B } service log { chroot = client_limit = 0 drop_priv_before_exec = no executable = log extra_groups = group = idle_kill = 4294967295 secs privileged_group = process_limit = 1 process_min_avail = 0 protocol = service_count = 0 type = log unix_listener log-errors { group = mode = 0600 user = } user = vsz_limit = 18446744073709551615 B } service managesieve-login { chroot = login client_limit = 0 drop_priv_before_exec = no executable = managesieve-login extra_groups = group = idle_kill = 0 inet_listener sieve { address = haproxy = no port = 4190 reuse_port = no ssl = no } privileged_group = process_limit = 0 process_min_avail = 0 protocol = sieve service_count = 1 type = login user = $default_login_user vsz_limit = 18446744073709551615 B } service managesieve { chroot = client_limit = 1 drop_priv_before_exec = no executable = managesieve extra_groups = group = idle_kill = 0 privileged_group = process_limit = 0 process_min_avail = 0 protocol = sieve service_count = 1 type = unix_listener login/sieve { group = mode = 0666 user = } user = vsz_limit = 18446744073709551615 B } service old-stats { chroot = empty client_limit = 0 drop_priv_before_exec = no executable = old-stats extra_groups = fifo_listener old-stats-mail { group = mode = 0600 user = } fifo_listener old-stats-user { group = mode = 0600 user = } group = idle_kill = 4294967295 secs privileged_group = process_limit = 1 process_min_avail = 0 protocol = service_count = 0 type = unix_listener old-stats { group = mode = 0600 user = } user = $default_internal_user vsz_limit = 18446744073709551615 B } service pop3-login { chroot = login client_limit = 0 drop_priv_before_exec = no executable = pop3-login extra_groups = group = idle_kill = 0 inet_listener pop3 { address = haproxy = no port = 110 reuse_port = no ssl = no } inet_listener pop3s { address = haproxy = no port = 995 reuse_port = no ssl = yes } privileged_group = process_limit = 0 process_min_avail = 0 protocol = pop3 service_count = 1 type = login user = $default_login_user vsz_limit = 18446744073709551615 B } service pop3 { chroot = client_limit = 1 drop_priv_before_exec = no executable = pop3 extra_groups = $default_internal_group group = idle_kill = 0 privileged_group = process_limit = 200 process_min_avail = 0 protocol = pop3 service_count = 1 type = unix_listener login/pop3 { group = mode = 0666 user = } user = vsz_limit = 18446744073709551615 B } service quota-warning { chroot = client_limit = 0 drop_priv_before_exec = no executable = script /var/lib/dovecot/quota-warning.sh extra_groups = group = idle_kill = 0 privileged_group = process_limit = 0 process_min_avail = 0 protocol = service_count = 1 type = unix_listener quota-warning { group = dovecot mode = 0666 user = dovecot } user = vsz_limit = 18446744073709551615 B } service replicator { chroot = client_limit = 0 drop_priv_before_exec = no executable = replicator extra_groups = group = idle_kill = 4294967295 secs privileged_group = process_limit = 1 process_min_avail = 0 protocol = service_count = 0 type = unix_listener replicator-doveadm { group = mode = 00 user = $default_internal_user } unix_listener replicator { group = mode = 0600 user = $default_internal_user } user = vsz_limit = 18446744073709551615 B } service stats { chroot = client_limit = 0 drop_priv_before_exec = no executable = stats extra_groups = group = idle_kill = 4294967295 secs privileged_group = process_limit = 1 process_min_avail = 0 protocol = service_count = 0 type = unix_listener stats-reader { group = mode = 0600 user = } unix_listener stats-writer { group = $default_internal_group mode = 0660 user = } user = $default_internal_user vsz_limit = 18446744073709551615 B } service submission-login { chroot = login client_limit = 0 drop_priv_before_exec = no executable = submission-login extra_groups = group = idle_kill = 0 inet_listener submission { address = haproxy = no port = 587 reuse_port = no ssl = no } privileged_group = process_limit = 0 process_min_avail = 0 protocol = submission service_count = 1 type = login user = $default_login_user vsz_limit = 18446744073709551615 B } service submission { chroot = client_limit = 1 drop_priv_before_exec = no executable = submission extra_groups = $default_internal_group group = idle_kill = 0 privileged_group = process_limit = 1024 process_min_avail = 0 protocol = submission service_count = 1 type = unix_listener login/submission { group = mode = 0666 user = } user = vsz_limit = 18446744073709551615 B } shutdown_clients = yes ssl = yes ssl_alt_cert = ssl_alt_key = ssl_ca = ssl_cert = </etc/pki/dovecot/certs/dovecot.pem ssl_cert_username_field = commonName ssl_cipher_list = PROFILE=SYSTEM ssl_cipher_suites = ssl_client_ca_dir = ssl_client_ca_file = ssl_client_cert = ssl_client_key = ssl_client_require_valid_cert = yes ssl_crypto_device = ssl_curve_list = ssl_dh = ssl_key = # hidden, use -P to show it ssl_key_password = ssl_min_protocol = TLSv1.2 ssl_options = ssl_prefer_server_ciphers = no ssl_require_crl = yes ssl_verify_client_cert = no state_dir = /var/lib/dovecot stats_http_rawlog_dir = stats_writer_socket_path = stats-writer submission_client_workarounds = submission_host = submission_logout_format = in=%i out=%o submission_max_mail_size = 0 submission_max_recipients = 0 submission_relay_command_timeout = 5 mins submission_relay_connect_timeout = 30 secs submission_relay_host = submission_relay_master_user = submission_relay_max_idle_time = 29 mins submission_relay_password = submission_relay_port = 25 submission_relay_rawlog_dir = submission_relay_ssl = no submission_relay_ssl_verify = yes submission_relay_trusted = no submission_relay_user = submission_ssl = no submission_timeout = 30 secs syslog_facility = mail userdb { args = auth_verbose = default default_fields = driver = passwd name = override_fields = result_failure = continue result_internalfail = continue result_success = return-ok skip = never } valid_chroot_dirs = verbose_proctitle = no verbose_ssl = no version_ignore = no protocol lmtp { mail_plugins = " sieve" userdb { args = username_format=%n /etc/passwd driver = passwd-file name = } } protocol imap { mail_plugins = " imap_quota imap_sieve quota" } local_name sub.domain.tld { ssl_cert = </etc/pki/dovecot/certs/sub.domain.tld.pem ssl_key = # hidden, use -P to show it } local_name othersub.domain.tld { ssl_cert = </etc/dovecot/cert.othersub.domain.tld.pem ssl_key = # hidden, use -P to show it } ############################# /etc/passwd ############################# test@s32.someteststring.ml:x:14127:3625:fsadf:/home/s32/homes/test:/dev/null test-s32.someteststring.ml:x:14127:3625:fsadf:/home/s32/homes/test:/dev/null ############################# /etc/postfix/virtual ############################# test(a)s32.someteststring.ml test-s32.someteststring.ml #############################

1 0

submissiond xoauth2 authentication: line too long
by Tobias Florek 04 Jan '23

04 Jan '23

Hi, I am running the latest container image which has dovecot-submissiond 2:2.3.20-3+debian11 I am running into the following problem. I have successfully set up xoauth2 for IMAP and ManageSieve. Now when roundcube tries to send email to submissiond it fails with 500 5.5.2 Line too long This happens right after roundcube sends AUTH XOAUTH2 dXNlcj10ZkBzY2hhZWZmZXItYWcu[...] (a line of length 2149 characters). Reading RFC 4954, section 4 I suppose that this does not look standard compliant. Am I correct? I will raise this issue with roundcube as well. Cheers, Tobi

1 1

CRAM MD5 passwd db permission issue
by Gerben Wierda 04 Jan '23

04 Jan '23

I am busy migrating. I am moving from macOS+MacPorts to Ubuntu+Docker On the old system, I have this in the dovecot config: mail_uid = _dovecot mail_gid = mail mail_privileged_group = mail mail_access_groups = mail This seems weird to me, I think the dovecot user should be in group dovecot only if I understand the docs. On the old system dovecot, postfix, dovenull and rspamd are all members of the mail group. On that system, the cram md5 passwd database (file) has these permissions: drwxr-xr-x 3 root wheel 96 Feb 2 2021 . drwxr-xr-x 22 root admin 704 Jan 4 15:17 .. -rw-r----- 1 root mail 1234 Feb 2 2021 cram-md5.pwd and that has worked like that for many years, basically starting with Mac OS X Server, surviving all kinds of macOS migrations. On my new Ubuntu system I've copied this setup over: drwxr-xr-x 2 root root 4096 Jan 4 09:49 . drwxr-xr-x 7 root root 4096 Jan 4 15:21 .. -rw-r----- 1 root mail 1234 Feb 2 2021 cram-md5.pwd mail_uid = dovecot mail_gid = mail mail_privileged_group = mail mail_access_groups = mail But: Jan 04 15:40:08 auth: Error: passwd-file /etc/dovecot/etc/cram-md5.pwd:open(/etc/dovecot/etc/cram-md5.pwd) failed: Permission denied (euid=91(dovecot) egid=91(dovecot) missing +r perm: /etc/dovecot/etc/cram-md5.pwd, we're not in group 8(mail), dir owned by 0:0 mode=0755) And really, dovecot is in group mail. From /etc/group: mail:x:8:postfix,dovecot dovenull:x:90: dovecot:x:91: And from /etc/passwd: dovenull:x:90:90::/home/dovenull:/usr/sbin/nologin dovecot:x:91:91::/home/dovecot:/usr/sbin/nologin So, that I get this error baffles me. Gerben Wierda (LinkedIn <https://www.linkedin.com/in/gerbenwierda>) R&A IT Strategy <https://ea.rna.nl/> (main site) Book: Chess and the Art of Enterprise Architecture <https://ea.rna.nl/the-book/> Book: Mastering ArchiMate <https://ea.rna.nl/the-book-edition-iii/>

2 1

doveadm proxy list has strange entries
by Tobias Florek 02 Jan '23

02 Jan '23

Hi! I am using dovecot from the latest docker image: Version 2:2.3.20-3+debian11 When getting the proxy list I get the following entries. # doveadm -f flow proxy list username=user(a)example.com proto=imap src ip=10.254.0.13 dest ip=172.23.6.194 port=143 username=username proto=service src ip=src-ip dest ip=dest-ip port=dest-port username=user2(a)example.com proto=imap src ip=10.254.0.13 dest ip=172.23.6.194 port=143 username=username proto=service src ip=src-ip dest ip=dest-ip port=dest-port username=user3(a)example.com proto=imap src ip=10.254.0.13 dest ip=172.23.6.194 port=143 username=username proto=service src ip=src-ip dest ip=dest-ip port=dest-port ... These correspond to the http API's response: # curl -H "Authorization: X-Dovecot-API $(echo -n MY_API_KEY|base64 -w0)" http://localhost:8080/doveadm/v1 -H "Content-Type: application/json" -d '[["proxyList",{},"tag1"]]' | jq [ [ "doveadmResponse", [ { "username": "user(a)example.com", "service": "imap", "src-ip": "10.254.0.13", "dest-ip": "172.23.6.194", "dest-port": "143" }, { "username": "username", "service": "service", "src-ip": "src-ip", "dest-ip": "dest-ip", "dest-port": "dest-port" }, ... ], "tag1" ] ] This does not look right. Cheers, Tobias Florek

3 2

Error: Failed to get quota resource STORAGE: quota-fs: quotactl(Q_GETQUOTA, NFS:/home) failed: No such file or directory
by Jorge Concha C. 01 Jan '23

01 Jan '23

Hello everyone, I'm migrating my dovecot (imap) server from CentOS-6 to RockyLinux-9, but I can't get the QUOTA-FS plugin to work. When trying the "doveadm quota get -u user" command, it returns an error "doveadm(user): Error: Failed to get quota resource STORAGE: quota-fs: quotactl(Q_GETQUOTA, nfs:/home) failed: No such file or directory" If the user has his "$home" on a local drive, everything works fine, but if the user has his $home on a nfs-filesystem, it throws that error. On CentOS-6, everything works fine, with the same users on the same nfs-filesystem. I don't know if it is the product of the OS change or the dovecot version change. CentOS6 -> Dovecot 2.2.10 RockyLinux-9 -> Dovecot 2.3.16 Does anyone have any ideas? Thanks -- Jorge Concha C. Área de Sistemas - CEC U. de Chile

3 12

Iteration failure on passwd-file when listing all users?
by EML 31 Dec '22

31 Dec '22

Dovecot 2.3.16, Ubuntu 22.04. I'm trying to get a list of all dovecot users, on a simple test setup on my local network (which "works", in that I can get IMAP mails from dovecot): passdb { driver = passwd-file args = /var/mail/vhosts/%d/shadow } userdb { driver = passwd-file args = /var/mail/vhosts/%d/passwd } The command 'doveadm user -u foo(a)example.com' correctly shows that user. However, any attempt to wildcard the user fails: # doveadm user -u *(a)example.com Error: auth-master: userdb list: User listing returned failure Fatal: user listing failed The log file shows Error: conn unix:auth-worker (pid=13471,uid=129): auth-worker<1>: passwd-file(*(a)example.com): passwd-file: User iteration isn't currently supported with %variable paths Any ideas? And, if I can get this to work, is this method any better than just reading /var/mail/vhosts/example.com/passwd and extracting the first field to get the user name? Or just finding all the maildir directories in /var/mail/vhosts/example.com? Thanks. If you're interested, I'm doing this so that I can automate postfix setup (by mapping new addresses to known dovecot users in the postfix virtual mailbox file). The vmailbox file might look like: # 'user1' is a known dovecot user foo(a)example.com example.com/user1

3 6

Permissions issue with doveadm mailbox command
by James Moe 31 Dec '22

31 Dec '22

I have been exploring dovecot and came across this: $ sudo doveadm mailbox list doveadm(root): Error: Mail access for users with UID 303 not permitted (see first_valid_uid in config file, uid from mail_uid setting). Hmm. After setting "first_valid_uid = 300": $ sudo doveadm mailbox list doveadm(root)<4380><4VP8EENer2McEQAAvbJltg>: Error: chdir(/root/) failed: Permission denied (euid=303(vmail) egid=303(vmail) missing +x perm: /root, dir owned by 0:0 mode=0700) INBOX I do not understand the error message. The current configuration. (Note I have changed first_valid_uid to its original value.) $ postconf -n # 2.3.15 (0503334ab1): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.15 (e6a84e31) # OS: Linux 5.14.21-150400.24.33-default x86_64 btrfs # Hostname: sma-server3.sma.com auth_mechanisms = plain login base_dir = /var/run/dovecot/ debug_log_path = /data01/var/log/dovecot/dovecot-debug.log disable_plaintext_auth = no first_valid_uid = 1001 info_log_path = /data01/var/log/dovecot/dovecot-info.log log_path = /data01/var/log/dovecot/dovecot.log log_timestamp = %Y-%m-%dT%H:%M:%S mail_gid = vmail mail_location = maildir:/var/mail/vmail/%u/ mail_uid = vmail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { driver = pam } passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } plugin { sieve = file:~/sieve;active=~/.dovecot.sieve } protocols = imap service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } } service log { group = users user = dovecot } ssl = no ssl_cipher_list = ALL:!aNULL:!eNULL:!EXPORT:!DES:!3DES:!MD5:!PSK:!RC4:!ADH:!LOW@STRENGTH ssl_options = no_compression ssl_prefer_server_ciphers = yes userdb { driver = passwd } userdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } -- James Moe moe dot james at sohnen-moe dot com 520.743.3936 Think.

2 1

Permissions for dovecot logging
by James Moe 31 Dec '22

31 Dec '22

dovecot 2.3.15 opensuse LEAP 15.4 I changed logging to use a path rather than syslog. Doing so makes it easier to work with fail2ban. Dovecot fails to start with the error: Can't open log file /data01/var/log/dovecot.log: Permission denied Permissions: drwxrwxr-x 1 root users 104 Feb 25 2018 /data01/ drwxrwxr-x 1 sma-user3x users 102 Dec 17 14:50 /data01/var/ drwxrwxr-x 1 sma-user3x users 146 Dec 27 15:37 /data01/var/log/ drwxrwxr-x 1 dovecot users 22 Dec 27 15:47 /data01/var/log/dovecot/ "dovecot" is a member of "users". What "permission" am I missing? Note: A long time ago I had a problem with programs consuming all available space on the system disk with log or backup files. I have since gotten in the habit of putting log files on a non-system disk. -- James Moe moe dot james at sohnen-moe dot com 520.743.3936 Think.

4 6

Self hosting solution for Christmas
by Andre Rodier 29 Dec '22

29 Dec '22

Hello everyone, Here my present for Christmas: a new version of HomeBox, the self hosted email solution. Feel free to drop comments, create issues, update the docs, etc. I released this quickly before going on vacation, so you may find some issues. However, this is mostly stable, and the code is easy to modify. Also, you can now add and remove components individually, with an Ansible playbook. https://github.com/progmaticltd/homebox System installation and features - Custom Debian installer generation with full disk encryption and fully automatic installation. - Unlock the system upon boot by entering the passphrase through SSH. - Install packages only from Debian stable (Bullseye). - Automatic letsencrypt certificates generation using Lego and DNS challenge. - Automatic security updates (optional). - Centralised authentication with an LDAP users database, SSL certificate, password policies, PAM integration. - AppArmor activated with a profile for all daemons. - XKCD Random passwords generated and saved into pass (or on file system). - Can be used at home, on a dedicated or virtual server hosted online. - Flexible IP address support: IPv4 only, IPv6 only, and IPv4+IPv4 or IPv4+IPv6. - Embedded DNS server, with CAA, DNSSEC and SSHFP (SSH fingerprint) support. - Grade A https sites, HSTS implemented by default. - Automatic configuration of OpenPGP Web Key Directory. - Automatic firewall rules for inbound, outbound and forwarding traffic, using nftables. - Restricted outbound web sites access to the minimum. - Automatic update of DNS keys, DNS servers and glue records on Gandi. Emails - Postfix configuration and installation, with LDAP lookups, internationalised email aliases, fully SSL compliant. - Generate DKIM keys, SPF and DMARC DNS records. The DKIM keys are generated every year. - Automatic copy of sent emails into the sent folder. - Automatic creation of the postmaster account and special email addresses using RFC 2142 specifications. - Dovecot configuration, IMAPS, POP3S, Quotas, ManageSieve. - Simple spam and ham learning by moving emails in and out the Junk folder - Sieve and vacation scripts. - Virtual folders for server search: unread messages, conversations view, all messages, flagged and messages labelled as "important". - Email addresses with recipient delimiter included, e.g. john.doe+lists(a)dbcooper.com. - Optional master user creation, e.g. for families with children or moderated communities. - Server side full text search inside emails, attached documents and files and compressed archives, with better results than GMail. - SOGo webmail with sieve filters management, password change form, Calendar and Address book management, GUI to import other account emails. - Powerful and light antispam system with rspamd and optional access to the web interface. - Antivirus for inbound and outbound emails with clamav (optional). - Automatic configuration for Thunderbird and Outlook using published XML and other clients with special DNS records (RFC 6186). Calendar and Address book - Install and configure a CalDAV / CardDAV server, with automatic discovery (RFC 6186). - Groupware functionality in a web interface, with SOGo. - Recurring events, email alerts, shared address books and calendars. - Mobile devices compatibility: Android, Apple iOS, BlackBerry 10 and Windows mobile through Microsoft ActiveSync. Other optional features - Incremental backups, encrypted, on multiple destination (SFTP, S3, Samba share or USB drive), with email and Jabber reporting. - Jabber server, using ejabberd, with LDAP authentication, direct or offline file transfer and optional server to server communication. - Static web site skeleton configuration, with https certificates and A+ security grade by default. Development - YAML files validation on each commit, using travis-ci. - End to end integration tests for the majority of components. - Playbooks to facilitate the installation or removal of development packages. - Global debug flag to activate the debug mode of all components. - Fully open source Ansible scripts licensed under GPLv3. Merry Christmas, André

4 7

Sieve duplicates
by Ferenc 28 Dec '22

28 Dec '22

Hi list, I’m trying this again from a different account because of lots of SPF warnings. I have Sieve scripts that duplicate e-mails. I don’t want that. My dovecot version is 2.3.4.1 (f79e8e7e4), Pigeonhole version 0.5.4 on Linux 5.4.189-2-pve x86_64 Debian 10.13. My scripts get called on an imap COPY action (imapsieve extension). The mail is fed to an external script (spam/ham training or retraining) via a pipe :copy action (vnd.dovecot.pipe extension). An header is added to keep track of what happened (editheader extension). I use "if header :contains” for my (simple) logic. If contains header X, do this, add header Y. If contains header Y, do that, add header X. I end each "if” part with “keep;" and “stop;” commands. Simple versions of the scripts, without the if-then construct, seem to work ok with imapsieve. As soon as I try to use if-then-else I find a duplicate of the processed e-mail; the original mail seems to be untouched, the duplicate appears to have been processed. With macos mail not all duplicates show up but with Roundcube webmail I can see them all. The scripts are like this: # without if-then require … pipe :copy … addheader … keep; # with if-then require … if header :contains pipe :copy … addheader … keep; stop; if not exists pipe :copy … addheader … keep; stop; keep; The scripts get called from “imapsieve_mailbox1_before” for example. Cheers, Ferenc

2 2

Dovecot v2.3.20 released
by Aki Tuomi 28 Dec '22

28 Dec '22

We are pleased to release v2.3.20 of Dovecot. https://dovecot.org/releases/2.3/dovecot-2.3.20.tar.gz https://dovecot.org/releases/2.3/dovecot-2.3.20.tar.gz.sig Binary packages in https://repo.dovecot.org/ Docker images in https://hub.docker.com/r/dovecot/dovecot Regards, Aki Tuomi Open-Xchange oy -- + Add dsync_features=no-header-hashes. When this setting is enabled and one dsync side doesn't support mail GUIDs (i.e. imapc), there is no fallback to using header hashes. Instead, dsync assumes that all mails with identical IMAP UIDs contains the same mail contents. This can significantly improve dsync performance with some IMAP servers that don't support caching Date/Message-ID headers. + lua: HTTP client has more settings now, see https://doc.dovecot.org/admin_manual/lua/#dovecot.http.client + replicator: "doveadm replicator status" command now outputs when the next sync is expected for the user. - LAYOUT=index: duplicate GUIDs were not cleaned out. Also the list recovery was not optimal. - auth: Assert crash would occur when iterating multiple userdb backends. - director: Logging into director using master user with auth_master_user_separator character redirected user to a wrong backend, unless master_user_separator setting was also set to the same value. Merged these into auth_master_user_separator. - dsync: Couldn't always fix folder GUID conflicts automatically with Maildir format. This resulted in replication repeatedly failing with "Remote lost mailbox GUID". - dsync: Failed to migrate INBOX when using namespace prefix=INBOX/, resulting in "Remote lost mailbox GUID" errors. - dsync: INBOX was created too early with namespace prefix=INBOX/, resulting a GUID conflict. This may have been resolved automatically, but not always. - dsync: v2.3.18 regression: Wrong imapc password with dsync caused Panic: file lib-event.c: line 506 (event_pop_global): assertion failed: (event == current_global_event) - imapc: Requesting STATUS for a mailbox with imapc and INDEXPVT configured did not return correct (private) unseen counts. - lib-dict: Process would crash when committing data to redis without dict proxy. - lib-mail: Corrupted cached BODYSTRUCTURE caused panic during FETCH. Fixes: Panic: file message-part-data.c: line 579 (message_part_is_attachment): assertion failed: (data != NULL). v2.3.13 regression. - lib-storage: mail_attribute_dict with dict-sql failed when it tried to lookup empty dict keys. - lib: ioloop-kqueue was missing include breaking some BSD builds. - lua-http: Dovecot Lua HTTP client could not resolve DNS names in mail processes, because it expected "dns-client" socket to exist in the current directory. - oauth2: Using %{oauth2:name} variables could cause useless introspections. - pop3: Sending POP3 command with ':' character caused an assert-crash. v2.3.18 regression. - replicator: Replication queue had various issues, potentially causing replication requests to become stuck. - stats: Invalid Prometheus label names were created with specific

5 7

Happy Holidays From SCOM.CA Internet Services Inc.
by Paul Kudla 23 Dec '22

23 Dec '22

1 0

Pigeonhole v0.5.20 released
by Aki Tuomi 22 Dec '22

22 Dec '22

We are pleased to release v0.5.20 of Pigeonhole. https://pigeonhole.dovecot.org/releases/2.3/dovecot-2.3-pigeonhole-0.5.20.t… https://pigeonhole.dovecot.org/releases/2.3/dovecot-2.3-pigeonhole-0.5.20.t… Binary packages in https://repo.dovecot.org/ Docker images in https://hub.docker.com/r/dovecot/dovecot Regards, Aki Tuomi Open-Xchange oy -- * No changes - release done to keep version numbers synced.

1 0

OT: Two simultaneous POP3 connections from Outlook
by kjohnson＠eclypse.org 21 Dec '22

21 Dec '22

Hello, I recognize this may be somewhat off-topic, but my search-fu has failed to provide useful results, so I ask for pointers to further information. Today, while examining Dovecot logs, I found a case where the Outlook mail client (probably 2016 or later) on a user's computer opened two simultaneous, or at least overlapping, POP3 connections to Dovecot. This did not go well, naturally. Warning: Transaction log file .../mail/.imap/INBOX/dovecot.index.log was locked for 156 seconds (rotating while syncing) If anyone else has found useful information about this peculiar behavior for an email client, I would be pleased to receive a pointer in that direction. Thank you. Ken

2 1

How is URLAUTH broken, and for how long?
by Andy Balholm 21 Dec '22

21 Dec '22

The documentation for imap_urlauth_host says: > Warning > > URLAUTH in current versions of Dovecot is broken in several ways. > This will be fixed in the future, but activating URLAUTH support > on production systems is not recommended. In what ways is it broken? Is anyone actually working on fixing it? Andy

1 0

Re: SPF DNS Error / R_SPF_DNSFAIL
by Jochen Bern 20 Dec '22

20 Dec '22

On 19.12.22 13:20, Carlos Mogas da Silva wrote: > On Mon, 2022-12-19 at 12:38 +0100, Benny Pedersen wrote: >> Carlos Mogas da Silva skrev den 2022-12-19 11:57: >>> What can cause this error and/or how can I debug it? >> >> try avoid to many dns querys > > Even on a caching dns server? Any ideas on why it is failing? I don't remember it being in an actual RFC, but SPF records are supposed to not require more than 10 DNS queries to fully resolve. https://dmarcian.com/spf-survey/ gives cttexpresso.pt an all-green result, but notes that the "+a:email.reditus.pt" part is inoperational ("no A or AAAA RRs found", in fact, I'm getting an NXDOMAIN for the FQDN). Regards, -- Jochen Bern Systemingenieur Binect GmbH

1 0

SPF DNS Error / R_SPF_DNSFAIL
by Carlos Mogas da Silva 20 Dec '22

20 Dec '22

Hi list. My incoming messages are getting R_SPF_DNSFAIL and an error on the Authentication-Results header: spf=temperror (mail01.r3pek.org: error in processing during lookup of no-reply(a)cttexpresso.pt: DNS error) I see the DNS request on my DNS server and a "working" reply going out. What can cause this error and/or how can I debug it?

4 6

mail filters
by mick.crane 20 Dec '22

20 Dec '22

I'm using what ever is in Debian Bookworm, I'm pretty sure. These filters? I collect from different email addresses like gmail and that. If filter for the "Sent to" email address, move to this directory If "From" contains "blah", move to this other directory. If something is Sent to and also From contains "blah" then I get 2 copies of the message in both filter directories. How can I fix this? regards mick

5 6

feature request: add base64 variable modifier
by alex 19 Dec '22

19 Dec '22

Hi, It would be very convenient to have a base64 variable modifier. Main use-case is to base64-encode passwords when changing your hashing scheme. With a base64 encoding modifier (e.g. %B) something like this would safely work: userdb { driver = prefetch default_fields = plain_pass=%Bw } without things breaking when there are %-characters in the password, and without having to send the plaintext password to the database, as current solutions propose, which is never a good idea. alternative solution: adapt the generic hash-modifier to accept a none/plaintext hashing-scheme and use the base64 output functionality that is already available there. Thanks! Alex

1 0

What do I do with the ".ext?"
by James Moe 18 Dec '22

18 Dec '22

dovecot 2.3.15 opensuse LEAP 15.4 I am installing dovecot and have postfix as the SMTP agent. It also needs to use a MySQL database. In </etc/dovecot> there is the main dovecot.conf file, and a number of other files with the extension ".conf.ext." It is not clear how to use these. I could nothing in the documentation that discusses it. Do I copy one, say dovecot-sql.conf.ext, modify it: - rename the copy without the ".ext?" - or move the copy to the "conf.d" directory, with or without the "ext?" -- James Moe moe dot james at sohnen-moe dot com 520.743.3936 Think.

2 2

2.3.14: stale imap-login processes due to bogus user setup tying up process limit
by Volker Stolz 16 Dec '22

16 Dec '22

I just dealt with an interesting Dovecot issue on our small server, and thought I might share it. I also feel that although in the end it was a configuration error, Dovecot should somehow avoid leaving this processes around and hence filling up the process limit quickly. - set up Dovecot IMAP on Debian buster (either with the older 2.3.x Debian package, or 2.3.14 from the dovecot-repo) - config: ... namespace inbox { inbox = yes location = ... default settings ... ... passdb { args = scheme=HMAC-MD5 username_format=%u /etc/dovecot/users driver = passwd-file } protocols = " imap" ... userdb { args = blocking=no driver = passwd } ... - secret sauce: have a user in the passdb that doesn't have a physical account on the system yet (we were migrating to a new machine). The log-file shows successful authentication for that user (after we flipped DNS to point to this new machine), but over time (2-3 times/day) we were left with an increasing number of `imap-login` processes in state `pre-login`, eventually requiring a dovecot restart. Dialling up process_limits didn't seem to help, we'd just get more of these stale processes. After creating the user on the system, the behaviour reverted to normal, no more stale processes. I do not know what error message that user received on their end, but since we announced we were migrating, they probably just ignored it and thought it as part of the transition. Best, Volker (a happy & long Dovecot user)

3 4

Re: Can't figure out why managesieve (pigeonhole) can't connect
by colin＠colinlikesfood.com 15 Dec '22

15 Dec '22

thank you again. it seems you have seen my paste of config.inc.php. I do not have a config.php: my_user@some_host:/usr/local/www/roundcube/config # ls -l total 67 -rw-r--r-- 1 root wheel 164 Jul 23 15:17 .htaccess -rw-r--r-- 1 root wheel 1867 Nov 22 15:12 config.inc.php -rw-r--r-- 1 root wheel 2943 Jul 23 15:17 config.inc.php.sample -rw-r--r-- 1 root wheel 63790 Oct 29 20:24 defaults.inc.php -rw-r--r-- 1 root wheel 2806 Jul 23 15:17 mimetypes.php my_user@some_host:/usr/local/www/roundcube/config # I have tried changing tls:// to ssl:// and back again (in the line $config['managesieve_host'] = 'tls://obfuscated.domain';) but the error remains the same: roundcube: PHP Error: Connection refused (GET /index.php?_task=settings&_action=plugin.managesieve) roundcube: PHP Error: Unable to connect to managesieve on obfuscated.domain:4190 in /usr/local/www/roundcube/plugins/managesieve/lib/Roundcube/rcube_sieve_engine.php on line 221 (GET /index.php?_task=settings&_action=plugin.managesieve) roundcube: PHP Error: Not currently in AUTHORISATION state (GET /index.php?_task=settings&_action=plugin.managesieve) php: PHP Error: Not currently connected (GET /index.php?_task=settings&_action=plugin.managesieve) roundcube: PHP Error: Connection refused (GET /index.php?_task=settings&_action=plugin.managesieve-action&_framed=1&_nav=hide) roundcube: PHP Error: Unable to connect to managesieve on obfuscated.domain:4190 in /usr/local/www/roundcube/plugins/managesieve/lib/Roundcube/rcube_sieve_engine.php on line 221 (GET /index.php?_task=settings&_action=plugin.managesieve-action&_framed=1&_nav=hide) php: PHP Error: Not currently connected (GET /index.php?_task=settings&_action=plugin.managesieve-action&_framed=1&_nav=hide) roundcube: PHP Error: Connection refused (POST /?_task=settings&_action=plugin.managesieve-save) roundcube: PHP Error: Unable to connect to managesieve on obfuscated.domain:4190 in /usr/local/www/roundcube/plugins/managesieve/lib/Roundcube/rcube_sieve_engine.php on line 221 (POST /?_task=settings&_action=plugin.managesieve-save) i don't understand why it can't connect, this seems to work fine: # gnutls-cli --tofu --starttls -p 4190 10.0.0.91 Processed 142 CA certificate(s). Resolving '10.0.0.91:4190'... Connecting to '10.0.0.91:4190'... - Simple Client Mode: "IMPLEMENTATION" "dovecot" "SIEVE" "fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext" "NOTIFY" "mailto" "SASL" "CRAM-MD5" "STARTTLS" "VERSION" "1.0" OK "Dovecot ready." STARTTLS OK "Begin TLS negotiation now." *** Starting TLS handshake - Certificate type: X.509 - Got a certificate list of 3 certificates. - Certificate[0] info: - subject `CN=obfuscated.domain.com', issuer `CN=R3,O=Let's Encrypt,C=US', serial xxxxxxxxxxxxxxxxxxxxxx, RSA key 2048 bits, signed using RSA-SHA256, activated `yyyy-mm-dd 17:48:15 UTC', expires `yyyy-mm-dd 17:48:14 UTC', pin-sha256="xxxxxxxxxxxxxxxxxxxxxx" Public Key ID: sha1:xxxxxxxxxxxxxxxxxxxxxx sha256:xxxxxxxxxxxxxxxxxxxxxx Public Key PIN: pin-sha256:xxxxxxxxxxxxxxxxxxxxxx - Certificate[1] info: - subject `CN=R3,O=Let's Encrypt,C=US', issuer `CN=ISRG Root X1,O=Internet Security Research Group,C=US', serial xxxxxxxxxxxxxxxxxxxxxx, RSA key 2048 bits, signed using RSA-SHA256, activated `yyyy-mm-dd 00:00:00 UTC', expires `yyyy-mm-dd 16:00:00 UTC', pin-sha256="xxxxxxxxxxxxxxxxxxxxxx" - Certificate[2] info: - subject `CN=ISRG Root X1,O=Internet Security Research Group,C=US', issuer `CN=DST Root CA X3,O=Digital Signature Trust Co.', serial yyyy-mm-dd, RSA key 4096 bits, signed using RSA-SHA256, activated `yyyy-mm-dd 19:14:03 UTC', expires `yyyy-mm-dd 18:14:03 UTC', pin-sha256="xxxxxxxxxxxxxxxxxxxxxx" - Status: The certificate is NOT trusted. The name in the certificate does not match the expected. *** PKI verification of server certificate failed... Host 10.0.0.91 (sieve) has never been contacted before. Its certificate is valid for 10.0.0.91. Are you sure you want to trust it? (y/N): y - Description: (TLS1.3-X.509)-(ECDHE-SECP256R1)-(RSA-PSS-RSAE-SHA256)-(AES-256-GCM) - Session ID: xx:yy:xx:yy:xx:yy... - Options: "IMPLEMENTATION" "dovecot" "SIEVE" "fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext" "NOTIFY" "mailto" "SASL" "CRAM-MD5" "VERSION" "1.0" OK "TLS negotiation successful." On 2022-11-23 13:35, Yassine Chaouche wrote: > also make sure your are editing config.php and not config.inc.php > (which you pasted) > > Yassine. > > Le 23 novembre 2022 8:30:36 PM GMT+01:00, Yassine Chaouche > <a.chaouche(a)algerian-radio.dz> a écrit : > >> good. we have established that the problem shouldn't be on dovecot's >> side. i suspect roundcube is misconfigured or can't connect for some >> reason. I believe someone mentioned SSL and TLS support problem in RC >> for a specific version? can you try without? also can you paste RC >> config? >> >> Yassine.

5 6

Kerberos/GSSAPI auth weirdness?
by r3pek 14 Dec '22

14 Dec '22

Hi list! I'm migrating my server into a new REALM (INT.R3PEK.ORG) from an old one (R3PEK.ORG) This is a completely new install and configuration, so no leftovers exits. The machine is correctly register into the REALM and users are able to login without a problem. Now, when I try to login using a Kerberos ticket, for some reason that I can't understand, dovecot is looking for a ticket on the old REALM. Maybe because of the email domain (which stayed the same)? This is the error message I see on the clients: "Failed to authenticate: Server krbtgt/R3PEK.ORG(a)INT.R3PEK.ORG" The one it should be looking for is krbtgt/INT.R3PEK.ORG(a)INT.R3PEK.ORG, but I can't seem to figure out where the problem is. # doveconf | grep -i realm auth_default_realm = INT.R3PEK.ORG auth_realms = INT.R3PEK.ORG What do I need to change to make this work?

1 0

sasl service for other app
by Henry R 13 Dec '22

13 Dec '22

can dovecot run as a general sasl service for other apps? such as webdav. Thanks.

6 10

Backups
by Doug Hardie 11 Dec '22

11 Dec '22

I started to investigate using doveadm backup to backup my mail system. I have a small number of users and the mail store is not large. It uses maildir format. I setup a test system that is not connected to the internet and started up dovecot. I used the following command to backup one user: doveadm backup -u ben remote:test ben is the user is in the mail store. Test is the actual server name. That worked just fine. The maildir was copied completely (as best as I can tell with ls). Then I tried the second user: doveadm backup -u jean remote:test This gives 2 error messages: doveadm(jean)[]<McRYOFI0jGN1MwAAmC+70w>: Error: Mailbox INBOX: Failed to get attribute vendor/vendor.dovecot/pvt/server/sieve/files/.dovecot: Mailbox attributes not enabled doveadm(jean)[]<0IwxIlI0jGMgUwAAZU03Dg>: Error: Remote command returned error 65: ssh test doveadm dsync-server -ujean -U In addition, the maildir directories are created, but there are no emails in any of them (e.g., cur). What is the problem with the 2nd and why does it behave differently from the first? -- Doug

4 8

Sieve duplicates
by Ferenc 09 Dec '22

09 Dec '22

Hi list, I have Sieve scripts that unintentionally duplicate e-mails. My dovecot version is 2.3.4.1 (f79e8e7e4), Pigeonhole version 0.5.4 on Linux 5.4.189-2-pve x86_64 Debian 10.13. My scripts get called on an imap COPY action (imapsieve extension). The mail is fed to an external script (spam/ham training) via a pipe :copy action (vnd.dovecot.pipe extension). An header is added to keep track of what happened (editheader extension). I use "if header :contains” for my (simple) logic. If contains header X, do this, add header Y. If contains header Y, do that, add header X. I end each "if” part with keep; and stop; commands. Simple versions of this script, without the if-then construct, seem to work ok. As soon as I try to use if-then-else I find a duplicate of the processed e-mail; one that seems to be untouched, one that appears to have been processed. I hope I’m making myself clear… # without if-then require … pipe :copy … addheader … keep; # with if-then require … if header :contains pipe :copy … addheader … keep; stop; if not exists pipe :copy … addheader … keep; stop; keep; The scripts get called from for instance imapsieve_mailbox1_before. Cheers, Ferenc

1 0

Seen Flags per User
by Maurice Kunze 08 Dec '22

08 Dec '22

Hello, i want to configure seen flags per user for shared public mailboxes in dovecot. I have added the INDEVPVT Option to the location parameter in the namespace and restarted the services and the server. Unfortunately nothing changed and there are still global seen flags in the configuration. In a post i read that i have to manually add some files to the location but this isnt specified in the documentation. below is the version we use and the config. dovecot --version 2.3.13 (89f716dc2) dovecot -n # 2.3.13 (89f716dc2): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.13 (cdd19fe3) # OS: Linux 5.10.0-17-amd64 x86_64 Debian 11.4 ext4 # Hostname: <SERVERNAME> auth_debug = yes auth_debug_passwords = yes auth_verbose = yes auth_verbose_passwords = plain mail_debug = yes mail_gid = vmail mail_location = maildir:/var/mail/user mail_plugins = acl mail_privileged_group = vmail mail_uid = vmail namespace { list = yes location = maildir:/var/mail/public:INDEXPVT=/var/mail/public prefix = public/ separator = / subscriptions = no type = public } namespace { list = yes location = maildir:/var/mail/user/%u/Maildir:INDEX=/var/mail/user/%u/shared/%u:CONTROL=/var/mail/user/%u/shared/%u prefix = shared/%%u/ separator = / subscriptions = no type = shared } namespace inbox { hidden = no inbox = yes list = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = separator = / subscriptions = yes type = private } passdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } plugin { acl = vfile acl_anyone = allow acl_shared_dict = file:/var/mail/database/shared-mailboxes.db } protocols = " imap" service stats { unix_listener stats-reader { group = vmail mode = 0660 user = vmail } unix_listener stats-writer { group = vmail mode = 0660 user = vmail } } ssl_cert = </var/ssl/dove.crt ssl_client_ca_dir = /etc/ssl/certs ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } protocol imap { mail_plugins = acl imap_acl }

2 5

access dict in lua auth script
by Tobias Florek 08 Dec '22

08 Dec '22

Hi! I want to access a configured dictionary in a lua authentication script. Unfortunately the documentation <https://doc.dovecot.org/admin_manual/lua/> does mention a dict object but no way to get one. I also did not find any lua tests in dovecot's source code. Is using the built-in dict not supported? Cheers, Tobias Florek

2 2

moving messages between namespaces go into purge
by Marc 07 Dec '22

07 Dec '22

I think it would be nice to have an option where the moving of messages between namespaces (by automated server scripts) would not result in messages ending up in the 'purge' queue. Currently when you move these copied messages, they end up in the purge queue combined with messages that users deleted. I am more or less forced to purge the mailbox after moving GB's while I prefer not to do this, because I would like to keep the opportunity to recover from the purge queue. Maybe there is a way to 'deduplicate' this purge queue?

3 4

How to configure Dovecot with Keycloak correctly
by Gary Horchem 07 Dec '22

07 Dec '22

Hello I’m trying to configure Dovecot with Keycloak I’m using the proxy with password grant method. Here’s my dovecot-oauth2.plain.conf.ext grant_url = https://server-1.gary-springfield-mo.net/realms/sso/protocol/openid-connect… client_id = dovecot client_secret = WtZ5uZsBi2QPfh1EWuMWjUVGNNT4HEGR introspection_url = https://server-1.gary-springfield-mo.net/realms/sso/protocol/openid-connect… introspection_mode = post use_grant_password = yes debug = yes username_attribute = username pass_attrs = host=server-1:8181 proxy=y proxy_mech=xoauth2 pass=%{oauth2:access_token} And my dovecot-oauth2.token.conf.ext grant_url = https://server-1.gary-springfield-mo.net/realms/sso/protocol/openid-connect… client_id = dovecot client_secret = WtZ5uZsBi2QPfh1EWuMWjUVGNNT4HEGR tokeninfo_url = https://server-1.gary-springfield-mo.net/realms/sso/protocol/openid-connect… introspection_url = https://server-1.gary-springfield-mo.net/realms/sso/protocol/openid-connect… introspection_mode = post use_grant_password = no debug = yes username_attribute = username pass_attrs = pass=%{oauth2:access_token} Do I also need to configure the dovecot-oauth2.conf.ext Sent from my iPhone

2 1

lmtp with sieve editheader Panic: file edit-mail.c: line 1809 (merge_from_parent): assertion failed
by Matthias Lay 06 Dec '22

06 Dec '22

Hi, I have experienced a crash in lmtp delivery on some mails when sieve editheader plugin is used. The first one was an "analytics mail" from azure exchange. I stripped down the mail to the relevant parts that trigger this error. log message: lmtp(johnd)<27019><VM4XLJVVj2OLaQAA/TOvIg>: Error: Raw backtrace: /usr/lib/dovecot/libdovecot.so.0(backtrace_append+0x42) [0x7f3048ca0b72] -> /usr/lib/dovecot/libdovecot.so.0(backtrace_get+0x1e) [0x7f3048ca0c8e] -> /usr/lib/dovecot/libdovecot.so.0(+0xff5eb) [0x7f3048cad5eb] -> /usr/lib/dovecot/libdovecot.so.0(+0xff681) [0x7f3048cad681] -> /usr/lib/dovecot/libdovecot.so.0(+0x542c4) [0x7f3048c022c4] -> /usr/lib/dovecot/libdovecot-sieve.so.0(+0x2e11d) [0x7f304841811d] -> /usr/lib/dovecot/libdovecot.so.0(i_stream_read_memarea+0x74) [0x7f3048cb92d4] -> /usr/lib/dovecot/libdovecot.so.0(+0x10eb05) [0x7f3048cbcb05] -> /usr/lib/dovecot/libdovecot.so.0(+0x10f0a9) [0x7f3048cbd0a9] -> /usr/lib/dovecot/libdovecot.so.0(i_stream_read_memarea+0x74) [0x7f3048cb92d4] -> /usr/lib/dovecot/libdovecot.so.0(i_stream_read+0x3a) [0x7f3048cb94ba] -> /usr/lib/dovecot/libdovecot.so.0(+0x112f51) [0x7f3048cc0f51] -> /usr/lib/dovecot/libdovecot.so.0(i_stream_read_memarea+0x74) [0x7f3048cb92d4] -> /usr/lib/dovecot/libdovecot.so.0(i_stream_read+0x3a) [0x7f3048cb94ba] -> /usr/lib/dovecot/libdovecot.so.0(i_stream_read_data+0x3d) [0x7f3048cb9ddd] -> /usr/lib/dovecot/libdovecot.so.0(io_stream_copy+0x74) [0x7f3048cd28f4] -> /usr/lib/dovecot/libdovecot.so.0(o_stream_send_istream+0x4f) [0x7f3048cd25ef] -> /usr/lib/dovecot/libdovecot-storage.so.0(index_storage_save_continue+0x29) [0x7f3048e5dd39] -> /usr/lib/dovecot/libdovecot-storage.so.0(maildir_save_continue+0x20) [0x7f3048e07930] -> /usr/lib/dovecot/libdovecot-storage.so.0(mailbox_save_continue+0x3a) [0x7f3048ddff3a] -> /usr/lib/dovecot/libdovecot-storage.so.0(mail_storage_copy+0xb1) [0x7f3048dd0b71] -> /usr/lib/dovecot/libdovecot-lda.so.0(+0x475b) [0x7f3048eed75b] -> /usr/lib/dovecot/libdovecot-storage.so.0(+0x6439f) [0x7f3048de039f] -> /usr/lib/dovecot/libdovecot-sieve.so.0(+0x52ff4) [0x7f304843cff4] -> /usr/lib/dovecot/libdovecot-sieve.so.0(+0x473e9) [0x7f30484313e9] -> /usr/lib/dovecot/libdovecot-sieve.so.0(+0x482a0) [0x7f30484322a0] -> /usr/lib/dovecot/libdovecot-sieve.so.0(sieve_result_execute+0x1af) [0x7f3048432fbf] -> /usr/lib/dovecot/libdovecot-sieve.so.0(sieve_multiscript_finish+0x218) [0x7f3048446f38] -> /usr/lib/dovecot/lib90_sieve_plugin.so(+0x4030) [0x7f3048ba9030] -> /usr/lib/dovecot/libdovecot-lda.so.0(mail_deliver+0x16f) [0x7f3048eee8ef] lmtp(johnd)<27019><VM4XLJVVj2OLaQAA/TOvIg>: Fatal: master: service(lmtp): child 27019 killed with signal 6 (core dumps disabled - https://dovecot.org/bugreport.html#coredumps) the sieve script only has one addheader line require ["editheader","fileinto","body", "include"]; addheader :last "X-Long-Duration" "XXX"; I will attach doveconf and the lmtp communication. inserted to lmtp with: socat - UNIX-CONNECT:$lmtp_socket <<<"$(<$file)" greetz Matze

1 0

Sieve: fileinto a subfolder of inbox
by Federico Fanton 05 Dec '22

05 Dec '22

Hi everyone! I'm trying to write a sieve script that moves emails to a *subfolder* of the inbox. My script: require ["envelope", "fileinto", "mailbox"]; if anyof( address "to" "support(a)domain.cc", address "cc" "support(a)domain.cc", envelope "to" "support(a)domain.cc" ) { fileinto :create "INBOX.support"; } But this creates a new "support" folder BESIDE the inbox, not INSIDE it. I've tried replacing "INBOX.support" with "INBOX/support" but then I get an error: "Name must not have '/' characters" Is there something else I could try? Here is the output of dovecot -n: # 2.3.4.1 (f79e8e7e4): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.4 () # OS: Linux 4.19.0-21-amd64 x86_64 Debian 10.0 ext4 auth_mechanisms = plain login lda_mailbox_autosubscribe = yes mail_location = maildir:/home/vmail/maildir/%d/%n/Maildir mail_plugins = " zlib lazy_expunge" mail_privileged_group = vmail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext namespace { hidden = yes list = no location = maildir:/home/vmail/maildir/%d/%n/Maildir/expunged prefix = .EXPUNGED/ separator = / } namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { driver = pam } passdb { args = scheme=SHA1 /etc/dovecot/users.conf driver = passwd-file } plugin { lazy_expunge = .EXPUNGED/ sieve = file:~/sieve;active=~/.dovecot.sieve sieve_vacation_default_period = 1d sieve_vacation_to_header_ignore_envelope = yes } protocols = imap sieve service auth { executable = /usr/lib/dovecot/auth unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } unix_listener /var/spool/postfix/private/dovecot-auth { group = postfix mode = 0660 user = postfix } unix_listener auth-master { group = vmail mode = 0600 user = vmail } } service doveadm { inet_listener { port = 24242 } } service imap-login { process_limit = 200 } service stats { unix_listener stats-reader { group = vmail mode = 0660 user = vmail } unix_listener stats-writer { group = vmail mode = 0660 user = vmail } } ssl_cipher_list = ALL:!LOW:!SSLv2:ALL:!aNULL:!ADH:!eNULL:!EXP:RC4+RSA:+HIGH:+MEDIUM ssl_client_ca_dir = /etc/ssl/certs ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { driver = passwd } userdb { args = uid=1001 gid=1001 home=/home/vmail/maildir/%d/%n allow_all_users=yes driver = static } protocol lda { mail_plugins = " zlib lazy_expunge sieve" } protocol imap { imap_client_workarounds = delay-newmail mail_max_userip_connections = 20 } local 192.168.2.0/24 { doveadm_allowed_commands = sieve list,sieve get,sieve put,sieve activate,sieve deactivate doveadm_password = # hidden, use -P to show it } Many thanks for your time!

3 4

Backups and disaster recovery
by GDS 04 Dec '22

04 Dec '22

Hello all! After reading some of the past threads on backups, I was wondering if I could get a sanity check... I run a Maildir configuration for a small (10 mailboxes) mail server. Using "doveadm backup", for each mailbox I do: - Weekly full backups and then copy the files to a network-based filesystem.- Daily incremental backups and then copy the files to a network-based filesystem. My recovery assumption is that in case of hardware failure, I would re-set up the mail service and for each mailbox I will recover at the right directory the latest full mailbox backup and on top of it, each incremental backup to the latest day. Does this sound like a sound strategy? Also, I was thinking of setting up a second dovecot server on another server and replicating my primary on an hourly basis to decrease recovery time. But I looked at mbsync and it seems to require mailbox login/password for each mailbox (which I don't have). Is there an alternative? Thank you!

4 4

HIGHESTMODSEQ not increasing
by Ronny Forberger 04 Dec '22

04 Dec '22

Hi, I have a problem with my Dovecot IMAP Server on Debian Linux. I migrated it from FreeBSD to Debian, but since then the HIGHESTMODSEQ value for INBOX is not increasing, when I receive new e-mail. This causes my Groupware not to report any new e-mail via ActiveSync. Here is the protocol transscript: [I] <~>-> openssl s_client -crlf -connect mail.forberger-online.de:993 CONNECTED(00000003) [...] --- read R BLOCK * OK [CAPABILITY IMAP4rev1 SASL-IR LOGIN-REFERRALS ID ENABLE IDLE LITERAL+ AUTH=PLAIN AUTH=LOGIN] Dovecot (Debian) ready. A LOGIN REDACTED REDACTED A OK [CAPABILITY IMAP4rev1 SASL-IR LOGIN-REFERRALS ID ENABLE IDLE SORT SORT=DISPLAY THREAD=REFERENCES THREAD=REFS THREAD=ORDEREDSUBJECT MULTIAPPEND URL-PARTIAL CATENATE UNSELECT CHILDREN NAMESPACE UIDPLUS LIST-EXTENDED I18NLEVEL=1 CONDSTORE QRESYNC ESEARCH ESORT SEARCHRES WITHIN CONTEXT=SEARCH LIST-STATUS BINARY MOVE SNIPPET=FUZZY PREVIEW=FUZZY STATUS=SIZE SAVEDATE LITERAL+ NOTIFY SPECIAL-USE] Logged in A SELECT INBOX (CONDSTORE) * FLAGS (\Answered \Flagged \Deleted \Seen \Draft $MDNSent Junk NonJunk $label4 $label1 $label2 $label3 $label5 Old $Forwarded NOTJUNK $has_cal) * OK [PERMANENTFLAGS (\Answered \Flagged \Deleted \Seen \Draft $MDNSent Junk NonJunk $label4 $label1 $label2 $label3 $label5 Old $Forwarded NOTJUNK $has_cal \*)] Flags permitted. * 7286 EXISTS * 0 RECENT * OK [UIDVALIDITY 1291740963] UIDs valid * OK [UIDNEXT 158448] Predicted next UID * OK [HIGHESTMODSEQ 190086] Highest A OK [READ-WRITE] Select completed (0.001 + 0.000 secs). A SELECT INBOX (CONDSTORE) * FLAGS (\Answered \Flagged \Deleted \Seen \Draft $MDNSent Junk NonJunk $label4 $label1 $label2 $label3 $label5 Old $Forwarded NOTJUNK $has_cal) * OK [PERMANENTFLAGS (\Answered \Flagged \Deleted \Seen \Draft $MDNSent Junk NonJunk $label4 $label1 $label2 $label3 $label5 Old $Forwarded NOTJUNK $has_cal \*)] Flags permitted. * 7288 EXISTS * 0 RECENT * OK [UIDVALIDITY 1291740963] UIDs valid * OK [UIDNEXT 158450] Predicted next UID * OK [HIGHESTMODSEQ 190086] Highest A OK [READ-WRITE] Select completed (0.002 + 0.000 + 0.001 secs). The Groupware's IMAP client library is reporting, that MODSEQ is not increasing. It stays at 190086, nevertheless I receive new e-mail. I have tried the commands doveadm index and doveadm force-resync on the INBOX, without any change. My filesystem where the mailboxes reside is on ext4. Can you help me what is wrong? Best regards, Ronny Forberger -- Ronny Forberger ronnyforberger(a)ronnyforberger.de

1 1

Some info to configure OAuth2 using Keycloak
by Gary Horchem 02 Dec '22

02 Dec '22

Hello I’m about to configure and test Dovecot with Keycloak. When do you use the dovecot-oauth2.token.conf.ext and/or dovecot-oauth2.plain.conf.ext over dovecot-oauth2.token.conf.ext Thanks. and/or Sent from my iPhone

2 1

Doveadm Move Query
by Simon B 01 Dec '22

01 Dec '22

I have a production Dovecot problem and although I searched the mailing lists, I could not find an answer and I hope you can give me a quick answer/pointer in the right direction. I have mails for a user (user(a)domain.net) under /var/spool/mail/virtual/ domain.net/user and I want to move ALL the mails to /var/spool/mail/virtual/domain.com/user If I use #doveadm -Dv move -u user(a)domain.net Maildir:/var/spool/mail/virtual/ domain.net/user Maildir:/var/spool/mail/virtual/domain.com/user ALL I get doveadm(root): Fatal: Unknown argument MAILDIR:/var/spool/mail/virtual/ domain.com/user if I use #doveadm -Dv move -u user(a)domain.net Maildir:/var/spool/mail/virtual/ domain.net/user /var/spool/mail/virtual/domain.com/user ALL doveadm(root): Fatal: Unknown argument /var/spool/mail/virtual/ domain.com/user What the hell am I doing wrong!? :) Thanks. Simon

3 3

Can't figure out why managesieve (pigeonhole) can't connect
by colin＠colinlikesfood.com 27 Nov '22

27 Nov '22

Subject line says it all? I am using Roundcube, and every time i click on "filters" i get RC's "unable to connect to server" message. This might be an SQL error, but i can't figure out how to pull the relevant logs yet. Please see below and any advice you have is so very appreciated SYSLOG: ------------------- Nov 22 10:29:27 mail roundcube[66295]: <keirks4p> PHP Error: Connection refused (GET /index.php?_task=settings&_action=plugin.managesieve) Nov 22 10:29:27 mail roundcube[66295]: <keirks4p> PHP Error: Unable to connect to managesieve on obfuscated.domain:4190 in /usr/local/www/roundcube/plugins/managesieve/lib/Roundcube/rcube_sieve_engine.php on line 221 (GET /index.php?_task=settings&_action=plugin.managesieve) Nov 22 10:29:27 mail roundcube[66295]: <keirks4p> PHP Error: Not currently in AUTHORISATION state (GET /index.php?_task=settings&_action=plugin.managesieve) Nov 22 10:29:27 mail php[66295]: <keirks4p> PHP Error: Not currently connected (GET /index.php?_task=settings&_action=plugin.managesieve) Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> PHP Error: Connection refused (GET /index.php?_task=settings&_action=plugin.managesieve-action&_framed=1&_nav=hide) Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> PHP Error: Unable to connect to managesieve on obfuscated.domain:4190 in /usr/local/www/roundcube/plugins/managesieve/lib/Roundcube/rcube_sieve_engine.php on line 221 (GET /index.php?_task=settings&_action=plugin.managesieve-action&_framed=1&_nav=hide) Nov 22 10:29:31 mail php[66295]: <keirks4p> PHP Error: Not currently connected (GET /index.php?_task=settings&_action=plugin.managesieve-action&_framed=1&_nav=hide) Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> PHP Error: Connection refused (POST /?_task=settings&_action=plugin.managesieve-save) Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> PHP Error: Unable to connect to managesieve on obfuscated.domain:4190 in /usr/local/www/roundcube/plugins/managesieve/lib/Roundcube/rcube_sieve_engine.php on line 221 (POST /?_task=settings&_action=plugin.managesieve-save) Nov 22 10:29:43 mail roundcube[71055]: PHP Warning: Trying to access array offset on value of type null in /usr/local/www/roundcube/plugins/managesieve/lib/Roundcube/rcube_sieve_engine.php on line 1065 Nov 22 10:29:43 mail php[71055]: <keirks4p> PHP Error: Not currently connected (POST /?_task=settings&_action=plugin.managesieve-save) DOVECOT.LOG: ------------------- Nov 22 10:28:58 mail roundcube[66297]: <keirks4p> [43CD] C: A0008 LOGOUT Nov 22 10:28:58 mail dovecot[8514]: imap(obfuscated(a)user.name)<8609><XgBCqxHusXAKAAAB>: Disconnected: Logged out in=219 out=1045 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0 Nov 22 10:28:58 mail roundcube[66297]: <keirks4p> [43CD] S: * BYE Logging out Nov 22 10:28:58 mail roundcube[66297]: <keirks4p> [43CD] S: A0008 OK Logout completed (0.001 + 0.000 secs). Nov 22 10:29:25 mail roundcube[66295]: <keirks4p> [1] SELECT "vars", "ip", "changed", datetime('now') AS ts, CASE WHEN "changed" < datetime('now', '-600 seconds') THEN 1 ELSE 0 END AS expired FROM "session" WHERE "sess_id" = 'keirks4pbepr17um9mvj1qsvt2'; Nov 22 10:29:25 mail roundcube[66295]: <keirks4p> [2] SELECT * FROM "users" WHERE "user_id" = '2'; Nov 22 10:29:25 mail roundcube[66295]: <keirks4p> [3] UPDATE "session" SET "changed" = datetime('now'), "vars" = 'bGFuZ3VhZ2V8czo1OiJlbl9VUyI7aW1hcF9uYW1lc3BhY2V8YTo0OntzOjg6InBlcnNvbmFsIjthOjE6e2k6MDthOjI6e2k6MDtzOjA6IiI7aToxO3M6MToiLyI7fX1zOjU6Im90aGVyIjtOO3M6Njoic2hhcmVkIjtOO3M6MTA6InByZWZpeF9vdXQiO3M6MDoiIjt9aW1hcF9kZWxpbWl0ZXJ8czoxOiIvIjtpbWFwX2xpc3RfY29uZnxhOjI6e2k6MDtOO2k6MTthOjA6e319dXNlcl9pZHxpOjI7dXNlcm5hbWV8czoyNDoiY29saW5AY29saW5saWtlc2Zvb2QuY29tIjtzdG9yYWdlX2hvc3R8czoxODoiY29saW5saWtlc2Zvb2QuY29tIjtzdG9yYWdlX3BvcnR8aToxNDM7c3RvcmFnZV9zc2x8czozOiJ0bHMiO3Bhc3N3b3JkfHM6NDQ6ImNYOCt0VmJXV010VEMxRTlXQVB4ZjVOSlU1bWlKa2ZveC8xRWpuZVB2Ym89Ijtsb2dpbl90aW1lfGk6MTY2OTA2MzM4OTt0aW1lem9uZXxzOjE1OiJBbWVyaWNhL0NoaWNhZ28iO2F1dGhfc2VjcmV0fHM6MjY6ImNHdkc4ZWR5QmFmNWJITVpISG5sTEY3ZmpZIjtyZXF1ZXN0X3Rva2VufHM6MzI6IkM5VXlNNVBMUnhSeERiVm9HTlNMNjdVZ05NaWE4WVZGIjt0YXNrfHM6ODoic2V0dGluZ3MiO3NraW5fY29uZmlnfGE6Nzp7czoxNzoic3VwcG9ydGVkX2xheW91dHMiO2E6MTp7aTowO3M6MTA6IndpZGVzY3JlZW4iO31zOjIyOiJqcXVlcnlfdWlfY29sb3JzX3RoZW1lIjtzOjk6ImJvb3RzdHJhcCI7czoxODoiZW1iZWRfY3NzX2xvY2F0aW9uIjtzOjE3OiIvc3R5bGVzL2VtYmVkLmNzcyI7c zoxOToiZWRpdG9yX2Nzc19sb2NhdGlvbiI7czoxNzoiL3N0eWxlcy9lbWJlZC5jc3MiO3M6MTc6ImRhcmtfbW9kZV9zdXBwb3J0IjtiOjE7czoyNjoibWVkaWFfYnJvd3Nlcl9jc3NfbG9jYXRpb24iO3M6NDoibm9uZSI7czoyMToiYWRkaXRpb25hbF9sb2dvX3R5cGVzIjthOjM6e2k6MDtzOjQ6ImRhcmsiO2k6MTtzOjU6InNtYWxsIjtpOjI7czoxMDoic21hbGwtZGFyayI7fX1pbWFwX2hvc3R8czoxODoiY29saW5saWtlc2Zvb2QuY29tIjttYm94fHM6NToiSU5CT1giO3NvcnRfY29sfHM6MDoiIjtzb3J0X29yZGVyfHM6NDoiREVTQyI7U1RPUkFHRV9USFJFQUR8YTozOntpOjA7czoxMDoiUkVGRVJFTkNFUyI7aToxO3M6NDoiUkVGUyI7aToyO3M6MTQ6Ik9SREVSRURTVUJKRUNUIjt9U1RPUkFHRV9RVU9UQXxiOjA7U1RPUkFHRV9MSVNULUVYVEVOREVEfGI6MTtsaXN0X2F0dHJpYnxhOjc6e3M6NDoibmFtZSI7czo4OiJtZXNzYWdlcyI7czoyOiJpZCI7czoxMToibWVzc2FnZWxpc3QiO3M6NToiY2xhc3MiO3M6NDI6Imxpc3RpbmcgbWVzc2FnZWxpc3Qgc29ydGhlYWRlciBmaXhlZGhlYWRlciI7czoxNToiYXJpYS1sYWJlbGxlZGJ5IjtzOjIyOiJhcmlhLWxhYmVsLW1lc3NhZ2VsaXN0IjtzOjk6ImRhdGEtbGlzdCI7czoxMjoibWVzc2FnZV9saXN0IjtzOjE0OiJkYXRhLWxhYmVsLW1zZyI7czoxODoi Nov 22 10:29:27 mail roundcube[66295]: <keirks4p> [1] SELECT "vars", "ip", "changed", datetime('now') AS ts, CASE WHEN "changed" < datetime('now', '-600 seconds') THEN 1 ELSE 0 END AS expired FROM "session" WHERE "sess_id" = 'keirks4pbepr17um9mvj1qsvt2'; Nov 22 10:29:27 mail roundcube[66295]: <keirks4p> [2] SELECT * FROM "users" WHERE "user_id" = '2'; Nov 22 10:29:27 mail roundcube[66295]: <keirks4p> PHP Error: Connection refused (GET /index.php?_task=settings&_action=plugin.managesieve) Nov 22 10:29:27 mail roundcube[66295]: <keirks4p> PHP Error: Unable to connect to managesieve on obfuscated.domain:4190 in /usr/local/www/roundcube/plugins/managesieve/lib/Roundcube/rcube_sieve_engine.php on line 221 (GET /index.php?_task=settings&_action=plugin.managesieve) Nov 22 10:29:27 mail roundcube[66295]: <keirks4p> PHP Error: Not currently in AUTHORISATION state (GET /index.php?_task=settings&_action=plugin.managesieve) Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [1] SELECT "vars", "ip", "changed", datetime('now') AS ts, CASE WHEN "changed" < datetime('now', '-600 seconds') THEN 1 ELSE 0 END AS expired FROM "session" WHERE "sess_id" = 'keirks4pbepr17um9mvj1qsvt2'; Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [2] SELECT * FROM "users" WHERE "user_id" = '2'; Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> PHP Error: Connection refused (GET /index.php?_task=settings&_action=plugin.managesieve-action&_framed=1&_nav=hide) Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> PHP Error: Unable to connect to managesieve on obfuscated.domain:4190 in /usr/local/www/roundcube/plugins/managesieve/lib/Roundcube/rcube_sieve_engine.php on line 221 (GET /index.php?_task=settings&_action=plugin.managesieve-action&_framed=1&_nav=hide) Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] Connecting to tls://obfuscated.domain:143... Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] S: * OK [CAPABILITY IMAP4rev1 SASL-IR LOGIN-REFERRALS ID ENABLE IDLE LITERAL+ STARTTLS LOGINDISABLED AUTH=CRAM-MD5] Dovecot ready. Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] C: A0001 STARTTLS Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] S: A0001 OK Begin TLS negotiation now. Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] C: A0002 CAPABILITY Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] S: * CAPABILITY IMAP4rev1 SASL-IR LOGIN-REFERRALS ID ENABLE IDLE LITERAL+ LOGINDISABLED AUTH=CRAM-MD5 Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] S: A0002 OK Pre-login capabilities listed, post-login capabilities have more. Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] C: A0003 AUTHENTICATE CRAM-MD5 Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] S: + PDI3MjU4Mjg1ODUxMTkzMTEuMTY2OTEzNDU3MUBtYWlsPg== Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] C: ****** [74] Nov 22 10:29:31 mail dovecot[8514]: imap-login: Login: user=<obfuscated(a)user.name>, method=CRAM-MD5, rip=10.0.0.1, lip=10.0.0.91, mpid=8639, TLS, session=<51k6rRHuw5gKAAAB> Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] S: A0003 OK [CAPABILITY IMAP4rev1 SASL-IR LOGIN-REFERRALS ID ENABLE IDLE SORT SORT=DISPLAY THREAD=REFERENCES THREAD=REFS THREAD=ORDEREDSUBJECT MULTIAPPEND URL-PARTIAL CATENATE UNSELECT CHILDREN NAMESPACE UIDPLUS LIST-EXTENDED I18NLEVEL=1 CONDSTORE QRESYNC ESEARCH ESORT SEARCHRES WITHIN CONTEXT=SEARCH LIST-STATUS BINARY MOVE SNIPPET=FUZZY PREVIEW=FUZZY PREVIEW STATUS=SIZE SAVEDATE LITERAL+ NOTIFY SPECIAL-USE] Logged in Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] C: A0004 ID ("name" "Roundcube" "version" "1.6.0" "php" "8.0.25" "os" "FreeBSD" "command" "/index.php?_task=settings&_action=plugin.managesieve-action&_framed=1&_nav=hide") Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] S: * ID ("name" "Dovecot") Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] S: A0004 OK ID completed (0.001 + 0.000 secs). Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] C: A0005 LIST (SUBSCRIBED) "" "*" Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] S: * LIST (\Subscribed) "/" Drafts Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] S: * LIST (\Subscribed) "/" Junk Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] S: * LIST (\Subscribed) "/" Sent Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] S: * LIST (\Subscribed) "/" Trash Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] S: * LIST (\Subscribed) "/" INBOX/NAS-Alerts Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] S: * LIST (\Subscribed) "/" INBOX/email-reports Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] S: A0005 OK List completed (0.001 + 0.000 secs). Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [3] UPDATE "session" SET "changed" = datetime('now'), "vars" = 'bGFuZ3VhZ2V8czo1OiJlbl9VUyI7aW1hcF9uYW1lc3BhY2V8YTo0OntzOjg6InBlcnNvbmFsIjthOjE6e2k6MDthOjI6e2k6MDtzOjA6IiI7aToxO3M6MToiLyI7fX1zOjU6Im90aGVyIjtOO3M6Njoic2hhcmVkIjtOO3M6MTA6InByZWZpeF9vdXQiO3M6MDoiIjt9aW1hcF9kZWxpbWl0ZXJ8czoxOiIvIjtpbWFwX2xpc3RfY29uZnxhOjI6e2k6MDtOO2k6MTthOjA6e319dXNlcl9pZHxpOjI7dXNlcm5hbWV8czoyNDoiY29saW5AY29saW5saWtlc2Zvb2QuY29tIjtzdG9yYWdlX2hvc3R8czoxODoiY29saW5saWtlc2Zvb2QuY29tIjtzdG9yYWdlX3BvcnR8aToxNDM7c3RvcmFnZV9zc2x8czozOiJ0bHMiO3Bhc3N3b3JkfHM6NDQ6ImNYOCt0VmJXV010VEMxRTlXQVB4ZjVOSlU1bWlKa2ZveC8xRWpuZVB2Ym89Ijtsb2dpbl90aW1lfGk6MTY2OTA2MzM4OTt0aW1lem9uZXxzOjE1OiJBbWVyaWNhL0NoaWNhZ28iO2F1dGhfc2VjcmV0fHM6MjY6ImNHdkc4ZWR5QmFmNWJITVpISG5sTEY3ZmpZIjtyZXF1ZXN0X3Rva2VufHM6MzI6IkM5VXlNNVBMUnhSeERiVm9HTlNMNjdVZ05NaWE4WVZGIjt0YXNrfHM6ODoic2V0dGluZ3MiO3NraW5fY29uZmlnfGE6Nzp7czoxNzoic3VwcG9ydGVkX2xheW91dHMiO2E6MTp7aTowO3M6MTA6IndpZGVzY3JlZW4iO31zOjIyOiJqcXVlcnlfdWlfY29sb3JzX3RoZW1lIjtzOjk6ImJvb3RzdHJhcCI7czoxODoiZW1iZWRfY3NzX2xvY2F0aW9uIjtzOjE3OiIvc3R5bGVzL2VtYmVkLmNzcyI7c zoxOToiZWRpdG9yX2Nzc19sb2NhdGlvbiI7czoxNzoiL3N0eWxlcy9lbWJlZC5jc3MiO3M6MTc6ImRhcmtfbW9kZV9zdXBwb3J0IjtiOjE7czoyNjoibWVkaWFfYnJvd3Nlcl9jc3NfbG9jYXRpb24iO3M6NDoibm9uZSI7czoyMToiYWRkaXRpb25hbF9sb2dvX3R5cGVzIjthOjM6e2k6MDtzOjQ6ImRhcmsiO2k6MTtzOjU6InNtYWxsIjtpOjI7czoxMDoic21hbGwtZGFyayI7fX1pbWFwX2hvc3R8czoxODoiY29saW5saWtlc2Zvb2QuY29tIjttYm94fHM6NToiSU5CT1giO3NvcnRfY29sfHM6MDoiIjtzb3J0X29yZGVyfHM6NDoiREVTQyI7U1RPUkFHRV9USFJFQUR8YTozOntpOjA7czoxMDoiUkVGRVJFTkNFUyI7aToxO3M6NDoiUkVGUyI7aToyO3M6MTQ6Ik9SREVSRURTVUJKRUNUIjt9U1RPUkFHRV9RVU9UQXxiOjA7U1RPUkFHRV9MSVNULUVYVEVOREVEfGI6MTtsaXN0X2F0dHJpYnxhOjc6e3M6NDoibmFtZSI7czo4OiJtZXNzYWdlcyI7czoyOiJpZCI7czoxMToibWVzc2FnZWxpc3QiO3M6NToiY2xhc3MiO3M6NDI6Imxpc3RpbmcgbWVzc2FnZWxpc3Qgc29ydGhlYWRlciBmaXhlZGhlYWRlciI7czoxNToiYXJpYS1sYWJlbGxlZGJ5IjtzOjIyOiJhcmlhLWxhYmVsLW1lc3NhZ2VsaXN0IjtzOjk6ImRhdGEtbGlzdCI7czoxMjoibWVzc2FnZV9saXN0IjtzOjE0OiJkYXRhLWxhYmVsLW1zZyI7czoxODoi Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] C: A0006 LOGOUT Nov 22 10:29:31 mail dovecot[8514]: imap(obfuscated(a)user.name)<8639><51k6rRHuw5gKAAAB>: Disconnected: Logged out in=215 out=821 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0 Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] S: * BYE Logging out Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] S: A0006 OK Logout completed (0.001 + 0.000 secs). Nov 22 10:29:42 mail roundcube[71055]: <keirks4p> [1] SELECT "vars", "ip", "changed", datetime('now') AS ts, CASE WHEN "changed" < datetime('now', '-600 seconds') THEN 1 ELSE 0 END AS expired FROM "session" WHERE "sess_id" = 'keirks4pbepr17um9mvj1qsvt2'; Nov 22 10:29:42 mail roundcube[71055]: <keirks4p> [2] SELECT * FROM "users" WHERE "user_id" = '2'; Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> PHP Error: Connection refused (POST /?_task=settings&_action=plugin.managesieve-save) Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> PHP Error: Unable to connect to managesieve on obfuscated.domain:4190 in /usr/local/www/roundcube/plugins/managesieve/lib/Roundcube/rcube_sieve_engine.php on line 221 (POST /?_task=settings&_action=plugin.managesieve-save) Nov 22 10:29:43 mail roundcube[71055]: PHP Warning: Trying to access array offset on value of type null in /usr/local/www/roundcube/plugins/managesieve/lib/Roundcube/rcube_sieve_engine.php on line 1065 Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] Connecting to tls://obfuscated.domain:143... Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] S: * OK [CAPABILITY IMAP4rev1 SASL-IR LOGIN-REFERRALS ID ENABLE IDLE LITERAL+ STARTTLS LOGINDISABLED AUTH=CRAM-MD5] Dovecot ready. Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] C: A0001 STARTTLS Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] S: A0001 OK Begin TLS negotiation now. Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] C: A0002 CAPABILITY Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] S: * CAPABILITY IMAP4rev1 SASL-IR LOGIN-REFERRALS ID ENABLE IDLE LITERAL+ LOGINDISABLED AUTH=CRAM-MD5 Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] S: A0002 OK Pre-login capabilities listed, post-login capabilities have more. Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] C: A0003 AUTHENTICATE CRAM-MD5 Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] S: + PDE2NjcxMDUwNTU2NDcwMTMuMTY2OTEzNDU4M0BtYWlsPg== Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] C: ****** [74] Nov 22 10:29:43 mail dovecot[8514]: imap-login: Login: user=<obfuscated(a)user.name>, method=CRAM-MD5, rip=10.0.0.1, lip=10.0.0.91, mpid=8644, TLS, session=<677prRHu4aAKAAAB> Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] S: A0003 OK [CAPABILITY IMAP4rev1 SASL-IR LOGIN-REFERRALS ID ENABLE IDLE SORT SORT=DISPLAY THREAD=REFERENCES THREAD=REFS THREAD=ORDEREDSUBJECT MULTIAPPEND URL-PARTIAL CATENATE UNSELECT CHILDREN NAMESPACE UIDPLUS LIST-EXTENDED I18NLEVEL=1 CONDSTORE QRESYNC ESEARCH ESORT SEARCHRES WITHIN CONTEXT=SEARCH LIST-STATUS BINARY MOVE SNIPPET=FUZZY PREVIEW=FUZZY PREVIEW STATUS=SIZE SAVEDATE LITERAL+ NOTIFY SPECIAL-USE] Logged in Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] C: A0004 ID ("name" "Roundcube" "version" "1.6.0" "php" "8.0.25" "os" "FreeBSD" "command" "/") Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] S: * ID ("name" "Dovecot") Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] S: A0004 OK ID completed (0.001 + 0.000 secs). Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] C: A0005 LIST (SUBSCRIBED) "" "*" Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] S: * LIST (\Subscribed) "/" Drafts Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] S: * LIST (\Subscribed) "/" Junk Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] S: * LIST (\Subscribed) "/" Sent Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] S: * LIST (\Subscribed) "/" Trash Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] S: * LIST (\Subscribed) "/" INBOX/NAS-Alerts Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] S: * LIST (\Subscribed) "/" INBOX/email-reports Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] S: A0005 OK List completed (0.001 + 0.000 secs). Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] C: A0006 LOGOUT Nov 22 10:29:43 mail dovecot[8514]: imap(obfuscated(a)user.name)<8644><677prRHu4aAKAAAB>: Disconnected: Logged out in=137 out=821 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0 Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] S: * BYE Logging out Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] S: A0006 OK Logout completed (0.001 + 0.000 secs). DOVECOT INFO: ------------------------ # dovecot --version 2.3.19.1 (9b53102964) # dovecot -n # 2.3.19.1 (9b53102964): /usr/local/etc/dovecot/dovecot.conf # Pigeonhole version 0.5.19 (4eae2f79) # OS: FreeBSD 13.1-RELEASE-p2 amd64 zfs # Hostname: localhost auth_mechanisms = cram-md5 first_valid_gid = 10000 first_valid_uid = 10000 mail_location = maildir:/var/mail/users/%u managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext namespace inbox { inbox = yes location = mailbox Drafts { auto = create special_use = \Drafts } mailbox Junk { auto = create special_use = \Junk } mailbox Sent { auto = create special_use = \Sent } mailbox Trash { auto = create special_use = \Trash } prefix = separator = / } passdb { args = username_format=%u /usr/local/etc/dovecot/users driver = passwd-file } plugin { sieve = file:/usr/local/etc/dovecot/sieve;active=/usr/local/etc/dovecot/sieve/.dovecot.sieve sieve_before = /usr/local/etc/dovecot/sieve/before-global.sieve sieve_default = /usr/local/etc/dovecot/sieve/default.sieve sieve_global = /usr/local/etc/dovecot/sieve/global/ } protocols = imap lmtp sieve service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0666 user = postfix } } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0660 user = postfix } } service managesieve-login { inet_listener sieve { port = 4190 } } ssl_cert = </usr/local/etc/letsencrypt/live/obfuscated.domain/fullchain.pem ssl_cipher_list = HIGH:!aNULL:!AES128:!SSLv2 ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it syslog_facility = local1 userdb { args = username_format=%u /usr/local/etc/dovecot/users driver = passwd-file } protocol lmtp { mail_plugins = " sieve" } protocol sieve { info_log_path = /var/log/dovecot-sieve.log log_path = /var/log/dovecot-sieve-errors.log managesieve_implementation_string = dovecot managesieve_max_line_length = 64 k } THANKS! Colin

5 9

bug: ARGON2 hash selection incompatible with LDAP
by Krisztián Szegi 25 Nov '22

25 Nov '22

Good day to all, this is my first post to the mailing list! I'd like to report that non-binding auth to (Open)LDAP doesn't work if the latter hashes passwords with ARGON2. Although dovecot (I am using http://2.3.19.1) does support ARGON2 with libsodium, but it doesn't recoginize hashes beginning "{ARGON2}$argon2id$" stored (and hashed, using ppolicy module's hashCleartext) by OpenLDAP. Now, I understand that ARGON2I, -D, and -ID are not compatible, but the ACTUAL algorithm is there between the two $. Furthermore, I think dovecot is in the minority here, I haven't met any software that specifies the ARGON2 subtype between {}. BTW, I haven't met any software that hashes passwords with ARGON2, but not with the ARGON2ID subtype (where libsodium is available, which also seems to be the standard here), as THAT is the recommended one anyway. I patched the rpm in OpenSUSE repo to alias {ARGON2} to {ARGON2ID}: https://build.opensuse.org/package/view_file/home:Samonitari:branches:openS… Could we get something like this (but maybe more correct) into the official source? Maybe a config switch to alias it runtime? Thanks for the attention: Krisztián

3 3

Dovecot and TLSv1 on ubuntu 22.04
by Six002 24 Nov '22

24 Nov '22

Hello, I have ubuntu 22.04, dovecot 2.3.16 and old email client (Outlook 2013) and their dont support TLSv1_2. In dovecot 10-ssl.conf i put: ssl_min_protocol = TLSv1, in openssl.cnf i have: openssl_conf = default_conf [ default_conf ] ssl_conf = ssl_section [ssl_section] system_default = ssl_default_sectq [ssl_default_sect] MinProtocol = TLSv1CipherString = DEFAULT:@SECLEVEL=1 but when i check openssl s_client -connect localhost:993 -tls1_1 have output: CONNECTED(00000003) 803BD26AC67F0000:error:0A000126:SSL routines:ssl3_read_n:unexpected eof while reading:../ssl/record/rec_layer_s3.c:308: --- no peer certificate available --- No client certificate CA names sent --- SSL handshake has read 0 bytes and written 111 bytes Verification: OK --- New, (NONE), Cipher is (NONE) Secure Renegotiation IS NOT supported Compression: NONE Expansion: NONE No ALPN negotiated SSL-Session: Protocol : TLSv1.1 Cipher : 0000 Session-ID: Session-ID-ctx: Master-Key: PSK identity: None PSK identity hint: None SRP username: None Start Time: 1668602712 Timeout : 7200 (sec) Verify return code: 0 (ok) Extended master secret: no --- version tls1_2 and 1_3 works fine. What I doing wrong?Thanks for help.

3 2

compiled sieve files svbin ?
by jeremy ardley 23 Nov '22

23 Nov '22

Hi, I have recently started using claws mail to manage my user sieve scripts using server dovecot-sieve_1%3a2.3.13+dfsg1-2_arm64.deb I originally edited ~/.dovecot.sieve to hold my script and I recall that ~/.dovecot.svbin was automatically generated on first use. (either that or I have forgotten that I had used sievec) Later I used claws mail to generate sieve scripts but they were written into directory ~/sieve/ In experimentation I changed ~/.dovecot.sieve into a link to my principal script ~/sieve/main.sieve The oddity now is that sieve seems to be working when there is no compiled version Should I expect a compiled .svbin version to be generated from claws client? Or generated by first run of the sieve server on the user account? Or should I manage the scripts with claws, but log in to the server later to generate the .svbin versions? In any event what effect does not having a .svbin version have on typical small installation? -- Jeremy

2 1

Can't figure out why managesieve (pigeonhole) can't connect
by colin＠colinlikesfood.com 22 Nov '22

22 Nov '22

Subject line says it all? I am using Roundcube, and every time i click on "filters" i get RC's "unable to connect to server" message. This might be an SQL error, but i can't figure out how to pull the relevant logs yet. Please see below and any advice you have is so very appreciated SYSLOG: ------------------- Nov 22 10:29:27 mail roundcube[66295]: <keirks4p> PHP Error: Connection refused (GET /index.php?_task=settings&_action=plugin.managesieve) Nov 22 10:29:27 mail roundcube[66295]: <keirks4p> PHP Error: Unable to connect to managesieve on obfuscated.domain:4190 in /usr/local/www/roundcube/plugins/managesieve/lib/Roundcube/rcube_sieve_engine.php on line 221 (GET /index.php?_task=settings&_action=plugin.managesieve) Nov 22 10:29:27 mail roundcube[66295]: <keirks4p> PHP Error: Not currently in AUTHORISATION state (GET /index.php?_task=settings&_action=plugin.managesieve) Nov 22 10:29:27 mail php[66295]: <keirks4p> PHP Error: Not currently connected (GET /index.php?_task=settings&_action=plugin.managesieve) Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> PHP Error: Connection refused (GET /index.php?_task=settings&_action=plugin.managesieve-action&_framed=1&_nav=hide) Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> PHP Error: Unable to connect to managesieve on obfuscated.domain:4190 in /usr/local/www/roundcube/plugins/managesieve/lib/Roundcube/rcube_sieve_engine.php on line 221 (GET /index.php?_task=settings&_action=plugin.managesieve-action&_framed=1&_nav=hide) Nov 22 10:29:31 mail php[66295]: <keirks4p> PHP Error: Not currently connected (GET /index.php?_task=settings&_action=plugin.managesieve-action&_framed=1&_nav=hide) Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> PHP Error: Connection refused (POST /?_task=settings&_action=plugin.managesieve-save) Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> PHP Error: Unable to connect to managesieve on obfuscated.domain:4190 in /usr/local/www/roundcube/plugins/managesieve/lib/Roundcube/rcube_sieve_engine.php on line 221 (POST /?_task=settings&_action=plugin.managesieve-save) Nov 22 10:29:43 mail roundcube[71055]: PHP Warning: Trying to access array offset on value of type null in /usr/local/www/roundcube/plugins/managesieve/lib/Roundcube/rcube_sieve_engine.php on line 1065 Nov 22 10:29:43 mail php[71055]: <keirks4p> PHP Error: Not currently connected (POST /?_task=settings&_action=plugin.managesieve-save) DOVECOT.LOG: ------------------- Nov 22 10:28:58 mail roundcube[66297]: <keirks4p> [43CD] C: A0008 LOGOUT Nov 22 10:28:58 mail dovecot[8514]: imap(obfuscated(a)user.name)<8609><XgBCqxHusXAKAAAB>: Disconnected: Logged out in=219 out=1045 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0 Nov 22 10:28:58 mail roundcube[66297]: <keirks4p> [43CD] S: * BYE Logging out Nov 22 10:28:58 mail roundcube[66297]: <keirks4p> [43CD] S: A0008 OK Logout completed (0.001 + 0.000 secs). Nov 22 10:29:25 mail roundcube[66295]: <keirks4p> [1] SELECT "vars", "ip", "changed", datetime('now') AS ts, CASE WHEN "changed" < datetime('now', '-600 seconds') THEN 1 ELSE 0 END AS expired FROM "session" WHERE "sess_id" = 'keirks4pbepr17um9mvj1qsvt2'; Nov 22 10:29:25 mail roundcube[66295]: <keirks4p> [2] SELECT * FROM "users" WHERE "user_id" = '2'; Nov 22 10:29:25 mail roundcube[66295]: <keirks4p> [3] UPDATE "session" SET "changed" = datetime('now'), "vars" = 'bGFuZ3VhZ2V8czo1OiJlbl9VUyI7aW1hcF9uYW1lc3BhY2V8YTo0OntzOjg6InBlcnNvbmFsIjthOjE6e2k6MDthOjI6e2k6MDtzOjA6IiI7aToxO3M6MToiLyI7fX1zOjU6Im90aGVyIjtOO3M6Njoic2hhcmVkIjtOO3M6MTA6InByZWZpeF9vdXQiO3M6MDoiIjt9aW1hcF9kZWxpbWl0ZXJ8czoxOiIvIjtpbWFwX2xpc3RfY29uZnxhOjI6e2k6MDtOO2k6MTthOjA6e319dXNlcl9pZHxpOjI7dXNlcm5hbWV8czoyNDoiY29saW5AY29saW5saWtlc2Zvb2QuY29tIjtzdG9yYWdlX2hvc3R8czoxODoiY29saW5saWtlc2Zvb2QuY29tIjtzdG9yYWdlX3BvcnR8aToxNDM7c3RvcmFnZV9zc2x8czozOiJ0bHMiO3Bhc3N3b3JkfHM6NDQ6ImNYOCt0VmJXV010VEMxRTlXQVB4ZjVOSlU1bWlKa2ZveC8xRWpuZVB2Ym89Ijtsb2dpbl90aW1lfGk6MTY2OTA2MzM4OTt0aW1lem9uZXxzOjE1OiJBbWVyaWNhL0NoaWNhZ28iO2F1dGhfc2VjcmV0fHM6MjY6ImNHdkc4ZWR5QmFmNWJITVpISG5sTEY3ZmpZIjtyZXF1ZXN0X3Rva2VufHM6MzI6IkM5VXlNNVBMUnhSeERiVm9HTlNMNjdVZ05NaWE4WVZGIjt0YXNrfHM6ODoic2V0dGluZ3MiO3NraW5fY29uZmlnfGE6Nzp7czoxNzoic3VwcG9ydGVkX2xheW91dHMiO2E6MTp7aTowO3M6MTA6IndpZGVzY3JlZW4iO31zOjIyOiJqcXVlcnlfdWlfY29sb3JzX3RoZW1lIjtzOjk6ImJvb3RzdHJhcCI7czoxODoiZW1iZWRfY3NzX2xvY2F0aW9uIjtzOjE3OiIvc3R5bGVzL2VtYmVkLmNzcyI7c zoxOToiZWRpdG9yX2Nzc19sb2NhdGlvbiI7czoxNzoiL3N0eWxlcy9lbWJlZC5jc3MiO3M6MTc6ImRhcmtfbW9kZV9zdXBwb3J0IjtiOjE7czoyNjoibWVkaWFfYnJvd3Nlcl9jc3NfbG9jYXRpb24iO3M6NDoibm9uZSI7czoyMToiYWRkaXRpb25hbF9sb2dvX3R5cGVzIjthOjM6e2k6MDtzOjQ6ImRhcmsiO2k6MTtzOjU6InNtYWxsIjtpOjI7czoxMDoic21hbGwtZGFyayI7fX1pbWFwX2hvc3R8czoxODoiY29saW5saWtlc2Zvb2QuY29tIjttYm94fHM6NToiSU5CT1giO3NvcnRfY29sfHM6MDoiIjtzb3J0X29yZGVyfHM6NDoiREVTQyI7U1RPUkFHRV9USFJFQUR8YTozOntpOjA7czoxMDoiUkVGRVJFTkNFUyI7aToxO3M6NDoiUkVGUyI7aToyO3M6MTQ6Ik9SREVSRURTVUJKRUNUIjt9U1RPUkFHRV9RVU9UQXxiOjA7U1RPUkFHRV9MSVNULUVYVEVOREVEfGI6MTtsaXN0X2F0dHJpYnxhOjc6e3M6NDoibmFtZSI7czo4OiJtZXNzYWdlcyI7czoyOiJpZCI7czoxMToibWVzc2FnZWxpc3QiO3M6NToiY2xhc3MiO3M6NDI6Imxpc3RpbmcgbWVzc2FnZWxpc3Qgc29ydGhlYWRlciBmaXhlZGhlYWRlciI7czoxNToiYXJpYS1sYWJlbGxlZGJ5IjtzOjIyOiJhcmlhLWxhYmVsLW1lc3NhZ2VsaXN0IjtzOjk6ImRhdGEtbGlzdCI7czoxMjoibWVzc2FnZV9saXN0IjtzOjE0OiJkYXRhLWxhYmVsLW1zZyI7czoxODoi Nov 22 10:29:27 mail roundcube[66295]: <keirks4p> [1] SELECT "vars", "ip", "changed", datetime('now') AS ts, CASE WHEN "changed" < datetime('now', '-600 seconds') THEN 1 ELSE 0 END AS expired FROM "session" WHERE "sess_id" = 'keirks4pbepr17um9mvj1qsvt2'; Nov 22 10:29:27 mail roundcube[66295]: <keirks4p> [2] SELECT * FROM "users" WHERE "user_id" = '2'; Nov 22 10:29:27 mail roundcube[66295]: <keirks4p> PHP Error: Connection refused (GET /index.php?_task=settings&_action=plugin.managesieve) Nov 22 10:29:27 mail roundcube[66295]: <keirks4p> PHP Error: Unable to connect to managesieve on obfuscated.domain:4190 in /usr/local/www/roundcube/plugins/managesieve/lib/Roundcube/rcube_sieve_engine.php on line 221 (GET /index.php?_task=settings&_action=plugin.managesieve) Nov 22 10:29:27 mail roundcube[66295]: <keirks4p> PHP Error: Not currently in AUTHORISATION state (GET /index.php?_task=settings&_action=plugin.managesieve) Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [1] SELECT "vars", "ip", "changed", datetime('now') AS ts, CASE WHEN "changed" < datetime('now', '-600 seconds') THEN 1 ELSE 0 END AS expired FROM "session" WHERE "sess_id" = 'keirks4pbepr17um9mvj1qsvt2'; Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [2] SELECT * FROM "users" WHERE "user_id" = '2'; Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> PHP Error: Connection refused (GET /index.php?_task=settings&_action=plugin.managesieve-action&_framed=1&_nav=hide) Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> PHP Error: Unable to connect to managesieve on obfuscated.domain:4190 in /usr/local/www/roundcube/plugins/managesieve/lib/Roundcube/rcube_sieve_engine.php on line 221 (GET /index.php?_task=settings&_action=plugin.managesieve-action&_framed=1&_nav=hide) Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] Connecting to tls://obfuscated.domain:143... Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] S: * OK [CAPABILITY IMAP4rev1 SASL-IR LOGIN-REFERRALS ID ENABLE IDLE LITERAL+ STARTTLS LOGINDISABLED AUTH=CRAM-MD5] Dovecot ready. Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] C: A0001 STARTTLS Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] S: A0001 OK Begin TLS negotiation now. Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] C: A0002 CAPABILITY Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] S: * CAPABILITY IMAP4rev1 SASL-IR LOGIN-REFERRALS ID ENABLE IDLE LITERAL+ LOGINDISABLED AUTH=CRAM-MD5 Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] S: A0002 OK Pre-login capabilities listed, post-login capabilities have more. Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] C: A0003 AUTHENTICATE CRAM-MD5 Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] S: + PDI3MjU4Mjg1ODUxMTkzMTEuMTY2OTEzNDU3MUBtYWlsPg== Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] C: ****** [74] Nov 22 10:29:31 mail dovecot[8514]: imap-login: Login: user=<obfuscated(a)user.name>, method=CRAM-MD5, rip=10.0.0.1, lip=10.0.0.91, mpid=8639, TLS, session=<51k6rRHuw5gKAAAB> Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] S: A0003 OK [CAPABILITY IMAP4rev1 SASL-IR LOGIN-REFERRALS ID ENABLE IDLE SORT SORT=DISPLAY THREAD=REFERENCES THREAD=REFS THREAD=ORDEREDSUBJECT MULTIAPPEND URL-PARTIAL CATENATE UNSELECT CHILDREN NAMESPACE UIDPLUS LIST-EXTENDED I18NLEVEL=1 CONDSTORE QRESYNC ESEARCH ESORT SEARCHRES WITHIN CONTEXT=SEARCH LIST-STATUS BINARY MOVE SNIPPET=FUZZY PREVIEW=FUZZY PREVIEW STATUS=SIZE SAVEDATE LITERAL+ NOTIFY SPECIAL-USE] Logged in Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] C: A0004 ID ("name" "Roundcube" "version" "1.6.0" "php" "8.0.25" "os" "FreeBSD" "command" "/index.php?_task=settings&_action=plugin.managesieve-action&_framed=1&_nav=hide") Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] S: * ID ("name" "Dovecot") Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] S: A0004 OK ID completed (0.001 + 0.000 secs). Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] C: A0005 LIST (SUBSCRIBED) "" "*" Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] S: * LIST (\Subscribed) "/" Drafts Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] S: * LIST (\Subscribed) "/" Junk Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] S: * LIST (\Subscribed) "/" Sent Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] S: * LIST (\Subscribed) "/" Trash Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] S: * LIST (\Subscribed) "/" INBOX/NAS-Alerts Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] S: * LIST (\Subscribed) "/" INBOX/email-reports Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] S: A0005 OK List completed (0.001 + 0.000 secs). Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [3] UPDATE "session" SET "changed" = datetime('now'), "vars" = 'bGFuZ3VhZ2V8czo1OiJlbl9VUyI7aW1hcF9uYW1lc3BhY2V8YTo0OntzOjg6InBlcnNvbmFsIjthOjE6e2k6MDthOjI6e2k6MDtzOjA6IiI7aToxO3M6MToiLyI7fX1zOjU6Im90aGVyIjtOO3M6Njoic2hhcmVkIjtOO3M6MTA6InByZWZpeF9vdXQiO3M6MDoiIjt9aW1hcF9kZWxpbWl0ZXJ8czoxOiIvIjtpbWFwX2xpc3RfY29uZnxhOjI6e2k6MDtOO2k6MTthOjA6e319dXNlcl9pZHxpOjI7dXNlcm5hbWV8czoyNDoiY29saW5AY29saW5saWtlc2Zvb2QuY29tIjtzdG9yYWdlX2hvc3R8czoxODoiY29saW5saWtlc2Zvb2QuY29tIjtzdG9yYWdlX3BvcnR8aToxNDM7c3RvcmFnZV9zc2x8czozOiJ0bHMiO3Bhc3N3b3JkfHM6NDQ6ImNYOCt0VmJXV010VEMxRTlXQVB4ZjVOSlU1bWlKa2ZveC8xRWpuZVB2Ym89Ijtsb2dpbl90aW1lfGk6MTY2OTA2MzM4OTt0aW1lem9uZXxzOjE1OiJBbWVyaWNhL0NoaWNhZ28iO2F1dGhfc2VjcmV0fHM6MjY6ImNHdkc4ZWR5QmFmNWJITVpISG5sTEY3ZmpZIjtyZXF1ZXN0X3Rva2VufHM6MzI6IkM5VXlNNVBMUnhSeERiVm9HTlNMNjdVZ05NaWE4WVZGIjt0YXNrfHM6ODoic2V0dGluZ3MiO3NraW5fY29uZmlnfGE6Nzp7czoxNzoic3VwcG9ydGVkX2xheW91dHMiO2E6MTp7aTowO3M6MTA6IndpZGVzY3JlZW4iO31zOjIyOiJqcXVlcnlfdWlfY29sb3JzX3RoZW1lIjtzOjk6ImJvb3RzdHJhcCI7czoxODoiZW1iZWRfY3NzX2xvY2F0aW9uIjtzOjE3OiIvc3R5bGVzL2VtYmVkLmNzcyI7c zoxOToiZWRpdG9yX2Nzc19sb2NhdGlvbiI7czoxNzoiL3N0eWxlcy9lbWJlZC5jc3MiO3M6MTc6ImRhcmtfbW9kZV9zdXBwb3J0IjtiOjE7czoyNjoibWVkaWFfYnJvd3Nlcl9jc3NfbG9jYXRpb24iO3M6NDoibm9uZSI7czoyMToiYWRkaXRpb25hbF9sb2dvX3R5cGVzIjthOjM6e2k6MDtzOjQ6ImRhcmsiO2k6MTtzOjU6InNtYWxsIjtpOjI7czoxMDoic21hbGwtZGFyayI7fX1pbWFwX2hvc3R8czoxODoiY29saW5saWtlc2Zvb2QuY29tIjttYm94fHM6NToiSU5CT1giO3NvcnRfY29sfHM6MDoiIjtzb3J0X29yZGVyfHM6NDoiREVTQyI7U1RPUkFHRV9USFJFQUR8YTozOntpOjA7czoxMDoiUkVGRVJFTkNFUyI7aToxO3M6NDoiUkVGUyI7aToyO3M6MTQ6Ik9SREVSRURTVUJKRUNUIjt9U1RPUkFHRV9RVU9UQXxiOjA7U1RPUkFHRV9MSVNULUVYVEVOREVEfGI6MTtsaXN0X2F0dHJpYnxhOjc6e3M6NDoibmFtZSI7czo4OiJtZXNzYWdlcyI7czoyOiJpZCI7czoxMToibWVzc2FnZWxpc3QiO3M6NToiY2xhc3MiO3M6NDI6Imxpc3RpbmcgbWVzc2FnZWxpc3Qgc29ydGhlYWRlciBmaXhlZGhlYWRlciI7czoxNToiYXJpYS1sYWJlbGxlZGJ5IjtzOjIyOiJhcmlhLWxhYmVsLW1lc3NhZ2VsaXN0IjtzOjk6ImRhdGEtbGlzdCI7czoxMjoibWVzc2FnZV9saXN0IjtzOjE0OiJkYXRhLWxhYmVsLW1zZyI7czoxODoi Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] C: A0006 LOGOUT Nov 22 10:29:31 mail dovecot[8514]: imap(obfuscated(a)user.name)<8639><51k6rRHuw5gKAAAB>: Disconnected: Logged out in=215 out=821 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0 Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] S: * BYE Logging out Nov 22 10:29:31 mail roundcube[66295]: <keirks4p> [7FB5] S: A0006 OK Logout completed (0.001 + 0.000 secs). Nov 22 10:29:42 mail roundcube[71055]: <keirks4p> [1] SELECT "vars", "ip", "changed", datetime('now') AS ts, CASE WHEN "changed" < datetime('now', '-600 seconds') THEN 1 ELSE 0 END AS expired FROM "session" WHERE "sess_id" = 'keirks4pbepr17um9mvj1qsvt2'; Nov 22 10:29:42 mail roundcube[71055]: <keirks4p> [2] SELECT * FROM "users" WHERE "user_id" = '2'; Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> PHP Error: Connection refused (POST /?_task=settings&_action=plugin.managesieve-save) Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> PHP Error: Unable to connect to managesieve on obfuscated.domain:4190 in /usr/local/www/roundcube/plugins/managesieve/lib/Roundcube/rcube_sieve_engine.php on line 221 (POST /?_task=settings&_action=plugin.managesieve-save) Nov 22 10:29:43 mail roundcube[71055]: PHP Warning: Trying to access array offset on value of type null in /usr/local/www/roundcube/plugins/managesieve/lib/Roundcube/rcube_sieve_engine.php on line 1065 Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] Connecting to tls://obfuscated.domain:143... Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] S: * OK [CAPABILITY IMAP4rev1 SASL-IR LOGIN-REFERRALS ID ENABLE IDLE LITERAL+ STARTTLS LOGINDISABLED AUTH=CRAM-MD5] Dovecot ready. Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] C: A0001 STARTTLS Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] S: A0001 OK Begin TLS negotiation now. Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] C: A0002 CAPABILITY Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] S: * CAPABILITY IMAP4rev1 SASL-IR LOGIN-REFERRALS ID ENABLE IDLE LITERAL+ LOGINDISABLED AUTH=CRAM-MD5 Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] S: A0002 OK Pre-login capabilities listed, post-login capabilities have more. Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] C: A0003 AUTHENTICATE CRAM-MD5 Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] S: + PDE2NjcxMDUwNTU2NDcwMTMuMTY2OTEzNDU4M0BtYWlsPg== Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] C: ****** [74] Nov 22 10:29:43 mail dovecot[8514]: imap-login: Login: user=<obfuscated(a)user.name>, method=CRAM-MD5, rip=10.0.0.1, lip=10.0.0.91, mpid=8644, TLS, session=<677prRHu4aAKAAAB> Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] S: A0003 OK [CAPABILITY IMAP4rev1 SASL-IR LOGIN-REFERRALS ID ENABLE IDLE SORT SORT=DISPLAY THREAD=REFERENCES THREAD=REFS THREAD=ORDEREDSUBJECT MULTIAPPEND URL-PARTIAL CATENATE UNSELECT CHILDREN NAMESPACE UIDPLUS LIST-EXTENDED I18NLEVEL=1 CONDSTORE QRESYNC ESEARCH ESORT SEARCHRES WITHIN CONTEXT=SEARCH LIST-STATUS BINARY MOVE SNIPPET=FUZZY PREVIEW=FUZZY PREVIEW STATUS=SIZE SAVEDATE LITERAL+ NOTIFY SPECIAL-USE] Logged in Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] C: A0004 ID ("name" "Roundcube" "version" "1.6.0" "php" "8.0.25" "os" "FreeBSD" "command" "/") Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] S: * ID ("name" "Dovecot") Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] S: A0004 OK ID completed (0.001 + 0.000 secs). Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] C: A0005 LIST (SUBSCRIBED) "" "*" Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] S: * LIST (\Subscribed) "/" Drafts Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] S: * LIST (\Subscribed) "/" Junk Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] S: * LIST (\Subscribed) "/" Sent Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] S: * LIST (\Subscribed) "/" Trash Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] S: * LIST (\Subscribed) "/" INBOX/NAS-Alerts Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] S: * LIST (\Subscribed) "/" INBOX/email-reports Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] S: A0005 OK List completed (0.001 + 0.000 secs). Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] C: A0006 LOGOUT Nov 22 10:29:43 mail dovecot[8514]: imap(obfuscated(a)user.name)<8644><677prRHu4aAKAAAB>: Disconnected: Logged out in=137 out=821 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0 Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] S: * BYE Logging out Nov 22 10:29:43 mail roundcube[71055]: <keirks4p> [CD90] S: A0006 OK Logout completed (0.001 + 0.000 secs). DOVECOT INFO: ------------------------ # dovecot --version 2.3.19.1 (9b53102964) # dovecot -n # 2.3.19.1 (9b53102964): /usr/local/etc/dovecot/dovecot.conf # Pigeonhole version 0.5.19 (4eae2f79) # OS: FreeBSD 13.1-RELEASE-p2 amd64 zfs # Hostname: localhost auth_mechanisms = cram-md5 first_valid_gid = 10000 first_valid_uid = 10000 mail_location = maildir:/var/mail/users/%u managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext namespace inbox { inbox = yes location = mailbox Drafts { auto = create special_use = \Drafts } mailbox Junk { auto = create special_use = \Junk } mailbox Sent { auto = create special_use = \Sent } mailbox Trash { auto = create special_use = \Trash } prefix = separator = / } passdb { args = username_format=%u /usr/local/etc/dovecot/users driver = passwd-file } plugin { sieve = file:/usr/local/etc/dovecot/sieve;active=/usr/local/etc/dovecot/sieve/.dovecot.sieve sieve_before = /usr/local/etc/dovecot/sieve/before-global.sieve sieve_default = /usr/local/etc/dovecot/sieve/default.sieve sieve_global = /usr/local/etc/dovecot/sieve/global/ } protocols = imap lmtp sieve service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0666 user = postfix } } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0660 user = postfix } } service managesieve-login { inet_listener sieve { port = 4190 } } ssl_cert = </usr/local/etc/letsencrypt/live/obfuscated.domain/fullchain.pem ssl_cipher_list = HIGH:!aNULL:!AES128:!SSLv2 ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it syslog_facility = local1 userdb { args = username_format=%u /usr/local/etc/dovecot/users driver = passwd-file } protocol lmtp { mail_plugins = " sieve" } protocol sieve { info_log_path = /var/log/dovecot-sieve.log log_path = /var/log/dovecot-sieve-errors.log managesieve_implementation_string = dovecot managesieve_max_line_length = 64 k } THANKS! Colin

3 5

Event 0x560045857eb0 leaked
by support＠openmbox.net 18 Nov '22

18 Nov '22

what do these logs mean in mail.log? Nov 18 10:23:03 mx dovecot: auth: Warning: Event 0x560045857eb0 leaked (parent=(nil)): auth-client-connection.c:338 Nov 18 10:23:03 mx dovecot: auth: Warning: Event 0x560045894390 leaked (parent=(nil)): auth-client-connection.c:338 Nov 18 10:23:03 mx dovecot: auth: Warning: Event 0x56004589d3e0 leaked (parent=(nil)): auth-client-connection.c:338 Nov 18 10:23:03 mx dovecot: auth: Warning: Event 0x56004588f810 leaked (parent=(nil)): auth-client-connection.c:338 Nov 18 10:23:03 mx dovecot: auth: Warning: Event 0x560045857240 leaked (parent=(nil)): auth-client-connection.c:338 Nov 18 10:23:03 mx dovecot: auth: Warning: Event 0x56004589cfd0 leaked (parent=(nil)): auth-client-connection.c:338 Nov 18 10:23:03 mx dovecot: auth: Warning: Event 0x56004586b130 leaked (parent=(nil)): auth-client-connection.c:338 I am using this version dovecot in a ubunto 20.04 box. # dovecot --version 2.3.7.2 (3c910f64b) thanks.

1 0

Dovecot 2.2 to 2.3 migration
by Markus Wienhöfer 17 Nov '22

17 Nov '22

Hi, we are currently using Dovecot 2.2 (from the Ubuntu 18.04 repos) and would like to migrate to 2.3 I have read the migration documentation regarding the configuration changes. Apart from that, is it feasible/possible to change from Ubuntu to official Dovecot repositories and upgrade the dovecot package this way? Or is there anything else we should be aware of? Best regards Markus

3 3

Doveadm backup stateful synchronization trouble
by dovecot＠f-hamelin.fr 16 Nov '22

16 Nov '22

Hi, The non-blocking error is: doveadm(user1s@domain): Error: Saved sync state is invalid, falling back to full sync: Invalid base64 data This error occurs every time on my test machine (no traffic, only a few test messages). That error sometime also occurs on my production system, but not each time. The command I used for the first time is : doveadm backup -A -s "" -d > state.txt After that there is a daily calls (as vmail user, my config only handle virtual users) to : doveadm backup -A -s "$(<state.txt)" -d > state.txt.tmp && mv state.txt.tmp state.txt doveconf -n output is available at https://www.f-hamelin.fr/pub/doveadm-backup-doveconf.txt Any help will be welcomed Best regards, Franck

1 0

OAUTH2 local validation
by Felix Auringer 16 Nov '22

16 Nov '22

Hello, <https://doc.dovecot.org/configuration_manual/authentication/oauth2/#local-v…> describes how to set up local validation for OAUTH2 with dovecot. This works fine as long as the keys are not rotated. In my experience, it is common for a client to try to validate a token with the cached key and update the cached keys when the local validation fails (e.g. via the /auth/realms/<realm>/protocol/openid-connect/certs endpoint in Keycloak). This way, the client does not need to fetch new keys periodically but only when the old ones expired. If I understand it correctly, Dovecot reads the keys from a defined path but does not care how to update them. Did you have a nice way in mind how the keys should be refreshed when deciding not to do that in dovecot? Are you planning to add automatic refreshing of local validation keys to dovecot? I am running dovecot in Docker and one way would be a cron job on the host that fetches new keys and updates the files inside the container via docker exec. It would work but it's not really a nice solution because from outside dovecot, the information whether the old keys are no longer valid, is not available and the whole process needs to run periodically (and thus way more often than actually necessary). Best regards, Felix Auringer --- Gesellschaft für interkulturelles Zusammenleben gGmbH (GIZ) Felix Auringer IT Reformationsplatz 2 13597 Berlin Tel: 030/513 0100 00; Fax: 030/513 0100 09 www.giz.berlin; felix.auringer(a)giz.berlin Amtsgericht Charlottenburg HRB 200872 B Geschäftsführerin: Dr. Britta Marschke

2 1

Re: bug: ARGON2 hash selection incompatible with LDAP
by Krisztián Szegi 16 Nov '22

16 Nov '22

"Michael Ströder" michael(a)stroeder.com – 15 November 2022 15:00 > On 11/15/22 13:45, Krisztián Szegi wrote: >> I'd like to report that non-binding auth to (Open)LDAP doesn't work >> if the latter hashes passwords with ARGON2. > Could you please elaborate why using LDAP bind is a problem for you? > > Ciao, Michael. > > Fair enough question! I cannot specify bind_dn template due to mismatched mail addresses and user DNs, and I thought that that would be suboptimal due to re-binding. I am a bit confused about how to optimize LDAP lookups now (static files not option :), re-reading the docs it just made me question more things - auth_bind_dn cannot be given in my case, as a fixed starting point - auth_bind adds a temporary binding (using pass_filter) - can I use userdb prefetch? Docs say I cannot if I use bind with template, but I am not using the latter. So the search for the user's dn during auth IS the passdb lookup? - assuming I am correct, I should give back stuff with passdb lookup: or do I? - Must I give back userid an guid? 10-mail.conf has "vmail" for both, as mail accounts don't have UNIX ones linked to them... - same for home? There is no default I've given until userdb lookup. Just specify a global mail_home with variables, and get on with life? -if I should give back one, should I pass it with default_fields = userdb_home (currently I specify it under default_fields:home in userdb lookup as LDAP doesn't override home). The docs are confusing around userdb. The main thing what is not clear that they CAN override fields on a per-user basis, but must they provide them for non-extra fields, when there are global settings for those? Thanks! BTW, thanks for the great software all of you. Michael, I've come across some of your work, you have my respect!

3 2

Accessing Shared Mailbox not working
by Quiwy 15 Nov '22

15 Nov '22

Hi, I'm new on this mailing list and I'm struggling with the configuration of shared mailboxes. I've followed the following documentation page : https://doc.dovecot.org/configuration_manual/shared_mailboxes/shared_mailbo… and manage to had it working for something like 2 minutes, but then changed a parameter and can't get it back working (and of course I don't remember which one it was). I'm using dovecot 2.3.13 . user@hostname:~# dovecot -n # 2.3.13 (89f716dc2): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.13 (cdd19fe3) # OS: Linux 5.10.0-19-amd64 x86_64 Debian 11.5 # Hostname: hostname auth_mechanisms = plain login dict { acl = mysql:/etc/dovecot/dovecot-dict-sql.conf.ext } mail_debug = yes mail_home = /var/vmail/%d/%n mail_location = maildir:~/ mail_plugins = acl mail_privileged_group = mail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext namespace { list = yes location = maildir:/var/mail/vmail/%%d/%%n/Maildir:INDEXPVT=/var/mail/vmail/%%d/%%n/Maildir/shared/%n prefix = shared/%%u/ separator = / subscriptions = no type = shared } namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = separator = / type = private } passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } plugin { acl = vfile acl_shared_dict = proxy::acl sieve = file:~/sieve;active=~/.dovecot.sieve } protocols = " imap sieve" service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } unix_listener auth-userdb { mode = 0600 user = vmail } user = dovecot } ssl_cert = </etc/letsencrypt/live/domain/fullchain.pem ssl_client_ca_dir = /etc/ssl/certs ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { args = uid=vmail gid=vmail home=/var/mail/vmail/%d/%n driver = static } protocol imap { mail_plugins = acl imap_acl imap_acl } protocol lda { mail_plugins = acl sieve } This is the content of dovecot-dict-sql.conf.ext : cat dovecot-dict-sql.conf.ext # This file is commonly accessed via dict {} section in dovecot.conf connect = host=localhost dbname=my_dbname user=my_admin_db_user password=my_password map { pattern = shared/shared-boxes/user/$to/$from table = user_shares value_field = dummy fields { from_user = $from to_user = $to } } map { pattern = shared/shared-boxes/anyone/$from table = anyone_shares value_field = dummy fields { from_user = $from } } Now, I have configured some rigth through SOGo interface as I need to use it. With doveadm I can see the good rights : doveadm acl get -u user1@domain INBOX ID Global Rights user=user2(a)devops.algoo.net lookup read user=user3(a)devops.algoo.net admin create delete expunge insert lookup post read write write-deleted write-seen This this the output I have from journalctl -f command with debug enabled when trying to access to the shared folder within SOGo : Nov 15 17:51:14 hostname dovecot[269267]: imap-login: Login: user=<user3@domain>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, mpid=270025, secured, session=<UL//KYXt7ul/AAAB> Nov 15 17:51:14 hostname dovecot[269267]: imap(user3user3@domain)<270025><UL//KYXt7ul/AAAB>: Debug: Loading modules from directory: /usr/lib/dovecot/modules Nov 15 17:51:14 hostname dovecot[269267]: imap(user3@domain)<270025><UL//KYXt7ul/AAAB>: Debug: Module loaded: /usr/lib/dovecot/modules/lib01_acl_plugin.so Nov 15 17:51:14 hostname dovecot[269267]: imap(user3@domain)<270025><UL//KYXt7ul/AAAB>: Debug: Module loaded: /usr/lib/dovecot/modules/lib02_imap_acl_plugin.so Nov 15 17:51:14 hostname dovecot[269267]: imap(user3@domain)<270025><UL//KYXt7ul/AAAB>: Debug: Effective uid=5000, gid=5000, home=/var/mail/vmail/domain/user3 Nov 15 17:51:14 hostname dovecot[269267]: imap(user3@domain)<270025><UL//KYXt7ul/AAAB>: Debug: Namespace inbox: type=private, prefix=, sep=/, inbox=yes, hidden=no, list=yes, subscriptions=yes location=maildir:~/ Nov 15 17:51:14 hostname dovecot[269267]: imap(user3@domain)<270025><UL//KYXt7ul/AAAB>: Debug: maildir++: root=/var/mail/vmail/domain/user3, index=, indexpvt=, control=, inbox=/var/mail/vmail/domain/user3, alt= Nov 15 17:51:14 hostname dovecot[269267]: imap(user3@domain)<270025><UL//KYXt7ul/AAAB>: Debug: acl: initializing backend with data: vfile Nov 15 17:51:14 hostname dovecot[269267]: imap(user3@domain)<270025><UL//KYXt7ul/AAAB>: Debug: acl: acl username = user3@domain Nov 15 17:51:14 hostname dovecot[269267]: imap(user3@domain)<270025><UL//KYXt7ul/AAAB>: Debug: acl: owner = 1 Nov 15 17:51:14 hostname dovecot[269267]: imap(user3@domain)<270025><UL//KYXt7ul/AAAB>: Debug: acl vfile: Global ACLs disabled Nov 15 17:51:14 hostname dovecot[269267]: imap(user3@domain)<270025><UL//KYXt7ul/AAAB>: Debug: Namespace : type=shared, prefix=shared/%u/, sep=/, inbox=no, hidden=no, list=yes, subscriptions=no location=maildir:/var/mail/vmail/%d/%n/Maildir:INDEXPVT=/var/mail/vmail/%d/%n/Maildir/shared/user3 Nov 15 17:51:14 hostname dovecot[269267]: imap(user3@domain)<270025><UL//KYXt7ul/AAAB>: Debug: shared: root=/run/dovecot, index=, indexpvt=, control=, inbox=, alt= Nov 15 17:51:14 hostname dovecot[269267]: imap(user3@domain)<270025><UL//KYXt7ul/AAAB>: Debug: acl: initializing backend with data: vfile Nov 15 17:51:14 hostname dovecot[269267]: imap(user3@domain)<270025><UL//KYXt7ul/AAAB>: Debug: acl: acl username = user3@domain Nov 15 17:51:14 hostname dovecot[269267]: imap(user3@domain)<270025><UL//KYXt7ul/AAAB>: Debug: acl: owner = 0 Nov 15 17:51:14 hostname dovecot[269267]: imap(user3@domain)<270025><UL//KYXt7ul/AAAB>: Debug: acl vfile: Global ACLs disabled Nov 15 17:51:14 hostname dovecot[269267]: imap(user3@domain)<270025><UL//KYXt7ul/AAAB>: Debug: Mailbox INBOX/folder_i_want_to_share_from_user1_to_user3: Mailbox opened because: SELECT Nov 15 17:51:14 hostname dovecot[269267]: imap(user3@domain)<270025><UL//KYXt7ul/AAAB>: Debug: acl vfile: reading file /var/mail/vmail/domain/user3/.INBOX.folder_i_want_to_share_from_user1_to_user3/dovecot-acl Nov 15 17:51:14 hostname dovecot[269267]: imap(user3@domain)<270025><UL//KYXt7ul/AAAB>: Logged out in=140 out=1521 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0 Nov 15 17:51:15 hostname dovecot[269267]: imap-login: Login: user=<user3@domain>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, mpid=270028, secured, session=<IDgGKoXt/Ol/AAAB> Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270028><IDgGKoXt/Ol/AAAB>: Debug: Loading modules from directory: /usr/lib/dovecot/modules Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270028><IDgGKoXt/Ol/AAAB>: Debug: Module loaded: /usr/lib/dovecot/modules/lib01_acl_plugin.so Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270028><IDgGKoXt/Ol/AAAB>: Debug: Module loaded: /usr/lib/dovecot/modules/lib02_imap_acl_plugin.so Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270028><IDgGKoXt/Ol/AAAB>: Debug: Effective uid=5000, gid=5000, home=/var/mail/vmail/domain/user3 Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270028><IDgGKoXt/Ol/AAAB>: Debug: Namespace inbox: type=private, prefix=, sep=/, inbox=yes, hidden=no, list=yes, subscriptions=yes location=maildir:~/ Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270028><IDgGKoXt/Ol/AAAB>: Debug: maildir++: root=/var/mail/vmail/domain/user3, index=, indexpvt=, control=, inbox=/var/mail/vmail/domain/user3, alt= Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270028><IDgGKoXt/Ol/AAAB>: Debug: acl: initializing backend with data: vfile Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270028><IDgGKoXt/Ol/AAAB>: Debug: acl: acl username = user3@domain Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270028><IDgGKoXt/Ol/AAAB>: Debug: acl: owner = 1 Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270028><IDgGKoXt/Ol/AAAB>: Debug: acl vfile: Global ACLs disabled Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270028><IDgGKoXt/Ol/AAAB>: Debug: Namespace : type=shared, prefix=shared/%u/, sep=/, inbox=no, hidden=no, list=yes, subscriptions=no location=maildir:/var/mail/vmail/%d/%n/Maildir:INDEXPVT=/var/mail/vmail/%d/%n/Maildir/shared/user3 Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270028><IDgGKoXt/Ol/AAAB>: Debug: shared: root=/run/dovecot, index=, indexpvt=, control=, inbox=, alt= Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270028><IDgGKoXt/Ol/AAAB>: Debug: acl: initializing backend with data: vfile Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270028><IDgGKoXt/Ol/AAAB>: Debug: acl: acl username = user3@domain Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270028><IDgGKoXt/Ol/AAAB>: Debug: acl: owner = 0 Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270028><IDgGKoXt/Ol/AAAB>: Debug: acl vfile: Global ACLs disabled Nov 15 17:51:15 hostname dovecot[269267]: imap-login: Login: user=<user3@domain>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, mpid=270029, secured, session=<7mIGKoXtAOp/AAAB> Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270029><7mIGKoXtAOp/AAAB>: Debug: Loading modules from directory: /usr/lib/dovecot/modules Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270029><7mIGKoXtAOp/AAAB>: Debug: Module loaded: /usr/lib/dovecot/modules/lib01_acl_plugin.so Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270029><7mIGKoXtAOp/AAAB>: Debug: Module loaded: /usr/lib/dovecot/modules/lib02_imap_acl_plugin.so Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270029><7mIGKoXtAOp/AAAB>: Debug: Effective uid=5000, gid=5000, home=/var/mail/vmail/domain/user3 Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270029><7mIGKoXtAOp/AAAB>: Debug: Namespace inbox: type=private, prefix=, sep=/, inbox=yes, hidden=no, list=yes, subscriptions=yes location=maildir:~/ Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270029><7mIGKoXtAOp/AAAB>: Debug: maildir++: root=/var/mail/vmail/domain/user3, index=, indexpvt=, control=, inbox=/var/mail/vmail/domain/user3, alt= Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270029><7mIGKoXtAOp/AAAB>: Debug: acl: initializing backend with data: vfile Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270029><7mIGKoXtAOp/AAAB>: Debug: acl: acl username = user3@domain Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270029><7mIGKoXtAOp/AAAB>: Debug: acl: owner = 1 Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270029><7mIGKoXtAOp/AAAB>: Debug: acl vfile: Global ACLs disabled Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270029><7mIGKoXtAOp/AAAB>: Debug: Namespace : type=shared, prefix=shared/%u/, sep=/, inbox=no, hidden=no, list=yes, subscriptions=no location=maildir:/var/mail/vmail/%d/%n/Maildir:INDEXPVT=/var/mail/vmail/%d/%n/Maildir/shared/user3 Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270029><7mIGKoXtAOp/AAAB>: Debug: shared: root=/run/dovecot, index=, indexpvt=, control=, inbox=, alt= Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270029><7mIGKoXtAOp/AAAB>: Debug: acl: initializing backend with data: vfile Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270029><7mIGKoXtAOp/AAAB>: Debug: acl: acl username = user3@domain Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270029><7mIGKoXtAOp/AAAB>: Debug: acl: owner = 0 Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270029><7mIGKoXtAOp/AAAB>: Debug: acl vfile: Global ACLs disabled Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270029><7mIGKoXtAOp/AAAB>: Debug: acl vfile: file /var/mail/vmail/domain/user3/dovecot-acl not found Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270029><7mIGKoXtAOp/AAAB>: Debug: acl vfile: reading file /var/mail/vmail/domain/user3/.INBOX.folder_i_want_to_share_from_user1_to_user3/dovecot-acl Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270028><IDgGKoXt/Ol/AAAB>: Debug: Mailbox INBOX: Mailbox opened because: SELECT Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270028><IDgGKoXt/Ol/AAAB>: Debug: acl vfile: file /var/mail/vmail/domain/user3/dovecot-acl not found Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270029><7mIGKoXtAOp/AAAB>: Debug: maildir++: root=/var/mail/vmail/domain/user1/Maildir, index=, indexpvt=/var/mail/vmail/domain/user1/Maildir/shared/user3, control=, inbox=/var/mail/vmail/domain/user1/Maildir, alt= Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270029><7mIGKoXtAOp/AAAB>: Debug: acl: initializing backend with data: vfile Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270029><7mIGKoXtAOp/AAAB>: Debug: acl: acl username = user1@domain Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270029><7mIGKoXtAOp/AAAB>: Debug: acl: owner = 1 Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270029><7mIGKoXtAOp/AAAB>: Debug: acl vfile: Global ACLs disabled Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270029><7mIGKoXtAOp/AAAB>: Debug: maildir++: root=/var/mail/vmail/domain/user1/Maildir, index=, indexpvt=/var/mail/vmail/domain/user1/Maildir/shared/user3, control=, inbox=/var/mail/vmail/domain/user1/Maildir, alt= Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270029><7mIGKoXtAOp/AAAB>: Debug: acl: initializing backend with data: vfile Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270029><7mIGKoXtAOp/AAAB>: Debug: acl: acl username = user3@domain Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270029><7mIGKoXtAOp/AAAB>: Debug: acl: owner = 0 Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270029><7mIGKoXtAOp/AAAB>: Debug: acl vfile: Global ACLs disabled Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270029><7mIGKoXtAOp/AAAB>: Debug: acl: Mailbox not in dovecot-acl-list: shared/user1@domain Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270029><7mIGKoXtAOp/AAAB>: Debug: acl vfile: file /var/mail/vmail/domain/user1/Maildir/dovecot-acl not found Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270029><7mIGKoXtAOp/AAAB>: Debug: Namespace shared/: Using permissions from : mode=0700 gid=default Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270028><IDgGKoXt/Ol/AAAB>: Logged out in=198 out=1581 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0 Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270029><7mIGKoXtAOp/AAAB>: Logged out in=125 out=1417 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0 Nov 15 17:51:15 hostname dovecot[269267]: imap-login: Login: user=<user3@domain>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, mpid=270033, secured, session=<B4gIKoXtDOp/AAAB> Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270033><B4gIKoXtDOp/AAAB>: Debug: Loading modules from directory: /usr/lib/dovecot/modules Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270033><B4gIKoXtDOp/AAAB>: Debug: Module loaded: /usr/lib/dovecot/modules/lib01_acl_plugin.so Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270033><B4gIKoXtDOp/AAAB>: Debug: Module loaded: /usr/lib/dovecot/modules/lib02_imap_acl_plugin.so Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270033><B4gIKoXtDOp/AAAB>: Debug: Effective uid=5000, gid=5000, home=/var/mail/vmail/domain/user3 Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270033><B4gIKoXtDOp/AAAB>: Debug: Namespace inbox: type=private, prefix=, sep=/, inbox=yes, hidden=no, list=yes, subscriptions=yes location=maildir:~/ Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270033><B4gIKoXtDOp/AAAB>: Debug: maildir++: root=/var/mail/vmail/domain/user3, index=, indexpvt=, control=, inbox=/var/mail/vmail/domain/user3, alt= Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270033><B4gIKoXtDOp/AAAB>: Debug: acl: initializing backend with data: vfile Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270033><B4gIKoXtDOp/AAAB>: Debug: acl: acl username = user3@domain Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270033><B4gIKoXtDOp/AAAB>: Debug: acl: owner = 1 Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270033><B4gIKoXtDOp/AAAB>: Debug: acl vfile: Global ACLs disabled Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270033><B4gIKoXtDOp/AAAB>: Debug: Namespace : type=shared, prefix=shared/%u/, sep=/, inbox=no, hidden=no, list=yes, subscriptions=no location=maildir:/var/mail/vmail/%d/%n/Maildir:INDEXPVT=/var/mail/vmail/%d/%n/Maildir/shared/user3 Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270033><B4gIKoXtDOp/AAAB>: Debug: shared: root=/run/dovecot, index=, indexpvt=, control=, inbox=, alt= Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270033><B4gIKoXtDOp/AAAB>: Debug: acl: initializing backend with data: vfile Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270033><B4gIKoXtDOp/AAAB>: Debug: acl: acl username = user3@domain Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270033><B4gIKoXtDOp/AAAB>: Debug: acl: owner = 0 Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270033><B4gIKoXtDOp/AAAB>: Debug: acl vfile: Global ACLs disabled Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270033><B4gIKoXtDOp/AAAB>: Debug: Mailbox INBOX/folder_i_want_to_share_from_user1_to_user3: Mailbox opened because: SELECT Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270033><B4gIKoXtDOp/AAAB>: Debug: acl vfile: reading file /var/mail/vmail/domain/user3/.INBOX.folder_i_want_to_share_from_user1_to_user3/dovecot-acl Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270033><B4gIKoXtDOp/AAAB>: Logged out in=313 out=2117 deleted=0 expunged=0 trashed=0 hdr_count=1 hdr_bytes=2 body_count=0 body_bytes=0 Nov 15 17:51:15 hostname dovecot[269267]: imap-login: Login: user=<user3@domain>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, mpid=270037, secured, session=<nRkMKoXtFup/AAAB> Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270037><nRkMKoXtFup/AAAB>: Debug: Loading modules from directory: /usr/lib/dovecot/modules Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270037><nRkMKoXtFup/AAAB>: Debug: Module loaded: /usr/lib/dovecot/modules/lib01_acl_plugin.so Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270037><nRkMKoXtFup/AAAB>: Debug: Module loaded: /usr/lib/dovecot/modules/lib02_imap_acl_plugin.so Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270037><nRkMKoXtFup/AAAB>: Debug: Effective uid=5000, gid=5000, home=/var/mail/vmail/domain/user3 Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270037><nRkMKoXtFup/AAAB>: Debug: Namespace inbox: type=private, prefix=, sep=/, inbox=yes, hidden=no, list=yes, subscriptions=yes location=maildir:~/ Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270037><nRkMKoXtFup/AAAB>: Debug: maildir++: root=/var/mail/vmail/domain/user3, index=, indexpvt=, control=, inbox=/var/mail/vmail/domain/user3, alt= Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270037><nRkMKoXtFup/AAAB>: Debug: acl: initializing backend with data: vfile Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270037><nRkMKoXtFup/AAAB>: Debug: acl: acl username = user3@domain Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270037><nRkMKoXtFup/AAAB>: Debug: acl: owner = 1 Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270037><nRkMKoXtFup/AAAB>: Debug: acl vfile: Global ACLs disabled Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270037><nRkMKoXtFup/AAAB>: Debug: Namespace : type=shared, prefix=shared/%u/, sep=/, inbox=no, hidden=no, list=yes, subscriptions=no location=maildir:/var/mail/vmail/%d/%n/Maildir:INDEXPVT=/var/mail/vmail/%d/%n/Maildir/shared/user3 Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270037><nRkMKoXtFup/AAAB>: Debug: shared: root=/run/dovecot, index=, indexpvt=, control=, inbox=, alt= Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270037><nRkMKoXtFup/AAAB>: Debug: acl: initializing backend with data: vfile Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270037><nRkMKoXtFup/AAAB>: Debug: acl: acl username = user3@domain Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270037><nRkMKoXtFup/AAAB>: Debug: acl: owner = 0 Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270037><nRkMKoXtFup/AAAB>: Debug: acl vfile: Global ACLs disabled Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270037><nRkMKoXtFup/AAAB>: Debug: Mailbox INBOX: Mailbox opened because: SELECT Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270037><nRkMKoXtFup/AAAB>: Debug: acl vfile: file /var/mail/vmail/domain/user3/dovecot-acl not found Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270037><nRkMKoXtFup/AAAB>: Debug: Mailbox INBOX/folder_i_want_to_share_from_user1_to_user3: Mailbox opened because: SELECT Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270037><nRkMKoXtFup/AAAB>: Debug: acl vfile: reading file /var/mail/vmail/domain/user3/.INBOX.folder_i_want_to_share_from_user1_to_user3/dovecot-acl Nov 15 17:51:15 hostname dovecot[269267]: imap(user3@domain)<270037><nRkMKoXtFup/AAAB>: Logged out in=218 out=1925 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0 I tried with thunderbird too but no folders appears neither. Do you have any clue on which parameter do I need to change in order to get it working? Thank you very much for any help provided. Quiwy

1 0

R: Dovecot 2.3 shared namespace issues
by Stefano Cecconello 15 Nov '22

15 Nov '22

Hello, My bad, the OS was ubuntu 20.04 and not 22.04 . After further tinkering\testing, it seems that removing the " acl_ignore_namespace = shared/* " setting did the trick, now we're getting the correct ACL on client side . Without it we can see the folder with the right permissions : Logging as user01 : shared\Sharer01\INBOX : '[NONEXISTENT] Mailbox doesn't exist: shared/test.imapsharer01(a)td01.testdomain.it/INBOX'' shared\Sharer01\subfolder01 ( RW ) : 'shared/test.imapsharer01(a)td01.testdomain.it/subfolder01 test.imapuser01(a)td01.testdomain.it akxeilprwtscd '] shared\Sharer01\subfolder02ro ( RO ) : '[NOPERM] You lack administrator privileges on this mailbox' Logging on Thunderbird and other IMAP clients ( sylpheed\claws ) as user01 : - It list correctly the shared folders as subscribed folders ; - can't view the mail contents of the sharer INBOX, as desired ; - show the total elements of the sharer INBOX, even if the user01 didnt have access ; If the config is correct, this is somehow what we're trying to accomplish, i have some concerns regarding how it is possible to show the total messages of the remote INBOX without having any privileges . Maybe is something related to the index of that INBOX folder that is somewhat read by the accessing user even if IMAP-wise didnt have any ACL \ rights . I still dont understand why enabling the acl_ignore_namespace setting, results in a : - remote INBOX full control, even if it was not defined in any acl ; - subfolders ACL applied correctly Hope that someone can shed a light on it . Thanks Stefano

1 0

Re: bug: ARGON2 hash selection incompatible with LDAP
by Krisztián Szegi 15 Nov '22

15 Nov '22

Sorry, I wanted to post from this alias, but From-Address isn't saved with my drafts :) I failed to recognize during my patchwork that the verification function is the same for ARGON2I and -ID: both call `verify_argon2`, which in turn calls `libsodium's crypto_pwhash_str_verify`. In the new light this, there is no "harm" in my patch: - If backend gives back "{ARGON2}...", dovecot verifies with the same call anyway, regardless of what subtype it actually is, i.e.: {ARGON2I} will work too. - If dovecot generates the hash, the prefix will be the one set by the config's default hash, so for backwards comp., "{ARGON2ID}" could be used if someone wants that. Dovecot will succeed in verifying {ARGON2} generated by itself as well. "Aki Tuomi" aki.tuomi(a)open-xchange.com – 15 November 2022 13:55 > > On 15/11/2022 14:45 EET Krisztián Szegi <oni-dono(a)mszk.eu> wrote: > > > > > > Good day to all, > > > > this is my first post to the mailing list! > > > > I'd like to report that non-binding auth to (Open)LDAP doesn't work if the latter hashes passwords with ARGON2. > > > > Although dovecot (I am using http://2.3.19.1) does support ARGON2 with libsodium, but it doesn't recoginize hashes beginning "{ARGON2}$argon2id$" stored (and hashed, using ppolicy module's hashCleartext) by OpenLDAP. > > > > Now, I understand that ARGON2I, -D, and -ID are not compatible, but the ACTUAL algorithm is there between the two $. > > Furthermore, I think dovecot is in the minority here, I haven't met any software that specifies the ARGON2 subtype between {}. > > BTW, I haven't met any software that hashes passwords with ARGON2, but not with the ARGON2ID subtype (where libsodium is available, which also seems to be the standard here), as THAT is the recommended one anyway. > > > > I patched the rpm in OpenSUSE repo to alias {ARGON2} to {ARGON2ID}: > > https://build.opensuse.org/package/view_file/home:Samonitari:branches:openS… > > > > Could we get something like this (but maybe more correct) into the official source? > > Maybe a config switch to alias it runtime? > > > > Thanks for the attention: > > Krisztián > > Hi! > > Thanks for your report. I think it makes sense, we'll see what we can do about this. > > Aki > >

1 0

Dovecot 2.3 shared namespace issues
by Stefano Cecconello 15 Nov '22

15 Nov '22

Hello, We're trying to configure the shared mailbox feature\namespace on a dovecot 2.3 installation . OS : Ubuntu 22.04 x64 Dovecot : 2:2.3.19.1-2+ubuntu20.04 Our test enviroment is based on a dovecot frontend ( director + proxy ) and a dovecot backend ( auth and storage ), later we will think about increasing the number of backends and frontends ( if we got it right, as we plan to use multiple backends, we should use imapc in order to bind the sharer and the accessing user to the same backend ) . On dovecot backend we've configured the new shared namespace, as stated in the documentation ( https://doc.dovecot.org/configuration_manual/shared_mailboxes/shared_mailbox es/#user-shared-mailboxes ) : -- Dovecot conf -------------------- # Maildir's location is under home dir, which is returned by userdb. mail_location = maildir:~/Maildir:VOLATILEDIR=/tmp_lock/%2.256Nu/%u # Quota, mail_log plugins enabled everywhere mail_plugins = quota notify acl fts fts_lucene mail_log mailbox_alias virtual # Default namespace namespace { hidden = no inbox = yes location = prefix = separator = / type = private mailbox Sent { special_use = \Sent auto = create } mailbox Trash { special_use = \Trash auto = create } mailbox Drafts { special_use = \Drafts auto = create } mailbox SPAM { special_use = \Junk auto = create } } # namespace used by virtual search namespace { prefix = VrtSearch. separator = / location = virtual:/etc/dovecot-common-backend/virtual:INDEX=~/virtual hidden = yes subscriptions = no inbox = no list = no } # IMAP SHARING FEATURE service dict { unix_listener dict { mode = 0600 user = vpopmail group = vchkpw } } plugin { acl = vfile acl_ignore_namespace = shared/* acl_shared_dict = proxy::acl-mysql } dict { acl-mysql = mysql:/etc/dovecot-common-backend/dovecot-dict-sql.conf.ext } # namespace used for IMAP sharing feature namespace { type = shared separator = / prefix = shared/%%u/ location = maildir:%%h/Maildir:INDEX=~/Maildir/shared/%%u list = children subscriptions = no } -- Dovecot dict sql -------------------- # IMAP SHARING FEATURE connect = host=x.x.x.x dbname=xxxxxx user=xxxxxx password=xxxxxx map { pattern = shared/shared-boxes/user/$to/$from table = imap_user_shares value_field = dummy fields { from_user = $from to_user = $to } } map { pattern = shared/shared-boxes/anyone/$from table = imap_anyone_shares value_field = dummy fields { from_user = $from } } -- Dict DB contents -------------------- mysql> select * from imap_user_shares; +------------------------------------------+-------------------------------- --------+-------+ | from_user | to_user | dummy | +------------------------------------------+-------------------------------- --------+-------+ | test.imapsharer01(a)td01.testdomain.it | test.imapuser01(a)td01.testdomain.it | 1 | +------------------------------------------+-------------------------------- --------+-------+ For our tests, we've : - created two users test.imapsharer01(a)td01.testdomain.it test.imapuser01(a)td01.testdomain.it - Created two INBOX subfolders on the sharer01 user, giving user01 those permissions : subfolder01 giving to user01 Full control subfolder02ro giving to user01 list and read - logging as user01 with thunderbird, we see the shared namespace tree : shared test.imapsharer01(a)td01.testdomain.it subfolder01 subfolder02 we're able to see the contents of each folder, even the INBOX . Checking the folder properties, thunderbird reports that the user01 has full control on the INBOX of shared01 . If we try to check the ACL via python script ( imaplib.gestacl ) or via doveadm, we can see that the sharer01 INBOX has no rights for user01 . But via thunderbird ( or other email clients ) we can delete emails . ACL - sharer01 accessing its folder ('OK', [b'INBOX test.imapsharer01(a)td01.testdomain.it lrwstipekxacd']) ('OK', [b'subfolder01 test.imapuser01(a)td01.testdomain.it akxeilprwtscd test.imapsharer01(a)td01.testdomain.it lrwstipekxacd']) ('OK', [b'subfolder02ro test.imapuser01(a)td01.testdomain.it lr test.imapsharer01(a)td01.testdomain.it lrwstipekxacd']) ACL - user01 accessing sharer01 folders ('OK', [b'shared/test.imapsharer01(a)td01.testdomain.it/INBOX']) ('OK', [b'shared/test.imapsharer01(a)td01.testdomain.it/subfolder01 test.imapuser01(a)td01.testdomain.it akxeilprwtscd']) ('OK', [b'shared/test.imapsharer01(a)td01.testdomain.it/subfolder02ro test.imapuser01(a)td01.testdomain.it lr']) Testing with doveadm shows the correct ACL : # doveadm -c /etc/dovecot-backend01/dovecot.conf acl debug -u test.imapuser01(a)td01.testdomain.it shared/test.imapsharer01(a)td01.testdomain.it/INBOX doveadm(test.imapuser01(a)td01.testdomain.it): Info: Mailbox 'INBOX' is in namespace 'shared/test.imapsharer01(a)td01.testdomain.it/' doveadm(test.imapuser01(a)td01.testdomain.it): Info: Mailbox path: /home/vpopmail/domains/td01.testdomain.it/dccm4584.imapsharer01/Maildir doveadm(test.imapuser01(a)td01.testdomain.it): Info: All message flags are shared across users in mailbox doveadm(test.imapuser01(a)td01.testdomain.it): Info: User test.imapuser01(a)td01.testdomain.it has no rights for mailbox doveadm(test.imapuser01(a)td01.testdomain.it): Error: User test.imapuser01(a)td01.testdomain.it is missing 'lookup' right doveadm(test.imapuser01(a)td01.testdomain.it): Info: Mailbox shared/test.imapsharer01(a)td01.testdomain.it/INBOX is NOT visible in LIST # doveadm -c /etc/dovecot-backend01/dovecot.conf acl debug -u test.imapuser01(a)td01.testdomain.it shared/test.imapsharer01(a)td01.testdomain.it/subfolder01 doveadm(test.imapuser01(a)td01.testdomain.it): Info: Mailbox 'subfolder01' is in namespace 'shared/test.imapsharer01(a)td01.testdomain.it/' doveadm(test.imapuser01(a)td01.testdomain.it): Info: Mailbox path: /home/vpopmail/domains/td01.testdomain.it/dccm4584.imapsharer01/Maildir/.sub folder01 doveadm(test.imapuser01(a)td01.testdomain.it): Info: All message flags are shared across users in mailbox doveadm(test.imapuser01(a)td01.testdomain.it): Info: User test.imapuser01(a)td01.testdomain.it has rights: lookup read write write-seen write-deleted insert post expunge create delete admin doveadm(test.imapuser01(a)td01.testdomain.it): Info: Mailbox found from dovecot-acl-list doveadm(test.imapuser01(a)td01.testdomain.it): Info: User test.imapsharer01(a)td01.testdomain.it found from ACL shared dict doveadm(test.imapuser01(a)td01.testdomain.it): Info: Mailbox shared/test.imapsharer01(a)td01.testdomain.it/subfolder01 is visible in LIST # doveadm -c /etc/dovecot-backend01/dovecot.conf acl debug -u test.imapuser01(a)td01.testdomain.it shared/test.imapsharer01(a)td01.testdomain.it/subfolder02ro doveadm(test.imapuser01(a)td01.testdomain.it): Info: Mailbox 'subfolder02ro' is in namespace 'shared/test.imapsharer01(a)td01.testdomain.it/' doveadm(test.imapuser01(a)td01.testdomain.it): Info: Mailbox path: /home/vpopmail/domains/td01.testdomain.it/dccm4584.imapsharer01/Maildir/.sub folder02ro doveadm(test.imapuser01(a)td01.testdomain.it): Info: All message flags are shared across users in mailbox doveadm(test.imapuser01(a)td01.testdomain.it): Info: User test.imapuser01(a)td01.testdomain.it has rights: lookup read doveadm(test.imapuser01(a)td01.testdomain.it): Info: Mailbox found from dovecot-acl-list doveadm(test.imapuser01(a)td01.testdomain.it): Info: User test.imapsharer01(a)td01.testdomain.it found from ACL shared dict doveadm(test.imapuser01(a)td01.testdomain.it): Info: Mailbox shared/test.imapsharer01(a)td01.testdomain.it/subfolder02ro is visible in LIST in the debug log we can see the delete operation : Nov 15 10:53:25 imap(357716 test.imapuser01@td01.testdomain.it):Debug: Mailbox Trash: Mailbox opened Nov 15 10:53:25 imap(357716 test.imapuser01@td01.testdomain.it):Debug: acl vfile: file /home/vpopmail/domains/td01.testdomain.it/dccm4584.imapuser01/Maildir/.Trash /dovecot-acl not found Nov 15 10:53:25 imap(357716 test.imapuser01@td01.testdomain.it):Debug: Mailbox shared/test.imapsharer01(a)td01.testdomain.it: Mailbox opened Nov 15 10:53:25 imap(357716 test.imapuser01@td01.testdomain.it):Debug: Mailbox Trash: Adding field flags to cache for the first time (uid=0) Nov 15 10:53:25 imap(357716 test.imapuser01@td01.testdomain.it):Debug: Mailbox Trash: saving UID 0: Opened mail because: header Message-ID (Cache file is unusable) Nov 15 10:53:25 imap(357716 test.imapuser01@td01.testdomain.it):Debug: Mailbox Trash: Adding field hdr.Message-ID to cache for the first time (uid=0) Nov 15 10:53:25 imap(357716 test.imapuser01@td01.testdomain.it):Debug: Mailbox shared/test.imapsharer01(a)td01.testdomain.it: UID 1: Expunge requested Nov 15 10:53:25 imap(357716 test.imapuser01@td01.testdomain.it):Debug: Mailbox Trash: Purging (new file_seq=1668506005): creating cache Nov 15 10:53:25 imap(357716 test.imapuser01@td01.testdomain.it):Debug: Mailbox Trash: Purging finished, file_seq changed 0 -> 1668506005, size=0 -> 412, max_uid=0 Nov 15 10:53:25 imap(357716 test.imapuser01@td01.testdomain.it):Info: copy from shared/test.imapsharer01(a)td01.testdomain.it: box=Trash, uid=1, msgid=<mnid2m.1.24789225.57389.0.1127444.c495198613._(a)nl.aruba.it> Nov 15 10:53:25 imap(357716 test.imapuser01@td01.testdomain.it):Info: expunge: box=shared/test.imapsharer01(a)td01.testdomain.it, uid=1, msgid=<mnid2m.1.24789225.57389.0.1127444.c495198613._(a)nl.aruba.it> Nov 15 10:53:26 imap(357716 test.imapuser01@td01.testdomain.it):Debug: Mailbox shared/test.imapsharer01(a)td01.testdomain.it: UID 1: Mail expunged After we delete a message, we cannot find it on the Trash folders ( user01 or sharer01 ) . Are we missing something ? Thanks Stefano

1 0

Questions around mailcrypt and LDAP
by Andre Rodier 15 Nov '22

15 Nov '22

Hello, all. I read carefully the messages about mailcrypt on the mailing list, especially this response from Aki: > It's best suited for securing external storage such as NFS or object storage. > There are possibilities to encrypt the key using user's password, but this > takes careful planning. The keys can also come from userdb , e.g. LDAP. I am able to extend the LDAP schema of my OpenLDAP server to store a key into LDAP attribute for each user. In this case, would it be enough for Dovecot to encrypt the messages when they arrive ? Maybe I misunderstand the documentation. Even when using user keys protected by a password, the Dovecot LMTP process should be able to encrypt the emails with user’s public key, without a password, no ? Ideally, I would like to store user's emails encrypted, so each users cannot access other user's emails. I don't need folder sharing. Thanks for your advice. Kind regards, André Rodier

2 2

Dovecot not offering TLSv1.2 after a few minutes
by Markus Wienhöfer 14 Nov '22

14 Nov '22

I have a very strange problem with one of our Dovecot servers (2.2.33.2) on Ubuntu 18.04. The current configuration allows for TLSv1 to TLSv1.3 connections. I can verify those using testssl.sh, the tests will succeed (although correctly mentioning, that TLSv1 and TLSv1.1 should be disabled). Running the tests again after about 5 minutes, the results are different. TLSv1.2 now shows "not offered and downgraded to a weaker protocol". Has anybody experienced a similar problem before? Best regards Markus

2 1

Dovecot 2.3.19.1: BUG: Mailbox renaming algorithm got into a potentially infinite loop, aborting
by Ralf Becker 14 Nov '22

14 Nov '22

I found this from 2019 on the list: https://www.mail-archive.com/dovecot@dovecot.org/msg78898.html Timo mentioned it's tracked internally as DOP-1501, but I could find nothing about it being fixed on the (public) list. Any news about that and is the workaround of deleting dovecot.mailbox.log* and dovecot.list.index* still the recommendation, when running into this bug. Ralf -- Ralf Becker EGroupware GmbH [www.egroupware.org] Handelsregister HRB Kaiserslautern 3587 Geschäftsführer Birgit und Ralf Becker Leibnizstr. 17, 67663 Kaiserslautern, Germany Telefon +49 631 31657-0

2 2

Submission: track authenticated_user
by itanguy＠univ-brest.fr 10 Nov '22

10 Nov '22

Hello, We would like to use Dovecot Submission to have less queues to maintain. The relayhost (Postfix) after Dovecot routes mail by sender_map, so authenticated user, not the "mail from" because . For what we've seen, we can't use receive header to retrieve this authenticated_user. Example of header : Received: from mailhost ([0.0.0.0]) by submission.host with ESMTPSA id submission-id (envelope-from<myadress(a)example.com>) for<myadress(a)example.com>; Thu, 9 Nov 2022 08:27:41 +0000 So we've thought to use X-client, but reading the doc seems that's not the a good way : /https://doc.dovecot.org/settings/core// - submission_relay_trusted If enabled, the relay server is trusted. Determines whether we try to send (Postfix-specific) XCLIENT data to the relay server (only if enabled). But, XCLIENT for Submission seems to not transfer LOGIN : /https://doc.dovecot.org/settings/core/ / XCLIENT command can be used to override: Session ID Client IP and port (|%{rip}|,|%{rport}|) HELO - Overrides what the client sent earlier in the EHLO command LOGIN - Currently unused PROTO - Currently unused |forward_*| fields can be sent to auth process’s passdb lookup The trust is always checked against the connecting IP address. Except if HAProxy is used, then the original client IP address is used. Do you know another way to inform the relayhost of submission of the authenticated_user? Thanks Ismaël TANGUY

2 1

SSL error
by Ruben Safir 10 Nov '22

10 Nov '22

Hello I am getting this error and I have no idea why. openssh is upto date client bash-5.1$ fetchmail --ssl -p POP3 -uruben mail2.boroparkmd.com Enter password for ruben(a)mail2.boroparkmd.com: fetchmail: Server certificate verification error: self signed certificate fetchmail: Missing trust anchor certificate: /C=US/ST=NY/L=Brooklyn/O=Dovecot/OU=mail servuces/CN=*.boroparkmd.com/emailAddress=ruben@mrbrklyn.com fetchmail: This could mean that the root CA's signing certificate is not in the trusted CA certificate location, or that c_rehash needs to be run on the certificate directory. For details, please see the documentation of --sslcertpath and --sslcertfile in the manual page. See README.SSL for details. fetchmail: OpenSSL reported: error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed fetchmail: mail2.boroparkmd.com: SSL connection failed. fetchmail: socket error while fetching from ruben(a)mail2.boroparkmd.com fetchmail: Query status=2 (SOCKET) Server: Nov 9 09:36:13 mail2 dovecot[25838]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:0A000412:SSL routines::sslv3 alert bad certificate: SSL alert number 42 (no auth attempts in 1 secs): user=<>, rip=96.57.23.83, lip=96.57.23.84, TLS handshaking: SSL_accept() failed: error:0A000412:SSL routines::sslv3 alert bad certificate: SSL alert number 42, session=<MBsPlArtPtxgORdT> -- So many immigrant groups have swept through our town that Brooklyn, like Atlantis, reaches mythological proportions in the mind of the world - RI Safir 1998 http://www.mrbrklyn.com DRM is THEFT - We are the STAKEHOLDERS - RI Safir 2002 http://www.nylxs.com - Leadership Development in Free Software http://www2.mrbrklyn.com/resources - Unpublished Archive http://www.coinhangout.com - coins! http://www.brooklyn-living.com Being so tracked is for FARM ANIMALS and extermination camps, but incompatible with living as a free human being. -RI Safir 2013

4 6

Help with configuration?
by Ellie McNeill 10 Nov '22

10 Nov '22

Hi, I'm running my own mail server on Debian 11 with exim and Dovecot 2.3.13. I have it working, but I'm seeking advice on further customising my setup. I'm using the Maildir++ format with some personal folders. I use IMAP to retrieve mail and Dovecot's submission server to send mail. 1. I want to have incoming emails automatically placed in certain folders instead of 'Inbox' based on certain criteria. For example, I want all emails from PayPal to go into the 'PayPal' folder and all emails from the Debian mailing list to go into the 'Debian' folder. Can dovecot do this for me and what is the best approach? 2. When I delete an email using my user client, it is only 'marked' as deleted (Thunderbird places a scored line through it, and a 'T' is added to the filename in the Maildir). How can I get dovecot to automatically move mail marked 'deleted' to the Trash folder each time? I also want further delete operations on any mail in the 'Trash' folder to be permanently deleted. 3. I want to hide my client IP address from the headers when submitting mail to Dovecot's submissiond, but I can't seem to find any way to disable this. I would prefer that recipients only see the server IP address, but not the IP address of the mail client which submitted it. Regards, Ellie PS - When signing up for the mailing list, there was no selection ability on the question "Would you like to get replies to your mails only to the list, ie. add a Reply-To header?"

5 5

Re: SSL error
by Joseph Tam 10 Nov '22

10 Nov '22

Ruben Safir <ruben(a)mrbrklyn.com> wrote: > > This got nothing to with LE or own CA. Bottom line is, you need to > > add your own CA to the cert tore (ideally) > > what is a cert tore? Someone has probably already replied to this, but it's a typo: the OP wanted to say "store". The certificate you created was used to sign itself ("self signed") and thus, asserts its own validity. If you need *other* people to trust your SSL service, you should sign your certificate using a third party authority (e.g. LetsEncrypt) to sign it. Most internet users will have these third party signing authority's certificates in their certificate store to validate your service certificate. If this is for your own personal use (i.e. you don't care about trust since you know it's your own certificate), you have to add your self-signed certificate into *your* system's certificate authority store so that your mail reader does not complain about an untrusted certificate. Clear? Joseph Tam <jtam.home(a)gmail.com>

1 0

doveadm backup|sync works for every folder but INBOX
by Ralf Becker 09 Nov '22

09 Nov '22

I'm trying to migrate an old Cyrus 2.5 server to Dovecot 2.3.19 using doveadm backup -R, which works for all folders but the INBOX itself, which always stays empty. The Cyrus side uses altnamespace:no and unixhierarchysep:no, it's used as imapc: remote in doveadm backup -R with imapc_list_prefix=INBOX Dovecot uses the following namespace to migrate into: namespace inboxes { inbox = yes location = mailbox Sent { auto = subscribe special_use = \Sent } ### some more folders omitted ### prefix = INBOX/ separator = / subscriptions = no } I use the following command line for the migration: doveadm -o imapc_features='rfc822.size fetch-headers' -o mail_prefetch_count=20 -o namespace/subs/location=mbox:/var/dovecot/subs -o imapc_user='someuser' -o imapc_password='secret' -o imapc_host=<cyrus-ip> -o imapc_list_prefix=INBOX -D backup -f -n INBOX/ -R -u someuser@somedomain imapc: The debug output contains the following lines: Nov 02 10:16:01 dsync(someuser@somedomain): Debug: brain S: Namespace INBOX/ has location imapc: Nov 02 10:16:01 dsync(someuser@somedomain): Debug: brain M: Local mailbox tree: INBOX guid=d8d5a3122bce5f63ef9101001ebfc848 uid_validity=1667223083 uid_next=1 subs=no last_change=0 last_subs=0 Nov 02 10:16:01 dsync(someuser@somedomain): Debug: brain S: Local mailbox tree: INBOX guid=c92f64f79f0d1ed01e6d5b314f04886c uid_validity=1577952633 uid_next=32691 subs=no last_change=0 last_subs=0 Nov 02 10:16:28 dsync(someuser@somedomain): Warning: Mailbox changes caused a desync. You may want to run dsync again: Remote lost mailbox GUID c92f64f79f0d1ed01e6d5b314f04886c (maybe it was just deleted?) The Cyrus server is solely used for the migration, no access from anywhere else! doveadm mailbox status -u someuser@somedomain all INBOX reports: INBOX messages=0 recent=0 uidnext=1 uidvalidity=1667223083 unseen=0 highestmodseq=1 vsize=0 guid=d8d5a3122bce5f63ef9101001ebfc848 firstsaved=never As all other folders seem ok, I blamed the failure with the INBOX on the imapc_list_prefix and altnamespace:no and tried, adding the INBOX content with an other doveadm sync run: doveadm -o imapc_features='rfc822.size fetch-headers' -o mail_prefetch_count=20 -o namespace/subs/location=mbox:/var/dovecot/subs -o imapc_user='someuser' -o imapc_password='secret' -o imapc_host=<cyrus-ip> -D sync -1 -f -m INBOX -n INBOX/ -R -u someuser@somedomain imapc: That gives the following output: Nov 02 10:55:45 dsync(someuser@somedomain): Debug: brain S: Namespace INBOX/ has location imapc: Nov 02 10:55:45 dsync(someuser@somedomain): Debug: brain M: Local mailbox tree: INBOX guid=d8d5a3122bce5f63ef9101001ebfc848 uid_validity=1667223083 uid_next=1 subs=no last_change=0 last_subs=0 Nov 02 10:55:45 dsync(someuser@somedomain): Debug: brain S: Local mailbox tree: INBOX guid=c92f64f79f0d1ed01e6d5b314f04886c uid_validity=1577952633 uid_next=32691 subs=no last_change=0 last_subs=0 Nov 02 10:55:45 dsync(someuser@somedomain): Debug: brain M: Remote mailbox tree: INBOX guid=c92f64f79f0d1ed01e6d5b314f04886c uid_validity=1577952633 uid_next=32691 subs=no last_change=0 last_subs=0 Nov 02 10:55:45 dsync(someuser@somedomain): Debug: brain S: Remote mailbox tree: INBOX guid=d8d5a3122bce5f63ef9101001ebfc848 uid_validity=1667223083 uid_next=1 subs=no last_change=0 last_subs=0 Nov 02 10:55:45 dsync(someuser@somedomain): Debug: brain M: Mailbox INBOX: local=d8d5a3122bce5f63ef9101001ebfc848/0/1, remote=c92f64f79f0d1ed01e6d5b314f04886c/0/1: GUIDs conflict - will be merged later Nov 02 10:55:45 dsync(someuser@somedomain): Debug: Mailbox INBOX: Mailbox opened Nov 02 10:55:45 dsync(someuser@somedomain): Debug: brain M: Changing mailbox INBOX GUID d8d5a3122bce5f63ef9101001ebfc848 -> c92f64f79f0d1ed01e6d5b314f04886c Nov 02 10:55:45 dsync(someuser@somedomain): Debug: dict(file): Waiting for dict to finish pending operations Nov 02 10:55:45 dsync(someuser@somedomain): Debug: brain S: Remote mailbox tree deletion: guid=c8882c0029ce5f63a9aa0000ca9feb0b type=mailbox timestamp=1667223081 name= local update=not found Nov 02 10:55:45 dsync(someuser@somedomain): Debug: brain S: Mailbox INBOX: local=c92f64f79f0d1ed01e6d5b314f04886c/0/1, remote=d8d5a3122bce5f63ef9101001ebfc848/0/1: GUIDs conflict - will be merged later Nov 02 10:55:45 dsync(someuser@somedomain): Debug: Mailbox INBOX: Mailbox opened Nov 02 10:55:45 dsync(someuser@somedomain): Debug: brain S: Ignore nonexistent mailbox GUID c92f64f79f0d1ed01e6d5b314f04886c with -1 sync Nov 02 10:55:45 dsync(someuser@somedomain): Debug: brain S: We don't have mailbox c92f64f79f0d1ed01e6d5b314f04886c Nov 02 10:55:45 dsync(someuser@somedomain): Debug: brain M: Ignoring missing remote box GUID c92f64f79f0d1ed01e6d5b314f04886c Nov 02 10:55:45 dsync(someuser@somedomain): Debug: dict(file): Waiting for dict to finish pending operations Nov 02 10:55:45 dsync(someuser@somedomain): Debug: dict(file): dict destroyed Nov 02 10:55:45 dsync(someuser@somedomain): Debug: dict(file): Waiting for dict to finish pending operations Nov 02 10:55:45 dsync(someuser@somedomain): Debug: dict(file): dict destroyed Nov 02 10:55:45 dsync(someuser@somedomain): Debug: imapc(10.44.88.3:143): Disconnected Nov 02 10:55:45 dsync(someuser@somedomain): Debug: User session is finished Nov 02 10:55:45 dsync(someuser@somedomain): Debug: dict(file): dict destroyed Nov 02 10:55:45 dsync(someuser@somedomain): Debug: dict(file): Waiting for dict to finish pending operations Nov 02 10:55:45 dsync(someuser@somedomain): Debug: dict(file): dict destroyed Nov 02 10:55:45 doveadm(40708): Debug: auth-master: conn unix:/run/dovecot/auth-userdb (pid=1,uid=0): Disconnected: Connection closed (fd=9) doveadm mailbox status -u someuser@somedomain all INBOX INBOX messages=0 recent=0 uidnext=1 uidvalidity=1667223083 unseen=0 highestmodseq=1 vsize=0 guid=c92f64f79f0d1ed01e6d5b314f04886c firstsaved=never The interesting part is that INBOX somehow seems to have two different GUIDs, depending on how I sync it (compare the two doveadm mailbox status outputs). In a tcpdump of the IMAP trafic I can see a STATUS "INBOX" (UIDNEXT UIDVALIDITY) but no EXAMINE "INBOX" or something else I would expect from the sync. I can provide the full output of doveadm backup/sync and a pcap of the IMAP trafic, but not to the public list. Any idea what's wrong with the sync of the INBOX or other suggestions / imapc parameters to use? Ralf -- Ralf Becker EGroupware GmbH [www.egroupware.org] Handelsregister HRB Kaiserslautern 3587 Geschäftsführer Birgit und Ralf Becker Leibnizstr. 17, 67663 Kaiserslautern, Germany Telefon +49 631 31657-0

3 17

"Mailbox isn't a valid MBOX file" Error
by Elise 06 Nov '22

06 Nov '22

Running currently two local mailclients: Outlook 2021 and Thunderbird 102.4.2 When using TB and remove a message on my main account, I get this error: [CANNOT] Mailbox isn't a valid mailbox On any other TB configured email accounts I can remove messages without any problems. First I thought that Outlook might block removal on messages, but the issue appears as well if I close that mail client. Can you tell what is causing this problem? Best regards, Jos Chrispijn

5 4

Any update on lazy load SNI?
by Pierre Allétru 03 Nov '22

03 Nov '22

Hi folks, We need to use SNI with Dovecot at a relatively large scale and I was wondering if there's any update on the ability to: 1 - Lazy load SNI certificates when they are needed instead of loading them all at once during startup/reload, thus taking a lot of memory and being very slow. 2 - Not having to reload Dovecot every time a new domain cert is added in conf. 3 - Or at least have Dovecot keep processing clients while the slow reload happens. This has been asked already in a 2016 thread: https://www.dovecot.org/pipermail/dovecot/2016-November/106075.html. Regarding point 3 there's a reply from Aki saying it was in the internal tasklist ( https://www.dovecot.org/pipermail/dovecot/2016-November/106089.html) Anybody knows if some progress has been made on these subjects? I can't anything in the docs or any recent information anywhere else. Thanks, -- Pierre Allétru 06 70 55 08 35 pierre.alletru(a)gmail.com

2 2

how to limit a global disk quota
by linuxguy＠gmx.net 03 Nov '22

03 Nov '22

1 0

The end of Dovecot Director?
by Steff Majeur 02 Nov '22

02 Nov '22

I recently stumbled upon the following commit on the Dovecot core Github repository: https://github.com/dovecot/core/commit/4a187116dc2311804be22724007d35732300… Apparently, Dovecot Director is going to be removed in the next major version of Dovecot and the commercial Dovecot cluster architecture will be its successor: https://github.com/dovecot/documentation/blob/a85b742ec4fc2744db30a6943b3c2… This would be a huge blow for many organizations around the world that are currently using Dovecot with Director in a shared storage environment. Can anyone of the Dovecot developers maybe enlighten us about the future of Dovecot? - Will there still be the Director feature in the next community release of Dovecot? - If not, will there be a community feature that is on par with the current Director feature? - For how long will Dovecot version 2.3 still be supported (security fixes, bug fixes)? Is there any EOL plan? Thanks for any clarification! Steff

31 56

Dovecot does not start on MacOS Monterey
by Doro Rose 30 Oct '22

30 Oct '22

Hi, this is a duplicate of the "Dovecot does not start on MacOS Monterey 12.01" thread. I’m still seeing this on dovecot 2.3.19.1. Is there a recommended workaround? The last post in that thread indicated that some modifications in `./src/lib/restrict-process-size.c` might be necessary. Best regards Doro

3 6

how to configure imapsieve to be used per user
by Marc 29 Oct '22

29 Oct '22

I only see configurations that are active for all users, how to configure this in the user sieve rules. I only need this for specific users.

7 11

oauth2 + postgres = Panic: file http-client.c: line 646 (http_client_context_close)
by Sebastiano Degan 27 Oct '22

27 Oct '22

I could to reply to the original thread: https://www.mail-archive.com/dovecot@dovecot.org/msg85204.html But I managed to get a stack trace of the error: root@mail:~ # lldb /usr/local/libexec/dovecot/auth (lldb) target create "/usr/local/libexec/dovecot/auth" Current executable set to '/usr/local/libexec/dovecot/auth' (x86_64). (lldb) run Process 54354 launched: '/usr/local/libexec/dovecot/auth' (x86_64) Error: stats: open(old-stats-user) failed: No such file or directory Panic: file http-client.c: line 646 (http_client_context_close): assertion failed: (cctx->clients_list == NULL) Process 54354 stopped * thread #1, name = 'auth', stop reason = signal SIGABRT frame #0: 0x000000080159f33a libc.so.7`__sys_thr_kill + 10 libc.so.7`__sys_thr_kill: -> 0x80159f33a <+10>: jb 0x80159d498 0x80159f340 <+16>: retq 0x80159f341: int3 0x80159f342: int3 (lldb) bt all * thread #1, name = 'auth', stop reason = signal SIGABRT * frame #0: 0x000000080159f33a libc.so.7`__sys_thr_kill + 10 frame #1: 0x0000000801517c74 libc.so.7`__raise + 52 frame #2: 0x00000008015c9109 libc.so.7`abort + 73 frame #3: 0x00000008012e606b libdovecot.so.0`default_fatal_finish(type=LOG_TYPE_PANIC, status=0) at failures.c:465:3 frame #4: 0x00000008012e3f7c libdovecot.so.0`fatal_handler_real(ctx=0x00007fffffffe610, format="file %s: line %d (%s): assertion failed: (%s)", args=0x00007fffffffe5f0) at failures.c:477:2 frame #5: 0x00000008012e3f14 libdovecot.so.0`default_fatal_handler(ctx=0x00007fffffffe610, format="file %s: line %d (%s): assertion failed: (%s)", args=0x00007fffffffe5f0) at failures.c:485:2 frame #6: 0x00000008012e4253 libdovecot.so.0`i_panic(format="file %s: line %d (%s): assertion failed: (%s)") at failures.c:530:2 frame #7: 0x000000080124f2ed libdovecot.so.0`http_client_context_close(cctx=0x000000080205c048) at http-client.c:646:2 frame #8: 0x000000080124ef22 libdovecot.so.0`http_client_global_context_ioloop_switched(prev_ioloop=0x0000000802030640) at http-client.c:710:3 frame #9: 0x00000008013102e4 libdovecot.so.0`io_loop_set_current(ioloop=0x0000000000000000) at ioloop.c:982:4 frame #10: 0x00000000010aa0be auth`driver_pgsql_set_state(db=0x0000000802092200, state=SQL_DB_STATE_IDLE) at driver-pgsql.c:103:3 frame #11: 0x00000000010a9ff0 auth`connect_callback(db=0x0000000802092200) at driver-pgsql.c:206:3 frame #12: 0x000000080130f3b2 libdovecot.so.0`io_loop_call_io(io=0x00000008020105c0) at ioloop.c:737:2 frame #13: 0x0000000801313e0b libdovecot.so.0`io_loop_handler_run_internal(ioloop=0x0000000802030640) at ioloop-kqueue.c:164:4 frame #14: 0x000000080130fa15 libdovecot.so.0`io_loop_handler_run(ioloop=0x0000000802030640) at ioloop.c:789:2 frame #15: 0x000000080130f8fa libdovecot.so.0`io_loop_run(ioloop=0x0000000802030640) at ioloop.c:762:3 frame #16: 0x00000000010a7eef auth`driver_pgsql_wait(_db=0x0000000802092200) at driver-pgsql.c:1279:3 frame #17: 0x00000000010a4c59 auth`sql_wait(db=0x0000000802092200) at sql-api.c:820:3 frame #18: 0x00000000010a7fc0 auth`driver_pgsql_get_flags(db=0x0000000802092200) at driver-pgsql.c:306:3 frame #19: 0x00000000010a2fa9 auth`sql_get_flags(db=0x0000000802092200) at sql-api.c:171:10 frame #20: 0x00000000010a585e auth`driver_sqlpool_get_flags(_db=0x0000000802092000) at driver-sqlpool.c:450:9 frame #21: 0x00000000010a2fa9 auth`sql_get_flags(db=0x0000000802092000) at sql-api.c:171:10 frame #22: 0x000000000108c675 auth`passdb_sql_init(_module=0x0000000802041ca8) at passdb-sql.c:281:10 frame #23: 0x000000000107d577 auth`passdb_init(passdb=0x0000000802041ca8) at passdb.c:247:3 frame #24: 0x0000000001052a89 auth`auth_passdb_init(passdb=0x0000000802041ba8) at auth.c:308:2 frame #25: 0x0000000001051dbc auth`auth_init(auth=0x0000000802041b70) at auth.c:322:3 frame #26: 0x0000000001051d21 auth`auths_init at auth.c:427:3 frame #27: 0x0000000001050610 auth`main_init at main.c:242:2 frame #28: 0x00000000010503ad auth`main(argc=1, argv=0x00007fffffffeaf8) at main.c:391:2 frame #29: 0x000000000104ff7d auth`_start(ap=<unavailable>, cleanup=<unavailable>) at crt1_c.c:75:7

1 0

Mailing list IMAP archive.
by dovecot＠ptld.com 27 Oct '22

27 Oct '22

I am trying to use the IMAP mailing list archive described on https://www.dovecot.org/mailing-lists/ Is this feature still functioning? Using Thunderbird i get an error message that the connection was refused. I don't know if Thunderbird isn't functioning properly (with handling no password) or if the service is down. My end goal is i want to search the archive for solutions before asking the list. Is there a browser based option to search the archives? I didn't see a search option on https://dovecot.org/pipermail/dovecot/

3 3

Re: The end of Dovecot Director?
by William Edwards 27 Oct '22

27 Oct '22

> Op 27 okt. 2022 om 04:25 heeft Timo Sirainen <timo(a)sirainen.com> het volgende geschreven: > > Director never worked especially well, and for most use cases it's just unnecessarily complex. I think usually it could be replaced with: > > * Database (sql/ldap/whatever) containing user -> backend table. > * Configure Dovecot proxy to use this database as passdb. > * For HA change dovemon to update the database if backend is down to move users elsewhere > * When backend comes up, move users into it. Set delay_until extra field for user in passdb to 5 seconds into future and kick the user in its old backend (e.g. via doveadm HTTP API). > > All this can be done with existing Dovecot. Should be much easier to build a project doing this than forking director. This is my train of thought as well. I believe the following would suffice for most setups. A database with: - Current vhost count per backend server. Alternatively, count the temporary user mappings. - Backend servers. - Temporary user mappings between user - backend server. This database is accessible by all Dovecot proxies in case there’s multiple. Steps when receiving a login: - Check if a temporary user mapping exists. - If so, proxy to the backend server in the temporary mapping. (To do: clean up mappings.) - If not, pick the backend server with the lowest vhost count, create a temporary mapping, then increase the vhost count of the chosen backend server. A monitoring service up/downs backend servers. E.g. by checking the port that we proxy to for each backend server. When a backend server is set to down, kick the user to force a reconnection. (Is that how Director ‘moves’ users?)

2 2

Catch all for Metadata storage in SQL database
by Steffen Kaiser 27 Oct '22

27 Oct '22

Hi, the https://doc.dovecot.org/configuration_manual/imap_metadata/ sample uses mail_attribute_dict = file:%h/Maildir/dovecot-attributes which stores all keys=value pairs in the file. http://dovecot.2317879.n4.nabble.com/Dovecot-v2-3-9-3-HTTP-API-Endpoint-for… uses a SQL dict, however very specific ones. How can I use a SQL dict to store _all_ keys, as with a file based storage? I cannot find a documentation for "pattern" specification, that works as "catch all", in order to store anything not catched by patterns into the database. https://wiki.dovecot.org/Dictionary does not give any hint (in my eyes). -- Steffen Kaiser

3 4

Dynamically set LDAP user namespace using two attributes
by Thomas Leuxner 26 Oct '22

26 Oct '22

Hi, I’m looking for a way to use two LDAP attributes to create a user-specific namespace to be expunged e.g. mailExpungeTrash=namespace/inbox/mailbox/%{ldap:mailTrashMailbox}/autoexpunge I can create the namespace fine returning the full string to be expunged: mailExpungeTrash=namespace/inbox/mailbox/Deleted\_Messages/autoexpunge However I want to alter the namespace using a second LDAP attribute like: mailExpungeTrash=namespace/inbox/mailbox/%{ldap:mailTrashMailbox}/autoexpunge Regards Thomas

1 0

Re: ot: how to t/s TBird problems ?
by Joseph Tam 26 Oct '22

26 Oct '22

Voytek Eymont) wrote: > yesterday it was > --------------- > I'm still experiencing a 40 second delay to retrieve emails for > xxx If *this* is the problem you saw (and not the 2 hour delay mentioned further in the thread), you can get a hint where the problem lies if you see a 40s gap in the session logs: it will tell you who was doing what when the pause happened (e.g. during authentication? During LIST fetch? During message fetch?) For example, if dovecot was busy mulching through a large INBOX rebuilding indices, I can see how it can chew up 40s under some circumstances. Joseph Tam <jtam.home(a)gmail.com>

2 1

how to clean virtual users correctly
by Henry R 26 Oct '22

26 Oct '22

Hello I removed the user in static userdb file, and deleted /var/mail/vhosts/$domain/$user dir. when I recreated the user, the system dirs (sent, draft etc) disappeared. Anything wrong here? Thank you. -- Henry R https://openmbox.net/

2 1

Re: ot: how to t/s TBird problems ?
by Joseph Tam 23 Oct '22

23 Oct '22

Voytek Eymont writes: > I've enabled logging as per your suggestion: > > -rw------- 1 vmail vmail 127 Oct 16 21:38 20221016-213738.25640.1.in > -rw------- 1 vmail vmail 8546603 Oct 16 21:38 20221016-213738.25640.1.out > -rw------- 1 vmail vmail 96 Oct 16 21:58 20221016-215757.26075.1.in > -rw------- 1 vmail vmail 8343463 Oct 16 21:58 20221016-215757.26075.1.out > > # cat 20221016-213738.25640.1.in > 1665916659.491025 STAT > 1665916659.550829 LIST > 1665916676.430794 UIDL > 1665916693.761281 RETR 114437 > 1665916694.440965 QUIT > # cat 20221016-215757.26075.1.in > 1665917878.786953 STAT > 1665917878.863136 LIST > 1665917905.610805 UIDL > 1665917924.491198 QUIT > # > > what should I look in the .out file ? > > some of the file is like: > .... > 1665916661.234807 114436 70097 > 1665916661.234814 114437 154498 > 1665916661.234821 . > 1665916676.430870 +OK > 1665916676.981415 1 000024b95283283a > 1665916676.981459 2 000024ba5283283a > .... > > 1665916679.434297 114436 00033fcf5283283a > 1665916679.434327 114437 00033fd05283283a > 1665916679.434349 . > 1665916694.048139 +OK 154498 octets > 1665916694.048199 Return-Path: <buyer-notice14.g(a)mail.aliexpress.com> > .... I haven't seen anyone else replying, but there doesn't seem anything anomalous with the output. The session commands-repliesd is is more or less what I expect, although to make sense of this, you'll have to splice the input and output files together using timestamps to see the sequential flow of data. I forget what the symptoms you originally reported, but theoretically, you could simulate either client or server by feeding in the above data and see how the other end behaves. If dovecot is serving out the correct data, then TB is somehow misinterpreting it. > on an uneducated guess, the mailbox is just 'too large' ? > POP has difficulty handling so many files ? Typically, if some resource limit is hit, one side or the other will create a log or notification. Your INBOX is large, but not outrageous. You can test it directly by creating smaller subsets of the INBOX messages and see if the problem goes away. Joseph Tam <jtam.home(a)gmail.com>

5 4

Office 365 SSL issue
by Ervin Hegedüs 23 Oct '22

23 Oct '22

Hi there, I have a bit old Dovecot instance (Ubuntu 14.04 - there is no chance to upgrade it), with these versions of packages: * Dovecot: 2.2.9 * OpenSSL: 1.0.1f Few days ago a client noticed me, that he can't reach his mails through his Office 365. He uses POP3S. I tried to set up a same client for this Dovecot server, but when I configured the POP3 protocoll, after the settings check Office says: Your server does not support the connection encryption type you have specified. Try changing the encryption method. Contact your mail server ... While the client was trying, I see these lines in the log: Oct 21 16:12:18 mail dovecot: pop3-login: Debug: SSL: where=0x10, ret=1: before/accept initialization [192.168.8.133] Oct 21 16:12:18 mail dovecot: pop3-login: Debug: SSL: where=0x2001, ret=1: before/accept initialization [192.168.8.133] Oct 21 16:12:18 mail dovecot: pop3-login: Debug: SSL: where=0x2001, ret=1: SSLv3 read client hello A [192.168.8.133] Oct 21 16:12:18 mail dovecot: pop3-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write server hello A [192.168.8.133] Oct 21 16:12:18 mail dovecot: pop3-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write certificate A [192.168.8.133] Oct 21 16:12:18 mail dovecot: pop3-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write key exchange A [192.168.8.133] Oct 21 16:12:18 mail dovecot: pop3-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write server done A [192.168.8.133] Oct 21 16:12:18 mail dovecot: pop3-login: Debug: SSL: where=0x2001, ret=1: SSLv3 flush data [192.168.8.133] Oct 21 16:12:18 mail dovecot: pop3-login: Debug: SSL: where=0x2002, ret=-1: SSLv3 read client certificate A [192.168.8.133] Oct 21 16:12:18 mail dovecot: pop3-login: Debug: SSL: where=0x2002, ret=-1: SSLv3 read client certificate A [192.168.8.133] Oct 21 16:12:18 mail dovecot: pop3-login: Warning: SSL failed: where=0x2002: SSLv3 read client certificate A [192.168.8.133] Oct 21 16:12:18 mail dovecot: pop3-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=192.168.8.133, lip=192.168.8.21, TLS handshaking: Disconnected, session=<9sWMB4zr+ADAqAiF> Which is weird, because I disabled SSLv3. Here is the (relevant) config: ssl_cert = </etc/dovecot/dovecot.crt ssl_key = </etc/dovecot/dovecot.key ssl_dh_parameters_length = 2048 ssl_protocols = !SSLv2 !SSLv3 ssl_cipher_list = ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA verbose_ssl = yes When I check the supported encryption type with nmap, I get this: $ nmap --script ssl-enum-ciphers -p 995 192.168.8.21 Starting Nmap 7.80 ( https://nmap.org ) at 2022-10-22 10:20 CEST Nmap scan report for 192.168.8.21 Host is up (0.021s latency). PORT STATE SERVICE 995/tcp open pop3s | ssl-enum-ciphers: | TLSv1.0: | ciphers: | TLS_DHE_RSA_WITH_AES_128_CBC_SHA (dh 2048) - A | ... | TLSv1.1: | ciphers: | TLS_DHE_RSA_WITH_AES_128_CBC_SHA (dh 2048) - A | ... | TLSv1.2: | ciphers: | TLS_DHE_RSA_WITH_AES_128_CBC_SHA (dh 2048) - A | ,,, |_ least strength: C When I check the traffic with tcpdump, I see that client uses TLSv1.2: https://www.dropbox.com/s/k8wqzg5xzki5p23/pop3_traffic.png Only the one client who reported the problem, and my test client can't reach the server - other (about) 400 users can (but I don't know with what kind of types of clients - most use Thunderbird). What can I do? How can I fix this problem? As I wrote, this problem has came few days ago suddenly... Thanks, a.

4 5

Change password schema and post-login script
by Christos Chatzaras 23 Oct '22

23 Oct '22

Hello, Question #1: For version 2.3.19.1 these commands use BLF-CRYPT, right? doveadm pw doveadm pw -s CRYPT Question #2: I want to change password schema for current users. For users using POP3 or IMAP I can do it using a post-login script. I have some accounts used only to send e-mails using Postfix, so no POP3/IMAP logins for these accounts. Is any way to change password schema for these accounts? My config: # 2.3.19.1 (9b53102964): /usr/local/etc/dovecot/dovecot.conf # Pigeonhole version 0.5.19 (4eae2f79) # OS: FreeBSD 13.1-RELEASE-p2 amd64 zfs # Hostname: server2.example.com auth_master_user_separator = * auth_mechanisms = plain login auth_verbose = yes default_process_limit = 225 disable_plaintext_auth = no first_valid_gid = 0 first_valid_uid = 1001 mail_location = maildir:/home/mail/%d/%n:INDEX=/tmpfs/dovecot_%u:CONTROL=/var/mail/%d/%n mail_privileged_group = mail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext imapsieve vnd.dovecot.imapsieve namespace inbox { inbox = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk { auto = subscribe special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Messages" { auto = no special_use = \Sent } mailbox Trash { auto = subscribe special_use = \Trash } prefix = } passdb { args = /usr/local/etc/dovecot/passwd.master driver = passwd-file master = yes result_success = continue } passdb { args = /usr/local/etc/dovecot/passwd.suspended deny = yes driver = passwd-file } passdb { args = /usr/local/etc/dovecot/passwd driver = passwd-file } plugin { imapsieve_mailbox1_before = file:/usr/local/lib/dovecot/sieve/report-spam.sieve imapsieve_mailbox1_causes = COPY imapsieve_mailbox1_name = Junk imapsieve_mailbox2_before = file:/usr/local/lib/dovecot/sieve/report-ham.sieve imapsieve_mailbox2_causes = COPY imapsieve_mailbox2_from = Junk imapsieve_mailbox2_name = * quota = maildir:User quota quota_max_mail_size = 100M quota_rule = *:storage=2048M quota_status_nouser = DUNNO quota_status_overquota = 552 5.2.2 Mailbox is full quota_status_success = DUNNO quota_warning = storage=80%% quota-warning 80 %u sieve = file:~/sieve;active=~/sieve.active sieve_before = /usr/local/lib/dovecot/sieve/antispam.sieve sieve_global_extensions = +vnd.dovecot.pipe sieve_pipe_bin_dir = /usr/local/lib/dovecot/sieve sieve_plugins = sieve_imapsieve sieve_extprograms } protocols = imap pop3 lmtp sieve service auth { client_limit = 1125 unix_listener auth-client { group = postfix mode = 0660 user = postfix } } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } service managesieve-login { inet_listener sieve { address = 127.0.0.1 port = 4190 } } service quota-status { client_limit = 1 executable = quota-status -p postfix inet_listener { port = 12340 } } service quota-warning { executable = script /root/cretapanel/quota-warning.sh unix_listener quota-warning { mode = 0666 user = dovecot } } ssl_cert = </etc/ssl/certs/mail.pem ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it ssl_min_protocol = TLSv1.2 userdb { args = /usr/local/etc/dovecot/passwd driver = passwd-file } verbose_proctitle = yes protocol imap { imap_client_workarounds = delay-newmail tb-extra-mailbox-sep mail_max_userip_connections = 20 mail_plugins = quota imap_quota imap_sieve imap_zlib } protocol pop3 { mail_plugins = quota pop3_client_workarounds = outlook-no-nuls oe-ns-eoh pop3_uidl_format = %08Xu%08Xv } protocol lda { postmaster_address = postmaster(a)example.com sendmail_path = /usr/sbin/sendmail } protocol lmtp { mail_plugins = quota sieve postmaster_address = postmaster(a)example.com }

3 2

dovecot mailing list (this mailing list), DKIM, SPF and DMARC
by Lev Serebryakov 22 Oct '22

22 Oct '22

My domain (serebrtyajov.spb.ru) has all these "new" e-mail technologies configured. It works fine till I write to this mailing list. After that I've got several DMARC reports about "spam" from my domain. All these reports are about my mailing list post. I don't have such problems with other mailing lists (FreeBSD ones, OpenJDK ones, and others). Looks like mailing list software for this mailing list is misconfigured. I'm sure, I'll get new after this message. -- // Black Lion AKA Lev Serebryakov

15 38

lmtp userdb can't resolve users
by George Asenov 21 Oct '22

21 Oct '22

Hello, I use postfix with dovecot as an lmtp LDA with unix users and multiple domain names and mailboxes in Maildir format placed in domain directory like: /home/mainuser/homes/user(a)domain.tld/Maildir or /home/mainuser/domains/domain2.tld/homes/user(a)domain2.tld/Maildir which have the main user as a group and user@domain.tld/user@domain2.tld as owner Postfix have virtual_alias_maps = hash:/etc/postfix/virtual there in virtual file there is map like: user(a)domain.tld user-domain(a)domain.tld and in /etc/passwd there are actually 2 users with the same home dir and same UID/GID (only the username is different) and in postfix mailbox_transport = lmtp:unix:private/dovecot-lmtp The issue is that when postfix passes the email for local delivery to dovecot lmtp it sends the username as user-domain.tld(a)serverhostname.tld but dovecot is configured with !include auth-system.conf.ext can't resolve this username thus fails to deliver. I've found a workaround in the net to use custom userdb just for lmtp like this: protocol lmtp { mail_plugins = $mail_plugins sieve userdb { driver = passwd-file args = username_format=%n /etc/passwd } } which works but produce some warnings because there is the root user (ID 0) and actually is a dirty workaround Is there more elegant solution??

2 1