- dovecot - dovecot.org

Dovecot with LDAP Proxy
by Federico Bartolucci 21 May '19

21 May '19

Hello, configuring Dovecot with LDAP authentication, adding the parameter in ther sql config file: pass_attrs = \ =proxy=y I see then backend connections always addressed to localhot port 143: /user=utente1(a)domanin.com proxy lip=127.0.0.1 lport=143 / while I expect that connections would be managed by the director and then addressed to my backend IPs and specific port. Is there a way to configure ldap proxy to get that behavior? Thanks in advance. -federico

2 3

Dovecot documentation
by ＠lbutlr 21 May '19

21 May '19

the make config options for dovecot on FreeBSD list list [x] ICU Use libicu for FTS unicode normalization but https://wiki2.dovecot.org/Plugins/FTS makes no mention of libicu (nor of icu at all). is linicu simply in addition to the four options of Solar, Lucene, fts-xapian, and fts-dovecot? Also, the link to fts-dovecot goes to https://wiki2.dovecot.org/Plugins/FTS/Dovecot which is a 404. -- Man is born free, but is everywhere in chains.

1 0

[mail-crypt-plugin] How to decrypt mailbox?
by emordin 21 May '19

21 May '19

Hi, So I am able to encrypt email using the crypt plugin, but when I try to access the email by logging in thru mutt or roundcube the email is still encrypted. Is the decryption process automatic or do I have to create a custom program with the decrypt.rb code? Thanks. Sent with [ProtonMail](https://protonmail.com) Secure Email.

2 1

Further issues on FTS engine
by Joan Moreau 20 May '19

20 May '19

Hi, Additionally to the long list of problem on the FTS previously discussed, here a new: WHen I reset the indexes, the indexer-worker seems paralelleizing the indexing (which is good), however, the number available in "ps aux | grep dove" shows that it does not move: dovecot 28549 0.0 0.0 8620 3920 ? S 06:20 0:00 dovecot/indexer [0 clients, 3 requests] mailuse+ 28550 98.6 0.1 167412 86916 ? R 06:20 5:28 dovecot/indexer-worker [jom(a)grosjo.net XXXX - 800/37755] Looking further, if I put a tracer in teh backend, it treats the *same* message several times in parallel, and therefore does not move very fast on the global indexing of the box ANy clue ? THanks

2 1

enforcing multiple per-mailbox quotas for shared mailboxes
by Jost-Philip Matysik 20 May '19

20 May '19

Hi! I'm trying to get quotas for shared mailboxes set up on my server. It's not working, and I fail to understand why. Documentation for setup of this complexity is rather scarce on the web, and the discussions I found either don't directly apply or terminate with "I got it working" but no explanation. Can someone please help? The setup is rather lengthy and complicated, so I'll try to give a summary first for easier understanding. All help is appreciated! Please respond if you need more info! Thanks! Best regards, Jost Basic setup (where am I coming from?): ====================================== - This is a Debian 9 system with a more recent version of dovecot installed from https://repo.dovecot.org/ce-2.3-latest/debian/stretch - users have individual mailboxes with individual quotas -- this works great! - users can share mailboxes with other users through ACLs. To achieve this, there exists a wildcarded namespace with prefix="ZZZ_Freigaben/%%u" --this also works great! ==> up to here it's pretty much following the examples from the Wiki to the letter. Configuration goal (what do I want to achieve?): ================================================ - attach quotas to mailboxes, not logins - when copying/moving mails across shared mailboxes during imap sessions, enforce quota based on target mailbox, not logged-in user doing the copying. To clarify: ==> so if Bob has a quota of 500MB, all messages in Bob's mailbox should count against (and only against!) Bob's quota, regardless of who put them there. ==> if Alice has access to her own mailbox (directly), as well as Bob's mailbox and Dave's mailbox (through sharing), she should see 3 individual quotas when logging in: her own quota (200MB) for everything in her mailbox, bob's quota (300MB) for everything in Bob's mailbox, and Dave's quota (10GB) for everything in Dave's mailbox. These 3 quotas should be completely independant and neither block, nor override each other. Setup Idea (how I tried to get there): ====================================== - "quota=..." "quota_rule" and "quota_rule2" always refer to the user's own mailbox (with an additional rule for Trash). Everyone has those, so these are loaded statically from dovecot config file. - "quota_rule" is overwritten from userdb with the user's individual mailbox quota (the more I like you, the more space you get...) - since the number of different additional quotas required per user depends on how many mailboxes are shared with that user, individual "quota2=...", "quota3=...", "quotaN=..." fields are dynamically generated by the MySQL backend and loaded from userdb upon login. - consequently, for each "quotaN=..." entry, a corresponding "quotaN_rule=*:storage=XXX" is generated and returned from userdb (substitute N=1,2,3,4,... accordingly) Observations: ============= 1. enforcing quota for the user's personal mailbox works as expected, both through IMAP and when delivering incoming mail 2. overriding "quota_rule=..." from userdb for the user's personal mailbox works great. Individual quota is recognized and enforced both through IMAP and when delivering incoming mail. 3. dynamically loading "quota2=...", "quota3=..." etc. from userdb doesn't seem to work at all! I can see them being added as extra fields in the logs upon user login, but the quota-plugin seems to completely ignore them. They are not enforces, and tools like 'doveadm quota' list the userdb fields in the debug messages, but do not interpret them in any way. They do not throw errors either, the additional quota roots are just silently ignored. 4. the end result is that in an IMAP session the logged-in user's quota is enforced for their individual mailbox, but as soon as they write to someone else's mailbox (move a mail to /ZZZFreigaben/bob/Some-Subfolder), no quota is enforced at all! Additional debugging done: ========================== if I hardcode a "quota2=" and/or "quota3=" in the config file, I can observe the following: - If I hardcode "quota2=count:some_name:ns=ZZZ_Freigaben/", dovecot and doveadm will recognize the additional quota root. But since the folder "ZZZ_Freigaben/" on its own isn't a mailbox (it's just a path CONTAINING mailboxes), the quota is neither displayed in clients, nor enforced. It has no real-word effect, other than 'doveadm quota' showing an additional line. - If I hardcode "quota2=count:other_name:ns=ZZZ_Freigaben/postmaster/" in the config file (with that path being the real IMAP path to a shared mailbox), dovecot will complain in the log saying Error: quota: Unknown namespace: ZZZ_Freigaben/postmaster/ dovecot will start and work for the most part, but again completely ignore settings for the additional quota. - additionally, trying to override "quota2_rule=..." from userdb doesn't work as it does with "quota_rule=..."! If I have both "quota_rule=..." and "quota2_rule=..." in the config file as well as returned from userdb (with different values), dovecot will use "quota_rule" from userdb, but "quota2_rule" from config file. This behavior seems inconsistent! - I tried both maildir and count backends (seperately or mixed). Both show the same behavior. - I tried appending or removing an empty "ns=" to the first "quota=..." entry (the wiki shows some examples with it, some without). Makes no difference... Configuration Dumps below (slightly redacted to remove complete email addresses or IPs) ========================== output of dovecot -n: # 2.3.6 (7eab80676): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.6 (92dc263a) # OS: Linux 4.9.0-9-amd64 x86_64 Debian 9.9 # Hostname: [censored] auth_failure_delay = 10 secs auth_mechanisms = plain login default_vsz_limit = 512 M dict { acl = mysql:/etc/dovecot/dovecot-dict-sql.conf.ext } listen = * lmtp_rcpt_check_quota = yes login_greeting = Mail system ready. mail_gid = vmail mail_location = maildir:~/Maildir mail_plugins = " quota acl" mail_uid = vmail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext imapsieve vnd.dovecot.imapsieve namespace Freigaben { list = children location = maildir:%%h/Maildir:INDEXPVT=%h/Maildir/Freigaben/%%u prefix = ZZZ_Freigaben/%%u/ separator = / subscriptions = no type = shared } namespace inbox { inbox = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk { auto = subscribe autoexpunge = 61 days special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { auto = subscribe autoexpunge = 61 days special_use = \Trash } prefix = separator = / subscriptions = yes type = private } passdb { args = /etc/dovecot/dovecot-sql.conf.username driver = sql } plugin { acl = vfile:/etc/dovecot/dovecot-acl acl_defaults_from_inbox = yes acl_shared_dict = proxy::acl imapsieve_mailbox1_before = file:/etc/dovecot/sieve/learn-spam.sieve imapsieve_mailbox1_causes = COPY imapsieve_mailbox1_name = Junk imapsieve_mailbox2_before = file:/etc/dovecot/sieve/learn-ham.sieve imapsieve_mailbox2_causes = COPY imapsieve_mailbox2_from = Junk imapsieve_mailbox2_name = * quota = count:User quota:ns= quota_grace = 1%% quota_rule = *:storage=5G quota_rule2 = Trash:storage=+100M quota_status_nouser = DUNNO quota_status_overquota = 552 5.2.2 Mailbox is full quota_status_success = DUNNO quota_vsizes = yes sieve = file:~/sieve;active=~/.dovecot.sieve sieve_after = /etc/dovecot/sieve-after sieve_global_extensions = +vnd.dovecot.pipe +vnd.dovecot.environment sieve_max_script_size = 10M sieve_pipe_bin_dir = /etc/dovecot/sieve sieve_plugins = sieve_imapsieve sieve_extprograms sieve_quota_max_storage = 50M } postmaster_address = postmaster(a)matysik-ingenieurwesen.de protocols = " imap lmtp sieve" service auth-worker { user = vmail } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } unix_listener auth-userdb { mode = 0666 } } service dict { unix_listener dict { group = vmail mode = 0660 user = dovecot } } service imap-login { inet_listener imap { port = 0 } inet_listener imaps { address = [censored] port = 993 ssl = yes } } service imap { process_limit = 1024 } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } service managesieve-login { inet_listener sieve { address = [censored] port = 4190 } service_count = 1 } service managesieve { process_limit = 64 } ssl_cert = </etc/letsencrypt/live/fullchain.pem ssl_cipher_list = ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!MD5:!DSS ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it ssl_min_protocol = TLSv1.2 ssl_options = no_compression ssl_prefer_server_ciphers = yes # comment: since imap logins differ from email-addresses I have 2 # userdb queries. One will return fields for %u='login', the other will # return fields for %u='email(a)domain.tld'. # no %u will ever make BOTH userdbs return rows (they are mutually exclusive) userdb { args = /etc/dovecot/dovecot-sql.conf.email driver = sql } userdb { args = /etc/dovecot/dovecot-sql.conf.username driver = sql } protocol lmtp { mail_plugins = " quota acl sieve" } protocol imap { mail_plugins = " quota acl imap_sieve imap_quota imap_acl" } example userdb output: ======================= root@server:/# doveadm -Dv user jost Debug: Loading modules from directory: /usr/lib/dovecot/modules Debug: Module loaded: /usr/lib/dovecot/modules/lib01_acl_plugin.so Debug: Module loaded: /usr/lib/dovecot/modules/lib10_quota_plugin.so Debug: Loading modules from directory: /usr/lib/dovecot/modules/doveadm Debug: Module loaded: /usr/lib/dovecot/modules/doveadm/lib10_doveadm_acl_plugin.so Debug: Skipping module doveadm_expire_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/lib10_doveadm_expire_plugin.so: undefined symbol: expire_set_deinit (this is usually intentional, so just ignore this message) Debug: Module loaded: /usr/lib/dovecot/modules/doveadm/lib10_doveadm_quota_plugin.so Debug: Module loaded: /usr/lib/dovecot/modules/doveadm/lib10_doveadm_sieve_plugin.so Debug: Skipping module doveadm_fts_lucene_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/lib20_doveadm_fts_lucene_plugin.so: undefined symbol: lucene_index_iter_deinit (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_fts_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/lib20_doveadm_fts_plugin.so: undefined symbol: fts_user_get_language_list (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_mail_crypt_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/libdoveadm_mail_crypt_plugin.so: undefined symbol: mail_crypt_box_get_pvt_digests (this is usually intentional, so just ignore this message) field valuedoveadm(jost)<25290><>: Debug: auth USER input: jost home=/var/vmail/matysik.it/jost-philip uid=5000 gid=5000 acl_groups=matysik,admin quota_rule=*:storage=10G quota_rule2 = Trash:storage=+100M quota2 = count:shared quota for maschinen:ns=ZZZ_Freigaben/maschinen/ quota2_rule = *:storage=500M quota3 = count:shared quota for matysik:ns=ZZZ_Freigaben/matysik/ quota3_rule = *:storage=10G quota4 = count:shared quota for postmaster:ns=ZZZ_Freigaben/postmaster/ quota4_rule = *:storage=1G uid 5000 gid 5000 home /var/vmail/matysik.it/jost-philip mail maildir:~/Maildir acl_groups matysik,admin quota_rule *:storage=10G quota_rule2 Trash:storage=+100M quota2 count:shared quota for maschinen:ns=ZZZ_Freigaben/maschinen/ quota2_rule *:storage=500M quota3 count:shared quota for matysik:ns=ZZZ_Freigaben/matysik/ quota3_rule *:storage=10G quota4 count:shared quota for postmaster:ns=ZZZ_Freigaben/postmaster/ quota4_rule *:storage=1G

1 0

Create a malicious directory
by lty 20 May '19

20 May '19

Use scripts to create some malicious directories. Here is my creation process. How can I prevent the creation of these directories? I used the python imapclient script to create a directory. There may be no big threat to dovecot, but it is dangerous for doveadm.

4 3

Directory name have some malicious characters.
by hfh＠cndns.com 20 May '19

20 May '19

Directory name have some malicious characters, is it safe?How can I exclude some characters,thanks!

1 0

Plugins/Mailcrypt: mail_crypt_private_password not assigned by password_query
by Max Kostikov 20 May '19

20 May '19

I try to use Mailcrypt encrypted user keys with conjustion with dbsync replication(Dovecot 2.3.6 in FreeBSD 12.0 enviroment) but was unsuccessful. If I provide a password in mail_crypt_private_password variable directly in Dovecot config all things works as expected plugin { mail_crypt_curve = prime256v1 mail_crypt_save_version = 2 mail_crypt_require_encrypted_user_key = yes mail_crypt_private_password = 12345 } but when I remove this and trying to get the same user password in password_query it seems password doesn't assigned password_query = SELECT username AS user, password, \ '%w' AS userdb_mail_crypt_private_password \ FROM mailbox WHERE username = LCASE('%u') \ AND active = '1' with errors like this in log at server where message was accepted from remote system May 20 00:40:31 server1 dovecot[35417]: dsync-local(foo(a)example.com)<Y51qBF/b4VyHigAAJQnBKg>: Error: dsync(server1.example.com): read() failed: read(/var/mail/example.com/foo/new/1558305609.M674400P35456.server1.example… failed: Private key not available: Cannot decrypt key a4ceb2df0287c0c0ccb0d76e31d91824e1f13e9ffe63d1e04a9a233a073d8a64: Cannot decrypt key 5d19a9246ddce2759a21462974add562dd90f2cb2aa3ff6a5af1af1e3e9b58e6: Password not available (last sent=mail, last recv=mail_request (EOL)) and errors at replica server May 20 00:40:31 server2 dovecot[63985]: dsync-local(foo(a)example.com)<MpW+HV/b4VwD+wAAfP91Tw>: Error: dsync(server2.example.com): read() failed: read() failed: dot-input stream ends without '.' line (last sent=mail_request (EOL), last recv=mail) The question is it possible to have password encrypted user keys with Dovecot dbsync replication or we found a new bug? -- With best regards, Max Kostikov W: https://kostikov.co | DeltaChat: mk(a)eprove.net

1 0

Permission denied
by ＠lbutlr 19 May '19

19 May '19

mail dovecot: lda(user@domain)<955><rPK3B2Gr4Vy7AwAAIdGjjQ>: msgid=<4562Sm6YyYzvmrD(a)mail.covisp.net>: save failed to INBOX: Mailbox INBOX: open(/usr/local/virtual/user(a)domain/tmp/1558293345.M130062P955.mail.covisp.net) failed: Permission denied The permissions on /usr/local/virual have not changed and are still owed by user/group 89/89 dovecot-sql.conf.ext: user_query = select 89 as uid, 89 as gid, concat('/usr/local/virtual/', maildir) as home FROM mailbox where username = '%u' dovecot.conf: first_valid_uid = 89 # ls -lsdn /usr/local/virtual/ 8 drwx------ 29 89 89 1536 Mar 12 23:30 /usr/local/virtual/ # ls -lsdn /usr/local/virtual/backup\(a)southgaylord.com 184 drwx------ 2056 89 89 92672 May 19 12:43 /usr/local/virtual/user@domain Do I need to compile dovecot with vpopmail support? -- I WILL NOT DO THE DIRTY BIRD Bart chalkboard Ep. AABF08

1 0

Repo for RHEL8
by TG Servers 19 May '19

19 May '19

2 2

Merging existing mailboxes to aliases
by Lefteris Tsintjelis 19 May '19

19 May '19

I am trying to merge all, existing or not, different mailboxes in one with the mailbox alias plugin. If I add the following lines, will the existing mailboxes automatically merge in one mailbox and corresponding links auto create? If not, do I have to do this manually? mailbox_alias_new = Spam mailbox_alias_new2 = Junk E-mail mailbox_alias_new3 = Sent Items mailbox_alias_new4 = Sent Messages mailbox_alias_new5 = Deleted Items mailbox_alias_old = Junk mailbox_alias_old2 = Junk mailbox_alias_old3 = Sent mailbox_alias_old4 = Sent mailbox_alias_old5 = Trash Lefteris

3 4

Do we need ssl_dh_parameters_length in version 2.3
by MRob 19 May '19

19 May '19

Hi, I couldn't really find documentation about ssl_dh_parameters_length except for mention in passing on the page https://wiki2.dovecot.org/SSL/DovecotConfiguration For version 2.3 and above is that setting necessary? If so what are the values I can use, is setting it high like 4096 beneficial or make any problems for clients? Thanks for assistance.

2 1

Re: imap failing
by LuKreme 18 May '19

18 May '19

Ugh. Sorry about this, using gmail and it’s weird and annoying meant to send to list On Thu, May 16, 2019 at 00:46 LuKreme <kremels(a)kreme.com> wrote: > One more bit of info. After leaving s_client up for a bit, I got another > line > > CONNECTED(00000003) > 675481056:error:140790E5:SSL routines:ssl23_write:ssl handshake > failure:/usr/src/crypto/openssl/ssl/s23_lib.c:177: > --- > no peer certificate available > --- > No client certificate CA names sent > --- > SSL handshake has read 0 bytes and written 307 bytes > --- > New, (NONE), Cipher is (NONE) > Secure Renegotiation IS NOT supported > Compression: NONE > Expansion: NONE > No ALPN negotiated > SSL-Session: > Protocol : TLSv1.2 > Cipher : 0000 > Session-ID: > Session-ID-ctx: > Master-Key: > Key-Arg : None > PSK identity: None > PSK identity hint: None > SRP username: None > Start Time: 1557988789 > Timeout : 300 (sec) > Verify return code: 0 (ok) > --- > > I guess I wasn't patient enough before. But the certs are in the exact > same place as they've been all along and are working fine with apache. > I can also send mail, if that is at all relevant. (postconf -n is in > another post in this thread) > -- Sent from Gmail Mobile

3 3

Find last day of login
by Lefteris Tsintjelis 18 May '19

18 May '19

I am using dovecot virtual maildir accounts. Is it possible to find last day of login for an account by checking the last modification time of the maildir files? Lefteris

3 4

How to continuously gather statistics?
by Roel van Duijnhoven 17 May '19

17 May '19

Hello, I recently upgraded to the latest version of Dovecot, and want to use the newly introduced logging / event system. I want to fetch the statistics every couple of seconds, and push those to our logging platform. Metrics such as: number of IMAP commands, average time they took, etc. However the metrics as reported by Dovecot continously increment. So I see two solutions: - Our solution could keep track of the previous values. But that could also break if the statistics are reset for some reason (e.g. threshold reached). - My second thought was to use "stats -r". That *should* clear the statistics directly after fetching them. And thus, give a better picture. However I am not sure if this gives me actual useful results. Or is there maybe a better approach to fetch statistics that I overlooked? Thanks a lot. Best, Roel van Duijnhoven

2 1

Dovecot Separator change
by Oliver Werner 16 May '19

16 May '19

Hi community, actually we are using dovecot 2.2.27 without shares mailboxes. Now we would like to implement it. So the problem is that our separator is dot „.“ and the username like „firstname.surname“. That’s doesn’t works with shared mailboxes. Are there a migration guide for changing „.“ to „/„ or it's not possible? kind regards Oliver

1 0

File-dictionary based quotas and SETQUOTA
by Ganael Laplanche 16 May '19

16 May '19

Hello, I am trying to set up file-dictionary based quotas while supporting the SETQUOTA IMAP command. I am using the following configuration : ---- plugin { quota = dict:User quota::file:%h/Maildir/dovecot-quota quota_set = dict:file:%h/Maildir/dovecot-quota } ---- which enables correct quota accounting + setting through SETQUOTA. A user's dovecot-quota file ends with the following contents : ---- priv/quota/limit/storage 5242880 priv/quota/limit/messages 20 priv/quota/messages 1 priv/quota/storage 8506282 ---- which shows a correct accounting (1 mail received, ~8MB used) and correct setting after having used the following IMAP command through a master user : A2 SETQUOTA "User quota" (STORAGE 5242880 MESSAGE 20) *But* the problem is that I am unable to fetch the limits and consume them from userdb (as a consequence, the limits are never applied). On the consuming side, I am using a dictionary userdb to try to fetch the 'priv/quota/limit/storage' value from the file but it does not work because the key is never found. Here is my configuration : ---- userdb { driver = dict args = /etc/dovecot/dovecot-dict-quota.conf.ext } ---- and my dovecot-dict-quota.conf.ext file : ---- uri = file:%h/Maildir/dovecot-quota iterate_disable = yes key quota { key = priv/quota/limit/storage default_value = 100 } userdb_fields { quota_rule = *:storage=%{dict:quota} } ---- If I try to fetch the quota for that user : # doveadm quota get -u ganael.laplanche(a)centralesupelec.fr Quota name Type Value Limit % User quota STORAGE 8307 100 8307 User quota MESSAGE 1 - 0 the default rule is returned (100). The logs show : May 16 12:02:45 mailhost1-saclay dovecot: auth-worker(12899): Debug: dict(Ganael.Laplanche(a)centralesupelec.fr): Lookup: shared/priv/quota/limit/ storage not found, using default value 100 We can see that the default quota rule has been applied because the key is not found. The problem is that a "shared/" prefix is always prepended when looking for the key I configured (priv/quota/limit/storage). If I test the dictionary manually, the key is found : # doveadm dict get -u ganael.laplanche(a)centralesupelec.fr "file:/var/vmail/l/ laplanche_gan/Maildir/dovecot-quota" priv/quota/limit/storage 5242880 Does anyone know how to prevent Dovecot from adding that prefix and make it fetch the correct value from userdb ? Best regards, -- Ganael Laplanche <ganael.laplanche(a)centralesupelec.fr> Unix Systems Engineer @CentraleSupelec Rennes

1 0

Password database - external verification
by Richard Hector 16 May '19

16 May '19

Hi all, I'm currently using a PostgreSQL database for my user/password db, directly from dovecot. The trouble with that is that I'm stuck with whatever hash algorithms dovecot supports - which IIRC means (a subset of?) what libc has been compiled with, which can be a bit restrictive. So I'd like to use an external tool, which would also let me integrate other applications (eg web apps). PAM seems to be most suited to sharing accounts with the OS, which isn't what I want. BSDAuth likewise, but I'm not using BSD. CheckPassword looks like a somewhat convoluted protocol, but maybe the best bet? IMAP - well, that's circular :-) OAuth2 looks possible, but seems to be focused on http? Any suggestions? And recommended implementations? How hard is it to add extra methods? Thanks, Richard

2 2

Dovecot not connecting to OpenLDAP
by Elias Falconi 16 May '19

16 May '19

Hi, We recently shutdown our old LDAP server and repointed our mail server (dovecot + postfix) to our new LDAP server and ever since we've been unable to fetch mail. Mail is getting delivered, but we just can't pop it. We're using Ubuntu 16.04, btw. We keep on getting the following error messages in /var/log/dovecote: 2019-05-15 16:27:43 auth: Error: LDAP /etc/dovecot/dovecot-ldap.conf.ext: ldap_start_tls_s() failed: Can't contact LDAP server 2019-05-15 16:39:36 auth: Error: LDAP /etc/dovecot/dovecot-ldap.conf.ext: ldap_start_tls_s() failed: Connect error 2019-05-15 16:39:43 auth: Error: LDAP /etc/dovecot/dovecot-ldap.conf.ext: ldap_start_tls_s() failed: Local error However, our server is finding our LDAP users and postfix doesn't seem to have a problem, just Dovecot. Also, when we try to connect via Dovecot, we get the following message: -ERR [SYS/TEMP] Temporary authentication failure. [mail:2019-05-15 21:40:06] Our /etc/dovecot/dovecot.conf contains the following: ## Dovecot configuration file # If you're in a hurry, see http://wiki2.dovecot.org/QuickConfiguration # "doveconf -n" command gives a clean output of the changed settings. Use it # instead of copy&pasting files when posting to the Dovecot mailing list. # '#' character and everything after it is treated as comments. Extra spaces # and tabs are ignored. If you want to use either of these explicitly, put the # value inside quotes, eg.: key = "# char and trailing whitespace " # Most (but not all) settings can be overridden by different protocols and/or # source/destination IPs by placing the settings inside sections, for example: # protocol imap { }, local 127.0.0.1 { }, remote 10.0.0.0/8 { } # Default values are shown for each setting, it's not required to uncomment # those. These are exceptions to this though: No sections (e.g. namespace {}) # or plugin settings are added by default, they're listed only as examples. # Paths are also just examples with the real defaults being based on configure # options. The paths listed here are for configure --prefix=/usr # --sysconfdir=/etc --localstatedir=/var # Enable installed protocols !include_try /usr/share/dovecot/protocols.d/*.protocol # A comma separated list of IPs or hosts where to listen in for connections. # "*" listens in all IPv4 interfaces, "::" listens in all IPv6 interfaces. # If you want to specify non-default ports or anything more complex, # edit conf.d/master.conf. #listen = *, :: # Base directory where to store runtime data. #base_dir = /var/run/dovecot/ # Name of this instance. In multi-instance setup doveadm and other commands # can use -i <instance_name> to select which instance is used (an alternative # to -c <config_path>). The instance name is also added to Dovecot processes # in ps output. #instance_name = dovecot # Greeting message for clients. #login_greeting = Dovecot ready. # Space separated list of trusted network ranges. Connections from these # IPs are allowed to override their IP addresses and ports (for logging and # for authentication checks). disable_plaintext_auth is also ignored for # these networks. Typically you'd specify your IMAP proxy servers here. #login_trusted_networks = # Space separated list of login access check sockets (e.g. tcpwrap) #login_access_sockets = # With proxy_maybe=yes if proxy destination matches any of these IPs, don't do # proxying. This isn't necessary normally, but may be useful if the destination # IP is e.g. a load balancer's IP. #auth_proxy_self = # Show more verbose process titles (in ps). Currently shows user name and # IP address. Useful for seeing who are actually using the IMAP processes # (eg. shared mailboxes or if same uid is used for multiple accounts). #verbose_proctitle = no # Should all processes be killed when Dovecot master process shuts down. # Setting this to "no" means that Dovecot can be upgraded without # forcing existing client connections to close (although that could also be # a problem if the upgrade is e.g. because of a security fix). #shutdown_clients = yes # If non-zero, run mail commands via this many connections to doveadm server, # instead of running them directly in the same process. #doveadm_worker_count = 0 # UNIX socket or host:port used for connecting to doveadm server #doveadm_socket_path = doveadm-server # Space separated list of environment variables that are preserved on Dovecot # startup and passed down to all of its child processes. You can also give # key=value pairs to always set specific settings. #import_environment = TZ ## ## Dictionary server settings ## # Dictionary can be used to store key=value lists. This is used by several # plugins. The dictionary can be accessed either directly or though a # dictionary server. The following dict block maps dictionary names to URIs # when the server is used. These can then be referenced using URIs in format # "proxy::<name>". dict { #quota = mysql:/etc/dovecot/dovecot-dict-sql.conf.ext #expire = sqlite:/etc/dovecot/dovecot-dict-sql.conf.ext quota = ldap:/etc/dovecot/dovecot-ldap.conf.ext expire = ldap:/etc/dovecot/dovecot-ldap.conf.ext } # Most of the actual configuration gets included below. The filenames are # first sorted by their ASCII value and parsed in that order. The 00-prefixes # in filenames are intended to make it easier to understand the ordering. !include conf.d/*.conf # A config file can also tried to be included without giving an error if # it's not found: !include_try local.conf # Added by Elias protocols = pop3 imap #ssl_cert = </etc/ssl/certs/server.crt #ssl_key = </etc/ssl/private/server.key ssl_cert = </etc/ssl/certs/ssl-cert-snakeoil.pem ssl_key = </etc/ssl/private/ssl-cert-snakeoil.key log_path = /var/log/dovecote info_log_path = /var/log/dovecote_info log_timestamp = "%Y-%m-%d %H:%M:%S " #syslog_facility = mail_dovecote #ssl = no #mail_location = mbox:~/:INBOX=/var/mail/%u #namespace { # type = private # separator = . # inbox = yes #} mail_privileged_group = mail mail_full_filesystem_access = yes mail_debug = yes mmap_disable = yes mail_nfs_storage = yes mail_nfs_index = yes mail_fsync = always mbox_read_locks = dotlock mbox_write_locks = dotlock passdb ldap { driver = ldap # Path for LDAP configuration file args = /etc/dovecot/dovecot-ldap.conf.ext } userdb { driver=passwd } userdb ldap { driver = ldap # Path for LDAP configuration file args = /etc/dovecot/dovecot-ldap.conf.ext } And our /etc/dovecot/dovecot-ldap.conf.ext has this: # This file is commonly accessed via passdb {} or userdb {} section in # conf.d/auth-ldap.conf.ext # This file is opened as root, so it should be owned by root and mode 0600. # # http://wiki2.dovecot.org/AuthDatabase/LDAP # # NOTE: If you're not using authentication binds, you'll need to give # dovecot-auth read access to userPassword field in the LDAP server. # With OpenLDAP this is done by modifying /etc/ldap/slapd.conf. There should # already be something like this: # access to attribute=userPassword # by dn="<dovecot's dn>" read # add this # by anonymous auth # by self write # by * none # Space separated list of LDAP hosts to use. host:port is allowed too. hosts = 139.147.9.135 # LDAP URIs to use. You can use this instead of hosts list. Note that this # setting isn't supported by all LDAP libraries. #uris = ldaps://139.147.9.135 # Distinguished Name - the username used to login to the LDAP server. # Leave it commented out to bind anonymously (useful with auth_bind=yes). dn = cn=admin,dc=cs,dc=lafayette,dc=edu # Password for LDAP server, if dn is specified. dnpass = blahblah123 # Use SASL binding instead of the simple binding. Note that this changes # ldap_version automatically to be 3 if it's lower. Also note that SASL binds # and auth_bind=yes don't work together. #sasl_bind = no # SASL mechanism name to use. #sasl_mech = # SASL realm to use. #sasl_realm = # SASL authorization ID, ie. the dnpass is for this "master user", but the # dn is still the logged in user. Normally you want to keep this empty. #sasl_authz_id = # Use TLS to connect to the LDAP server. tls = yes # TLS options, currently supported only with OpenLDAP: #tls_ca_cert_file =/etc/ssl/certs/ldap.crt tls_ca_cert_file =/etc/ssl/certs/ldap6_cacert.pem #tls_ca_cert_dir =/etc/ssl/certs/ #tls_cipher_suite = # TLS cert/key is used only if LDAP server requires a client certificate. #tls_cert_file = /etc/ssl/certs/ldap01_slapd_cert.pem #tls_key_file = /etc/ssl/private/ldap01_slapd_key.pem # Valid values: never, hard, demand, allow, try #tls_require_cert = demand # Use the given ldaprc path. #ldaprc_path = # LDAP library debug level as specified by LDAP_DEBUG_* in ldap_log.h. # -1 = everything. You may need to recompile OpenLDAP with debugging enabled # to get enough output. #debug_level = 0 # Use authentication binding for verifying password's validity. This works by # logging into LDAP server using the username and password given by client. # The pass_filter is used to find the DN for the user. Note that the pass_attrs # is still used, only the password field is ignored in it. Before doing any # search, the binding is switched back to the default DN. auth_bind = yes # If authentication binding is used, you can save one LDAP request per login # if users' DN can be specified with a common template. The template can use # the standard %variables (see user_filter). Note that you can't # use any pass_attrs if you use this setting. # # If you use this setting, it's a good idea to use a different # dovecot-ldap.conf.ext for userdb (it can even be a symlink, just as long as # the filename is different in userdb's args). That way one connection is used # only for LDAP binds and another connection is used for user lookups. # Otherwise the binding is changed to the default DN before each user lookup. # # For example: # auth_bind_userdn = cn=%u,ou=people,o=org # #auth_bind_userdn = # LDAP protocol version to use. Likely 2 or 3. ldap_version = 3 # LDAP base. %variables can be used here. # For example: dc=mail, dc=example, dc=org base = ou=People,dc=cs,dc=lafayette,dc=edu # Dereference: never, searching, finding, always deref = never # Search scope: base, onelevel, subtree scope = subtree # User attributes are given in LDAP-name=dovecot-internal-name list. The # internal names are: # uid - System UID # gid - System GID # home - Home directory # mail - Mail location # # There are also other special fields which can be returned, see # http://wiki2.dovecot.org/UserDatabase/ExtraFields user_attrs = homeDirectory=home,uidNumber=uid,gidNumber=gid # Filter for user lookup. Some variables can be used (see # http://wiki2.dovecot.org/Variables for full list): # %u - username # %n - user part in user@domain, same as %u if there's no domain # %d - domain part in user@domain, empty if user there's no domain user_filter = (&(objectClass=posixAccount)(uid=%u)) # Password checking attributes: # user: Virtual user name (user@domain), if you wish to change the # user-given username to something else # password: Password, may optionally start with {type}, eg. {crypt} # There are also other special fields which can be returned, see # http://wiki2.dovecot.org/PasswordDatabase/ExtraFields pass_attrs = uid=user,userPassword=password # If you wish to avoid two LDAP lookups (passdb + userdb), you can use # userdb prefetch instead of userdb ldap in dovecot.conf. In that case you'll # also have to include user_attrs in pass_attrs field prefixed with "userdb_" # string. For example: #pass_attrs = uid=user,userPassword=password,\ # homeDirectory=userdb_home,uidNumber=userdb_uid,gidNumber=userdb_gid # Filter for password lookups pass_filter = (&(objectClass=posixAccount)(uid=%u)) # Attributes and filter to get a list of all users #iterate_attrs = uid=user #iterate_filter = (objectClass=posixAccount) # Default password scheme. "{scheme}" before password overrides this. # List of supported schemes is in: http://wiki2.dovecot.org/Authentication #default_pass_scheme = CRYPT What do you suppose could be the problem? Thanks, Elias

3 2

imap failing
by ＠lbutlr 16 May '19

16 May '19

mail kernel: pid 59433 (imap-login), uid 0: exited on signal 11 (core dumped) master: Error: service(imap-login): command startup failed, throttling for 16 secs May 15 17:21:37 imap-login: Fatal: master: service(imap-login): child 92934 killed with signal 11 (core dumped) I also get a password error for a user unknown, but if I connect to the database with the credentials dovecot uses, I get a password. MariaDB [postfix]> select password FROM mailbox where username ='sample(a)domain.munged'; +-------------------------------------------------------------------------------+ | password | +-------------------------------------------------------------------------------+ | {SHA256-CRYPT}$5$042......................................................... | +-------------------------------------------------------------------------------+ MariaDB [postfix]> select 89 as uid, 89 as gid, concat('/usr/local/virtual/', maildir) as home FROM mailbox where username = 'sample(a)domain.munged'; +-----+-----+------------------------------------------+ | uid | gid | home | +-----+-----+------------------------------------------+ | 89 | 89 | /usr/local/virtual/sample(a)domain.munged/ | +-----+-----+------------------------------------------+ 1 row in set (0.00 sec) I updated my system to openssl111 and rebuilt dovecot and postfix (and a hundred other packages). <y configuration files have not changed. I've looked through he logs for other info, but I don't see anything. Trying to connect via openssl gives me: # openssl s_client -connect mail.covisp.net:993 -starttls imap CONNECTED(00000003)

3 5

Setting up individual encrypted user keys using mail-crypt-plugin
by emordin 16 May '19

16 May '19

Hi, I have setup up a simple mail server using the ISPMail tutorial and I'm trying to learn how to create email encryption at rest. I'm having a tough time understanding how to set this up... So say a user logins thru roundcube and they type in their password...so the password authenticates to the mysql database which is storing their encrypted private key?? And once they access that private key, how do they use that private key to unencrypt their mailbox? I'm a super noob at this, and I may be off, but I don't know where to start when it comes to setting this up... if I'm way off could you just recommend some tutorials or other basics I should learn first before moving on to setting this up? Sent with [ProtonMail](https://protonmail.com) Secure Email.

2 1

Mutual auth and MS Outlook
by dovecot＠scottsavarese.com 16 May '19

16 May '19

I am trying to get Dovecot IMAP and Outlook to talk to each other with SSL and client certificates enabled. In Dovecot, I have the following options enabled: ssl_ca = ... ssl_verify_client_cert = yes auth_ssl_require_client_cert = yes auth_ssl_username_from_cert = yes when I try to connect with Outlook, I get: May 12 08:07:50 mail dovecot: imap-login: Disconnected (client didn't send a cert): user=<>, method=PLAIN, rip=192.168.1.245, lip=192.168.2.5, TLS: Disconnected, session=<is7gpa+Im97AqAH1> But when I use openssl directly with the same certificates it seems to pass the certificate in just fine. Does anybody have any ideas? Thanks in advance.

2 1

Permissions fix
by Lefteris Tsintjelis 16 May '19

16 May '19

Is there a fast way for dovecot to set and/or fix its directory permissions?

2 2

Anyone using object storage ceph?
by Marc Roos 15 May '19

15 May '19

Just curious if there are already people actively using object storage? https://github.com/ceph-dovecot/dovecot-ceph-plugin https://docplayer.net/docs-images/40/9935441/images/page_13.jpg

2 1

Re: weakforced and GeoIP lookups
by Neil Cook 15 May '19

15 May '19

Hi Tobi, This looks like you haven’t included the libmaxmind libraries before running configure. GeoIP support is only compiled in if it finds the right libs. This would be libmaxminddb-dev on Ubuntu for example. Neil >> Hi list >> >> hope it's okay to ask weakforced questions here as well, but I could not >> find a dedicated mailinglist for wforce. >> >> I want to enable GeoIP lookups in my wforce daemon. In a first step I >> installed luarocks and lua-compat53 to install mmdblua module. >> Then I added >> >> newGeoIP2DB("country", "/usr/local/share/GeoIP/GeoLite2-Country.mmdb") >> local mygeodb = getGeoIP2DB("country") >> if(mygeodb:lookupCountry(lt.remote) == 'XX') >> then >> return -1, "country blocked", "country blocked", { country="XX" } >> end >> >> to wforce.conf and tried to restart wforce but that ends up in a >> >> > Fatal Lua error: [string "chunk"]:28: attempt to call global >> > 'newGeoIP2DB' (a nil value) >> >> Any ideas what I could be missing here? >> >> Cheers >> >> tobi > > > Neil Cook > neil.cook(a)open-xchange.com <mailto:neil.cook@open-xchange.com> > > ------------------------------------------------------------------------------------- > Open-Xchange AG, Rollnerstr. 14, 90408 Nuremberg, District Court Nuremberg HRB 24738 > Managing Board: Rafael Laguna de la Vera, Carsten Dirks, Michael Knapstein, Stephan Martin > Chairman of the Board: Richard Seibt > > European Office: > Open-Xchange GmbH, Olper Huette 5f, D-57462 Olpe, Germany, District Court Siegen, HRB 8718 > Managing Director: Frank Hoberg > > US Office: > Open-Xchange. Inc., 530 Lytton Avenue, Palo Alto, CA 94301, USA > ------------------------------------------------------------------------------------- > Neil Cook neil.cook(a)open-xchange.com <mailto:neil.cook@open-xchange.com> ------------------------------------------------------------------------------------- Open-Xchange AG, Rollnerstr. 14, 90408 Nuremberg, District Court Nuremberg HRB 24738 Managing Board: Rafael Laguna de la Vera, Carsten Dirks, Michael Knapstein, Stephan Martin Chairman of the Board: Richard Seibt European Office: Open-Xchange GmbH, Olper Huette 5f, D-57462 Olpe, Germany, District Court Siegen, HRB 8718 Managing Director: Frank Hoberg US Office: Open-Xchange. Inc., 530 Lytton Avenue, Palo Alto, CA 94301, USA -------------------------------------------------------------------------------------

2 4