- dovecot - dovecot.org

Re: Mail account brute force / harassment
by Odhiambo Washington 11 Apr '19

11 Apr '19

All your approaches are not well thought out. The best solutions are always the simplest ones. KISS principle dictates so. On Thu, 11 Apr 2019 at 15:01, Marc Roos <M.Roos(a)f1-outsourcing.eu> wrote: > > How long have we been using the current strategy? Do we have less or > more abuse clouds operating? > > "Let the others bother with their own problems." is a bit narrow minded > view. If every one on this mailing list would have this attitude, there > would be no single answer to your question. > > > -----Original Message----- > From: Odhiambo Washington [mailto:odhiambo@gmail.com] > Sent: donderdag 11 april 2019 12:54 > To: Marc Roos > Cc: dovecot > Subject: Re: Mail account brute force / harassment > > Marc, > > There is a strategy loosely referred to as "choose your battles well" > :-) > If you can, hack the server and dump the 500GB - you'll be using > resources transferring the 500GB as the other server receives it. Two > servers wasting resources because you think you are punishing an > offender! > > > On Thu, 11 Apr 2019 at 13:43, wrote: > > > Please do not assume anything other than what is written, it is a > hypothetical situation > > > A. With the fail2ban solution > - you 'solve' that the current ip is not able to access you > - it will continue bothering other servers and admins > - you get the next abuse host to give a try. > > B. With 500GB dump > - the owner of the attacking server (probably hacked) will notice > it > will be forced to take action. > > > If abuse clouds are smart (most are) they would notice that > attacking my > servers, will result in the loss of abuse nodes, hence they will > not > bother me anymore. > > If every one would apply strategy B, the abuse problem would get > less. > Don't you agree?? > > > > > > > -----Original Message----- > From: Odhiambo Washington > Sent: donderdag 11 april 2019 12:28 > To: Marc Roos > Cc: dovecot > Subject: Re: Mail account brute force / harassment > > > > On Thu, 11 Apr 2019 at 13:24, Marc Roos via dovecot > <dovecot(a)dovecot.org> wrote: > > > > > Say for instance you have some one trying to constantly > access an > account > > > Has any of you made something creative like this: > > * configure that account to allow to login with any > password > * link that account to something like /dev/zero that > generates > infinite > amount of messages > (maybe send an archive of virusses?) > * transferring TB's of data to this harassing client. > > I think it would be interesting to be able to do such a > thing. > > > > > Instead of being evil, just use fail2ban to address this problem > :-) > > -- > > Best regards, > Odhiambo WASHINGTON, > Nairobi,KE > +254 7 3200 0004/+254 7 2274 3223 > "Oh, the cruft.", grep ^[^#] :-) > > > > > > > -- > > Best regards, > Odhiambo WASHINGTON, > Nairobi,KE > +254 7 3200 0004/+254 7 2274 3223 > "Oh, the cruft.", grep ^[^#] :-) > > > -- Best regards, Odhiambo WASHINGTON, Nairobi,KE +254 7 3200 0004/+254 7 2274 3223 "Oh, the cruft.", grep ^[^#] :-)

1 0

Re: Mail account brute force / harassment
by Odhiambo Washington 11 Apr '19

11 Apr '19

Marc, There is a strategy loosely referred to as "choose your battles well" :-) Let the others bother with their own problems. If you can, hack the server and dump the 500GB - you'll be using resources transferring the 500GB as the other server receives it. Two servers wasting resources because you think you are punishing an offender! On Thu, 11 Apr 2019 at 13:43, Marc Roos <M.Roos(a)f1-outsourcing.eu> wrote: > Please do not assume anything other than what is written, it is a > hypothetical situation > > > A. With the fail2ban solution > - you 'solve' that the current ip is not able to access you > - it will continue bothering other servers and admins > - you get the next abuse host to give a try. > > B. With 500GB dump > - the owner of the attacking server (probably hacked) will notice it > will be forced to take action. > > > If abuse clouds are smart (most are) they would notice that attacking my > servers, will result in the loss of abuse nodes, hence they will not > bother me anymore. > > If every one would apply strategy B, the abuse problem would get less. > Don't you agree?? > > > > > > > -----Original Message----- > From: Odhiambo Washington > Sent: donderdag 11 april 2019 12:28 > To: Marc Roos > Cc: dovecot > Subject: Re: Mail account brute force / harassment > > > > On Thu, 11 Apr 2019 at 13:24, Marc Roos via dovecot > <dovecot(a)dovecot.org> wrote: > > > > > Say for instance you have some one trying to constantly access an > account > > > Has any of you made something creative like this: > > * configure that account to allow to login with any password > * link that account to something like /dev/zero that generates > infinite > amount of messages > (maybe send an archive of virusses?) > * transferring TB's of data to this harassing client. > > I think it would be interesting to be able to do such a thing. > > > > > Instead of being evil, just use fail2ban to address this problem :-) > > -- > > Best regards, > Odhiambo WASHINGTON, > Nairobi,KE > +254 7 3200 0004/+254 7 2274 3223 > "Oh, the cruft.", grep ^[^#] :-) > > > -- Best regards, Odhiambo WASHINGTON, Nairobi,KE +254 7 3200 0004/+254 7 2274 3223 "Oh, the cruft.", grep ^[^#] :-)

2 1

Re: Lua Push Notification Plugin
by Sami Ketola 11 Apr '19

11 Apr '19

Hi, doveadm mailbox metadata get -u victim INBOX /private/vendor/vendor.dovecot/pvt/server/vendor/vendor.dovecot/http-notify or doveadm mailbox metadata set if you are not using appsuite as your mail frontend then you need to set the metadata manually or make sure that your mail frontend does set it. Sami > On 11 Apr 2019, at 11.50, Pabsky <j0hnw0rk3r(a)gmail.com> wrote: > > Sami, > > the package 'appsuite' is not mentioned in the documentation, also I already enabled imap metadata. > > What do you mean by 'It's not supposed to be a file. It's supposed to be a attribute on the users INBOX'? > > I'm attaching my dovecot configuration file for you to examine. Thanks Sami! > > On 11/04/2019 4:37 PM, Sami Ketola wrote: >> >> >>> On 11 Apr 2019, at 11.00, Pabsky via dovecot <dovecot(a)dovecot.org <mailto:dovecot@dovecot.org>> wrote: >>> >>> Thanks AKI! I'm a step closer to achieving my goals. >>> >>> However, I'm getting a new error as indicated from below: >>> >>> Apr 11 01:45:34 lmtp(user(a)mydomain.com <mailto:user@mydomain.com>)<20801><pVlIEJ7wrlxBUQAAUdwEFQ>: Debug: push-notification-ox: Skipped because not active (/private/vendor/vendor.dovecot/pvt/server/vendor/vendor.dovecot/http-notify METADATA not set) >>> Apr 11 01:45:34 lmtp(user(a)mydomain.com <mailto:user@mydomain.com>)<20801><pVlIEJ7wrlxBUQAAUdwEFQ>: Debug: push-notification: Push notification transaction completed >>> >>> By the way, the file /private/vendor/vendor.dovecot/pvt/server/vendor/vendor.dovecot/http-notify does not exist on my server. >> >> It's not supposed to be a file. It's supposed to be a attribute on the users INBOX. Also you need to enable imap metadata or appsuite can't set the attribute. >> >> Sami >> >> > <dovecot.conf>

1 0

Passord change problem. (INTERNAL)
by Arvid.Eikas＠telenor.com 11 Apr '19

11 Apr '19

Hi, We have a strange problem with login after password change. We need to kill the auth_worker processes to activate the new password. It doesn't work with SIGHUP on pid, it doesn't help to run "doveadm auth cache flush". It runs flush xx but the new password still doesn't work. Are there any suggestions for how this can be resolved? Our release is 2.3.5. Arvid

1 0

Re: Lua Push Notification Plugin
by Pabsky 11 Apr '19

11 Apr '19

Thanks AKI! I'm a step closer to achieving my goals. However, I'm getting a new error as indicated from below: Apr 11 01:45:34 lmtp(user(a)mydomain.com)<20801><pVlIEJ7wrlxBUQAAUdwEFQ>:*Debug: push-notification-ox: Skipped because not active (/private/vendor/vendor.dovecot/pvt/server/vendor/vendor.dovecot/http-notify METADATA not set)* Apr 11 01:45:34 lmtp(user(a)mydomain.com)<20801><pVlIEJ7wrlxBUQAAUdwEFQ>:*Debug: push-notification: Push notification transaction completed *By the way, the file****/private/vendor/vendor.dovecot/pvt/server/vendor/vendor.dovecot/http-notify* *does not exist on my server. Again, I appreciate the help :) ** > On 11 April 2019 07:57 Robust Coding via dovecot <dovecot(a)dovecot.org> wrote: > > > Hi Admin, > > I hope you consider reading and addressing my concern promptly. > > For the past few days I've been setting up a VPS with cPanel and WHM > pre-installed on Bluehost. I want to enable push notification plugin in > Dovecot2.3.5. I tried OX and Lua plugins and got errors. > > For using OX plugin: > push_notification_driver = ox:url=http://staging.mydomain.com/mail-notify/v1 > user_from_metadata > And got this error on runtime: > Error: push-notification-ox: Skipped because unable to get attribute: Mailbox > attributes not enabled > mail_attribute_dict = file:%h/Maildir/dovecot-attributes > When using Lua: > mail_plugins = $mail_plugins mail_lua notify push_notification > push_notification_lua > > plugin { > push_notification_driver = lua:file=/path/to/lua/push.lua > } > And got this order: > Plugin 'push_notification_lua' not found from directory /usr/lib64/dovecot > You do not have push_notification_lua installed. > I think I'm missing something here but I can't figure it out. Please HELP! > > Sincerely, > John Lopena > > -- > > "Become a programmer - Lose your brain's virginity" Aki

3 2

masteruser can not select INBOX
by Ludwig Wieland 11 Apr '19

11 Apr '19

Hello, My Dovecot Master can login but not not select INBOX ! What's wrong ? best regards Luda 1) USER can select INBOX: OK --------------------------------------------------- telnet localhost imap Trying ::1... Connected to localhost. Escape character is '^]'. * OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE STARTTLS AUTH=CRAM-MD5 AUTH=DIGEST-MD5 AUTH=GSSAPI AUTH=PLAIN AUTH=LOGIN] Dovecot ready. a login test1 password a OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE SORT SORT=DISPLAY THREAD=REFERENCES THREAD=REFS THREAD=ORDEREDSUBJECT MULTIAPPEND URL-PARTIAL CATENATE UNSELECT CHILDREN NAMESPACE UIDPLUS LIST-EXTENDED I18NLEVEL=1 CONDSTORE QRESYNC ESEARCH ESORT SEARCHRES WITHIN CONTEXT=SEARCH LIST-STATUS BINARY MOVE SEARCH=FUZZY SPECIAL-USE COMPRESS=DEFLATE QUOTA ACL RIGHTS=texk] Logged in b select INBOX * FLAGS (\Answered \Flagged \Deleted \Seen \Draft) * OK [PERMANENTFLAGS (\Answered \Flagged \Deleted \Seen \Draft \*)] Flags permitted. * 5 EXISTS * 0 RECENT * OK [UNSEEN 1] First unseen. * OK [UIDVALIDITY 1328091893] UIDs valid * OK [UIDNEXT 6] Predicted next UID * OK [HIGHESTMODSEQ 11] Highest b OK [READ-WRITE] Select completed (0.000 + 0.000 secs). c logout * BYE Logging out c OK Logout completed. Connection closed by foreign host. 2) MASTER-USER can't select INBOX: ! --------------------------------------------------- admins$ telnet localhost imap Trying ::1... Connected to localhost. Escape character is '^]'. * OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE STARTTLS AUTH=CRAM-MD5 AUTH=DIGEST-MD5 AUTH=GSSAPI AUTH=PLAIN AUTH=LOGIN] Dovecot ready. a login test1*mailmaster password a OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE SORT SORT=DISPLAY THREAD=REFERENCES THREAD=REFS THREAD=ORDEREDSUBJECT MULTIAPPEND URL-PARTIAL CATENATE UNSELECT CHILDREN NAMESPACE UIDPLUS LIST-EXTENDED I18NLEVEL=1 CONDSTORE QRESYNC ESEARCH ESORT SEARCHRES WITHIN CONTEXT=SEARCH LIST-STATUS BINARY MOVE SEARCH=FUZZY SPECIAL-USE COMPRESS=DEFLATE QUOTA ACL RIGHTS=texk] Logged in b select INBOX b NO [SERVERBUG] Internal error occurred. Refer to server log for more information. [2019-04-09 08:20:46] (0.000 + 0.000 secs). c logout * BYE Logging out c OK Logout completed. Connection closed by foreign host. ---------------------------------------- An the Server Error log says: Apr 09 00:05:40 imap(pid 62335 user test1): Error: Opening INBOX failed: Mailbox doesn't exist: INBOX ---------------------------------------- admins$ doveconf -n # 2.2.24 (a82c823): /Library/Server/Mail/Config/dovecot/dovecot.conf # OS: Darwin 16.7.0 x86_64 hfs auth_master_user_separator = * auth_mechanisms = cram-md5 digest-md5 gssapi plain login apop auth_realms = xserver.mydomain.ch auth_socket_path = /var/run/dovecot/auth-userdb auth_username_format = %n debug_log_path = /Library/Logs/Mail/mail-debug.log default_internal_user = _dovecot default_login_user = _dovenull disable_plaintext_auth = no first_valid_gid = 6 first_valid_uid = 6 imap_id_log = * imap_id_send = "name" * "version" * imap_urlauth_submit_user = submit info_log_path = /Library/Logs/Mail/mail-info.log log_path = /Library/Logs/Mail/mail-err.log login_log_format_elements = user=<%u> method=%m rip=%r lip=%l mpid=%e %c mail_access_groups = mail mail_attribute_dict = file:/Library/Server/Mail/Data/attributes/attributes.dict mail_location = maildir:/Library/Server/Mail/Data/mail/%u mail_log_prefix = "%s(pid %p user %u): " mail_plugins = quota zlib acl fts fts_sk managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave mdbox_rotate_size = 200 M namespace acl-mailboxes { list = children location = maildir:/Library/Server/Mail/Data/mail/users/%%u:INDEX=/Library/Server/Mail/Data/mail/shared/%%u prefix = shared.%%u. separator = . subscriptions = no type = shared } namespace inbox { inbox = yes location = mailbox "Deleted Messages" { special_use = \Trash } mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } namespace list-archives { list = children location = maildir:/Library/Server/Mail/Data/listserver/messages/archive/lists/%%u:INDEX=/Library/Server/Mail/Data/listserver/messages/archive/shared/%%u prefix = archives.%%u. separator = . subscriptions = no type = shared } passdb { args = /Library/Server/Mail/Config/dovecot/master-users driver = passwd-file master = yes pass = yes } passdb { driver = od } passdb { args = /Library/Server/Mail/Config/dovecot/submit.passdb driver = passwd-file } plugin { acl = vfile:/Library/Server/Mail/Config/dovecot/global-acls:cache_secs=300 acl_shared_dict = file:/Library/Server/Mail/Data/shared/shared-mailboxes fts = sk quota = maildir:User quota quota_warning = storage=100%% quota-exceeded %u quota_warning2 = storage=80%% quota-warning %u sieve = /Library/Server/Mail/Data/rules/%u/dovecot.sieve sieve_dir = /Library/Server/Mail/Data/rules/%u stats_refresh = 30 secs stats_track_cmds = yes } postmaster_address = postmaster(a)xserver.myserver.ch protocols = imap pop3 lmtp sieve quota_full_tempfail = yes service auth { idle_kill = 15 mins unix_listener auth-userdb { user = _dovecot } } service dns_client { unix_listener dns-client { mode = 0600 } } service imap-login { inet_listener imap { port = 143 } inet_listener imaps { port = 993 ssl = yes } service_count = 0 } service imap { client_limit = 5 process_limit = 200 service_count = 0 } service indexer-worker { user = _dovecot } service lmtp { unix_listener lmtp { mode = 0600 } } service managesieve-login { inet_listener sieve { port = 4190 } } service pop3-login { inet_listener pop3 { port = 110 } inet_listener pop3s { port = 995 ssl = yes } } service pop3 { client_limit = 5 process_limit = 200 service_count = 0 } service quota-exceeded { executable = script /Applications/Server.app/Contents/ServerRoot/usr/libexec/dovecot/quota-exceeded.sh unix_listener quota-exceeded { group = mail mode = 0660 user = _dovecot } user = _dovecot } service quota-warning { executable = script /Applications/Server.app/Contents/ServerRoot/usr/libexec/dovecot/quota-warning.sh unix_listener quota-warning { group = mail mode = 0660 user = _dovecot } user = _dovecot } service stats { fifo_listener stats-mail { mode = 0600 user = _dovecot } } ssl = required ssl_ca = </etc/certificates/myserver.ch.A9FFFFB4B4C0E4CA959917BC2F60BDECBC414D35.chain.pem ssl_cert = </etc/certificates/myserver.ch.A9FFFFB4B4C0E4CA959917BC2F60BDECBC414D35.cert.pem ssl_cipher_list = ALL:!LOW:!SSLv2:!EXP:!aNULL:!ADH:!eNULL ssl_key = </etc/certificates/myserver.ch.A9FFFFB4B4C0E4CA959917BC2F60BDECBC414D35.key.pem ssl_key_path = /etc/certificates/myserver.ch.A9FFFFB4B4C0E4CA959917BC2F60BDECBC414D35.key.pem ssl_protocols = !SSLv2 !SSLv3 userdb { args = partition=/Library/Server/Mail/Config/dovecot/partition_map.conf global_quota=0 enforce_quotas=yes driver = od } userdb { args = /Library/Server/Mail/Config/dovecot/submit.passdb driver = passwd-file } verbose_proctitle = yes protocol lmtp { mail_plugins = quota zlib acl fts fts_sk sieve } protocol lda { mail_plugins = quota zlib acl fts fts_sk sieve } protocol imap { mail_max_userip_connections = 20 mail_plugins = quota zlib acl fts fts_sk imap_acl imap_quota imap_zlib } protocol pop3 { mail_max_userip_connections = 6 }

3 8

Lua Push Notification Plugin
by Robust Coding 11 Apr '19

11 Apr '19

Hi Admin, I hope you consider reading and addressing my concern promptly. For the past few days I've been setting up a VPS with cPanel and WHM pre-installed on Bluehost. I want to enable push notification plugin in Dovecot2.3.5. I tried OX and Lua plugins and got errors. For using OX plugin: push_notification_driver = ox:url=http://staging.mydomain.com/mail-notify/v1 user_from_metadata And got this error on runtime: *Error: push-notification-ox: Skipped because unable to get attribute: Mailbox attributes not enabled* When using Lua: mail_plugins = $mail_plugins mail_lua notify push_notification push_notification_luaplugin { push_notification_driver = lua:file=/path/to/lua/push.lua} And got this order: *Plugin 'push_notification_lua' not found from directory /usr/lib64/dovecot* I think I'm missing something here but I can't figure it out. Please HELP! Sincerely, John Lopena -- *"Become a programmer - Lose your brain's virginity"*

2 1

ssl_cert: Can't open file permission denied
by Laura Smith 10 Apr '19

10 Apr '19

Dovecot 2.3.3 (dcead646b) openSUSE Leap 15.0 I am getting a weird error message: Fatal: Error in configuration file /etc/dovecot/local.conf line 16: ssl_cert: Can't open file /etc/foobar/ssl/certbot.pem: Permission denied I have tried the following: - chmod -R 655 /etc/foobar/ssl (/etc/foobar is 755) - create "ssl_users" group add dovecot to it chown -R dovecot:ssl_users /etc/foobar/ssl How can I fix this ? There's no obvious solution ?

5 7

/var/run/dovecot/stats-writer) failed: Permission denied
by ＠lbutlr 10 Apr '19

10 Apr '19

I am getting this error in logs net_connect_unix(/var/run/dovecot/stats-writer) failed: Permission den)) and I looked around the google results and it seems to be related to using service stats, which I am not using. # doveconf -n | grep stat # doveconf -n | head -3 # 2.3.5.1 (7ec6d0ade): /usr/local/etc/dovecot/dovecot.conf # Pigeonhole version 0.5.5 (2483b085) # OS: FreeBSD 11.2-RELEASE-p4 i386 Postfix is 3.4-20190106 (the newest version in ports) -- Over 3,500 gay marriages and, what, no hellfire? I was promise hellfire. And riots. What gives? -- Mark Morford

4 12

Restoring mailboxes from backup duplicates messages in POP clients
by Luis F. V. Gomes 10 Apr '19

10 Apr '19

Hello I had a disk problem and had to reformat it. All mailboxes were backed up using rsync. After I restored the mailboxes, the POP clients (Thunderbird) that were configured to leave the messages on the mailserver for, let's say, 30 days, didn't understand that some messages were already transfered and the users got duplicated messages in their Inbox. How can we avoid this? -- Thanks Luís F. Gomes IT Manager (55)(21) 3527-1220 Departamento de Engenharia Elétrica PUC-Rio R. Marques de S. Vicente 225/401L 22451-900 - Rio de Janeiro/RJ

3 4

protocols: Unknown protocol: sieve
by luckydog xf 10 Apr '19

10 Apr '19

Hi, list, I downloaded dovecot-2.3-pigeonhole-0.5.5.tar.gz and installed it, after I enabled #/etc/dovecot/conf.d/20-managesieve.conf protocols = $protocols sieve it said " protocols: Unknown protocol: sieve" What's wrong?" Thanks,

3 2

sieve match ANY header
by Shawn Heisey 10 Apr '19

10 Apr '19

I would like to create a sieve rule where I do a regex match on ALL headers, not a specific header. I've been trying to find out the proper syntax, but haven't found anything. Is this possible, and if so, how do I write it? Thanks, Shawn

4 6

Dovecot index compatibility
by Frido Otten 10 Apr '19

10 Apr '19

We're in the process of upgrading Dovecot from version 2.1.17 to 2.2.27 (package Debian Stretch). We have a shared NFS storage in use by multiple servers without Dovecot director. I've tested by connecting to IMAP on the new server to my own mailbox. This isn't a problem. But when the server with the Dovecot version 2.1.17 LDA drops a new message in my mailbox it thinks the index file is corrupted, and the message bounces to it's sender. So there must be a index compatibility issue between both versions. This is still no problem if I upgrade the entire platform in a maintenance window at once. But what I want is a rollback possibility. To which minimal Dovecot version should I upgrade the old platform to create this rollback possibility. I was looking for a table of dovecot index compatibility between the different versions (forward and backward), but couldn't find it. Is there any? Please advice. Best regards, Frido

1 0

dict: Error: Fatal error in defaults handling. Program aborted
by Hugo Manuel Ojendiz Lemus 10 Apr '19

10 Apr '19

Good day to everyone Currently, I'm trying to implement the sieve "vacation" plugin with the sieve "Extdata" plugin to lookup information from a MySQL remote server. I'm following the instructions in the documentation: https://wiki2.dovecot.org/Pigeonhole/Sieve/Plugins/Extdata ===== I have the following error === Apr 09 13:46:51 mail dovecot[5512]: dict: Error: Fatal error in defaults handling. Program aborted Apr 09 13:46:51 mail dovecot[5512]: lmtp(usrx(a)themail.com)<5539><PNwlBJvorFyjFQAAYWwSRA:2>: Warning: sieve: before: line 18: extdata: failed to lookup value `reply_enabled': Connection closed (reply took 0.016 secs (0.017 in dict wait, 0.000 in other ioloops, 0.000 in locks, async-id reply 0.001 secs ago)) Apr 09 13:46:51 mail dovecot[5512]: dict: Fatal: master: service(dict): child 5542 killed with signal 11 (core dumps disabled - https://dovecot.org/bugreport.html#coredumps) Apr 09 13:46:51 mail.halmex.com.mx dovecot[5512]: dict: Error: Fatal error in defaults handling. Program aborted ============================ ====== Dovecot Information ====== 2.3.5.1 (7ec6d0ade): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.5 (2483b085) # OS: Linux 3.10.0-514.16.1.el7.x86_64 x86_64 CentOS Linux release 7.3.1611 (Core) xfs doveconf: Warning: please set ssl_dh=</etc/dovecot/dh.pem doveconf: Warning: You can generate it with: dd if=/var/lib/dovecot/ssl-parameters.dat bs=1 skip=88 | openssl dhparam -inform der > /etc/dovecot/dh.pem dict { sieve = mysql:/etc/dovecot/pigeonhole-sieve.dict } log_timestamp = "%Y-%m-%d %H:%M:%S " mail_location = maildir:/var/vmail/%d/%Ln managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext namespace inbox { inbox = yes location = prefix = separator = . type = private } passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } plugin { pop3_migration_mailbox = imapc: sieve_extdata_dict_uri = proxy::sieve sieve_global_extensions = +vnd.dovecot.extdata sieve_plugins = sieve_extdata sieve_vacation_send_from_recipient = yes sieve_before = /var/lib/dovecot/before.sieve } pop3c_host = mail.halmex.com.mx service auth-worker { user = root } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } unix_listener auth-master { mode = 0600 user = vmail } user = root } service dict { unix_listener dict { group = vmail mode = 0600 user = vmail } } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } userdb { args = uid=5000 gid=5000 home=/var/vmail/%d/%Ln allow_all_users=yes driver = static } protocol pop3 { disable_plaintext_auth = no } protocol doveadm { mail_plugins = " pop3_migration" } protocol lmtp { mail_plugins = " sieve" } ============================ An important bit of information it's that the dict service was trying to read the /etc/my.cnf file, but SELinux prevent it, and the sieve script worked fine, once I solved the SELinux access problem, the errors began to appear. This is a postfix server working great for years, with a local MariaDB. The remote MySQL server its in the same LAN and Its reachable by the mail server and other servers, the account has access, and like Ive mention, before I gave access to the local /etc/my.cnf the sieve script worked fine (just the SELinux warnings). Looks like the dict service has problems with the local MariaDB configuration file, but in this scenario its not required Any information or help you can provide me would be greatly appreciated. Hugo Manuel Ojendiz Lemus Desarrollo | Recursos Humanos | HALMEX ((°J°))

2 1

Where to report (potential) Dovecot bugs
by Mark Moseley 10 Apr '19

10 Apr '19

I'm curious if this is still the right place to report potential bugs with Dovecot. Is there a Dovecot bug tracker somewhere?

2 2

LMTP, PAM session and home directory autocreating
by Ivars Strazdins 09 Apr '19

09 Apr '19

Hi, mail is delivered by Dovecot's lmtp locally and I need user's home directory to be created if it doesn't exist yet. There is a setting in Dovecot's configuration, "session=yes", in /etc/Dovecot/conf.d/auth-system.conf.ext, which should do that. passdb { driver = pam args = session=yes dovecot } But I think it does not work in my setup because I do not see any PAM log entry for Dovecot when this error happens: Apr 9 13:01:55 mailhost dovecot: lmtp(2935): Connect from local Apr 9 13:01:55 mailhost dovecot: lmtp(2935, testuser): Error: User initialization failed: Namespace '': mkdir(/home/testuser/Maildir) failed: Permission denied (euid=174000327(testuser) egid=174000327(testuser ) missing +w perm: /home, dir owned by 0:0 mode=0755) Apr 9 13:01:55 mailhost dovecot: lmtp(2935): Disconnect from local: Successful quit The error above seems expected, because it is not lmtp agent's job to create user's home directory but pam_oddjob_mkhomedir.so module should do that. Right? And there are log entries every PAM user session: Apr 9 13:24:42 mailhost auth: pam_sss(dovecot:auth): authentication success; logname= uid=0 euid=0 tty=dovecot ruser=validuser rhost=::1 user= validuser Apr 9 13:24:42 mailhost auth: pam_unix(dovecot:session): session opened for user validuser by (uid=0) Apr 9 13:24:42 mailhost auth: pam_unix(dovecot:session): session closed for user validuser I ask for help how to debug this problem and find out why Dovecot does not open PAM session or - if I am wrong and it does, then what else is going wrong. Home directory autocreation is configured with command "authconfig --enablemkhomedir --update" and it works if user logs into system manually. I tried to enable "mail_debug" in Dovecot's settings, but it did not give me any more information on PAM session. Running on Centos 7.6, with Dovecot 2.2.36. I sort of remember this was working 2 years ago when I enabled "session=yes" but something has changed along the way with all the Centos updates. Thank you very much in advance for your time. Ivars /etc/pam.d/dovecot #%PAM-1.0 auth required pam_nologin.so auth include password-auth account include password-auth session include password-auth /etc/pam.d/password-auth #%PAM-1.0 # This file is auto-generated. # User changes will be destroyed the next time authconfig is run. auth required pam_env.so auth [default=1 success=ok] pam_localuser.so auth [success=done ignore=ignore default=die] pam_unix.so nullok try_first_pass auth requisite pam_succeed_if.so uid >= 1000 quiet_success auth sufficient pam_sss.so forward_pass auth required pam_deny.so account required pam_unix.so account sufficient pam_localuser.so account sufficient pam_succeed_if.so uid < 1000 quiet account [default=bad success=ok user_unknown=ignore] pam_sss.so account required pam_permit.so password requisite pam_pwquality.so try_first_pass local_users_only retry=3 authtok_type= password sufficient pam_unix.so sha512 shadow nullok try_first_pass use_authtok password sufficient pam_sss.so use_authtok password required pam_deny.so session optional pam_keyinit.so revoke session required pam_limits.so -session optional pam_systemd.so session optional pam_oddjob_mkhomedir.so umask=0077 session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid session required pam_unix.so session optional pam_sss.so doveconf -n # 2.2.36 (1f10bfa63): /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.24 (124e06aa) # OS: Linux 3.10.0-957.10.1.el7.x86_64 x86_64 CentOS Linux release 7.6.1810 (Core) # Hostname: mailhost.example.com auth_mechanisms = plain login auth_socket_path = /var/run/dovecot/auth-master auth_username_format = %Ln auth_verbose = yes default_client_limit = 3500 default_process_limit = 500 disable_plaintext_auth = no first_valid_uid = 203 imap_client_workarounds = tb-lsub-flags tb-extra-mailbox-sep lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes lmtp_save_to_detail_mailbox = yes mail_location = maildir:~/Maildir:INBOX=~/Maildir:LAYOUT=fs mail_plugins = " fts fts_lucene" mail_privileged_group = mail maildir_very_dirty_syncs = yes managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext imapsieve vnd.dovecot.imapsieve mbox_write_locks = fcntl namespace inbox { inbox = yes list = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk { auto = subscribe special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Messages" { auto = subscribe special_use = \Sent } mailbox Trash { auto = subscribe special_use = \Trash } prefix = separator = / type = private } passdb { args = session=yes dovecot driver = pam } plugin { autocreate = Junk autocreate2 = Sent autocreate3 = Drafts autocreate4 = Trash autosubscribe = Junk autosubscribe2 = Sent autosubscribe3 = Drafts autosubscribe4 = Trash fts = lucene fts_lucene = whitespace_chars=@. imapsieve_mailbox1_before = file:/usr/lib64/dovecot/sieve/report-spam.sieve imapsieve_mailbox1_causes = COPY imapsieve_mailbox1_name = Junk imapsieve_mailbox2_before = file:/usr/lib64/dovecot/sieve/report-ham.sieve imapsieve_mailbox2_causes = COPY imapsieve_mailbox2_from = Junk imapsieve_mailbox2_name = * sieve = file:~/sieve;active=~/roundcube.sieve sieve_before = /var/lib/sieve/junk.sieve sieve_global_extensions = +vnd.dovecot.pipe +vnd.dovecot.environment sieve_pipe_bin_dir = /usr/lib64/dovecot/sieve sieve_plugins = sieve_imapsieve sieve_extprograms } pop3_client_workarounds = outlook-no-nuls oe-ns-eoh pop3_uidl_format = %v.%u protocols = imap pop3 lmtp sieve service auth { unix_listener /var/spool/postfix/private/dovecot-auth { group = postfix mode = 0660 user = postfix } unix_listener auth-master { group = user mode = 0660 user = root } } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } ssl_cert = </etc/letsencrypt/live/webmail.example.com/fullchain.pem ssl_key = # hidden, use -P to show it syslog_facility = local0 userdb { driver = passwd } valid_chroot_dirs = /var/mail:/home protocol lmtp { mail_fsync = never mail_plugins = " fts fts_lucene sieve" postmaster_address = postmaster(a)example.com } protocol lda { mail_fsync = never mail_plugins = " fts fts_lucene sieve expire" } protocol imap { mail_max_userip_connections = 25 mail_plugins = " fts fts_lucene fts fts_squat expire imap_sieve" } protocol sieve { managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date } protocol pop3 { mail_max_userip_connections = 20 mail_plugins = " fts fts_lucene fts fts_squat expire" }

1 0

Problem with filter forwarded messages when using director proxy
by Ted 09 Apr '19

09 Apr '19

Hey there, I've been able to switch our mailservers over to using director to proxy logins and received email to the backend servers which store email on a shared NFS mount. Before I did this we were having trouble with the indexes running into errors because multiple servers accessing and modifying the dovecot.index files at the same time. I'm still seeing a small amount of this, and tracing it through it appears that when an account uses a filter to forward email to another address within our mail system, it recognises that it is a local email address it is responsible for and saves the message locally despite the fact that it is not the director specified server for the recipient address. As an example, lets say that test1(a)example.com is currently pointed to the 01 backend server by director, and test2(a)example.com to 02. If a filter at test1 forwards email to test2, then when an email for test1 comes in the director porxy will direct it to the 01 backend server, and when the message is saved the filter will run to forward it, and the 01 server will recognise that it is also responsible for test2 and so 01 will save the message for test2 rather than 02, as per director. This is causing a smallish number of clashes which I'd like to get cleaned up. I've tried getting the server to send through a relay but if it recognises the account as local it will not use the relay to send the email. Has anyone run into anything like this or have any ideas about how to approach the problem? Thank you Ted easyDNS Technologies

1 0

Editing fail2ban page?
by Mauricio Tavares 09 Apr '19

09 Apr '19

In https://wiki.dovecot.org/HowTo/Fail2Ban, for a current (I know for a fact in 2.2.36) I believe it should be filter = dovecot instead of filter = dovecot-pop3imap [root@mail ~]# ls -l /etc/fail2ban/filter.d/doveco* -rw-r--r-- 1 root root 1875 May 11 2017 /etc/fail2ban/filter.d/dovecot.conf [root@mail ~]#

2 1

dovecot[30008]: auth-worker: Fatal: master: service(auth-worker): child 31074 killed with signal 11
by Herbert 09 Apr '19

09 Apr '19

Hi Since a recent DNF update, I see many log file entries like the following: Apr 08 16:16:36 udoo.symmetrix.ch audit[31074]: ANOM_ABEND auid=4294967295 uid=0 gid=0 ses=4294967295 subj=system_u:system_r:dovecot_auth_t:s0 pid=31074 comm="auth" exe="/usr/libexec/dovecot/auth" sig=11 res=1 Apr 08 16:16:36 udoo.symmetrix.ch kernel: traps: auth[31074] general protection fault ip:7ff45b5f98a7 sp:7fff0df96830 error:0 in libmariadb.so.3[7ff45b5d7000+46000] Apr 08 16:16:36 udoo.symmetrix.ch dovecot[30008]: auth-worker: Fatal: master: service(auth-worker): child 31074 killed with signal 11 (core not dumped - https://dovecot.org/bugreport.html#coredumps) Apr 08 16:16:38 udoo.symmetrix.ch abrt-dump-journal-oops[1139]: abrt-dump-journal-oops: Found oopses: 1 Apr 08 16:16:38 udoo.symmetrix.ch abrt-dump-journal-oops[1139]: abrt-dump-journal-oops: Creating problem directories Apr 08 16:16:39 udoo.symmetrix.ch abrt-dump-journal-oops[1139]: Reported 1 kernel oopses to Abrt Apr 08 16:16:39 udoo.symmetrix.ch abrt-server[31104]: Can't find a meaningful backtrace for hashing in '.' Apr 08 16:16:39 udoo.symmetrix.ch abrt-server[31104]: Option 'DropNotReportableOopses' is not configured Apr 08 16:16:39 udoo.symmetrix.ch abrt-server[31104]: Preserving oops '.' because DropNotReportableOopses is 'no' Apr 08 16:16:39 udoo.symmetrix.ch dbus-daemon[1022]: [system] Activating service name='org.freedesktop.problems' requested by ':1.779' (uid=0 pid=31122 comm="/usr/bin/python3 /usr/bin/abrt-action-notify -d /v" label="system_u:system_r:abrt_t:s0-s0:c0.c1023") (using servicehelper) Apr 08 16:16:40 udoo.symmetrix.ch dbus-daemon[1022]: [system] Successfully activated service 'org.freedesktop.problems' Apr 08 16:16:40 udoo.symmetrix.ch abrt-notification[31129]: System encountered a non-fatal error in ??() # uname -a Linux udoo.symmetrix.ch 5.0.5-100.fc28.x86_64 #1 SMP Wed Mar 27 22:16:29 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux # dovecot --version 2.3.5 (513208660) # mysql --version mysql Ver 15.1 Distrib 10.2.22-MariaDB, for Linux (x86_64) using readline 5.1 Unfortunately I didn't manage to get a core dump, sorry. Kind regards, Herbert

2 1

Re: SMTPUTF8 support
by David Bürgin 08 Apr '19

08 Apr '19

André, are you quite sure you have it working? In this thread someone from Open-Xchange stated that no, Dovecot doesn’t have SMTPUTF8 support implemented, and the same response was given by another Dovecot developer last September (it ‘is being considered’ was the answer then, see https://dovecot.org/pipermail/dovecot/2018-September/112887.html) I am using LMTP to deliver mail to Dovecot from Postfix, and delivery fails with Postfix reporting: ‘SMTPUTF8 is required, but was not offered by host mail.my.org[private/dovecot-lmtp]’. I doubt that this can work without a change in Dovecot LMTP. Anyway, I am also interested in SMTPUTF8 support, so +1 from me! -- David

6 10

OpenFTS
by Cerebus 05 Apr '19

05 Apr '19

All the discussion on FTS reminds me, is there any plan to support OpenFTS in dovecot or is there a reason preventing that? -- This is my signature. There are many like it, but this one is mine.

2 1

SMTPUTF8 support
by sylvhem＠lepubdelobservateur.fr 05 Apr '19

05 Apr '19

Hi, I'm currently trying to set up SMTPUTF8 on my mail stack, but I can't find any information on Dovecot's RFC 6531 support. Has it been implemented yet? If so, does anyone know how to activate it? Regards. -- Sylvhem

4 5

Solr connection timeout hardwired to 60s
by Peter Mogensen 05 Apr '19

05 Apr '19

Hi, What's the recommended way to handling timeouts on large mailboxes given the hardwired request timeout of 60s in solr-connection.c: http_set.request_timeout_msecs = 60*1000; /Peter

5 5

doveadm backup + ISO 8859-1 mailbox name
by Michael Goth 04 Apr '19

04 Apr '19

Hi! I'm trying to migrate a mailbox from an old IMAP server (not Dovecot) to a new Dovecot server with 'doveadm backup'. The command fails because of an unexpected character in a mailbox name: doveadm -o imapc_user=ag(a)example.org \ -o imapc_password=XXX \ -o imapc_host=old-mailserver.webflow.de \ -o imapc_port=993 \ -o imapc_ssl=imaps \ -o imapc_ssl_verify=no \ -o imapc_features=rfc822.size,fetch-headers \ -o ssl_client_ca_dir=/etc/ssl \ backup -R -f -x ~* -u migration-ag(a)example.org imapc: dsync(migration-ag(a)example.org): Info: imapc(old-mailserver.webflow.de:993): Connected to 1.1.1.1:993 (local 2.2.2.2:46154) dsync(migration-ag(a)example.org): Error: Failed to access mailbox Entw?rfe: mailbox does not exist The problem is with "Entw?rfe" here. It's actually Entw<0xfc>rfe, which translates to "Entwürfe" in ISO-8859-1. Why can't doveadm find that mailbox? Is the old mailserver misbehaving (I hope not because I have no idea how to change that...), or does this happen on the new server? Can I tell doveadm something that makes this work? Thank you Michael -- Michael Goth .webflow GmbH Geschäftsführer: Andreas Schrei Wasserburger Straße 4 D - 83352 Altenmarkt a. d. Alz Amtsgericht Traunstein HRB 18537 E-Mail: mg(a)webflow.de Tel: +49 (0) 8621 - 99989 - 26 Fax: +49 (0) 8621 - 99989 - 28 Web: www.webflow.de

3 3

Autosubscribe to public folder
by Рустам 04 Apr '19

04 Apr '19

Hello everyone! I am trying to migrate from Dovecot 1.2 to Dovecot 2.2 and I can`t find information how to subscribe all users to public folder. In Dovecot 1.2 I have a few strings kind of "autosubscribeX = Public.Documents" and every users get subscribed to this Public folders and can`t unsubscribe. This is a goal. Is any posibility to make the same in Dovecot 2.2 or each user have to susbscribe to public folders themselves and this is kind of policy of Dovecot 2.2? -- С уважением, Рустам Багов.

2 1