- dovecot - dovecot.org

Dovecot on Debian Stretch with AppArmor
by Andre Rodier 16 Mar '18

16 Mar '18

Hello all, I am using dovecot on Debian stretch, with AppArmor, and I have this audit log: Mar 16 11:25:10 mail kernel: audit: type=1400 audit(1521199510.705:580): apparmor="DENIED" operation="file_mmap" info="Failed name lookup - disconnected path" error=-13 profile="/usr/lib/dovecot/auth" name="var/cache/nscd/hosts" pid=26797 comm="auth" requested_mask="r" denied_mask="r" fsuid=0 ouid=0 With 'name="var/cache/nscd/hosts"', is there any missing '/' at the beginning of the path, somewhere? The version is: 1:2.2.27-3+deb9u2 Thanks for your advices, André Rodier. -- https://github.com/progmaticltd/homebox

2 1

per-user virtual mailboxes
by unknown＠example.com 16 Mar '18

16 Mar '18

Have given up on getting the global virtual config for now, and am trying to setup the virtual mailboxes for just my user account. Basically, it's behaving exactly as it did when I was trying to use a global config. This, and the lack of errors, is causing me to think that it is something odd in my install as opposed to a configuration issue (full doveconf -n at end) mail_location = maildir:~/Maildir mail_plugins = " virtual" namespace { location = virtual:~/Maildir/virtual:LAYOUT=maildir++ prefix = virtual. separator = . } # ldd `which dovecot` /usr/local/sbin//dovecot: libdovecot.so.0 => /usr/local/lib/dovecot/libdovecot.so.0 (0x28085000) libc.so.7 => /lib/libc.so.7 (0x28184000) # cd ~kremels/Maildir # ls -lsR virtual/ total 24 8 drwxr-xr-x 2 kremels kremels 512 Mar 16 14:40 .day 8 drwxr-xr-x 2 kremels kremels 512 Mar 16 14:40 .month 8 drwxr-xr-x 2 kremels kremels 512 Mar 16 14:40 .unread virtual/.day: total 16 8 -rwxr-xr-x 1 kremels kremels 62 Mar 16 14:15 dovecot-vitual 8 -rwxr-xr-x 1 kremels kremels 392 Mar 13 07:12 dovecot.index.log virtual/.month: total 8 8 -rwxr-xr-x 1 kremels kremels 66 Mar 16 14:15 dovecot-vitual virtual/.unread: total 16 8 -rwxr-xr-x 1 kremels kremels 11 Mar 16 14:15 dovecot-vitual 8 -rwxr-xr-x 1 kremels kremels 256 Mar 16 14:42 dovecot.index.log # doveadm search mailbox "virtual.unread" -u kremels (nothing) # cat .virtual.unread/dovecot-vitual # ~/Maildir/virtual/.day/dovecot-virtual * unseen # doveadm mailbox list -u kremels | grep virt virtual.unread virtual.month virtual.day virtual # Again, the "virtual" mailbox shows up, it contains three mailboxes (day, month, unread), and all are empty. I've added :LAYOUT=maildir++ in the location but I also tried using the "fs" layout and just creating folders under ~/Maildir/virtual, but results where the same. I've read https://wiki2.dovecot.org/Plugins/Virtual many times and I feel I must be missing something, but no idea what and with no errors it's proving impossible for me to figure it out. full conf: # doveconf -n # 2.2.34 (874deae): /usr/local/etc/dovecot/dovecot.conf # Pigeonhole version 0.4.22 (22940fb7) # OS: FreeBSD 11.1-RELEASE-p4 i386 # Hostname: mail.covisp.net auth_failure_delay = 5 secs auth_mechanisms = PLAIN LOGIN default_client_limit = 4096 default_process_limit = 1024 default_vsz_limit = 768 M disable_plaintext_auth = no first_valid_uid = 89 imap_id_log = * lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes log_path = /var/log/dovecot login_log_format_elements = user=<%u> %r %m %c mail_location = maildir:~/Maildir mail_max_userip_connections = 90 mail_plugins = " virtual" managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext imapsieve vnd.dovecot.imapsieve namespace { location = virtual:~/Maildir/virtual:LAYOUT=maildir++ prefix = virtual. separator = . } namespace inbox { inbox = yes location = mailbox Archive { auto = subscribe special_use = \Archive } mailbox Drafts { special_use = \Drafts } mailbox Junk { auto = subscribe special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { driver = pam username_filter = !*@* } passdb { args = /usr/local/etc/dovecot/dovecot-sql.conf.ext driver = sql } plugin { imapsieve_mailbox1_before = file:/usr/lib/dovecot/sieve/report-spam.sieve imapsieve_mailbox1_causes = COPY imapsieve_mailbox1_name = Junk imapsieve_mailbox2_before = file:/usr/lib/dovecot/sieve/report-ham.sieve imapsieve_mailbox2_causes = COPY imapsieve_mailbox2_from = Junk imapsieve_mailbox2_name = * sieve_global_extensions = +vnd.dovecot.pipe +vnd.dovecot.environment sieve_pipe_bin_dir = /usr/lib/dovecot/sieve sieve_plugins = sieve_imapsieve sieve_extprograms } protocols = imap pop3 service auth { unix_listener /var/spool/postfix/private/auth { mode = 0666 } } service imap-login { inet_listener imaps { port = 993 ssl = yes } } service pop3-login { inet_listener pop3 { port = 0 } inet_listener pop3s { port = 995 ssl = yes } } ssl_cert = </usr/local/etc/dehydrated/certs/covisp.net/fullchain.pem ssl_key = # hidden, use -P to show it userdb { driver = passwd } userdb { args = /usr/local/etc/dovecot/dovecot-sql.conf.ext default_fields = uid=vpopmail gid=vchkpw mail_location=/usr/local/virtual/%u mail=maildir:/usr/local/virtual/%u driver = sql } protocol imap { mail_plugins = " virtual imap_sieve" }

1 0

Sieve not working.
by Jungersen, Danjel - Jungersen Grafisk ApS 15 Mar '18

15 Mar '18

2 3

Disable SIS
by Nick Rosier 15 Mar '18

15 Mar '18

Hi, I'm currently running a small home-server with Dovecot. A long time ago I configured it with SIS enabled. I would like to stop using SIS. If I remove sis from mail_attachment_fs will the old mails that are stored in SIS-storage still be accessible? How can I convert all mailboxes to stop using SIS and store attachments back in the mails? Rgds, N.

3 6

Re: Argon2i support in CE packages
by Grégory Oestreicher 15 Mar '18

15 Mar '18

(Messed up the reply on my mobile, re-sending) Hi Aki, Le Mercredi 14 mars 2018, Aki Tuomi a écrit : > Which operating system is this? Damn, I forgot the most important information, my apologies. I'm using the Debian Stretch CE repository. Cheers, Grégory

2 2

Argon2i support in CE packages
by Grégory Oestreicher 14 Mar '18

14 Mar '18

Hi All, I've been experimenting with the Argon2i password scheme in a local setup, backed by a LDAP server, and Dovecot 2.3.0.1 can't authenticate my users for now. On the LDAP side the user passwords start with {ARGON2I} (and I can authenticate fine to the LDAP server), but it seems that the CE packages are compiled without libsodium. Is that correct? Is at this time the only alternative to recompile Dovecot myself, or are there plans to compile CE packages with libsodium? Cheers, Grégory

2 1

Re: quota-status: Issues with uppercase recipient address
by Christoph Lukas 14 Mar '18

14 Mar '18

Am 10.03.2018 um 12:20 schrieb Aki Tuomi: > Change mail_location too > > > --- > Aki Tuomi > Dovecot oy That did it! Thank you very much! Best regards, Christoph

3 4

Virtual Mailboxes redux
by ＠lbutlr 13 Mar '18

13 Mar '18

I’ve created virtual mailboxes in dovecot, and they show up in various clients, but the folders contain no messages. (I will get an ‘empty” folder icon named “@virtual” and an empty folder icon named “month” inside it. Is there a way I can verify what dovecot THINKS should be in the virtual folder via doveadm? <https://www.dropbox.com/s/hd4wnjrs3y5iswi/Screenshot%202018-03-06%2011.38.2…> # cat /usr/local/etc/dovecot/virtual/month/dovecot-vitual # ~/Maildir/virtual/month/dovecot-virtual * all younger 2678400 # doveconf -n # 2.2.33.2 (d6601f4ec): /usr/local/etc/dovecot/dovecot.conf # Pigeonhole version 0.4.21 (92477967) # OS: FreeBSD 11.1-RELEASE-p4 i386 auth_failure_delay = 5 secs auth_mechanisms = PLAIN LOGIN default_client_limit = 4096 default_process_limit = 1024 default_vsz_limit = 768 M disable_plaintext_auth = no first_valid_uid = 89 imap_id_log = * lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes login_log_format_elements = user=<%u> %r %m %c mail_location = maildir:~/Maildir mail_max_userip_connections = 90 mail_plugins = " virtual" managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext imapsieve vnd.dovecot.imapsieve namespace { location = virtual:/usr/local/etc/dovecot/virtual:INDEX=~/Maildir/virtual:CONTROL=~/Maildir/virtual prefix = @virtual. separator = . } namespace inbox { inbox = yes location = mailbox Archive { auto = subscribe special_use = \Archive } mailbox Drafts { special_use = \Drafts } mailbox Junk { auto = subscribe special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { driver = pam username_filter = !*@* } passdb { args = /usr/local/etc/dovecot/dovecot-sql.conf.ext driver = sql } plugin { imapsieve_mailbox1_before = file:/usr/lib/dovecot/sieve/report-spam.sieve imapsieve_mailbox1_causes = COPY imapsieve_mailbox1_name = Junk imapsieve_mailbox2_before = file:/usr/lib/dovecot/sieve/report-ham.sieve imapsieve_mailbox2_causes = COPY imapsieve_mailbox2_from = Junk imapsieve_mailbox2_name = * sieve_global_extensions = +vnd.dovecot.pipe +vnd.dovecot.environment sieve_pipe_bin_dir = /usr/lib/dovecot/sieve sieve_plugins = sieve_imapsieve sieve_extprograms } protocols = imap pop3 service auth { unix_listener /var/spool/postfix/private/auth { mode = 0666 } } service imap-login { inet_listener imaps { port = 993 ssl = yes } } service pop3-login { inet_listener pop3 { port = 0 } inet_listener pop3s { port = 995 ssl = yes } } ssl_cert = </path/to/fullchain.pem ssl_key = # hidden, use -P to show it ssl_protocols = !SSLv2 !SSLv3 userdb { driver = passwd } userdb { args = /usr/local/etc/dovecot/dovecot-sql.conf.ext default_fields = uid=vpopmail gid=vchkpw mail_location=/usr/local/virtual/%u mail=maildir:/usr/local/virtual/%u driver = sql } protocol imap { mail_plugins = " virtual imap_sieve" }

5 8

Assertion during dsync receive
by Ian Bobbitt 13 Mar '18

13 Mar '18

Hi, I'm getting an assertion failed on the receiving side, causing syncs to fail for one user. The servers are setup so that only one is receiving any traffic other than replication at any time. The one that's only receiving replications is the one that's failing. I've tried deleting the user's home on the receiving server, but it still crashes during the sync. Oddly, the user's home is 7.4G on the sending server, but ends up at 42G on the receiving side, even after deleting and trying a fresh sync. The mailbox implicated in the backtrace ("Spam") does have a very large number of messages in it. On sender: Spam messages=1217764 recent=0 uidnext=1218103 uidvalidity=1379509105 unseen=16 highestmodseq=744588 vsize=34468460093 guid=090ed93a7a055559abf10200fdf6807a firstsaved=1498744186 On receiver: Spam messages=1217766 recent=352 uidnext=1218105 uidvalidity=1379509105 unseen=16 highestmodseq=744589 vsize=34468496809 guid=090ed93a7a055559abf10200fdf6807a firstsaved=1519396172 Feb 23 14:57:20 dovecot: dsync-local(bgeels): Warning: fscking index file /gnoc/mail/home/bgeels/mail/storage/dovecot.map.index Feb 23 14:57:20 dovecot: dsync-local(bgeels): Warning: mdbox /gnoc/mail/home/bgeels/mail/storage: rebuilding indexes Feb 23 14:57:33 dovecot: dsync-local(bgeels): Panic: file mail-index-util.c: line 10 (mail_index_uint32_to_offset): assertion failed: (offset < 0x40000000) Feb 23 14:57:33 dovecot: dsync-local(bgeels): Error: Raw backtrace: /usr/lib64/dovecot/libdovecot.so.0(+0x9f3de) [0x7feb584143de] -> /usr/lib64/dovecot/libdovecot.so.0(+0x9f4be) [0x7feb584144be] -> /usr/lib64/dovecot/libdovecot.so.0(i_fatal+0) [0x7feb583a577c] -> /usr/lib64/dovecot/libdovecot-storage.so.0(mail_index_uint32_to_offset+0xa0) [0x7feb587906d0] -> /usr/lib64/dovecot/libdovecot-storage.so.0(mail_cache_compress+0x854) [0x7feb58774f34] -> /usr/lib64/dovecot/libdovecot-storage.so.0(mail_index_sync_commit+0x25f) [0x7feb587884ff] -> /usr/lib64/dovecot/libdovecot-storage.so.0(mdbox_storage_rebuild_in_context+0x10de) [0x7feb5870b3ae] -> /usr/lib64/dovecot/libdovecot-storage.so.0(mdbox_sync_begin+0x858) [0x7feb5870ccd8] -> /usr/lib64/dovecot/libdovecot-storage.so.0(mdbox_sync+0x4c) [0x7feb5870ce7c] -> /usr/lib64/dovecot/libdovecot-storage.so.0(mdbox_storage_sync_init+0x4b) [0x7feb5870cf3b] -> /usr/lib64/dovecot/libdovecot-storage.so.0(mailbox_sync_init+0x44) [0x7feb586f2834] -> /usr/lib64/dovecot/libdovecot-storage.so.0(mailbox_sync+0x37) [0x7feb586f28d7] -> dovecot/doveadm-server(dsync_mailbox_import_deinit+0x475) [0x445495] -> dovecot/doveadm-server() [0x43edc0] -> dovecot/doveadm-server(dsync_brain_sync_mails+0x743) [0x43f653] -> dovecot/doveadm-server(dsync_brain_run+0x541) [0x43acf1] -> dovecot/doveadm-server() [0x43b070] -> dovecot/doveadm-server() [0x44fe5f] -> /usr/lib64/dovecot/libdovecot.so.0(io_loop_call_io+0x52) [0x7feb58429cd2] -> /usr/lib64/dovecot/libdovecot.so.0(io_loop_handler_run_internal+0x10f) [0x7feb5842b3bf] -> /usr/lib64/dovecot/libdovecot.so.0(io_loop_handler_run+0x3c) [0x7feb58429d6c] -> /usr/lib64/dovecot/libdovecot.so.0(io_loop_run+0x38) [0x7feb58429f28] -> dovecot/doveadm-server() [0x4209c5] -> dovecot/doveadm-server() [0x422df6] -> dovecot/doveadm-server() [0x4377f4] -> /usr/lib64/dovecot/libdovecot.so.0(io_loop_call_io+0x52) [0x7feb58429cd2] -> /usr/lib64/dovecot/libdovecot.so.0(io_loop_handler_run_internal+0x10f) [0x7feb5842b3bf] -> /usr/lib64/dovecot/libdovecot.so.0(io_loop_handler_run+0x3c) [0x7feb58429d6c] Feb 23 14:57:33 dsync-local(bgeels): Fatal: master: service(doveadm): child 82098 killed with signal 6 (core dumped) I've attached the output of `doveconf -n` and the full backtrace from a core dump. Dovecot 2.2.33.2 (GhettoForge package) CentOS 7 x86_64 XFS, no NFS. -- Ian

3 12

Extra intermediate certificate when using ssl_alt_cert
by Peter Linss 13 Mar '18

13 Mar '18

I just added an ECDSA certificate to my mail server using ssl_alt_cert (the RSA certificate is specified by ssl_cert), both certificate files contain the certificate and a single intermediate (which currently happens to be the same intermediate from Let’s Encrypt). When connecting to the server using either RSA or ECDSA ciphers, the server sends the proper certificate, but also sends two intermediates. Apparently it’s reading the intermediate from both files and using both for all situations, rather than using only the intermediate in the RSA file for RSA certificates, and the intermediate in the ECDSA file for ECDSA certificates. I expect this will be a bigger problem when Let’s Encrypt starts using ECDSA intermediates. Removing the intermediate from the ssl_alt_cert file solves the problem (but then doesn’t allow an ECDSA intermediate to be specified). Configuration: # 2.2.34 (874deae): /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.22 (22940fb7) # OS: Linux 4.14.17-x86_64-linode99 x86_64 Debian 9.3 ext4 # Hostname: [redacted] auth_mechanisms = plain login listen = [ipv4 redacted], [ipv6 redacted] mail_location = maildir:/var/mail/vhosts/%d/%n mail_privileged_group = mail namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } passdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } protocols = imap lmtp service auth-worker { user = vmail } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0666 user = postfix } unix_listener auth-userdb { mode = 0600 user = vmail } user = dovecot } service imap-login { inet_listener imap { port = 0 } inet_listener imaps { port = 993 ssl = yes } } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } ssl = required ssl_alt_cert = </etc/ssl/certs/mail.[redacted].ecdsa.pem ssl_alt_key = </etc/ssl/private/[redacted].ecdsa.key ssl_cert = </etc/ssl/certs/mail.[redacted].rsa.pem ssl_key = </etc/ssl/private/[redacted].rsa.key ssl_cipher_list = ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:DHE-RSA-AES256-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES256-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES128-SHA:kEDH+CAMELLIA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:AES:CAMELLIA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA:!DES-CBC3-SHA ssl_dh_parameters_length = 4096 ssl_prefer_server_ciphers = yes userdb { args = uid=vmail gid=vmail home=/var/vmail/vhosts/%d/%n driver = static } userdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap }

3 8

Re: dovecot sha512-crypt database storage
by David Mehler 12 Mar '18

12 Mar '18

Hi, Thanks. That query doesn't return any parse errors but it does say that it can't save the password. Any ideas? Thanks. Dave. On 3/10/18, David Mehler <dave.mehler(a)gmail.com> wrote: > Hello, > > Thanks. Trying that query adapted to my database table and getting an > error can not save password, any ideas? > > When you made your initial database tables how did you set up the > password field and in MySQL how did you make it? > > I'm trying to figure out what is different about your setup than mine. > > Thanks. > Dave. > > > On 3/10/18, Thore Bödecker <me(a)foxxx0.de> wrote: >> Hey, >> >> using the roundcube password plugin allows you to specify arbitrary >> statements for password_query. >> >> I'm using SHA512-CRYPT too and this is my $config['password_query']: >> >> "UPDATE vhostapi_prod.mail_accounts SET >> password=CONCAT(_utf8'{SHA512-CRYPT}',ENCRYPT(_utf8%p,CONCAT(_utf8'$6$', >> SUBSTRING(SHA(RAND()), -16)))) WHERE email=%u LIMIT 1" >> >> >> Cheers, >> Thore >> >> On 10.03.18 - 16:00, David Mehler wrote: >>> Hello, >>> >>> I've got dovecot authenticating to a MySQL database. I've got a field >>> varchar(128) called password. Whenever I create a password I use >>> doveadm pw as in: >>> >>> doveadm pw -s sha512-crypt >>> >>> now i'd like to get MySQL to make a dovecot-specific password. My goal >>> is to eventually have roundcube's password plugin working with this >>> MySQL database to change the password. >>> >>> Thanks. >>> Dave. >> >> -- >> >> >

3 4

2.2.34 broken if ssl_protocols contains !SSLv2
by Stuart Henderson 11 Mar '18

11 Mar '18

The code in ssl_protocols_to_min_protocol() to convert ssl_protocols to min/max values can't cope with strings containing "!SSLv2". dovecot: imap-login: Fatal: Unknown ssl_protocols setting: Unrecognized protocol 'SSLv2' This string might be configured explicitly by the user, or if the user hasn't configured this themselves it could also come from the default because master_service_ssl_default_settings sets this: #ifdef SSL_TXT_SSLV2 .ssl_protocols = "!SSLv2 !SSLv3", #else .ssl_protocols = "!SSLv3", #endif

1 0

dovecot sha512-crypt database storage
by David Mehler 10 Mar '18

10 Mar '18

Hello, I've got dovecot authenticating to a MySQL database. I've got a field varchar(128) called password. Whenever I create a password I use doveadm pw as in: doveadm pw -s sha512-crypt now i'd like to get MySQL to make a dovecot-specific password. My goal is to eventually have roundcube's password plugin working with this MySQL database to change the password. Thanks. Dave.

2 1

quota-status: Issues with uppercase recipient address
by Christoph Lukas 10 Mar '18

10 Mar '18

Hello list, Dovecot Version: 2.2.34 (874deae) on FreeBSD MTA: Postfix 3.3.0 I've got an issue with the quota-status service: Something breaks when receiving mail with a recipient address that includes non-lowercase characters, for example foo(a)Example.com instead of foo(a)example.com: postfix log: postfix/smtp/smtpd[83387]: NOQUEUE: reject_warning: RCPT from mout01.posteo.de[185.67.36.65]: 450 4.7.1 <foo(a)Example.com>: Recipient address rejected: Invalid user settings. Refer to server log for more information.; from=<[REDACTED]> to=<foo(a)Example.com> proto=ESMTP helo=<mout01.posteo.de> dovecot.log: quota-status(foo(a)Example.com): Error: User initialization failed: Namespace '': mkdir(/srv/mail/Example.com/foo/mailboxes) failed: Permission denied (euid=1001(vmail) egid=1001(vmail) missing +w perm: /srv/mail, dir owned by 0:1001 mode=0755) The user_query has already been altered to include L, however the issue persists. user_query = \ SELECT CONCAT('/srv/mail/','%Ld','/','%Ln','/') AS home, \ 1001 AS uid, \ 1001 AS gid, \ concat('*:bytes=', quota) AS quota_rule \ FROM mailbox WHERE username = '%Lu' \ AND active = 1 Thank you for any suggestions. Christoph # 2.2.34 (874deae): /usr/local/etc/dovecot/dovecot.conf # Pigeonhole version 0.4.22 (22940fb7) # OS: FreeBSD 11.1-STABLE amd64 zfs # Hostname: mail auth_default_realm = firc.de auth_mechanisms = plain login auth_username_chars = abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ01234567890.-_@+ auth_username_format = auth_verbose = yes base_dir = /var/run/dovecot/ first_valid_gid = 1001 first_valid_uid = 1001 hostname = mail.firc.de info_log_path = /var/log/dovecot/dovecot-info.log last_valid_gid = 1001 last_valid_uid = 1001 lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes lda_original_recipient_header = X-Original-To log_path = /var/log/dovecot/dovecot.log login_log_format_elements = user=<%u> method=%m rip=%r lip=%l mpid=%e %c %k mail_gid = 1001 mail_location = sdbox:/srv/mail/%d/%n mail_plugins = acl fts fts_solr quota mail_uid = 1001 mailbox_list_index = yes managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext spamtest spamtestplus imapsieve vnd.dovecot.imapsieve namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Entwürfe { special_use = \Drafts } mailbox "Gelöschte Elemente" { special_use = \Trash } mailbox "Gesendete Elemente" { special_use = \Sent } mailbox Junk-E-Mail { special_use = \Junk } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = /usr/local/etc/dovecot/dovecot-sql.conf.ext driver = sql } plugin { acl = vfile acl_shared_dict = file:/srv/mail/dovecot/shared-mailboxes antispam_backend = mailtrain antispam_mail_notspam = learn_ham antispam_mail_sendmail = /usr/local/bin/rspamc antispam_mail_sendmail_args = -h;10.0.110.27:11334;-P;[REDACTED] antispam_mail_spam = learn_spam antispam_spam = Junk antispam_trash = Trash fts = solr fts_autoindex = yes fts_solr = url=http://127.0.0.1:8983/solr/dovecot/ imapsieve_mailbox1_before = file:/usr/local/etc/dovecot/sieve/report-spam.sieve imapsieve_mailbox1_causes = COPY imapsieve_mailbox1_name = Junk imapsieve_mailbox2_before = file:/usr/local/etc/dovecot/sieve/report-ham.sieve imapsieve_mailbox2_causes = COPY imapsieve_mailbox2_from = Junk imapsieve_mailbox2_name = * quota = count:User quota quota_grace = 10%% quota_rule2 = Trash:storage=+100M quota_status_nouser = DUNNO quota_status_overquota = 552 5.2.2 Mailbox is full quota_status_success = DUNNO quota_vsizes = yes sieve = /srv/mail/%d/%n/dovecot.sieve sieve_default = /srv/mail/dovecot/default.sieve sieve_extensions = +spamtest +spamtestplus sieve_global_extensions = +vnd.dovecot.pipe sieve_pipe_bin_dir = /usr/local/etc/dovecot/sieve sieve_plugins = sieve_imapsieve sieve_extprograms sieve_spamtest_max_header = X-Spamd-Result: default: [[:alnum:]]+ \[-?[[:digit:]]+\.[[:digit:]]+ / (-?[[:digit:]]+\.[[:digit:]]+)\] sieve_spamtest_status_header = X-Spamd-Result: default: [[:alnum:]]+ \[(-?[[:digit:]]+\.[[:digit:]]+) / -?[[:digit:]]+\.[[:digit:]]+\] sieve_spamtest_status_type = score } postmaster_address = postmaster(a)firc.de protocols = imap pop3 lmtp sieve service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0666 user = postfix } unix_listener auth-userdb { group = vmail user = vmail } } service imap-login { inet_listener imap { port = 143 } inet_listener imaps { port = 993 ssl = yes } } service pop3-login { inet_listener pop3 { port = 110 } inet_listener pop3s { port = 995 ssl = yes } } service quota-status { client_limit = 1 executable = quota-status -p postfix inet_listener { port = 12340 } } ssl_alt_cert = </usr/local/etc/ssl/acme/mail.firc.de_ecc/cert.pem ssl_alt_key = </usr/local/etc/ssl/acme/mail.firc.de_ecc/key.pem ssl_ca = /usr/local/etc/ssl/acme/ca.pem ssl_cert = </usr/local/etc/ssl/acme/mail.firc.de/cert.pem ssl_dh_parameters_length = 2048 ssl_key = # hidden, use -P to show it ssl_protocols = !SSLv3 userdb { args = /usr/local/etc/dovecot/dovecot-sql.conf.ext driver = sql } protocol lmtp { mail_plugins = acl fts fts_solr quota sieve } protocol !indexer-worker { mail_vsize_bg_after_count = 100 } protocol imap { mail_max_userip_connections = 50 mail_plugins = acl fts fts_solr quota imap_sieve imap_acl imap_quota plugin { acl = vfile } } protocol lda { mail_plugins = acl fts fts_solr quota sieve quota }

2 1

Unexpected config results with local_name + multiple SSL certs
by David Favor 10 Mar '18

10 Mar '18

Working with SSL on fresh install of latest Ubuntu Artful + Dovecot seems broken somehow. Application is Dovecot listening for many SSL sites... Likely I've missed adding something simple to the config, related to local_name usage. Be great if someone can point out what I've missed, to setup multiple SSL certs for different host.domain entries in config. Thanks. _______ This works as expected... where the SNI server name is returned... #local_name imap.cydec.com { ssl_cert = </etc/letsencrypt/live/imap.cydec.com/fullchain.pem ssl_key = </etc/letsencrypt/live/imap.cydec.com/privkey.pem #} service dovecot restart && echo QUIT | openssl s_client -connect imap.cydec.com:993 -servername imap.cydec.com 2>&1 | egrep ^subject subject=/CN=imap.cydec.com _______ This fails... local_name imap.cydec.com { ssl_cert = </etc/letsencrypt/live/imap.cydec.com/fullchain.pem ssl_key = </etc/letsencrypt/live/imap.cydec.com/privkey.pem } service dovecot restart && echo QUIT | openssl s_client -connect imap.cydec.com:993 -servername imap.cydec.com 2>&1 | egrep ^subject # Empty, so no servername match _______ Full openssl output shows no cert being returned... service dovecot restart && echo QUIT | openssl s_client -connect imap.cydec.com:993 -servername imap.cydec.com CONNECTED(00000004) write:errno=104 --- no peer certificate available --- No client certificate CA names sent --- SSL handshake has read 0 bytes and written 199 bytes Verification: OK --- New, (NONE), Cipher is (NONE) Secure Renegotiation IS NOT supported Compression: NONE Expansion: NONE No ALPN negotiated SSL-Session: Protocol : TLSv1.2 Cipher : 0000 Session-ID: Session-ID-ctx: Master-Key: PSK identity: None PSK identity hint: None SRP username: None Start Time: 1519576210 Timeout : 7200 (sec) Verify return code: 0 (ok) Extended master secret: no --- _______ Config seems correct, with local_name uncommented... dovecot -n # 2.2.27 (c0f36b0): /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.16 (fed8554) # OS: Linux 4.13.0-36-generic x86_64 Ubuntu 17.10 auth_debug = yes auth_debug_passwords = yes auth_verbose = yes debug_log_path = /var/log/dovecot.log disable_plaintext_auth = no info_log_path = /var/log/dovecot.log log_path = /var/log/dovecot.log mail_debug = yes mail_location = mbox:~/mail:INBOX=/var/mail/%u namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = dovecot driver = pam } protocols = " imap pop3" service imap-login { inet_listener imap { port = 0 } inet_listener imaps { port = 993 ssl = yes } } service pop3-login { inet_listener pop3 { port = 0 } inet_listener pop3s { port = 995 ssl = yes } } userdb { driver = passwd } local_name imap.cydec.com { ssl_cert = </etc/letsencrypt/live/imap.cydec.com/fullchain.pem ssl_key = # hidden, use -P to show it }

3 3

mail_attachment_detection_options not working
by Alessio Cecchi 09 Mar '18

09 Mar '18

Hi, I enabled mail_attachment_detection_options on dovecot 2.2.34, in 10-mail.conf I have: mail_attachment_detection_options = add-flags-on-save but when an email is delivered in mailbox (Maildir) via LMTP no flag (HasNoAttachment or HasAttachment) was added. In dovecot-keywords file I have: 0 $HasNoAttachment 1 NonJunk 2 $HasAttachment so I thinks that the feature was eanbled but is unable. What am I doing wrong? Thanks -- Alessio Cecchi Postmaster @ http://www.qboxmail.it https://www.linkedin.com/in/alessice

2 1

Dovecot LMTP rejects all users as non-existent
by Alexander Harm 09 Mar '18

09 Mar '18

I'm running Dovecot 2.2.27 (c0f36b0) on Debian Stretch and I'm having some trouble with LMTP delivery from Postfix to Dovecot. The message in the logs is Mar 9 09:21:19 mail postfix/smtpd[3295]: NOQUEUE: reject: RCPT from some.mail.server[1.2.3.4]: 450 4.1.1 <alias(a)my.domain>: Recipient address rejected: unverified address: host my.mail.server[private/dovecot-lmtp] said: 550 5.1.1 <user(a)my.domain> User doesn't exist: user(a)my.domain (in reply to RCPT TO command); from=<someone(a)another.domain> to=<alias(a)my.domain> proto=ESMTP helo=<some.mail.server> However, testing my installation with doveadm works fine: doveadm user -u user(a)my.domain userdb: user(a)my.domain user : user(a)my.domain uid : 5000 gid : 5000 home : /srv/mail/vhosts/my.domain/user doveadm auth test user(a)my.domain passdb: user(a)my.domain auth succeeded I'm using a static userdb and a ldap passdb: # /etc/dovecot/conf.d/auth-ldap.conf.ext passdb { driver = ldap args = /etc/dovecot/dovecot-ldap.conf.ext } userdb { driver = static args = uid=vmail gid=vmail home=/srv/mail/vhosts/%d/%n } And my LDAP config reads like this # /etc/dovecot/dovecot-ldap.conf.ext uris = ldap://127.0.0.1 dn = uid=dovecot,ou=services,dc=my,dc=domain dnpass = ********* auth_bind = yes auth_bind_userdn = cn=%u,ou=mail,dc=my,dc=domain ldap_version = 3 base = ou=mail,dc=querco,dc=org deref = never scope = onelevel user_attrs = user_filter = (&(objectclass=PostfixBookMailAccount)(mailEnabled=TRUE)(cn=%u)) pass_attrs = cn=user,userPassword=password pass_filter = (&(objectclass=PostfixBookMailAccount)(mailEnabled=TRUE)(cn=%u)) iterate_attrs = cn=user iterate_filter = (&(objectclass=PostfixBookMailAccount)(mailEnabled=TRUE)) Sending the mail straight to user(a)my.domain works. Sending it to another alias works as well. Is there some caching problem and if so how to delete the cache (reboot didn't work)? Any pointers are highly appreciated.

1 0

Sieve filter doesn't respect mailbox separator
by Konstantinos Tsakiltzidis 08 Mar '18

08 Mar '18

namespace separator is '.', this sieve script incorrectly tries to put the mail inside a mailbox rather that beside it, for example if the mailbox is named 'example', the mail will be put in the path 'example/.Spam' instead of 'example.Spam' require ["fileinto"]; if header :contains "X-Spam" "yes" { fileinto "Spam"; } # 2.2.33.2 (d6601f4ec): /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.21 (92477967) # OS: Linux 4.9.0-6-amd64 x86_64 Debian 9.1 ext4 lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes mail_debug = yes mail_location = maildir:/var/vmail/%d/%n managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = separator = . subscriptions = yes type = private } namespace modulus { list = children location = maildir:/var/vmail/%d/Public:INDEXPVT=~/public/indexes mailbox admin { auto = subscribe } mailbox support { auto = subscribe } mailbox telecoms { auto = subscribe } prefix = Public. separator = . subscriptions = yes type = public } passdb { driver = pam } plugin { acl = vfile mail_log_events = flag_change mail_log_fields = box flags uid sieve = ~/dovecot.sieve sieve_before = /var/vmail/global.sieve sieve_dir = ~/sieve sieve_global_dir = /var/vmail/sieve } protocols = " imap lmtp sieve lmtp" service auth { unix_listener /var/spool/postfix/private/auth { group = mail mode = 0666 user = postfix } unix_listener auth-userdb { group = mail mode = 0666 user = vmail } } service imap-login { inet_listener imap { port = 0 } } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } service managesieve-login { inet_listener sieve { port = 4190 } process_min_avail = 0 service_count = 1 vsz_limit = 64 M } service managesieve { process_limit = 1024 } ssl = required ssl_cert = </etc/ssl/certs/mail.crt ssl_key = # hidden, use -P to show it userdb { driver = passwd } protocol imap { mail_max_userip_connections = 20 mail_plugins = " mail_log notify acl" passdb { args = /etc/dovecot/dovecot-ldap-users.conf.ext driver = ldap name = } userdb { args = uid=vmail gid=mail home=/var/vmail/%d/%n driver = static name = } } protocol lda { mail_plugins = " sieve acl" userdb { args = /etc/dovecot/dovecot-ldap-users.conf.ext driver = ldap name = override_fields = uid=vmail gid=mail home=/var/vmail/%d/%n } userdb { args = /etc/dovecot/dovecot-ldap-groups.conf.ext driver = ldap name = override_fields = uid=vmail gid=mail home=/var/vmail/%d/Public/.%n mail=maildir:/var/vmail/%d/Public/.%n } } protocol lmtp { mail_plugins = " sieve acl" postmaster_address = postmaster(a)modulus.gr userdb { args = /etc/dovecot/dovecot-ldap-users.conf.ext driver = ldap name = override_fields = uid=vmail gid=mail home=/var/vmail/%d/%n } userdb { args = /etc/dovecot/dovecot-ldap-groups.conf.ext driver = ldap name = override_fields = uid=vmail gid=mail home=/var/vmail/%d/Public/.%n mail=maildir:/var/vmail/%d/Public/.%n } } protocol doveadm { userdb { args = /etc/dovecot/dovecot-ldap-users.conf.ext driver = ldap name = override_fields = uid=vmail gid=mail home=/var/vmail/%d/%n } userdb { args = /etc/dovecot/dovecot-ldap-groups.conf.ext driver = ldap name = override_fields = uid=vmail gid=mail home=/var/vmail/%d/Public/.%n mail=maildir:/var/vmail/%d/Public/.%n } } protocol sieve { mail_max_userip_connections = 10 managesieve_implementation_string = Dovecot Pigeonhole managesieve_logout_format = bytes=%i/%o managesieve_max_line_length = 65536 passdb { args = /etc/dovecot/dovecot-ldap-users.conf.ext driver = ldap name = } userdb { args = uid=vmail gid=mail home=/var/vmail/%d/%n driver = static name = } }

2 2

Re: Authentication Problem with dovecot-2.3.0.1
by Aki Tuomi 08 Mar '18

08 Mar '18

> On 08 March 2018 at 10:00 Odhiambo Washington <odhiambo(a)gmail.com> wrote: > > > On 8 March 2018 at 10:09, Aki Tuomi <aki.tuomi(a)dovecot.fi> wrote: > > > > > > > On 07.03.2018 22:07, Odhiambo Washington wrote: > > > > I am a little confused here. > > > > I have been running 2.2.34 which I installed in /opt/dovecot2.2 > > I installed 2.3.0.1 to /opt/dovecot23 > > > > I then used config files from /opt/dovecot2.2/etc/dovecot to > > /opt/dovecot2.3/etc/dovecot and all I did was sed -i.BAK > > 's/dovecot2.2/dovecot2.3/g'. Dovecot started and was running file. > > > > Next, I manually crafted config files for 2.3.0.1 based on the example > > config files provided which diff-ing those with what I had for 2.2.34. I > > doub't if I missed something crucial during the process. > > > > 1. I realized that I cannot start 2.3.0.1 when I enable submission, since > > my Exim MTA is already using that port. This persists even if I tell the > > submission protocol to use a different port than 587. I tested 2587, but it > > would appear that 587 is hard-coded! > > > > 2. I realize that "unix_listener auth-client" service ceased to exist! > > > > 3. *I realized that while 2.2.34 runs with default_pass_scheme = > > MD5-CRYPT, 2.3.0.1 would not run with it.* > > > > 4. I have run dovecot -n from my 2.2.x installation and 2.3.x installation > > and here is the diff from the two files. > > > > I am confused why authentication is failing with dovecot-2.3.0.1 when it > > uses 2.3.x config files using MD5-CRYPT scheme while it is succeeding with > > dovecot-2.2.34 using the same. > > *Mar 07 22:30:22 auth: Info: sql(user.name(a)domain.name > > <user.name(a)domain.name>,192.168.55.97,<4CETl9dmscvAqDdh>): Requested > > DIGEST-MD5 scheme, but we have only MD5-CRYPT* > > > > Maybe the problem is elsewhere??? I need a 3rd eye to help me. > > > > For now > > > > root@gw:~wash/public_html # sdiff dovecot-2.2.txt dovecot-2.3.txt | less > > # 2.2.34 (874deae): /opt/dovecot2.2/etc/dovecot/dovecot.conf | # 2.3.0.1 > > (ffd8a29): /opt/dovecot2.3/etc/dovecot/dovecot.conf > > # OS: FreeBSD 9.3-STABLE i386 ufs # OS: > > FreeBSD 9.3-STABLE i386 ufs > > # Hostname: localhost < > > auth_cache_size = 20 M > > auth_cache_size = 20 M > > auth_master_user_separator = * > > auth_master_user_separator = * > > auth_mechanisms = plain login digest-md5 > > auth_mechanisms = plain login digest-md5 > > auth_socket_path = /var/run/dovecot/auth-userdb > > auth_socket_path = /var/run/dovecot/auth-userdb > > base_dir = /var/run/dovecot/ base_dir = > > /var/run/dovecot/ > > default_login_user = dovecot > > default_login_user = dovecot > > disable_plaintext_auth = no > > disable_plaintext_auth = no > > first_valid_gid = 0 > > first_valid_gid = 0 > > first_valid_uid = 26 > > first_valid_uid = 26 > > hostname = gw hostname = gw > > info_log_path = /var/log/dovecot.log > > info_log_path = /var/log/dovecot.log > > mail_location = maildir:/var/spool/virtual/%d/%n/Maildir:INDE > > mail_location = maildir:/var/spool/virtual/%d/%n/Maildir:INDE > > mail_plugins = " quota" < > > namespace inbox { namespace > > inbox { > > inbox = yes inbox = > > yes > > location = location > > = > > mailbox Drafts { mailbox > > Drafts { > > special_use = \Drafts > > special_use = \Drafts > > } } > > mailbox Junk { mailbox > > Junk { > > special_use = \Junk > > special_use = \Junk > > } } > > mailbox Sent { mailbox > > Sent { > > special_use = \Sent > > special_use = \Sent > > } } > > mailbox "Sent Messages" { mailbox > > "Sent Messages" { > > special_use = \Sent > > special_use = \Sent > > } } > > mailbox Trash { mailbox > > Trash { > > special_use = \Trash > > special_use = \Trash > > } } > > prefix = prefix = > > } } > > passdb { passdb { > > args = /opt/dovecot2.2/etc/dovecot/passwd.master_users.ext | args = > > /opt/dovecot2.3/etc/dovecot/passwd.master_users.ext > > driver = passwd-file driver = > > passwd-file > > master = yes master = > > yes > > pass = yes pass = > > yes > > } } > > passdb { passdb { > > args = /opt/dovecot2.2/etc/dovecot/dovecot-sql.conf.ext | args = > > /opt/dovecot2.3/etc/dovecot/dovecot-sql.conf.ext > > driver = sql driver = > > sql > > } } > > plugin { plugin { > > mail_log_fields = uid box msgid size > > mail_log_fields = uid box msgid size > > quota_rule = *:storage=1G > > quota_rule = *:storage=1G > > quota_rule2 = Trash:storage=+100M > > quota_rule2 = Trash:storage=+100M > > quota_warning = storage=95%% quota-warning 95 %u > > quota_warning = storage=95%% quota-warning 95 %u > > quota_warning2 = storage=80%% quota-warning 80 %u > > quota_warning2 = storage=80%% quota-warning 80 %u > > quota_warning3 = -storage=100%% quota-warning below %u > > quota_warning3 = -storage=100%% quota-warning below %u > > } } > > service auth { service > > auth { > > unix_listener auth-client { < > > mode = 0600 < > > user = mailnull < > > } > > < > > unix_listener auth-userdb { > > unix_listener auth-userdb { > > group = mailnull group > > = mailnull > > user = mailnull user = > > mailnull > > } } > > } } > > service quota-warning { service > > quota-warning { > > executable = script /opt/dovecot2.2/scripts/quota-warning.s | > > executable = script /opt/dovecot2.3/scripts/quota-warning.s > > unix_listener quota-warning { > > unix_listener quota-warning { > > user = mailnull user = > > mailnull > > } } > > user = dovecot user = > > dovecot > > } } > > ssl_cert = </usr/local/etc/letsencrypt/live/gw.crownkenya.com ssl_cert > > = </usr/local/etc/letsencrypt/live/gw.crownkenya.com > > ssl_key = # hidden, use -P to show it ssl_key = > > # hidden, use -P to show it > > > > > submission_max_mail_size = 4 G > > userdb { userdb { > > args = /opt/dovecot2.2/etc/dovecot/dovecot-sql.conf.ext | args = > > /opt/dovecot2.3/etc/dovecot/dovecot-sql.conf.ext > > driver = sql driver = > > sql > > } } > > protocol lda { < > > mail_plugins = quota < > > } < > > protocol imap { protocol > > imap { > > mail_max_userip_connections = 5 > > mail_max_userip_connections = 5 > > mail_plugins = " quota imap_quota" < > > } } > > protocol pop3 { | protocol > > lda { > > mail_max_userip_connections = 5 | > > mail_plugins = quota > > } } > > > > > > Maybe I am just suffering brainlock and need to debug auth further, but I > > have see a question about this auth issue already from another poster, and > > it's not been answered by anyone. > > > > > > > > > > > > Can you send 'doveconf -n' for the 2.3.0.1 instance? > > > > Also. You cannot use hashed passwords with DIGEST-MD5. MD5-CRYPT is hashed > > password scheme. > > > > To change dovecot's submission service port, use > > > > service submission-login { > > inet_listener { > > port = 2587 > > } > > } > > > > "auth-client" cannot be missing, since you can specify arbitrary listeners > > in dovecot, so https://wiki.dovecot.org/HowTo/EximAndDovecotSASL is still > > quite valid. > > > > Aki > > > > > Here is the output: > > root@gw:/opt/dovecot2.3/etc # ../bin/doveconf -n > # 2.3.0.1 (ffd8a29): /opt/dovecot2.3/etc/dovecot/dovecot.conf > # OS: FreeBSD 9.3-STABLE i386 ufs > auth_cache_size = 20 M > auth_master_user_separator = * > auth_mechanisms = plain login digest-md5 > auth_socket_path = /var/run/dovecot/auth-userdb > base_dir = /var/run/dovecot/ > default_login_user = dovecot > disable_plaintext_auth = no > first_valid_gid = 0 > first_valid_uid = 26 > hostname = gw.crownkenya.com > info_log_path = /var/log/dovecot.log > mail_location = maildir:/var/spool/virtual/%d/%n/Maildir:INDEX=MEMORY > namespace inbox { > inbox = yes > location = > mailbox Drafts { > special_use = \Drafts > } > mailbox Junk { > special_use = \Junk > } > mailbox Sent { > special_use = \Sent > } > mailbox "Sent Messages" { > special_use = \Sent > } > mailbox Trash { > special_use = \Trash > } > prefix = > } > passdb { > args = /opt/dovecot2.3/etc/dovecot/passwd.master_users.ext > driver = passwd-file > master = yes > pass = yes > } > passdb { > args = /opt/dovecot2.3/etc/dovecot/dovecot-sql.conf.ext > driver = sql > } > plugin { > mail_log_fields = uid box msgid size > quota_rule = *:storage=1G > quota_rule2 = Trash:storage=+100M > quota_warning = storage=95%% quota-warning 95 %u > quota_warning2 = storage=80%% quota-warning 80 %u > quota_warning3 = -storage=100%% quota-warning below %u > } > postmaster_address = postmaster(a)ccc.com > service auth { > unix_listener auth-userdb { > group = mailnull > user = mailnull > } > } > service quota-warning { > executable = script /opt/dovecot2.3/scripts/quota-warning.sh > unix_listener quota-warning { > user = mailnull > } > user = dovecot > } > ssl_cert = </usr/local/etc/letsencrypt/live/gw.ccc.com/fullchain.pem > ssl_key = # hidden, use -P to show it > submission_max_mail_size = 4 G > userdb { > args = /opt/dovecot2.3/etc/dovecot/dovecot-sql.conf.ext > driver = sql > } > protocol imap { > mail_max_userip_connections = 5 > } > protocol lda { > mail_plugins = quota > } > > > > My default_pass_scheme = MD5-CRYPT, but while running 2.3.0.1 there were > many authentication failures and I would see some MS OutHouse clients were > asking for DIGEST-MD5! > Right now I am back to running 2.2.33.1 (2.2.34 has been having issues > which were forcing me to reboot the server, but being a busy server it'e > been hard to find a good time to figure out why server would run out of > buffers) and everything is good! > > > About submission, I looked in 10-master.conf and modified as follows: > > service submission-login { > inet_listener submission { > port = 2587 > } > } > > .... but it would still make dovecot fail to start, because Exim is > listening on port 587. > > I see that your suggested modification is slightly different when it comes > to inet_listener line, because you do not include "submission" after > inet_listener and that is different from the format used in 10-master.conf: > > service submission-login { > inet_listener { > port = 2587 > } > } > > PS: I will look at whether I accidentally did something during my editing > which resulted in the auth-client line missing in my new configuration. > > > -- > Best regards, > Odhiambo WASHINGTON, > Nairobi,KE > +254 7 3200 0004/+254 7 2274 3223 > "Oh, the cruft." service submission-login { inet_listener submission { address = haproxy = no port = 587 reuse_port = no ssl = no } } this is the default config. We have not hard-coded any listener port. Aki

1 0

Authentication Problem with dovecot-2.3.0.1
by Odhiambo Washington 08 Mar '18

08 Mar '18

I am a little confused here. I have been running 2.2.34 which I installed in /opt/dovecot2.2 I installed 2.3.0.1 to /opt/dovecot23 I then used config files from /opt/dovecot2.2/etc/dovecot to /opt/dovecot2.3/etc/dovecot and all I did was sed -i.BAK 's/dovecot2.2/dovecot2.3/g'. Dovecot started and was running file. Next, I manually crafted config files for 2.3.0.1 based on the example config files provided which diff-ing those with what I had for 2.2.34. I doub't if I missed something crucial during the process. 1. I realized that I cannot start 2.3.0.1 when I enable submission, since my Exim MTA is already using that port. This persists even if I tell the submission protocol to use a different port than 587. I tested 2587, but it would appear that 587 is hard-coded! 2. I realize that "unix_listener auth-client" service ceased to exist! 3. *I realized that while 2.2.34 runs with default_pass_scheme = MD5-CRYPT, 2.3.0.1 would not run with it.* 4. I have run dovecot -n from my 2.2.x installation and 2.3.x installation and here is the diff from the two files. I am confused why authentication is failing with dovecot-2.3.0.1 when it uses 2.3.x config files using MD5-CRYPT scheme while it is succeeding with dovecot-2.2.34 using the same. *Mar 07 22:30:22 auth: Info: sql(user.name(a)domain.name <user.name(a)domain.name>,192.168.55.97,<4CETl9dmscvAqDdh>): Requested DIGEST-MD5 scheme, but we have only MD5-CRYPT* Maybe the problem is elsewhere??? I need a 3rd eye to help me. For now root@gw:~wash/public_html # sdiff dovecot-2.2.txt dovecot-2.3.txt | less # 2.2.34 (874deae): /opt/dovecot2.2/etc/dovecot/dovecot.conf | # 2.3.0.1 (ffd8a29): /opt/dovecot2.3/etc/dovecot/dovecot.conf # OS: FreeBSD 9.3-STABLE i386 ufs # OS: FreeBSD 9.3-STABLE i386 ufs # Hostname: localhost < auth_cache_size = 20 M auth_cache_size = 20 M auth_master_user_separator = * auth_master_user_separator = * auth_mechanisms = plain login digest-md5 auth_mechanisms = plain login digest-md5 auth_socket_path = /var/run/dovecot/auth-userdb auth_socket_path = /var/run/dovecot/auth-userdb base_dir = /var/run/dovecot/ base_dir = /var/run/dovecot/ default_login_user = dovecot default_login_user = dovecot disable_plaintext_auth = no disable_plaintext_auth = no first_valid_gid = 0 first_valid_gid = 0 first_valid_uid = 26 first_valid_uid = 26 hostname = gw hostname = gw info_log_path = /var/log/dovecot.log info_log_path = /var/log/dovecot.log mail_location = maildir:/var/spool/virtual/%d/%n/Maildir:INDE mail_location = maildir:/var/spool/virtual/%d/%n/Maildir:INDE mail_plugins = " quota" < namespace inbox { namespace inbox { inbox = yes inbox = yes location = location = mailbox Drafts { mailbox Drafts { special_use = \Drafts special_use = \Drafts } } mailbox Junk { mailbox Junk { special_use = \Junk special_use = \Junk } } mailbox Sent { mailbox Sent { special_use = \Sent special_use = \Sent } } mailbox "Sent Messages" { mailbox "Sent Messages" { special_use = \Sent special_use = \Sent } } mailbox Trash { mailbox Trash { special_use = \Trash special_use = \Trash } } prefix = prefix = } } passdb { passdb { args = /opt/dovecot2.2/etc/dovecot/passwd.master_users.ext | args = /opt/dovecot2.3/etc/dovecot/passwd.master_users.ext driver = passwd-file driver = passwd-file master = yes master = yes pass = yes pass = yes } } passdb { passdb { args = /opt/dovecot2.2/etc/dovecot/dovecot-sql.conf.ext | args = /opt/dovecot2.3/etc/dovecot/dovecot-sql.conf.ext driver = sql driver = sql } } plugin { plugin { mail_log_fields = uid box msgid size mail_log_fields = uid box msgid size quota_rule = *:storage=1G quota_rule = *:storage=1G quota_rule2 = Trash:storage=+100M quota_rule2 = Trash:storage=+100M quota_warning = storage=95%% quota-warning 95 %u quota_warning = storage=95%% quota-warning 95 %u quota_warning2 = storage=80%% quota-warning 80 %u quota_warning2 = storage=80%% quota-warning 80 %u quota_warning3 = -storage=100%% quota-warning below %u quota_warning3 = -storage=100%% quota-warning below %u } } service auth { service auth { unix_listener auth-client { < mode = 0600 < user = mailnull < } < unix_listener auth-userdb { unix_listener auth-userdb { group = mailnull group = mailnull user = mailnull user = mailnull } } } } service quota-warning { service quota-warning { executable = script /opt/dovecot2.2/scripts/quota-warning.s | executable = script /opt/dovecot2.3/scripts/quota-warning.s unix_listener quota-warning { unix_listener quota-warning { user = mailnull user = mailnull } } user = dovecot user = dovecot } } ssl_cert = </usr/local/etc/letsencrypt/live/gw.crownkenya.com ssl_cert = </usr/local/etc/letsencrypt/live/gw.crownkenya.com ssl_key = # hidden, use -P to show it ssl_key = # hidden, use -P to show it > submission_max_mail_size = 4 G userdb { userdb { args = /opt/dovecot2.2/etc/dovecot/dovecot-sql.conf.ext | args = /opt/dovecot2.3/etc/dovecot/dovecot-sql.conf.ext driver = sql driver = sql } } protocol lda { < mail_plugins = quota < } < protocol imap { protocol imap { mail_max_userip_connections = 5 mail_max_userip_connections = 5 mail_plugins = " quota imap_quota" < } } protocol pop3 { | protocol lda { mail_max_userip_connections = 5 | mail_plugins = quota } } Maybe I am just suffering brainlock and need to debug auth further, but I have see a question about this auth issue already from another poster, and it's not been answered by anyone. -- Best regards, Odhiambo WASHINGTON, Nairobi,KE +254 7 3200 0004/+254 7 2274 3223 "Oh, the cruft."

2 1

last login tracking
by David Mehler 08 Mar '18

08 Mar '18

Hello, I've got dovecot going with postfix and MySQL database for user and domain storage. Dovecot handles the authentication. My last login is not working, does anyone have a table example and configs? I looked at the wiki page on the lastlogin plugin but obviously what I'm doing isn't working, I keep getting message write was unsuccessful for the lastlogin ip. I'd appreciate any help. Thanks. Dave. #doveconf -n # 2.2.34 (874deae): /usr/local/etc/dovecot/dovecot.conf # Pigeonhole version 0.4.22 (22940fb7) # OS: FreeBSD 11.1-RELEASE-p4 amd64 # Hostname: localhost auth_cache_size = 10 M auth_default_realm = example.com auth_mechanisms = plain login auth_realms = example.com example2.com dict { acl = proxy:mysql:/usr/local/etc/dovecot/shared-folders.conf lastlogin = proxy:mysql:/usr/local/etc/dovecot/last-login.conf sqlquota = proxy:mysql:/usr/local/etc/dovecot/quota.conf } first_valid_gid = 999 first_valid_uid = 999 hostname = mail.example.com imap_idle_notify_interval = 10 mins last_valid_gid = 999 last_valid_uid = 999 lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes lda_original_recipient_header = X-Original-To listen = 127.0.0.1 xxx.xxx.xxx.xxx lmtp_rcpt_check_quota = yes mail_access_groups = vmail mail_fsync = never mail_gid = vmail mail_home = /home/vmail/mailboxes/%d/%n mail_location = maildir:~/mail:LAYOUT=fs mail_plugins = acl mail_log notify quota quota_clone trash virtual welcome zlib mail_privileged_group = vmail mail_server_admin = mailto:postmaster@example.com mail_uid = vmail mailbox_list_index = yes managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext imapflags notify imapsieve vnd.dovecot.imapsieve namespace { location = maildir:/home/vmail/public/:CONTROL=~/mail/public:INDEX=~/mail/public mailbox TestFolder { auto = subscribe comment = Public Folder for message sharing } prefix = Public/ separator = / subscriptions = yes type = public } namespace { list = children location = maildir:%%h/Maildir:INDEXPVT=~/Maildir/shared/%%u prefix = shared/%%u/ separator = / subscriptions = no type = shared } namespace inbox { inbox = yes location = mailbox Archive { auto = no special_use = \Archive } mailbox Archives { auto = subscribe special_use = \Archive } mailbox "Deleted Messages" { auto = no autoexpunge = 30 days special_use = \Trash } mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk { auto = no autoexpunge = 30 days special_use = \Junk } mailbox "Junk E-mail" { auto = no autoexpunge = 30 days special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Items" { auto = no special_use = \Sent } mailbox "Sent Messages" { auto = no special_use = \Sent } mailbox Spam { auto = subscribe autoexpunge = 30 days special_use = \Junk } mailbox Trash { auto = subscribe autoexpunge = 30 days special_use = \Trash } mailbox virtual/All { comment = All my messages special_use = \All } prefix = separator = / type = private } namespace virtual { location = virtual:/usr/local/etc/dovecot/virtual:INDEX=~/virtual:CONTROL=~/virtual prefix = virtual/ separator = / } passdb { args = /usr/local/etc/dovecot/dovecot-sql.conf.ext driver = sql } plugin { acl = vfile:/usr/local/etc/dovecot/global-acls:cache_secs=300 acl_anyone = allow acl_globals_only = yes acl_shared_dict = proxy::acl imapsieve_mailbox1_before = file:/home/vmail/sieve/global/learn-spam.sieve imapsieve_mailbox1_causes = COPY imapsieve_mailbox1_name = Spam imapsieve_mailbox2_before = file:/home/vmail/sieve/global/learn-ham.sieve imapsieve_mailbox2_causes = COPY imapsieve_mailbox2_from = Spam imapsieve_mailbox2_name = * last_login_dict = proxy::lastlogin last_login_key = last-login/%u mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename mail_log_fields = uid box msgid size quota = count:User quota quota_clone_dict = proxy::sqlquota quota_exceeded_message = Storage quota for this account has been exceeded, please try again later. quota_grace = 10%% quota_status_nouser = DUNNO quota_status_overquota = 552 5.2.2 Mailbox is full quota_status_success = DUNNO quota_vsizes = true quota_warning = storage=100%% quota-exceeded 100 %u quota_warning2 = storage=95%% quota-warning 95 %u quota_warning3 = storage=90%% quota-warning 90 %u quota_warning4 = storage=85%% quota-warning 85 %u quota_warning5 = storage=75%% quota-warning 75 %u sieve = ~/.dovecot.sieve sieve_before = /home/vmail/sieve/before.d sieve_default = /home/vmail/sieve/default.sieve sieve_dir = ~/sieve sieve_extensions = +notify +imapflags sieve_global_dir = /home/vmail/sieve sieve_global_extensions = +vnd.dovecot.pipe +vnd.dovecot.execute sieve_max_redirects = 30 sieve_max_script_size = 1M sieve_pipe_bin_dir = /usr/local/bin sieve_plugins = sieve_imapsieve sieve_extprograms sieve_user_log = /home/vmail/sieve/sieve_error.log trash = /usr/local/etc/dovecot/trash.conf welcome_script = welcome %u welcome_wait = yes } postmaster_address = postmaster(a)example.com protocols = imap lmtp sieve sendmail_path = /usr/local/sbin/sendmail service auth-worker { user = vmail } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0666 user = postfix } unix_listener auth-userdb { group = vmail mode = 0666 user = vmail } } service dict { unix_listener dict { group = vmail mode = 0660 user = vmail } user = root } service imap-login { inet_listener imap { address = 127.0.0.1 port = 143 } inet_listener imaps { address = xxx.xxx.xxx.xxx port = 993 ssl = yes } } service imap { executable = imap } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0666 user = postfix } } service managesieve-login { inet_listener sieve { address = 127.0.0.1 port = 4190 } } service quota-status { client_limit = 1 executable = quota-status -p postfix unix_listener /var/spool/postfix/private/dovecot-quota { group = postfix mode = 0660 user = postfix } } service quota-warning { executable = script /usr/local/etc/dovecot/quota-warning.sh unix_listener quota-warning { group = vmail mode = 0660 user = vmail } user = vmail } service welcome { executable = script /usr/local/etc/dovecot/welcome.sh unix_listener welcome { user = vmail } user = vmail } ssl = required ssl_cert = </usr/local/etc/ssl/acme/example.com/fullchain.pem ssl_cipher_list = ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256 ssl_dh_parameters_length = 4096 ssl_key = # hidden, use -P to show it ssl_options = no_compression ssl_prefer_server_ciphers = yes ssl_protocols = !SSLv2 !SSLv3 !TLSv1 !TLSv1.1 TLSv1.2 userdb { args = /usr/local/etc/dovecot/dovecot-sql.conf.ext driver = sql } protocol lmtp { mail_fsync = optimized mail_plugins = acl mail_log notify quota quota_clone trash virtual welcome zlib quota sieve } protocol lda { mail_fsync = optimized mail_plugins = acl mail_log notify quota quota_clone trash virtual welcome zlib sieve virtual } protocol imap { mail_max_userip_connections = 20 mail_plugins = acl mail_log notify quota quota_clone trash virtual welcome zlib imap_acl imap_quota imap_sieve imap_zlib last_login virtual } mysql: describe virtual_users; +------------------+----------------------+------+-----+---------+----------------+ | Field | Type | Null | Key | Default | Extra | +------------------+----------------------+------+-----+---------+----------------+ | id | int(11) | NO | PRI | NULL | auto_increment | | domain_id | int(11) | NO | MUL | NULL | | | user | varchar(40) | NO | MUL | NULL | | | password | varchar(128) | NO | | NULL | | | uid | smallint(5) unsigned | NO | | 999 | | | gid | smallint(5) unsigned | NO | | 999 | | | quota | bigint(20) | NO | | 0 | | | active | tinyint(1) | NO | | 1 | | | allow_imap | tinyint(1) | NO | | 1 | | | last_login_ip | varchar(16) | YES | | NULL | | | last_login_date | datetime | YES | | NULL | | | last_login_proto | varchar(5) | YES | | NULL | | +------------------+----------------------+------+-----+---------+----------------+ 12 rows in set (0.00 sec) #cat last-login.conf connect = host=/tmp/mysql.sock dbname=DBNameHere user=UserNameHere password=PasswordHere # Last Login map { pattern = shared/last-login/$user table = virtual_users value_field = lastlogin value_type = uint fields { user = $user } } Mar 7 11:41:00 Servername dovecot: dict(16033): Error: dict client: Unconfigured dictionary name 'lastlogin' Mar 7 11:41:00 ServerName dovecot: imap(user(a)example.com): Error: last_login_dict: Write was unconfirmed (timeout or disconnect) for user username(a)davemehler.com

1 0

Authentification fails in dovecot 2.3.0.1
by post＠volker-wysk.de 08 Mar '18

08 Mar '18

Hi I've upgraded dovecot from 2.2.22 to 2.3.0.1. Now I can't authenticate any longer. My mail client says that the user name and password are rejected by dovecot. I get this line in /var/log/auth.log: Mar 6 19:28:02 desktop auth: PAM audit_log_acct_message() failed: Operation not permitted And this in /var/log/dovecot.log: Mar 06 19:28:02 auth: Debug: Loading modules from directory: /usr/lib/dovecot/modules/auth Mar 06 19:28:02 auth: Debug: Module loaded: /usr/lib/dovecot/modules/auth/lib20_auth_var_expand_crypt.so Mar 06 19:28:02 auth: Debug: Module loaded: /usr/lib/dovecot/modules/auth/libdriver_sqlite.so Mar 06 19:28:02 auth: Debug: Read auth token secret from /var/run/dovecot/auth-token-secret.dat Mar 06 19:28:02 auth: Debug: auth client connected (pid=5615) Mar 06 19:28:02 auth: Debug: client in: AUTH 1 PLAIN service=imap secured session=ggZPmsJmIoh/AAAB lip=127.0.0.1 rip=127.0.0.1 lport=993 rport=34850 local_ Mar 06 19:28:02 auth-worker(5617): Debug: Loading modules from directory: /usr/lib/dovecot/modules/auth Mar 06 19:28:02 auth-worker(5617): Debug: Module loaded: /usr/lib/dovecot/modules/auth/lib20_auth_var_expand_crypt.so Mar 06 19:28:02 auth-worker(5617): Debug: Module loaded: /usr/lib/dovecot/modules/auth/libdriver_sqlite.so Mar 06 19:28:02 auth-worker(5617): Debug: pam(v,127.0.0.1,<ggZPmsJmIoh/AAAB>): lookup service=dovecot Mar 06 19:28:02 auth-worker(5617): Debug: pam(v,127.0.0.1,<ggZPmsJmIoh/AAAB>): #1/1 style=1 msg=Password: Mar 06 19:28:02 auth-worker(5617): Info: pam(v,127.0.0.1,<ggZPmsJmIoh/AAAB>): pam_authenticate() failed: System error Mar 06 19:28:04 auth: Debug: client passdb out: FAIL 1 user=v Mar 06 19:28:06 imap-login: Info: Aborted login (auth failed, 1 attempts in 4 secs): user=<v>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, TLS, session=<ggZPmsJmIoh/AAAB> Now it seems I can't go back to 2.2.22 as well: https://wiki2.dovecot.org/Upgrading/2.3 says "Downgrading is possible to v2.2.27 and later. (v2.2.27 accidentally broke dovecot.index* backwards compatibility a bit.)" What should I do now? Remove the dysfunctional dovecot server and try a fresh new 2.3.0.1 install? How would I migrate my mail? Here's my dovecot -n: # 2.3.0.1 (ffd8a29): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.0.1 (d33dca2) # OS: Linux 4.4.0-116-generic x86_64 Ubuntu 16.04.4 LTS auth_debug = yes auth_username_format = %n auth_verbose = yes auth_verbose_passwords = plain hostname = volker-wysk.de log_path = /var/log/dovecot.log mail_debug = yes mail_location = mdbox:~/lib/Dovecot-Mail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext imapsieve vnd.dovecot.imapsieve namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Entwürfe { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Papierkorb { special_use = \Trash } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } mailbox "Versendete Nachrichten" { special_use = \Sent } prefix = separator = . } passdb { driver = pam } plugin { imapsieve_mailbox1_before = file:/usr/lib/dovecot/sieve/report-spam.sieve imapsieve_mailbox1_causes = COPY imapsieve_mailbox1_name = Spam imapsieve_mailbox2_before = file:/usr/lib/dovecot/sieve/report-ham.sieve imapsieve_mailbox2_causes = COPY imapsieve_mailbox2_from = Spam imapsieve_mailbox2_name = * sieve = ~/.dovecot.sieve sieve_dir = ~/lib/Sieve sieve_global_extensions = +vnd.dovecot.pipe +vnd.dovecot.environment sieve_pipe_bin_dir = /usr/lib/dovecot/sieve sieve_plugins = sieve_imapsieve sieve_extprograms } postmaster_address = post(a)volker-wysk.de protocols = imap lmtp sieve ssl = required ssl_cert = </etc/ssl/certs/dovecot.pem ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { driver = passwd } protocol lmtp { mail_plugins = " sieve mail_log notify" } protocol lda { mail_plugins = " sieve" } protocol imap { mail_max_userip_connections = 50 mail_plugins = " imap_sieve" } Bye Volker

2 1

AppArmor profile for Dovecot on Debian Stretch
by André Rodier 08 Mar '18

08 Mar '18

Hello all, Is there any guide to help in the configuration of Dovecot for AppArmor on Debian / Ubuntu ? Or maybe does any of you already have something that works? I am actually adding AppArmor on an email server project, and I had some trouble with the versions from Debian. I would like to avoid - if possible - the long try and error process for each Dovecot executable. I am using IMAP, LMTP, Sieve and ManageSieve, with LDAP users. The full project reference is here: https://github.com/progmaticltd/homebox ii dovecot-core 1:2.2.27-3+deb9u2 amd64 ii dovecot-imapd 1:2.2.27-3+deb9u2 amd64 ii dovecot-ldap 1:2.2.27-3+deb9u2 amd64 ii dovecot-lmtpd 1:2.2.27-3+deb9u2 amd64 ii dovecot-managesieved 1:2.2.27-3+deb9u2 amd64 ii dovecot-pop3d 1:2.2.27-3+deb9u2 amd64 ii dovecot-sieve 1:2.2.27-3+deb9u2 amd64 Thanks for your advices André

1 0

Coredump: Panic: file smtp-address.c: line 530 (smtp_address_write): assertion failed: (smtp_char_is_qpair(*p))
by Ralf Hildebrandt 07 Mar '18

07 Mar '18

Got a coredump: Mar 5 15:09:42 mail-cbf dovecot: lmtp(backup(a)backup.invalid)<15425><2B+kCaZPnVpBPAAAplP5LA>: Fatal: master: service(lmtp): child 15425 killed with signal 6 (core dumped) #0 0x00007fea19977428 in __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:54 resultvar = 0 pid = 15425 selftid = 15425 #1 0x00007fea1997902a in __GI_abort () at abort.c:89 save_stage = 2 act = { __sigaction_handler = { sa_handler = 0x56239d9a3890, sa_sigaction = 0x56239d9a3890 }, sa_mask = { __val = {1, 94710917811261, 140643428345904, 94710917811577, 0, 140735221053024, 94710938452648, 513, 7700885895375379200, 0, 140643433202867, 94710938452648, 140735221053120, 94710938452304, 140643433203225, 94710938452648} }, sa_flags = 433895898, sa_restorer = 0x5 } sigs = { __val = {32, 0 <repeats 15 times>} } #2 0x00007fea19dd2aaf in default_fatal_finish (type=LOG_TYPE_PANIC, status=status@entry=0) at failures.c:228 backtrace = 0x56239bd7c2e0 "/usr/lib/dovecot/libdovecot.so.0(+0xc6aca) [0x7fea19dd2aca] -> /usr/lib/dovecot/libdovecot.so.0(+0xc6bad) [0x7fea19dd2bad] -> /usr/lib/dovecot/libdovecot.so.0(i_fatal+0) [0x7fea19d44721] -> /usr/lib/d"... recursed = 0 #3 0x00007fea19dd2bad in i_internal_fatal_handler (ctx=0x7fff78dbb710, format=<optimized out>, args=<optimized out>) at failures.c:718 status = 0 #4 0x00007fea19d44721 in i_panic (format=format@entry=0x7fea19e0ec98 "file %s: line %d (%s): assertion failed: (%s)") at failures.c:306 ctx = { type = LOG_TYPE_PANIC, exit_status = 0, timestamp = 0x0, timestamp_usecs = 0, log_prefix = 0x0 } args = <error reading variable args (Attempt to dereference a generic pointer.)> #5 0x00007fea19d4831d in smtp_address_write (out=0x56239bd7c150, address=0x56239bd7c108) at smtp-address.c:530 quoted = <optimized out> p = 0x56239bd7c11b "üller" pend = 0x56239bd7c121 "" pblock = 0x56239bd7c11a "müller" __func__ = "smtp_address_write" #6 0x00007fea19d48411 in smtp_address_encode (address=0x56239bd7c108) at smtp-address.c:567 str = 0x56239bd7c150 #7 0x00007fea1a3cf774 in mail_deliver_log_update_cache (cache=cache@entry=0x56239bddf1c8, pool=0x56239bddf180, mail=0x56239be185c8) at mail-deliver.c:111 message_id = 0x56239d943a4c "<ae7dbbbcb4790c611b6a104ef5f7c540(a)cron-eu.crsend.com>" subject = 0x56239d943b69 "JOMEC Seminar | Von Kennzahlencockpits und Lean Hospital Strategien" from_envelope = 0x0 from = <optimized out> #8 0x00007fea1a3cfabf in mail_deliver_save_finish (ctx=0x56239be14ca0) at mail-deliver.c:533 box = <optimized out> mbox = 0x56239be0efc0 muser = 0x56239bdcb7c0 dt = 0x56239bddf1c0 #9 0x00007fea1a0c758c in mailbox_save_finish (_ctx=_ctx@entry=0x7fff78dbb948) at mail-storage.c:2461 _data_stack_cur_id = 4 ctx = 0x56239be14ca0 t = 0x56239be10ce0 keywords = 0x0 pvt_flags = 0 copying_via_save = true ret = <optimized out> #10 0x00007fea1a0b9eb4 in mail_storage_copy (ctx=0x0, ctx@entry=0x56239be14ca0, mail=mail@entry=0x56239bdfdb28) at mail-copy.c:112 __func__ = "mail_storage_copy" #11 0x00007fea1a0e03f6 in mdbox_copy (_ctx=0x56239be14ca0, mail=0x56239bdfdb28) at mdbox-save.c:461 ctx = 0x56239be14ca0 save_mail = 0x56239bdfdb28 src_mbox = <optimized out> rec = { map_uid = 2615013952, save_date = 22051 } guid_data = 0x7fff78dbb9b0 wanted_guid = "@\362ݛ#V\000\000\240L\341\233#V\000" #12 0x00007fea1a3cf999 in mail_deliver_copy (ctx=0x56239be14ca0, mail=0x56239bdfdb28) at mail-deliver.c:547 box = <optimized out> mbox = 0x56239be0efc0 muser = 0x56239bdcb7c0 dt = 0x56239bddf1c0 #13 0x00007fea1a0c7956 in mailbox_copy_int (_ctx=_ctx@entry=0x7fff78dbba98, mail=0x56239bdfdb28) at mail-storage.c:2532 _data_stack_cur_id = 3 ctx = 0x56239be14ca0 t = 0x56239be10ce0 keywords = 0x0 pvt_flags = 0 backend_mail = 0x56239bdfdb28 ret = <optimized out> __func__ = "mailbox_copy_int" #14 0x00007fea1a0c7c38 in mailbox_save_using_mail (_ctx=_ctx@entry=0x7fff78dbba98, mail=<optimized out>) at mail-storage.c:2584 ctx = <optimized out> __func__ = "mailbox_save_using_mail" #15 0x00007fea1a3d02ac in mail_deliver_save (ctx=ctx@entry=0x7fff78dbbc60, mailbox=<optimized out>, flags=flags@entry=0, keywords=keywords@entry=0x0, storage_r=storage_r@entry=0x7fff78dbbc50) at mail-deliver.c:363 open_ctx = { user = 0x56239bdcacb8, lda_mailbox_autocreate = false, lda_mailbox_autosubscribe = false } box = 0x56239be0e6b8 trans_flags = <optimized out> t = 0x56239be10ce0 save_ctx = 0x0 headers_ctx = 0x0 kw = 0x0 dest_mail = <optimized out> error = MAIL_ERROR_NONE mailbox_name = 0x56239a9d0a54 "INBOX" errstr = 0x0 guid = 0x6adf0aebb9aa5b00 <error: Cannot access memory at address 0x6adf0aebb9aa5b00> changes = { pool = 0x1, uid_validity = 434166593, saved_uids = { arr = { buffer = 0x100000000, element_size = 7700885895375379200 }, v = 0x100000000, v_modifiable = 0x100000000 }, ignored_modseq_changes = 2614870800, changed = 35, no_read_perm = 86 } default_save = <optimized out> ret = 0 __func__ = "mail_deliver_save" #16 0x00007fea1a3d0916 in mail_deliver (ctx=ctx@entry=0x7fff78dbbc60, storage_r=storage_r@entry=0x7fff78dbbc50) at mail-deliver.c:496 muser = 0x56239bdcb7c0 ret = <optimized out> __func__ = "mail_deliver" #17 0x000056239a9cedc0 in lmtp_local_deliver (session=0x56239bddf1a8, src_mail=0x56239bdfdb28, rcpt=0x56239bdd5c80, trans=0x56239bde0d68, cmd=0x56239bde1ea8, local=0x56239bde2020) at lmtp-local.c:603 set_parser = <optimized out> line = <optimized out> str = 0x56239bd7bc08 proxy_data = { proto = SMTP_PROXY_PROTOCOL_LMTP, source_ip = { family = 0, u = { ip6 = { __in6_u = { __u6_addr8 = '\000' <repeats 15 times>, __u6_addr16 = {0, 0, 0, 0, 0, 0, 0, 0}, __u6_addr32 = {0, 0, 0, 0} } }, ip4 = { s_addr = 0 } } }, source_port = 0, helo = 0x56239bd8d470 "mail-cbf.charite.de", login = 0x0, ttl_plus_1 = 0, timeout_secs = 0, extra_fields = 0x0, extra_fields_count = 0 } delivery_time_started = { tv_sec = 1520258982, tv_usec = 162818 } sets = <optimized out> rcpt_user = 0x56239bdcacb8 mail_set = <optimized out> username = <optimized out> rcpt_idx = 0 smtp_set = 0x56239be046e0 lda_set = 0x56239be04750 ns = <optimized out> rcpt_to = 0x56239bde0e78 trcpt = 0x56239bde0e38 storage = 0x56239bdcecc8 mail_error = 1793002219 ret = <optimized out> client = 0x56239bdbc338 service_user = <optimized out> dctx = { pool = 0x56239bddf180, set = 0x56239be04750, smtp_set = 0x56239be046e0, session = 0x56239bddf1a8, session_time_msecs = 0, delivery_time_started = { tv_sec = 1520258982, tv_usec = 162818 }, dup_db = 0x0, session_id = 0x56239bd8d450 "2B+kCaZPnVpBPAAAplP5LA", src_mail = 0x56239bdfdb28, mail_from = 0x56239bde0e08, mail_params = { auth = 0x0, body = { type = SMTP_PARAM_MAIL_BODY_TYPE_UNSPECIFIED, ext = 0x0 }, envid = 0x0, ret = SMTP_PARAM_MAIL_RET_UNSPECIFIED, size = 0, extra_params = { arr = { buffer = 0x0, element_size = 0 }, v = 0x0, v_modifiable = 0x0 } }, rcpt_to = 0x56239bde0e78, rcpt_params = { orcpt = { addr_type = 0x0, addr = 0x56239bde0e78, addr_raw = 0x0 }, notify = SMTP_PARAM_RCPT_NOTIFY_UNSPECIFIED, extra_params = { arr = { buffer = 0x0, element_size = 0 }, v = 0x0, v_modifiable = 0x0 } }, rcpt_user = 0x56239bdcacb8, rcpt_default_mailbox = 0x56239a9d0a54 "INBOX", dest_mail = 0x0, cache = 0x0, tempfail_error = 0x0, tried_default_save = true, saved_mail = false, save_dest_mail = false, mailbox_full = false, dsn = false } input = <optimized out> var_table = <optimized out> error = 0x0 #18 lmtp_local_deliver_to_rcpts (session=0x56239bddf1a8, trans=0x56239bde0d68, cmd=0x56239bde1ea8, local=0x56239bde2020) at lmtp-local.c:657 rcpt = 0x56239bdd5c80 first_uid = 4294967295 src_mail = 0x56239bdfdb28 count = <optimized out> i = 0 #19 lmtp_local_data (client=client@entry=0x56239bdbc338, cmd=cmd@entry=0x56239bde1ea8, trans=trans@entry=0x56239bde0d68, input=<optimized out>) at lmtp-local.c:734 local = 0x56239bde2020 session = 0x56239bddf1a8 old_uid = 0 #20 0x000056239a9cdb53 in cmd_data_finish (trans=0x56239bde0d68, cmd=0x56239bde1ea8, client=0x56239bdbc338) at commands.c:144 state = 0x56239bdbc3c0 input_proxy = 0x0 input_msg = 0x0 input_local = 0x56239bde26b8 inputs = {0x0, 0x56239bde2238, 0x0} #21 cmd_data_continue (conn_ctx=0x56239bdbc338, cmd=0x56239bde1ea8, trans=0x56239bde0d68) at commands.c:190 client = 0x56239bdbc338 state = 0x56239bdbc3c0 data_input = <optimized out> data = <optimized out> size = 543 ret = <optimized out> __func__ = "cmd_data_continue" #22 0x00007fea19d566e0 in cmd_data_handle_input (cmd=0x56239bde1ea8) at smtp-server-cmd-data.c:199 conn = 0x56239bde0930 callbacks = 0x56239abd27a0 <lmtp_callbacks> command = 0x56239bde1ea8 data_cmd = 0x56239bde83e8 ret = <optimized out> __func__ = "cmd_data_handle_input" #23 0x00007fea19dea649 in io_loop_call_io (io=0x56239bdba970) at ioloop.c:614 ioloop = 0x56239bd82c70 t_id = 2 __func__ = "io_loop_call_io" #24 0x00007fea19debf29 in io_loop_handler_run_internal (ioloop=ioloop@entry=0x56239bd82c70) at ioloop-epoll.c:222 ctx = 0x56239bd849f0 ret = <optimized out> __func__ = "cmd_data_handle_input" #23 0x00007fea19dea649 in io_loop_call_io (io=0x56239bdba970) at ioloop.c:614 ioloop = 0x56239bd82c70 t_id = 2 __func__ = "io_loop_call_io" #24 0x00007fea19debf29 in io_loop_handler_run_internal (ioloop=ioloop@entry=0x56239bd82c70) at ioloop-epoll.c:222 ctx = 0x56239bd849f0 ---Type <return> to continue, or q <return> to quit--- io = <optimized out> tv = { tv_sec = 299, tv_usec = 999816 } events_count = <optimized out> msecs = <optimized out> ret = 1 i = 0 j = <optimized out> call = <optimized out> __func__ = "io_loop_handler_run_internal" #25 0x00007fea19dea752 in io_loop_handler_run (ioloop=<optimized out>) at ioloop.c:666 No locals. #26 0x00007fea19dea968 in io_loop_run (ioloop=0x56239bd82c70) at ioloop.c:639 __func__ = "io_loop_run" #27 0x00007fea19d672a3 in master_service_run (service=0x56239bd82b00, callback=<optimized out>) at master-service.c:767 No locals. #28 0x000056239a9ccc3d in main (argc=1, argv=0x56239bd82890) at main.c:159 set_roots = {0x56239abd3280 <smtp_submit_setting_parser_info>, 0x56239abd31e0 <lda_setting_parser_info>, 0x56239abd2600 <lmtp_setting_parser_info>, 0x0} service_flags = <optimized out> storage_service_flags = (MAIL_STORAGE_SERVICE_FLAG_DISALLOW_ROOT | MAIL_STORAGE_SERVICE_FLAG_USERDB_LOOKUP | MAIL_STORAGE_SERVICE_FLAG_TEMP_PRIV_DROP | MAIL_STORAGE_SERVICE_FLAG_NO_LOG_INIT | MAIL_STORAGE_SERVICE_FLAG_NO_IDLE_TIMEOUT) tmp_base_dir = 0x56239bd7a040 "tp data)" c = <optimized out> error = 0x0 -- Ralf Hildebrandt Geschäftsbereich IT | Abteilung Netzwerk Charité - Universitätsmedizin Berlin Campus Benjamin Franklin Hindenburgdamm 30 | D-12203 Berlin Tel. +49 30 450 570 155 | Fax: +49 30 450 570 962 ralf.hildebrandt(a)charite.de | https://www.charite.de

3 3

Mail addresses with quotes + Postfix
by Philipp Berger 07 Mar '18

07 Mar '18

Dear all, I have a working setup with Postfix + Dovecot, storing users in a MySQL table. I ran into problems setting up and using a mail address like a"@"b(a)mydomain.tld, which by RFC should be valid, but leads to problems in Dovecot. From my debugging, I can see that on the lookup, Dovecot replaces %n with "a" (quotes added by me) and %d with "b(a)mydomain.tld" (quotes added by me). So the original quotes are gone, and the domain/user split is incorrect. I am not sure of Postfix passes the address without quotes to Dovecot or whether Dovecot can not handle quotes correctly, but I was hoping that someone with more insight into Dovecot could help me out here. System Info: Debian 9, Postifx 3.1.6-0+deb9u1, Dovecot 2.2.27-3+deb9u1 Postfix master.cf for Dovecot: dovecot unix - n n - - pipe flags=DRhu user=virtual:virtual argv=/usr/lib/dovecot/dovecot-lda -f ${sender} -d ${user}@${nexthop} I am grateful for any hints :) Thank you in advance, kind regards, Philipp

4 12