- dovecot - dovecot.org

Pigeonhole vacation and envelope extension recipient addresses
by David Zambonini 31 Oct '17

31 Oct '17

I have a situation where my LMTP RCPT TO: goes to a mailbox user account that does not reflect either the final (through aliasing) or envelope email address. SMTP RCPT TO: (envelope-local-part@envelope-domain) Final Recipient: (final-local-part@final-domain) LMTP RCPT TO: (mailbox-local-part@mailbox-domain) I'd like to use the final recipient as the vacation address, but also have the envelope recipient address used in place of the LTMP RCPT TO for the envelope extension. At the moment it looks like I can set one or the other? Let's say I add an x-final-to and x-envelope-to header to the email headers before delivering via LMTP. Then, setting: sieve_vacation_use_original_recipient = yes lda_original_recipient_header = x-final-to will get the vacation replies coming from where I'd like, but the envelope extension will not reflect the original SMTP envelope to. Conversely, setting: lda_original_recipient_header = x-envelope-to might get the envelope extension working correctly, but will not give vacation replies from where I'd like. Is there some way anyone is aware of to configure both final and envelope senders based on email headers (that doesn't involve lda flags, these are on different systems), or am I currently out of luck? I've tried playing with DSN ORCPT but it seems like a non-starter trying to get it passed through (exim) -- David Zambonini

3 2

antispam plugin with IMAPSieve
by j.emerlik 31 Oct '17

31 Oct '17

Hi, my dovecot is configured with IMAP Sieve antispam plugin (sa-learn), everything seems to be working correctly but in debug mode in my log file I noticed "dovecot: imap: Error". Last 14 lines od my log file: Oct 31 15:05:25 mnode1 dovecot: imap: Error: Oct 31 15:05:25.040 [10743] dbg: bayes: tokenized header: 90 tokens Oct 31 15:05:25 mnode1 dovecot: imap: Error: Oct 31 15:05:25.067 [10743] dbg: bayes: seen (8e031cc9fec44b6607dc7f6b37903fc49e9c8526@sa_generated) put Oct 31 15:05:25 mnode1 dovecot: imap: Error: Oct 31 15:05:25.067 [10743] dbg: bayes: learned '8e031cc9fec44b6607dc7f6b37903fc49e9c8526@sa_generated', atime: 1509457623 Oct 31 15:05:25 mnode1 dovecot: imap: Error: Oct 31 15:05:25.068 [10743] dbg: plugin: Mail::SpamAssassin::Plugin::Bayes=HASH(0x2adc340) implements 'learner_close', priority 0 Oct 31 15:05:25 mnode1 dovecot: imap: Error: Oct 31 15:05:25.033 [10743] dbg: bayes: using userid: 7 Oct 31 15:05:25 mnode1 dovecot: imap: Error: Oct 31 15:05:25.037 [10743] dbg: bayes: tokenized body: 174 tokens Oct 31 15:05:25 mnode1 dovecot: imap: Error: Oct 31 15:05:25.037 [10743] dbg: bayes: tokenized uri: 0 tokens Oct 31 15:05:25 mnode1 dovecot: imap: Error: Oct 31 15:05:25.037 [10743] dbg: bayes: tokenized invisible: 0 tokens Oct 31 15:05:25 mnode1 dovecot: imap: Error: Oct 31 15:05:25.040 [10743] dbg: bayes: tokenized header: 90 tokens Oct 31 15:05:25 mnode1 dovecot: imap: Error: Oct 31 15:05:25.067 [10743] dbg: bayes: seen (8e031cc9fec44b6607dc7f6b37903fc49e9c8526@sa_generated) put Oct 31 15:05:25 mnode1 dovecot: imap: Error: Oct 31 15:05:25.067 [10743] dbg: bayes: learned '8e031cc9fec44b6607dc7f6b37903fc49e9c8526@sa_generated', atime: 1509457623 Logs looks good and I don't understand "Error:" from log, It looks like sa-learn is connected to database and learned bayes. Error in log it's normal or It's means that it not work ? Regards, Jack

2 1

Re: Bug#876364: dovecot-sieve: Just discovered imap_sieve/sieve_imapsieve is not set up to work with virtual mailboxes.
by Apollon Oikonomopoulos 31 Oct '17

31 Oct '17

Control: tags -1 + moreinfo upstream [Forwarding this to the Dovecot mailing list, just in case someone can help] Hi, Thanks for the report! See my comments inline. On 11:56 Thu 21 Sep , Thurgood Angelou wrote: > Package: dovecot-core > Version: 1:2.2.32-2 > > I've just discovered a bug where the sieve plugin (especially IMAP) > will not work with a virtual mailbox. I recently found this out when > testing a virtual mailbox setup and I use imap_sieve for SPAM > filtering so to lose that would be painful. > > This is what is reported in dovecot's debug log... > > Sep 21 10:53:01 imap(personal(a)othersider92.com): Panic: file mail-index-map.c: line 549 (mail_index_map_lookup_seq_range): assertion failed: (first_uid > 0) > Sep 21 10:53:01 imap(personal(a)othersider92.com): Error: Raw backtrace: /usr/lib/dovecot/libdovecot.so.0(+0x9f0a2) [0x7f4226fd50a2] -> /usr/lib/dovecot/libdovecot.so.0(+0x9f19a) [0x7f4226fd519a] -> /usr/lib/dovecot/libdovecot.so.0(i_fatal+0) [0x7f4226f65cf8] -> /usr/lib/dovecot/libdovecot-storage.so.0(mail_index_map_lookup_seq_range+0x120) [0x7f422733dae0] -> /usr/lib/dovecot/libdovecot-storage.so.0(+0xe8d1d) [0x7f422734cd1d] -> /usr/lib/dovecot/libdovecot-storage.so.0(mail_index_lookup_seq+0xf) [0x7f4227350e9f] -> /usr/lib/dovecot/modules/lib20_virtual_plugin.so(+0x82aa) [0x7f422678a2aa] -> /usr/lib/dovecot/modules/lib95_imap_sieve_plugin.so(+0x708c) [0x7f422657d08c] -> /usr/lib/dovecot/libdovecot-storage.so.0(mailbox_transaction_commit_get_changes+0x52) [0x7f42272adca2] -> dovecot/imap(+0x10084) [0x556502adb084] -> dovecot/imap(command_exec+0x5c) [0x556502ae7d9c] -> dovecot/imap(+0x1b322) [0x556502ae6322] -> dovecot/imap(+0x1b3bc) [0x556502ae63bc] -> dovecot/imap(client_handle_input > +0x18d) [0x556502ae677d] -> dovecot/imap(client_input+0xac) [0x556502ae6ccc] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_call_io+0x52) [0x7f4226fea742] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run_internal+0x12e) [0x7f4226febd8e] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run+0x36) [0x7f4226fea7d6] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_run+0x38) [0x7f4226fea988] -> /usr/lib/dovecot/libdovecot.so.0(master_service_run+0x13) [0x7f4226f70353] -> dovecot/imap(main+0x329) [0x556502ad9139] -> /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xf1) [0x7f4226bb92e1] -> dovecot/imap(_start+0x2a) [0x556502ad92ca] After mixing in the debug symbols, this backtrace becomes: /usr/lib/dovecot/libdovecot.so.0(+0x9f0a2) [0x7f4226fd50a2] default_fatal_finish at ./src/lib/failures.c:195 /usr/lib/dovecot/libdovecot.so.0(+0x9f19a) [0x7f4226fd519a] ?? at ./src/lib/failures.c:670 /usr/lib/dovecot/libdovecot.so.0(i_fatal+0) [0x7f4226f65cf8] i_fatal at ./src/lib/failures.c:280 /usr/lib/dovecot/libdovecot-storage.so.0(mail_index_map_lookup_seq_range+0x120) [0x7f422733dae0] mail_index_map_lookup_seq_range at ./src/lib-index/mail-index-map.c:550 /usr/lib/dovecot/libdovecot-storage.so.0(+0xe8d1d) [0x7f422734cd1d] tview_lookup_seq_range at ./src/lib-index/mail-index-transaction-view.c:178 /usr/lib/dovecot/libdovecot-storage.so.0(mail_index_lookup_seq+0xf) [0x7f4227350e9f] mail_index_lookup_seq at ./src/lib-index/mail-index-view.c:522 /usr/lib/dovecot/modules/lib20_virtual_plugin.so(+0x82aa) [0x7f422678a2aa] virtual_mail_set_uid at ./src/plugins/virtual/virtual-mail.c:213 /usr/lib/dovecot/modules/lib95_imap_sieve_plugin.so(+0x708c) [0x7f422657d08c] imap_sieve_mailbox_transaction_run at ./pigeonhole/src/plugins/imapsieve/imap-sieve-storage.c:752 (inlined by: imap_sieve_mailbox_transaction_commit at ./pigeonhole/src/plugins/imapsieve/imap-sieve-storage.c:807) /usr/lib/dovecot/libdovecot-storage.so.0(mailbox_transaction_commit_get_changes+0x52) [0x7f42272adca2] mailbox_transaction_commit_get_changes at ./src/lib-storage/mail-storage.c:2083 dovecot/imap(+0x10084) [0x556502adb084] cmd_copy_full at ./src/imap/cmd-copy.c:146 dovecot/imap(command_exec+0x5c) [0x556502ae7d9c] command_exec at ./src/imap/imap-commands.c:200 dovecot/imap(+0x1b322) [0x556502ae6322] client_command_input at ./src/imap/imap-client.c:1088 dovecot/imap(+0x1b3bc) [0x556502ae63bc] client_command_input at ./src/imap/imap-client.c:1150 dovecot/imap(client_handle_input+0x18d) [0x556502ae677d] client_handle_input at ./src/imap/imap-client.c:1203 dovecot/imap(client_input+0xac) [0x556502ae6ccc] client_input at ./src/imap/imap-client.c:1249 /usr/lib/dovecot/libdovecot.so.0(io_loop_call_io+0x52) [0x7f4226fea742] io_loop_call_io at ./src/lib/ioloop.c:600 /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run_internal+0x12e) [0x7f4226febd8e] io_loop_handler_run_internal at ./src/lib/ioloop-epoll.c:223 /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run+0x36) [0x7f4226fea7d6] io_loop_handler_run at ./src/lib/ioloop.c:648 /usr/lib/dovecot/libdovecot.so.0(io_loop_run+0x38) [0x7f4226fea988] io_loop_run at ./src/lib/ioloop.c:622 /usr/lib/dovecot/libdovecot.so.0(master_service_run+0x13) [0x7f4226f70353] master_service_run at ./src/lib-master/master-service.c:667 dovecot/imap(main+0x329) [0x556502ad9139] main at ./src/imap/main.c:491 /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xf1) [0x7f4226bb92e1] __libc_start_main at ../csu/libc-start.c:325 dovecot/imap(_start+0x2a) [0x556502ad92ca] start at ??:0 > -- System Information: > Debian Release: 8.2 > APT prefers oldstable-updates > APT policy: (500, 'oldstable-updates'), (500, 'unstable'), (500, 'testing'), (500, 'oldstable') > Architecture: amd64 (x86_64) > > Kernel: Linux 3.16.0-4-amd64 (SMP w/2 CPU cores) > Locale: LANG=en_GB.UTF-8, LC_CTYPE=en_GB.UTF-8 (charmap=UTF-8), LANGUAGE=en_GB:en (charmap=UTF-8) > Shell: /bin/sh linked to /bin/dash > Init: systemd (via /run/systemd/system) > > Versions of packages dovecot-sieve depends on: > ii dovecot-core 1:2.2.32-2 > ii libc6 2.24-17 > ii ucf 3.0030 > > dovecot-sieve recommends no packages. > > dovecot-sieve suggests no packages. > > Versions of packages dovecot-sieve is related to: > ii dovecot-core [dovecot-common] 1:2.2.32-2 > pn dovecot-dbg <none> > pn dovecot-dev <none> > ii dovecot-gssapi 1:2.2.32-2 > ii dovecot-imapd 1:2.2.32-2 > ii dovecot-ldap 1:2.2.32-2 > ii dovecot-lmtpd 1:2.2.32-2 > ii dovecot-managesieved 1:2.2.32-2 > ii dovecot-mysql 1:2.2.32-2 > pn dovecot-pgsql <none> > pn dovecot-pop3d <none> > ii dovecot-sieve 1:2.2.32-2 > pn dovecot-sqlite <none> Could you also include the output of doveconf -n? Regards, Apollon

3 2

Re: Disconnected: Inactivity (no auth attempts in 180 secs)
by Joseph Tam 31 Oct '17

31 Oct '17

Alexandre <byalefp(a)yahoo.com.br> wrote: > I can send and receive mails using: > IMAP 143 with TLS OK, IMAP STARTTLS is working in some sense. (Your MTA handles SMTP, not dovecot.) > The hangup occours inside of my LAN using Outlook 2016, and Outside > also trying access on 4G from my Android smartphone. > > My goal is enable also POP3s and IMAPs using TLS. [voluminous diagnostics] I can't really see from what you present what the problem is. Can you report the output of openssl s_client -starttls imap {imap-server}:143 openssl s_client -starttls pop3 {imap-server}:110 (from both inside and outside), as well as any matching log entries. Joseph Tam <jtam.home(a)gmail.com>

1 0

Re: Password encription
by Joseph Tam 30 Oct '17

30 Oct '17

> Aki, (Not speaking for Aki) > I understand that salted passwords saved in my database and stronger hash > algorithm course that it will require more processor time/power to crack my > passwords. > > But only when hackers have direct access to my database what means that > hackers have access to my passwords hashes (eg. hackers stolen my database). > > My Dovecot use passwords saved in database as SHA256 and hackers can use > only SMTP, IMAP or POP3 services to try crack it using dictionary attack (I > understand that they using plain text dictionaty passwords). > > Stronger hash algorithm and salt is useful when hackers have direct access > to my database but when they use services as SMTP, IMAP or POP3 > to crack passwords only longer and more complicated password can be more > secure. > > I do not understand this correctly ? Yes, your understanding is basically correct. However, history gives lots of examples of broken systems that explicitly or implicitly relied on one critical system not failing -- they lacked defense in depth or resilience. Examples are "this system has no bugs", "my system does not leak hashes", "this algorithm is unbreakable", "we'll never see a CAT5 hurricane", etc. If these critical assumption ever becomes untrue, the foundation of your defense crumbles. If you narrow your attack definition to only include in-protocol remote brute forcing, then any decent password will take far too long to break that way (esp. with throttling controls that are built-in). Your log files will overflow recording the attempts long before you can expect a password to be cracked. However, you're still susceptable to the qwerty passwords. If this is your *only* line of defense, it is brittle. A robustly secure system will overlap protection: strong hashes, password compliance systems, brute force countermeasures, file permissions/OS hardening, network origins vetting, anti-DoS measures, etc. Keep this picture in mind that I found on CLCERT https://www.clcert.cl/humor/img/weakest-link-road.jpg Joseph Tam <jtam.home(a)gmail.com>

1 0

Dovecot and the Maildir path
by Will Merkens 30 Oct '17

30 Oct '17

System basics Centos 7.3 Dovecot 2.2.32 (dfbe293d4) I am working on a replacement mail server for work and one of the features I wanted was ldap authentication After much fiddling I got it to work. But I encountered a issue where two different methods of testing a mail account resulted in the mail_location being different I set mail_location = maildir:/var/spool/maildir/%d/%n/Maildir in dovecot.conf when I test the authentication and to see if the folders are created correctly on first use I have two results depending on how I test. First test was from openssl openssl s_client -connect mail2:993 I have no problem connecting, I issue the following commands * OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE AUTH=PLAIN] Dovecot ready. a login testuser(a)userful.com ******** a OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE SORT SORT=DISPLAY THREAD=REFERENCES THREAD=REFS THREAD=ORDEREDSUBJECT MULTIAPPEND URL-PARTIAL CATENATE UNSELECT CHILDREN NAMESPACE UIDPLUS LIST-EXTENDED I18NLEVEL=1 CONDSTORE QRESYNC ESEARCH ESORT SEARCHRES WITHIN CONTEXT=SEARCH LIST-STATUS BINARY MOVE] Logged in a list "" * * LIST (\HasNoChildren) "." INBOX a OK List completed (0.001 + 0.000 secs). * BYE Disconnected for inactivity. closed But when I look in the mail server at /var/spool/maildir the testuser is not created inside of userful.com but at the same level as userful.com contrary to the %d in mail_location settings. Now second method doveadm -D mailbox list -u 'testuser(a)userful.com' This correctly creates the user under the domain as specified. for logs I have from journalctl for openssl Oct 30 07:37:12 mail2 dovecot[10722]: auth: Debug: client in: AUTH 2 PLAIN service=imap secured session=VgBmvMNcQoTAqHsn lip=192.168. 123.236 rip=192.168.123.39 lport=993 rport=33858 resp=AHRlc3R1c2VyQHVzZXJmdWwuY29tADk5dGVzdHVzZXI5OQ== (previous base64 data may contain sensitive data) Oct 30 07:37:12 mail2 dovecot[10722]: auth: Debug: ldap(testuser(a)userful.com,192.168.123.39,<VgBmvMNcQoTAqHsn>): bind search: base=ou=People,dc=userful,dc=ca filter=(&(objectClass=posixAccount)(uid=testuser)) Oct 30 07:37:12 mail2 dovecot[10722]: auth: Debug: ldap(testuser(a)userful.com,192.168.123.39,<VgBmvMNcQoTAqHsn>): result: uid=testuser; uid unused Oct 30 07:37:12 mail2 dovecot[10722]: auth: Debug: ldap(testuser(a)userful.com,192.168.123.39,<VgBmvMNcQoTAqHsn>): username changed testuser(a)userful.com -> testuser Oct 30 07:37:12 mail2 dovecot[10722]: auth: Debug: ldap(testuser,192.168.123.39,<VgBmvMNcQoTAqHsn>): result: uid=testuser Oct 30 07:37:12 mail2 dovecot[10722]: auth: Debug: client passdb out: OK 2 user=testuser original_user=testuser(a)userful.com Oct 30 07:37:12 mail2 dovecot[10722]: auth: Debug: master in: REQUEST 2784755713 10725 2 d4a357fe811a1da8bd725b82fc1da2ab session_pid=11051 request_auth_token Oct 30 07:37:12 mail2 dovecot[10722]: auth: Debug: ldap(testuser,192.168.123.39,<VgBmvMNcQoTAqHsn>): user search: base=ou=People,dc=userful,dc=ca scope=subtree filter=(&(objectClass=posixAccount)(uid=testuser)) fields=homeDirectory,uidNumber,gidNumber Oct 30 07:37:12 mail2 dovecot[10722]: auth: Debug: ldap(testuser,192.168.123.39,<VgBmvMNcQoTAqHsn>): result: homeDirectory=/nfs/home/test-user uidNumber=6000 gidNumber=1000; homeDirectory,uidNumber,gidNumber unused Oct 30 07:37:12 mail2 dovecot[10722]: auth: Debug: ldap(testuser,192.168.123.39,<VgBmvMNcQoTAqHsn>): result: homeDirectory=/nfs/home/test-user uidNumber=6000 gidNumber=1000 Oct 30 07:37:12 mail2 dovecot[10722]: auth: Debug: master userdb out: USER 2784755713 testuser home=/nfs/home/test-user uid=6000 gid=1000 auth_token=29e6ac32c85cf1b69eeabbe8e4f8e4810e9a3468 auth_user=testuser(a)userful.com Oct 30 07:37:12 mail2 dovecot[10722]: imap-login: Login: user=<testuser>, method=PLAIN, rip=192.168.123.39, lip=192.168.123.236, mpid=11051, TLS, session=<VgBmvMNcQoTAqHsn> for doveadm Oct 30 07:39:12 mail2 dovecot[10722]: auth: Debug: master in: USER 1 testuser(a)userful.com service=doveadm Oct 30 07:39:12 mail2 dovecot[10722]: auth: Debug: ldap(testuser(a)userful.com): user search: base=ou=People,dc=userful,dc=ca scope=subtree filter=(&(objectClass=posixAccount)(uid=testuser)) fields=homeDirectory,uidNumber,gidNumber Oct 30 07:39:12 mail2 dovecot[10722]: auth: Debug: ldap(testuser(a)userful.com): result: homeDirectory=/nfs/home/test-user uidNumber=6000 gidNumber=1000; homeDirectory,uidNumber,gidNumber unused Oct 30 07:39:12 mail2 dovecot[10722]: auth: Debug: ldap(testuser(a)userful.com): result: homeDirectory=/nfs/home/test-user uidNumber=6000 gidNumber=1000 Oct 30 07:39:12 mail2 dovecot[10722]: auth: Debug: userdb out: USER 1 testuser(a)userful.com home=/nfs/home/test-user uid=6000 gid=1000 Any ideas and any settings files that I need to post. -- William Merkens IT Support Analyst Userful Corporation +1 403.289.2177 ext.289 +1 866 USERFUL (1-866-873-7385) Suite 300, 736 8th Ave. SW Calgary AB T2P 1H4 Managed Desktops Done Right. http://www.userful.com

2 1

dovecot-2.3 (-git) Warning and Fatal Compile Error
by Reuben Farrelly 30 Oct '17

30 Oct '17

I haven't been tracking dovecot-2.3 until now, but I've just given it a quick run, and there are a few things that may need some attention. Linux x86-64, Gentoo, GCC-7.2.0 Dovecot 2.3 @ commit 32c2612514a404ebc226f32bb88f28d76ceb1db1 Compiled with: ./configure --prefix=/usr --build=x86_64-pc-linux-gnu --host=x86_64-pc-linux-gnu --mandir=/usr/share/man --infodir=/usr/share/info --datadir=/usr/share --sysconfdir=/etc --localstatedir=/var/lib --disable-dependency-tracking --disable-silent-rules --docdir=/usr/share/doc/dovecot-9999_p20171018 --htmldir=/usr/share/doc/dovecot-9999_p20171018/html --libdir=/usr/lib64 --localstatedir=/var --with-moduledir=/usr/lib64/dovecot --without-stemmer --disable-rpath --with-icu --with-systemdsystemunitdir=/usr/lib/systemd/system --enable-maintainer-mode --with-bzlib --without-libcap --without-gssapi --without-ldap --with-lucene --with-lz4 --with-lzma --without-mysql --with-pam --without-pgsql --without-sqlite --without-solr --with-ssl --with-libwrap --without-textcat --without-vpopmail --with-zlib --disable-static Warnings: (Lots of this one...) /bin/sh ../../../libtool --tag=CC --mode=compile x86_64-pc-linux-gnu-gcc -DHAVE_CONFIG_H -I. -I../../.. -I../../../src/lib -I../../../src/lib-settings -I../../../src/lib-fts -I../../../src/lib-ssl-iostream -I../../../src/lib-http -I../../../src/lib-mail -I../../../src/lib-imap -I../../../src/lib-index -I../../../src/lib-storage -I../../../src/lib-storage/index -I../../../src/doveadm -std=gnu99 -O0 -g -pipe -march=native -mtune=native -ggdb -fstack-protector-strong -D_FORTIFY_SOURCE=2 -Wall -W -Wmissing-prototypes -Wmissing-declarations -Wpointer-arith -Wchar-subscripts -Wformat=2 -Wbad-function-cast -fno-builtin-strftime -Wstrict-aliasing=2 -c -o fts-user.lo fts-user.c libtool: compile: x86_64-pc-linux-gnu-gcc -DHAVE_CONFIG_H -I. -I../../.. -I../../../src/lib -I../../../src/lib-settings -I../../../src/lib-fts -I../../../src/lib-ssl-iostream -I../../../src/lib-http -I../../../src/lib-mail -I../../../src/lib-imap -I../../../src/lib-index -I../../../src/lib-storage -I../../../src/lib-storage/index -I../../../src/doveadm -std=gnu99 -O0 -g -pipe -march=native -mtune=native -ggdb -fstack-protector-strong -D_FORTIFY_SOURCE=2 -Wall -W -Wmissing-prototypes -Wmissing-declarations -Wpointer-arith -Wchar-subscripts -Wformat=2 -Wbad-function-cast -fno-builtin-strftime -Wstrict-aliasing=2 -c fts-storage.c -fPIC -DPIC -o .libs/fts-storage.o <command-line>:0:0: warning: "_FORTIFY_SOURCE" redefined <built-in>: note: this is the location of the previous definition In file included from /usr/include/bits/libc-header-start.h:33:0, from /usr/include/stdlib.h:25, from ../../../src/lib/lib.h:11, from fts-storage.c:3: /usr/include/features.h:376:4: warning: #warning _FORTIFY_SOURCE requires compiling with optimization (-O) [-Wcpp] # warning _FORTIFY_SOURCE requires compiling with optimization (-O) ^~~~~~~ The build then fails entirely with this: /bin/sh ../../../libtool --tag=CC --mode=compile x86_64-pc-linux-gnu-gcc -DHAVE_CONFIG_H -I. -I../../.. -I/home/portage/portage/net-mail/dovecot-9999_p20171018/work/dovecot-9999_p20171018 -I/home/portage/portage/net-mail/dovecot-9999_p20171018/work/dovecot-9999_p20171018/src/lib -I/home/portage/portage/net-mail/dovecot-9999_p20171018/work/dovecot-9999_p20171018/src/lib-dict -I/home/portage/portage/net-mail/dovecot-9999_p20171018/work/dovecot-9999_p20171018/src/lib-dns -I/home/portage/portage/net-mail/dovecot-9999_p20171018/work/dovecot-9999_p20171018/src/lib-http -I/home/portage/portage/net-mail/dovecot-9999_p20171018/work/dovecot-9999_p20171018/src/lib-mail -I/home/portage/portage/net-mail/dovecot-9999_p20171018/work/dovecot-9999_p20171018/src/lib-smtp -I/home/portage/portage/net-mail/dovecot-9999_p20171018/work/dovecot-9999_p20171018/src/lib-imap -I/home/portage/portage/net-mail/dovecot-9999_p20171018/work/dovecot-9999_p20171018/src/lib-fs -I/home/portage/portage/net-mail/dovecot-9999_p20171018/work/dovecot-9999_p20171018/src/lib-charset -I/home/portage/portage/net-mail/dovecot-9999_p20171018/work/dovecot-9999_p20171018/src/lib-auth -I/home/portage/portage/net-mail/dovecot-9999_p20171018/work/dovecot-9999_p20171018/src/lib-master -I/home/portage/portage/net-mail/dovecot-9999_p20171018/work/dovecot-9999_p20171018/src/lib-ssl-iostream -I/home/portage/portage/net-mail/dovecot-9999_p20171018/work/dovecot-9999_p20171018/src/lib-compression -I/home/portage/portage/net-mail/dovecot-9999_p20171018/work/dovecot-9999_p20171018/src/lib-settings -I/home/portage/portage/net-mail/dovecot-9999_p20171018/work/dovecot-9999_p20171018/src/lib-test -I/home/portage/portage/net-mail/dovecot-9999_p20171018/work/dovecot-9999_p20171018/src/lib-sasl -I/home/portage/portage/net-mail/dovecot-9999_p20171018/work/dovecot-9999_p20171018/src/lib-stats -I/home/portage/portage/net-mail/dovecot-9999_p20171018/work/dovecot-9999_p20171018/src/lib-dcrypt -I/home/portage/portage/net-mail/dovecot-9999_p20171018/work/dovecot-9999_p20171018/src/lib-program-client -I/home/portage/portage/net-mail/dovecot-9999_p20171018/work/dovecot-9999_p20171018/src/lib-index -I/home/portage/portage/net-mail/dovecot-9999_p20171018/work/dovecot-9999_p20171018/src/lib-storage -I/home/portage/portage/net-mail/dovecot-9999_p20171018/work/dovecot-9999_p20171018/src/lib-storage/list -I/home/portage/portage/net-mail/dovecot-9999_p20171018/work/dovecot-9999_p20171018/src/lib-storage/index -I/home/portage/portage/net-mail/dovecot-9999_p20171018/work/dovecot-9999_p20171018/src/lib-storage/index/raw -I/home/portage/portage/net-mail/dovecot-9999_p20171018/work/dovecot-9999_p20171018/src/lib-imap-storage -I/home/portage/portage/net-mail/dovecot-9999_p20171018/work/dovecot-9999_p20171018/src/plugins/quota -DMODULEDIR=\""/usr/lib64/dovecot"\" -O0 -g -pipe -march=native -mtune=native -ggdb -c -o realpath.lo realpath.c edit-mail.c: In function ‘edit_mail_wrap’: edit-mail.c:235:14: error: too few arguments to function ‘mailbox_transaction_begin’ raw_trans = mailbox_transaction_begin(raw_box, 0); ^~~~~~~~~~~~~~~~~~~~~~~~~ In file included from /home/portage/portage/net-mail/dovecot-9999_p20171018/work/dovecot-9999_p20171018/src/lib-storage/mail-storage-private.h:7:0, from edit-mail.c:16: /home/portage/portage/net-mail/dovecot-9999_p20171018/work/dovecot-9999_p20171018/src/lib-storage/mail-storage.h:651:1: note: declared here mailbox_transaction_begin(struct mailbox *box, ^~~~~~~~~~~~~~~~~~~~~~~~~ edit-mail.c: In function ‘edit_mail_set_cache_corrupted’: edit-mail.c:1662:2: error: too few arguments to function ‘edmail->wrapped->v.set_cache_corrupted’ edmail->wrapped->v.set_cache_corrupted(&edmail->wrapped->mail, field); ^~~~~~ edit-mail.c: In function ‘edit_mail_set_cache_corrupted_reason’: edit-mail.c:1671:21: error: ‘struct mail_vfuncs’ has no member named ‘set_cache_corrupted_reason’; did you mean ‘set_cache_corrupted’? edmail->wrapped->v.set_cache_corrupted_reason ^~~~~~~~~~~~~~~~~~~~~~~~~~ set_cache_corrupted edit-mail.c: At top level: edit-mail.c:1701:2: warning: initialization from incompatible pointer type [-Wincompatible-pointer-types] edit_mail_get_real_mail, ^~~~~~~~~~~~~~~~~~~~~~~ edit-mail.c:1701:2: note: (near initialization for ‘edit_mail_vfuncs.get_backend_mail’) edit-mail.c:1708:2: warning: initialization from incompatible pointer type [-Wincompatible-pointer-types] edit_mail_set_cache_corrupted, ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ edit-mail.c:1708:2: note: (near initialization for ‘edit_mail_vfuncs.set_cache_corrupted’) edit-mail.c:1710:2: warning: excess elements in struct initializer edit_mail_set_cache_corrupted_reason ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ edit-mail.c:1710:2: note: (near initialization for ‘edit_mail_vfuncs’) make[4]: *** [Makefile:481: edit-mail.lo] Error 1 make[4]: *** Waiting for unfinished jobs.... Reuben

5 9

Re: Password encription
by Joseph Tam 29 Oct '17

29 Oct '17

Aki Tuomi wrote: > The use of salt, today, is to prevent the attacker from directly seeing > who has same passwords. Of course it also will make a rainbow table > attack less useful, Not just less useful, but almost infeasible. Given the use of random salts, you would have to generate (number of possible salts) rainbow tables. This drastically changes the CPU/storage tradeoffs. > but then again, no one uses rainbow tables anymore > since it takes about few minutes to brute force a password in the cloud > or on your home computer GPU. SHA512-CRYPT uses by default 4000 rounds > on dovecot, to make it more computationally expensive, but still it's > not very strong protection anymore. I know it is theoretically possible, but really, how feasible is it? The way people talk about it, they make it sound trivial. As a test, I just generated a hash using "doveadm pw". Any takers? {SHA512-CRYPT}$6$qyQANQFbQGqOSqHh$Z4YVIe.QakXtWs63lWUmzlseKpiFzfPCKhwM0NQk8jP6QeRmk6POkCdSrFBmVO2wh.dgPCPA7Gq3sNUeKOZLM/ > MD5 with or without salt can be ATTAcked at passwords per second speed, > so using CRAM-MD5 of DIGEST-MD5 is very very poor choice. Anything with > MD5 should not be used for passwords these days. > > With Dovecot 2.3 we are making BLF-CRYPT available on all platforms, and > also adding support for ARGON2 when you have libsodium available. Straight hashes, without question, are weak. I routinely break NTLM hashes with rainbow tables. I'm *not* arguing against the use of stronger hashes, I'm just skeptical of the FUD surrounding the user of older salted hashes. This is especially true if the hashes are guarded against leakage, as most are. Strong crypt-hashes are an extra layer of protection (defense in depth). This page (if you trust 3rd parties) will report whether a password was ever found in a breached databases. You can also download the SHA1 hashes of all their known cracked passwords. It's big -- 5.3Gb 7-zipped file. https://haveibeenpwned.com/Passwords "j.emerlik" further asks: > You mean that today they using encrypted passwords to seeing > who has same passwords using brute force, hashes dictionary attack ? They precompute hashes for large number of password candidates, then look up hashes in that table. Rainbow tables are a way of folding large tables into a smaller ones, trading off space for extra CPU time. However, for hashes that use non-trivial salts, you would need to precompute an astronomically large number of tables. An attacker might be better off with a straight CPU-bound brute force search. Joseph Tam <jtam.home(a)gmail.com>

3 3

Need help in understanding auth digest-md5 and realm
by Admin Beckspaced 28 Oct '17

28 Oct '17

Hello dovecot community, I've setup dovecot and need a bit help in understanding the auth mechanism digest-md5 and realm in 10-auth.conf I got auth_mechanisms = plain login digest-md5 cram-md5 apop #auth_realms = #auth_default_realm = So i got empty realms. Auth normally works fine and clients can auth with mechanism digest-md5 and I see the following log entries: dovecot: auth: Debug: sql(user(a)temizbau.de,46.85.229.153,<klUjO3FcTy8uVeWZ>): Generating DIGEST-MD5 from user 'user(a)temizbau.de', password 'xxxx' dovecot: auth: Debug: sql(user(a)gruene-wiesentheid.de,87.168.26.5,<ISVLQXFcT/xXqBoF>): Generating DIGEST-MD5 from user 'user@gruene-wiesentheid.de@', password 'xxxxxxxxxx' dovecot: auth: Debug: sql(user(a)vitaler-genuss.de,81.209.203.170,<tzxyT3FcT9RR0cuq>): Generating DIGEST-MD5 from user 'user(a)vitaler-genuss.de', password 'xxxxxxxxxxx' But sometimes clients get a password mismatch and I the see the following log entries: dovecot: auth: Debug: sql(user(a)temizbau.de,80.187.103.15,<adzhAnVclmxQu2cP>): Generating DIGEST-MD5 from user 'user@temizbau.de@mail.beckspaced.com', password 'xxxx' dovecot: auth: Debug: sql(user(a)thansadet.com,87.218.86.165,<LWItYHVc6r1X2lal>): Generating DIGEST-MD5 from user 'user@thansadet.com@mail.beckspaced.com', password 'xxxxxxxxxx' dovecot: auth: Debug: sql(user(a)plaa-thansadetresort.com,110.164.127.146,<aGhcvHBcStJupH+S>): Generating DIGEST-MD5 from user 'user@plaa-thansadetresort.com@imap.beckspaced.com', password 'xxxxxxxxxx' when there's a password mismatch I see a different user string for generating the digest-md5 hash. i suppose users use a different mail client and the mail client does things differently? How can I fix this password mismatch thing? Do i just need to set an auth_realms of some random string in the 10-auth.conifig Or does the auth_realms need to be a host name? Domain name of some sort? For the moment I just removed the digest-md5 mechanism ... Or could I just simply not offer that mechanism? If someone could shed some light on this I would be more than grateful ;) Thanks & greetings Becki

4 6

Quota warning executable can not log to /dev/stdout
by Michael Härtl 28 Oct '17

28 Oct '17

I'm running dovecot 2.2.27 in a alpine based docker container and want to log to /dev/stdout. I therefore added this setting: log_path = /dev/stdout Logging works fine so far. Now I've added a quota-warning script. With the log_path setting above the script creates warnings like: Oct 28 10:27:01 quota-warning: Error: Can't open log file /dev/stdout: No such device or address Oct 28 10:27:01 quota-warning: Fatal: master: service(quota-warning): child 460 returned error 75 When I change log_path to something like /tmp/dovecot.log everything works fine. Dovecot itself is started via s6 with a run script like this: #!/bin/sh exec /usr/sbin/dovecot -F -c /etc/dovecot/dovecot.conf What could cause this issue and how could I fix it? For the record here's my doveconf -n output: # 2.2.27 (c0f36b0): /etc/dovecot/dovecot.conf # OS: Linux 4.4.27-x86_64-jb1 x86_64 ext4 auth_mechanisms = plain login auth_verbose = yes first_valid_uid = 100 log_path = /dev/stdout mail_gid = dovecot mail_home = /var/mail/domains/%d/%n mail_location = maildir:/var/mail/domains/%d/%n mail_max_userip_connections = 160 mail_plugins = " quota" mail_privileged_group = dovecot mail_uid = vmail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext namespace inbox { inbox = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk { auto = subscribe special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { auto = subscribe special_use = \Trash } prefix = separator = . } passdb { args = /etc/dovecot/dovecot-mysql.conf.ext driver = sql } plugin { quota = maildir:User quota quota_exceeded_message = Storage quota for user %u exceeded (Benutzer %u hat sein Speichervolumen ueberschritten) quota_grace = 10%% quota_rule2 = Trash:storage=+100M quota_status_nouser = DUNNO quota_status_overquota = 552 5.2.2 Mailbox is full quota_status_success = DUNNO quota_warning = storage=85%% quota-warning 80 %u %d } protocols = imap lmtp sieve service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0666 user = postfix } unix_listener auth-userdb { mode = 0777 } } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } service quota-status { client_limit = 1 executable = quota-status -p postfix inet_listener { port = 10001 } } service quota-warning { executable = script /usr/local/bin/quota-warning.sh group = dovecot unix_listener quota-warning { mode = 0666 user = dovecot } user = vmail } ssl_cert = </certs/fullchain.pem ssl_key = # hidden, use -P to show it ssl_protocols = !SSLv2 !SSLv3 userdb { args = /etc/dovecot/dovecot-mysql.conf.ext driver = sql } protocol imap { mail_plugins = " quota imap_quota" } protocol lmtp { mail_plugins = " quota sieve" }

2 2

How to check which version of openssl is getting compiled in into dovecot?
by krzf83＠gmail.com 27 Oct '17

27 Oct '17

I got multiple versions of openssl in my system. I compile dovecot with PKG_CONFIG_PATH=/usr/openssl-1.0.2l-fpic/lib/pkgconfig ./configure How do I check which version of openssl got compiled in? configure script does not show version. There seem to be no way to check it in compiled binary (?) My dovecot is still seen vulnerable by tls testing tools so I'm guessing wrong version of openssl got compiled it but there seem to be no way to check it.

3 7

secure setup for imap hibernation
by Arkadiusz Miśkiewicz 27 Oct '17

27 Oct '17

Hi. What's the approach for securely enabling imap hibernation in case when each user uses different uid and gid? Looks like none and 0666 on hibernation and imap master sockets is the only way? Thanks, -- Arkadiusz Miśkiewicz, arekm / ( maven.pl | pld-linux.org )

2 3

Re: Password encription
by Aki Tuomi 27 Oct '17

27 Oct '17

SHA512-CRYPT and PLAIN/LOGIN with SSL. ---Aki TuomiDovecot oy -------- Original message --------From: "j.emerlik" <j.emerlik(a)gmail.com> Date: 25/10/2017 12:07 (GMT+02:00) To: Aki Tuomi <aki.tuomi(a)dovecot.fi> Cc: Dovecot Mailing List <dovecot(a)dovecot.org> Subject: Re: Password encription What scheme and mechanism do you recommend? 2017-10-25 11:01 GMT+02:00 Aki Tuomi <aki.tuomi(a)dovecot.fi>: > CRAM-MD5 should not be used. Its not terribly secure. > > > ---Aki TuomiDovecot oy > -------- Original message --------From: "j.emerlik" <j.emerlik(a)gmail.com> > Date: 25/10/2017 11:58 (GMT+02:00) To: Aki Tuomi <aki.tuomi(a)dovecot.fi> > Cc: Dovecot Mailing List <dovecot(a)dovecot.org> Subject: Re: Password > encription > Thx Aki, > with CRAP-MD5 as scheme and mechanism it's works corretlly. > > 2017-10-25 10:52 GMT+02:00 Aki Tuomi <aki.tuomi(a)dovecot.fi>: > > > PLAIN and LOGIN. > > > > > > > > --- > > Aki Tuomi > > Dovecot oy > > > > -------- Original message -------- > > From: "j.emerlik" <j.emerlik(a)gmail.com> > > Date: 25/10/2017 11:41 (GMT+02:00) > > To: Dovecot Mailing List <dovecot(a)dovecot.org> > > Subject: Password encription > > > > Hi, > > which authentication mechanism should I use for SHA-256 password schama ? > > Regards, > > Jack > > >

3 6

Looking for NTLM config example
by Mark Foley 26 Oct '17

26 Oct '17

Now that I am running Thunderbird on Linux and away from Windows/Outlook, I'd like to take another run at setting up NTLM authentication from Thunderbird to my Samba4 AC/DC. With the help of the samba maillist folks I was able to set up NTLM authentication for domain user login. I should be able to do the same for email! But, I need help. I went to http://wiki2.dovecot.org/Authentication/Mechanisms/NTLM and got lost immediately. Are "authenticaion submethods" synonymous with "password schemes"? The 7th line down says, "NTLM password scheme is required for NTLM, NTLM2 and NTLMv2.", but in the referenced link I found no reference to "NTLM password scheme". The links http://wiki2.dovecot.org/Authentication/Mechanisms/NTLM and http://wiki2.dovecot.org/Authentication/PasswordSchemes, tell you what the 4 NTLM authentication submethods are, tells you what password schemes are, tells you what the NTLM client/server handshake is, but doesn't actually tell you how to configure dovecot config files. I'm much more interested in the "how to" than in: "NTLMv2: server and client nonce, MITM can't force downgrade" ... whatever that means. Anyway, probably it's my lack of understanding terminology. I don't even know what a "nonce" is. But, I learn well from examples! Can somone please give me a sample 10-auth.conf for NTML and any other supporting settings or configs I need? My current/working dovecot settings, which have been running perfectly for well over a year now, are: $ dovecot -n # 2.2.15: /usr/local/etc/dovecot/dovecot.conf # OS: Linux 3.10.17 x86_64 Slackware 14.1 auth_debug_passwords = yes auth_mechanisms = plain login auth_verbose = yes auth_verbose_passwords = plain disable_plaintext_auth = no info_log_path = /var/log/dovecot_info mail_location = maildir:~/Maildir passdb { driver = shadow } protocols = imap ssl_cert = </etc/ssl/certs/OHPRS/GoDaddy/Apache/2015-08-14/57aa6ed6ae98b4c7.crt ssl_key = </etc/ssl/certs/OHPRS/GoDaddy/my.server.name.key userdb { driver = passwd } verbose_ssl = yes Here's what I've tried so far as 10-auth.conf: disable_plaintext_auth = no auth_use_winbind = yes info_log_path = /var/log/dovecot_info auth_verbose = yes auth_debug_passwords = yes auth_verbose_passwords= plain auth_winbind_helper_path = /usr/bin/ntlm_auth auth_mechanisms = ntlm plain login userdb { driver = passwd args = username_format=%n allow_all_users=yes } Which gives me a dovecot -n of: $ dovecot -n # 2.2.15: /usr/local/etc/dovecot/dovecot.conf # OS: Linux 3.10.17 x86_64 Slackware 14.1 auth_debug_passwords = yes auth_mechanisms = ntlm plain login auth_use_winbind = yes auth_verbose = yes auth_verbose_passwords = plain disable_plaintext_auth = no info_log_path = /var/log/dovecot_info mail_location = maildir:~/Maildir protocols = imap ssl_cert = </etc/ssl/certs/OHPRS/GoDaddy/Apache/2015-08-14/57aa6ed6ae98b4c7.crt ssl_key = </etc/ssl/certs/OHPRS/GoDaddy/my.server.name.key userdb { args = username_format=%n allow_all_users=yes driver = passwd } verbose_ssl = yes I configured Thunderbird for NTLM authentication, then tried sending a message, I got the following in /var/log/dovecot_info: Apr 22 01:37:57 imap-login: Debug: SSL: elliptic curve secp384r1 will be used for ECDH and ECDHE key exchanges Apr 22 01:37:57 imap-login: Debug: SSL: elliptic curve secp384r1 will be used for ECDH and ECDHE key exchanges Apr 22 01:37:57 auth: Debug: Loading modules from directory: /usr/local/lib/dovecot/auth Apr 22 01:37:57 imap-login: Info: Disconnected: Auth process broken (disconnected before auth was ready, waited 0 secs): user=<>, rip=192.168.0.58, lip=98.102.63.107, session=<xFuyOgwx9wDAqAA6> On Thunderbird I got the error, "Sending of the message failed. The Outlgoing server (SMTP) my.server.name does not support the selected authentication method. Please change the 'Autnentication method' in 'Account Settings | Outgoing Server (SMTP)'." Clearly, something is configured wrong, but I've no clue what. Can I get some advice? THX --Mark

8 19

Initialization failed: Namespace '': mkdir(/var/www/mail) failed: Permission denied
by trash＠skrilnetz.net 26 Oct '17

26 Oct '17

Hi, I'm running dovecot (v 2.2.9) on ubuntu 14.04 since a long time. I did not change any configuration lately and I'm getting the below error message. /dovecot: lda(www-data): Error: user www-data: Initialization failed: Namespace '': MKDIR(/VAR/WWW/MAIL) failed: Permission denied (euid=33(www-data) egid=33(www-data) missing +w perm: /var/www, dir owned by 1001:1001 mode=0755//) / I did some troubleshooting and I don't understand where the MKDIR(/VAR/WWW/MAIL) is coming from. Mailboxes are in /var/mail and sending/receiving emails is working as it always did. mail_location is still setup to be MAIL_LOCATION = MBOX:~/MAIL:INBOX=/VAR/MAIL/%U Why is it trying a mkdir in /var/www? Any help would be appreciated. Rgs,

3 11

haproxy ssl support
by Rok Potočnik 26 Oct '17

26 Oct '17

Even though it seems dovecot (using 2.2.33.1) supports haproxy's send-proxy-v2, it seems to lack send-proxy-v2-ssl (which also sends client's ssl state). It would be a nice feature for the backend server to identify clients so one wouldn't have to use disable_plaintext_auth on a production environment. --- haproxy.cfg frontend pop3 bind [::]:110 v4v6 bind [::]:995 v4v6 ssl crt /etc/pki/tls/private/haproxy.pem mode tcp default_backend pop3 backend pop3 mode tcp balance leastconn stick store-request src stick-table type ip size 200k expire 30m timeout connect 5000 timeout server 50000 server proxy1 [2001:db8::11]:10110 send-proxy-v2-ssl server proxy2 [2001:db8::22]:10110 send-proxy-v2-ssl --- --- dovecot.conf haproxy_trusted_networks = [2001:db8::]/64 service pop3-login { inet_listener pop3_haproxy { port = 10110 haproxy = yes } } --- It would also be nice if haproxy would support STARTTLS offloading but that's a subject for a different mailing list ;) -- BR, Rok

3 3

fts-solr: fresh start or reindex large mailboxes
by Anton Borovoy 26 Oct '17

26 Oct '17

Hi, Install solr (in the end 7.1.0) there were errors: Caused by: org.eclipse.jetty.io.EofException: Early EOF and from dovecot: Error: Mailbox INBOX: Transaction commit failed: FTS transaction commit failed: backend I could not find for a long time what the problem was and set the nginx as a proxy, and see that dovecot breaks the connect after 60 seconds. After examining the code, I found the fixed connection time: http_set.request_timeout_msecs = 60 * 1000; which is clearly not enough for large data. After searching, he also found this post https://dovecot.org/pipermail/dovecot-cvs/2015-March/025551.html 1. I think it would be a good idea to remove these settings in the configuration file dovecot.conf A bit of statistics from nginx, solr and nginx on same server (req_len == post body): 60 seconds, requests do not pass: [25 / Oct / 2017: 23: 07: 11 +0700] POST / solr / dovecot / update HTTP / 1.1 resp_time - msec 1508947631.364 req_time 86.863 req_len 171401961 499 [25 / Oct / 2017: 23: 07: 25 +0700] POST / solr / dovecot / update HTTP / 1.1 resp_time - msec 1508947645.149 req_time 74.657 req_len 70140598 499 [25 / Oct / 2017: 23: 11: 28 +0700] POST / solr / dovecot / update HTTP / 1.1 resp_time - msec 1508947888.834 req_time 90.776 req_len 205474676 499 600 seconds, requests do not pass: [26 / Oct / 2017: 04: 50: 50 +0700] POST / solr / dovecot / update HTTP / 1.1 resp_time - msec 1508968250.522 req_time 811.480 req_len 3083215798 499 [26 / Oct / 2017: 04: 51: 06 +0700] POST / solr / dovecot / update HTTP / 1.1 resp_time - msec 1508968266.432 req_time 666.089 req_len 556157906 499 [26 / Oct / 2017: 05: 06: 18 +0700] POST / solr / dovecot / update HTTP / 1.1 resp_time - msec 1508969178.612 req_time 797.983 req_len 3083215798 499 2. the index is more than 3g is transmitted painfully, can U make a queue limit on the size of the request, segment them, adjust max size of post body in the configuration file dovecot.conf thx solr: 7.1.0 dovecot: 2.2.32 server: Intel(R) Xeon(TM) CPU 2.93GHz x24, 72G RAM

1 0

authenticate as userA, but get authorization to user userB's account
by Heiko Schlittermann 26 Oct '17

26 Oct '17

Hello, given a small organization. There are *personal* mailboxes (mailbox per user, incl. subfolders et cetera). The users can share specic folders via the ACL (we call it "other users/", Dovecot calls it "shared" folder. Additionally there are mailboxes Dovecot calls "public" (we use the term "groups/"). They are not associated with a specific account, but acessible via ACL only. (Good example for the latter is "info(a)example.com") But now they're seeking for a way to implement "role" Accounts. We could create new "role" users, share the password and create an additional account within the mail client (thunderbird) they use. From users perspective it is exactly what they want. But I dislike the idea of sharing the password. Question: Is there any way to split the authentication from the authorization within common mail clients (as Thunderbird) in combination with Dovecot. That is, doing something like logging in to the account sales(a)example.com, using the credentials of the very own account (say hans(a)example.com)? - how to do it in Dovecot? (We use LDAP) - how to set up this in Thunderbird? - how to set up this in a generic MUA, as some webmail client? Thanks in advance, best regards from Dresden/Germany Heiko Schlittermann -- SCHLITTERMANN.de ---------------------------- internet & unix support - Heiko Schlittermann, Dipl.-Ing. (TU) - {fon,fax}: +49.351.802998{1,3} - gnupg encrypted messages are welcome --------------- key ID: F69376CE - ! key id 7CBF764A and 972EAC9F are revoked since 2015-01 ------------ -

5 9

Re: STAT command failure
by Joseph Tam 25 Oct '17

25 Oct '17

Andrew Charnley <ac(a)igaro.com> writes: >> It's also telling that it works for some accounts, and not for others. >> Try rebuilding the user's index cache by removing it (save a copy!) >> and see if that makes it work. If it does, you can send the buggy >> caches to the developer and see if they can figure it out. > > Which user index file to you refer to? If you're using INDEX= in your mail_location, that one. I think it suffices to remove the indices for the user's INBOX, since that's the only mailbox POP3 is aware of. I'm not sure where the default index location is if you don't specify INDEX, so maybe look in your mail spool or personal mail folder for $WHATEVER/.imap/INBOX. Caches are regenerated if they go missing (unless you use mdbox/sdbox formats: *don't* do this if you're using them.) Joseph Tam <jtam.home(a)gmail.com>

1 0

Replication Issue
by Jorge Canto E. 25 Oct '17

25 Oct '17

Hello, I've been trying to set up replication, Server A is dovecot 2.2.32 (upgrade from 2.0.9) and Server B is dovecot 2.2.10, I use mysql as userdb, I don't want to replicate every user on my database only especific users so I set my iterate_query on dovecot-sql.conf.ext file; my problem: doveadm replication is not "reading" my iterate_query, it tries to replicate every user. Diagnosis: - I removed iterate_query from dovecot-sql.conf.ext, on the log file I can see the doveadm replication is still trying to replicate. - doveadm user '*' shows error (obvious) there is not iterate_query but, on the log files I can see replication is trying, why doveadm replication is trying to replicate? what userdb is reading from? doveconf -n # 2.2.32 (dfbe293d4): /etc/dovecot/dovecot.conf # OS: Linux 2.6.32-696.1.1.el6.x86_64 x86_64 CentOS release 6.9 (Final) ext3 auth_debug = yes auth_socket_path = /var/run/dovecot/auth-userdb doveadm_password = # hidden, use -P to show it first_valid_uid = 150 last_valid_uid = 150 mail_debug = yes mail_location = maildir:/var/vmail/%d/%n mail_plugins = notify replication mail_privileged_group = mail mbox_write_locks = fcntl passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } plugin { mail_replica = tcp:x.x.x.x:61800 } postmaster_address = postmaster(a)email.com service aggregator { fifo_listener replication-notify-fifo { mode = 0666 user = vmail } unix_listener replication-notify { mode = 0666 user = vmail } } service auth { unix_listener /var/spool/postfix/private/auth { mode = 0666 user = postfix } unix_listener auth-userdb { group = mail mode = 0600 user = vmail } } service config { unix_listener config { user = vmail } } service doveadm { inet_listener { port = 61800 } user = vmail } service replicator { process_min_avail = 1 unix_listener replicator-doveadm { mode = 0666 } } ssl = required ssl_cert = </etc/pki/tls/certs/mailnew.crt ssl_key = # hidden, use -P to show it userdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } I really appreciate your help Jorge C.

1 0

Disconnected: Inactivity (no auth attempts in 180 secs)
by Alexandre 25 Oct '17

25 Oct '17

Hi, I hope you guys can understand me since english is not my nativelanguage. I am trying setup dovecot for imap and pop3 on FreeBSD 10.3 and is notworking on IMAPS or POP3S, currently My setup is: OS = FreeBSD 10.3 ( I did not get enough time for update to 11) Postfix = 3.2.3 Dovecot = 2.2.33.2 (d6601f4ec) OpenSSL =1.0.1s-freebsd SSL Certificate = Let's Encrypt I can send and receive mails using: IMAP 143 with TLS SMTP 587 with TLS Usually on Linux distros works pretty easy, when I don't forgetsomething this should be working on first try, but, after spend 2 weeks workingon it after arrive from job without found any solution, I am trying the luckasking for help from your guys expert on dovecot. The hangup occours inside of my LAN using Outlook 2016, and Outside also trying access on 4G from my Android smartphone. My goal is enable also POP3s and IMAPs using TLS. This is my data: Dovecot –n: #2.2.33.2 (d6601f4ec): /usr/local/etc/dovecot/dovecot.conf # Pigeonhole version 0.4.21 (92477967) # OS: FreeBSD 10.3-RELEASE-p22 amd64 zfs auth_debug = yes auth_debug_passwords = yes auth_mechanisms = plain login auth_verbose = yes auth_verbose_passwords = yes hostname = mail.mydomain.com imap_client_workarounds = delay-newmail tb-extra-mailbox-septb-lsub-flags lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes lda_original_recipient_header = X-Original-To mail_attachment_fs = sis-queue posix mail_attachment_hash = %{sha512} mail_debug = yes mail_location = maildir:/usr/local/vmail/%d/%n:LAYOUT=fs mail_plugins = quota acl mail_privileged_group = vmail mailbox_list_index = yes managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelopeencoded-character vacation subaddress comparator-i;ascii-numeric relationalregex imap4flags copy include variables body enotify environment mailbox dateindex ihave duplicate mime foreverypart extracttext mbox_write_locks = fcntl namespace inbox { inbox = yes location = mailbox Archives { auto = subscribe special_use = \Archive } mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk { auto = subscribe special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox "SentMessages" { auto = subscribe special_use = \Sent } mailbox Trash { auto = subscribe special_use = \Trash } mailbox virtual/All { auto = subscribe comment = All my messages special_use = \All } mailbox virtual/Flagged { auto = subscribe comment = All my flaggedmessages special_use = \Flagged } prefix = } passdb { args =/usr/local/etc/dovecot/dovecot-sql.conf.ext driver = sql } plugin { acl = vfile quota = maildir:User quota quota_max_mail_size = 100M quota_rule = *:storage=1G quota_rule2 =Archive:storage=+1G quota_rule3 =Trash:storage=+100M quota_warning = storage=80%%quota-warning 80 %u sieve =/usr/local/vmail/%d/%n/.dovecot.sieve sieve_before =/usr/local/vmail/sieve/before.d/ sieve_dir = /usr/local/vmail/%d/%n sieve_global_dir =/usr/local/vmail/sieve/%d sieve_global_path =/usr/local/vmail/sieve/%d/default.sieve } pop3_client_workarounds = outlook-no-nuls oe-ns-eoh postmaster_address = postmaster(a)mydomain.com protocols = imap pop3 lmtp sieve quota_full_tempfail = yes service auth-worker { user = vmail } service auth { unix_listener/var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } unix_listener auth-userdb { group = vmail mode = 0600 user = vmail } } service dict { unix_listener dict { mode = 0600 user = vmail } } service imap-login { inet_listener imap { port = 143 } inet_listener imaps { port = 993 ssl = yes } process_min_avail = 2 } service lmtp { unix_listener/var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } service managesieve-login { inet_listener sieve { port = 4190 } process_min_avail = 0 service_count = 1 vsz_limit = 64 M } service pop3-login { inet_listener pop3 { port = 110 } inet_listener pop3s { port = 995 ssl = yes } } service quota-warning { executable = script/usr/local/bin/quota-warning.sh unix_listener quota-warning { user = vmail } user = dovecot } ssl = required ssl_ca = </etc/ssl/cert.pem ssl_cert = </usr/local/etc/dovecot/private/mail.mydomain.com.crt ssl_cipher_list =ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA ssl_dh_parameters_length = 4096 ssl_key = # hidden, use -P toshow it ssl_options = no_compression ssl_parameters_regenerate = 6 hours ssl_prefer_server_ciphers = yes ssl_protocols = TLSv1.2 userdb { driver = prefetch } verbose_ssl = yes protocollda { mail_plugins = quota acl sieve postmaster_address = root } protocol lmtp { deliver_log_format = msgid=%m:%s mail_plugins = quota acl sieve postmaster_address =postmaster(a)mydomain.com } protocol sieve { managesieve_implementation_string = Dovecot Pigeonhole managesieve_max_compile_errors =5 managesieve_max_line_length =65536 } protocolpop3 { mail_plugins = quota } protocolimap { mail_plugins = quota acl imap_quota imap_acl } Dovecot-sql driver = mysql connect = host=127.0.0.1 dbname=mailserver user=mail password=***** default_pass_scheme = SHA512-CRYPT user_query = \ SELECT \ email asuser, \ maildir ashome, \ uid, \ gid, \ CONCAT('*:storage=',quota, 'B') AS quota_rule, \ CONCAT(maildir,'./sieve')as sieve \ FROM \ virtual_users\ WHERE \ email ='%u' \ AND \ active= '1' password_query = \ SELECT \ email asuser, \ password, \ maildir asuserdb_home, \ uid asuserdb_uid, \ gid asuserdb_gid, \ CONCAT('*:storage=',quota, 'B') AS userdb_quota_rule, \ CONCAT(maildir,'./sieve')as userdb_sieve \ FROM \ virtual_users\ WHERE \ email ='%u' \ AND \ active= '1' iterate_query = \ SELECT \ email ASuser \ FROM \ virtual_users\ WHERE \ active ='1' maillog with Disconnected: Inactivity (no auth attempts in 180 secs) Oct 25 06:46:38 mail dovecot: imap-login: Debug: SSL: where=0x10, ret=1:before/accept initialization [192.168.0.95] Oct 25 06:46:38 mail dovecot: imap-login: Debug: SSL: where=0x2001,ret=1: before/accept initialization [192.168.0.95] Oct 25 06:46:38 mail dovecot: imap-login: Debug: SSL: where=0x2002,ret=-1: SSLv2/v3 read client hello A [192.168.0.95] Oct 25 06:46:38 mail dovecot: auth: Debug: auth client connected(pid=9371) Oct 25 06:49:38 mail dovecot: imap-login: Disconnected: Inactivity (noauth attempts in 180 secs): user=<>, rip=192.168.0.95, lip=10.0.0.32, TLShandshaking, session=<+XXXXXXXXXXXXXf> Oct 25 06:49:38 mail postfix/submission/smtpd[9400]: connect fromunknown[192.168.0.95]:50860 Oct 25 06:49:38 mail postfix/submission/smtpd[9400]: Anonymous TLSconnection established from unknown[192.168.0.95]:50860: TLSv1.2 with cipherECDHE-RSA-AES256-SHA384 (256/256 bits) Oct 25 06:49:38 mail dovecot: auth: Debug: auth client connected (pid=0) Oct 25 06:49:38 mail dovecot: auth: Debug: client in: AUTH 1 LOGIN service=smtp nologin lip=10.0.0.32 rip=192.168.0.95 secured Oct 25 06:49:38 mail dovecot: auth: Debug: client passdb out: CONT 1 VXXXXXXXXXX6 Oct 25 06:49:38 mail dovecot: auth: Debug: client in: CONT 1 cXXXXXXXXXXXXXXXXXXXXXXXXXXt(previous base64 data may contain sensitive data) Oct 25 06:49:38 mail dovecot: auth: Debug: client passdb out: CONT 1 UXXXXXXXXXX6 Oct 25 06:49:38 mail dovecot: auth: Debug: client in: CONT 1 dXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX=(previous base64 data may contain sensitive data) Oct 25 06:49:38 mail dovecot: auth-worker(9402): Debug: Loading modulesfrom directory: /usr/local/lib/dovecot/auth Oct 25 06:49:38 mail dovecot: auth-worker(9402): Debug: Module loaded:/usr/local/lib/dovecot/auth/lib20_auth_var_expand_crypt.so Oct 25 06:49:39 mail dovecot: auth-worker(9402): Debug:sql(test@domain.com,192.168.0.95): query: SELECT email as user, password,maildir as userdb_home, uid as userdb_uid, gid as userdb_gid,CONCAT('*:storage=', quota, 'B') AS userdb_quota_rule,CONCAT(maildir,'./sieve') as userdb_sieve FROM virtual_users WHERE email ='test(a)domain.com' AND active = '1' Oct 25 06:49:39 mail dovecot: auth: Debug: client passdb out: OK 1 user=test(a)domain.com Oct 25 06:49:39 mail postfix/submission/smtpd[9400]: 3XXXXXXXXXXXt:client=unknown[192.168.0.95]:50860, sasl_method=LOGIN,sasl_username=test(a)domain.com Oct 25 06:49:39 mail postfix/cleanup[9404]: 3XXXXXXXXXXXt:message-id=<3XXXXXXXXXXXt(a)mail.domain.com> Oct 25 06:49:39 mail opendkim[945]: 3XXXXXXXXXXXt: DKIM-Signature fieldadded (s=201710, d=domain.com) Oct 25 06:49:39 mail postfix/qmgr[8504]: 3XXXXXXXXXXXt:from=<test(a)domain.com>, size=1446, nrcpt=1 (queue active) Oct 25 06:49:39 mail postfix/submission/smtpd[9400]: disconnect fromunknown[192.168.0.95]:50860 ehlo=2 starttls=1 auth=1 mail=1 rcpt=1 data=1commands=7 Oct 25 06:49:49 mail postfix/smtpd[9408]: connect from localhost[127.0.0.1]:23696 Oct 25 06:49:49 mail opendmarc[949]: ignoring connection from localhost Oct 25 06:49:49 mail postfix/smtpd[9408]: 3YYYYYYYYYYY1:client=localhost[127.0.0.1]:23696 Oct 25 06:49:49 mail postfix/cleanup[9404]: 3YYYYYYYYYYY1:message-id=<3XXXXXXXXXXXt(a)mail.domain.com> Oct 25 06:49:49 mail opendkim[945]: 3YYYYYYYYYYY1: DKIM-Signature fieldadded (s=201710, d=domain.com) Oct 25 06:49:49 mail postfix/qmgr[8504]: 3YYYYYYYYYYY1:from=<test(a)domain.com>, size=2918, nrcpt=1 (queue active) Oct 25 06:49:49 mail postfix/smtpd[9408]: disconnect fromlocalhost[127.0.0.1]:23696 ehlo=1 mail=1 rcpt=1 data=1 quit=1 commands=5 Oct 25 06:49:49 mail amavis[913]: (00913-03) Passed CLEAN {RelayedInternal},MYNETS LOCAL [192.168.0.95]:50860 <test(a)domain.com> -><test(a)domain.com>, Queue-ID: 3XXXXXXXXXXXt, Message-ID:<3XXXXXXXXXXXt(a)mail.domain.com>, mail_id: SuyWDTSHlDWx, Hits: -1.099,size: 2315, queued_as: 3YYYYYYYYYYY1, dkim_sd=201710:domain.com, 9815 ms Oct 25 06:49:49 mail postfix/lmtp[9405]: 3XXXXXXXXXXXt:to=<test(a)domain.com>, relay=127.0.0.1[127.0.0.1]:10024, delay=10,delays=0.3/0.03/0.01/9.8, dsn=2.0.0, status=sent (250 2.0.0 fromMTA(smtp:[127.0.0.1]:10025): 250 2.0.0 Ok: queued as 3YYYYYYYYYYY1) Oct 25 06:49:49 mail postfix/lmtp[9409]: warning: smtp_connect_local:opportunistic TLS encryption is not appropriate for unix-domain destinations. Oct 25 06:49:49 mail postfix/qmgr[8504]: 3XXXXXXXXXXXt: removed Oct 25 06:49:49 mail dovecot: lmtp(9410): Debug: none: root=, index=,indexpvt=, control=, inbox=, alt= Oct 25 06:49:49 mail dovecot: lmtp(9410): Connect from local Oct 25 06:49:49 mail dovecot: lmtp(test(a)domain.com): Debug: Loadingmodules from directory: /usr/local/lib/dovecot Oct 25 06:49:49 mail dovecot: lmtp(test(a)domain.com): Debug: Moduleloaded: /usr/local/lib/dovecot/lib01_acl_plugin.so Oct 25 06:49:49 mail dovecot: lmtp(test(a)domain.com): Debug: Moduleloaded: /usr/local/lib/dovecot/lib10_quota_plugin.so Oct 25 06:49:49 mail dovecot: lmtp(test(a)domain.com): Debug: Moduleloaded: /usr/local/lib/dovecot/lib90_sieve_plugin.so Oct 25 06:49:49 mail dovecot: auth: Debug: master in: USER 1 test(a)domain.com service=lmtp Oct 25 06:49:49 mail dovecot: auth: Debug: prefetch(test(a)domain.com): passdbdidn't return userdb entries, trying the next userdb Oct 25 06:49:49 mail dovecot: auth-worker(9402): Debug:sql(test@domain.com): SELECT email as user, maildir as home, uid, gid,CONCAT('*:storage=', quota, 'B') AS quota_rule, CONCAT(maildir,'./sieve') assieve FROM virtual_users WHERE email = 'test(a)domain.com' AND active = '1' Oct 25 06:49:49 mail dovecot: auth: Debug: userdb out: USER 1 test(a)domain.com home=/usr/local/vmail/domain.com/security uid=5000 gid=5000 quota_rule=*:storage=100000000B sieve=/usr/local/vmail/domain.com/security./sieve Oct 25 06:49:49 mail dovecot: lmtp(test(a)domain.com): Debug: auth USERinput: test(a)domain.com home=/usr/local/vmail/domain.com/security uid=5000gid=5000 quota_rule=*:storage=100000000B sieve=/usr/local/vmail/domain.com/security./sieve Oct 25 06:49:49 mail dovecot: lmtp(test(a)domain.com): Debug: Added userdbsetting: plugin/quota_rule=*:storage=100000000B Oct 25 06:49:49 mail dovecot: lmtp(test(a)domain.com): Debug: Added userdbsetting: plugin/sieve=/usr/local/vmail/domain.com/security./sieve Oct 25 06:49:49 mail dovecot: lmtp(9410, test(a)domain.com) Debug:Effective uid=5000, gid=5000, home=/usr/local/vmail/domain.com/security Oct 25 06:49:49 mail dovecot: lmtp(9410, test(a)domain.com) Debug: acl:No acl_shared_dict setting - shared mailbox listing is disabled Oct 25 06:49:49 mail dovecot: lmtp(9410, test(a)domain.com) Debug: Quotaroot: name=User quota backend=maildir args= Oct 25 06:49:49 mail dovecot: lmtp(9410, test(a)domain.com) Debug: Quotarule: root=User quota mailbox=* bytes=100000000 messages=0 Oct 25 06:49:49 mail dovecot: lmtp(9410, test(a)domain.com) Debug: Quotarule: root=User quota mailbox=Archive bytes=+1073741824 messages=0 Oct 25 06:49:49 mail dovecot: lmtp(9410, test(a)domain.com) Debug: Quotarule: root=User quota mailbox=Trash bytes=+104857600 messages=0 Oct 25 06:49:49 mail dovecot: lmtp(9410, test(a)domain.com) Debug: Quotawarning: bytes=80000000 (80%) messages=0 reverse=no command=quota-warning 80test(a)domain.com Oct 25 06:49:49 mail dovecot: lmtp(9410, test(a)domain.com) Debug: Quotagrace: root=User quota bytes=10000000 (10%) Oct 25 06:49:49 mail dovecot: lmtp(9410, test(a)domain.com) Debug:Namespace inbox: type=private, prefix=, sep=, inbox=yes, hidden=no, list=yes,subscriptions=yeslocation=maildir:/usr/local/vmail/domain.com/secu… Oct 25 06:49:49 mail dovecot: lmtp(9410, test(a)domain.com) Debug: fs:root=/usr/local/vmail/domain.com/security, index=, indexpvt=, control=,inbox=/usr/local/vmail/domain.com/security, alt= Oct 25 06:49:49 mail dovecot: lmtp(9410, test(a)domain.com) Debug: acl:initializing backend with data: vfile Oct 25 06:49:49 mail dovecot: lmtp(9410, test(a)domain.com) Debug: acl:acl username = test(a)domain.com Oct 25 06:49:49 mail dovecot: lmtp(9410, test(a)domain.com) Debug: acl:owner = 1 Oct 25 06:49:49 mail dovecot: lmtp(9410, test(a)domain.com) Debug: aclvfile: Global ACLs disabled Oct 25 06:49:49 mail dovecot: lmtp(9410, test(a)domain.com) Debug: quota:quota_over_flag check: quota_over_script unset - skipping Oct 25 06:49:49 mail dovecot: lmtp(test(a)domain.com): Debug: Mailbox<lmtp DATA>: Opened mail UID=1 because: header X-Original-To (Cache fileis unusable) Oct 25 06:49:49 mail dovecot: lmtp(test(a)domain.com): Debug: sieve:Pigeonhole version 0.4.21 (92477967) initializing Oct 25 06:49:49 mail dovecot: lmtp(test(a)domain.com): Debug: 4ZZZZZZZZZZZZZZZZZZZZQ:sieve: file storage: Failed to normalize active script directory(path=/usr/local/vmail/domain.com/security.): Part of the path does not exist(yet) Oct 25 06:49:49 mail dovecot: lmtp(test(a)domain.com): Debug:4ZZZZZZZZZZZZZZZZZZZZQ: sieve: file storage: Using active Sieve script path:/usr/local/vmail/domain.com/security./sieve Oct 25 06:49:49 mail dovecot: lmtp(test(a)domain.com): Debug:4ZZZZZZZZZZZZZZZZZZZZQ: sieve: file storage: Using script storage path:/usr/local/vmail/domain.com/security Oct 25 06:49:49 mail dovecot: lmtp(test(a)domain.com): Debug:4ZZZZZZZZZZZZZZZZZZZZQ: sieve: file storage: Relative path to sieve storage inactive link: /usr/local/vmail/domain.com/security/ Oct 25 06:49:49 mail dovecot: lmtp(test(a)domain.com): Debug: 4ZZZZZZZZZZZZZZZZZZZZQ:sieve: file storage: Failed to normalize active script directory(path=/usr/local/vmail/domain.com/security.): Part of the path does not exist(yet) Oct 25 06:49:49 mail dovecot: lmtp(test(a)domain.com): Debug:4ZZZZZZZZZZZZZZZZZZZZQ: sieve: file storage: Using Sieve script path:/usr/local/vmail/domain.com/security./sieve Oct 25 06:49:49 mail dovecot: lmtp(test(a)domain.com): Debug:4ZZZZZZZZZZZZZZZZZZZZQ: sieve: file storage: Storage path`/usr/local/vmail/domain.com/security./sieve' not found Oct 25 06:49:49 mail dovecot: lmtp(test(a)domain.com): Debug:4ZZZZZZZZZZZZZZZZZZZZQ: sieve: file storage: Storage path`/usr/local/vmail/sieve/domain.com/default.sieve' not found Oct 25 06:49:49 mail dovecot: lmtp(test(a)domain.com): Debug:4ZZZZZZZZZZZZZZZZZZZZQ: sieve: User has no active script in storage`/usr/local/vmail/domain.com/security' Oct 25 06:49:49 mail dovecot: lmtp(test(a)domain.com): Debug:4ZZZZZZZZZZZZZZZZZZZZQ: sieve: User has no personal script Oct 25 06:49:49 mail dovecot: lmtp(test(a)domain.com): Debug:4ZZZZZZZZZZZZZZZZZZZZQ: sieve: file storage: Storage path`/usr/local/vmail/sieve/before.d/' not found Oct 25 06:49:49 mail dovecot: lmtp(test(a)domain.com): Debug:4ZZZZZZZZZZZZZZZZZZZZQ: sieve: Location for sieve_before not found: /usr/local/vmail/sieve/before.d/ Oct 25 06:49:49 mail dovecot: lmtp(test(a)domain.com): Debug:4ZZZZZZZZZZZZZZZZZZZZQ: sieve: No scripts to execute: reverting to defaultdelivery. Oct 25 06:49:49 mail dovecot: lmtp(test(a)domain.com): Debug: INBOX:Mailbox opened because: lib-lda delivery Oct 25 06:49:49 mail dovecot: lmtp(test(a)domain.com): Debug: Mailbox<lmtp DATA>: Opened mail UID=1 because: copying Oct 25 06:49:49 mail dovecot: lmtp(test(a)domain.com): Debug: acl vfile:file /usr/local/vmail/domain.com/security/dovecot-acl not found Oct 25 06:49:49 mail dovecot: lmtp(test@domain.com):msgid=<3XXXXXXXXXXXt(a)mail.domain.com>: Microsoft Outlook Test Message Oct 25 06:49:49 mail postfix/lmtp[9409]: 3YYYYYYYYYYY1:to=<test(a)domain.com>, relay=mail.domain.com[private/dovecot-lmtp],delay=0.48, delays=0.26/0.03/0.13/0.06, dsn=2.0.0, status=sent (250 2.0.0<test(a)domain.com> 4ZZZZZZZZZZZZZZZZZZZZQ Saved) Oct 25 06:49:49 mail dovecot: lmtp(9410): Disconnect from local:Successful quit Oct 25 06:49:49 mail postfix/qmgr[8504]: 3YYYYYYYYYYY1: removed Testing from another computer with openssl s_client -host 10.0.0.32 -port 993 -verify –debug verify depth is 0 CONNECTED(00000003) depth=2 O = Digital Signature Trust Co., CN = DST Root CA X3 verify return:1 depth=1 C = US, O = Let's Encrypt, CN = Let's Encrypt Authority X3 verify return:1 depth=0 CN = domain.com verify return:1 --- Certificate chain 0 s:/CN=domain.com i:/C=US/O=Let'sEncrypt/CN=Let's Encrypt Authority X3 1 s:/C=US/O=Let's Encrypt/CN=Let'sEncrypt Authority X3 i:/O=Digital Signature TrustCo./CN=DST Root CA X3 --- Server certificate -----BEGIN CERTIFICATE----- MIIGDjCCBPagAwIBAgISA71fShBIzBs0jj8E7L/XmHyjMA0GCSqGSIb3DQEBCwUA BzzGusiZmPR/KpKnHmRXThgo -----END CERTIFICATE----- subject=/CN=domain.com issuer=/C=US/O=Let's Encrypt/CN=Let's Encrypt Authority X3 --- No client certificate CA names sent Peer signing digest: SHA512 Server Temp Key: ECDH, P-256, 256 bits --- SSL handshake has read 3702 bytes and written 457 bytes --- New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES256-SHA384 Server public key is 4096 bit Secure Renegotiation IS supported Compression: NONE Expansion: NONE No ALPN negotiated SSL-Session: Protocol : TLSv1.2 Cipher : ECDHE-RSA-AES256-SHA384 Session-ID:548A93EA5A644C15EBA4B8335274B3091D33DD8C1741292BA4C0650E7171EF9F Session-ID-ctx: Master-Key:3DA8713979CA918E62C6E2DDB24F25050545390A031AAEEF82208300911D13C1B850FD78771F2046CAF0484F64A9C7A2 Key-Arg : None PSK identity: None PSK identity hint: None SRP username: None TLS session ticket lifetimehint: 300 (seconds) TLS session ticket: 0000 - 63 99 b8 dc b6 5a ca49-4c 35 62 47 95 a6 59 7e c....Z.IL5bG..Y~ 0010 - 2b 6e 64 a6 bf 06 fd a1-85 e5 6d f8 79 4b 762c +nd.......m.yKv, 0020 - 26 12 c9 8d cd da da 6c-5e 1e 4e 6963 30 b7 90 &......l^.Nic0.. 0030 - 45 ce 70 b5 14 01 ba60-d9 85 df f9 a7 66 1d 58 E.p....`.....f.X 0040 - 0d 36 f3 41 29 0b 43 f6-60 c1 0a 5e 2d db b438 .6.A).C.`..^-..8 0050- 31 0b 8e 05 e4 5f f7 30-d6 4f 34 10 3f 4f a6 e2 1...._.0.O4.?O.. 0060 - 17 d3 36 34 14 5a 3a 91-99 25 96 4f5c 82 d8 f0 ..64.Z:..%.O\... 0070 - ee 82 ef eb 77 ad c1 37-9a 6d 60 796f a3 1f 2e ....w..7.m`yo... 0080 - 0c 5a 40 bc 02 de 92 ff-cf 37 e1 df95 41 30 8c .Z@......7...A0. 0090 - 1d 3d e1 cd 1b 3f 78d4-86 d1 ac ad 3a 23 16 85 .=...?x.....:#.. Start Time: 1508923307 Timeout : 300 (sec) Verify return code: 0 (ok) --- * OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLEIDLE AUTH=PLAIN AUTH=LOGIN] Dovecot ready. a login test(a)domain.com XXXXXXXXXXXXXXXXXXXXXXXX a OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLEIDLE SORT SORT=DISPLAY THREAD=REFERENCES THREAD=REFS THREAD=ORDEREDSUBJECTMULTIAPPEND URL-PARTIAL CATENATE UNSELECT CHILDREN NAMESPACE UIDPLUSLIST-EXTENDED I18NLEVEL=1 CONDSTORE QRESYNC ESEARCH ESORT SEARCHRES WITHINCONTEXT=SEARCH LIST-STATUS BINARY MOVE NOTIFY QUOTA ACL RIGHTS=texk] Logged in a select inbox * FLAGS (\Answered \Flagged \Deleted \Seen \Draft $Forwarded) * OK [PERMANENTFLAGS (\Answered \Flagged \Deleted \Seen \Draft$Forwarded \*)] Flags permitted. * 9 EXISTS * 0 RECENT * OK [UNSEEN 6] First unseen. * OK [UIDVALIDITY 1508179896] UIDs valid * OK [UIDNEXT 62] Predicted next UID a OK [READ-WRITE] Select completed (0.003 + 0.000 + 0.002 secs). a logout * BYE Logging out a OK Logout completed (0.002 + 0.000 + 0.001 secs). closed I have removed the certificate and sensitive data. I am out of ideas what else to config to get this working, and wannathank in advice for everyone who can try help me. Regards, PS.: I am going to work now, and as soon as possible, I can test anyadvice and report the results. Alexandre

1 0

Re: Password encription
by Aki Tuomi 25 Oct '17

25 Oct '17

CRAM-MD5 should not be used. Its not terribly secure. ---Aki TuomiDovecot oy -------- Original message --------From: "j.emerlik" <j.emerlik(a)gmail.com> Date: 25/10/2017 11:58 (GMT+02:00) To: Aki Tuomi <aki.tuomi(a)dovecot.fi> Cc: Dovecot Mailing List <dovecot(a)dovecot.org> Subject: Re: Password encription Thx Aki, with CRAP-MD5 as scheme and mechanism it's works corretlly. 2017-10-25 10:52 GMT+02:00 Aki Tuomi <aki.tuomi(a)dovecot.fi>: > PLAIN and LOGIN. > > > > --- > Aki Tuomi > Dovecot oy > > -------- Original message -------- > From: "j.emerlik" <j.emerlik(a)gmail.com> > Date: 25/10/2017 11:41 (GMT+02:00) > To: Dovecot Mailing List <dovecot(a)dovecot.org> > Subject: Password encription > > Hi, > which authentication mechanism should I use for SHA-256 password schama ? > Regards, > Jack >

2 1

Re: Password encription
by j.emerlik 25 Oct '17

25 Oct '17

Thx Aki, with CRAP-MD5 as scheme and mechanism it's works corretlly. 2017-10-25 10:52 GMT+02:00 Aki Tuomi <aki.tuomi(a)dovecot.fi>: > PLAIN and LOGIN. > > > > --- > Aki Tuomi > Dovecot oy > > -------- Original message -------- > From: "j.emerlik" <j.emerlik(a)gmail.com> > Date: 25/10/2017 11:41 (GMT+02:00) > To: Dovecot Mailing List <dovecot(a)dovecot.org> > Subject: Password encription > > Hi, > which authentication mechanism should I use for SHA-256 password schama ? > Regards, > Jack >

1 0

Re: Password encription
by Aki Tuomi 25 Oct '17

25 Oct '17

PLAIN and LOGIN. ---Aki TuomiDovecot oy -------- Original message --------From: "j.emerlik" <j.emerlik(a)gmail.com> Date: 25/10/2017 11:41 (GMT+02:00) To: Dovecot Mailing List <dovecot(a)dovecot.org> Subject: Password encription Hi, which authentication mechanism should I use for SHA-256 password schama ? Regards, Jack

1 0

Password encription
by j.emerlik 25 Oct '17

25 Oct '17

Hi, which authentication mechanism should I use for SHA-256 password schama ? Regards, Jack

1 0