- dovecot - dovecot.org

Using Dovecot for IMAP/POP and SMTP
by Kenneth Ulrich 06 Aug '17

06 Aug '17

All, I was wondering if it is possible to use Dovecot as both incoming and outgoing. I have a friend that I am helping build a server, and he plans on using Dovecot for POP/IMAP and Postfix for SMTP and mailbox storage. If I understand right, Dovecot can handle both services and that is the path I would like him to take for easier maintenance. Can someone confirm this?

3 2

Re: Corrupted SSL parameters file in state_dir: ssl-parameters.dat
by Joseph Tam 05 Aug '17

05 Aug '17

> But if I enable SSL, the doveadm backup on the remote machine hangs. > And the destination machine prints the following two massages in the > logs : > > Aug 4 17:10:31 bbb dovecot: doveadm: Error: Corrupted SSL parameters > file in state_dir: ssl-parameters.dat - disabling SSL 360 > Aug 4 17:10:31 bbb dovecot: doveadm: Error: Couldn't initialize SSL > parameters, disabling SSL > > > BUT : > > (1) /var/lib/dovecot/ssl-parameters.dat *DOES* exist. > and > (2) If I delete it and restart dovecot, it successully re-creates it, as per > Aug 4 17:02:32 bbb dovecot: ssl-params: Generating SSL parameters > Aug 4 17:06:58 bbb dovecot: ssl-params: SSL parameters regeneration completed Your timestamps suggest you did this the other way around. Aki mentioned that issue is/will be fixed, but DH parameters can take a *very* long time to generate if you're unlucky, so maybe it's a timing issue (using the service before the DH parameters was ready.) Joseph Tam <jtam.home(a)gmail.com>

2 1

Re: Doveadm-sync SSH practicalities
by Joseph Tam 05 Aug '17

05 Aug '17

Terry Jones wrote: > The documentation is somewhat silent on this subject. If you mean https://wiki.dovecot.org/Tools/Doveadm/Sync the answers seem implicit to what's been stated. > What permissions does the SSH user need ? To be able to run the doveadm executable (or a wrapper script that eventually runs doveadm) on the remote side. > How associated does it need to be with things like dovecot directory > ownership etc ? It will take uid/gid directly from the login privileges unless you use a wrapper script that changes UID/GID. This may be necessary if you use remote-prefix option for remapping virtual users and user@domain to another UID/GID. > Obviously my dovecot daemon processes are running as restricted users > with "nologin" shells etc., and I don't really want to go opening > them up if I don't have to. It doesn't seem possible: you'll need to be able to set up the other endpoint of communication. You may be able to lock down the shell by replacing it with a fixed doveadm and arguments, or perhaps by fiddling with keys and the forced command feature of ssh, after working out the security issues. Depending on your use-case, you might be better off using one of the other transport methods. Do you actually need per-user syncing? Joseph Tam <jtam.home(a)gmail.com>

2 2

Auth Policy Server/wforce/weakforced
by Daniel Miller 04 Aug '17

04 Aug '17

Is there explicit documentation available for the (probably trivial) configuration needed for Dovecot and Wforce? I'm probably missing something that should be perfectly obvious... Wforce appears to start without errors. I added a file to dovecot's conf.d: 95-policy.conf: auth_policy_server_url = http://localhost:8084/ auth_policy_hash_nonce = this_is_my_super_secret_something Looking at the Wforce console I see: WforceWebserver: HTTP Request "/" from 127.0.0.1:45108: Web Authentication failed In wforce.conf I have the (default): webserver("0.0.0.0:8084", "--WEBPWD") Do I need to change the "--WEBPWD"? Do I need to specify something in the Dovecot config? -- Daniel

2 2

Corrupted SSL parameters file in state_dir: ssl-parameters.dat
by Terry Jones 04 Aug '17

04 Aug '17

Dovecot 2.2.10 Centos 7 Linux 3.10.0-514.26.2.el7.x86_64 #1 SMP Tue Jul 4 15:04:05 UTC 2017 x86_64 x86_64 x86_64 GNU/Linux I have been experimenting with backup options to another server using dovadm and was trying to use the doveadm service as a workaround seeing as I couldn't decipher what the docs were saying about ssh. My doveadm stanza looks as follows: service doveadm { inet_listener { port = 10101 ssl = yes } } If "ssl=no", a pushed "doveadm backup" from the remote machine works OK. But if I enable SSL, the doveadm backup on the remote machine hangs. And the destination machine prints the following two massages in the logs : Aug 4 17:10:31 bbb dovecot: doveadm: Error: Corrupted SSL parameters file in state_dir: ssl-parameters.dat - disabling SSL 360 Aug 4 17:10:31 bbb dovecot: doveadm: Error: Couldn't initialize SSL parameters, disabling SSL BUT : (1) /var/lib/dovecot/ssl-parameters.dat *DOES* exist. and (2) If I delete it and restart dovecot, it successully re-creates it, as per Aug 4 17:02:32 bbb dovecot: ssl-params: Generating SSL parameters Aug 4 17:06:58 bbb dovecot: ssl-params: SSL parameters regeneration completed

2 1

Problem switching from LDA to LMTP (with Postfix)
by Nikolaos Milas 04 Aug '17

04 Aug '17

Hello, I am trying to switch from LDA to LMTP on a Postfix/Dovecot setup, but something is going wrong. I have followed the directions at: https://wiki.dovecot.org/HowTo/PostfixDovecotLMTP Here is a session from dovecot.log: Aug 4 12:19:42 vmail2 dovecot: lmtp(3152): Connect from local Aug 4 12:19:42 vmail2 dovecot: auth: ldap(imaptester(a)noa.gr): unknown user Aug 4 12:19:42 vmail2 dovecot: lmtp(3152): Disconnect from local: Successful quit Aug 4 12:19:42 vmail2 dovecot: lmtp(3152): Connect from local Aug 4 12:19:42 vmail2 dovecot: auth: ldap(nmilas(a)noa.gr): unknown user Aug 4 12:19:42 vmail2 dovecot: lmtp(3152): Disconnect from local: Successful quit Aug 4 12:19:42 vmail2 dovecot: imap(nmilas): save: box=Sent, uid=31, msgid=<c84ae059-854d-12bc-6aa2-9099cc2977b2(a)noa.gr>, size=445, vsize=459, from=Nikolaos Milas <nmilas(a)noa.gr>, subject=Test (12) - vmail2, flags=(\Seen) What is going wrong? It seems authentication is not working correctly with this setup. If understand right, dovecot is querying ldap with the whole mail address and not with the local part only (which is the username), as I would expect. What is the suggested course of action? With LDA it was working fine; here is a sample log entry: Aug 4 12:02:51 vmail2 dovecot: lda(imaptester): sieve: msgid=<768b056c-1d12-c9bd-0864-c3fc6a6dbeda(a)noa.gr>: stored mail into mailbox 'INBOX' Aug 4 12:02:51 vmail2 dovecot: imap(nmilas): save: box=Sent, uid=30, msgid=<768b056c-1d12-c9bd-0864-c3fc6a6dbeda(a)noa.gr>, size=445, vsize=459, from=Nikolaos Milas <nmilas(a)noa.gr>, subject=Test (11) - vmail2, flags=(\Seen) Aug 4 12:02:51 vmail2 dovecot: imap(nmilas): Connection closed (noop finished 0.372 secs ago) in=628 out=2145 Please help me to figure out how things should be. The config file follows: ----------------------------- CONFIG START -------------------------------- protocols = imap pop3 sieve lmtp login_greeting = NOA POP/IMAP Srv XAPITI XPICTOY mail_location = maildir:~/Maildir/ mail_gid = 500 mail_uid = 500 auth_mechanisms = plain login auth_username_format = %Lu auth_verbose = yes auth_debug = no mail_debug = no disable_plaintext_auth = no mail_plugins = quota mail_log notify protocol imap { imap_client_workarounds = "delay-newmail" mail_plugins = quota imap_quota mail_log notify mail_max_userip_connections = 400 } protocol pop3 { mail_max_userip_connections = 3 mail_plugins = quota notify pop3_client_workarounds = outlook-no-nuls oe-ns-eoh pop3_uidl_format = %08Xu%08Xv } protocol lda { auth_socket_path = /var/run/dovecot/auth-master info_log_path = log_path = mail_plugins = quota notify sieve postmaster_address = sysadmin(a)noa.gr sendmail_path = /usr/lib/sendmail } protocol lmtp { auth_socket_path = /var/run/dovecot/auth-master postmaster_address = sysadmin(a)noa.gr mail_plugins = quota notify sieve sendmail_path = /usr/lib/sendmail } protocol sieve { managesieve_max_line_length = 65536 mail_max_userip_connections = 10 managesieve_logout_format = bytes=%i/%o managesieve_max_compile_errors = 10 } userdb { args = /etc/dovecot/dovecot-usrdb-ldap.conf driver = ldap } passdb { args = /etc/dovecot/dovecot-passdb-ldap.conf driver = ldap } plugin { mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename flag_change save mailbox_create mail_log_fields = uid box msgid size flags vsize from subject } plugin { quota = maildir:User quota quota_rule = *:storage=5G quota_rule2 = Trash:storage=+3%% quota_warning = storage=75%% quota-warning 75 %u quota_warning2 = storage=90%% quota-warning 90 %u } plugin { sieve = file:~/sieve;active=~/.dovecot.sieve sieve_max_script_size = 0 sieve_max_actions = 0 sieve_max_redirects = 1 } service quota-warning { executable = script /opt/mail1.sh user = vmail unix_listener quota-warning { user = vmail } } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } unix_listener auth-master { group = vmail mode = 0660 user = vmail } user = root } service imap-login { service_count = 1 vsz_limit = 64 M process_limit = 500 process_min_avail = 2 } service pop3-login { service_count = 1 vsz_limit = 64 M } service managesieve-login { inet_listener sieve { port = 4190 } service_count = 1 process_min_avail = 0 vsz_limit = 64M } service managesieve { process_limit = 1024 } service imap { executable = imap postlogin process_limit = 2048 } service pop3 { executable = pop3 postlogin } service postlogin { executable = script-login -d rawlog unix_listener postlogin { } } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } ssl_ca = </etc/pki/tls/certs/DigiCertCA.crt ssl_cert = </etc/pki/tls/certs/star_noa_gr-1243437.crt ssl_key = </etc/pki/tls/private/star_noa_gr-1243437.key ssl_protocols = !SSLv2 !SSLv3 syslog_facility = local1 ----------------------------- CONFIG END -------------------------------- FILE: /etc/dovecot/dovecot-usrdb-ldap.conf hosts = localhost tls = no base = ou=people, dc=noa, dc=gr scope = onelevel ldap_version = 3 dn = uid=auth,ou=Sys,dc=noa,dc=gr dnpass = secret auth_bind = yes user_filter = (uid=%u) pass_filter = (uid=%u) pass_attrs = uid=user,userPassword=password auth_bind_userdn = uid=%u,ou=people,dc=noa,dc=gr user_attrs = roomNumber=quota_rule=*:bytes=%$,uid=home=/home/vmail/%u iterate_filter = (objectClass=*) ---------------------------------------------------------------------------------------- Thanks in advance, Nick

2 2

proxy-dict with tcp connection
by Ralf Becker 04 Aug '17

04 Aug '17

I try to create a patch to allow (proxy-)dict to use tcp connections instead of a unix domain socket. I'm replacing connection_init_client_unix with connection_init_client_ip: --- ./src/lib-dict/dict-client.c.orig +++ ./src/lib-dict/dict-client.c @@ -721,6 +721,10 @@ client_dict_init(struct dict *driver, const char *uri, struct ioloop *old_ioloop = current_ioloop; struct client_dict *dict; const char *p, *dest_uri, *path; + const char *const *args; + unsigned int argc; + struct ip_addr ip; + in_port_t port=0; unsigned int idle_msecs = DICT_CLIENT_DEFAULT_TIMEOUT_MSECS; unsigned int warn_slow_msecs = DICT_CLIENT_DEFAULT_WARN_SLOW_MSECS; @@ -772,7 +776,21 @@ client_dict_init(struct dict *driver, const char *uri, dict->warn_slow_msecs = warn_slow_msecs; i_array_init(&dict->cmds, 32); - if (uri[0] == ':') { + args = t_strsplit(uri, ":"); + for(argc=0; args[argc] != NULL; argc++); + + if (argc == 3) { /* host:ip:somewhere --> argc == 3 */ + if (net_addr2ip(args[0], &ip) < 0) { + *error_r = t_strdup_printf("Invalid IP: %s in URI: %s", args[0], uri); + return -1; + } + if (net_str2port(args[1], &port) < 0) { + *error_r = t_strdup_printf("Invalid port: %s in URI: %s", args[1], uri); + return -1; + } + dest_uri = strrchr(uri, ':'); + } else if (uri[0] == ':') { /* default path */ path = t_strconcat(set->base_dir, "/"DEFAULT_DICT_SERVER_SOCKET_FNAME, NULL); @@ -784,7 +802,13 @@ client_dict_init(struct dict *driver, const char *uri, path = t_strconcat(set->base_dir, "/", t_strdup_until(uri, dest_uri), NULL); } - connection_init_client_unix(dict_connections, &dict->conn.conn, path); + if (port > 0) { + connection_init_client_ip(dict_connections, &dict->conn.conn, &ip, port); + } else { + connection_init_client_unix(dict_connections, &dict->conn.conn, path); + } dict->uri = i_strdup(dest_uri + 1); dict->ioloop = io_loop_create(); But unfortunately this crashes: Jul 28 13:20:04 auth: Error: auth worker: Aborted PASSL request for info(a)outdoor-training.de: Worker process died unexpectedly Jul 28 13:20:04 auth-worker(705): Fatal: master: service(auth-worker): child 705 killed with signal 11 (core dumped) Jul 28 13:20:04 doveadm(10.44.88.1,info(a)outdoor-training.de): Error: user info(a)outdoor-training.de: Auth PASS lookup failed It looks like the tcp connection gets opened non-blocking and the first write / dict lookup happens to early: 4303041 13:44:25.120398220 0 auth (29884) < connect res=-115(EINPROGRESS) tuple=172.18.0.2:47552->10.44.99.180:2001 Looking at dict-memcached-ascii.c I probably need to do something like: i_array_init(&dict->input_states, 4); i_array_init(&dict->replies, 4); dict->ioloop = io_loop_create(); io_loop_set_current(old_ioloop); *dict_r = &dict->dict; to wait until the socket is ready ... Any idea / tips? Ralf -- Ralf Becker EGroupware GmbH [www.egroupware.org] Handelsregister HRB Kaiserslautern 3587 Geschäftsführer Birgit und Ralf Becker Leibnizstr. 17, 67663 Kaiserslautern, Germany Telefon +49 631 31657-0

2 2

rawlog
by Matt Bryant 04 Aug '17

04 Aug '17

Hi, Trying to get rawlog working on dovecot 2.2.31 configured as per https://wiki2.dovecot.org/Debugging/Rawlog but a) it doesnt appear to be loggin anything b) rawlog_dir which is supposed to be v2.2.26+ seems no where in site .. in fact complains about unknown variable So does rawlog still do anything ???? Or am I missing something ... config is below .... # 2.2.19: /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.9 (357ac0a0e68b+) doveconf: Warning: service auth { client_limit=30000 } is lower than required under max. load (150032) doveconf: Warning: service anvil { client_limit=22000 } is lower than required under max. load (50027) # OS: Linux 3.10.0-327.4.4.el7.x86_64 x86_64 CentOS Linux release 7.2.1511 (Core) auth_cache_negative_ttl = 2 mins auth_cache_size = 10 M auth_cache_ttl = 10 mins auth_master_user_separator = * auth_mechanisms = plain login auth_worker_max_count = 10000 default_client_limit = 50000 default_process_limit = 50000 disable_plaintext_auth = no doveadm_password = # hidden, use -P to show it imap_client_workarounds = delay-newmail tb-extra-mailbox-sep tb-lsub-flags imap_hibernate_timeout = 1 mins imap_idle_notify_interval = 1 mins login_greeting = IMAP/POP3 ready - dev-dh-ro-ms-001-b mail_attachment_dir = /var/lib/dovecot/attachments/%Ld mail_cache_min_mail_count = 5 mail_plugins = " notify replication quota virtual" mailbox_list_index = yes managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate vacation-seconds spamtest spamtestplus editheader mbox_write_locks = fcntl mmap_disable = yes namespace { inbox = yes list = yes location = mailbox Archive { auto = create special_use = \Archive } mailbox Drafts { auto = create special_use = \Drafts } mailbox Sent { auto = create special_use = \Sent } mailbox Spam { auto = create special_use = \Junk } mailbox Trash { auto = create special_use = \Trash } prefix = INBOX/ separator = / type = private } namespace { list = no location = virtual:/var/lib/dovecot/virtual:INDEXPVT=~/virtual prefix = virtual/ separator = / type = private } passdb { args = /etc/dovecot/sql_users.conf driver = sql } plugin { mail_log_events = delete expunge mail_log_fields = uid box msgid size mail_replica = tcp:dev-ms-001-a:4000 quota = dict:UserQuota::file:%h/dovecot-quota quota_rule2 = INBOX/Trash:storage=+10%% sieve = file:~/sieve/user;active=~/.dovecot.sieve sieve_default = file:/var/lib/dovecot/sieve/default.sieve sieve_default_name = default sieve_editheader_max_header_size = 1k sieve_extensions = +spamtest +spamtestplus +editheader +vacation-seconds sieve_global = file:/var/lib/dovecot/sieve sieve_quota_max_scripts = 5 sieve_spamtest_max_value = 200 sieve_spamtest_status_header = X-Spam-score-int: -?([[:digit:]]+) sieve_spamtest_status_type = score sieve_vacation_default_period = 10d sieve_vacation_max_period = 30d sieve_vacation_min_period = 1s } pop3_client_workarounds = outlook-no-nuls oe-ns-eoh pop3_fast_size_lookups = yes protocols = imap pop3 lmtp sieve replication_dsync_parameters = -d -n INBOX -l 30 -U service aggregator { fifo_listener replication-notify-fifo { user = vmail } unix_listener replication-notify { user = vmail } } service anvil { client_limit = 22000 } service auth-worker { user = $default_internal_user } service auth { client_limit = 30000 unix_listener auth_client { mode = 0660 user = exim } } service doveadm { client_limit = 1 inet_listener { address = * port = 4000 } process_limit = 80 process_min_avail = 8 service_count = 10 } service imap-hibernate { client_limit = 8000 process_limit = 8 process_min_avail = 8 service_count = 0 unix_listener imap-hibernate { group = vmail mode = 0660 } } service imap-login { client_limit = 8000 inet_listener imap { port = 143 } process_limit = 8 process_min_avail = 8 service_count = 0 } service imap { client_limit = 1 process_limit = 50000 service_count = 100 } service managesieve-login { client_limit = 1000 inet_listener sieve { port = 4190 } process_limit = 8 process_min_avail = 8 service_count = 0 } service managesieve { process_limit = 1024 } service pop3-login { client_limit = 1000 inet_listener pop3 { port = 110 } process_limit = 8 process_min_avail = 8 service_count = 0 } service pop3 { process_limit = 10000 } service postlogin { executable = script-login -d rawlog unix_listener postlogin { group = atmail mode = 0660 } } service replicator { process_min_avail = 1 unix_listener replicator-doveadm { group = atmail mode = 0660 } } shutdown_clients = no ssl_cert = </etc/pki/dovecot/certs/dovecot.pem ssl_key = </etc/pki/dovecot/private/dovecot.pem userdb { driver = prefetch } userdb { args = /etc/dovecot/sql_users.conf driver = sql } protocol imap { mail_max_userip_connections = 30000 mail_plugins = " notify replication quota virtual imap_quota" } protocol pop3 { mail_max_userip_connections = 30000 mail_plugins = " notify replication quota virtual" } protocol lmtp { auth_username_format = %Lu mail_plugins = " notify replication quota virtual sieve quota" postmaster_address = mailer-daemon }

3 3

Re: rawlog
by Joseph Tam 04 Aug '17

04 Aug '17

Matt Bryant wrote: > a) it doesnt appear to be loggin anything > b) rawlog_dir which is supposed to be v2.2.26+ seems no where in site .. > in fact complains about unknown variable > ... > service postlogin { > executable = script-login -d rawlog > unix_listener postlogin { > group = atmail > mode = 0660 > } > } In my test setup, I use the first option protocol imap { ... rawlog_dir = /data/rawlogs/%u } You may also want it into your protocol pop3 section. Joseph Tam <jtam.home(a)gmail.com>

1 0

pam auth problem
by Randy Bush 03 Aug '17

03 Aug '17

# dovecot --version 2.2.31 (65cde28) on freebsd 64 10.3 system converted to dovecot 2 against my will and consuming a lot of time sorting it out. i am glad google does not charge. have spent two hours on this one alone; and undoubtedly it is my st00pidity. so excuse my desperate posting to lazynet. cram-md5 works, pam not so much Aug 3 06:06:35 psg auth: in openpam_parse_chain(): /etc/pam.d/dovecot(1): missing or invalid facility Aug 3 06:06:35 psg dovecot: auth-worker(48815): Error: pam(elb,2604:6000:130d:c31b:d250:99ff:fe90:14dd,<Lyh6LtNVMq8mBGAAEw3DG9JQmf/+kBTd>): pam_start() failed: system error Aug 3 06:06:35 psg auth: in openpam_parse_chain(): /etc/pam.d/dovecot(1): missing or invalid facility Aug 3 06:06:35 psg dovecot: auth-worker(48815): Error: pam(elb,2604:6000:130d:c31b:d250:99ff:fe90:14dd,<Lyh6LtNVMq8mBGAAEw3DG9JQmf/+kBTd>): pam_start() failed: system error # 2.2.31 (65cde28): /usr/local/etc/dovecot/dovecot.conf # OS: FreeBSD 10.3-RELEASE-p20 amd64 auth_mechanisms = plain login cram-md5 first_valid_gid = 0 mail_location = mbox:~/mail/:INBOX=/var/mail/%u mail_privileged_group = mail namespace inbox { inbox = yes location = prefix = } passdb { args = scheme=cram-md5 /usr/local/etc/dovecot.cram-md5 driver = passwd-file name = passwd-file } passdb { driver = pam } passdb { driver = pam name = pam } pop3_client_workarounds = outlook-no-nuls oe-ns-eoh protocols = imap pop3 service auth { unix_listener auth-userdb { group = mail } } service imap-login { inet_listener imaps { port = 993 ssl = yes } } service pop3-login { inet_listener pop3 { port = 110 } inet_listener pop3s { port = 995 ssl = yes } } ssl_cert = </etc/ssl/certs/dovecot.pem ssl_key = # hidden, use -P to show it userdb { driver = passwd } # cat /etc/pam.d/dovecot passdb { driver = pam args = failure_show_msg=yes args = %s }

5 10

Replication and public folders with private (seen) flags
by Ralf Becker 03 Aug '17

03 Aug '17

We started using Dovecot replication between two nodes and noticed that our configured private flags (INDEXPVT) in public/shared mailboxes are not replicated. We are only replicating INBOX namespace, as we dont want to replicate content of shared mailboxes for every user again. Is there a way to replicate the INDEXPVT or is that not (yet) implemented? Dovecot versions: # 2.2.31 (65cde28): /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.19 (e5c7051) # OS: Linux 4.4.0-87-generic x86_64 Using following namespaces: namespace inboxes { inbox = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk { auto = subscribe special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox Templates { auto = subscribe } mailbox Trash { auto = subscribe special_use = \Trash } prefix = INBOX/ separator = / subscriptions = no } namespace subs { hidden = yes list = no location = prefix = separator = / } namespace users { location = mdbox:%%h/mdbox:INDEXPVT=~/shared/%%u prefix = user/%%n/ separator = / subscriptions = no type = shared } And the following replication config: root@ka-nfs-mail:~# cat /etc/dovecot/replication.conf service aggregator { fifo_listener replication-notify-fifo { user = dovecot } unix_listener replication-notify { user = dovecot } } service replicator { process_min_avail = 1 unix_listener replicator-doveadm { group = dovecot user = dovecot mode = 0660 } } service doveadm { inet_listener { port = 12345 #ssl = yes } } doveadm_port = 12345 doveadm_password = ******* plugin { #mail_replica = tcp:10.44.99.1 # use doveadm_port mail_replica = tcp:10.44.88.1 # use doveadm_port } replication_dsync_parameters = -d -n INBOX -l 30 -U -- Ralf Becker EGroupware GmbH [www.egroupware.org] Handelsregister HRB Kaiserslautern 3587 Geschäftsführer Birgit und Ralf Becker Leibnizstr. 17, 67663 Kaiserslautern, Germany Telefon +49 631 31657-0

1 0

Doveadm-sync SSH practicalities
by Terry Jones 02 Aug '17

02 Aug '17

Hi, The documentation is somewhat silent on this subject. What permissions does the SSH user need ? How associated does it need to be with things like dovecot directory ownership etc ? Obviously my dovecot daemon processes are running as restricted users with "nologin" shells etc., and I don't really want to go opening them up if I don't have to. So could someone kindly please expand a little on how exactly doveadm-sync is supposed to work with SSH ? Thanks Terry

1 0

result of uid sort by subject
by TACHIBANA Masashi 02 Aug '17

02 Aug '17

Result of uid sort by subject is not expected. for example: Japanese => English => Japanese => English I'm now using Dovecot 2.2.31. command example: HNKK6 UID SORT (REVERSE SUBJECT) utf-7 ALL * SORT 3 1 7 2 4 10 11 8 12 HNKK6 OK Sort completed (0.002 + 0.041 + 0.001 secs). Any hint? -- Masashi Astro TACHIBANA QUALITIA CO., LTD. mailto:tachibana@qualitia.co.jp

2 2

Corrupt index files
by Bruce Guenter 02 Aug '17

02 Aug '17

I am running Dovecot IMAP on Linux, on a LizardFS storage cluster with Maildir storage. This has worked well for most of the accounts for several months. However in the last couple of weeks we are seeing increasing errors regarding corrupted index files. Some of the accounts affected are unable to retrieve messages due to timeouts. It appeared the problems were due to the accounts being accessed from multiple servers simultaneously, so I forced them all to access one server, but the errors remained. It looks like it has something to do with file locking, but LizardFS supports advisory file locking and I do have it enabled. Deleting the corrupted indexes fixes the problem for a while, but it eventually returns, particularly for some accounts. Here are some errors I'm seeing (just a random grab). Actual home directories are munged for confidentiality. imap[25157]: (clientes.standby) Error: Failed to fix view for HOME/clientes:standby/dovecot.index: Missing middle file seq=1 (between 1..1, we have seqs 8): File is already open imap[5565]: (stadiumchair) Error: Transaction log file HOME/stadiumchair/.Drafts/dovecot.index.log: marked corrupted imap[5005]: (stadiumchair) Error: Corrupted transaction log file HOME/stadiumchair/.Drafts/dovecot.index.log seq 2: indexid changed 1418941056 -> 1500658549 (sync_offset=0) imap[20243]: (martha) Error: Transaction log HOME/martha/dovecot.index.log: duplicate transaction log sequence (539) imap[4665]: (emsspam) Error: Index file HOME/emsspam/dovecot.index: indexid changed: 1500658479 -> 1297175382 imap[4665]: (emsspam) Error: Corrupted transaction log file HOME/emsspam/dovecot.index.log seq 3: indexid changed: 1500658479 -> 1297175382 (sync_offset=316) imap[22985]: (emsspam) Error: Corrupted transaction log file HOME/emsspam/dovecot.index.log seq 10742: Invalid transaction log size (9296 vs 9296): HOME/emsspam/dovecot.index.log (sync_offset=9296) imap[3267]: (emsspam) Error: Failed to map view for HOME/emsspam/dovecot.index: Failed to map file seq=10742 offset=9052..18446744073709551615 (ret=0): corrupted, indexid=0 imap[3267]: (emsspam) Error: HOME/emsspam/dovecot.index view is inconsistent: uid=3062271 inserted in the middle of mailbox The output of dovecot -n is pasted in below. Note that some of the boxes are running 4.9, some running 4.4, all have the same problems. Also note that I am using a custom authentication front end for our virtual mailboxes, but it just sets up the minimal environment variables and runs imap. Is there anything I can change to eliminate these problems? Are there any other diagnostics I can provide to shed light on this? # 2.2.31 (65cde28): /etc/dovecot/dovecot.conf # OS: Linux 4.4.66 x86_64 Gentoo Base System release 2.3 log_path = /dev/stderr mail_debug = yes mail_fsync = always mail_location = maildir:~/.maildir mail_log_prefix = "%s[%p]: (%u) " mmap_disable = yes namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = INBOX separator = type = private } passdb { args = * driver = pam } passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } plugin { mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename } ssl_cert = </etc/ssl/dovecot/server.pem ssl_key = # hidden, use -P to show it userdb { driver = passwd } userdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } -- Bruce Guenter <bruce(a)untroubled.org> http://untroubled.org/

5 11

under another kind of attack
by Olaf Hopp 31 Jul '17

31 Jul '17

Hi folks, "somehow" similar to the thread "under some kind oof attack" started by "MJ": I have dovecot shielded by fail2ban which works fine. But since a few days I see many many IPs per day knocking on my doors with wron password and/or users. But the rate at which they are knocking is very very low. So fail2ban will never catch them. For example one IP: Jul 25 14:03:17 irams1 dovecot: auth-worker(2212): pam(eurodisc,101.231.247.210,<gAulHSNVsNZl5/fS>): unknown user Jul 25 15:16:36 irams1 dovecot: auth-worker(11047): pam(gergei,101.231.247.210,<dPzYIyRVtOpl5/fS>): pam_authenticate() failed: Authentication failure (password mismatch?) Jul 25 16:08:51 irams1 dovecot: auth-worker(3379): pam(icpe,101.231.247.210,<Ws6t3iRVkOhl5/fS>): unknown user Jul 25 16:10:47 irams1 dovecot: auth-worker(4250): pam(endsulei,101.231.247.210,<dceL5SRVGZVl5/fS>): unknown user Note the timestamps. If I look the other way round (tries to one account) I'll get Jul 25 01:30:48 irams1 dovecot: auth-worker(11276): pam(endsulei,60.166.12.117,<slp6mhhViI48pgx1>): unknown user Jul 25 01:31:26 irams1 dovecot: auth-worker(11276): pam(endsulei,222.243.211.200,<s0+6nBhVabHe89PI>): unknown user Jul 25 13:29:22 irams1 dovecot: auth-worker(4745): pam(endsulei,60.2.50.114,<4elhpCJVtcw8AjJy>): unknown user Jul 25 13:30:27 irams1 dovecot: auth-worker(4747): pam(endsulei,222.84.118.83,<kaE1qCJVn7neVHZT>): unknown user Jul 25 16:10:47 irams1 dovecot: auth-worker(4250): pam(endsulei,101.231.247.210,<dceL5SRVGZVl5/fS>): unknown user Jul 25 16:11:45 irams1 dovecot: auth-worker(5933): pam(endsulei,206.214.0.120,<R5H56CRVdJfO1gB4>): unknown user Also note the timestamps! And I see many many distinct IPs per day (a few hundred) trying many many existing and non-existings accounts. As you see in the timestamps in my examples, this can not be handled by fail2ban without affecting regular users with typos. Is anybody observing something similar ? Anybody an idea against this ? Many of these observed IPs are chinese mobile IPs, if this matters. But we have also chinese students and researchers all abroad. Regards, Olaf -- Karlsruher Institut für Technologie (KIT) ATIS - Abt. Technische Infrastruktur, Fakultät für Informatik Dipl.-Geophys. Olaf Hopp - Leitung IT-Dienste - Am Fasanengarten 5, Gebäude 50.34, Raum 009 76131 Karlsruhe Telefon: +49 721 608-43973 Fax: +49 721 608-46699 E-Mail: Olaf.Hopp(a)kit.edu atis.informatik.kit.edu www.kit.edu KIT – Die Forschungsuniversität in der Helmholtz-Gemeinschaft Das KIT ist seit 2010 als familiengerechte Hochschule zertifiziert.

11 16

Re: under another kind of attack
by Davide Marchi 31 Jul '17

31 Jul '17

> From: Olaf Hopp <Olaf.Hopp(a)kit.edu> > Davide, > yours is all postfix and thus has got no overlap with dovecot. > So no interference. > Olaf Yes, I know, but I preferred not to give anything for granted ;-) Many Thanks Olaf!

1 0

Large Scale Cluster using dsync and tagged director
by Matt Bryant 31 Jul '17

31 Jul '17

Just been reading up on some of dovecot features and was wondering if anyone had played around with large scale systems made up from mutliple small dsync clusters and using tagged director to split users between nodes of a sync'd cluster (rather than nfs). I know traditionally its been shared storage and multiple nodes and dovecots own doco suggest dsync for several thousands rather than millions but given the cloud seems to be all about replication what about many smaller nodes using dsync and scaling horizontally ? The only issue is how does director scale when there are serveral(or rather lots of) 'tags' ... in fact what are the limitations with director ? Matt -- <https://www.postbox-inc.com/?utm_source=email&utm_medium=siglink&utm_campai…>

1 0

dovecot auth errors for a new user
by Ruben Safir 31 Jul '17

31 Jul '17

I've been running dovecott without trouble for quite a why and now when I added a new user, it is not accepting the user and I can not track the problem. It says find more information in the server log, but it is not in /var/log/messages or /var/log/mail.err and nothing with lsof dovecot|grep log show anything to tail www:~ # dovecot -n # 2.2.13: /etc/dovecot/dovecot.conf # OS: Linux 3.16.7-53-pae i686 openSUSE 13.2 (i586) base_dir = /var/run/dovecot/ managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { driver = pam } plugin { sieve = ~/.dovecot.sieve sieve_dir = ~/sieve } protocols = pop3 ssl_cert = </etc/ssl/certs/dovecot.pem ssl_key = </etc/ssl/private/dovecot.key userdb { driver = passwd } www:/etc/dovecot # dovecot --version 2.2.13 Sending of password for user facebook did not succeed. Mail server mrbrklyn.com responded: Internal error occurred. Refer to server log for more information. 2017-07-30T15:41:58.803006-04:00 www dovecot: pop3-login: Login: user=<facebook>, method=PLAIN, rip=10.0.0.62, lip=96.57.23.82, mpid=25269, TLS, session=<D5J/G45VQgAKAAA+> 2017-07-30T15:41:58.812827-04:00 www dovecot: pop3(facebook): Error: user facebook: Initialization failed: Namespace '': Mail storage autodetection failed with home=/home/facebook 2017-07-30T15:41:58.816903-04:00 www dovecot: pop3(facebook): Error: Invalid user settings. Refer to server log for more information. -- So many immigrant groups have swept through our town that Brooklyn, like Atlantis, reaches mythological proportions in the mind of the world - RI Safir 1998 http://www.mrbrklyn.com DRM is THEFT - We are the STAKEHOLDERS - RI Safir 2002 http://www.nylxs.com - Leadership Development in Free Software http://www2.mrbrklyn.com/resources - Unpublished Archive http://www.coinhangout.com - coins! http://www.brooklyn-living.com Being so tracked is for FARM ANIMALS and and extermination camps, but incompatible with living as a free human being. -RI Safir 2013

2 4

Re: under another kind of attack
by Davide Marchi 30 Jul '17

30 Jul '17

Hi to all, @Olaf Hopp I've this filter enabled for fail2ban, my question is: could my filters overlap or interfere with those suggested by you? this is my filter: Contents of /etc/fail2ban/jail.conf: [postfix] # Ban for 10 minutes if it fails 6 times within 10 minutes enabled = true port = smtp,ssmtp filter = postfix logpath = /var/log/mail.log maxretry = 6 bantime = 600 findtime = 600 Contents of /etc/fail2ban/filter.d/postfix.conf: # Fail2Ban configuration file # Author: Cyril Jaquier # $Revision$ [Definition] # Option: failregex # Notes.: regex to match the password failures messages in the logfile. The # host must be matched by a group named "host". The tag "<HOST>" can # be used for standard IP/hostname matching and is only an alias for # (?:::f{4,6}:)?(?P<host>[\w\-.^_]+) # Values: TEXT # # Jul 11 02:35:08 mail postfix/smtpd[16299]: lost connection after AUTH from unknown[196.12.178.73] failregex = lost connection after AUTH from unknown\[<HOST>\] # Option: ignoreregex # Notes.: regex to ignore. If this regex matches, the line is ignored. # Values: TEXT # ignoreregex = Many thanks!

2 1

Re: under another kind of attack
by Joseph Tam 28 Jul '17

28 Jul '17

(I think I am testing other readers' patience, so if you want to follow-up, you can Email me directly.) > but how often do you have to type your username ? Not often, but I'm not talking the typical case. The larger the population you serve, the more circumstances you'll have to cover. > Only on the initial config of your mailer. After that you are done. Mail reader setups by users is often an error prone process, judging from the number of times I have to correct a setup. This is especially true for an educational institution that typically has a large turnover of accounts. If a user gets it initially wrong, then fixes their mistake, they can't get it to work despite trying all sorts of config variations, not realizing it can't be resolved anymore. Result: trouble call. If someone blows it setting on a multi-user workstation, other users with a working setups can't log in. Result: trouble call. If a student flubs their credentials, all the roommates behind their residential NAT gateway suffer. Result: trouble call. If a user screws up using an external service that slurps their mail (e.g. Gmail, Yahoo, uniboxapp, etc.), or worse, someone malicious does it on puropse, all other users of this service will be DoS'd. Result: trouble call(s). If a user acquires a DHCP address in a polluted network ..., well you get the idea. Not to mention ex-users who forget to remove their mail accounts from their smartphones, leaving a trail of blacklist entries in their wake as they travel from coffee shops to other public WiFi hotspots. > So this is why I decided to use two distinct jails with > different policies. It seems to work reasonable well. Until it doesn't. If it works for you, more power to you. The cost/benefit of a hair-trigger blacklist policy is that it saves you a few log entries showing futile attempts at finding weak passwords (because you have strong passwords, don't you?) at the risk of dealing with any of the above situations. Joseph Tam <jtam.home(a)gmail.com>

1 0

Re: under another kind of attack
by Joseph Tam 27 Jul '17

27 Jul '17

Olaf Hopp <Olaf.Hopp(a)kit.edu> wrote: > And I have a new one just for "unknown user" and here my bantime and findtime > are much bigger and the retries are just '2'. So here I'm much harsher. > I'll keep an eye on my logs and maybe some more twaeking is necessary. Just be careful about typos (like twaeking!): users could simply misspell their username, or get mixed up with some another account or alias. This is why I favour targetting known bad accounts, not merely accounts that don't exist. Joseph Tam <jtam.home(a)gmail.com>

2 1

Re: failed to store into mailbox 'INBOX/Junk': Permission
by Davide Marchi 26 Jul '17

26 Jul '17

> From: Thomas Leuxner <tlx(a)leuxner.net> >> cat /etc/dovecot/dovecot-acl >> * user=booking(a)hotelsangiorgioriccione.com lrwsi >> * user=info(a)hotelsangiorgioriccione.com lrwsi > Hi Davide, > > For LMTP to file the mails you need to add the p flag (POST). Well, I've added the "p" flag and now I will monitor the situation ;-) PS Just as an additional note, just after making this change and reload Dovecot I have detected (oneshot) this error message: Jul 26 22:09:53 server dovecot: imap-login: Error: read(anvil) failed: EOF Jul 26 22:09:53 server dovecot: imap-login: Error: read(anvil) failed: EOF Jul 26 22:09:53 server dovecot: imap-login: Error: read(anvil) failed: EOF Jul 26 22:09:53 server dovecot: auth: Error: read(anvil-auth-penalty) failed: EOF Jul 26 22:09:53 server dovecot: auth: Error: net_connect_unix(anvil-auth-penalty) failed: Permission denied Jul 26 22:09:53 server dovecot: imap-login: Error: read(anvil) failed: EOF Jul 26 22:09:53 server dovecot: imap-login: Error: read(anvil) failed: EOF Jul 26 22:09:53 server dovecot: imap-login: Error: read(anvil) failed: EOF Jul 26 22:09:53 server dovecot: imap-login: Error: read(anvil) failed: EOF But now everything seems to work well (let's hope) ;-) Many thanks Thomas!

1 0

Return extra fields from passwd userdb
by Michele Petrella 26 Jul '17

26 Jul '17

Hi all. I use dovecot 2.2.29.1. Output of dovecot -n: # 2.2.29.1 (e0b76e3): /var/etc/dovecot/dovecot.conf # Pigeonhole version 0.4.18 (29cc74d) # OS: Linux 3.10.55-gentoo i686 SuSE Linux 7.1 (i386) debug_log_path = /var/log/dovecot/dovecot_debug.log disable_plaintext_auth = no info_log_path = /var/log/state.mail/dovecot.pipe log_path = /var/log/dovecot/dovecot.log mail_debug = yes mail_gid = users mail_location = maildir:~/.maildir mail_plugins = acl quota mail_shared_explicit_inbox = yes mail_uid = vmail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext namespace { list = yes location = maildir:/data/home/vmail/public prefix = Public/ separator = / subscriptions = no type = public } namespace { list = children location = maildir:/data/home/%%n/.maildir:INDEX=~/.maildir/shared/%%u prefix = Shared/%%u/ separator = / subscriptions = no type = shared } namespace inbox { inbox = yes list = yes location = mailbox Cestino { special_use = \Trash } mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox "Posta inviata" { special_use = \Sent } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = separator = / subscriptions = yes type = private } passdb { args = /etc/dovecot/passwd.masterusers driver = passwd-file master = yes } passdb { driver = pam } plugin { acl = vfile:/etc/dovecot/acl:cache_secs=300 acl_shared_dict = file:/var/lib/dovecot-dict/shared-mailboxes quota = maildir:User quota quota_rule = *:storage=5M quota_rule2 = Trash:storage=+100M quota_rule3 = SPAM:ignore sieve = ~/.dovecot.sieve sieve_before = /var/etc/dovecot/sieve/general/ sieve_dir = ~/sieve sieve_execute_bin_dir = /usr/local/bin/dovecot/sieve-execute sieve_filter_bin_dir = /usr/local/bin/dovecot/sieve-filter sieve_global_dir = /var/etc/dovecot/sieve/global/ sieve_global_extensions = +vnd.dovecot.execute +vnd.dovecot.filter +vnd.dovecot.pipe +editheader sieve_pipe_bin_dir = /usr/local/bin/dovecot/sieve-pipe sieve_plugins = sieve_extprograms } protocols = imap pop3 lmtp sieve service auth { unix_listener auth-userdb { group = users } } service imap-postlogin { executable = script-login /usr/local/bin/imap-postlogin.sh user = $default_internal_user } service imap { executable = imap imap-postlogin } ssl = no ssl_cert = </conf/etc/cert/certs/services/imap_pop/majornet.crt ssl_key = # hidden, use -P to show it userdb { default_fields = quota_rule=*:bytes=%$ driver = passwd } protocol lda { info_log_path = /var/log/dovecot/dovecot-lda.log log_path = /var/log/dovecot/dovecot-lda.log mail_plugins = acl quota sieve } protocol imap { mail_max_userip_connections = 20 mail_plugins = acl quota imap_acl imap_quota } I have problems in return extra fields from passwd userdb. My users are partially in passwd files and partially in LDAP. Users who use mail are in LDAP db. If I use "default_fields = quota_rule=*:bytes=100M" in userdb, Output of "doveadm -D quota get -u afasystems" is: Debug: Loading modules from directory: /usr/lib/dovecot Debug: Module loaded: /usr/lib/dovecot/lib01_acl_plugin.so Debug: Module loaded: /usr/lib/dovecot/lib10_quota_plugin.so Debug: Loading modules from directory: /usr/lib/dovecot/doveadm Debug: Module loaded: /usr/lib/dovecot/doveadm/lib10_doveadm_acl_plugin.so Debug: Skipping module doveadm_expire_plugin, because dlopen() failed: /usr/lib/dovecot/doveadm/lib10_doveadm_expire_plugin.so: undefined symbol: expire_set_deinit (this is usually intentional, so just ignore this message) Debug: Module loaded: /usr/lib/dovecot/doveadm/lib10_doveadm_quota_plugin.so Debug: Module loaded: /usr/lib/dovecot/doveadm/lib10_doveadm_sieve_plugin.so Debug: Skipping module doveadm_fts_lucene_plugin, because dlopen() failed: /usr/lib/dovecot/doveadm/lib20_doveadm_fts_lucene_plugin.so: undefined symbol: lucene_index_iter_deinit (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_fts_plugin, because dlopen() failed: /usr/lib/dovecot/doveadm/lib20_doveadm_fts_plugin.so: undefined symbol: fts_user_get_language_list (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_mail_crypt_plugin, because dlopen() failed: /usr/lib/dovecot/doveadm/libdoveadm_mail_crypt_plugin.so: undefined symbol: mail_crypt_box_get_pvt_digests (this is usually intentional, so just ignore this message) doveadm(afasystems): Debug: auth USER input: afasystems quota_rule=*:bytes=100M system_groups_user=afasystems uid=1002 gid=100 home=/data/home/afasystems doveadm(afasystems): Debug: Added userdb setting: plugin/quota_rule=*:bytes=100M doveadm(afasystems): Debug: Effective uid=1002, gid=100, home=/data/home/afasystems doveadm(afasystems): Debug: Quota root: name=User quota backend=maildir args= doveadm(afasystems): Debug: Quota rule: root=User quota mailbox=* bytes=104857600 messages=0 doveadm(afasystems): Debug: Quota rule: root=User quota mailbox=Trash bytes=+104857600 messages=0 doveadm(afasystems): Debug: Quota rule: root=User quota mailbox=SPAM ignored doveadm(afasystems): Debug: Quota grace: root=User quota bytes=10485760 (10%) doveadm(afasystems): Debug: Namespace inbox: type=private, prefix=, sep=/, inbox=yes, hidden=no, list=yes, subscriptions=yes location=maildir:~/.maildir doveadm(afasystems): Debug: maildir++: root=/data/home/afasystems/.maildir, index=, indexpvt=, control=, inbox=/data/home/afasystems/.maildir, alt= doveadm(afasystems): Debug: acl: initializing backend with data: vfile:/etc/dovecot/acl:cache_secs=300 doveadm(afasystems): Debug: acl: acl username = afasystems doveadm(afasystems): Debug: acl: owner = 1 doveadm(afasystems): Debug: acl vfile: Global ACL legacy directory: /etc/dovecot/acl doveadm(afasystems): Debug: Namespace : type=public, prefix=Public/, sep=/, inbox=no, hidden=no, list=yes, subscriptions=no location=maildir:/data/home/vmail/public doveadm(afasystems): Debug: maildir++: root=/data/home/vmail/public, index=, indexpvt=, control=, inbox=, alt= doveadm(afasystems): Debug: acl: initializing backend with data: vfile:/etc/dovecot/acl:cache_secs=300 doveadm(afasystems): Debug: acl: acl username = afasystems doveadm(afasystems): Debug: acl: owner = 0 doveadm(afasystems): Debug: acl vfile: Global ACL legacy directory: /etc/dovecot/acl doveadm(afasystems): Debug: Namespace : type=shared, prefix=Shared/%u/, sep=/, inbox=no, hidden=no, list=children, subscriptions=no location=maildir:/data/home/%n/.maildir:INDEX=~/.maildir/shared/%u doveadm(afasystems): Debug: shared: root=/var/run/dovecot, index=, indexpvt=, control=, inbox=, alt= doveadm(afasystems): Debug: acl: initializing backend with data: vfile:/etc/dovecot/acl:cache_secs=300 doveadm(afasystems): Debug: acl: acl username = afasystems doveadm(afasystems): Debug: acl: owner = 0 doveadm(afasystems): Debug: acl vfile: Global ACL legacy directory: /etc/dovecot/acl doveadm(afasystems): Debug: quota: quota_over_flag check: quota_over_script unset - skipping doveadm(afasystems): Debug: Namespace : Using permissions from /data/home/afasystems/.maildir: mode=0700 gid=default Quota name Type Value Limit % User quota STORAGE 469 102400 0 User quota MESSAGE 6 - 0 That's ok, but i want to return quota from quotaBytes userdb parameter But if I use "default_fields = quota_rule=*:bytes=%$" in userdb, Output of "doveadm -D quota get -u afasystems" is: Debug: Loading modules from directory: /usr/lib/dovecot Debug: Module loaded: /usr/lib/dovecot/lib01_acl_plugin.so Debug: Module loaded: /usr/lib/dovecot/lib10_quota_plugin.so Debug: Loading modules from directory: /usr/lib/dovecot/doveadm Debug: Module loaded: /usr/lib/dovecot/doveadm/lib10_doveadm_acl_plugin.so Debug: Skipping module doveadm_expire_plugin, because dlopen() failed: /usr/lib/dovecot/doveadm/lib10_doveadm_expire_plugin.so: undefined symbol: expire_set_deinit (this is usually intentional, so just ignore this message) Debug: Module loaded: /usr/lib/dovecot/doveadm/lib10_doveadm_quota_plugin.so Debug: Module loaded: /usr/lib/dovecot/doveadm/lib10_doveadm_sieve_plugin.so Debug: Skipping module doveadm_fts_lucene_plugin, because dlopen() failed: /usr/lib/dovecot/doveadm/lib20_doveadm_fts_lucene_plugin.so: undefined symbol: lucene_index_iter_deinit (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_fts_plugin, because dlopen() failed: /usr/lib/dovecot/doveadm/lib20_doveadm_fts_plugin.so: undefined symbol: fts_user_get_language_list (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_mail_crypt_plugin, because dlopen() failed: /usr/lib/dovecot/doveadm/libdoveadm_mail_crypt_plugin.so: undefined symbol: mail_crypt_box_get_pvt_digests (this is usually intentional, so just ignore this message) doveadm(afasystems): Debug: auth USER input: afasystems quota_rule=*:bytes= system_groups_user=afasystems uid=1002 gid=100 home=/data/home/afasystems doveadm(afasystems): Debug: Added userdb setting: plugin/quota_rule=*:bytes= doveadm(afasystems): Debug: Effective uid=1002, gid=100, home=/data/home/afasystems doveadm(afasystems): Debug: Quota root: name=User quota backend=maildir args= doveadm(afasystems): Debug: Quota rule: root=User quota mailbox=* bytes=0 messages=0 doveadm(afasystems): Error: User initialization failed: Failed to initialize quota: Invalid quota root quota: Invalid rule *:bytes=: Invalid bytes limit: doveadm(afasystems): Error: User init failed Quota name Type Value Limit if I use "default_fields = quota_rule=*:bytes=%{userdb:quotabytes}" in userdb, Output of "doveadm -D quota get -u afasystems" is: Debug: Loading modules from directory: /usr/lib/dovecot Debug: Module loaded: /usr/lib/dovecot/lib01_acl_plugin.so Debug: Module loaded: /usr/lib/dovecot/lib10_quota_plugin.so Debug: Loading modules from directory: /usr/lib/dovecot/doveadm Debug: Module loaded: /usr/lib/dovecot/doveadm/lib10_doveadm_acl_plugin.so Debug: Skipping module doveadm_expire_plugin, because dlopen() failed: /usr/lib/dovecot/doveadm/lib10_doveadm_expire_plugin.so: undefined symbol: expire_set_deinit (this is usually intentional, so just ignore this message) Debug: Module loaded: /usr/lib/dovecot/doveadm/lib10_doveadm_quota_plugin.so Debug: Module loaded: /usr/lib/dovecot/doveadm/lib10_doveadm_sieve_plugin.so Debug: Skipping module doveadm_fts_lucene_plugin, because dlopen() failed: /usr/lib/dovecot/doveadm/lib20_doveadm_fts_lucene_plugin.so: undefined symbol: lucene_index_iter_deinit (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_fts_plugin, because dlopen() failed: /usr/lib/dovecot/doveadm/lib20_doveadm_fts_plugin.so: undefined symbol: fts_user_get_language_list (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_mail_crypt_plugin, because dlopen() failed: /usr/lib/dovecot/doveadm/libdoveadm_mail_crypt_plugin.so: undefined symbol: mail_crypt_box_get_pvt_digests (this is usually intentional, so just ignore this message) doveadm(afasystems): Debug: auth USER input: afasystems quota_rule=*:bytes= system_groups_user=afasystems uid=1002 gid=100 home=/data/home/afasystems doveadm(afasystems): Debug: Added userdb setting: plugin/quota_rule=*:bytes= doveadm(afasystems): Debug: Effective uid=1002, gid=100, home=/data/home/afasystems doveadm(afasystems): Debug: Quota root: name=User quota backend=maildir args= doveadm(afasystems): Debug: Quota rule: root=User quota mailbox=* bytes=0 messages=0 doveadm(afasystems): Error: User initialization failed: Failed to initialize quota: Invalid quota root quota: Invalid rule *:bytes=: Invalid bytes limit: doveadm(afasystems): Error: User init failed Quota name Type Value Limit if I use "default_fields = quota_rule=*:bytes=%{ldap:quotabytes}" in userdb, Output of "doveadm -D quota get -u afasystems" is: Debug: Loading modules from directory: /usr/lib/dovecot Debug: Module loaded: /usr/lib/dovecot/lib01_acl_plugin.so Debug: Module loaded: /usr/lib/dovecot/lib10_quota_plugin.so Debug: Loading modules from directory: /usr/lib/dovecot/doveadm Debug: Module loaded: /usr/lib/dovecot/doveadm/lib10_doveadm_acl_plugin.so Debug: Skipping module doveadm_expire_plugin, because dlopen() failed: /usr/lib/dovecot/doveadm/lib10_doveadm_expire_plugin.so: undefined symbol: expire_set_deinit (this is usually intentional, so just ignore this message) Debug: Module loaded: /usr/lib/dovecot/doveadm/lib10_doveadm_quota_plugin.so Debug: Module loaded: /usr/lib/dovecot/doveadm/lib10_doveadm_sieve_plugin.so Debug: Skipping module doveadm_fts_lucene_plugin, because dlopen() failed: /usr/lib/dovecot/doveadm/lib20_doveadm_fts_lucene_plugin.so: undefined symbol: lucene_index_iter_deinit (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_fts_plugin, because dlopen() failed: /usr/lib/dovecot/doveadm/lib20_doveadm_fts_plugin.so: undefined symbol: fts_user_get_language_list (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_mail_crypt_plugin, because dlopen() failed: /usr/lib/dovecot/doveadm/libdoveadm_mail_crypt_plugin.so: undefined symbol: mail_crypt_box_get_pvt_digests (this is usually intentional, so just ignore this message) doveadm(afasystems): Debug: auth USER input: afasystems quota_rule=*:bytes=UNSUPPORTED_VARIABLE_ldap system_groups_user=afasystems uid=1002 gid=100 home=/data/home/afasystems doveadm(afasystems): Debug: Added userdb setting: plugin/quota_rule=*:bytes=UNSUPPORTED_VARIABLE_ldap doveadm(afasystems): Debug: Effective uid=1002, gid=100, home=/data/home/afasystems doveadm(afasystems): Debug: Quota root: name=User quota backend=maildir args= doveadm(afasystems): Debug: Quota rule: root=User quota mailbox=* bytes=0 messages=0 doveadm(afasystems): Error: User initialization failed: Failed to initialize quota: Invalid quota root quota: Invalid rule *:bytes=UNSUPPORTED_VARIABLE_ldap: Invalid bytes limit: UNSUPPORTED_VARIABLE_ldap doveadm(afasystems): Error: User init failed Quota name Type Value Limit Where I am wrong? What is the correct configuration? Thanks in advance -- AFA Systems Srl Via G.Pastore Zona Industriale B 86039 Termoli (CB) - Italia tel.: +39 0875 724104 fax.: +39 0875 726084 www.afasystems.it

5 7

Re: failed to store into mailbox 'INBOX/Junk': Permission denied
by Davide Marchi 26 Jul '17

26 Jul '17

Steffen Kaiser ha scritto: > Does INBOX/Junk already exists? Yes, (but empty): find /var/vmail/hotelsangiorgioriccione.com/info/ |grep INBOX /var/vmail/hotelsangiorgioriccione.com/info/Maildir/.INBOX /var/vmail/hotelsangiorgioriccione.com/info/Maildir/.INBOX/Trash /var/vmail/hotelsangiorgioriccione.com/info/Maildir/.INBOX/Trash/new /var/vmail/hotelsangiorgioriccione.com/info/Maildir/.INBOX/Trash/tmp /var/vmail/hotelsangiorgioriccione.com/info/Maildir/.INBOX/Trash/cur /var/vmail/hotelsangiorgioriccione.com/info/Maildir/.INBOX/Trash/maildirfolder /var/vmail/hotelsangiorgioriccione.com/info/Maildir/.INBOX/Trash/dovecot.index.log /var/vmail/hotelsangiorgioriccione.com/info/Maildir/.INBOX/Junk /var/vmail/hotelsangiorgioriccione.com/info/Maildir/.INBOX/Junk/new /var/vmail/hotelsangiorgioriccione.com/info/Maildir/.INBOX/Junk/tmp /var/vmail/hotelsangiorgioriccione.com/info/Maildir/.INBOX/Junk/cur /var/vmail/hotelsangiorgioriccione.com/info/Maildir/.INBOX/Junk/maildirfolder /var/vmail/hotelsangiorgioriccione.com/info/Maildir/.INBOX/Junk/dovecot.index.log and same for other v-user "booking" > What's in your ACL file? cat /etc/dovecot/dovecot-acl * user=booking(a)hotelsangiorgioriccione.com lrwsi * user=info(a)hotelsangiorgioriccione.com lrwsi > What does these commands return? > doveadm acl debug -u info(a)hotelsangiorgioriccione.com INBOX > doveadm acl debug -u info(a)hotelsangiorgioriccione.com INBOX/Junk doveadm acl debug -u info(a)hotelsangiorgioriccione.com INBOX doveadm(info(a)hotelsangiorgioriccione.com): Info: Mailbox 'INBOX' is in namespace '' doveadm(info(a)hotelsangiorgioriccione.com): Info: Mailbox path: /var/vmail/hotelsangiorgioriccione.com/info/Maildir doveadm(info(a)hotelsangiorgioriccione.com): Info: All message flags are shared across users in mailbox doveadm(info(a)hotelsangiorgioriccione.com): Info: User info(a)hotelsangiorgioriccione.com has rights: lookup read write write-seen insert doveadm(info(a)hotelsangiorgioriccione.com): Info: Mailbox in user's private namespace doveadm(info(a)hotelsangiorgioriccione.com): Info: Mailbox INBOX is visible in LIST doveadm acl debug -u info(a)hotelsangiorgioriccione.com INBOX/Junk doveadm(info(a)hotelsangiorgioriccione.com): Info: Mailbox 'INBOX/Junk' is in namespace '' doveadm(info(a)hotelsangiorgioriccione.com): Info: Mailbox path: /var/vmail/hotelsangiorgioriccione.com/info/Maildir/.INBOX/Junk doveadm(info(a)hotelsangiorgioriccione.com): Info: All message flags are shared across users in mailbox doveadm(info(a)hotelsangiorgioriccione.com): Info: User info(a)hotelsangiorgioriccione.com has rights: lookup read write write-seen insert doveadm(info(a)hotelsangiorgioriccione.com): Info: Mailbox in user's private namespace doveadm(info(a)hotelsangiorgioriccione.com): Info: Mailbox INBOX/Junk is visible in LIST Many thanks Steffen!

2 1

Re: failed to store into mailbox 'INBOX/Junk': Permission denied
by Davide Marchi 26 Jul '17

26 Jul '17

I add a clarification: Now that I've commented out sieve Junk/Trash on "/etc/dovecot/conf.d/15-mailboxes.conf" > mailbox Junk > { special_use = \Junk > } > mailbox Trash > { special_use = \Trash > } remains a single account with permission issues, only one with write permissions controlled by the ACL plugin: > plugin { > acl = vfile:/etc/dovecot/dovecot-acl > sieve = ~/.dovecot.sieve > sieve_after = /etc/dovecot/sieve-after > sieve_dir = ~/sieve > } Many thanks again!

2 1