- dovecot - dovecot.org

Post-Auth external check?
by Stephan von Krawczynski 28 Mar '24

28 Mar '24

Hello all, is it possible to include some post-auth check in the password authentication? So after dovecot has found a user allowed to login to execute some external script for checking additional conditions which gives back simple true or false wether the login should be allowed? -- Regards, Stephan

3 2

Re: [Dovecot] Re: Using mbox INBOX with Maildirs?
by Will 26 Mar '24

26 Mar '24

Hi, This is my first time using this group and I have the same question as the subject. I can't seem to get dovecot to read a mbox inbox that is in /var/mail/%u with /home/%u/Maildir as maildir. This just worked on my old server that I am now upgrading to AlmaLinux release 9.3 with dovecot version 2.3.16 (7e2e900c1a). Please help, this upgrade is very painful. Guess I shouldn't have waited 20 years...

3 3

How can I override settings in a dovecot protocol section?
by Christian Rößner 25 Mar '24

25 Mar '24

Hi, I have defined a service and a protocol that shall honor quota, but in an non-enforcing mode (required). Therefr I have done this on a test-server: ``` protocols = lmtp lmtp_noenforcing imap pop3 service lmtp_noenforcing { executable = lmtp inet_listener lmtp_noenforcing { port = 24000 } protocol = lmtp_noenforcing } protocol lmtp_noenforcing { postmaster_address = postmaster@**** mail_plugins = quota sieve fts fts_solr # Just for testing, if this works. userdb { driver = ldap args = /etc/dovecot/dovecot-ldap.conf.ext override_fields = quota=count:User quota:noenforcing skip = never result_success = continue result_failure = return-fail } # Just for testing, if this works. userdb { driver = lua args = file=/etc/dovecot/userdb.lua blocking=yes override_fields = quota=count:User quota:noenforcing result_success = return-ok result_failure = continue result_internalfail = continue } # Preferred plugin { quota = count:User quota:noenforcing } } ``` I tried with and without userdbs. With and without plugin{}. It seems that this whole section is never used. I removed "quota" from the mail_plugins parameter, but that seems to show me that the section is not used, because it always fails in a local swaks-test. The test shows that quota is exceeded. I would expect that the quota is ignored. One or the other hand. So why is the protocol not used for this service? We currently use Dovecot 2.3.20 from your repos. Kind regards and thanks in advance Christian Rößner -- Rößner-Network-Solutions Zertifizierter ITSiBe / CISO Karl-Bröger-Str. 10, 36304 Alsfeld Fax: +49 6631 78823409, Mobil: +49 171 9905345 USt-IdNr.: DE225643613, https://roessner.website PGP fingerprint: 658D 1342 B762 F484 2DDF 1E88 38A5 4346 D727 94E5

1 1

virtual user list in a passwd file (without linux user)
by paul＠virtuadv.com 23 Mar '24

23 Mar '24

Hi, I am trying to have a virtual user list in a passwd file (without linux user) but it does not seem to work. I have been trying to make this work for days reading the dovecot documentation and whatever I could find online... Note that I did not enable imap since I only use pop3s to retrieve my emails. I also tried to follow this guide: https://doc.dovecot.org/configuration_manual/howto/simple_virtual_install/ Note that once this works for dovecot, I plan to have postfix use the dovecot auth service to authenticate the virtual users and validate mail boxes. # cat /proc/version Linux version 6.1.0-17-cloud-amd64 (debian-kernel(a)lists.debian.org) (gcc-12 (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40) #1 SMP PREEMPT_DYNAMIC Debian 6.1.69-1 (2023-12-30) # dovecot version Feb 15 15:57:26 master: Info: Dovecot v2.3.19.1 (9b53102964) starting up for pop3, submission, lmtp # doveconf -n # 2.3.19.1 (9b53102964): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.19 (4eae2f79) # OS: Linux 6.1.0-17-cloud-amd64 x86_64 Debian 12.5 # Hostname: 85e10e78339f auth_verbose = yes debug_log_path = /dev/stdout first_valid_uid = 1000 info_log_path = /dev/stdout last_valid_uid = 1000 listen = * log_path = /dev/stdout login_greeting = greeting. mail_debug = yes mail_gid = 1000 mail_home = /srv/vmail/%d/%n mail_location = maildir:~/mail mail_uid = 1000 namespace { inbox = yes location = prefix = separator = / } passdb { args = username_format=%u /path/to/passwd driver = passwd-file } pop3_uidl_format = %g protocols = pop3 submission lmtp service auth { inet_listener { address = <ip> port = 12345 } user = vmail } service lmtp { inet_listener lmtp { address = <ip> port = 12344 } user = vmail } service pop3-login { client_limit = 1000 process_min_avail = 1 service_count = 0 } service submission-login { client_limit = 1000 process_min_avail = 1 service_count = 0 } ssl_cert = <cert.pem ssl_key = # hidden, use -P to show it userdb { args = username_format=%u /path/to/passwd default_fields = uid=vmail gid=vmail home=/srv/vmail/%d/%n driver = passwd-file } verbose_proctitle = yes local_name site1.com { ssl_cert = </etc/apache2/md-ssl/domains/site1.com/pubcert.pem ssl_key = # hidden, use -P to show it } local_name www.site1.com { ssl_cert = </etc/apache2/md-ssl/domains/site1.com/pubcert.pem ssl_key = # hidden, use -P to show it } The passwd file: # user:password:uid:gid:(gecos):home:(shell):extra_fields user1(a)site1.com{PLAIN}password1:::::: user2(a)site2.com{PLAIN}password2:::::: This is the log I am getting when trying to create an account with Thunderbird: Feb 15 15:57:26 master: Info: Dovecot v2.3.19.1 (9b53102964) starting up for pop3, submission, lmtp Feb 15 17:34:45 pop3-login: Info: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=<ip>, lip=<ip>, TLS, session=<cMIeC28RVOImVwz3> Feb 15 17:35:02 auth: Info: passwd-file(user1(a)site1.com,<ip>,<AIAjDG8RVuImVwz3>): unknown user Feb 15 17:35:08 auth: Info: passwd-file(user1(a)site1.com,<ip>,<AIAjDG8RVuImVwz3>): unknown user Feb 15 17:35:10 pop3-login: Info: Disconnected: Aborted login by logging out (auth failed, 2 attempts in 8 secs): user=<user1(a)site1.com>, method=PLAIN, rip=<ip>, lip=<ip>, TLS, session=<AIAjDG8RVuImVwz3> I tried using doveadm: # doveadm user user1 userdb lookup: user user1 doesn't exist field value # doveadm user user1(a)site1.com userdb lookup: user user1(a)site1.com doesn't exist field value I also tried with the verbose on (removed all the 'usually intentional'): # doveadm -Dv user user1(a)site1.com Feb 15 17:38:17 doveadm(user1(a)site1.com)<137><>: Debug: auth-master: userdb lookup(user1(a)site1.com): Started userdb lookup Feb 15 17:38:17 doveadm(user1(a)site1.com)<137><>: Debug: auth-master: conn unix:/run/dovecot/auth-userdb: Connecting Feb 15 17:38:17 doveadm(user1(a)site1.com)<137><>: Debug: auth-master: conn unix:/run/dovecot/auth-userdb (pid=7,uid=0): Client connected (fd=9) Feb 15 17:38:17 doveadm(user1(a)site1.com)<137><>: Debug: auth-master: userdb lookup(user1(a)site1.com): auth USER input: Feb 15 17:38:17 doveadm(user1(a)site1.com)<137><>: Debug: auth-master: userdb lookup(user1(a)site1.com): Userdb lookup failed userdb lookup: user user1(a)site1.com doesn't exist Feb 15 17:38:17 Debug: auth-master: conn unix:/run/dovecot/auth-userdb (pid=7,uid=0): Disconnected: Connection closed (fd=9) field value I could not find a way to list either the mailboxes or virtual user list that dovecot is using/serving.

4 17

Debug on FreeBSD: tries to open linux style /proc
by Larry Rosenman 23 Mar '24

23 Mar '24

Aki, Can you comment on this FreeBSD bug I got? https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=274540 Either here on in the bugzilla bug. Thanks! -- Larry Rosenman http://www.lerctr.org/~ler Phone: +1 214-642-9640 (c) E-Mail: larryrtx(a)gmail.com US Mail: 5708 Sabbia Dr, Round Rock, TX 78665-2106 Aki, Can you comment on this FreeBSD bug I got? https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=274540 Either here on in the bugzilla bug. Thanks! -- Larry Rosenman http://www.lerctr.org/~ler Phone: +1 214-642-9640 (c) E-Mail: larryrtx(a)gmail.com US Mail: 5708 Sabbia Dr, Round Rock, TX 78665-2106

1 0

Thousands of dovecot/dict processes
by Alex 22 Mar '24

22 Mar '24

Hi, I have a fedora38 system with dovecot-2.3.21 for a few hundred users and just noticed there are 4000 dovecot/dict processes running: 2203938 ? S 0:15 dovecot/dict or sleeping, as the case may be. Some time ago I installed the last_login_dict plugin to record login details per user. Here is my config: plugin { last_login_dict = proxy::sql last_login_key = last-login/%{service}/%{user}/%{remote_ip} last_login_precision = ms } dict { sql = mysql:/etc/dovecot/dovecot-dict-sql.conf.ext } There are about 1100 total entries in the last_login table, most of which are localhost for webmail. Is this all to be expected? I don't know how much in terms of resources these 4000 processes are utilizing, and although the system is virtually idle, it does appear to be going into swap. # free -h total used free shared buff/cache available Mem: 62Gi 9.3Gi 2.5Gi 13Mi 51Gi 52Gi Swap: 15Gi 4.4Gi 11Gi Any ideas greatly appreciated. Thanks, Alex Hi, I have a fedora38 system with dovecot-2.3.21 for a few hundred users and just noticed there are 4000 dovecot/dict processes running: 2203938 ? S 0:15 dovecot/dict or sleeping, as the case may be. Some time ago I installed the last_login_dict plugin to record login details per user. Here is my config: plugin { last_login_dict = proxy::sql last_login_key = last-login/%{service}/%{user}/%{remote_ip} last_login_precision = ms } dict { sql = mysql:/etc/dovecot/dovecot-dict-sql.conf.ext } There are about 1100 total entries in the last_login table, most of which are localhost for webmail. Is this all to be expected? I don't know how much in terms of resources these 4000 processes are utilizing, and although the system is virtually idle, it does appear to be going into swap. # free -h total used free shared buff/cache available Mem: 62Gi 9.3Gi 2.5Gi 13Mi 51Gi 52Gi Swap: 15Gi 4.4Gi 11Gi Any ideas greatly appreciated. Thanks, Alex

1 0

Disable sieve redirect filters?
by jarland＠mxroute.com 21 Mar '24

21 Mar '24

Right now we're using Dovecot for sieve filters. Good old fairly standard config: https://mxbin.io/N6hDUi I'm hoping someone has an idea, but I think I'm probably on my own here. The problem is that this is the best solution to preventing people from spoofing external senders when creating redirects to external recipients: sieve_redirect_envelope_from = recipient But also, as great as this is, it kind of sucks because users continually insist on receiving spam and phishing emails. When a user sends a phishing email, I step in to make sure our network isn't being abused. That's how we do what we do for high quality inbox delivery, we police the hell out of our network. So my problem is I end up with all of these users that I need to review every day, only to find out they just created a redirect filter and "redirected" a phishing email. So my long winded question is, how can I disable redirect filters? I don't want users to be able to create them. But I want them to have access to the rest of the functions of the sieve filtering. Is this possible, or would this need to be an entirely new function contributed to the project's code?

2 1

Crash in dovecot snippet when using imapc
by John van der Kamp 20 Mar '24

20 Mar '24

Hello, I've found a crash in a very specific setup. A dovecot server with imapc connection needs to receive an email with no body contents for the intent of generating a preview/snippet. It crashes somewhere deep in the jungle of istream and snapshots. I've included a script which sets up the systems to reproduce the crash. I've tested this with several versions. 2.3.16 doesn't seem to be affected, but 2.3.20 and 2.3.21 are affect. For me it produces a traceback like this, using the ubuntu version from here: https://packages.ubuntu.com/noble/dovecot-core (gdb) bt #0 __pthread_kill_implementation (no_tid=0, signo=6, threadid=140530132887360) at ./nptl/pthread_kill.c:44 #1 __pthread_kill_internal (signo=6, threadid=140530132887360) at ./nptl/pthread_kill.c:78 #2 __GI___pthread_kill (threadid=140530132887360, signo=signo@entry=6) at ./nptl/pthread_kill.c:89 #3 0x00007fcfb8842476 in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26 #4 0x00007fcfb88287f3 in __GI_abort () at ./stdlib/abort.c:79 #5 0x00007fcfb8b37fe5 in default_fatal_finish (status=0, type=LOG_TYPE_PANIC) at ../lib/failures.c:465 #6 fatal_handler_real (ctx=<optimized out>, format=<optimized out>, args=<optimized out>) at ../lib/failures.c:477 #7 0x00007fcfb8be50d7 in i_internal_fatal_handler (ctx=<optimized out>, format=<optimized out>, args=<optimized out>) at ../lib/failures.c:879 #8 0x00007fcfb8b37eea in i_panic (format=0x7fcfb8c29020 "file %s: line %d (%s): assertion failed: (%s)") at ../lib/failures.c:530 #9 0x00007fcfb8b3387b in i_stream_header_filter_snapshot_free (_snapshot=<optimized out>) at ../lib-mail/istream-header-filter.c:663 #10 i_stream_header_filter_snapshot_free (_snapshot=0x55dabe297a60) at ../lib-mail/istream-header-filter.c:655 #11 0x00007fcfb8bf25ac in i_stream_snapshot_free (_snapshot=_snapshot@entry=0x55dabe29b0d0) at ../lib/istream.c:253 #12 0x00007fcfb8bf2654 in i_stream_unref (stream=0x7ffc16cc7fa0) at ../lib/istream.c:66 #13 0x00007fcfb8d96baa in index_mail_write_body_snippet (mail=0x55dabe292058) at index/index-mail.c:1151 #14 0x00007fcfb8d97e48 in index_mail_parse_bodystructure (mail=0x55dabe292058, field=MAIL_CACHE_BODY_SNIPPET) at index/index-mail.c:1551 #15 0x00007fcfb8d97fe2 in index_mail_fetch_body_snippet (value_r=0x7ffc16cc8050, mail=0x55dabe292058) at index/index-mail.c:1602 #16 index_mail_get_special (_mail=0x55dabe292058, field=<optimized out>, value_r=0x7ffc16cc8050) at index/index-mail.c:1730 #17 0x00007fcfb8d16ffe in mail_get_special (mail=mail@entry=0x55dabe292058, field=field@entry=MAIL_FETCH_BODY_SNIPPET, value_r=value_r@entry=0x7ffc16cc8050) at /home/ubuntu/dovecot/new/dovecot-2.3.21+dfsg1/src/lib-storage/mail.c:418 #18 0x000055dabc52645c in fetch_snippet (ctx=0x55dabe26e050, mail=0x55dabe292058, preview=0x55dabe28f1f8) at ./src/imap/imap-fetch-body.c:615 #19 0x000055dabc52b5cc in imap_fetch_more_int (ctx=0x55dabe26e050, cancel=false) at ./src/imap/imap-fetch.c:562 #20 0x000055dabc52b8ad in imap_fetch_more (ctx=0x55dabe26e050, cmd=0x55dabe26de98) at ./src/imap/imap-fetch.c:617 #21 0x000055dabc51fd07 in cmd_fetch (cmd=0x55dabe26de98) at ./src/imap/cmd-fetch.c:382 #22 0x000055dabc528af4 in command_exec (cmd=0x55dabe26de98) at ./src/imap/imap-commands.c:201 #23 0x000055dabc52e9e2 in client_command_input (cmd=<optimized out>) at ./src/imap/imap-client.c:1237 #24 0x000055dabc52ea96 in client_command_input (cmd=<optimized out>) at ./src/imap/imap-client.c:1307 #25 0x000055dabc52eeed in client_handle_next_command (remove_io_r=<synthetic pointer>, client=0x55dabe26d2c8) at ./src/imap/imap-client.c:1349 #26 client_handle_input (client=0x55dabe26d2c8) at ./src/imap/imap-client.c:1363 #27 0x000055dabc52f2c4 in client_input (client=0x55dabe26d2c8) at ./src/imap/imap-client.c:1407 #28 0x00007fcfb8bfe27d in io_loop_call_io (io=0x55dabe26e660) at ../lib/ioloop.c:737 #29 0x00007fcfb8bff81a in io_loop_handler_run_internal (ioloop=0x55dabe243fd0) at ../lib/ioloop-epoll.c:222 #30 0x00007fcfb8bff8d4 in io_loop_handler_run (ioloop=0x55dabe243fd0) at ../lib/ioloop.c:789 #31 0x00007fcfb8bffa90 in io_loop_run (ioloop=0x55dabe243fd0) at ../lib/ioloop.c:762 #32 0x00007fcfb8b6ce57 in master_service_run (service=0x55dabe243e20, callback=callback@entry=0x55dabc533210 <client_connected>) at ../lib-master/master-service.c:878 #33 0x000055dabc51ad37 in main (argc=<optimized out>, argv=<optimized out>) at ./src/imap/main.c:575 John Hello, I've found a crash in a very specific setup. A dovecot server with imapc connection needs to receive an email with no body contents for the intent of generating a preview/snippet. It crashes somewhere deep in the jungle of istream and snapshots. I've included a script which sets up the systems to reproduce the crash. I've tested this with several versions. 2.3.16 doesn't seem to be affected, but 2.3.20 and 2.3.21 are affect. For me it produces a traceback like this, using the ubuntu version from here: https://packages.ubuntu.com/noble/dovecot-core (gdb) bt #0 __pthread_kill_implementation (no_tid=0, signo=6, threadid=140530132887360) at ./nptl/pthread_kill.c:44 #1 __pthread_kill_internal (signo=6, threadid=140530132887360) at ./nptl/ pthread_kill.c:78 #2 __GI___pthread_kill (threadid=140530132887360, signo=signo@entry=6) at ./ nptl/pthread_kill.c:89 #3 0x00007fcfb8842476 in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/ raise.c:26 #4 0x00007fcfb88287f3 in __GI_abort () at ./stdlib/abort.c:79 #5 0x00007fcfb8b37fe5 in default_fatal_finish (status=0, type=LOG_TYPE_PANIC) at ../lib/failures.c:465 #6 fatal_handler_real (ctx=<optimized out>, format=<optimized out>, args=<optimized out>) at ../lib/failures.c:477 #7 0x00007fcfb8be50d7 in i_internal_fatal_handler (ctx=<optimized out>, format=<optimized out>, args=<optimized out>) at ../lib/failures.c:879 #8 0x00007fcfb8b37eea in i_panic (format=0x7fcfb8c29020 "file %s: line %d (%s): assertion failed: (%s)") at ../lib/failures.c:530 #9 0x00007fcfb8b3387b in i_stream_header_filter_snapshot_free (_snapshot=<optimized out>) at ../lib-mail/istream-header-filter.c:663 #10 i_stream_header_filter_snapshot_free (_snapshot=0x55dabe297a60) at ../lib- mail/istream-header-filter.c:655 #11 0x00007fcfb8bf25ac in i_stream_snapshot_free (_snapshot=_snapshot@entry=0x55dabe29b0d0) at ../lib/istream.c:253 #12 0x00007fcfb8bf2654 in i_stream_unref (stream=0x7ffc16cc7fa0) at ../lib/ istream.c:66 #13 0x00007fcfb8d96baa in index_mail_write_body_snippet (mail=0x55dabe292058) at index/index-mail.c:1151 #14 0x00007fcfb8d97e48 in index_mail_parse_bodystructure (mail=0x55dabe292058, field=MAIL_CACHE_BODY_SNIPPET) at index/index-mail.c:1551 #15 0x00007fcfb8d97fe2 in index_mail_fetch_body_snippet (value_r=0x7ffc16cc8050, mail=0x55dabe292058) at index/index-mail.c:1602 #16 index_mail_get_special (_mail=0x55dabe292058, field=<optimized out>, value_r=0x7ffc16cc8050) at index/index-mail.c:1730 #17 0x00007fcfb8d16ffe in mail_get_special (mail=mail@entry=0x55dabe292058, field=field@entry=MAIL_FETCH_BODY_SNIPPET, value_r=value_r@entry=0x7ffc16cc8050) at /home/ubuntu/dovecot/new/dovecot-2.3.21+dfsg1/src/lib-storage/mail.c:418 #18 0x000055dabc52645c in fetch_snippet (ctx=0x55dabe26e050, mail=0x55dabe292058, preview=0x55dabe28f1f8) at ./src/imap/imap-fetch-body.c: 615 #19 0x000055dabc52b5cc in imap_fetch_more_int (ctx=0x55dabe26e050, cancel=false) at ./src/imap/imap-fetch.c:562 #20 0x000055dabc52b8ad in imap_fetch_more (ctx=0x55dabe26e050, cmd=0x55dabe26de98) at ./src/imap/imap-fetch.c:617 #21 0x000055dabc51fd07 in cmd_fetch (cmd=0x55dabe26de98) at ./src/imap/cmd- fetch.c:382 #22 0x000055dabc528af4 in command_exec (cmd=0x55dabe26de98) at ./src/imap/imap- commands.c:201 #23 0x000055dabc52e9e2 in client_command_input (cmd=<optimized out>) at ./src/ imap/imap-client.c:1237 #24 0x000055dabc52ea96 in client_command_input (cmd=<optimized out>) at ./src/ imap/imap-client.c:1307 #25 0x000055dabc52eeed in client_handle_next_command (remove_io_r=<synthetic pointer>, client=0x55dabe26d2c8) at ./src/imap/imap-client.c:1349 #26 client_handle_input (client=0x55dabe26d2c8) at ./src/imap/imap-client.c: 1363 #27 0x000055dabc52f2c4 in client_input (client=0x55dabe26d2c8) at ./src/imap/ imap-client.c:1407 #28 0x00007fcfb8bfe27d in io_loop_call_io (io=0x55dabe26e660) at ../lib/ ioloop.c:737 #29 0x00007fcfb8bff81a in io_loop_handler_run_internal (ioloop=0x55dabe243fd0) at ../lib/ioloop-epoll.c:222 #30 0x00007fcfb8bff8d4 in io_loop_handler_run (ioloop=0x55dabe243fd0) at ../ lib/ioloop.c:789 #31 0x00007fcfb8bffa90 in io_loop_run (ioloop=0x55dabe243fd0) at ../lib/ ioloop.c:762 #32 0x00007fcfb8b6ce57 in master_service_run (service=0x55dabe243e20, callback=callback@entry=0x55dabc533210 <client_connected>) at ../lib-master/ master-service.c:878 #33 0x000055dabc51ad37 in main (argc=<optimized out>, argv=<optimized out>) at ./src/imap/main.c:575 John

2 6

Notifications to over-quota accounts
by N V 15 Mar '24

15 Mar '24

Hello! I'm trying to allow a system email address to send notifications to over-quota accounts. Is there a way to do it? Thanks in advance! Hello! I'm trying to allow a system email address to send notifications to over-quota accounts. Is there a way to do it? Thanks in advance!

3 2

Question about sieve language
by Lev Serebryakov 15 Mar '24

15 Mar '24

Hello! I need to match all messages sent from some specific domain and all its sub-domains. I can achieve this with: if address :match :domain "From" [ "domain.com", "*.domain.com" ] { ... } But it looks ugly, especially if repeated for 5-6 domains. Is here way better? `:match ["*domain.com"]` will match "notdomain.com" and `:is [ "domain.com" ] doesn't match sub-domains. I understand, that it is (slightly?) off-topic, but I can not find any sieve-specific resources (all google find ins questions about PronotMail and FastMail filters, and these questions are very basic). Thank you. -- // Black Lion AKA Lev Serebryakov

3 4

antispoofing with dovecot submission
by Adrian M 15 Mar '24

15 Mar '24

Hi, it is possible to do antispoofing, like reject_authenticated_sender_login_mismatch from postfix ? Hi, it is possible to do antispoofing, like reject_authenticated_sender_login_mismatch from postfix ?

4 3

How to get a memory pointer in the core process
by Joan Moreau 15 Mar '24

15 Mar '24

Hi Is it possible, from a plugin perspective, to create and recover a pointer in the core process (i.e. memory not lost between 2 calls to the plugin, even after the "deinit" of the plugin" ) ? Thanks Hi Is it possible, from a plugin perspective, to create and recover a pointer in the core process (i.e. memory not lost between 2 calls to the plugin, even after the "deinit" of the plugin" ) ? Thanks

4 11

dovecot panic
by Michael Grant 15 Mar '24

15 Mar '24

I'm running dovecot 2.3.19.1 on debian stable. I just started seeing a slew of these in my log: Mar 14 10:02:38 strange.networkguild.org dovecot[865654]: imap(mgrant)<1939553><DcMIWJ8T6s7ZIx04>: Panic: file istream-header-filter.c: line 663 (i_stream_header_filter_snapshot_free): assertion failed: (snapshot->mstream->snapshot_pending) Mar 14 10:02:38 strange.networkguild.org dovecot[865654]: imap(mgrant)<1939553><DcMIWJ8T6s7ZIx04>: Error: Raw backtrace: #0 test_subprocess_fork[0x7f1a33d7ca20] -> #1 backtrace_append[0x7f1a33d7cc90] -> #2 backtrace_get[0x7f1a33d7ce20] -> #3 execvp_const[0x7f1a33d89f90] -> #4 i_syslog_fatal_handler[0x7f1a33d8a900] -> #5 i_panic[0x7f1a33ce00a4] -> #6 fs_wrapper_unlock[0x7f1a33cdb71d] -> #7 i_stream_snapshot_free[0x7f1a33d96110] -> #8 i_stream_unref[0x7f1a33d96180] -> #9 index_mail_get_virtual_size[0x7f1a33f2d190] -> #10 index_mail_save_finish[0x7f1a33f2d470] -> #11 index_mail_get_special[0x7f1a33f2d690] -> #12 mail_get_special[0x7f1a33eaf950] -> #13 cmd_select[0x560714f983e0] -> #14 imap_fetch_begin[0x560714f9d170] -> #15 imap_fetch_more[0x560714f9d550] -> #16 cmd_fetch[0x560714f91c00] -> #17 command_exec[0x560714f9a880] -> #18 cmd_x_cancel[0x560714fa0510] -> #19 cmd_x_cancel[0x560714fa0510] -> #20 cmd_x_cancel[0x560714fa0510] -> #21 client_handle_input[0x560714fa0880] -> #22 client_input[0x560714fa0d80] -> #23 io_loop_call_io[0x7f1a33da1c70] -> #24 io_loop_handler_run_internal[0x7f1a33da3970] -> #25 io_loop_handler_run[0x7f1a33da3b00] -> #26 io_loop_run[0x7f1a33da3cd0] -> #27 master_service_run[0x7f1a33d14180] -> #28 main[0x560714f8ca00] -> #29 __libc_init_first[0x7f1a33ac51d0] -> #30 __libc_start_main[0x7f1a33ac5280] -> #31 _start[0x560714f8d000] I realize this is a slightly old version of dovecot but this is what's in debian's stable package repository. I see 2.3.21+dfsg1-2 in testing and 2.3.21+dfsg1-3 in unstable. I really try to avoid installing this on production. I didn't recently change anything in my configs on the server. I did start recently using 'eM Client' on Windows a couple days ago, could that have caused this? Mail seems to continue to come in to my imap clients, but these errors in the log are worrying! Michael Grant I'm running dovecot 2.3.19.1 on debian stable. I just started seeing a slew of these in my log: Mar 14 10:02:38 strange.networkguild.org dovecot[865654]: imap (mgrant)<1939553><DcMIWJ8T6s7ZIx04>: Panic: file istream-header-filter.c: line 663 (i_stream_header_filter_snapshot_free): assertion failed: (snapshot- >mstream->snapshot_pending) Mar 14 10:02:38 strange.networkguild.org dovecot[865654]: imap (mgrant)<1939553><DcMIWJ8T6s7ZIx04>: Error: Raw backtrace: #0 test_subprocess_fork[0x7f1a33d7ca20] -> #1 backtrace_append[0x7f1a33d7cc90] - > #2 backtrace_get[0x7f1a33d7ce20] -> #3 execvp_const[0x7f1a33d89f90] -> #4 i_syslog_fatal_handler[0x7f1a33d8a900] -> #5 i_panic[0x7f1a33ce00a4] -> #6 fs_wrapper_unlock[0x7f1a33cdb71d] -> #7 i_stream_snapshot_free[0x7f1a33d96110] -> #8 i_stream_unref[0x7f1a33d96180] -> #9 index_mail_get_virtual_size [0x7f1a33f2d190] -> #10 index_mail_save_finish[0x7f1a33f2d470] -> #11 index_mail_get_special[0x7f1a33f2d690] -> #12 mail_get_special[0x7f1a33eaf950] -> #13 cmd_select[0x560714f983e0] -> #14 imap_fetch_begin[0x560714f9d170] - > #15 imap_fetch_more[0x560714f9d550] -> #16 cmd_fetch[0x560714f91c00] -> #17 command_exec[0x560714f9a880] -> #18 cmd_x_cancel[0x560714fa0510] -> #19 cmd_x_cancel[0x560714fa0510] -> #20 cmd_x_cancel[0x560714fa0510] -> #21 client_handle_input[0x560714fa0880] -> #22 client_input[0x560714fa0d80] -> #23 io_loop_call_io[0x7f1a33da1c70] -> #24 io_loop_handler_run_internal [0x7f1a33da3970] -> #25 io_loop_handler_run[0x7f1a33da3b00] -> #26 io_loop_run [0x7f1a33da3cd0] -> #27 master_service_run[0x7f1a33d14180] -> #28 main [0x560714f8ca00] -> #29 __libc_init_first[0x7f1a33ac51d0] -> #30 __libc_start_main[0x7f1a33ac5280] -> #31 _start[0x560714f8d000] I realize this is a slightly old version of dovecot but this is what's in debian's stable package repository. I see 2.3.21+dfsg1-2 in testing and 2.3.21+dfsg1-3 in unstable. I really try to avoid installing this on production. I didn't recently change anything in my configs on the server. I did start recently using 'eM Client' on Windows a couple days ago, could that have caused this? Mail seems to continue to come in to my imap clients, but these errors in the log are worrying! Michael Grant

2 1

Re: [EXT] Re: How to get a memory pointer in the core process
by Joseph Tam 15 Mar '24

15 Mar '24

From: Joan Moreau > I am trying to avoid closing/ reopening a file pointer to the exact same file > between each call to the plugin Can't you do an end-run around all this by having a persistent standalone process that holds all your persistent data, and the plugin collects session data and passes it to the persistent process via sockets? You'll have to have some initial handshake protocol to establish session context, but this seems the easiest way to accomplish what you want. Joseph Tam <jtam.home(a)gmail.com>

1 0

dovecot and solr clustering
by Maciej Milaszewski 13 Mar '24

13 Mar '24

Hi I have 1 director and ~8 dovecot nodes. I thinking about Solr cluster beacuse one server solr probably is not enough. I thinking about SolrCloud Mode but I don't know if it will work with Dovecot And if not SolrCloud Mode, then what? I don't have much experience in Solr clustering and I want to choose the most optimal solution with scalable aand redundancy (bare metal servers is not problem) Hi I have 1 director and ~8 dovecot nodes. I thinking about Solr cluster beacuse one server solr probably is not enough. I thinking about SolrCloud Mode but I don't know if it will work with Dovecot And if not SolrCloud Mode, then what? I don't have much experience in Solr clustering and I want to choose the most optimal solution with scalable aand redundancy (bare metal servers is not problem)

1 0

Dovecot and SNI
by steffan＠hldns.com 13 Mar '24

13 Mar '24

I have an old CentOS 7 server using dovecot 2.2.36 and OpenSSL 1.0.2k-fips that’s been fine for quite some time. Recently I started getting complaints related to SNI. I test with this: openssl s_client -connect mail.domain.com:993 -crlf -quiet On macOS using OpenSSL LibreSSL 3.3.6 I test and get the default dovecot domain “SomeWrongDomain.com” which causes issues. On Oracle Linux 9 using OpenSSL 3.0.7 I get the correct response for the domain “mail.domain.com” What could cause this? Thank you, Steffan Cline steffan(a)hldns.com<mailto:steffan@hldns.com> 602-793-0014 I have an old CentOS 7 server using dovecot 2.2.36 and OpenSSL 1.0.2k-fips that’s been fine for quite some time. Recently I started getting complaints related to SNI. I test with this: openssl s_client -connect mail.domain.com:993 -crlf -quiet On macOS using OpenSSL LibreSSL 3.3.6 I test and get the default dovecot domain “SomeWrongDomain.com” which causes issues. On Oracle Linux 9 using OpenSSL 3.0.7 I get the correct response for the domain “mail.domain.com” What could cause this? Thank you, Steffan Cline steffan(a)hldns.com 602-793-0014

4 3

quota plugin with virtual user
by noemi 13 Mar '24

13 Mar '24

Hi, I'm having some problems after activating the quota plugin: I followed the guide from the doc[0] but I'm having problems with some virtual user. I understand that,with my conf,the quota plugin check the limit of a user and then tell postfix to accept/discard the mail. i have some users under my main domain [conf in /etc/passwd] and some virtual user/domains [conf in virtusertable/virtdomains as files in postfix]. the virtual users use their local user for the login, so dovecot doesn't know they are virtual. I think the problem is here, because it is clear that the quota-status check is made by dovecot using the virtual user and not the local user[1]. understanding the problem doesn't help me in the resolution [other than burn everything and rebuild with a single management for local/virtual users using a db] but i will prefer a more soft approach. any help? my complete conf below[2] thanks, noemi [0] https://blog.sys4.de/postfix-dovecot-mailbox-quota-en.html [1] where the virtual user is mail(a)virtdomain.com and the local user is mail_virtdomain the check is done to user 'mail', thus returning a error: Nov 16 06:36:09 quota-status(other-user)<129776><OOwwMv+3VWXw+gEAKobZ8Q>: Error: Failed to lookup user mail(a)virtdomain.com: Mail access for users with UID 8 not permitted (see first_valid_uid in config file, uid from userdb lookup). [2] # 2.3.4.1 (f79e8e7e4): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.4 () # OS: Linux 6.1.0-10-amd64 x86_64 Debian 11.7 zfs # Hostname: mail-ng.pangea.org auth_mechanisms = plain login auth_username_format = %Ln default_client_limit = 3000 disable_plaintext_auth = no first_valid_uid = 8 log_path = /var/log/mail.log mail_location = maildir:/home/%n/Maildir mail_plugins = " quota" mail_privileged_group = mail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { driver = pam } plugin { quota = maildir:User quota quota_exceeded_message = Quota exceeded, please go to https://laweb.pangea.org/contacte/ for instructions on how to fix this. quota_grace = 10%% quota_max_mail_size = 100M quota_status_nouser = DUNNO quota_status_overquota = 552 5.2.2 Mailbox is full and cannot receive any more emails quota_warning = storage=95%% quota-warning 95 %u quota_warning2 = storage=80%% quota-warning 80 %u sieve = file:~/sieve/;active=~/.dovecot.sieve sieve_user_log = /var/log/sieve.log sieve_vacation_send_from_recipient = yes } protocols = " imap lmtp sieve pop3" service auth { unix_listener /var/spool/postfix/private/dovecot-auth { group = postfix mode = 0660 user = postfix } } service imap-login { process_limit = 1024 service_count = 100 } service imap { process_limit = 1024 } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } service pop3-login { process_limit = 1024 service_count = 0 } service pop3 { process_limit = 1024 } service quota-status { client_limit = 1 executable = quota-status -p postfix inet_listener { address = 127.0.0.1 port = 7777 } } service quota-warning { executable = script /usr/local/bin/quota-warning.sh unix_listener quota-warning { mode = 0666 user = vmail } user = dovecot } ssl_cert = </etc/letsencrypt/live/mail-ng.pangea.org/fullchain.pem ssl_client_ca_dir = /etc/ssl/certs ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { driver = passwd } protocol imap { mail_max_userip_connections = 40 mail_plugins = " quota imap_quota" } protocol lmtp { mail_plugins = " quota sieve" }

1 0

Possible bug in dovecot doc
by Petr Šorm 13 Mar '24

13 Mar '24

Dear maintainer, there is potentially conflicting information in dovecot doc about the count quota backend. According to https://doc.dovecot.org/configuration_manual/quota/quota_count/ the count quota backend is the recommended way of calculating quota on recent Dovecot installations. But according to https://github.com/dovecot/core/blob/main/doc/example-config/conf.d/90-quot… it is extremely SLOW with Maildir. It'll eat your CPU and disk I/O. I don't think the information on github is true, but I could be wrong. Could you fix/clarify this? Thank you in advance. Best regards Petr Sorm

1 0

Configure: "Can't build with MySQL support: libmysqlclient not found"
by James L. Brown 13 Mar '24

13 Mar '24

Hi all. I’m getting errors when trying to configure make for version 2.3.21 on macOS 14.3.1 Sonoma. It ends with: checking for mysql_config... mysql_config checking for mysql_init in -lmysqlclient... no configure: error: Can't build with MySQL support: libmysqlclient not found I’m using: env PKG_CONFIG_PATH=/opt/homebrew/lib/pkgconfig pkg-config --libs libsodium CPPFLAGS=-I/opt/homebrew/Cellar/openssl(a)3/3.2.1/include LDFLAGS=-L/opt/homebrew/opt/openssl@3/lib ./configure --with-ssl=openssl --with-mysql --with-sodium Looking at config.log I see: configure:28222: checking for mysql_config configure:28238: found /opt/homebrew/bin/mysql_config configure:28250: result: mysql_config configure:28285: checking for mysql_init in -lmysqlclient configure:28310: gcc -o conftest -std=gnu99 -g -O2 -fstack-protector-strong -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=2 -Wall -W -Wmissing-prototypes -Wmissing-declarations -Wpointer-arith -Wchar-subscripts -Wformat=2 -Wbad-function-cast -Wno-duplicate-decl-specifier -Wstrict-aliasing=2 -I/opt/homebrew/Cellar/openssl(a)3/3.2.1/include -I/opt/homebrew/Cellar/openssl(a)3/3.2.1/include -L/opt/homebrew/opt/openssl@3/lib conftest.c -lmysqlclient -L/opt/homebrew/Cellar/mysql/8.3.0_1/lib -lmysqlclient -lz -lzstd -lssl -lcrypto -lresolv -lz -lm >&5 ld: warning: ignoring duplicate libraries: '-lmysqlclient', '-lz' ld: library 'zstd' not found clang: error: linker command failed with exit code 1 (use -v to see invocation) configure:28310: $? = 1 Odd that it is using the old version mysql. Would someone be able to help me get it to find libmysqlclient? In /opt/homebrew/Cellar/mysql/8.0.32/lib/ I have: libmysqlclient.21.dylib libmysqlclient.a libmysqlclient.dylib Thanks, James. Hi all. I’m getting errors when trying to configure make for version 2.3.21 on macOS 14.3.1 Sonoma. It ends with: checking for mysql_config... mysql_config checking for mysql_init in -lmysqlclient... no configure: error: Can't build with MySQL support: libmysqlclient not found I’m using: env PKG_CONFIG_PATH=/opt/homebrew/lib/pkgconfig pkg-config --libs libsodium CPPFLAGS=-I/opt/homebrew/Cellar/openssl(a)3/3.2.1/include LDFLAGS=-L/opt/ homebrew/opt/openssl@3/lib ./configure --with-ssl=openssl --with-mysql --with- sodium Looking at config.log I see: configure:28222: checking for mysql_config configure:28238: found /opt/homebrew/bin/mysql_config configure:28250: result: mysql_config configure:28285: checking for mysql_init in -lmysqlclient configure:28310: gcc -o conftest -std=gnu99 -g -O2 -fstack-protector-strong - U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=2 -Wall -W -Wmissing-prototypes -Wmissing- declarations -Wpointer-arith -Wchar-subscripts -Wformat=2 -Wbad-function-cast - Wno-duplicate-decl-specifier -Wstrict-aliasing=2 -I/opt/homebrew/Cellar/ openssl(a)3/3.2.1/include -I/opt/homebrew/Cellar/openssl(a)3/3.2.1/include -L/opt/ homebrew/opt/openssl@3/lib conftest.c -lmysqlclient -L/opt/homebrew/Cellar/ mysql/8.3.0_1/lib -lmysqlclient -lz -lzstd -lssl -lcrypto -lresolv -lz -lm >&5 ld: warning: ignoring duplicate libraries: '-lmysqlclient', '-lz' ld: library 'zstd' not found clang: error: linker command failed with exit code 1 (use -v to see invocation) configure:28310: $? =1 Odd that it is using the old version mysql. Would someone be able to help me get it to find libmysqlclient? In /opt/homebrew/Cellar/mysql/8.0.32/lib/ I have: libmysqlclient.21.dylib libmysqlclient.a libmysqlclient.dylib Thanks, James.

3 4

Re: Dovecot installation and ssl certificates
by Joseph Tam 12 Mar '24

12 Mar '24

Jerry Stuckle writes: > I'm starting with POP3 (because it's easy to handle from the CLI). I > have it working from localhost - I can telnet to port localhost 110 and > access emails (of course I can't do this from a remote system because it > requires SSL). Sure you can: (STARTTLS style) openssl s_client -starttls pop3 -connect your.pop.server:110 (SSL style) openssl s_client -connect your.pop.server:995 You can also use ncat (exercise left to the reader). "localhost", I believe, is a specific exclusion where SSL in *not* enforced during the session. > Trying to access this from a remote system with Thunderbird is not > working. /var/log/mail.log shows the following: > > 2024-03-03T22:18:54.887061-05:00 debian-server dovecot: pop3-login: > Disconnected: Connection closed: SSL_accept() failed: error:0A000412:SSL > routines::sslv3 alert bad certificate: SSL alert number 42 (no auth > attempts in 0 secs): user=<>, rip=206.223.85.12, lip=206.223.85.137, TLS > handshaking: SSL_accept() failed: error:0A000412:SSL routines::sslv3 > alert bad certificate: SSL alert number 42, session=<l6qBL80SOePO31UM> This looks like an error message stating STARTTLS was expected but the client used a plaintext session. Try enabling STARTTLS on your Thunderbird. If that is not the cause ... Ref: https://doc.dovecot.org/configuration_manual/dovecot_ssl_configuration/ The most important dovecot configurations are ssl_cert = </path/to/your/server.crt ssl_key = </path/to/your/server.key You can have protocol specific certificates e.g. protocol pop3 { ssl_cert = ... ssl_key = ... } but you'll typically put this outside the protocol section so that there is one default certificate. > I need help. First of all, an explanation as to how to configure the > dovecot-openssl.cnf file (an example with actual values - real or fake - > would be a real help). > > Second, where does this go? Maybe running doveconf will tell you where your installation expects the main configuration file to be. This file may include other config files. > Note that for right now I'm trying to just get one domain working but > eventually this will serve at least 4 domains. Once I get the first > domain working, thoughts about how to get multiple domains working would > also be appreciated. This depends on how you set up your filesystem and authentication and your security constraints. You'll have to be more specific on your setup. Confining my reply to just SSL setup, you can obtain a SSL certificate with multiple domains named listed, which makes multi-domain SSL support easier. Joseph Tam <jtam.home(a)gmail.com>

1 0

Remote IP address in dovecot
by Andre Rodier 12 Mar '24

12 Mar '24

Hello, I am using a webmail, SOGo, to access Dovecot mail server in IMAP. SOGo correctly logs the remote IP address, using the standard nginx headers, especially X-Forwarded-For. However, when I check the IMAP logs, I see my server's IP address for the "remote_ip" value. I think there is a way to override this value from the environment, but I could not find it. Thanks for your help, -- André Rodier

2 1

Dovecot installation and ssl certificates
by Jerry Stuckle 12 Mar '24

12 Mar '24

Hi, all, First of all, I will admit I am totally a noob with Dovecot. I am trying to install it on Debian and am somewhat lost. Right now this is a test system on our LAN. I'm starting with POP3 (because it's easy to handle from the CLI). I have it working from localhost - I can telnet to port localhost 110 and access emails (of course I can't do this from a remote system because it requires SSL). Trying to access this from a remote system with Thunderbird is not working. /var/log/mail.log shows the following: 2024-03-03T22:18:54.887061-05:00 debian-server dovecot: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:0A000412:SSL routines::sslv3 alert bad certificate: SSL alert number 42 (no auth attempts in 0 secs): user=<>, rip=206.223.85.12, lip=206.223.85.137, TLS handshaking: SSL_accept() failed: error:0A000412:SSL routines::sslv3 alert bad certificate: SSL alert number 42, session=<l6qBL80SOePO31UM> I tried to create a certificate with mkconf.sh but obviously don't have the right information in the configuration file and/or didn't get the files in the right place (I've seen different places they should be). I need help. First of all, an explanation as to how to configure the dovecot-openssl.cnf file (an example with actual values - real or fake - would be a real help). Second, where does this go? Note that for right now I'm trying to just get one domain working but eventually this will serve at least 4 domains. Once I get the first domain working, thoughts about how to get multiple domains working would also be appreciated. I know we noobs are a PITA but I really appreciate the help. Jerry

2 1

[dovecot 2.3.4.1] Pigeonhole sieve: Howto use vacation extension with virtual users and subject/message stored in database?
by phren＠ist-einmalig.de 11 Mar '24

11 Mar '24

Hi, we're about to replace our current auto-responder with pigeonhole sieve vacation extension. Currently the (virtual) users are able to enable and disable the auto-responder, besides subject and message, in the webinterface and the setting is stored in a database. Now we're looking for a way for the vacation extension to use the database as source for enabled/disabled/subject/message. The goal is *not* to use the virtual home directory as storage. On the first sight the extdata plugin seems to have an interface to the database, but I'm unable to find a way for conditional SQL statements. Our last resort could be the extprograms plugin, but we try to avoid shell scripts. Virtual users are common usage and so we're pretty sure that there is a way to use pigeonhole sieve vacation extension with database storage. But we're unable to find it. Can please someone point to us to the right direction? Every hint is appreciated. -- Phren

1 0

Remote IP address in dovecot
by André Rodier 11 Mar '24

11 Mar '24

Hello, I am using a webmail, SOGo, to access Dovecot mail server in IMAP. SOGo correctly logs the remote IP address, using the standard nginx headers, especially X-Forwarded-For. However, when I check the IMAP logs, I see my server's IP address for the "remote_ip" value. I think there is a way to override this value from the environment, but I could not find it. Thanks for your help, -- André Rodier

1 0

Documentation error for sieve_redirect_envelope_from
by Thomas Mechtersheimer 11 Mar '24

11 Mar '24

Hi, the documentation at https://doc.dovecot.org/settings/pigeonhole/ says regarding sieve_redirect_envelope_from setting option user_email: | The user’s primary address is used. This is configured with the | sieve_user_email setting. If that setting is not configured, user_email | is equal to sender. But checking dovecot-2.3-pigeonhole-0.5.21/src/lib-sieve/sieve-address-source.c ~line 79: | if ( type == SIEVE_ADDRESS_SOURCE_USER_EMAIL && | svinst->user_email == NULL ) | type = SIEVE_ADDRESS_SOURCE_RECIPIENT; So if sieve_user_email is not configured, "user_email" is equal to "recipient" (which is the observed behaviour). Either the documentation is incorrect and should be updated, or the source has a bug . btw: I was looking at this cause I search for a way to change the envelope sender on redirect only for a specific user. But it looks like this is impossible: sieve_redirect_envelope_from is a server wide setting; and the sieve script doesn't allow changing the envelope... -- Thomas Mechtersheimer - Necklenbroicher Str. 45a - D-40667 Meerbusch - Germany EMail: thomasm(a)wupper.com IRC-Nick: Mechti Of course I'm crazy, but that doesn't mean I'm wrong. I'm mad but not ill.

1 0