- dovecot - dovecot.org

Compilation fails: SSL_TXT_SSLV2 not defined
by Muffinman 07 Mar '16

07 Mar '16

Hello all, I'm trying to compile dovecot 2.2.21 on OS-X 10.11.3 and I'm running a bit of trouble with OpenSSL. I've cloned OpenSSL (OpenSSL 1.1.0-pre4-dev) from github and in openssl/ssl.h SSL_TXT_SSLV2 is not defined anymore. Compilation fails with: libtool: compile: gcc -DHAVE_CONFIG_H -I. -I../.. -I../../src/lib -I../../src/lib-test -DMODULE_DIR=\"/usr/local/lib/dovecot\" -std=gnu99 -g -O2 -Wall -W -Wmissing-prototypes -Wmissing-declarations -Wpointer-arith -Wchar-subscripts -Wformat=2 -Wbad-function-cast -Wno-duplicate-decl-specifier -Wstrict-aliasing=2 -MT iostream-openssl-common.lo -MD -MP -MF .deps/iostream-openssl-common.Tpo -c iostream-openssl-common.c -fno-common -DPIC -o .libs/iostream-openssl-common.o iostream-openssl-common.c:34:24: error: use of undeclared identifier 'SSL_TXT_SSLV2' if (strcasecmp(name, SSL_TXT_SSLV2) == 0) ^ 1 error generated. make[3]: *** [iostream-openssl-common.lo] Error 1 make[2]: *** [all-recursive] Error 1 make[1]: *** [all-recursive] Error 1 make: *** [all] Error 2 In openssl/ssl.h the following is defined: # define SSL_TXT_SSLV3 "SSLv3" # define SSL_TXT_TLSV1 "TLSv1" # define SSL_TXT_TLSV1_1 "TLSv1.1" # define SSL_TXT_TLSV1_2 "TLSv1.2" # define SSL_TXT_ALL "ALL" Any suggestions on how to fix this? Kind regards, Maarten

2 3

questions regarding zlib plugin
by Götz Reinicke - IT Koordinator 07 Mar '16

07 Mar '16

Hi, faced with a current space problem on our dovecot 2.2.18 server, I thought about using the zlib plugin. My questions: - is it really as simple as adding the options to the conf files as described in the docs :) ? http://wiki2.dovecot.org/Plugins/Zlib - As this just compresses new messages; dose anybody has a sort of simple cron or whatever script or best practice how to compress existing maildir mails? The doc is a bit complicated to me at that point... Thanks a lot and regards . Götz

3 3

Ubuntu packages
by Peter Chiochetti 07 Mar '16

07 Mar '16

Since dovecot put up packages on their own repo, bigmichi stopped providing his'. I guess this is not Stephan; Would the kind person update ppa.launchpad.net/bigmichi1 ? Thank You -- peter

11 18

VS: Re: v2.2.22 release candidate released
by Aki Tuomi 06 Mar '16

06 Mar '16

In future release we will add master authentication too. Now you can use api key or doveadm password which are essentially same thing. ---Aki TuomiDovecot oy-------- Alkuperäinen viesti --------Lähettäjä: Peter Chiochetti <pch(a)myzel.net> Päivämäärä: 4.3.2016 20.20 (GMT+02:00) Saaja: dovecot(a)dovecot.org Aihe: Re: v2.2.22 release candidate released Am 2016-03-04 um 14:33 schrieb Timo Sirainen: > + Added doveadm HTTP API: See > http://wiki2.dovecot.org/Design/DoveadmProtocol/HTTP Hmm, so anybody who has the API key can send any doveadm commands? I guess something like /etc/sudoers for API keys would be good? Did I miss something? -- peter

3 2

Re: Dovecot stops responding when I update SSL certificate
by Joseph Tam 06 Mar '16

06 Mar '16

HotSlots Webmaster <webmaster(a)hotslots132.com> writes: > I have had Dovecot working fine with SSL for nearly two years now. It's > time to renew the SSL certificate, so I did (same CA). The new > certificate works fine in Apache and Postfix. But when I update Dovecot > to use the same certificate, and restart the server, Dovecot stops > responding to connects. > ... > Here is the end of the dovecot -n file that mentions SSL: > ... > ssl_dh_parameters_length = 2048 When you start dovecot, does CPU load of dovecot/ssl-params roof to 100%? It's possible it's generating ephemeral DH keys. In a previous post to this list, I note that the run time to generate these keys can vary wildly, and gets worse with longer keys. Sometimes you get lucky, and you'll generate then quickly, sometimes it takes a long while (minutes). http://dovecot.org/pipermail/dovecot/2015-November/102447.html Try running openssl dhparam -noout 2048 to see how it varies for you. If what I suspect is true, you can try using shorter keys. A followup post suggest a way you can precompute the key Joseph Tam <jtam.home(a)gmail.com>

3 2

VS: Re: Implementation of TLS OCSP Stapling
by Aki Tuomi 06 Mar '16

06 Mar '16

Luckily ocsp stapling is an SSL extension and clients not supporting it won't be asking for it either. ---Aki TuomiDovecot oy -------- Alkuperäinen viesti --------Lähettäjä: Andrew McGlashan <andrew.mcglashan(a)affinityvision.com.au> Päivämäärä: 6.3.2016 10.36 (GMT+02:00) Saaja: dovecot(a)dovecot.org Aihe: Re: Implementation of TLS OCSP Stapling On 3/03/2016 11:58 PM, aki.tuomi(a)dovecot.fi wrote: > We will take this feature under consideration and see if it can be implemented > in future release. Thank you for your suggestion! As much as I hate Outlook (Look Out!), there are loads of people using really old versions; 2003 is no longer supported, but loads of people use 2007. Thunderbird can be expected to be far more up to date. Implementing features to work with older clients will always be a problem. Just a simple example, almost unrelated here, but this is either wrong by TB or wrong by Outlook (versions 2007, 2010 and 2013 that I know of). When the IMAP server sends a message, OL will pop up a window that requires the user to acknowledge the message via a popup. TB just pops up the message in the normal 'new mail' notify if that is configured and it might be lost if notify isn't set to show. Either way, the implementation is different b/w the two client products. Is OL right or is TB right... IMAP doco says that the message should be made to be acknowledged by the client; OL's version can't easily be ignored or missed, but TB's can easily be missed. But TB's implementation is more user friendly if the server wants to keep sending messages from time to time. I considered using this for MOTD type stuff and maybe random inspirational or motivational messages; even to remind or inform users to do certain things [one example in the dovecot wiki is to advise that the vacation message is still active]. A TB notification is next to harmless, but an OL one needs to be acknowledged every time, which would be very painful. Anyway, the point is that if a feature is added for OCSP stabling support, you couldn't really expect older versions of Look Out to comply with it (even though M$ could patch it easily, they care less about older versions than getting people to subscribe to Office 365 these days). Cheers A.

1 0

Implementation of TLS OCSP Stapling
by dovecot＠flut.demon.nl 06 Mar '16

06 Mar '16

Hi all, About a year ago, Torsten already asked for OCSP stapling (http://dovecot.org/pipermail/dovecot/2015-April/100632.html) Unfortunately, there was no answer to his question. Now RFC 7633 ("TLS Feature Extension", https://tools.ietf.org/html/rfc7633, a.k.a. "Must Staple") has landed, revocation is getting serious! I personally would like to embed all my TLS certificates with the must-staple extension. The great project Let's Encrypt already supports it: https://github.com/letsencrypt/boulder/pull/1224 I'm aware most MTAs don't really care about the certificate, but big players as Google take TLS encryption very seriously: https://googleblog.blogspot.nl/2016/02/building-safer-web-for-everyone.html So I would like to know if Dovecot is planning to feature OCSP stapling. That way I know for sure my "must staple" certificates can be used by Dovecot. And in my opinion, every TLS offering daemon should be up to par to the capabilities of TLS.. Not lag behind :) What's your opinion on this matter? Thanks in advance for any anwser! Greets, Osiris

7 11

dovecot local indexes and multiple servers
by alex 05 Mar '16

05 Mar '16

Hi, I've been testing mdbox with local indexes on our nfs based directors + multiple imap/lda/pop3 server setup. The performance is noticeably better than maildir with indexes on nfs, so I'd like to make this work. About the possible direction to other servers the wiki says that it will create a new index 'on the fly'. That is true, but after the index is recreated, Thunderbird (imap) re-downloads all the messages and sees all those messages as unread again! This is probably quite logical as the message status is only kept in the indexes, but this is not very customer friendly. Is there a way to avoid this problem? I'd rather not manually sync those local indexes between our servers. In fact, I was planning on deleting (old) indexes when a user moved to another server or even if they haven't checked their mail for XX days. with up to 10Gb mailboxes the indexes themselves can get up to 20-40Mb for a mailbox. that amounts to quite a lot of storage for 200k+ users. Thanks, Alex.

2 2

VS: Dovecot stops responding when I update SSL certificate
by Aki Tuomi 05 Mar '16

05 Mar '16

Did you change dh parameter size as well? This causes dh generation which can take some time. ---Aki TuomiDovecot oy-------- Alkuperäinen viesti --------Lähettäjä: HotSlots Webmaster <webmaster(a)hotslots132.com> Päivämäärä: 5.3.2016 4.10 (GMT+02:00) Saaja: dovecot(a)dovecot.org Aihe: Dovecot stops responding when I update SSL certificate Dovecot 2.2.18 CentOS 6.7 (x86_64) Plesk 12.5.30 I have had Dovecot working fine with SSL for nearly two years now. It's time to renew the SSL certificate, so I did (same CA). The new certificate works fine in Apache and Postfix. But when I update Dovecot to use the same certificate, and restart the server, Dovecot stops responding to connects. I have triple-checked that the ssl_cert and ssl_key files are correct - all I did was change the names in the conf file. There's nothing in the log. I have tried various SSL tests but either they don't work (unspecific error) or they tell me nothing is wrong (and show the correct certificate.) I am running out of time to find a solution to this - what else can I look for? The one difference for the certificates is that I opted for one with a SHA256 root rather than SHA1 root. I have separately used a tool to verify that the certificate and private key match. Here is the end of the dovecot -n file that mentions SSL: ssl = required ssl_cert = </etc/pki/tls/certs/hotslots-cert.pem ssl_cipher_list = EECDH+AESGCM+AES128:EECDH+AESGCM+AES256:EDH+AESGCM+AES128:EDH+AESGCM+AES256:EECDH+SHA256+AES128:EECDH+SHA384+AES256:EDH+SHA256+AES128:EDH+SHA256+AES256:EECDH+SHA1+AES128:EECDH+SHA1+AES256:EDH+SHA1+AES128:EDH+SHA1+AES256:EECDH+HIGH:EDH+HIGH:AESGCM+AES128:AESGCM+AES256:SHA256+AES128:SHA256+AES256:SHA1+AES128:SHA1+AES256:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!KRB5:!aECDH:!EDH+3DES ssl_dh_parameters_length = 2048 ssl_key = </etc/ssl/private/hotslots-private.pem ssl_protocols = TLSv1.1 TLSv1.2 !TLSv1 userdb { args = uid=popuser gid=popuser driver = static } protocol imap { mail_plugins = " quota imap_quota" } protocol pop3 { pop3_uidl_format = UID%u-%v } protocol lda { mail_plugins = " quota sieve" } (The !TLSv1 doesn't seem to be honored - I tried it with and without that. A problem for later.) Thanks for any help. Steve L

1 0

Dovecot stops responding when I update SSL certificate
by HotSlots Webmaster 05 Mar '16

05 Mar '16

Dovecot 2.2.18 CentOS 6.7 (x86_64) Plesk 12.5.30 I have had Dovecot working fine with SSL for nearly two years now. It's time to renew the SSL certificate, so I did (same CA). The new certificate works fine in Apache and Postfix. But when I update Dovecot to use the same certificate, and restart the server, Dovecot stops responding to connects. I have triple-checked that the ssl_cert and ssl_key files are correct - all I did was change the names in the conf file. There's nothing in the log. I have tried various SSL tests but either they don't work (unspecific error) or they tell me nothing is wrong (and show the correct certificate.) I am running out of time to find a solution to this - what else can I look for? The one difference for the certificates is that I opted for one with a SHA256 root rather than SHA1 root. I have separately used a tool to verify that the certificate and private key match. Here is the end of the dovecot -n file that mentions SSL: ssl = required ssl_cert = </etc/pki/tls/certs/hotslots-cert.pem ssl_cipher_list = EECDH+AESGCM+AES128:EECDH+AESGCM+AES256:EDH+AESGCM+AES128:EDH+AESGCM+AES256:EECDH+SHA256+AES128:EECDH+SHA384+AES256:EDH+SHA256+AES128:EDH+SHA256+AES256:EECDH+SHA1+AES128:EECDH+SHA1+AES256:EDH+SHA1+AES128:EDH+SHA1+AES256:EECDH+HIGH:EDH+HIGH:AESGCM+AES128:AESGCM+AES256:SHA256+AES128:SHA256+AES256:SHA1+AES128:SHA1+AES256:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!KRB5:!aECDH:!EDH+3DES ssl_dh_parameters_length = 2048 ssl_key = </etc/ssl/private/hotslots-private.pem ssl_protocols = TLSv1.1 TLSv1.2 !TLSv1 userdb { args = uid=popuser gid=popuser driver = static } protocol imap { mail_plugins = " quota imap_quota" } protocol pop3 { pop3_uidl_format = UID%u-%v } protocol lda { mail_plugins = " quota sieve" } (The !TLSv1 doesn't seem to be honored - I tried it with and without that. A problem for later.) Thanks for any help. Steve L

1 0

Deliver to Public Mailbox
by Chris 03 Mar '16

03 Mar '16

Dear All, I'd like dovecot-lda (deliver) to post a message to a public mailbox. It doesn't seem to work when I just use the -m parameter with the IMAP-Mailbox path, e.g. Public/info . What parameters are required? Do I have to change the headers with formail in any way? TIA! - Chris

1 1

Dovecot 2.2.21 - segfault
by Robert Blayzor 03 Mar '16

03 Mar '16

pid 31943 (dovecot), uid 0: exited on signal 11 (core dumped) dovecot --version 2.2.21 (5345f22) uname -a FreeBSD 10.3-BETA2 #0 r295966M: amd64 bt full #0 0x00000008008eb037 in t_push (marker=0x0) at data-stack.c:133 133 data-stack.c: No such file or directory. in data-stack.c (gdb) bt full #0 0x00000008008eb037 in t_push (marker=0x0) at data-stack.c:133 frame_block = (struct stack_frame_block *) 0x7fffffffb4e0 #1 0x000000080086a5ec in master_service_env_clean () at master-service.c:534 _data_stack_cur_id = 32767 value = 0x801471056 "TZ CORE_OUTOFMEM CORE_ERROR" #2 0x000000000040df88 in service_process_setup_environment (service=0x8014b11e0, uid=58537, hostdomain=0x801419960 “mta3.xxx.net") at service-process.c:234 No locals. #3 0x000000000040dd6d in service_process_create (service=0x8014b11e0) at service-process.c:322 uid_counter = 58537 process = (struct service_process *) 0x8008eb2f3 uid = 58537 hostdomain = 0x801419960 “mta3.xxx.net" pid = 0 process_forked = true #4 0x000000000040d7ff in service_accept (l=0x8014b1378) at service-monitor.c:299 service = (struct service *) 0x8014b11e0 #5 0x000000080090e57f in io_loop_call_io (io=0x80144e7e0) at ioloop.c:559 ioloop = (struct ioloop *) 0x801421080 t_id = 2 #6 0x0000000800911497 in io_loop_handler_run_internal (ioloop=0x801421080) at ioloop-kqueue.c:151 ctx = (struct ioloop_handler_context *) 0x801419880 events = (struct kevent *) 0x8014b9000 event = (const struct kevent *) 0x8014b9000 tv = {tv_sec = 42682, tv_usec = 705349} ts = {tv_sec = 42682, tv_nsec = 705349000} io = (struct io_file *) 0x80144e7e0 events_count = 67 ret = 1 i = 0 #7 0x000000080090eb0e in io_loop_handler_run (ioloop=0x801421080) at ioloop.c:607 No locals. #8 0x000000080090e92f in io_loop_run (ioloop=0x801421080) at ioloop.c:583 No locals. #9 0x000000080086a8bb in master_service_run (service=0x80141b140, callback=0) at master-service.c:640 No locals. #10 0x0000000000406558 in main (argc=3, argv=0x7fffffffb4c0) at main.c:888 set = (struct master_settings *) 0x801429110 error = 0x800ca9283 "H\203Ä ]Ã\017\037\200" doveconf_arg = 0x0 orig_info_callback = (failure_callback_t *) 0x8008ee880 <i_syslog_error_handler> orig_debug_callback = (failure_callback_t *) 0x8008ee880 <i_syslog_error_handler> foreground = false ask_key_pass = false i = 3 c = -1 doubleopts = 0x7fffffffb3a0 Current language: auto; currently minimal

2 2

Dovecot error symbol mysql_options, version libmysqlclient_16 not defined in file libmysqlclient.so.18
by Condor 03 Mar '16

03 Mar '16

Hello, Im using Dovecot version: 2.2.21 (5345f22) Here is my conf file: auth_debug = yes auth_mechanisms = plain login auth_socket_path = /usr/local/var/run/dovecot/auth-userdb auth_verbose = yes base_dir = /usr/local/var/run/dovecot/ debug_log_path = /var/log/dovecot.log default_login_user = nobody default_process_limit = 200 dict { driver = sql quota = mysql:/usr/local/etc/dovecot/dovecot-dict-sql.conf.ext } mail_debug = yes mail_location = maildir:/var/mailq/postmail/%d/%n/Maildir mail_privileged_group = vmail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify envir onment mailbox date index ihave duplicate mime foreverypart extracttext namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = /usr/local/etc/dovecot/dovecot-sql.conf.ext driver = sql } passdb { args = /usr/local/etc/dovecot/dovecot-sql.conf.ext driver = sql } plugin { autocreate = Trash autocreate2 = Junk autocreate3 = Sent autocreate4 = Drafts autosubscribe = Trash autosubscribe2 = Junk autosubscribe3 = Sent autosubscribe4 = Drafts sieve = /var/mailq/postmail/%d/%n/.dovecot.sieve sieve_dir = /var/mailq/postmail/%d/%n/sieve/ sieve_global_dir = /usr/local/var/lib/dovecot/sieve sieve_global_path = /usr/local/var/lib/dovecot/sieve/default.sieve sieve_max_actions = 32 sieve_max_redirects = 15 sieve_quota_max_scripts = 20 } protocols = pop3 imap sieve service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0666 user = postfix } } service imap-login { inet_listener imap { port = 143 } inet_listener imaps { port = 993 } } service managesieve-login { inet_listener sieve { port = 4190 } service_count = 1 vsz_limit = 64 M } ssl_cert = </etc/postfix/ssl/certs/dovecot.pem ssl_key = </etc/postfix/ssl/private/dovecot.pem userdb { args = uid=1003 gid=1001 home=/var/mailq/postmail/%d/%n allow_all_users=yes driver = static } userdb { args = /usr/local/etc/dovecot/dovecot-sql.conf.ext driver = sql } protocol pop3 { pop3_uidl_format = %08Xu%08Xv } protocol lmtp { mail_plugins = " sieve" } protocol lda { mail_plugins = " sieve" } protocol imap { imap_max_line_length = 64 k mail_max_userip_connections = 200 mail_plugins = " autocreate" } protocol sieve { managesieve_implementation_string = Dovecot Pigeonhole } dovecot-sql. conf grep -v '^ *$#.*$\?$' dovecot-sql.conf.ext driver = mysql connect = host=localhost dbname=postfix user=xxx password=xxx default_pass_scheme = CRYPT password_query = SELECT username AS user, password FROM mailbox WHERE username = '%u'; I get follow error: dovecot: auth-worker: Error: dovecot/auth: relocation error: dovecot/auth: symbol mysql_options, version libmysqlclient_16 not defined in file libmysqlclient.so.18 with link time reference I delete all binary and libs and source code, download again and compile with option with-mysql and always got the same error when I start it: dovecot: auth-worker: Error: dovecot/auth: relocation error: dovecot/auth: symbol mysql_options, version libmysqlclient_16 not defined in file libmysqlclient.so.18 with link time reference Mar 3 16:50:56 mailcontrol dovecot: master: Error: service(auth-worker): command startup failed, throttling for 60 secs Mar 3 16:50:56 mailcontrol dovecot: auth-worker(3276): Fatal: master: service(auth-worker): child 3276 returned error 127 Mar 3 16:50:56 mailcontrol dovecot: auth: Error: auth worker: Aborted PASSV request for xxx@xxx: Worker process died unexpectedly I even check with ldd is there any banary that use libmysqlclient.16.so but did not found. ldd auth is linked libmysqlclient.so.18 => /usr/lib64/libmysqlclient.so.18 (0x00007fad84696000) I use kernel 4.4.3, gcc 5.3.0 $ gcc -v Reading specs from /usr/lib64/gcc/x86_64-slackware-linux/5.3.0/specs COLLECT_GCC=gcc COLLECT_LTO_WRAPPER=/usr/libexec/gcc/x86_64-slackware-linux/5.3.0/lto-wrapper Target: x86_64-slackware-linux Configured with: ../gcc-5.3.0/configure --prefix=/usr --libdir=/usr/lib64 --mandir=/usr/man --infodir=/usr/info --enable-shared --enable-bootstrap --enable-languages=ada,c,c++,fortran,go,java,lto,objc --enable-threads=posix --enable-checking=release --enable-objc-gc --with-system-zlib --with-python-dir=/lib64/python2.7/site-packages --enable-libstdcxx-dual-abi --with-default-libstdcxx-abi=gcc4-compatible --disable-libunwind-exceptions --enable-__cxa_atexit --enable-libssp --enable-lto --enable-install-libiberty --with-gnu-ld --verbose --enable-java-home --with-java-home=/usr/lib64/jvm/jre --with-jvm-root-dir=/usr/lib64/jvm --with-jvm-jar-dir=/usr/lib64/jvm/jvm-exports --with-arch-directory=amd64 --with-antlr-jar=/tmp/gcc/antlr-runtime-3.4.jar --enable-java-awt=gtk --disable-gtktest --disable-multilib --target=x86_64-slackware-linux --build=x86_64-slackware-linux --host=x86_64-slackware-linux Thread model: posix gcc version 5.3.0 (GCC) Mysql version: mysql Ver 15.1 Distrib 10.0.24-MariaDB, for Linux (x86_64) using readline 5.1 Glibc version 2.23 any one can help me to understand whats happaened ? HS

1 0

Found bug in quota-status + patch
by Thierry Coppey 03 Mar '16

03 Mar '16

Hello, I've found a bug in the quota-status util (Dovecot 2.2.21, and probably below): it always return OK (sufficient quota) because it fails to load the user properly. More specifically, the branch " if (quser == NULL) return 1; " in src/plugins/quota/quota-status.c:59 is always taken. (at least with postgresql backend, test your config with the (adapted) command below: printf "recipient=mailbox(a)example.com\nsize=10000000000\n\n" | nc inet:mailstore.example.com 12340 it should reject, unless you have no quota, or more than 10G). Therefore it is pointless to configure the quota-status service as described in http://wiki2.dovecot.org/Quota because of that bug: the mail would be always accepted from the client and rejected at the end of the (Postfix) processing by lda. It is possible to reject directly at SMTP level when the mailbox is full using Postfix and main.cf: smtpd_recipient_restrictions = ... reject_unauth_destination, ... check_policy_service inet:mailstore.example.com:12340 smtpd_end_of_data_restrictions = check_policy_service inet:mailstore.example.com:12340 However there remain a *small inconsistency* as lda will count the size of message including headers whereas smtpd_end_of_data_restrictions seems not to count them towards the message size (or additional headers might be added by other preprocessing e.g. antispam etc...) I propose the patch below to fix quota-status. Could an expert double-check that it doesn't have memory leaks? (it shouldn't but I'm not yet comfortable enough with Dovecot memory management). Best regards, Thierry C.

3 3

Dual certificate
by Jean-Baptiste Vignaud 03 Mar '16

03 Mar '16

Hello all; Is anyone knows if it's possible to have a dual certificate setup on dovecot like in postfix or apache ? i tried to add several crts in local name section : local_name imap.server.tdl { ssl_cert = <server_rsa_crt.pem ssl_key = <server_rsa_key.pem ssl_cert = <server_ecdsa_crt.pem ssl_key = <server_ecdsa_key.pem } but it seems that dovecot takes the last one (ecdsa) and that rsa cert is not used. to check if booth are working, i check with openssl: openssl s_client openssl s_client -connect imap.server.tdl:143 -starttls imap -servername imap.server.tdl -cipher ECDHE-RSA-AES128-GCM-SHA256 for rsa and openssl s_client openssl s_client -connect imap.server.tdl:143 -starttls imap -servername imap.server.tdl -cipher ECDHE-ECDSA-AES128-GCM-SHA256 for ecdsa In apache we have to duplicate the cert / key lines one for rsa, one for edcda. In postfix, we have some specific ecdsa conf keys. So is there a way to do the same in dovecot ?

3 3

Deleting / Removing users
by John Krug 03 Mar '16

03 Mar '16

i have a list of users that I’ve removed from LDAP and I want to delete their mail storage. sdbox Dovecot 2.2.15.8 I have mail messages in one location and indexes in another. Should I just rm -rf /messages/<username> rm -rf /indexes/<username> Thanks, JK ----------------------------------------------------------------------- John "JK" Krug System Administrator The University of Chicago | Laboratory Schools 1362 East 59th Street | Chicago, IL 60637 Phone: (773) 834-4476 jk(a)ucls.uchicago.edu <mailto:jkallo@ucls.uchicago.edu> | http://helpdesk.ucls.uchicago.edu _______________________________________________

2 3

Get mailbox from its guid through IMAP
by Peter Chiochetti 02 Mar '16

02 Mar '16

In the shell I'do: doveadm fetch -u bob mailbox mailbox-guid $box uid 1 Is there a way through IMAP to get the same? -- peter

2 1

user configuration question
by Eric Abrahamsen 02 Mar '16

02 Mar '16

I've been using mbsync to sync this email account to a local Dovecot installation. I used to use Gmail, through Google Apps, and a while ago switched the account to self-hosting. I didn't want to upload years' worth of old email to my old server, so I've had two accounts in my MUA: one talking to the local Dovecot account for the old emails, and a second talking directly to the server for the new emails. I'd like to sync the new account to Dovecot as well, and I'm having trouble wrapping my brain around how to configure the two side-by-side accounts in Dovecot (I know there are other solutions to this, but I'm also just trying to figure out how this works). What I don't grok is the exact effect of the different username fields in the passdb file, and how they combine with username_format. Right now my dovecot.conf has this: passdb { driver = passwd-file args = username_format=%u /etc/dovecot/passwd } userdb { driver = static args = uid=eric gid=users home=/home/eric/.mail/%d/%n username_format=%u default_fields = mail=maildir:/home/eric/.mail/%d/%n/mail } And /etc/dovecot/passwd: eric@ericabrahamsen.net:{PLAIN}password:eric@ericabrahamsen.net Say I want to keep my existing mail where it is, and have all the new mail go into ~/.mail/ericabrahamsen.net/eric-new/mail. Ie, when mbsync connects to the local Dovecot, it does so with the username eric-new(a)ericabrahamsen.net. Now, in Dovecot's conf, do I change the email address in the first field of /etc/dovecot/passwd, or the third field, or both? And, if it isn't too much trouble, what is the difference between the two? Thanks! Eric

1 0

Dsync induces redundant mail after rapid append/expunge repeatedly
by 潘信傑 02 Mar '16

02 Mar '16

I meet the problem about dsync with expunge. The problems is expunged mail would reappear after dsyncing and it is easily to reproduce. Environment Settings: - Two servers(serverA, serverB) both enabled plugin "*replication"* - And more detail get by "dovecot -n" show below Reproduce flow: - Run two processes pA and pB both would run in while loop - pA(All behavior is on Draft mailbox and all on serverA): - Clean "Draft" mailbox of userA - Run the following imap command of userA - imap save (save new mail to Draft) - imap delete (delete old mail on Draft) - imap expunge * - Check if draft only have one email (it would be failed in about 50 loops)* - pB(Send mail to serverB): - Send new mail to userA (which would be save in INBOX) It would be easier reproduce by increasing server loading. I have found something - T he expunge changes from server A in dsync connection don't send immediately, these expunge changes appear after 1~2 dsync connection over. - The replicated mail is generated from serverB and sync back to serverA so expunged mail reappeared. dovecot -n (ServerA) # 2.2.19: /etc/dovecot/dovecot.conf # OS: Linux 3.10.77 x86_64 ext4 auth_mechanisms = plain login default_internal_user = root default_login_user = dovecot default_vsz_limit = 0 disable_plaintext_auth = no doveadm_password = # hidden, use -P to show it dsync_remote_cmd = ssh -l%{login} %{host} doveadm dsync-server -u%u dsync_target_servers = tcps:10.13.23.139:24245 lda_mailbox_autocreate = yes mail_debug = yes mail_fsync = never mail_location = maildir:/var/spool/mail/%d/%-4.04i/%i/Maildir mail_max_userip_connections = 30 mail_never_cache_fields = * mail_plugins = " notify replication mail_log" managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave duplicate namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { driver = pam } plugin { fts = lucene fts_autoindex = yes fts_lucene = whitespace_chars=@._/\~&,()[]" mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename flag_change append mail_log_fields = uid box msgid size flags from subject } postmaster_address = postmaster@localhost protocols = imap pop3 lmtp imap pop3 sieve replication_dsync_parameters = -N -l 30 -U service aggregator { fifo_listener replication-notify-fifo { group = users mode = 0666 user = admin } unix_listener replication-notify { group = users mode = 0666 user = admin } } service doveadm { inet_listener { address = 10.13.23.136,127.0.0.1 port = 24245 ssl = yes } } service imap-login { inet_listener imap { address = 10.13.23.136,127.0.0.1 port = 143 } inet_listener imaps { address = 10.13.23.136,127.0.0.1 port = 993 ssl = yes } process_limit = 256 service_count = 0 } service indexer-worker { process_limit = 8 } service pop3-login { inet_listener pop3 { address = 10.13.23.136,127.0.0.1 port = 110 } inet_listener pop3s { address = 10.13.23.136,127.0.0.1 port = 995 ssl = yes } process_limit = 256 service_count = 0 } service replicator { unix_listener replicator-doveadm { mode = 0666 } } userdb { driver = passwd } protocol lda { mail_plugins = " notify replication mail_log sieve" } dovecot -n (ServerB) $ ./sbin/dovecot -n # 2.2.19: /etc/dovecot/dovecot.conf # OS: Linux 3.10.77 x86_64 auth_mechanisms = plain login default_internal_user = root default_login_user = dovecot default_vsz_limit = 0 disable_plaintext_auth = no doveadm_password = # hidden, use -P to show it dsync_remote_cmd = ssh -l%{login} %{host} doveadm dsync-server -u%u dsync_target_servers = tcps:10.13.23.136:24245 lda_mailbox_autocreate = yes mail_debug = yes mail_fsync = always mail_location = maildir:/var/spool/mail/%d/%-4.04i/%i/Maildir mail_max_userip_connections = 30 mail_never_cache_fields = * mail_plugins = " notify replication mail_log" managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational reg ex imap4flags copy include variables body enotify environment mailbox date ihave duplicate namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { driver = pam } plugin { fts = lucene fts_autoindex = yes fts_lucene = whitespace_chars=@._/\~&,()[]" mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename flag_change append mail_log_fields = uid box msgid size flags from subject } postmaster_address = postmaster@localhost protocols = imap pop3 lmtp imap pop3 sieve replication_dsync_parameters = -N -l 30 -U service aggregator { fifo_listener replication-notify-fifo { group = users mode = 0666 user = admin } unix_listener replication-notify { group = users mode = 0666 user = admin } } service doveadm { inet_listener { address = 10.13.23.139,127.0.0.1 port = 24245 ssl = yes } } service imap-login { inet_listener imap { address = 10.13.23.139,127.0.0.1 port = 143 } inet_listener imaps { address = 10.13.23.139,127.0.0.1 port = 993 ssl = yes } process_limit = 256 service_count = 0 } service indexer-worker { process_limit = 4 } service pop3-login { inet_listener pop3 { address = 10.13.23.139,127.0.0.1 port = 110 } inet_listener pop3s { address = 10.13.23.139,127.0.0.1 port = 995 ssl = yes } process_limit = 256 service_count = 0 } service replicator { unix_listener replicator-doveadm { mode = 0666 } } userdb { driver = passwd } protocol lda { mail_plugins = " notify replication mail_log sieve" } Regards, Jay Pan

2 2

Setup changes 1.x to 2.x -- custom POP3 account handling required.
by Andrew McGlashan 02 Mar '16

02 Mar '16

Hi, Previously I did /special/ processing for some email accounts; if a particular file existed in the user's home directory, then I caused the account to use /var/mail/$USER file for POP -- otherwise it used IMAP. Now, because I adjusted the setup for POP only, IMAP still worked perfectly well. Some users have both POP and IMAP access for various reasons. The special POP processing was done using a shell script [1] in place of: /usr/lib/dovecot/pop3 - which in turn called the normal binary once setting up the environment. Now, I have been forced to upgrade my Debian from squeeze-lts to wheezy and the dovecot setup is quite different. How can I implement my /wrapper/ script for POP handling now? Here is my current setup with dovecot -n ... # 2.1.7: /etc/dovecot/dovecot.conf # OS: Linux 2.6.32-5-xen-amd64 x86_64 Debian 7.9 mail_location = maildir:~/Maildir namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Items" { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { driver = pam } plugin { sieve = ~/.dovecot.sieve sieve_dir = ~/sieve } protocols = " imap pop3" service imap-login { inet_listener imap { port = 0 } } service pop3-login { inet_listener pop3 { port = 0 } } ssl = required ssl_cert = </etc/exim4/exim.crt ssl_key = </etc/exim4/exim.key userdb { driver = passwd } [1] This is the content of the original wrapper script: #!/bin/sh if [ -f $HOME/.use-mbox-for-pop3s ]; then export MAIL=mbox:$HOME/mail:INBOX=/var/mail/$USER export USER_INBOX=/var/mail/$USER if [ -f $USER_INBOX ] then export USER_INBOX_GROUP=$(stat -c %G $USER_INBOX) if [ $USER_INBOX_GROUP != $USER ] then ( date ls -l $USER_INBOX chown Debian-exim:$USER $USER_INBOX ls -l $USER_INBOX ) >> /var/log/usr-lib-dovecot--pop3-affinity.log fi fi else if [ -d $HOME/Maildir ]; then export MAIL=Maildir:$HOME/Maildir else export MAIL=mbox:$HOME/mail:INBOX=/var/mail/$USER fi fi # Finally execute the imap/pop3. If you use both, you'll need two scripts. # - this customization just for POP3S ... exec /usr/lib/dovecot/pop3 Thanks AndrewM

2 2

dsync issues due to Prefix difference?
by Mark Little 02 Mar '16

02 Mar '16

Hi everyone, I'm hoping I am just missing something obvious - but I cannot seem to get a one-way migration dsync working between two Dovecot servers because the Prefix configuration is different. I am doing a migration from our old Dovecot servers to some new cPanel based ones. Source: 2.2.15 Dest: 2.2.21 Here is the debug output for the sync: doveadm(root): Debug: Loading modules from directory: /usr/lib/dovecot/modules/doveadm doveadm(root): Debug: Module loaded: /usr/lib/dovecot/modules/doveadm/lib10_doveadm_sieve_plugin.so doveadm(testuser(a)example.ca): Debug: Effective uid=1322, gid=1322, home=/khstor3/khmail-mailboxes/l/li/example.ca/testuser doveadm(testuser(a)example.ca): Debug: Namespace inbox: type=private, prefix=, sep=, inbox=yes, hidden=no, list=yes, subscriptions=yes location=maildir:~/Maildir doveadm(testuser(a)example.ca): Debug: maildir++: root=/khstor3/khmail-mailboxes/l/li/example.ca/testuser/Maildir, index=, indexpvt=, control=, inbox=/khstor3/khmail-mailboxes/l/li/example.ca/testuser/Maildir, alt= doveadm(testuser(a)example.ca): Debug: Namespace : Using permissions from /khstor3/khmail-mailboxes/l/li/example.ca/testuser/Maildir: mode=0777 gid=default stdin: is not a tty dsync-local(testuser(a)example.ca): Debug: brain M: Local mailbox tree: INBOX guid=f055ac07d79cad508a7a000075e38adc uid_validity=1353555159 uid_next=2085 subs=no last_change=0 last_subs=0 dsync-local(testuser(a)example.ca): Debug: brain M: Local mailbox tree: Junk guid=703a8b1d51ceab56f91e0000667eee40 uid_validity=1391566942 uid_next=1 subs=yes last_change=0 last_subs=1454100049 dsync-local(testuser(a)example.ca): Debug: brain M: Local mailbox tree: Trash guid=9bee9f0f2aacb65039260000b171e44d uid_validity=1353555163 uid_next=25 subs=no last_change=0 last_subs=0 dsync-local(testuser(a)example.ca): Debug: brain M: Local mailbox tree: Drafts guid=4d03661058a0f1524f240000e9d81ad0 uid_validity=1391566936 uid_next=1 subs=no last_change=0 last_subs=0 dsync-local(testuser(a)example.ca): Debug: brain M: Local mailbox tree: Sent guid=99ee9f0f2aacb65039260000b171e44d uid_validity=1353555161 uid_next=4 subs=no last_change=0 last_subs=0 dsync-local(testuser(a)example.ca): Debug: brain M: Remote mailbox tree: INBOX guid=6460141741cfab5643470000afb0d608 uid_validity=1454100291 uid_next=2064 subs=no last_change=0 last_subs=0 dsync-local(testuser(a)example.ca): Debug: brain M: Remote mailbox tree: INBOX.Trash guid=6360141741cfab5643470000afb0d608 uid_validity=1454100290 uid_next=12 subs=yes last_change=0 last_subs=1454100289 dsync-local(testuser(a)example.ca): Debug: brain M: Remote mailbox tree: INBOX.Sent guid=6260141741cfab5643470000afb0d608 uid_validity=1454100289 uid_next=2 subs=yes last_change=0 last_subs=1454100289 dsync-remote(testuser(a)example.ca): Error: Couldn't find namespace for mailbox Junk I believe the problem is because on the source we have no prefix set, but on the destination it has INBOX as the prefix. I need to use dsync because we have many POP3 clients so I need to ensure the UIDL's are copied correctly. Here is the output from 'doveconf namespace': Source: namespace inbox { disabled = no hidden = no ignore_on_failure = no inbox = yes list = yes location = mailbox Drafts { auto = subscribe driver = special_use = \Drafts } mailbox Junk { auto = subscribe driver = special_use = \Junk } mailbox Sent { auto = subscribe driver = special_use = \Sent } mailbox "Sent Messages" { auto = no driver = special_use = \Sent } mailbox Trash { auto = subscribe driver = special_use = \Trash } order = 0 prefix = separator = subscriptions = yes type = private } Destination: namespace { disabled = no hidden = no ignore_on_failure = no inbox = yes list = yes location = mailbox Archive { auto = create autoexpunge = 0 comment = driver = special_use = \Archive } mailbox Archives { auto = no autoexpunge = 0 comment = driver = special_use = \Archive } mailbox Drafts { auto = subscribe autoexpunge = 0 comment = driver = special_use = \Drafts } mailbox Junk { auto = create autoexpunge = 0 comment = driver = special_use = \Junk } mailbox Sent { auto = subscribe autoexpunge = 0 comment = driver = special_use = \Sent } mailbox "Sent Messages" { auto = no autoexpunge = 0 comment = driver = special_use = \Sent } mailbox Trash { auto = subscribe autoexpunge = 0 comment = driver = special_use = \Trash } order = 0 prefix = INBOX. separator = subscriptions = yes type = private } If anyone could provide some assistance it would be greatly appreciated! Thanks, Mark

2 6

where is pop3_migration_ignore_missing_uidls=yes set?
by Leon Kyneur 02 Mar '16

02 Mar '16

While doing pop3 migrations with dsync I am getting an error: dsync(user(a)domain.net): Error: pop3_migration: 2 POP3 messages have no matching IMAP messages (first POP3 msg 2638 UIDL fb3d6f3299541e695a28585f5803ed1c) - set pop3_migration_ignore_missing_uidls=yes to continue anyway dsync(user(a)domain.net): Error: Exporting mailbox INBOX failed: Can't lookup pop3-uidl for UID=3252: POP3 UIDLs couldn't be synced Can't see this is doveconf -a so it's not a setting? - tried configuring it as a plugin setting but that didn't work... Where is the correct place to set this? TIA

2 1

Alternative storage backend for Dovecot
by Oleksandr Natalenko 01 Mar '16

01 Mar '16

Hi. We have corporate Dovecot setup with GlusterFS as file storage. We store maildirs on GlueterFS share, mounting it via NFS. Mounting share via native GlusterFS FUSE client introduces visible performance overhead. Also, NFS mount does not provide us with HA. That's why I have an idea to use GlusterFS C API to access maildirs share. I'd like to preserve maildir structure, but get access to it not via FS mount point but with GlusterFS C API calls. I've discovered that Dovecot source tree has src/lib-fs infrastructure with fs-posix implemented on top of it. Is that the right place to start from? GlusterFS C API calls are POSIX-like, so they could be easily used as substitutions for VFS ops. Could such a backend be implemented as separate plugin? Are there any examples of alternative storage backend to look at? Thanks. Regards, Oleksandr.

2 1

search problem dovecot 2.2.21 + fts - Solr
by Anderson Barbosa 01 Mar '16

01 Mar '16

Hello, Realized update dovecot on my server. Now the search is returning differently from the previous version bringing reference information of other messages . For example when doing a search for anderson.joao this new version of the dovecot dovecot 2.2.21 + fts - Solr response will be all email that has the word anderson and joao, instead of returning only items with the word anderson.joao. Before used version 2.2.18 + dovecot fts - Solr and the problem did not occur . For example practical test : Dovecot 2.2.18 # telnet SERVER 143 Trying SERVER... Connected to SERVER. Escape character is '^]'. * OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE AUTH=PLAIN] Zimbra IMAP4. a login conta(a)conta.com.br 1223456 a OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE SORT SORT=DISPLAY THREAD=REFERENCES THREAD=REFS THREAD=ORDEREDSUBJECT MULTIAPPEND URL-PARTIAn a select INBOX * FLAGS (\Answered \Flagged \Deleted \Seen \Draft) * OK [PERMANENTFLAGS (\Answered \Flagged \Deleted \Seen \Draft \*)] Flags permitted. * 14 EXISTS * 0 RECENT * OK [UIDVALIDITY 1452548222] UIDs valid * OK [UIDNEXT 25] Predicted next UID * OK [HIGHESTMODSEQ 52] Highest a OK [READ-WRITE] Select completed (0.001 secs). a SEARCH text "anderson" * SEARCH 11 12 (2 found emails) a OK Search completed (0.265 secs). a SEARCH text "joao" * SEARCH 13 14 (2 found emails) a OK Search completed (0.003 secs). a SEARCH text "anderson.joao" * SEARCH (0 found emails) a OK Search completed (0.004 secs). a logout * BYE Logging out a OK Logout completed. Connection closed by foreign host. Dovecot 2.2.21 # telnet SERVER 143 Trying SERVER... Connected to SERVER. Escape character is '^]'. * OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE AUTH=PLAIN] Zimbra IMAP4. a login conta(a)conta.com.br 1223456 a OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE SORT SORT=DISPLAY THREAD=REFERENCES THREAD=REFS THREAD=ORDEREDSUBJECT MULTIAPPEND URL-PARTIAn a select INBOX * FLAGS (\Answered \Flagged \Deleted \Seen \Draft) * OK [PERMANENTFLAGS (\Answered \Flagged \Deleted \Seen \Draft \*)] Flags permitted. * 14 EXISTS * 0 RECENT * OK [UIDVALIDITY 1452548222] UIDs valid * OK [UIDNEXT 25] Predicted next UID * OK [HIGHESTMODSEQ 52] Highest a OK [READ-WRITE] Select completed (0.000 + 0.000 secs). a SEARCH text "anderson" * SEARCH 11 12 (2 found emails) a OK Search completed (0.004 + 0.000 secs). a SEARCH text "joao" (2 found emails) * SEARCH 13 14 a OK Search completed (0.005 + 0.000 secs). a SEARCH text "anderson.joao" * SEARCH 11 12 13 14 *(4 found emails)* a OK Search completed (0.005 + 0.000 secs). a logout * BYE Logging out a OK Logout completed. Connection closed by foreign host. Even using characters Special "" \ scape, ' ' for an answer will always be all emails with the word anderson and joao. Checking the Changelog dovecot noticed que NAS versions Previous v2.2.20 and v2.2.19 certain changes with respect to fts . There Have Another way to Make Search for Exact Word In this new version to loft? -- Anderson Barbosa dos Santos Em todo o universo, nada existe de mais parecido com Deus que o silêncio. "Johanes Eckhart"

3 3

Inconsistent mdbox index while running doveadm altmove
by Ricardo Machini Barbosa 01 Mar '16

01 Mar '16

Hello, I was performing doveadm altmove for one account while this mailbox was being accessed. Dovecot version: 2.2.21 Mailbox format: mdbox Command: doveadm altmove -u user1(a)domain.com.br before 360d This command took about 5 minutes to finish and during the execution I found some log messages: Feb 25 19:57:51 dovecot: imap(user1(a)domain.com.br): Error: mdbox map /var/mail/user1/mdbox/storage/dovecot.map.index corrupted: Unexpectedly lost INBOX uid=77 map_uid=76 Feb 25 19:57:51 dovecot: imap(user1(a)domain.com.br): Internal error occurred. Refer to server log for more information. [2016-02-25 19:57:51] in=4798 out=1361819 deleted=0 expunged=0 trashed=0 Feb 25 19:57:51 dovecot: imap(user1(a)domain.com.br): Warning: fscking index file /var/mail/user1/mdbox/storage/dovecot.map.index Feb 25 19:58:15 dovecot: imap(user1(a)domain.com.br): Error: /var/mail/user1/mdbox/mailboxes/INBOX/dbox-Mails/dovecot.index reset, view is now inconsistent Feb 25 19:58:20 dovecot: imap(user1(a)domain.com.br): Error: /var/mail/user1/mdbox/mailboxes/Rascunhos/dbox-Mails/dovecot.index reset, view is now inconsistent After that these messages moved to alternate storage disappeared from the mailbox/IMAP but these files were all on alternative storage. I had to execute doveadm force-resync -u user1(a)domain.com.br INBOX to recovery this mailbox, but losing all e-mail's flags. I should do some kind of lock before running the command altmove ? Regards, Ricardo

2 1