- dovecot - dovecot.org

dovecot --hostdomain issue
by dovecot＠outputservices.com 25 Sep '15

25 Sep '15

I am on a server I called "email. But dovecot says i am on sunfire.outputservices.com ------------------------------------ dovecot --hostdomain sunfire.outputservices.com ------------------------------------ I would like to at least get it to say email.outputservices.com. But what I really want it to say is posta.outputservices.com. First where does --hostdomain get it's information so I can clear that up? Then how can I get it to identify as posta.outputservices.com? Dave Ryan dovecot(a)outputservices.com Senior System Administrator Output Services, Inc. Thursday, September 24, 2015 1124 hrs MDT ----------------------------------------------------------- doveconf -n # 2.2.15: /usr/local/tools/dovecot/etc/dovecot/dovecot.conf # OS: SunOS 5.10 i86pc base_dir = /dovecot/var/run/dovecot log_path = /dovecot/log/log login_trusted_networks = 137.106.0.0/16 mail_location = mbox:~/posta:INBOX=/var/mail/%u namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = /dovecot/etc/dovecot/conf.d/ldap.settings driver = ldap } protocols = imap service auth { unix_listener /postfix/mqueue/private/auth { group = postfix mode = 0660 user = postfix } } service imap-login { inet_listener imap { port = 143 } inet_listener imaps { port = 993 } } ssl_cert = </dovecot/certs/dovecot.pem ssl_key = </dovecot/certs/dovecot.key ssl_prefer_server_ciphers = yes ssl_protocols = !SSLv2 !SSLv3 userdb { args = /dovecot/etc/dovecot/conf.d/ldap.settings driver = ldap } -----------------------------------------------------------

2 1

Released Pigeonhole v0.4.9.rc1 for Dovecot v2.2.19.rc1
by Stephan Bosch 25 Sep '15

25 Sep '15

Hello Dovecot users, Here's the Pigeonhole RC that goes with the Dovecot RC. Changelog v0.4.9.rc1: * Properly implemented checking of ABI version for Sieve interpreter plugins, much like Dovecot itself does for plugins. This will prevent plugin ABI mismatches. + Implemented a vnd.dovecot.environment extension. This builds upon the standard environment extension and adds a few more environment items, such as username and default mailbox. It also creates a variables namespace so that environment items can be accessed directly. I am still thinking about more environment items that can be added. + Sieve extprograms plugin: Made line endings of the input passed to the external programs configurable. This can be configured separately for each of the three extensions. + ManageSieve: Implemented proxy XCLIENT support. This allows the proxy to pass client information to the back-end. - ManageSieve: Fixed an assert failure occurring when a client disconnects during the GETSCRIPT command. - doveadm sieve plugin: Fixed incorrect initialization of mail user. This caused a few memory leaks. - sieve-filter command line tool: Fixed handling of failure-related implicit keep when there is an explicit default destination folder. This caused message duplication. - lib-sieve: Fixed bug in RFC5322 header folding. Words longer than the optimal line length caused empty lines in the output, which would break the resulting message header. This surfaced in References: headers with very long message IDs. The release is available as follows: http://pigeonhole.dovecot.org/releases/2.2/dovecot-2.2-pigeonhole-0.4.9.rc1… http://pigeonhole.dovecot.org/releases/2.2/dovecot-2.2-pigeonhole-0.4.9.rc1… Refer to http://pigeonhole.dovecot.org and the Dovecot v2.x wiki for more information. Have fun testing this new release and don't hesitate to notify me when there are any problems. Regards, -- Stephan Bosch stephan(a)rename-it.nl

1 0

FTS not indexing new folders (mailboxes)
by Francisco Wagner C. Freire 24 Sep '15

24 Sep '15

Hello, Im getting problem on FTS on new created folders (mailboxes). How to simulate: - Enable FTS (solr on our case) - Create a new folder (mailbox) - Move some message to that mailbox - Try to search for the message contents *doveadm search -u user@domain text sometext* # Found nothing, but if i move the message to another mailbox, the search catch the message. # I tried doveadm index command but no response as well # This works only after a full fts rescan *doveadm fts rescan -u user@domain* # And now, works *doveadm search -u user@domain text sometext3c7b60241443ba55af680000cc4d0d4b 1* # My dovecot version = 2.2.18 (EE) # My fts config: fts = solr fts_autoindex = yes fts_autoindex_max_recent_msgs = 50 fts_solr = url=http://127.0.0.1:8080/solr/ Anyone got this problem?

3 2

Can't receive email
by lists＠lazygranch.com 24 Sep '15

24 Sep '15

No problem sending email, but I can't receive email. Diagnostics follow: a login user(a)domain.com password a OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE SORT SORT=DISPLAY THREAD=REFERENCES THREAD=REFS THREAD=ORDEREDSUBJECT MULTIAPPEND URL-PARTIAL CATENATE UNSELECT CHILDREN NAMESPACE UIDPLUS LIST-EXTENDED I18NLEVEL=1 CONDSTORE QRESYNC ESEARCH ESORT SEARCHRES WITHIN CONTEXT=SEARCH LIST-STATUS BINARY MOVE SPECIAL-USE] Logged in b select inbox * FLAGS (\Answered \Flagged \Deleted \Seen \Draft) * OK [PERMANENTFLAGS (\Answered \Flagged \Deleted \Seen \Draft \*)] Flags permitted. * 9 EXISTS * 1 RECENT * OK [UNSEEN 9] First unseen. * OK [UIDVALIDITY 1439944213] UIDs valid * OK [UIDNEXT 10] Predicted next UID * OK [HIGHESTMODSEQ 2] Highest b OK [READ-WRITE] Select completed (0.017 secs). c list "" * * LIST (\HasNoChildren \Trash) "." Trash * LIST (\HasNoChildren) "." Queue * LIST (\HasNoChildren \Sent) "." Sent * LIST (\HasNoChildren \Drafts) "." Drafts * LIST (\HasNoChildren) "." INBOX c OK List completed (0.001 secs). d lsub "" * * LSUB (\Trash) "." Trash * LSUB () "." Queue * LSUB (\Sent) "." Sent * LSUB (\Drafts) "." Drafts d OK Lsub completed (0.003 secs). e logout * BYE Logging out e OK Logout completed. closed --------------------------------------- from dovecot.log Sep 19 23:35:13 imap-login: Debug: SSL: where=0x10, ret=1: before/accept initialization [xxx.xxx.xxx.xxx] Sep 19 23:35:13 imap-login: Debug: SSL: where=0x2001, ret=1: before/accept initialization [xxx.xxx.xxx.xxx] Sep 19 23:35:13 imap-login: Debug: SSL: where=0x2002, ret=-1: SSLv2/v3 read client hello A [xxx.xxx.xxx.xxx] Sep 19 23:35:13 auth: Debug: Loading modules from directory: /usr/local/lib/dovecot/auth Sep 19 23:35:13 auth: Debug: Read auth token secret from /var/run/dovecot/auth-token-secret.dat Sep 19 23:35:13 auth: Debug: passwd-file /usr/local/etc/dovecot/users: Read 2 users in 0 secs Sep 19 23:35:13 auth: Debug: auth client connected (pid=1698) Sep 19 23:38:13 imap-login: Info: Disconnected: Inactivity (no auth attempts in 180 secs): user=<>, rip=xxx.xxx.xxx.xxx, lip=xxx.xxx.xxx.xxx, TLS handshaking, session=<MghMJCIgiACsOCYK> -------------------------------- # dovecot -n # 2.2.18: /usr/local/etc/dovecot/dovecot.conf # Pigeonhole version 0.4.8 (0c4ae064f307+) # OS: FreeBSD 10.1-RELEASE-p19 amd64 auth_debug = yes auth_debug_passwords = yes auth_verbose = yes log_path = /var/log/dovecot.log mail_debug = yes mail_gid = 1003 mail_home = /var/mail/vhosts/%d/%n mail_location = maildir:~ mail_privileged_group = vpostfix mail_uid = 1003 managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = scheme=CRYPT username_format=%u /usr/local/etc/dovecot/users driver = passwd-file } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0666 user = postfix } unix_listener auth-userdb { group = postfix mode = 0600 user = postfix } } ssl_cert = </usr/local/etc/ipsec.d/certs/domain.com.crt ssl_key = </usr/local/etc/ipsec.d/private/domain.com.key userdb { args = username_format=%u /usr/local/etc/dovecot/users driver = passwd-file } verbose_ssl = yes # -------------------------- # dovecot --version 2.2.18‎ ‎

2 2

dict lookup from quota plugin
by Bjørnar Ness 23 Sep '15

23 Sep '15

I am having trouble with using a custom daemon listening on a socket together with the quota plugin. My configuration is: quota = dict:User quota::dict:/tmp/dovecot-proxy-dict:: The problem is that dovecot sends keys without usernames, for example: priv/quota/storage Is it possible to get around this limitation without code modification? Also, is it planned to support the "new-style" userdb/passdb lookups from other plugins? -- Bj(/)rnar

2 1

bug - over system quota and dovecot-uidlist
by krzf83＠gmail.com 23 Sep '15

23 Sep '15

Ever since I've migraded from courier pop3 to dovecot pop3 I'm constantly getting complains from users that went over system quota for short while and then their pop3 client downloads all messages again. I never happened with courier pop3. I think that dovecot does not handle dovecot-uidlist file safely so it can withstand such situations. rsync and other similar programs always writes to a copy of the file like dovecot-uidlis.xcb453 and on success unlinks old file and renames new one. Dovecot should not assume that write operation on dovecot-uidlist will succeed. Yes, I know I can put metadata like dovecot-uidlist somewhere else, on another partition but that really splits mailbox into multiple locations making for example backups way harder to make, restore, share etc.

2 1

Dovecot proxy ignores trusted root certificate store
by Alex Bulan 22 Sep '15

22 Sep '15

Dovecot v2.2.18 OS: FreeBSD 10.1/amd64 Dovecot in proxy mode ignores the root certificate store and can't verify the backend's SSL certificate. I've pointed ssl_client_ca_file to my root certificate store, but I suspect ssl_client_ca_file is only used in imapc context. It seems to be ignored in proxy context. doveconf -n ssl_client_ca_file: ssl_client_ca_file = /usr/local/share/certs/ca-root-nss.crt In my password_query I return host set to the backend's IP address, starttls='yes', proxy='y'. The backend's certificate chain is correct and it verifies successfully with "openssl s_client -connect x.x.x.x:110 -starttls pop3 -CAfile /usr/local/share/certs/ca-root-nss.crt". But the Dovecot proxy fails to verify the intermediate certificate it receives from the backend. The inode atime of ca-root-nss.crt is never updated, either at Dovecot start or when it connects to the backend, so Dovecot (via the openssl library) never reads the file. Sep 20 19:59:48 dovecot: pop3-login: Invalid certificate: unable to get local issuer certificate: /C=US/O=GeoTrust Inc./OU=Domain Validated SSL/CN=GeoTrust DV SSL CA - G4 Sep 20 19:59:48 dovecot: pop3-login: Invalid certificate: certificate not trusted: /C=US/O=GeoTrust Inc./OU=Domain Validated SSL/CN=GeoTrust DV SSL CA - G4 Sep 20 19:59:48 dovecot: pop3-login: Error: proxy: Received invalid SSL certificate from x.x.x.x:110: unable to get local issuer certificate: /C=US/O=GeoTrust Inc./OU=Domain Validated SSL/CN=GeoTrust DV SSL CA - G4: user=<xxx>, method=PLAIN, rip=x.x.x.x, lip=x.x.x.x, session=<lz9YjzYgIADYyWAp>

6 13

2.2.18 Regression: Incorrect STATUS response for virtual mailboxes
by Guilhem Moulin 22 Sep '15

22 Sep '15

As shown below, adding a message to TRASH doesn't increase virtual/test's MESSAGES count. However SELECTing virtual/test triggers the increase; so does running `doveadm mailbox status vsize virtual/test` in another shell. $ mkdir -m0700 ~/mail/virtual/test $ echo -e "TRASH\n\tall" > ~/mail/virtual/test/dovecot-virtual $ /usr/lib/dovecot/imap S: * PREAUTH [CAPABILITY IMAP4rev1 … ] Logged in as guilhem C: a STATUS TRASH (MESSAGES UIDNEXT UNSEEN) C: b STATUS virtual/test (MESSAGES UIDNEXT UNSEEN) S: * STATUS TRASH (MESSAGES 5599 UIDNEXT 5619 UNSEEN 0) S: a OK Status completed (0.001 secs). S: * STATUS virtual/test (MESSAGES 5599 UIDNEXT 5600 UNSEEN 0) S: b OK Status completed (0.032 secs). C: c APPEND TRASH {1+} S: x S: c OK [APPENDUID 1442277584 5619] Append completed (0.029 secs). C: d STATUS TRASH (MESSAGES UIDNEXT UNSEEN) C: e STATUS virtual/test (MESSAGES UIDNEXT UNSEEN) S: * STATUS TRASH (MESSAGES 5600 UIDNEXT 5620 UNSEEN 1) S: d OK Status completed (0.000 secs). S: * STATUS virtual/test (MESSAGES 5599 UIDNEXT 5600 UNSEEN 0) S: e OK Status completed (0.000 secs). # it doesn't help to LOGOUT and issue the STATUS command again. However, # it does to execute `doveadm mailbox status vsize virtual/test` in another # shell, or to SELECT virtual/test in the IMAP session. C: f STATUS TRASH (MESSAGES UIDNEXT UNSEEN) C: g STATUS virtual/test (MESSAGES UIDNEXT UNSEEN) S: * STATUS TRASH (MESSAGES 5600 UIDNEXT 5620 UNSEEN 1) S: f OK Status completed (0.000 secs). S: * STATUS virtual/test (MESSAGES 5600 UIDNEXT 5601 UNSEEN 1) S: g OK Status completed (0.000 secs). Cheers, -- Guilhem.

2 1

sieve_extprograms - run any individual script?
by Hajo Locke 22 Sep '15

22 Sep '15

Hello, i use sieve extension sieve_extprograms to send incoming mail to some script. For security reasons it is needed that script-paths etc. are registered in dovecot.conf This is my current dovecot.conf plugin { sieve = ~/.dovecot.sieve sieve_plugins = sieve_extprograms sieve_extensions = +vnd.dovecot.pipe +vnd.dovecot.filter +vnd.dovecot.execute sieve_pipe_bin_dir = /usr/local/bin/ sieve_filter_bin_dir = /usr/local/bin/ } .dovecot.sieve example: if address "to" "test(a)example.com" { filter "myfilter"; } This is all working without problems. Is there a possibility to allow users the execution of individual scripts in own homepath? Some people need to pipe mails to scripts for immediately processing (some ticketsystems need this). Is there a way to make this possible with sieve? Thanks, Hajo

4 4

Multiple passwords for a user (SQL)
by Marco Fretz 22 Sep '15

22 Sep '15

Hi everyone, I'm not sure if this has been discuessed already as I coun't find anything in the archives - maybe I'm looking for the wrong thing. I want to build something similar to googles "app passwords" where your use a different password (strong, auto generated) for each device / app. In general I think this is pretty easy on the database side as I just need a password table and link say the passwords with an user_id to the corresponding user in the users table - one use has many passwords (1:n). for dovecot this means that it will get multiple rows with passwords back from the "password_query". is there a way to tell dovecot to check all those returned passwords and "pass" the request if one of those passwords match? thank you, best regards Marco

2 3

[Dovecot] Pigeonhole sieve re-filter extension?
by T.B. 22 Sep '15

22 Sep '15

Dear Stephan Bosch, dear Dovecot community, "sieve-filter" re-filtering of existing mails is already a great progress for everyone using sieve! But as far as I know this functionality is just accessible by the server administrator. In the meanwhile everyone knows the comfort of re-executing filter scripts on his own existing mailboxes - triggered by himself! This service is already very widespread. Examples are MUA's like Outlook or Thunderbird which provide this service just on the client side. Or almost every web-mail provider offers this. Is there already an managesieve protocol extension that allows client triggered server side re-filtering? If not, maybe you could design a RFC for this? What do you think? Best regards. T.B.

4 8

ssl_key_password loaded from file: 'Couldn't parse private ssl_key'
by B. R. 22 Sep '15

22 Sep '15

As this is my first message to this ML: Hello! I am using a password-protected SSL key for my dovecot MDA. When I tried to use the ssl_key_password configuration directive as follow: ssl_key_password = </path/to/passfile it did not work as I logged the following: dovecot: imap-login: Error: SSL: Stacked error: error:06065064:digital envelope routines:EVP_DecryptFinal_ex:bad decrypt dovecot: imap-login: Fatal: Couldn't parse private ssl_key: error:0906A065:PEM routines:PEM_do_header:bad decrypt However, not using the fille inclusion but directly configuring as follow: ssl_key_password = mypass did work... I am loading my certificate & key with the file inclusion trick... How come cannot I use that for the password file? It would avoid input the password directly into the dovecot configuraiton files, forcing me to change permissions and duplicating it... When renewing the private key I will be force to edit the password at every location. Is it a bug? or a feature? :D --- *B. R.*

3 3

Messages lost from imap folders
by Nikolaos Milas 19 Sep '15

19 Sep '15

Hello, We have one user who is complaining that he has lost mails from 3 imap folders, administered through squirrelmail. The folders suddenly appeared unregistered, and once manually registered they were empty. Has anyone observed something like this? We are running two servers (as VMs) with Dovecot v2.2.18, synced (two-way) using dsync. The configurations follow. Can you please help me understand what may have gone wrong? Can I try to find actions regarding these folders in the logs? What should I search for? Could this be an issue involving dsync? How can I trace back dsync activity in detail? Server configs follow (I have only altered the real domain name and the login greeting.) Thanks in advance, Nick ----------------------------------------------------------------------------- SERVER 1 ----------------------------------------------------------------------------- protocols = imap pop3 login_greeting = Hello World! mail_location = maildir:~/Maildir/ mail_gid = 500 mail_uid = 500 auth_mechanisms = plain login auth_username_format = %Lu auth_verbose = yes auth_debug = no mail_debug = no disable_plaintext_auth = no mail_plugins = quota notify replication protocol imap { imap_client_workarounds = "delay-newmail" mail_plugins = quota imap_quota notify replication } protocol pop3 { mail_max_userip_connections = 3 mail_plugins = quota notify replication pop3_client_workarounds = outlook-no-nuls oe-ns-eoh pop3_uidl_format = %08Xu%08Xv } protocol lda { auth_socket_path = /var/run/dovecot/auth-master info_log_path = log_path = mail_plugins = quota notify replication postmaster_address = sysadmin(a)example.com sendmail_path = /usr/lib/sendmail } userdb { args = /etc/dovecot/dovecot-usrdb-ldap.conf driver = ldap } passdb { args = /etc/dovecot/dovecot-passdb-ldap.conf driver = ldap } dsync_remote_cmd = ssh -l root vmail1.example.com doveadm dsync-server -u%u replication_dsync_parameters = -d -N -l 30 -U plugin { mail_replica = remote:vmail@vmail1.example.com } plugin { quota = maildir:User quota quota_rule = *:storage=5G quota_rule2 = Trash:storage=+3%% quota_warning = storage=75%% quota-warning 75 %u quota_warning2 = storage=90%% quota-warning 90 %u } service quota-warning { executable = script /opt/mail1.sh user = vmail unix_listener quota-warning { user = vmail } } service aggregator { fifo_listener replication-notify-fifo { user = vmail } unix_listener replication-notify { user = vmail } } service replicator { unix_listener replicator-doveadm { mode = 0600 } } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } unix_listener auth-master { group = vmail mode = 0660 user = vmail } user = root } service imap-login { service_count = 1 vsz_limit = 64 M } service pop3-login { service_count = 1 vsz_limit = 64 M } service replicator { process_min_avail = 1 } service imap { executable = imap postlogin } service pop3 { executable = pop3 postlogin } service postlogin { executable = script-login -d rawlog unix_listener postlogin { } } ssl_ca = </etc/pki/tls/certs/chain-1552.pem ssl_cert = </etc/pki/tls/certs/cert-1552.pem ssl_key = </etc/pki/tls/private/key-1552.pem ssl_protocols = !SSLv2 !SSLv3 syslog_facility = local1 ----------------------------------------------------------------------------- SERVER 2 ----------------------------------------------------------------------------- protocols = imap pop3 login_greeting = Hello World! mail_location = maildir:~/Maildir/ mail_gid = 5000 mail_uid = 5000 auth_mechanisms = plain login auth_username_format = %Lu auth_verbose = yes disable_plaintext_auth = no mail_plugins = quota notify replication protocol imap { imap_client_workarounds = "delay-newmail " mail_plugins = quota imap_quota notify replication } protocol pop3 { mail_max_userip_connections = 3 mail_plugins = quota notify replication pop3_client_workarounds = outlook-no-nuls oe-ns-eoh pop3_uidl_format = %08Xu%08Xv } protocol lda { auth_socket_path = /var/run/dovecot/auth-master info_log_path = log_path = mail_plugins = quota notify replication postmaster_address = sysadmin(a)example.com sendmail_path = /usr/lib/sendmail } userdb { args = /etc/dovecot/dovecot-usrdb-ldap.conf driver = ldap } passdb { args = /etc/dovecot/dovecot-passdb-ldap.conf driver = ldap } dsync_remote_cmd = ssh -l root vmail.example.com doveadm dsync-server -u%u replication_dsync_parameters = -d -N -l 30 -U plugin { mail_replica = remote:vmail@vmail.example.com } plugin { quota = maildir:User quota quota_rule = *:storage=5G quota_rule2 = Trash:storage=+3%% quota_warning = storage=75%% quota-warning 75 %u quota_warning2 = storage=90%% quota-warning 90 %u } service quota-warning { executable = script /opt/mail1.sh user = vmail unix_listener quota-warning { user = vmail } } service aggregator { fifo_listener replication-notify-fifo { user = vmail } unix_listener replication-notify { user = vmail } } service replicator { unix_listener replicator-doveadm { mode = 0600 } } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } unix_listener auth-master { group = vmail mode = 0660 user = vmail } user = root } service imap-login { service_count = 1 vsz_limit = 64 M } service pop3-login { service_count = 1 vsz_limit = 64 M } service replicator { process_min_avail = 1 } ssl_ca = </etc/pki/tls/certs/chain-2228.pem ssl_cert = </etc/pki/tls/certs/cert-2228.pem ssl_key = </etc/pki/tls/private/key-2228.pem syslog_facility = local1 ssl_protocols = !SSLv2 !SSLv3 -----------------------------------------------------------------------------

1 1

Re: concerning dovecot settings for high volume server
by Rajesh M 17 Sep '15

17 Sep '15

thanks very much urban. this was very helpful. i have around 12500 users spread over 3 independent servers each having around 4000+ users i am using qmailtoaster, vpopmail, spamassassin and dovecot. in future i am planning to consolidate all using a HA cluster. if it is ok with you could you kindly share some information about your email server configuration. if you do not wish to put it on the list then you can directly email me. 1) is your email volume high ? 2) server hardware to support 28000 users 3) mailserver software - exim or postfix ??. 4) antispam software like spamassassin if any also if you have faced any email re-download issues with dovecot sometimes randomly incase of pop3 users storing emails on the server ? thanks rajesh ----- Original Message ----- From: Urban Loesch [mailto:bind@enas.net] To: dovecot(a)dovecot.org Sent: Sun, 13 Sep 2015 09:33:14 +0200 Subject: Re: concerning dovecot settings for high volume server Hi, I have running dovecot with about 28k users. Here comes my relevant config for pop3 and imap from "doveconf -n". No problems so far. -- snip -- default_client_limit = 2000 ... service imap-login { inet_listener imap { port = 143 } process_limit = 256 process_min_avail = 50 service_count = 1 } service imap { process_limit = 2048 process_min_avail = 50 service_count = 1 vsz_limit = 512 M } ... service pop3-login { inet_listener pop3 { port = 110 } process_limit = 256 process_min_avail = 25 service_count = 1 } service pop3 { process_limit = 256 process_min_avail = 25 service_count = 1 } ... protocol imap { imap_client_workarounds = tb-extra-mailbox-sep imap_id_log = * imap_logout_format = bytes=%i/%o session=<%{session}> mail_max_userip_connections = 40 mail_plugins = " quota mail_log notify zlib imap_quota imap_zlib" } ... protocol pop3 { mail_plugins = " quota mail_log notify zlib" pop3_logout_format = bytes_sent=%o top=%t/%p, retr=%r/%b, del=%d/%m, \ size=%s uidl_hash=%u session=<%{session}> } -- snip -- Regards Urban Am 12.09.2015 um 20:53 schrieb Rajesh M: > hi > > centos 6 64 bit > > hex core processor with hyperthreading ie display shows 12 cores > 16 gb ram > 600 gb 15000 rpm drive > > we are having around 4000 users on a server > > > i wish to allow 1500 pop3 and 1500 imap connections simultaneously. > > need help regarding the settings to handle the above > > imap-login, pop3-login > imap pop3 service settings > > i recently i got an error > imap-login: Error: read(imap) failed: Remote closed connection (process_limit reached?) > > > my current dovecot config file > > # 2.2.7: /etc/dovecot/dovecot.conf > # OS: Linux 2.6.32-431.23.3.el6.x86_64 x86_64 CentOS release 6.5 (Final) > auth_cache_negative_ttl = 0 > auth_cache_ttl = 0 > auth_mechanisms = plain login digest-md5 cram-md5 > default_login_user = vpopmail > disable_plaintext_auth = no > first_valid_gid = 89 > first_valid_uid = 89 > log_path = /var/log/dovecot.log > login_greeting = ready. > mail_max_userip_connections = 50 > mail_plugins = " quota" > managesieve_notify_capability = mailto > managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave > namespace { > inbox = yes > location = > prefix = > separator = . > type = private > } > passdb { > args = cache_key=%u webmail=127.0.0.1 > driver = vpopmail > } > plugin { > quota = maildir:ignore=Trash > quota_rule = ?:storage=0 > } > protocols = imap pop3 > service imap-login { > client_limit = 256 > process_limit = 400 > process_min_avail = 4 > service_count = 0 > vsz_limit = 512 M > } > service pop3-login { > client_limit = 1000 > process_limit = 400 > process_min_avail = 12 > service_count = 0 > vsz_limit = 512 M > } > ssl_cert = </var/qmail/control/servercert.pem > ssl_dh_parameters_length = 2048 > ssl_key = </var/qmail/control/servercert.pem > userdb { > args = cache_key=%u quota_template=quota_rule=*:backend=%q > driver = vpopmail > } > protocol imap { > imap_client_workarounds = delay-newmail > mail_plugins = " quota imap_quota" > } > protocol pop3 { > pop3_client_workarounds = outlook-no-nuls oe-ns-eoh > pop3_fast_size_lookups = yes > pop3_lock_session = no > pop3_no_flag_updates = yes > } > > > thanks very much, > > rajesh >

3 2

restrict map-login by geoip?
by Terry Barnum 17 Sep '15

17 Sep '15

Is there a way to restrict my user logins from a set of IPs? For example, all my users are in the US so there shouldn't be any logins from other countries. Can I tell dovecot to restrict logins to a CIDR list of US IPs? Can someone point me to docs on how to set this up? I've searched but haven't found how to accomplish this. Thanks, -Terry Terry Barnum digital OutPost http://www.dop.com

4 5

New created users can not log in
by Ferdinand Gruber 17 Sep '15

17 Sep '15

Hi, I am using dovecot 2.2 for some time. All users on the system can log in using Horde Webmail. But now, after creating a new user on the server with <useradd -m username> this new user is not able to log in. Of course I have set a password for the new user. In the log file I can see: Sep 16 23:04:05 servername auth: gkr-pam: error looking up user information Sep 16 23:04:07 servername HORDE: [imp] [login] Authentication failed. [pid 1584 on line 730 of "/srv/www/htdocs/horde/imp/lib/Imap.php"] Sep 16 23:04:07 servername HORDE: [imp] FAILED LOGIN for calendar (93.82.157.132) to {imap://localhost/} [pid 1584 on line 157 of "/srv/www/htdocs/horde/imp/lib/Auth.php"] Sep 16 23:04:07 servername HORDE: [horde] FAILED LOGIN for calendar to horde (93.82.157.132) [pid 1584 on line 199 of "/srv/www/htdocs/horde/login.php"] Please give me a hint. -- Ferdinand

2 2

How to "Windows Authenticate"
by Mark Foley 17 Sep '15

17 Sep '15

I've been using Dovecot 2.2.15 as the IMAP server for Outlook (2010/2013) on Windows workstations for over 6 months with no problems. Dovecot is hosted on the office Samba4 AC/DC server. I have been using auth_mechanisms plain login, and passdb driver = shadow. What I'd like to do now is use the "Windows Authenticated" login so I don't have to have separate passwords for users logging into the Windows AD workstations and their Outlook clients. If anyone has actually done this I'd appreciate some tips. My various attempts have not been successful. Here is my current config: $ doveconf -n # 2.2.15: /usr/local/etc/dovecot/dovecot.conf # OS: Linux 3.10.17 x86_64 Slackware 14.1 auth_debug_passwords = yes auth_mechanisms = plain login auth_verbose = yes auth_verbose_passwords = plain disable_plaintext_auth = no info_log_path = /var/log/dovecot_info mail_location = maildir:~/Maildir passdb { driver = shadow } protocols = imap ssl_cert = </etc/ssl/certs/OHPRS/GoDaddy/Apache/c5fe0cc8242d6030.crt ssl_key = </etc/ssl/certs/OHPRS/GoDaddy/mail.ohprs.org.key userdb { driver = passwd } verbose_ssl = yes Thanks, Mark Foley

4 17

FreeBSD 10 & default_vsz_limit causing reboots?
by Rick Romero 15 Sep '15

15 Sep '15

Ok, So this is really more of an observation than anything else. I had a FreeBSD 10.1 server that was running great. Some SSL issue came up, or I upgrade Dovecot in ports - something occurred and the machine started rebooting randomly. It would run for 2 weeks, then reboot. It might run for 5 days and then reboot. So I started doing more FreeBSD upgrades, thinking it was a kernel issue. The reboots only increased. This weekend I started thinking I might actually be having hardware issues. But, since I don't have easy physical access to the box and it's REALLY under loaded, I figured what the hell and upraded to 10.2 on Sunday. I think it rebooted 4 times after that on Sunday, and then another 2 times Monday morning. Its worth noting that while I have crash dumps enabled, they don't seem to be occurring. So hardware is still a possibility. After the 2nd Monday morning reboot, I started to wonder if there was some sort of process issue. Besides the OS upgrades - I had been monitoring the Dovecot logs for when the process limits are reached, and increasing them. It's a 'big' box, and load is typically between .30 and .50. CPUs aren't overtaxed, and most of the memory is dedicated to ZFS. The reboots are so short, I've only received one 'down' alert due to them. So it's a conerning issue, but not really impacting production. On a whim I changed my default_vsz_limit (as I had been increasing every other limit but that) from 384M to 512M. The system hasn't rebooted in 24hours. Now that could be a coincidence, but I thought I'd at least put it out there. If you see anything weird in my dovecot config, let me know - My config was originally vpopmail, but over time I've migrated to SQL-only. root@romulus:/usr/local/etc/dovecot # dovecot -n # 2.2.18: /usr/local/etc/dovecot/dovecot.conf # OS: FreeBSD 10.2-RELEASE amd64 auth_master_user_separator = * auth_mechanisms = plain login auth_username_translation = %@ auth_verbose = yes default_login_user = dovecot default_vsz_limit = 512 M disable_plaintext_auth = no first_valid_gid = 89 first_valid_uid = 89 last_valid_gid = 89 last_valid_uid = 89 log_path = /dev/stderr login_greeting = Ready. login_trusted_networks = 172.16.100.0/24 mail_fsync = never mail_plugins = " quota zlib stats" mail_privileged_group = mail namespace compat { alias_for = hidden = yes inbox = no list = no location = prefix = INBOX. separator = . } namespace inbox { inbox = yes location = prefix = separator = . } passdb { args = /usr/local/etc/dovecot/dovecot-master-sql.conf driver = sql master = yes pass = yes } passdb { args = /usr/local/etc/dovecot/dovecot-sql.conf driver = sql } plugin { quota = maildir quota_rule = Trash:storage=+10%% stats_refresh = 30 secs stats_track_cmds = yes } protocols = imap pop3 service anvil { client_limit = 3175 } service auth { client_limit = 3684 unix_listener auth-master { mode = 0600 } } service imap-login { process_limit = 1536 process_min_avail = 25 service_count = 1 } service imap-postlogin { executable = script-login rawlog /usr/local/etc/dovecot/lastauth-imap.sh user = vpopmail } service imap { executable = /usr/local/libexec/dovecot/imap imap-postlogin process_limit = 1536 } service pop-postlogin { executable = script-login /usr/local/etc/dovecot/lastauth-pop.sh user = vpopmail } service pop3-login { process_limit = 1536 process_min_avail = 15 service_count = 1 } service pop3 { executable = /usr/local/libexec/dovecot/pop3 pop-postlogin } service stats { fifo_listener stats-mail { mode = 0600 user = vpopmail } } shutdown_clients = no ssl_cert = </etc/ssl/mail.pem ssl_key = </etc/ssl/mail.key ssl_key_password = na userdb { driver = prefetch } verbose_proctitle = yes protocol imap { imap_client_workarounds = delay-newmail tb-extra-mailbox-sep mail_max_userip_connections = 100 mail_plugins = " quota zlib stats imap_zlib quota imap_quota" } protocol pop3 { mail_max_userip_connections = 100 mail_plugins = quota pop3_client_workarounds = outlook-no-nuls oe-ns-eoh pop3_uidl_format = %08Xu%08Xv }

3 5

Dovecot does not accept new connection with error "imap-login: Error: read(anvil) failed: EOF"
by Julien Fastré 14 Sep '15

14 Sep '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Hi, First of all, thank you for the work the contributors are doing with Dovecot ! Dovecot is doing a great job ! I am encountering a problem with a configuration and, despite my search on the web, I do not find any solution for this problem. Dovecot seems to stop accepting new connection. The users : - - can not save sent messages to "Sent" folder (using Thunderbird) ; - - can not connect or retrieve message from webmail (using sogo or roundcube) In the log, I see this error : > Jun 30 13:54:53 mail dovecot: imap-login: Error: read(anvil) > failed: EOF Jun 30 13:54:53 mail dovecot: message repeated 2 times: > [ imap-login: Error: read(anvil) failed: EOF] (the message may be repeated more than 2 times) It happens... sometimes. Manually restarting the dovecot service make the software working again. By searching on the web, I regularly see this statement in logs : > dovecot: auth: Error: read(anvil-auth-penalty) failed: EOF like here : http://www.dovecot.org/list/dovecot/2010-November/054694.htm l But it doesn't seem to be the same problem as mine (anvil / anvil-auth-penalty). The problem happens during peak load. Sometimes it happens twice a week, sometimes it may spent two month without any problem (during holidays, I did not had any problem). My configuration : > # doveconf -n # 2.2.9: /etc/dovecot/dovecot.conf # OS: Linux > 3.13.0-49-generic x86_64 Ubuntu 14.04.3 LTS login_trusted_networks > = 10.0.3.0/24 mail_location = mbox:~/mail:INBOX=/var/mail/%u > mail_plugins = quota acl managesieve_notify_capability = mailto > managesieve_sieve_capability = fileinto reject envelope > encoded-character vacation subaddress comparator-i;ascii-numeric > relational regex imap4flags copy include variables body enotify > environment mailbox date ihave namespace { list = children location > = maildir:/var/mail-data/vhosts/%%u:INDEX=~/shared/%%u prefix = > shared/%%u/ separator = / subscriptions = no type = shared } > namespace inbox { inbox = yes location = mailbox Drafts { > special_use = \Drafts } mailbox Junk { special_use = \Junk } > mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { > special_use = \Sent } mailbox Trash { special_use = \Trash } prefix > = separator = / type = private } passdb { driver = pam } passdb { > args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } plugin { > acl = vfile acl_shared_dict = > file:/var/mail-data/acl_db/shared-mailboxes quota = maildir:User > quota quota_grace = 10%% quota_rule = *:storage=2G quota_rule2 = > Trash:storage=+100M sieve = ~/.dovecot.sieve sieve_dir = ~/sieve } > postmaster_address = julienfastre(a)cvfe.be protocols = " imap lmtp > sieve" service auth { unix_listener > /var/spool/postfix/private/dovecot-auth { group = postfix mode = > 0660 user = postfix } } service lmtp { unix_listener > /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = > 0600 user = postfix } } ssl_ca = </etc/dovecot/certificates/ca.pem > ssl_cert = </etc/dovecot/certificates/mail.cert.pem ssl_key = > </etc/dovecot/certificates/mail.key.nopass.pem userdb { driver = > passwd } userdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver > = ldap } protocol lmtp { mail_plugins = quota acl sieve } protocol > imap { mail_max_userip_connections = 30 mail_plugins = quota acl > imap_quota imap_acl } As somes answer about anvil-auth-penalty may suggest it is linked with proc capabilities, this is the limitation of the /proc > root@mail:/home/ubuntu# ps -aux | grep anvil postfix 4568 0.0 > 0.0 27404 1596 ? S 08:00 0:00 anvil -l -t unix -u -c > dovecot 5788 0.0 0.0 9280 956 ? S 09:45 0:00 > dovecot/anvil root 5973 0.0 0.0 11748 928 pts/2 S+ > 09:57 0:00 grep --color=auto anvil root@mail:/home/ubuntu# cat > /proc/5788/limits Limit Soft Limit > Hard Limit Units Max cpu time unlimited > unlimited seconds Max file size unlimited > unlimited bytes Max data size 268435456 > 268435456 bytes Max stack size 8388608 > unlimited bytes Max core file size 0 > unlimited bytes Max resident set unlimited > unlimited bytes Max processes 257157 > 257157 processes Max open files 1024 > 4096 files Max locked memory 65536 > 65536 bytes Max address space 268435456 > 268435456 bytes Max file locks unlimited > unlimited locks Max pending signals 257157 > 257157 signals Max msgqueue size 819200 > 819200 bytes Max nice priority 0 > 0 Max realtime priority 0 0 > Max realtime timeout unlimited unlimited > us If it may help, dovecot is running inside an lxc container. I would really appreciate any help. Thanks for your time ! Julien Fastré - -- Julien Fastré Champs Libres http://www.champs-libres.coop +32 486 540 660 Champs Libres Cooperative SCRLFS Rue Jean Bury 23 - 4000 Liège - Belgique BE0541.427.670 -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQIcBAEBCAAGBQJV9n6KAAoJEL+8y7VSV380BtoQALEFOmb2llnlgRrpbHIUuFRY g+dDRYETAmjVTsPoNVR45x5n/CcT6sOY5iZw7r3O2vBtVtyr8T2iF/6d+xKxvRj+ zM76+Cdd27ydkPEI83fDGH0ckXhjRgd1MU8xEi4RjdbgE3LCMlD0TtGImPniPFM9 POY8U3psEGUaiIrd3s6DwHVamYG+8ackvHgKua0L83r4turf6AI/0kdioCStxurE IKkdPTew8W92O3QiVJ0//6A5BC6HT+hTICgUqAx4mAgCVR1PIvRAMywUy08JFJtD A/RmZj2350ApY8oKukhbKfLSamTcP+UApYt6C0PfPjPpSQUVgEkI/zWA2NH+6Pjg XA311MK9+lYcjNqM6AAAjM2H012sh6AC/u17S1t8x85HY0KUk1YldfyLUeHgRg9Y 4JBFxKP7u4exIu1Us5R1qDPOkbE3e4zzUtI57Ae/QhzTiwpWdJkQ/4hdJhwbDcGp X5RTBNldd4mFqdhPeRXN5Vh2OL9HkboA3XIMac2ZrNJC3DEl2GZJRa+Zay/OJCaj 6eppyTxYr0J2shOkvYEz/BbUYLdAX1MkkOM8bWc5rcIsvvUZhe9lX7HMNCZoNTJq Y01l9o/qzu3feIssZ0tJ4FL6hYA6TirO9i/H7NG0cVBsgCccxFtFIDsZBTIW6Gqw Nsf4SLNo7GhADcbAeeOm =2mKN -----END PGP SIGNATURE-----

1 1

no login with MySQL
by Andreas Meyer 14 Sep '15

14 Sep '15

Hello! Setup again to authenticate my users with MySQL but can't login. Sep 13 11:55:49 auth: Info: passwd-file(a.meyer(a)nimmini.de,95.88.63.177,<R7Qe9J0fTgBfWD+x>): unknown user Sep 13 11:55:49 auth: Info: passwd-file(a.meyer(a)nimmini.de,95.88.63.177,<R7Qe9J0fTgBfWD+x>): unknown user Sep 13 11:55:49 imap-login: Info: Login: user=<a.meyer(a)nimmini.de>, method=CRAM-MD5, rip=95.88.63.177, lip=46.38.231.143, mpid=30826, TLS, TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits) Sep 13 11:55:49 imap(a.meyer(a)nimmini.de): Error: user a.meyer(a)nimmini.de: Initialization failed: Namespace '': Home directory not set for user. Can't expand ~/ for mail root dir in: ~/ Sep 13 11:55:49 imap(a.meyer(a)nimmini.de): Error: Invalid user settings. Refer to server log for more information. Sep 13 11:55:49 auth: Debug: auth client connected (pid=30825) Sep 13 11:55:49 auth: Debug: client in: AUTH 1 CRAM-MD5 service=imap secured session=R7Qe9J0fTgBfWD+x lip=46.38.231.143 rip=95.88.63.177 lport=143 rport=45646 Sep 13 11:55:49 auth: Debug: client passdb out: CONT 1 PDkzMDcwNTI5Mzk5NTk1NTYuMTQ0MjEzODE0OUBiaXRtYWNoaW5lMT4= Sep 13 11:55:49 auth: Debug: client in: CONT<hidden> Sep 13 11:55:49 auth: Debug: passwd-file(a.meyer(a)nimmini.de,95.88.63.177,<R7Qe9J0fTgBfWD+x>): lookup: user=a.meyer(a)nimmini.de file=/etc/dovecot/passwd Sep 13 11:55:49 auth-worker(30822): Debug: sql(a.meyer(a)nimmini.de,95.88.63.177): query: SELECT username AS username, password FROM mailbox WHERE username = 'a.meyer(a)nimmini.de' AND active = 1 Sep 13 11:55:49 auth: Debug: client passdb out: OK 1 user=a.meyer(a)nimmini.de Sep 13 11:55:49 auth: Debug: master in: REQUEST 997457921 30821 1 dc2456b4ee1453e5458806ab92da9ee7 session_pid=30826 request_auth_token Sep 13 11:55:49 auth: Debug: passwd-file(a.meyer(a)nimmini.de,95.88.63.177,<R7Qe9J0fTgBfWD+x>): lookup: user=a.meyer(a)nimmini.de file=/etc/dovecot/passwd Sep 13 11:55:49 auth-worker(30822): Debug: passwd-file(a.meyer(a)nimmini.de,95.88.63.177): SELECT maildir, uid, gid, concat('*:storage=', quota) AS quota_rule, concat('Trash:storage=+', quota_trash) AS quota_rule2 FROM mailbox WHERE username = 'a.meyer(a)nimmini.de' Sep 13 11:55:49 auth: Debug: master userdb out: USER 997457921 a.meyer(a)nimmini.de maildir=/var/spool/vhosts/nimmini.de/ uid=5000 gid=5000 quota_rule=*:storage=5242880 quota_rule2=Trash:storage=+100 auth_token=2a4c8e78ff8fcf3f9599eecbefb6a5605f22abe5 Sep 13 11:55:49 imap: Debug: Loading modules from directory: /usr/lib64/dovecot/modules Sep 13 11:55:49 imap: Debug: Module loaded: /usr/lib64/dovecot/modules/lib01_acl_plugin.so Sep 13 11:55:49 imap: Debug: Module loaded: /usr/lib64/dovecot/modules/lib02_imap_acl_plugin.so Sep 13 11:55:49 imap: Debug: Module loaded: /usr/lib64/dovecot/modules/lib10_quota_plugin.so Sep 13 11:55:49 imap: Debug: Module loaded: /usr/lib64/dovecot/modules/lib11_imap_quota_plugin.so Sep 13 11:55:49 imap: Debug: Added userdb setting: plugin/maildir=/var/spool/vhosts/nimmini.de/ Sep 13 11:55:49 imap: Debug: Added userdb setting: plugin/quota_rule=*:storage=5242880 Sep 13 11:55:49 imap: Debug: Added userdb setting: plugin/quota_rule2=Trash:storage=+100 Sep 13 11:55:49 imap(a.meyer(a)nimmini.de): Debug: Effective uid=5000, gid=5000, home= Sep 13 11:55:49 imap(a.meyer(a)nimmini.de): Debug: Quota root: name=User quota backend=maildir args= Sep 13 11:55:49 imap(a.meyer(a)nimmini.de): Debug: Quota rule: root=User quota mailbox=* bytes=5368709120 messages=0 Sep 13 11:55:49 imap(a.meyer(a)nimmini.de): Debug: Quota rule: root=User quota mailbox=Trash bytes=+102400 messages=0 Sep 13 11:55:49 imap(a.meyer(a)nimmini.de): Debug: Quota grace: root=User quota bytes=53687091 (1%) Sep 13 11:55:49 imap(a.meyer(a)nimmini.de): Debug: Namespace inbox: type=private, prefix=, sep=/, inbox=yes, hidden=no, list=yes, subscriptions=yes location=maildir:~/ This is what claws-mail says: [12:22:48] IMAP4< * OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE STARTTLS AUTH=PLAIN AUTH=CRAM-MD5] Dovecot ready. [12:22:48] IMAP4> 1 STARTTLS [12:22:48] IMAP4< 1 OK Begin TLS negotiation now. * IMAP connection is un-authenticated [12:22:48] IMAP4> 2 CAPABILITY [12:22:48] IMAP4< * CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE AUTH=PLAIN AUTH=CRAM-MD5 [12:22:48] IMAP4< 2 OK Pre-login capabilities listed, post-login capabilities have more. [12:22:48] IMAP4> Logging a.meyer(a)nimmini.de to mail.nimmini.de using CRAM-MD5 ** IMAP Fehler auf mail.nimmini.de: parse error (sehr wahrscheinlich ein nicht RFC-konformer Server) ** IMAP4-Verbindung unterbrochen [12:22:48] IMAP4< Error logging in to mail.nimmini.de When I set auth_type PLAIN in Roundcube, login fails too. The SELECTS in the database are ok: mysql> SELECT maildir, uid, gid, concat('*:storage=', quota) AS quota_rule, concat('Trash:storage=+', quota_trash) AS quota_rule2 FROM mailbox WHERE username = 'a.meyer(a)nimmini.de'; +-------------------------------+------+------+-------------------+--------------------+ | maildir | uid | gid | quota_rule | quota_rule2 | +-------------------------------+------+------+-------------------+--------------------+ | /var/spool/vhosts/nimmini.de/ | 5000 | 5000 | *:storage=5242880 | Trash:storage=+100 | +-------------------------------+------+------+-------------------+--------------------+ 1 row in set (0,00 sec) mysql> SELECT username AS username, password FROM mailbox WHERE username = 'a.meyer(a)nimmini.de' AND active = 1 -> ; +--------------------+----------+ | username | password | +--------------------+----------+ | a.meyer(a)nimmini.de | hidden | +--------------------+----------+ 1 row in set (0,00 sec) mysql> quit What's wrong? Any help appreciated! Regards Andreas

4 7

concerning dovecot settings for high volume server
by Rajesh M 13 Sep '15

13 Sep '15

hi centos 6 64 bit hex core processor with hyperthreading ie display shows 12 cores 16 gb ram 600 gb 15000 rpm drive we are having around 4000 users on a server i wish to allow 1500 pop3 and 1500 imap connections simultaneously. need help regarding the settings to handle the above imap-login, pop3-login imap pop3 service settings i recently i got an error imap-login: Error: read(imap) failed: Remote closed connection (process_limit reached?) my current dovecot config file # 2.2.7: /etc/dovecot/dovecot.conf # OS: Linux 2.6.32-431.23.3.el6.x86_64 x86_64 CentOS release 6.5 (Final) auth_cache_negative_ttl = 0 auth_cache_ttl = 0 auth_mechanisms = plain login digest-md5 cram-md5 default_login_user = vpopmail disable_plaintext_auth = no first_valid_gid = 89 first_valid_uid = 89 log_path = /var/log/dovecot.log login_greeting = ready. mail_max_userip_connections = 50 mail_plugins = " quota" managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave namespace { inbox = yes location = prefix = separator = . type = private } passdb { args = cache_key=%u webmail=127.0.0.1 driver = vpopmail } plugin { quota = maildir:ignore=Trash quota_rule = ?:storage=0 } protocols = imap pop3 service imap-login { client_limit = 256 process_limit = 400 process_min_avail = 4 service_count = 0 vsz_limit = 512 M } service pop3-login { client_limit = 1000 process_limit = 400 process_min_avail = 12 service_count = 0 vsz_limit = 512 M } ssl_cert = </var/qmail/control/servercert.pem ssl_dh_parameters_length = 2048 ssl_key = </var/qmail/control/servercert.pem userdb { args = cache_key=%u quota_template=quota_rule=*:backend=%q driver = vpopmail } protocol imap { imap_client_workarounds = delay-newmail mail_plugins = " quota imap_quota" } protocol pop3 { pop3_client_workarounds = outlook-no-nuls oe-ns-eoh pop3_fast_size_lookups = yes pop3_lock_session = no pop3_no_flag_updates = yes } thanks very much, rajesh

5 4

Re: concerning dovecot settings for high volume server
by Rajesh M 13 Sep '15

13 Sep '15

----- Original Message ----- From: Tony Morehen [mailto:tmorehen@ajmconsulting.ca] To: dovecot(a)dovecot.org Sent: Sat, 12 Sep 2015 17:57:27 -0400 Subject: Re: concerning dovecot settings for high volume server You may be running up against Linux system/user limits. Run $ cat /proc/sys/kernel/pid_max and $ ulimit -a That should give some insight into your problem. On 12/09/2015 2:53 PM, Rajesh M wrote: > hi > > centos 6 64 bit > > hex core processor with hyperthreading ie display shows 12 cores > 16 gb ram > 600 gb 15000 rpm drive > > we are having around 4000 users on a server > > > i wish to allow 1500 pop3 and 1500 imap connections simultaneously. > > need help regarding the settings to handle the above > > imap-login, pop3-login > imap pop3 service settings > > i recently i got an error > imap-login: Error: read(imap) failed: Remote closed connection (process_limit reached?) > > > my current dovecot config file > > # 2.2.7: /etc/dovecot/dovecot.conf > # OS: Linux 2.6.32-431.23.3.el6.x86_64 x86_64 CentOS release 6.5 (Final) > auth_cache_negative_ttl = 0 > auth_cache_ttl = 0 > auth_mechanisms = plain login digest-md5 cram-md5 > default_login_user = vpopmail > disable_plaintext_auth = no > first_valid_gid = 89 > first_valid_uid = 89 > log_path = /var/log/dovecot.log > login_greeting = ready. > mail_max_userip_connections = 50 > mail_plugins = " quota" > managesieve_notify_capability = mailto > managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave > namespace { > inbox = yes > location = > prefix = > separator = . > type = private > } > passdb { > args = cache_key=%u webmail=127.0.0.1 > driver = vpopmail > } > plugin { > quota = maildir:ignore=Trash > quota_rule = ?:storage=0 > } > protocols = imap pop3 > service imap-login { > client_limit = 256 > process_limit = 400 > process_min_avail = 4 > service_count = 0 > vsz_limit = 512 M > } > service pop3-login { > client_limit = 1000 > process_limit = 400 > process_min_avail = 12 > service_count = 0 > vsz_limit = 512 M > } > ssl_cert = </var/qmail/control/servercert.pem > ssl_dh_parameters_length = 2048 > ssl_key = </var/qmail/control/servercert.pem > userdb { > args = cache_key=%u quota_template=quota_rule=*:backend=%q > driver = vpopmail > } > protocol imap { > imap_client_workarounds = delay-newmail > mail_plugins = " quota imap_quota" > } > protocol pop3 { > pop3_client_workarounds = outlook-no-nuls oe-ns-eoh > pop3_fast_size_lookups = yes > pop3_lock_session = no > pop3_no_flag_updates = yes > } > > > thanks very much, > > rajesh this is the first time i got this message since past over an year. the error went away as soon as i restarted dovecot.. surprisingly this happened in the night ie off-office hours. here are the values i got also could you provide me the settings for the limits if wish to handle around 1500 simultaneous connections of pop3 and imap each ? the current values are as follows [root@ns1 log]# cat /proc/sys/kernel/pid_max 49152 [root@ns1 log]# ulimit -a core file size (blocks, -c) 0 data seg size (kbytes, -d) unlimited scheduling priority (-e) 0 file size (blocks, -f) unlimited pending signals (-i) 127047 max locked memory (kbytes, -l) 64 max memory size (kbytes, -m) unlimited open files (-n) 1024 pipe size (512 bytes, -p) 8 POSIX message queues (bytes, -q) 819200 real-time priority (-r) 0 stack size (kbytes, -s) 10240 cpu time (seconds, -t) unlimited max user processes (-u) 127047 virtual memory (kbytes, -v) unlimited file locks (-x) unlimited thanks rajesh

2 1

Need help on checkpassword userdb/passdb
by Mark Foley 13 Sep '15

13 Sep '15

I'm experimenting with checkpassword as an auth method for usedb and passdb (http://wiki2.dovecot.org/AuthDatabase/CheckPassword) I've set up the userdb and passdb *exactly* as the wiki suggests as the "standard way": passdb { driver = checkpassword args = /user/util/bin/checkpassword } userdb { driver = prefetch } I've created a checkpassword program that does receive the correct user and password from dovecot. And I am successfully authenticating with ntlm_auth and exiting with status 0. My debug output: AUTHORIZED: (null) USER: (null) userdb_uid: (null) userdb_gid: (null) arg1=/usr/local/libexec/dovecot/checkpassword-reply CMD: /usr/bin/ntlm_auth --username="mark" --password='mypass' ntlm_auth status: 0 Now, the wiki says 2 things that have me stumped: 1. It says that, "Dovecot calls the script with AUTHORIZED=1 environment set when performing a userdb lookup. The script must acknowledge this by changing the environment to AUTHORIZED=2, otherwise the lookup fails." As you can see from my program log, "AUTHORIZED" is not set. Why? Nor are any of the other environment variables mentioned in the wiki. I've listed all the environment variables that *are* passed to the program at the bottom of this message. 2. The wiki says, "Your program received a path to checkpassword-reply binary as the first parameter. Execute it." I did so as a fork() and then execve("/usr/local/libexec/dovecot/checkpassword-reply") How do I know it worked ... or failed? What am I doing wrong? Dovecot log entries: Sep 10 22:54:04 auth: Debug: auth client connected (pid=14748) Sep 10 22:54:04 auth: Debug: client in: AUTH 1 PLAIN service=imap session=AkYg1G8f8QDAqAA6 lip=192.168.0.2 rip=192.168.0.58 lport=143 rport=49649 resp=AG1hcmsAZ2xhY29uXzk= (previous base64 data may contain sensitive data) Sep 10 22:54:04 auth: Debug: checkpassword(mark,192.168.0.58,<AkYg1G8f8QDAqAA6>): execute: /user/util/bin/checkpassword /usr/local/libexec/dovecot/checkpassword-reply Sep 10 22:54:04 auth: Debug: checkpassword(mark,192.168.0.58,<AkYg1G8f8QDAqAA6>): exit_status=0 Sep 10 22:54:04 auth: Debug: checkpassword(mark,192.168.0.58,<AkYg1G8f8QDAqAA6>): Received input: Sep 10 22:54:06 auth: Debug: client passdb out: FAIL 1 user=mark temp ENV variables passed to the checkpassword program: DOVECOT_PRESERVE_ENVS=TZ CORE_OUTOFMEM CORE_ERROR DOVECOT_CHILD_PROCESS=1 CONFIG_FILE=/usr/local/var/run/dovecot/config CLIENT_LIMIT=1000 PROCESS_LIMIT=1 PROCESS_MIN_AVAIL=0 IDLE_KILL=60 GENERATION=2991 DOVECOT_HOSTNAME=mail DOVECOT_HOSTDOMAIN=mail.hprs.local DOVECOT_VERSION=2.2.15 LOG_SERVICE=1 SOCKET_COUNT=6 SSL_SOCKET_COUNT=0 SOCKET_NAMES=login tokenlogin auth-login auth-client auth-userdb auth-master PROTO=TCP ORIG_UID=151 SERVICE=imap TCPLOCALIP=192.168.0.2 LOCAL_IP=192.168.0.2 TCPREMOTEIP=192.168.0.58 REMOTE_IP=192.168.0.58 TCPLOCALPORT=143 TCPREMOTEPORT=49649 AUTH_USER=mark AUTH_USERNAME=mark AUTH_SERVICE=imap AUTH_LIP=192.168.0.2 AUTH_RIP=192.168.0.58 AUTH_PID=14748 AUTH_MECH=PLAIN AUTH_SECURED= AUTH_LPORT=143 AUTH_RPORT=49649 AUTH_CERT= AUTH_SESSION=AkYg1G8f8QDAqAA6 AUTH_REAL_LIP=192.168.0.2 AUTH_REAL_RIP=192.168.0.58 AUTH_REAL_LPORT=143 AUTH_REAL_RPORT=49649 AUTH_ORIG_USER=mark AUTH_ORIG_USERNAME=mark --Mark

1 2

Is it a bug when you move mail between namespaces....
by Larry Rosenman 11 Sep '15

11 Sep '15

that the fts data gets lost? doveconf -n attached -- Larry Rosenman http://www.lerctr.org/~ler Phone: +1 214-642-9640 (c) E-Mail: larryrtx(a)gmail.com US Mail: 7011 W Parmer Ln, Apt 1115, Austin, TX 78729-6961

2 8

Dovecot CalDAV server
by Timo Sirainen 11 Sep '15

11 Sep '15

I've been once in a while over the years thinking about implementing CalDAV (and CardDAV) to Dovecot. It might be time to start that soon. Does anyone have any suggestions? So far my main goals would be: - scalable, of course - configurable storage (object storage, regular fs, maybe some key-value dbs, maybe storing as emails) - efficient indexes (potentially using key-value dbs? or maybe just local files. not sure yet what kind of indexing is needed) - have it work with dsync (= replication & migration) Some things I wonder about: - Maybe there is already some code out there that could be used to implement it faster? - Maybe even use something else besides C to implement it.. Then again that makes integration to Dovecot more difficult. - Is anybody interested in helping to develop this? :) I think I still have too much other work that I won't spend a lot of time coding it.. One thing that makes this easier is that Open-Xchange has already implemented a CalDAV server, so they can help to avoid the biggest design mistakes. (There are a couple of reasons why they'd want to replace that.)

11 13