- dovecot - dovecot.org

ldap passdb, userdb imap auth sasl and lmtp
by bd730c5053df9efb 14 Nov '23

14 Nov '23

Hi! I'm trying to setup dovecot 2.3.17 such that it authenticates users against a samba4 ad dc when they connect through imap. I would also need dovecot to authenticate the same users through sasl so that postfix can relay mails based on the user's auth and finally I would also need for an lmtp service that maps email addresses into AD users. I've been tinkering with dovecot-ldap.conf.ext using auth_bind = yes and no, with all sorts of pass_filters, user_filter, pass_attr and user_attr and I just can't figure out how it works. I assume that for the auth part (both imap and sasl) I would rather benefit with using auth_bind = yes and auth_bind_userdn = %u and I seem to be able to authenticate the user but I can't get the passdb to prefetch the userdb attributes. I also assume that for lmtp to be able to fetch the ad information it would be necessary for dovecot to be able to bind to the ad ldap server with a "service account" to be able to query the ldap server and I haven't been able to figure out how to have both kinds of auth schemas. Does anyone know of some documentation that could clarify some of this issues, I have been searching the web for days to no avail. I'm sorry I can't show what I have tried for I have tried so many things with more or less the same lack of success that I wouldn't know where to start. Thanks in advance. Best regards, Dave.

2 1

More information on dict proxy
by Steve 09 Nov '23

09 Nov '23

Hello, I'm working on an implementation of a dict server. I've looked through all your documentation but can't seem to find how I can create the proper URI to direct the quota plugin to use a TCP socket instead of a UNIX socket. I'd appreciate any insight you can provide. Steve

2 1

file dotlock create
by The Doctor 07 Nov '23

07 Nov '23

I am seeing errors in our log as follows Nov 07 14:20:06 POP3(user937):Error: Mailbox INBOX: file_dotlock_create(/var/mail/user937) failed: Permission denied (euid=937(user937) egid=100(user) missing +w perm: /var/mail, we're not in group 6(mail), dir owned by 0:6 mode=0775) (set mail_privileged_group=mail) Nov 07 14:21:03 IMAP(user3094):Error: Mailbox INBOX: file_dotlock_create(/var/mail/user3094) failed: Permission denied (euid=3094(user3094) egid=100(user) missing +w perm: /var/mail, we're not in group 6(mail), dir owned by 0:6 mode=0775) (set mail_privileged_group=mail) Nov 07 14:21:03 IMAP(user3094):Error: Mailbox INBOX: file_dotlock_create(/var/mail/user3094) failed: Permission denied (euid=3094(user3094) egid=100(user) missing +w perm: /var/mail, we're not in group 6(mail), dir owned by 0:6 mode=0775) (set mail_privileged_group=mail) Nov 07 14:21:03 IMAP(user3094):Error: Mailbox INBOX: file_dotlock_create(/var/mail/user3094) failed: Permission denied (euid=3094(user3094) egid=100(user) missing +w perm: /var/mail, we're not in group 6(mail), dir owned by 0:6 mode=0775) (set mail_privileged_group=mail) /var/mail is set to 1775 Running FreeBSD 14.0-RC4 -- Member - Liberal International This is doctor(a)nk.ca Ici doctor(a)nk.ca Yahweh, King & country!Never Satan President Republic!Beware AntiChrist rising! Look at Psalms 14 and 53 on Atheism ; unsubscribe from Google Groups to be seen Suffering will continue until we stop believing lies. -unknown Beware https://mindspring.com

1 0

mail boxes on net mounted filesystem with multiple Dovecots
by lejeczek 07 Nov '23

07 Nov '23

Hi guys. I see that with mailboxes stored on a network mount-point and more than one box with Dovecot using such a mailbox, Dovecots step on each others toes. ... lmtp(minemail(a)lemko.xyz)<2674357><uATxGqbaSGW1zigAn4O9eQ>: Error: lmtp-server: conn unix:pid=2600068,uid=89 [2]: rcpt minemail(a)my.private: Mailbox INBOX: Corrupted transaction log file /VMAIL/my.private/minemail/dovecot.index.log seq 4: ext intro: name_size too large (sync_offset=6368) ... Above happened if the same one user was having mail delivered on two Postfix+Dovecot servers at the same time. I hope experts who know Dovecot's internals better can tell... having such multiple node/server Dovecots "talking" to that same network mount-point but!.. only one Dovecot being active - having Postfix using it and other, however many, Dovecots only "idling" - not having Postifx using it (+ no client connections is a goal too) Would that make such multi-Dovecot setup safe & free from errors as above & any storage related ones? Or perhaps there are other ways to have many Dovecots with the same user-base, using same networked storage simultaneously? many thanks, L. Hi guys. I see that with mailboxes stored on a network mount-point and more than one box with Dovecot using such a mailbox, Dovecots step on each others toes. ... lmtp(minemail(a)lemko.xyz)<2674357><uATxGqbaSGW1zigAn4O9eQ>: Error: lmtp-server: conn unix:pid=2600068,uid=89 [2]: rcpt minemail(a)my.private: Mailbox INBOX: Corrupted transaction log file /VMAIL/my.private/minemail/dovecot.index.log seq 4: ext intro: name_size too large (sync_offset=6368) ... Above happened if the same one user was having mail delivered on two Postfix+Dovecot servers at the same time. I hope experts who know Dovecot's internals better can tell... having such multiple node/server Dovecots "talking" to that same network mount- point but!.. only one Dovecot being active - having Postfix using it and other, however many, Dovecots only "idling" - not having Postifx using it (+ no client connections is a goal too) Would that make such multi-Dovecot setup safe & free from errors as above & any storage related ones? Or perhaps there are other ways to have many Dovecots with the same user-base, using same networked storage simultaneously? many thanks, L.

4 3

Can Dovecot Use Wildcard TLS Certificates?
by duluxoz 07 Nov '23

07 Nov '23

Hi All, Quick Q: Can dovecot use wildcard TLS Certificates? I'm having issues with a new dovecot/postfix stack set-up and I can't get mutt on the local box to connect via imap - its coming back with an SSL error, and as I'm using a wildcard cert for the domain I was wondering if that was my issue. If dovecot can use wildcard certs then I'll look elsewhere in my troubleshooting. Thanks in advance Cheers Dulux-Oz

8 7

Minimum configuration for Dovecot SASL only?
by Nick Lockheart 06 Nov '23

06 Nov '23

I have a Dovecot IMAP server and a Postfix server on separate machines. The user information is stored in a MariaDB database that is replicated on both servers. Postfix needs to authenticate outgoing mail against our valid user database. I believe this requires us to install a "dummy" Dovecot on the Postfix server so that Dovecot SASL can provide authentication to Postfix from the database. I think Cyrus had a standalone Cyrus-SASL package, but Dovecot doesn't? If I wanted to setup a Dovecot instance on the Postfix server just for the purposes of SMTP authentication, and not use it to handle any mail, what is the minimum configuration required to make that work? Is the dovecot-common package (Debian) enough? Or do I need the full dovecot-imap package? What protocols go in the protocols directive? Can you just make it "protocols = auth" to disable IMAP connections?

5 9

with GlusterFS - permissions for vmail ?
by lejeczek 05 Nov '23

05 Nov '23

Hi guys. I must be missing, having something misconfigured. I have: -> $ gluster volume info VMAIL Volume Name: VMAIL Type: Distributed-Replicate Volume ID: 462a1850-a31a-4a17-934d-26f3996dc9b8 Status: Started Snapshot Count: 0 Number of Bricks: 1 x 2 = 2 Transport-type: tcp Bricks: Brick1: 10.1.1.100:/devs/00.GLUSTERs/VMAIL Brick2: 10.1.1.101:/devs/00.GLUSTERs/VMAIL Options Reconfigured: storage.owner-gid: 2000 storage.owner-uid: 2000 cluster.granular-entry-heal: on storage.fips-mode-rchecksum: on transport.address-family: inet nfs.disable: on performance.client-io-threads: off and my _dovecot_ errors out with: ... imap(ja_discourse(a)test.web)<92447><w3ygwWUJUNddviSg>: Error: mkdir(/VMAIL/test.web/ja_discourse) failed: Permission denied (euid=2000(vmail) egid=2000(vmail) missing +w perm: /VMAIL, UNIX perms appear ok (ACL/MAC wrong?)) imap(ja_discourse(a)test.web)<92447><w3ygwWUJUNddviSg>: Error: mkdir(/VMAIL/test.web/ja_discourse) failed: Permission denied (euid=2000(vmail) egid=2000(vmail) missing +w perm: /VMAIL, UNIX perms appear ok (ACL/MAC wrong?)) imap(ja_discourse(a)test.web)<92447><w3ygwWUJUNddviSg>: Error: Mailbox INBOX: Failed to autocreate mailbox: Internal error occurred. Refer to server log for more information. [2023-11-05 12:08:25] ... What might I have incorrect or wrong? many thanks, L Hi guys. I must be missing, having something misconfigured. I have: -> $ gluster volume info VMAIL Volume Name: VMAIL Type: Distributed-Replicate Volume ID: 462a1850-a31a-4a17-934d-26f3996dc9b8 Status: Started Snapshot Count: 0 Number of Bricks: 1 x 2 = 2 Transport-type: tcp Bricks: Brick1: 10.1.1.100:/devs/00.GLUSTERs/VMAIL Brick2: 10.1.1.101:/devs/00.GLUSTERs/VMAIL Options Reconfigured: storage.owner-gid: 2000 storage.owner-uid: 2000 cluster.granular-entry-heal: on storage.fips-mode-rchecksum: on transport.address-family: inet nfs.disable: on performance.client-io-threads: off and my _dovecot_ errors out with: ... imap(ja_discourse(a)test.web)<92447><w3ygwWUJUNddviSg>: Error: mkdir(/VMAIL/ test.web/ja_discourse) failed: Permission denied (euid=2000(vmail) egid=2000 (vmail) missing +w perm: /VMAIL, UNIX perms appear ok (ACL/MAC wrong?)) imap(ja_discourse(a)test.web)<92447><w3ygwWUJUNddviSg>: Error: mkdir(/VMAIL/ test.web/ja_discourse) failed: Permission denied (euid=2000(vmail) egid=2000 (vmail) missing +w perm: /VMAIL, UNIX perms appear ok (ACL/MAC wrong?)) imap(ja_discourse(a)test.web)<92447><w3ygwWUJUNddviSg>: Error: Mailbox INBOX: Failed to autocreate mailbox: Internal error occurred. Refer to server log for more information. [2023-11-05 12:08:25] ... What might I have incorrect or wrong? many thanks, L

2 3

install/compile dovecot-pigeonhole
by joe a 03 Nov '23

03 Nov '23

Working dovecot 2.3, wish to be able to implement "server side" filtering. My understanding is that is done with "sieve". My further understanding is that "dovecot-pigeonhole" and be used to manage "sieve" in some fashion. Attempting to compile dovecot-2.3-pigeonhole-0.5.21 proves problematic due to its inability to find dovecot-config. Which is not astonishing as, on my system dovecot-config does not exist, dovecot having been installed as a vendor configure package. Sadly, no vendor package or binary is provided for dovecot-pigeonhole. At least that I am aware of. OS is opensuse LEAP 15.5. Any helpful commentary is welcome. Honest.

1 1

Too many auth errors
by DeJa Wu 03 Nov '23

03 Nov '23

I've got too many errors on my mail server like this: Nov 3 12:03:13 mail01 dovecot[5562]: imap-login: Error: auth-client: conn unix:login (pid=5553,uid=0): Authentication server sent unknown id 2965 Nov 3 12:03:13 mail01 dovecot[5562]: imap-login: Error: auth-client: conn unix:login (pid=5553,uid=0): Authentication server sent unknown id 2966 Nov 3 12:03:13 mail01 dovecot[5562]: imap-login: Error: auth-client: conn unix:login (pid=5553,uid=0): Authentication server sent unknown id 2967 Nov 3 12:03:13 mail01 dovecot[5562]: imap-login: Error: auth-client: conn unix:login (pid=5553,uid=0): Authentication server sent unknown id 2084 Nov 3 12:03:13 mail01 dovecot[5562]: imap-login: Error: auth-client: conn unix:login (pid=5553,uid=0): Authentication server sent unknown id 1972 And my users say that login to the mail server is too long. In some cases I've got an error connection problem. How do I fix this? BR, DeJa I've got too many errors on my mail server like this: Nov 3 12:03:13 mail01 dovecot[5562]: imap-login: Error: auth-client: conn unix:login (pid=5553,uid=0): Authentication server sent unknown id 2965 Nov 3 12:03:13 mail01 dovecot[5562]: imap-login: Error: auth-client: conn unix:login (pid=5553,uid=0): Authentication server sent unknown id 2966 Nov 3 12:03:13 mail01 dovecot[5562]: imap-login: Error: auth-client: conn unix:login (pid=5553,uid=0): Authentication server sent unknown id 2967 Nov 3 12:03:13 mail01 dovecot[5562]: imap-login: Error: auth-client: conn unix:login (pid=5553,uid=0): Authentication server sent unknown id 2084 Nov 3 12:03:13 mail01 dovecot[5562]: imap-login: Error: auth-client: conn unix:login (pid=5553,uid=0): Authentication server sent unknown id 1972 And my users say that login to the mail server is too long. In some cases I've got an error connection problem. How do I fix this? BR, DeJa

1 0

Sieve/Pigeonhole
by joe a 01 Nov '23

01 Nov '23

For dovecot, I see there is a "sieve" download at dovecot downloads and separately there is a pigeonhole download. Are these parallel projects, distinct and separate?

1 1

Setting up a new server
by James Cloos 30 Oct '23

30 Oct '23

I'm in the process of switching to dovecot for my lan imap and have a couple of questions. I want to keep the folder names unchanged. For mailing lists I use the posting address (eg foo(a)bar.co) for others I use / as the separator. If I use mdbox, will those choices cause any issues? My impression is not, but I'd like to be sure. Also I'd like to use imap-specific passwds for each user. My tests so far have used the login passwds for each user. Not necessarily virtual users, just imap-specific passwds. There is already a pgsql server handy; I take it that would be the way to go for passdb and userdb lookups, yes? Thanks, -JimC -- James Cloos <cloos(a)jhcloos.com> OpenPGP: 0x997A9F17ED7DAEA6

2 1

Two-way TLS and other security for LMTP over the internet?
by forum＠ageofdream.com 29 Oct '23

29 Oct '23

Dovecot version 2.3.19.1 (9b53102964) Postfix version 3.5.18 We have a Postfix server that runs on a VPS with a hosting company and a Dovecot IMAP server that runs at the office. We want Postfix to push the mail it receives to the Dovecot IMAP server, using the least amount of intermediate software. This transfer occurs over the open internet. LMTP over TCP seems like a great solution, *if* it can be secured. But I'm not finding documentation on how to actually setup something like two-way TLS over LMTP. 1. Is there any setting in Dovecot where I can set a remote IP address (or hostname) that will be the only address that Dovecot's LMTP accepts connections from? 2. My current configuration options for LMTP in Dovecot look like: protocol lmtp { ssl_cert = </etc/ssl/imap/imap.crt ssl_key = </etc/ssl/imap/imap.key ssl_ca = </etc/ssl/imap/authority.crt ssl_verify_client_cert = yes auth_ssl_require_client_cert = yes } service lmtp { user = vmail inet_listener lmtp { address = * :: port = 24 } } With these settings, I can telnet from the Postfix server to the Dovecot server with LMTP, and I'm not convinced there is any encryption actually enabled or any TLS verification going on. Is there any reasonable security that can be setup to make this safe (within Dovecot and Postfix settings, not using VPNs and SSH tunnels)? If so, how?

3 2

{ldap:objectGUID} returns binary data when used for user_attrs
by Andreas Haerter 26 Oct '23

26 Oct '23

Hi, there is an environment in which I have to use MS Active Directory for authentication and mail server user database, and I've run into a problem. I. The problem I want to retrieve the objectGUID attribute for the homedir path of the users. This attribute does never change, even when the username does or the account gets moved to another AD domain. However, the objectGUID is returned as binary gibberish when using the following setting: > user_attrs = \ > =home=/var/vmail/example.com/%LT{ldap:objectGUID}, \ It results in > # doveadm user uTesting > field value > user utesting > home /var/vmail/example.com/d ��n�aa_ o�� > mail maildir:~/mail Can someone reproduce this or offer a workaround? The only idea I had was hashing the value using =%M{ldap:objectGUID}. However, this approach would become problematic if the behavior changes and a proper string representation is returned, as expected, instead of the binary data. Therefore, I'm hesitant to use this method for now. A better approach would be encoding it as Base64, but I was unsuccessful to identify a fitting modifier at <https://doc.dovecot.org/configuration_manual/config_file/config_variables/#…>. Any ideas? II. Additional info Using other attributes for LDAP/Active Directory works as expected. E.g. > =home=/var/vmail/example.com/%LT{ldap:sAMAccountName} results in > # doveadm user uTesting > field value > user utesting > home /var/vmail/example.com/utesting > mail maildir:~/mail The objectGUID is indeed binary data, but IHMO, it should be handled differently when returned. E.g. there is a defined string representation, [MS-DTYP] section 2.3.4.3: <https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/222af…> which links to: > curly braced GUID string: The string representation of a 128-bit > globally unique identifier (GUID) using the form > {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX}, where X denotes a hexadecimal > digit. The string representation between the enclosing braces is the > standard representation of a GUID as described in [RFC4122] section 3. > Unlike a GUIDString, a curly braced GUID string includes enclosing braces. Some libs simply decide to return the data Base64 encoded (which would be OK, too). E.g. openldap-clients / ldapsearch does so with objectGUID and objectSid: > $ ldapsearch [...] > [...] > # uTesting, common, user, managed, example.com > dn: CN=uTesting,OU=common,OU=user,OU=managed,DC=example,DC=com > [...] > name: uTesting > objectGUID:: RCDirQPvGU6KQUFfIE/i2Q== > [...] > objectSid:: AQUAAAAAAAUVAAAALenCqsullBUfFoubWQQAAA== > [...] > sAMAccountName: uTesting > [...] Other software had comparable bugs or behavior , e.g. sssd ("Properly handle AD's binary objectGUID"): <https://bugzilla.redhat.com/show_bug.cgi?id=1205382> <https://github.com/SSSD/sssd/issues/3629> owncloud ("ensure that objectguid or guid really return binary data before converting it"): <https://github.com/owncloud/core/issues/8317> III. Software versions, config I can reproduce the issue on Fedora Server 38 > # cat /etc/redhat-release > Fedora release 38 (Thirty Eight) > # uname -r > 6.4.15-200.fc38.x86_64 > # dovecot --version > 2.3.20 (80a5ac675d) and CentOS 9 Stream: > # cat /etc/redhat-release > CentOS Stream release 9 > # uname -r > 5.14.0-364.el9.x86_64 > # dovecot --version > 2.3.16 (7e2e900c1a) I did not try a Debian-based distro yet. The config itself works fine, relevant settings just for reference (as there are not many examples on the internet, maybe useful for somebody): > auth_username_format = %Lu > > passdb { > driver = ldap > args = /etc/dovecot/dovecot-ldap.conf.ext > } > userdb { > driver = ldap > args = /etc/dovecot/dovecot-ldap-userdb.conf.ext > } with the following options to exclude inactive accounts, search smtp proxy addresses and having a mandatory group membership in SERVICE_EmailUsers: > base = OU=common,OU=user,OU=managed,DC=example,DC=com > scope = subtree > > user_filter = \ > (& \ > (objectClass=user) \ > (objectCategory=Person) \ > (|(sAMAccountName=%{username})(mail=%{username})(proxyAddresses=smtp:%{username}@%{domain})) \ > (!(userAccountControl:1.2.840.113556.1.4.803:=2)) \ > (memberOf:1.2.840.113556.1.4.1941:=SERVICE_EmailUsers) \ > ) > pass_filter = \ > (& \ > (objectClass=user) \ > (objectCategory=Person) \ > (|(sAMAccountName=%{username})(mail=%{username})(proxyAddresses=smtp:%{username}@%{domain})) \ > (!(userAccountControl:1.2.840.113556.1.4.803:=2)) \ > (memberOf:1.2.840.113556.1.4.1941:=SERVICE_EmailUsers) \ > ) I will blog about the config in more detail at https://foundata.com/en/blog/ soon, especially when the objectGUID is solved (maybe hashing it really the way to go). :-) Regards, Andreas -- foundata GmbH Steinhäuserstr. 20 76135 Karlsruhe Sitz der Gesellschaft: Karlsruhe Registergericht: Amtsgericht Mannheim, HRB 714807 Geschäftsführer: Andreas Haerter USt-IdNr.: DE284122682

1 1

Correct sizing of CPU and RAM
by DeJa Wu 26 Oct '23

26 Oct '23

How to correctly calculate the number of CPUs and memory required for 1000 client mailboxes and beyond? Given that 30-50% of users will be constantly connected via IMAP. I looked for information and did not find any sizing in the documentation anywhere. Is there a way to calculate my required resources? BR, DeJa How to correctly calculate the number of CPUs and memory required for 1000 client mailboxes and beyond? Given that 30-50% of users will be constantly connected via IMAP. I looked for information and did not find any sizing in the documentation anywhere. Is there a way to calculate my required resources? BR, DeJa

2 1

OAUTH2 tokeninfo is doing a GET instead of a POST request
by Alexander Leidinger 26 Oct '23

26 Oct '23

Hi, I try to setup oauth2 authentication with dovecot 2.3.21. The debug log of dovecot shows that it tries to do a HTTP GET request to the tokeninfo url with the token appended to the end of the URL. This gives a 404 error. The openidconnect server I use (keycloak) tells that this API endpoint conforms to https://openid.net/specs/openid-connect-core-1_0.html#TokenEndpoint which specifies that the request has to be a HTTP POST request. So dovecot is trying do to something (GET request) which the OIDC specification does not agree with (shall be POST request). Here is the dovecot debug log of it: ---snip--- Oct 17 12:11:19 imap dovecot[81589]: auth: Debug: http-client[1]: request [Req1: GET https://oauth2.domain.tld/realms/MyRealm/protocol/openid-connect/tokeneyJhb…<rest_omitted>...: Submitted (requests left=1) [...] Oct 17 12:11:19 imap dovecot[81589]: auth: Debug: oauth2.domain.tld: SSL: where=0x1001, ret=1: SSLv3/TLS read server session ticket Oct 17 12:11:19 imap dovecot[81589]: auth: Debug: oauth2.domain.tld: where=0x1002, ret=1: SSL negotiation finished successfully Oct 17 12:11:19 imap dovecot[81589]: auth: Debug: oauth2.domain.tld: SSL: where=0x1001, ret=1: SSL negotiation finished successfully Oct 17 12:11:19 imap syslogd: last message repeated 1 times Oct 17 12:11:19 imap dovecot[81589]: auth: Debug: oauth2.domain.tld: SSL: where=0x1001, ret=1: SSLv3/TLS read server session ticket Oct 17 12:11:19 imap dovecot[81589]: auth: Debug: oauth2.domain.tld: SSL: where=0x1002, ret=1: SSL negotiation finished successfully Oct 17 12:11:19 imap dovecot[81589]: auth: Debug: http-client: conn <IP>:443 [1]: Got 404 response for request [Req1: GET https://oauth2.domain.tld/realms/MyRealm/protocol/openid-connect/tokeneyJhb…<rest_omitted> ---snip--- My passdb config (only showing the oauth part): ---snip--- passdb { driver = oauth2 mechanisms = oauthbearer xoauth2 args = /usr/local/etc/dovecot/auth-oauth2.token.conf.ext } passdb { driver = oauth2 mechanisms = plain args = /usr/local/etc/dovecot/auth-oauth2.plain.conf.ext } ---snip--- auth-oauth2.token.conf.ext: ---snip--- openid_configuration_url = https://oauth2.domain.tld/realms/MyRealm/.well-known/openid-configuration tokeninfo_url = https://oauth2.domain.tld/realms/MyRealm/protocol/openid-connect/token introspection_url = https://oauth2.domain.tld/realms/MyRealm/protocol/openid-connect/token/intr… introspection_mode = post active_attribute = active active_value = true client_id = myid client_secret = mysecret use_grant_password = no debug = yes username_attribute = email pass_attrs = pass=%{oauth2:access_token} ---snip--- auth-oauth2.plain.conf.ext: ---snip--- openid_configuration_url = https://oauth2.domain.tld/realms/MyRealm/.well-known/openid-configuration #tokeninfo_url = https://oauth2.domain.tld/realms/MyRealm/protocol/openid-connect/token introspection_url = https://oauth2.domain.tld/realms/MyRealm/protocol/openid-connect/token/intr… introspection_mode = post active_attribute = active active_value = true client_id = myid client_secret = mysecret use_grant_password = yes debug = yes username_attribute = email pass_attrs = host=<IP of webmail> proxy=y proxy_mech=xoauth2 pass=%{oauth2:access_token} ---snip--- On https://doc.dovecot.org/configuration_manual/authentication/oauth2/ I can not find any way to tell that the tokeninfo url shall do a POST request instead of a GET request. I found something on reddit how to make it work with keycloak, but this seems to be a workaround, and not a proper fix... The first comment at https://www.reddit.com/r/selfhosted/comments/omwb2j/any_one_get_dovecot_key… makes this work for me. The working but not really up to the OIDC spec dovecot config is: auth-oauth2.token.conf.ext: ---snip--- openid_configuration_url = https://oauth2.domain.tld/realms/MyRealm/.well-known/openid-configuration #tokeninfo_url = https://oauth2.domain.tld/realms/MyRealm/Leidinger/protocol/openid-connect/… tokeninfo_url = https://oauth2.domain.tld/realms/MyRealm/protocol/openid-connect/userinfo?t… introspection_url = https://oauth2.domain.tld/realms/MyRealm/protocol/openid-connect/token/intr… introspection_mode = auth #active_attribute = active #active_value = true client_id = myid client_secret = mysecret use_grant_password = no #debug = yes username_attribute = email pass_attrs = pass=%{oauth2:access_token} ---snip--- auth-oauth2.plain.conf.ext: ---snip--- openid_configuration_url = https://oauth2.domain.tld/realms/MyRealm/.well-known/openid-configuration #tokeninfo_url = https://oauth2.domain.tld/realms/MyRealm/protocol/openid-connect/token tokeninfo_url = https://oauth2.domain.tld/realms/MyRealm/protocol/openid-connect/userinfo?t… introspection_url = https://oauth2.domain.tld/realms/MyRealm/protocol/openid-connect/token/intr… introspection_mode = auth #active_attribute = active #active_value = true client_id = myid client_secret = mysecret use_grant_password = yes #debug = yes username_attribute = email pass_attrs = host=<IP of webmail> proxy=y proxy_mech=xoauth2 pass=%{oauth2:access_token} ---snip--- Bye, Alexander. -- http://www.Leidinger.net Alexander(a)Leidinger.net: PGP 0x8F31830F9F2772BF http://www.FreeBSD.org netchild(a)FreeBSD.org : PGP 0x8F31830F9F2772BF

2 8

Is it possible to show different mechanism according to client IP ?
by Philippe MARASSE 26 Oct '23

26 Oct '23

Hello, Say I'm wondering if it's possible to show 3 mechanisms for clients in private network (XOAUTH2 / PLAIN / EXTERNAL) and only 2 to others (only OAUTH / EXTERNAL) ? I've seen allow_nets extra field for args, but it seems that's not working with ldap passdb. Regards. -- Philippe MARASSE Responsable pôle Infrastructures - DSIO Centre Hospitalier Henri Laborit CS 10587 - 370 avenue Jacques Cœur 86021 Poitiers Cedex Tel : 05.49.44.57.19 Hello, Say I'm wondering if it's possible to show 3 mechanisms for clients in private network (XOAUTH2 / PLAIN / EXTERNAL) and only 2 to others (only OAUTH / EXTERNAL) ? I've seen allow_nets extra field for args, but it seems that's not working with ldap passdb. Regards. -- Philippe MARASSE Responsable pôle Infrastructures - DSIO Centre Hospitalier Henri Laborit CS 10587 - 370 avenue Jacques Cœur 86021 Poitiers Cedex Tel : 05.49.44.57.19

2 1

Unclear output from force-resync.
by Justin Wheeler 25 Oct '23

25 Oct '23

Hi, After a hard drive issue from my VPS provider, one of my customers' mailboxes has been corrupted, and has been complaining about index sync issues. So I am attempting a force-resync. The command I used was: doveadm -v force-resync -u user(a)mailbox.com '*' The output it's been giving doesn't look anything like a 'progress counter', so I have no idea if it's just losing its mind, or if it's actually achieving anything. The mailbox is 20G, so theoretically it's just working its way through it, but I can't tell. The output looks like: doveadm(user(a)mailbox.com): Warning: fscking index file /home/mail/mailbox.com/user/mdbox/storage/dovecot.map.index doveadm(user(a)mailbox.com): Warning: mdbox /home/mail/mailbox.com/user/mdbox/storage: rebuilding indexes doveadm(user(a)mailbox.com): Warning: Transaction log file /home/mail/mailbox.com/user/mdbox/storage/dovecot.map.index.log was locked for 90 seconds (mdbox storage rebuild) doveadm(user(a)mailbox.com): Warning: fscking index file /home/mail/mailbox.com/user/mdbox/storage/dovecot.map.index doveadm(user(a)mailbox.com): Warning: fscking index file /home/mail/mailbox.com/user/mdbox/storage/dovecot.map.index doveadm(user(a)mailbox.com): Warning: mdbox /home/mail/mailbox.com/user/mdbox/storage: rebuilding indexes doveadm(user(a)mailbox.com): Warning: Transaction log file /home/mail/mailbox.com/user/mdbox/storage/dovecot.map.index.log was locked for 90 seconds (mdbox storage rebuild) It's just this over and over and over and over. Does this mean it's working, or that something else is going on? fuser /home/mail/mailbox.com/user/mdbox/storage/dovecot.map.index.log shows only the PID of the force-resync, and ls -l /proc/pid/fd shows it has a bunch of index and index.log and index.cache files open, as well as scrolling through mdbox/storage/m.{digits} a bunch, and strace -fp on the process shows a boatload of pread64 on those m.{digits} files, so I *think* it's working, but I can't tell if it's just restarting after the above messages and doing the same thing over and over again. I've locked the mailbox so there's no mail delivery being attempted on it, and changed its password and kicked out any logged in users on the mailbox, so the only process anywhere near that entire directory structure is the force-resync. Thanks, Justin

1 0

dovecot lmtp and smtputf8
by Kamil Jońca 25 Oct '23

25 Oct '23

Does dovecot handle smtputf8? Last articles regarding this are several years old. Anything changed? KJ

2 2

dovecot 2.0 supports EC private key?
by Marc 24 Oct '23

24 Oct '23

Does dovecot 2.0 supports EC private key?

2 1

Question: ETA OpenSSL 3.0 Support
by Niklas Meyer 23 Oct '23

23 Oct '23

Hello everyone, i stumbled across some serious problems with decrypting of e-mails if you use a Dovecot installation with OpenSSL 3.X so i started digging. It turns out that Dovecot is not OpenSSL 3.X ready yet, at least if you compile it yourself. The Debian Project adapted a OpenSSL 3.X patch to their repo version of Dovecot to make it run with Debian 12. Alpine Linux has not added a Workaround Patch for Dovecot yet. This is actually really bad if you want to Upgrade your Dovecot Server to a Distro which has OpenSSL 3.X as the new standard and you are not using their patched Repo Versions but instead compiling dovecot by yourself or install it from your package repos (which are not Debian 12 compatible also, which is probably because of OpenSSL 3.X i presume?) However though i think that this compatibility should be added soon as more and more Distros are using OpenSSL 3.X. So: Is there a approx. ETA when the OpenSSL Compatibility the devs worked/are working on is coming? Thank you for your answers. Kind regards from Germany Niklas Meyer aka. DerLinkman

2 3

Confusing documentation for 'address/listen' setting
by Bruno Victal 21 Oct '23

21 Oct '23

Hi, The 'address' setting in the “Service configuration” of the Configuration Manual [1] says: Space separated list of IP addresses / host names to listen on. […] Defaults to listen setting. I'm finding this part confusing as it seems that by “listen setting” it is referring to the 'listen' setting in the “Dovecot Core Manual” [2] which is described as: A comma-separated list of IP addresses or […] which leads me to suspect that either “listen setting” refers to something else (what?) or there's some inconsistency with the documentation or perhaps a bug/foot-gun here. [1]: <https://doc.dovecot.org/configuration_manual/service_configuration/#address> [2]: <https://doc.dovecot.org/settings/core/#core_setting-listen> Regards, -- Bruno.

1 0

Re: Dovecot behind Reverse Proxy and IP families
by Arnaud Cordier 20 Oct '23

20 Oct '23

On 10/13/23 06:55, Arnaud Cordier wrote: > Hi Justas, > > Thank you for your answer. Unfortunately, I already have a dual stack > cluster with an IPv6 assigned to the pod: > > 3: eth0@if22: <BROADCAST,MULTICAST,UP,LOWER_UP,M-DOWN> mtu 1430 qdisc > noqueue state UP qlen 1000 > link/ether c6:90:d2:cf:b8:77 brd ff:ff:ff:ff:ff:ff > inet 10.42.4.52/32 scope global eth0 > valid_lft forever preferred_lft forever > inet6 fd23:23:42:0:251d:192a:bb7f:a1f4/128 scope global > valid_lft forever preferred_lft forever > inet6 fe80::c490:d2ff:fecf:b877/64 scope link > valid_lft forever preferred_lft forever > > Any additional idea? > > --- > Arnaud Cordier > --------------- > CryptID > Freelance cybersecurity engineer - Pentester - Red teamer > Tel: +33 (0)6 61 44 82 04 > On 10/12/23 22:54, Justas Umbrasas wrote: >> >> Hey, >> >> >> we are running a similar setup without an issue (not on k8s). I >> believe the reason is that the remote dovecot pod is only binding on >> IPv4 and has no IPv6 configured. This is kind of a hack, however you >> could try binding the pod to both IPv4 and IPv6 and see if it works. >> >> >> Best, >> >> Justas Umbrasas >> >> >> On 2023-10-12 20:25, Arnaud Cordier via dovecot wrote: >> >>> Dear all, >>> >>> I am running Dovecot 2.3.20 in a Kubernetes cluster. The Dovecot >>> container is exposed behind a Traefik load-balancer, which acts just >>> like HAProxy would, using the Proxy Protocol in order to allow >>> Dovecot to be aware of the real source IP of the client, as follows: >>> >>> Internet <-> Traefik load-balancer <---- Proxy protocol ----> Dovecot >>> >>> My setup works well over IPv4. >>> >>> Oct 12 19:11:33 imap-login: Info: Login: user=<arnaud@xxx>, >>> method=PLAIN, rip=<my_ipv4_public_address> lip=10.42.4.21, >>> mpid=1369531, session=<xxxx> >>> >>> Howevever, if the client originates from an IPv6 address, Dovecot >>> does not seem to take the real IPv6 origin into account and fails. >>> >>> Oct 12 19:09:04 imap-login: Error: haproxy(v1): Client disconnected: >>> Proxied local address is invalid (address=`10.42.4.21', rip=10.42.4.21) >>> >>> A network capture shows that the proxy protocol indeed sends the >>> real IPv6 IP, that should be taken into account by dovecot: >>> >>> ......&.PROXY TCP6 2001:<rest_of_my_public_ip> 10.42.4.21 20200 993 >>> >>> The error seems to be raised in >>> "core/src/lib-master/master-service-haproxy.c" line 553: >>> >>> 551 if (net_addr2ip(*fields, &local_ip) < 0 || >>> 552 local_ip.family != family) { >>> 553 e_error(hpconn->event, "Client disconnected: " >>> 554 "Proxied local address >>> is invalid " >>> 555 "(address=`%s', >>> rip=%s)", str_sanitize(*fields, 64), >>> 556 net_ip2addr(real_remote_ip)); >>> 557 return -1; >>> 558 } >>> 559 fields++; >>> >>> I suppose that the issue is related to the fact that the client >>> originates from an IPv6 then the reverse proxy forwards the >>> connection to Dovecot over IPv4, which results in the >>> "local_ip.family != family" condition to be true. >>> >>> Why is such a restriction implemented ? >>> >>> It is to be noted that I implemented the exact same load-balancer >>> architecture for postfix, which successfully handles an IPv6 real IP >>> over an IPv4 connection. >>> >>> I temporarily fixed the issue by setting an IPv4 only DNS record for >>> my imaps domain name, however, do you think that a fix could be >>> implemented in Dovecot? >>> >>> Kind regards, >>> >>> _______________________________________________ >>> dovecot mailing list -- dovecot(a)dovecot.org >>> To unsubscribe send an email to dovecot-leave(a)dovecot.org >> >> On 10/13/23 06:55, Arnaud Cordier wrote: Hi Justas, Thank you for your answer. Unfortunately, I already have a dual stack cluster with an IPv6 assigned to the pod: 3: eth0@if22: <BROADCAST,MULTICAST,UP,LOWER_UP,M-DOWN> mtu 1430 qdisc noqueue state UP qlen 1000 link/ether c6:90:d2:cf:b8:77 brd ff:ff:ff:ff:ff:ff inet 10.42.4.52/32 scope global eth0 valid_lft forever preferred_lft forever inet6 fd23:23:42:0:251d:192a:bb7f:a1f4/128 scope global valid_lft forever preferred_lft forever inet6 fe80::c490:d2ff:fecf:b877/64 scope link valid_lft forever preferred_lft forever Any additional idea? --- Arnaud Cordier --------------- CryptID Freelance cybersecurity engineer - Pentester - Red teamer Tel: +33 (0)6 61 44 82 04 On 10/12/23 22:54, Justas Umbrasas wrote: Hey, we are running a similar setup without an issue (not on k8s). I believe the reason is that the remote dovecot pod is only binding on IPv4 and has no IPv6 configured. This is kind of a hack, however you could try binding the pod to both IPv4 and IPv6 and see if it works. Best, Justas Umbrasas On 2023-10-12 20:25, Arnaud Cordier via dovecot wrote: Dear all, I am running Dovecot 2.3.20 in a Kubernetes cluster. The Dovecot container is exposed behind a Traefik load-balancer, which acts just like HAProxy would, using the Proxy Protocol in order to allow Dovecot to be aware of the real source IP of the client, as follows: Internet <-> Traefik load-balancer <---- Proxy protocol ----> Dovecot My setup works well over IPv4. Oct 12 19:11:33 imap-login: Info: Login: user=<arnaud@xxx>, method=PLAIN, rip=<my_ipv4_public_address> lip=10.42.4.21, mpid=1369531, session=<xxxx> Howevever, if the client originates from an IPv6 address, Dovecot does not seem to take the real IPv6 origin into account and fails. Oct 12 19:09:04 imap-login: Error: haproxy(v1): Client disconnected: Proxied local address is invalid (address=`10.42.4.21', rip=10.42.4.21) A network capture shows that the proxy protocol indeed sends the real IPv6 IP, that should be taken into account by dovecot: ......&.PROXY TCP6 2001:<rest_of_my_public_ip> 10.42.4.21 20200 993 The error seems to be raised in "core/src/lib-master/master-service- haproxy.c" line 553: 551 if (net_addr2ip(*fields, &local_ip) < 0 || 552 local_ip.family != family) { 553 e_error(hpconn->event, "Client disconnected: " 554 "Proxied local address is invalid " 555 "(address=`%s', rip=%s)", str_sanitize(*fields, 64), 556 net_ip2addr(real_remote_ip)); 557 return -1; 558 } 559 fields++; I suppose that the issue is related to the fact that the client originates from an IPv6 then the reverse proxy forwards the connection to Dovecot over IPv4, which results in the "local_ip.family != family" condition to be true. Why is such a restriction implemented ? It is to be noted that I implemented the exact same load-balancer architecture for postfix, which successfully handles an IPv6 real IP over an IPv4 connection. I temporarily fixed the issue by setting an IPv4 only DNS record for my imaps domain name, however, do you think that a fix could be implemented in Dovecot? Kind regards, _______________________________________________ dovecot mailing list -- dovecot(a)dovecot.org To unsubscribe send an email to dovecot-leave(a)dovecot.org

2 1

submission server relay to localhost
by Michael Grant 20 Oct '23

20 Oct '23

I'm trying to set up dovecot-submission server which will listen on external ports 465 (SSL) and 587 (StartTLS) and relay mail to sendmail waiting on localhost port 587. I have dovecot submission listening on the external ports and sendmail listening on the localhost port. I want dovecot-submission doing the authentication on the external ports because sendmail doesn't use the /etc/dovecot/users file. I can authenticate to dovecot: auth: Debug: client in: CONT<hidden> auth: Debug: passwd-file(mgrant(a)top.networkguild.org,217.35.29.56,<blablabla>): Performing passdb lookup auth: Debug: passwd-file(mgrant(a)top.networkguild.org,217.35.29.56,<blablabla>): lookup: user=mgrant(a)top.networkguild.org file=/etc/dovecot/users auth: Debug: passwd-file(mgrant(a)top.networkguild.org,217.35.29.56,<blablabla>): Finished passdb lookup auth: Debug: auth(mgrant(a)top.networkguild.org,217.35.29.56,<blablabla>): Auth request finished auth: Debug: client passdb out: OK 1 user=mgrant(a)top.networkguild.org But in the sendmail logs, dovecot *is* trying to authenticate and it's trying to use a username that sendmail can't look up in the password file: top sm-mta[1012721]: 39KCg8h31012721: --- 220 top.networkguild.org ESMTP Sendmail 8.17.2/8.17.2/Debian-1~bpo12+1; Fri, 20 Oct 2023 12:42:08 GMT; (No UCE/UBE) logging access from: localhost(OK)-localhost [IPv6:0:0:0:0:0:0:0:1] top sm-mta[1012721]: 39KCg8h31012721: <-- EHLO top.networkguild.org top sm-mta[1012721]: 39KCg8h31012721: --- 250-top.networkguild.org Hello localhost [IPv6:0:0:0:0:0:0:0:1], pleased to meet you top sm-mta[1012721]: 39KCg8h31012721: --- 250-ENHANCEDSTATUSCODES top sm-mta[1012721]: 39KCg8h31012721: --- 250-PIPELINING top sm-mta[1012721]: 39KCg8h31012721: --- 250-EXPN top sm-mta[1012721]: 39KCg8h31012721: --- 250-VERB top sm-mta[1012721]: 39KCg8h31012721: --- 250-8BITMIME top sm-mta[1012721]: 39KCg8h31012721: --- 250-SIZE top sm-mta[1012721]: 39KCg8h31012721: --- 250-AUTH DIGEST-MD5 CRAM-MD5 top sm-mta[1012721]: 39KCg8h31012721: --- 250-STARTTLS top sm-mta[1012721]: 39KCg8h31012721: --- 250-DELIVERBY top sm-mta[1012721]: 39KCg8h31012721: --- 250 HELP top sm-mta[1012721]: 39KCg8h31012721: <-- MAIL FROM:<mgrant(a)top.networkguild.org> AUTH=mgrant(a)top.networkguild.org top sm-mta[1012721]: 39KCg8h31012721: --- 530 5.7.0 Authentication required top dovecot: submission(mgrant(a)top.networkguild.org)<1012719><blablabla>: Error: Relay server requires authentication: 530 5.7.0 Authentication required top dovecot: submission(mgrant(a)top.networkguild.org)<1012719><blablabla>: Disconnected: Internal error occurred. Refer to server log for more information. (unfinished MAIL command) (state=MAIL FROM) in=41 out=121 top sm-mta[1012721]: 39KCg8h31012721: <-- QUIT How do I stop dovecot from proposing AUTH to the relay server? Once I am authenticated via dovecot, the relay which is only available on localhost, doesn't need to authenticate. It should be as if bin-mail is submitting to localhost. I tried setting up a user with a password but no shell and configure this into submission_relay_master_user and submission_relay_password but this leads to other problems. Dovecot wants to do PLAIN auth, so I then enable starttls, but then the ssl certificate doesn't match because I'm connecting to localhost, not top.networkguild.org. So it seems clear, the relay should a) not auth, and b) not do ssl. Note that this is not an open relay, it's only open on the loopback interface. Michael Grant

1 1

Extract body preview in lua notify script
by Filip Hanes 20 Oct '23

20 Oct '23

Hi, I am trying to extract short text preview from mail body in function dovecot_lua_notify_end_txn. I want to send notification about new email with perex included. How can it be done? Is it possible? thanks -- Filip Hanes

2 1

Replicator service in Dovecot 2.4 CE
by k v 18 Oct '23

18 Oct '23

On the documentation page for the upgrade to version 2.4 at https://doc.dovecot.org/3.0/installation_guide/upgrading/from-2.3-to-3.0/, it is mentioned that instead of the 'replicator' service (https://doc.dovecot.org/configuration_manual/replication/#replication-with-…) it is necessary to use an NFS cluster file system. Are you completely removing support for 'replication-with-dsync' starting from version 2.4? Are there any plans for built-in tools to implement an active/active or active/passive cluster in the community edition?

2 1