- dovecot - dovecot.org

Re: Dovecot lda-dupes
by Francis Augusto Medeiros-Logeay 28 Sep '23

28 Sep '23

Never mind, I found it. I had to add `replication_dsync_parameters`, with the default values, but with `-x shared` to exclude the namespace. Best, Francis

1 0

Dovecot lda-dupes
by Francis Augusto Medeiros-Logeay 27 Sep '23

27 Sep '23

Hi, Since I enabled shared mailboxes I'm having these errors: Sep 27 21:22:41 doveadm(francis(a)med-lo.eu): Error: Failed to access mailbox dovecot/lda-dupes: stat(/var/mail/vmail/med-lo.eu/francis/.dovecot.lda-dupes/tmp) failed: Not a directory And replication stopped. How can I fix this? Best, Francis

1 0

Separators and shared namespaces
by martin f krafft 27 Sep '23

27 Sep '23

Hello, I am running Dovcecot 2.3.19 on Debian, and I am trying to get shared to work. It's working if I do this: ``` namespace { type = shared separator = / prefix = Team/%%u/ location = maildir:%%h/Maildir:INDEX=%h/Maildir/Team/%%u:INDEXPVT=%h/Maildir/Team/%%u subscriptions = no list = children } ``` After setting some ACLs, I now have the following in `LIST` output: ``` … . LIST "" * * LIST (\HasNoChildren) "/" INBOX […] * LIST (\Noselect \HasChildren) "/" Team/rechnungseingang(a)example.org * LIST (\HasNoChildren) "/" "Team/rechnungseingang(a)example.org/Archiv bearbeitete Rechnungen" . OK List completed (0.003 + 0.000 + 0.007 secs). ``` However, since I am using Maildir, the default separator is `.`, and so I have to change the separator for the `inbox` namespace, which makes me feel uneasy. The system still uses `.dotted.notation` on the filesystem despite the namespace change, and subfolders and all still work, but it still rubs me the wrong way to do this. And yet, when I try to use `.` like this: ``` separator = . prefix = Team.%%u. location = maildir:%%h/Maildir:INDEX=%h/Maildir/.Team,%%u:INDEXPVT=%h/Maildir/.Team.%%u ``` then nothing shows up in `LIST` output. Any idea why this might be? Thanks, -- martin krafft | https://matrix.to/#/#madduck:madduck.net "den stil verbessern, das heißt den gedanken verbessern." - friedrich nietzsche {: .blockquote } spamtraps: madduck.bogus(a)madduck.net {: .hidden }

2 2

Re: Separators and shared namespaces
by Francis Augusto Medeiros-Logeay 27 Sep '23

27 Sep '23

Hi, When I used a ‘.’ as a separator, it seemed to truncate paths with the domain name, such as those with %%d. That happened only to shared namespaces. Best, Francis

1 0

Exclude shared mailboxes from replication
by Francis Augusto Medeiros-Logeay 27 Sep '23

27 Sep '23

Hi, I was wondering if it is possible to exclude shared mailboxes from replication. I have userb(a)mydomain.com sharing mailboxes to usera(a)mydomain.com. However, since both mailboxes already replicate to a backup server, I wonder if it is possible to exclude the replicated mailboxes from syncing. Best, Francis

1 0

is dovecot 2.3.20 compatible with YESCRYPT?
by Andrew Hoff 26 Sep '23

26 Sep '23

To Whom It May Concern, Fedora 38 uses YESCRYPT by default to create the passwords stored in "shadow". The prefix is "$y$". Ref: https://doc.dovecot.org/configuration_manual/authentication/password_scheme… The nearest supported password scheme is blowfish. Can dovecot 2.3.20 read passwords created with YESCRYPT? Regards, -- Andrew Hoff 6/10 Middle Road Maribyrnong 3032 Victoria Australia Tel: 0393185581 (unreachable outside of Australia) Mob: 0400966178 Email: andrew.hoff(a)bigpond.com

2 2

Re: expunge & sh error
by Joseph Tam 26 Sep '23

26 Sep '23

From: "Данила Колесников" <d1kolesnikov(a)gmail.com> > I would like to expunge Inbox mailbox every 60 days > This mailbox is not in the config any I try to use "doveadm expunge". > But my sh configs doesn't works: Fatal: Invalid search date parameter: 60d > If I enter the contents of the config directly into the console - > everything works correctly > the same code in sh - ends with an error. This sounds like a shell parsing error rather than a dovecot bug. What is the exact command you are using? Are you trying to empty your INBOX every 60d, or rather, remove messages older than 60days? If the former, you can probably just delete the entire INBOX folder or mailbox via filesystem commands as an alternative. Joseph Tam <jtam.home(a)gmail.com>

1 0

Re: All list=yes namespaces must use the same separator - don't they?
by Francis Augusto Medeiros-Logeay 25 Sep '23

25 Sep '23

It works everywhere now. I guess it just needed its sweet time.

1 0

Re: All list=yes namespaces must use the same separator - don't they?
by Francis Augusto Medeiros-Logeay 25 Sep '23

25 Sep '23

I found what the problem was. It seems that using ‘.’ as a separator worked. But somehow folders and domain names with dots got messed up: maildir++: root=/var/mail/vmail/francisaugusto/francis, index=/var/mail/vmail/med-lo.eu/francis/shared/index/francis@francisaugusto, indexpvt=/var/mail/vmail/med-lo.eu/francis/shared/francis@francisaugusto, control=, inbox=/var/mail/vmail/francisaugusto/francis, alt= Sep 25 19:10:57 imap(francis(a)med-lo.eu)<58061><skunigB>: Debug: Namespace shared.francis@francisaugusto.: Creating storage despite: Root mail directory doesn't exist: /var/mail/vmail/francisaugusto/francis You see, my domain is francisaugusto.com <http://francisaugusto.com/>, but it got truncated. I changed the separator to ‘/‘ on the Inbox namespace and on the shared one, and voila, it worked. I can see my shared mailboxes everywhere. But on Apple Mail (both on the Mac and on the iPhone), the shared mailboxes show no message. Any clue why?

1 0

Sieve vacation function sends auto-reply with generic From: Address
by Thomas Boroske 25 Sep '23

25 Sep '23

Good day to you all. I have a question regarding the dovecot sieve vacation function that I am unable to answer myself by reading the documentation. A while ago we moved our dovecot server to a newer system (and newer dovecot version 2.3.16 ). This worked mostly fine, except there is now an issue with the auto-reply emails send from sieve vacation scripts. While the sending of the auto reply generally works fine, the emails always appear to come from the "sysgroup(a)ida.ing.tu-bs.de" address rather than the original recipient of the message. This is bad since the recipient of the auto reply then has no idea who the person on vacation actually is (unless there is a name in the message body). The sieve scripts are managed by roundcube webmail, an example entry for a vacation rule looks like this: require ["vacation"]; # rule:[Vacation] if true { vacation :days 7 :subject "Nicht im Büro" :from "tbtest(a)ida.ing.tu-bs.de" "Ich bin nicht da!"; } This looks ok to me. The problem is that the "tbtest" address is not used in the generated reply, instead sysgroup(a)ida.ing.tu-bs.de is used as a from address for all recipients. Note that the sysgroup@ address appears nowhere in the dovecot config, but it does in /etc/postfix/sender-canonical like that: root(a)ida.ing.tu-bs.de sysgroup(a)ida.ing.tu-bs.de @ida.ing.tu-bs.de sysgroup(a)ida.ing.tu-bs.de @net.ida sysgroup(a)ida.ing.tu.bs.de The /etc/dovecot/conf.d/90-sieve.conf is mostly on default values, the remaining config settings are these: plugin { sieve = file:~/Maildir/sieve;active=~/Maildir/.dovecot.sieve sieve_extensions = +editheader #Send vacation auto responder with correct Address sieve_vacation_send_from_recipient = yes sieve_vacation_use_original_recipient = no } I have attached the output of "dovecot -n" below. Many thanks for any ideas on what could be the issue! Kind regards, Thomas -- Dipl. Inf. Thomas Boroske Institute of Computer and Network Engineering TU Braunschweig Hans-Sommer-Str. 66, D-38106 Braunschweig, Germany www.ida.ing.tu-bs.de

2 2

All list=yes namespaces must use the same separator - don't they?
by Francis Augusto Medeiros-Logeay 25 Sep '23

25 Sep '23

Hi, I am trying to configure shared mailboxes, so I enabled the acl and the imap_acl plugins. But I got the "All list=yes namespaces must use the same separator" error when I added this: namespace { type = shared #separator = # Mailboxes are visible under "shared/user@domain/" # %%n, %%d and %%u are expanded to the destination user. prefix = shared/%%u/ # Mail location for other users' mailboxes. Note that %variables and ~/ # expands to the logged in user's data. %%n, %%d, %%u and %%h expand to the # destination user's data. location = maildir:/var/mail/vmail/%%d/%%n:INDEX=/var/mail/vmail-index/index/%%d/%%n:INDEXPVT=/var/mail/vmail-index/index/%%d/%%n # Use the default namespace for saving subscriptions. subscriptions = no # List the shared/ namespace only if there are visible shared mailboxes. list = children } I don't have any separator configured explicitly, and when I see the config, the value is empty. So I don't really know what is the problem here. Any hints? Best, Francis -- Francis Augusto Medeiros-Logeay Oslo, Norway

1 0

expunge & sh error
by Данила Колесников 24 Sep '23

24 Sep '23

Hello! I would like to expunge Inbox mailbox every 60 days This mailbox is not in the config any I try to use "doveadm expunge". But my sh configs doesn't works: Fatal: Invalid search date parameter: 60d If I enter the contents of the config directly into the console - everything works correctly the same code in sh - ends with an error. It is bug or I do mistake? root@mail:~# doveconf -n # 2.3.16 (7e2e900c1a): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.16 (09c29328) # OS: Linux 5.15.0-84-generic x86_64 Ubuntu 22.04.2 LTS # Hostname: mail.onelec.ru auth_mechanisms = plain login auth_verbose = yes base_dir = /run/dovecot/ disable_plaintext_auth = no log_path = /var/log/dovecot.log login_greeting = Mail Delivery Agent mail_access_groups = mail mail_location = maildir:%h/mail/%d/%n mail_privileged_group = mail namespace { inbox = yes list = yes location = mailbox Archive { auto = subscribe autoexpunge = 30 days special_use = \Archive } mailbox "Deleted Messages" { auto = no autoexpunge = 1 weeks special_use = \Trash } mailbox Drafts { auto = subscribe autoexpunge = 1 weeks special_use = \Drafts } mailbox Junk { auto = no autoexpunge = 1 weeks special_use = \Junk } mailbox Sent { auto = subscribe autoexpunge = 90 days special_use = \Sent } mailbox "Sent Mail" { auto = no autoexpunge = 90 days special_use = \Sent } mailbox "Sent Messages" { auto = no autoexpunge = 90 days special_use = \Sent } mailbox Spam { auto = subscribe autoexpunge = 1 weeks special_use = \Junk } mailbox Trash { auto = subscribe autoexpunge = 1 weeks special_use = \Trash } prefix = separator = / type = private } passdb { args = scheme=MD5-CRYPT username_format=%n /etc/exim4/domains/%d/passwd driver = passwd-file } plugin { quota = maildir:User quota } protocols = imap pop3 service auth { extra_groups = mail unix_listener auth-client { group = mail mode = 0660 user = dovecot } user = dovecot } service stats { unix_listener stats-writer { group = mail mode = 0660 user = dovecot } } ssl_cert = </usr/local/hestia/ssl/certificate.crt ssl_cipher_list = ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:DHE-RSA-AES256-SHA256 ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it ssl_prefer_server_ciphers = yes userdb { args = username_format=%n /etc/exim4/domains/%d/passwd driver = passwd-file } protocol imap { mail_plugins = quota imap_quota } protocol pop3 { mail_plugins = quota } local_name mail.bearlion.ru { ssl_cert = </home/bearlion/conf/mail/bearlion.ru/ssl/bearlion.ru.pem ssl_key = # hidden, use -P to show it } local_name mail.onelec.ru { ssl_cert = </home/onelec/conf/mail/onelec.ru/ssl/onelec.ru.pem ssl_key = # hidden, use -P to show it } local_name mail.radiokey.ru { ssl_cert = </home/radiokey/conf/mail/radiokey.ru/ssl/radiokey.ru.pem ssl_key = # hidden, use -P to show it }

2 1

possible doveadm expunge bug
by Noel Butler 24 Sep '23

24 Sep '23

In my boredom, I was cleaning up my own public mailbox, do I really need lists/newsletters/forums posts from the 90's .. I think not, but lets still keep 5 years and expunge the rest... or try to... but expunge doesnt want too... This error or lack of action, occurs on any mailbox, as an example doveadm expunge -u my@email mailbox Lists.FreeRadius SAVEDBEFORE $ now for $, pick your value 5 y/Y for years doesn't appear to exist, so converting it into 30 odd weeks, 30w or 30W did nothing, but rough convert it down to days 1800D appears to do something - showing a delay before returning to command line, but in reality it does nothing, 1800, 1500, 1200, nothing, only when I drop it to 1000D does it actually work, which is not suitable, since I'd like to keep 5 years worth. Running doveadm -Dv exp... shows no errors just usual debug output about the base modules, quota stuff, and opening mailbox message followed then by user session closed, nothing at all anywhere that points to an error for executing this task, I did deliberately break it by altering the mailbox name to test and it rightfully did report the error the mailbox doesn't exist. I thought it might be size related, freeradius one of the smaller lists having about 150k to nanog the biggest with over 400k message, but I have others, like monthly newsletters with over 20yrs worth, but only 250 to 300 messages in their mailboxes that also fail, so it can't be barfing out at the size. Aki, any ideas? Or have I have hit a ridiculously low 1000D hard coded limit? ...and I know some troll will comment, so let me say yes I know I can and will likely have to use nix's "find" to actually cull them, but if doveadm has an expunge option, it should do what it is asked of it :) # doveconf -a # 2.3.20 (80a5ac675d): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.20 (149edcf2) # OS: Linux 5.15.117 x86_64 Slackware 15.0 ext4 - Yes I know 2.3.21 was released 2 days ago, but I'm not seeing anything in changelog/NEWS that's related -- Regards, Noel Butler This Email, including attachments, may contain legally privileged information, therefore at all times remains confidential and subject to copyright protected under international law. You may not disseminate this message without the authors express written authority to do so. If you are not the intended recipient, please notify the sender then delete all copies of this message including attachments immediately. Confidentiality, copyright, and legal privilege are not waived or lost by reason of the mistaken delivery of this message.

2 2

Dovecot OIDC question
by dovecot＠deeztek.net 23 Sep '23

23 Sep '23

Exploring the possible use of SSO using OIDC with Dovecot. Trying to understand the functionality of OIDC as it pertains to e-mail clients like Thunderbird, Outlook etc... My OIDC provider will authenticate a user by intercepting the connection attempt to the resource, present a login screen and after success it will redirect to the resource. When it comes to e-mail clients, how would that process work if at all? Thanks

1 0

2.3.21 broke XOAUTH authentication against Keycloak
by tj＠interseclab.org 23 Sep '23

23 Sep '23

I have Roundcube and Dovecot2 setup to authenticate against Keycloak using the XOAUTH2 method, as follows: introspection_url = https://[...]/realms/[...]/protocol/openid-connect/token/introspect introspection_mode = post username_attribute = email client_id = [...] client_secret = [...] tls_ca_cert_file = /etc/ssl/certs/ca-certificates.crt Since upgrading to 2.3.21 XOAUTH2 fails to authenticate with: dovecot: auth: Error: oauth2([...],[...],<[...]>): oauth2 failed: Introspection failed: No username returned WARN [org.keycloak.events] (executor-thread-45) type=INTROSPECT_TOKEN_ERROR, realmId=[...], clientId=null, userId=null, ipAddress=[...], error=client_not_found WARN [org.keycloak.events] (executor-thread-45) type=INTROSPECT_TOKEN_ERROR, realmId=[...], clientId=null, userId=null, ipAddress=[...], error=invalid_request, detail='Authentication failed.' Downgrading to 2.3.20 fixes the issue. I believe this change is to blame: lib-oauth2: Dovecot would send client_id and client_secret as POST parameters to the introspection server. These need to be optionally in Basic auth instead. Is there anything I should change in my Keycloak/Dovecot config or is this a bug?

2 1

Change location where .dovecot.lda-dupes* file/dir are created
by sahsanu 22 Sep '23

22 Sep '23

Hello, I'm using Dovecot 2.3.19.1 and Pigeonhole 0.5.19 on Debian 12.1 and I'm trying to use sieve extensions vacation and redirect but I'm having issues because of the creation of file /home/USER/.dovecot.lda-dupes and dir /home/USER/.dovecot.lda-dupes.locks The error in logs is pretty clear, lda doesn't have perms to create any of them because /home/USER/ is owned by root # namei -mo /home/user2/ f: /home/user2/ drwxr-xr-x root root / drwxr-xr-x root root home drwxr-xr-x root root user2 I'm using Hestia Control Panel and it chroot the users and that is the reason the user's home is owned by root. Mail users are virtual and the maildir home is /home/user2/mail/domain2.tld/postmaster (%h/mail/%d/%n) but the .dovecot.lda-dupes* file and dir are trying to use /home/user2/ instead of /home/user2/mail/domain2.tld/postmaster/ where they have perms and that should solve the issue. So, the question, is there any way to create .dovecot.lda-dupes* file/dir in virtual user's home %h/mail/%d/%n instead of user's home %h? or, is there any other solution/workaround where I don't need to change /home/USER/ owner/perms? If you want to check them, below are the logs and my dovecot conf. Appreciate your support. Best regards, sahsanu This is the sieve log using vacation extension: sieve: info: started log at 2023-09-21 13:17:06 +0200. error: msgid=<102288b1348f270d83363f71bb7bcc81(a)example.com>: vacation action: failed to check for duplicate vacation response: internal error occurred: refer to server log for more information. [2023-09-21 13:17:06]. This is the dovecot log using sieve vacation extension: Sep 21 13:17:06 lda(postmaster(a)domain2.tld)<2711250><SHdgDzImDGXSXikAElSLcQ>: Error: duplicate db: transaction: file_dotlock_open(/home/user2/.dovecot.lda-dupes) failed: Permission denied Sep 21 13:17:06 lda(postmaster(a)domain2.tld)<2711250><SHdgDzImDGXSXikAElSLcQ>: Error: duplicate db: transaction: Failed to lock /home/user2/.dovecot.lda-dupes.locks/duplicate.lock.ea887f77f1f61464f902ada5e7bfb022: mkdir_parents(/home/user2/.dovecot.lda-dupes.locks) failed: Permission denied This is the sieve log using redirect extension: sieve: info: started log at 2023-09-21 16:51:46 +0200. error: msgid=<8f1cdb9c-0997-4e32-a28f-65e5f3f8dca6.maildroid@localhost>: redirect action: failed to check for duplicate forward: internal error occurred: refer to server log for more information. [2023-09-21 16:51:46]. This is the dovecot log using sieve redirect extension: Sep 21 16:51:46 lda(postmaster(a)domain2.tld)<2785960><03j9DoJYDGWogioAElSLcQ>: Error: duplicate db: transaction: file_dotlock_open(/home/user2/.dovecot.lda-dupes) failed: Permission denied Sep 21 16:51:46 lda(postmaster(a)domain2.tld)<2785960><03j9DoJYDGWogioAElSLcQ>: Error: duplicate db: transaction: Failed to lock /home/user2/.dovecot.lda-dupes.locks/duplicate.lock.291440db1d5e4457ecf50cd02882634b: mkdir_parents(/home/user2/.dovecot.lda-dupes.locks) failed: Permission denied Dovecot conf: # 2.3.19.1 (9b53102964): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.19 (4eae2f79) # OS: Linux 6.1.0-12-amd64 x86_64 Debian 12.1 # Hostname: server.domain1.tld auth_mechanisms = plain login auth_verbose = yes base_dir = /run/dovecot/ log_path = /var/log/dovecot.log login_greeting = Mail Delivery Agent mail_access_groups = mail mail_attribute_dict = file:%h/mail/%d/%n/dovecot-attributes mail_location = maildir:%h/mail/%d/%n mail_privileged_group = mail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext imapflags notify imapsieve vnd.dovecot.imapsieve namespace { inbox = yes list = yes location = mailbox Archive { auto = subscribe special_use = \Archive } mailbox "Deleted Messages" { auto = no special_use = \Trash } mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk { auto = no special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Mail" { auto = no special_use = \Sent } mailbox "Sent Messages" { auto = no special_use = \Sent } mailbox Spam { auto = subscribe special_use = \Junk } mailbox Trash { auto = subscribe special_use = \Trash } prefix = separator = / type = private } passdb { args = scheme=MD5-CRYPT username_format=%n /etc/exim4/domains/%d/passwd driver = passwd-file } plugin { imapsieve_mailbox1_before = file:/var/mail/sieve/report_spam.sieve imapsieve_mailbox1_causes = COPY APPEND imapsieve_mailbox1_name = Spam imapsieve_mailbox2_before = file:/var/mail/sieve/report_ham.sieve imapsieve_mailbox2_causes = COPY imapsieve_mailbox2_from = Spam imapsieve_mailbox2_name = * imapsieve_url = sieve://127.0.0.1:4190 quota = maildir:User quota sieve = file:~/mail/%d/%n/sieve;active=~/mail/%d/%n/dovecot.sieve sieve_extensions = +notify +imapflags sieve_global_extensions = +vnd.dovecot.pipe +vnd.dovecot.environment sieve_pipe_bin_dir = /etc/dovecot/sieve sieve_plugins = sieve_imapsieve sieve_extprograms sieve_vacation_send_from_recipient = yes } protocols = imap sieve service auth { extra_groups = mail unix_listener auth-client { group = mail mode = 0660 user = dovecot } unix_listener auth-master { group = mail mode = 0660 user = dovecot } user = dovecot } service managesieve-login { inet_listener sieve { port = 4190 } } service stats { unix_listener stats-writer { group = mail mode = 0660 user = dovecot } } ssl_cert = </usr/local/hestia/ssl/certificate.crt ssl_cipher_list = ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:DHE-RSA-AES256-SHA256 ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it ssl_prefer_server_ciphers = yes userdb { args = username_format=%n /etc/exim4/domains/%d/passwd driver = passwd-file } protocol lda { auth_socket_path = /var/run/dovecot/auth-master mail_plugins = " quota sieve" } protocol imap { mail_plugins = quota imap_quota imap_sieve } protocol sieve { managesieve_implementation_string = Dovecot Pigeonhole managesieve_max_line_length = 64 k } protocol pop3 { mail_plugins = quota } local_name domain1.tld { ssl_cert = </home/user1/conf/mail/domain1.tld/ssl/domain1.tld.pem ssl_key = # hidden, use -P to show it } local_name mail.domain1.tld { ssl_cert = </home/user1/conf/mail/domain1.tld/ssl/domain1.tld.pem ssl_key = # hidden, use -P to show it } local_name domain2.tld { ssl_cert = </home/user2/conf/mail/domain2.tld/ssl/domain2.tld.pem ssl_key = # hidden, use -P to show it } local_name mail.domain2.tld { ssl_cert = </home/user2/conf/mail/domain2.tld/ssl/domain2.tld.pem ssl_key = # hidden, use -P to show it }

2 4

State of wiki.dovecot.org?
by Sebastian Philipp 20 Sep '23

20 Sep '23

Hi all I just noticed that wiki.dovecot.org is no longer available, and instead redirects to a message stating that the documentation can now be found at doc.dovecot.org. However, there's was quite a lot of information on wiki.dovecot.org that is not available on doc.dovecot.org. One such example is the setup guide for a Dovecot Director cluster [1]. The "corresponding" page on doc.dovecot.org [2] even starts with the following sentence: > See http://wiki.dovecot.org/Director for more details. Are there plans to migrate such pages to doc.dovecot.org as well? If not, could the Wiki be restored? Of course it's possible to access the Wiki contents via web.archive.org, but that's rather cumbersome and slow. Thanks and regards Sebastian [1]: http://web.archive.org/web/20230212020603/https://wiki2.dovecot.org/Director [2]: https://doc.dovecot.org/configuration_manual/director_settings -- Adfinis AG Sebastian Philipp, Systems Engineer GPG Key ID: 0x8C920482C5CDA5FB Güterstrasse 86 | CH-4053 Basel Office: 061 500 31 31 www.adfinis.com

2 1

New Dovecot release?
by Taavi Ansper 20 Sep '23

20 Sep '23

Hi When will there be a new dovecot release. The 2.3.21 version borked our users with large amount of folders (i think over 255 folders) doveadm(REDACTED_USER): Error: /proc/self/status is larger than expected I can't find the debian bug report (or was it mentioned in this same mailing list), but somebody else has mentioned the same issue. I hope this gets fixed in the next version. -- Taavi Ansper taavi.ansper(a)cyber.ee

3 6

dovecot username with domain
by Michael Grant 20 Sep '23

20 Sep '23

I've been using dovecot using system usernames (my unix uname as my IMAP username). But today I tried New Outlook which requires the imap username match my email address. Is there some way to tell dovecot that username@host is the same as uname? (where username@host is an email address and uname is a unix login which might be completely different). Michael Grant

5 7

Logging for doveadm index?
by Shawn Heisey 15 Sep '23

15 Sep '23

I have dovecot using Solr for FTS. Dovecot version is 2:2.3.20-3+ubuntu20.04 pulled from the official APT repo. This is my reindex script: https://paste.elyograg.org/view/74accd23 The reindex script kicks off the indexing process in the background. Dovecot logs to syslog, and those logs ultimately end up in mail.log. I have not seen any logging for the FTS reindexing. Specifically I would like to see how long the process took. Getting that info from the solr logs is a manual process and I can't think of a way to properly automate it. Is this something I can easily have dovecot log? Or is there a way to have 'doveadm index' run in the foreground instead of the background so the time can be calculated by my script? Thanks, Shawn

1 0

Pigeonhole v0.5.21 released
by Aki Tuomi 15 Sep '23

15 Sep '23

Hi all! We are pleased to release v0.5.21 of Pigeonhole. https://pigeonhole.dovecot.org/releases/2.3/dovecot-2.3-pigeonhole-0.5.21.t… https://pigeonhole.dovecot.org/releases/2.3/dovecot-2.3-pigeonhole-0.5.21.t… Binary packages in https://repo.dovecot.org/ Docker images in https://hub.docker.com/r/dovecot/dovecot Regards, Aki Tuomi Open-Xchange oy --- - sieve: Using the deleteheader action on a message with a broken/invalid header can cause the Sieve interpreter to crash with an assert panic. This can happen e.g. when the message is missing the empty EOH line between the headers and the body of the message. Fixes: Panic: file edit-mail.c: line 820 (edit_mail_headers_parse): assertion failed: (body_offset > 0). - sieve: Pigeonhole added an extra Message-ID header during mail forwarding when the existing one was invalid. Now it adds the Message-ID only if it is entirely missing. Existing Message-ID(s) are left unchanged.

1 0

Dovecot v2.3.21 released
by Aki Tuomi 15 Sep '23

15 Sep '23

Hi all! We are pleased to release v2.3.21 of Dovecot. https://dovecot.org/releases/2.3/dovecot-2.3.21.tar.gz https://dovecot.org/releases/2.3/dovecot-2.3.21.tar.gz.sig Binary packages in https://repo.dovecot.org/ Docker images in https://hub.docker.com/r/dovecot/dovecot Regards, Aki Tuomi Open-Xchange oy --- * lib-oauth2: Allow JWT tokens to be validated with missing typ field. The typ field is left out by some key issuers to conserve space, notably kubernetes. Now missing typ is tolerated, but if present, it still must be "jwt". + auth: Auth passdb and userdb reply can contain "event_<name>=value" which will be added to login event and mail user event respectively. + lib-master: Set process title during various initialization stages to clearly describe what the process is waiting on. + lib-storage: The mail_temp_scan_interval is now fuzzed incrementing it by 0..30% based on username's hash to reduce the chance of load spikes . + lib-storage: The temp file scan has been moved from the open of the mailbox to the close, to reduce the latency perceived by users. + stats: If metric has fields specified, all these fields are exported as counters to prometheus exposition. See https://doc.dovecot.org/configuration_manual/stats/openmetrics/. - *-login: Processes might have crashed when a SSL connection disconnect s uncleanly. - acl: When plugin was loaded \HasChildren and \HasNoChildren flags were calculated incorrectly for mailboxes containing '*' and '%' in their names. - auth: Crash occured if a connection to PostgreSQL database server failed during startup. - auth: Logins with invalid passwords (e.g. unknown scheme) in passdb were failing with "password mismatch" instead of "internal error". - auth: XOAUTH2 and OAUTHBEARER mechanisms were not giving out protocol specific error message on all errors. This especially broke OIDC discovery. - dbox: When last_temp_file_scan header wasn't set (especially after dsync migration), the next mailbox open always triggers the temp file scan. This could have caused a load spike after migrations. Fixed by using the mailbox directory's atime when the header isn't set, which usually moves the scan time into the future. - dict-redis: A crash would occur on transaction rollback. - dsync: Infinite loop causing out of memory would occur when handling mailbox deletion from remote end and hierarchy separators would differ. - dsync: Incremental dsync failed for folder names ending with '%', unless BROKENCHAR was set. Also folder names with '%' elsewhere in them caused each incremental dsync to unnecessarily rename the folder to a temporary name and back. v2.3.19 regression. - imap-hibernate: If an IMAP client unhibernation timed out with "(version received)", the unhibernation could still have successfully finished later on and continued working normally. This was rather confusing, because imap-hibernate already logged that the client got disconnected. Avoid this by forcing the connection to shutdown on unhibernation timeout. - imapc: Crashed when a folder mapped through the virtual plugin disappears from the storage. - imapc: EXPUNGE, EXISTS or FETCH replies from a server for a previously selected mailbox could have been processed as if they belonged to the new mailbox currently being selected. This could have caused warnings. - lib-http: Dovecot HTTP server (doveadm, stats/openmetrics) may have disconnected HTTP clients before the response is fully sent. This happened only on busy servers where kernel's socket buffers were rather full. - lib-http: Fixed a potential crash on http-server if a client disconnected early. v2.3.18 regression. - lib-index: Index file corruption could have caused a crash. Fixes: Panic: file mail-transaction-log-view.c: line 165 (mail_transaction_log_view_set): assertion failed: (min_file_seq <= max_file_seq). - lib-index: Purging an existing >1GB cache file can crash. Now cache files still above 1GB after purging are removed. Fixes: Panic: file mail-index-util.c: line 10 (mail_index_uint32_to_offset): assertion failed: (offset < 0x40000000) - lib-lua: A HTTP client could not resolve DNS names in mail processes, because it expected "the dns-client" socket to exist in the current directory. - lib-oauth2: Dovecot would send client_id and client_secret as POST parameters to the introspection server. These need to be optionally in Basic auth instead. - lib-oauth2: JWT aud validation was not performed if aud was missing from a token, but was configured on Dovecot. - lib-oauth2: JWT key type check was too strict. - lib-oauth2: JWT token audience was not validated against client_id as required by the specification. - lib-ssl-iostream: Using the ssl_require_crl=yes setting may have caused CRL check failures for outgoing SSL/TLS connections, although it was supposed to affect checking CRLs only for client-side SSL certificates. v2.3.17 regression. - lib-sql: MySQL driver leaked memory when connection failed. - lib-storage: Various fixes when running into out of disk space. - master: Service idle_kill setting didn't work properly on busy servers. It was very unlikely that any process was idling long enough to become killed. Also the idle_kill handling code was using quite a lot of CPU on the master process when there were a lot of processes (e.g. imap). The new behavior is to track the lowest number of idling processes every idle_kill time interval and then kill that many idling processes. - mdbox: Temp file scan was done for always empty directories. - mdbox: The fdatasync() call was done in wrong parent directory when writing mails. Also on a failure it crashed instead of logging an error. - notify_status: The plugin crashes if any user initialization fails. - pop3: Sending command with the ':' character caused an assert-crash. v2.3.18 regression. Fixes: Panic: event_reason_code_prefix(): name has ':' - stats: Fix panic when a nonexistent event exporter was referenced while adding a new metric dynamically via doveadm stats add. This produces a proper error now. - stats: If process exported a lot of events and then exited, some of the last events may have become lost. - stats: Invalid Prometheus label names were created with specific histogram group_by configurations. Prometheus rejected these labels. - welcome: The plugin didn't execute in some situations that created INBOX but didn't open it, e.g. if GETMETADATA was used before the INBOX was opened.

1 0

config: Error: Conflict in setting ssl_cert found from filter
by Ján Ondrušek 15 Sep '23

15 Sep '23

Hi! I see this intermittent error with my dovecot setup. The most puzzling part is that it sometimes works and sometimes rejects connections, spitting out the log I attached in systeport (DNS). I am binding both ipv4 (TLS+SNI) and ipv6 (dedicated addresses). TLS certificates for corresponding DNS are shared across ipv4 / ipv6. Thank you, Best regards, Jan

2 3

ACL management from SQL
by cyril.leclerc＠mantiq.com 14 Sep '23

14 Sep '23

Hello, we are facing issue, we manage the shared folder from SQL table, but it was never working as we have to manage acl permission from the server itself, we want to manage permissions (read or write) from the same application we can share user mailbox but it is written in dovecot documentation that is not supported now, we tried to find a mail client that could manage it at least, but only thunderbird was able to do it (but in version 60) and not more today. We saw that roundcube could handle it but we use rainloop. 1. It is really not possible at all to manage acl permissions fron SQL like the shared box itself ? 2. I tried to set acl permissions from old version of thunderbird, when i made modification it tried to update the sharedbox table, i did not see the query executed but as we were working on a view, the update failed. Do you know what it tried to do ?

3 8

Shared mailbox listing not working
by exactoph 14 Sep '23

14 Sep '23

Hi there, Having trouble with shared mailboxes. Followed the documentation, but the IMAP LIST doesn't work for mailboxes besides "INBOX" etc. In the meantime I've switched from file based acl_shared_dict to DB based as some people had problems with it. However still no success. I can see entries in the DB, doveadm acl get ... returns that the mailbox is shared, but it is not listed in doveadm mailbox list ... My configuration: https://pastebin.com/aWnMXJ4J Help would be very appreciated!

3 2