- dovecot - dovecot.org

Looking for SNI feature
by Sherin A 10 Sep '21

10 Sep '21

Hello, I am looking for an alternative feature for SNI certificates in dovecout. Current dovecot need to integreate the sni codes into the configuration as follows, local_name imap.example.org { ssl_cert = </etc/ssl/certs/imap.example.org.crt ssl_key = </etc/ssl/private/imap.example.org.key } I have thousands of domain in the server. So during the ssl certificate creation of each domain , I need to add the codes to the configuration and reload the service. That looks not a suitable feature. So my question is Do dovecot have a feature to read the certificate of every domain from another service , let us say I have service that will send the above sni setting to a socket and dovecot read it from that socket. Kindly let me know if dovecot have any such feature exists. This feature may be like the authentication using dictionary proxy service ? -- Regards Sherin A

1 0

Failed to do incremental sync
by Andrea Gabellini 09 Sep '21

09 Sep '21

Hello, Two dovecot server with replication and version 2.3.10.1 Today i have many warnings like those: Sep 9 12:13:43 dovecot: doveadm: Warning: Failed to do incremental sync for mailbox INBOX, retry with a full sync (uidnext 4465 < 4517) Sep 9 12:13:56 dovecot: doveadm: Warning: Failed to do incremental sync for mailbox INBOX, retry with a full sync (Modseq 4016 no longer in transaction log (highest=4106, last_common_uid=3451, nextuid=3452)) Do you have some suggestions on how to debug this? Or something I can check? Thanks, Andrea -- __________________________ There were computers in Biblical times. Eve had an Apple. __________________________ TIM San Marino S.p.A. Andrea Gabellini Engineering R&D TIM San Marino S.p.A. - https://www.telecomitalia.sm Via Ventotto Luglio, 212 - Piano -2 47893 - Borgo Maggiore - Republic of San Marino Tel: (+378) 0549 886237 Fax: (+378) 0549 886188 -- Informativa Privacy Questa email ha per destinatari dei contatti presenti negli archivi di TIM San Marino S.p.A.. Tutte le informazioni vengono trattate e tutelate nel rispetto della normativa vigente sulla protezione dei dati personali (Reg. EU 2016/679). Per richiedere informazioni e/o variazioni e/o la cancellazione dei vostri dati presenti nei nostri archivi potete inviare una email a privacy(a)telecomitalia.sm. Avviso di Riservatezza Il contenuto di questa e-mail e degli eventuali allegati e' strettamente confidenziale e destinato alla/e persona/e a cui e' indirizzato. Se avete ricevuto per errore questa e-mail, vi preghiamo di segnalarcelo immediatamente e di cancellarla dal vostro computer. E' fatto divieto di copiare e divulgare il contenuto di questa e-mail. Ogni utilizzo abusivo delle informazioni qui contenute da parte di persone terze o comunque non indicate nella presente e-mail potra' essere perseguito ai sensi di legge.

2 2

Using %{ssl_security} in the policy server
by Andrea Gabellini 09 Sep '21

09 Sep '21

Hello, I am looking for a way to verify, at the moment of the connection, who does not use encryption or uses weak encryption. My choice was the use of the policy server because I would like to block only a certain number of users per day, so as not to overload the support service. In the call to the policy server, only tls = true / false is passed as information. I would also be interested in %{ssl_security} but it is not present among the usable variables. Is there any way, perhaps using userdb/passdb, to be able to pass this variable to the policy server? Thanks, Andrea -- __________________________ Seen it all, done it all, can't remember most of it __________________________ TIM San Marino S.p.A. Andrea Gabellini Engineering R&D TIM San Marino S.p.A. - https://www.telecomitalia.sm Via Ventotto Luglio, 212 - Piano -2 47893 - Borgo Maggiore - Republic of San Marino Tel: (+378) 0549 886237 Fax: (+378) 0549 886188 -- Informativa Privacy Questa email ha per destinatari dei contatti presenti negli archivi di TIM San Marino S.p.A.. Tutte le informazioni vengono trattate e tutelate nel rispetto della normativa vigente sulla protezione dei dati personali (Reg. EU 2016/679). Per richiedere informazioni e/o variazioni e/o la cancellazione dei vostri dati presenti nei nostri archivi potete inviare una email a privacy(a)telecomitalia.sm. Avviso di Riservatezza Il contenuto di questa e-mail e degli eventuali allegati e' strettamente confidenziale e destinato alla/e persona/e a cui e' indirizzato. Se avete ricevuto per errore questa e-mail, vi preghiamo di segnalarcelo immediatamente e di cancellarla dal vostro computer. E' fatto divieto di copiare e divulgare il contenuto di questa e-mail. Ogni utilizzo abusivo delle informazioni qui contenute da parte di persone terze o comunque non indicate nella presente e-mail potra' essere perseguito ai sensi di legge.

2 1

SSL errors after certificate renewal
by Amol Kulkarni 08 Sep '21

08 Sep '21

Hello, After I replaced my certificate with a new one yesterday, I'm seeing some ssl related errors. There are successful pop/imap logins using SSL also. So I think the certificate in itself is fine. No user has complained as yet, so I don't know for sure. However the count of errors has surely increased after installing the new certificate. There are 2 errors seen : dovecot: imap-login: Disconnected (no auth attempts in 1 secs): user=<>, rip=, lip =, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:SSL3_READ_BYTES:sslv3 alert certificate unknown: SSL alert number 46, session=<9m0AnVnL 2pHf4hso> dovecot: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=, lip =, TLS: SSL_read() failed: error:14094412:SSL routines:SSL3_READ_BYTES:sslv3 alert bad certificate: SSL alert number 42, session=<ww/b6VfLmeR7yTog> Kindly help with some pointers. Thanks and Regards, Amol

8 8

How can I always send a vacation response with sieve?
by Steve Dondley 08 Sep '21

08 Sep '21

I don't want dovecot to wait X days before sending out another vacation response. However, setting the :days to "0" doesn't work. RFC https://www.rfc-editor.org/rfc/rfc5230.html#section-4.1 says: 4.1. Days Parameter The ":days" argument is used to specify the period in which addresses are kept and are not responded to, and is always specified in days. The minimum value used for this parameter is normally 1. Sites MAY define a different minimum value as long as the minimum is greater than 0. Sites MAY also define a maximum days value, which MUST be greater than 7, and SHOULD be greater than 30. If ":days" is omitted, the default value is either 7 or the minimum value (as defined above), whichever is greater. If the parameter given to ":days" is less than the minimum value, then the minimum value is used instead. If ":days" exceeds the site-defined maximum, the site-defined maximum is used instead. Sorry if this is more of a sieve question and is slightly off topic.

5 7

Dovecot - FTS Solr: disk usage & position information?
by Vincent Brillault 07 Sep '21

07 Sep '21

Dear all, On a local dovecot cluster currently hosting roughly 2.1TB of data, using Solr as its FTS backend, we now have 256GB of data in Solr, split in 12 shard (to which replication adds 256GB of data through 12 additional cores). I'm now trying to see if we can optimize that data. Looking at one core at random (22G), I see that the data is split mostly between - .pos files: 12G - .tim files: 4.2G - .doc files: 3.8G - .cfs files: 1.8G Looking around a bit, I found https://lucene.apache.org/core/6_2_0/core/org/apache/lucene/codecs/lucene50… (which is unfortunately a bit outdated I think) that explains each file content: - .tim: Term Dictionary - .tip: Term Index - .doc: Frequencies and Skip Data - .pos: Positions - .pay: Payloads and Offsets So clearly the file naming convention have changed, but still if .pos is really position information ("lists of positions that each term occurs at within documents."), this sounds rather useless for the dovecot integration. Looking at Solr documentation on search (https://solr.apache.org/guide/8_6/the-standard-query-parser.html) it seems that position aware query are written as `"term1 term2"~[0-9]+`. Looking at the dovecot code (https://github.com/dovecot/core/blob/master/src/plugins/fts-solr/fts-backen…) I don't see this kind of query being made, `~` only being used for fuzzy search. Has anyone ever tried to set omitTermFreqAndPositions or omitPositions to true for the text fields in the Solr Schema? It sounds that this could improve a lot the disk space used by Solr without losing any feature. The only thing I'm not too clear about is the "autoGeneratePhraseQueries" which is enabled in https://github.com/dovecot/core/blob/master/doc/solr-schema-7.7.0.xml. Thanks in advance, Vincent Brillault PS: I have attached the schema we are using for completeness. It's based on the one in the dovecot repo, with a bit of simplification for headers that don't really require as much massaging.

3 7

Solr FTS - when does indexing happen?
by Shawn Heisey 06 Sep '21

06 Sep '21

I have Solr FTS on my dovecot install. I followed the instructions on the dovecot wiki. How long a delay should I expect to see between new mail being delivered with the dovecot LDA and an indexing request sent to Solr? Because I get a LOT of email from various mailing lists, and I do not see any activity in Solr's log. When I did doveadm index -A -q '*' there was a lot of indexing activity in Solr's log, as expected. One time I looked at the Solr index and it had been 23 hours since it's last update ... I can guarantee that I received a lot of new messages in that time. What do I need to look at for further troubleshooting? I can confirm that when I issue a search in the TypeApp app on my phone (an IMAP app for android), I see the query in Solr's logfile. Thanks, Shawn

2 4

Dovecot, Last Login Plugin and PostfixAdmin
by White, Daniel E. (GSFC-770.0)[NICS] 03 Sep '21

03 Sep '21

https://doc.dovecot.org/configuration_manual/lastlogin_plugin/ Is there any documentation about how to get the "Last Login" info into the PostfixAdmin database ?

2 1

100 MB RAM per clinet in an imap-proxy setup ...
by Tobias Oetiker 03 Sep '21

03 Sep '21

Hi All, I spent some quality time yesterday, tuning dovecot on a server which serves as an imap-proxy in front of a zimbra setup the imap proxy does ldap client-cert authentication and works well. BUT I found that the imap-login processes seem to gain 100 MB per connection they are accepting ... this seems pretty hefty. It does not seem to be a leak, since the setup is stable when client_limit and process_limit are set appropriately. Any ideas what part of the code I should be looking at ? Or is this a configuration problem ? cheers tobi -- Tobi Oetiker, OETIKER+PARTNER AG, Aarweg 15 CH-4600 Olten, Switzerland www.oetiker.ch tobi(a)oetiker.ch +41 62 775 9902

2 4

Using a DICT PROXY with SQL for AUTH
by dovecot＠ptld.com 02 Sep '21

02 Sep '21

https://doc.dovecot.org/configuration_manual/dict/#dict-sql https://doc.dovecot.org/configuration_manual/dict/#dict-proxy https://doc.dovecot.org/configuration_manual/dict/proxy/ I can't get the complete picture from these pages how to implement proxy with sql. I have direct sql setup now, how do i use this with proxy? passdb { driver = sql args = /etc/dovecot/mysql_login } userdb { driver = prefetch } /etc/dovecot/mysql_login: driver = mysql connect = host=/var/lib/mysql/mysql.sock dbname=redacted user=redacted password=redacted default_pass_scheme = redacted password_query = SELECT ... I feel like there is a disconnect. It says how to make a proxy service with service dict{} and it says put a dict name but where? And how do i connect my password_query to a dict? Or can you not use the proxy service for auth service? "The <destination dict> contains the dict name in the dict { .. } settings" service dict(1) { unix_listener dict(2) { mode = 0600 user = vmail } } What is the dict name, the first dict(1) or the second dict(2) or neither? Can you change "dict" in the service or unix_listner or does it always have to be "dict"? Can you use dict-async with sql?

1 0

Over Quota Reply Codes
by dovecot＠ptld.com 02 Sep '21

02 Sep '21

Dovecot quota plugin returns code 554 5.2.2 when a user inbox is full. Why 554 (transaction failed) instead of 552 (exceeded storage allocation)? Im curious behind the logic as im trying to determine the best code to use to reject a user sending more emails than their number-of-emails-limit quota. If anyone has an option to share on the best code to return it would be appreciated; 550 (policy reasons) 552 (exceeded ... allocation) 554 (transaction failed) 5.2.2 (mailbox full) 5.5.3 (Too many recipients) 5.7.0 (Other security related) 5.7.1 (delivery not authorized) Which fits best?

2 1

maildirfolder file created in maildir root during auto-creation with 2.3.4.1 but not 2.2.27
by Christian Balzer 02 Sep '21

02 Sep '21

Hello, as the tin says. I have several servers running 2.2.27 (Debian stretch) and am adding new ones with 2.3.4.1 (Debian buster). The configs were upgraded where needed but neither 10-mail.conf nor 15-mailboxes.conf were changed. 15-mailboxes is all commented out (I guess the default is auto-create, which isn't documented anywhere I could find) and the only non-comments in 10-mail.conf are --- mail_location = maildir:%h mail_privileged_group = mail --- So yes, no namespaces are explicitly defined/declared. The 2.3.4.1 version wrongly creates a maildirfolder file in the home directory (maildir root), preventing exim from correctly creating/using maildirsize. a) Is this expected behavior and can it be changed? b) How can I disable inbox auto-creation if a) doesn't pan out? Thanks, Christian -- Christian Balzer Network/Systems Engineer chibi(a)gol.com Rakuten Mobile Inc.

2 5

Duplicate plugins - FTS Xapian
by Joan Moreau 01 Sep '21

01 Sep '21

Hi There seems to be 2 plugins doing the same thins - https://github.com/slusarz/dovecot-fts-flatcurve/ - https://github.com/grosjo/fts-xapian/ (mine) Both are in the doc of dovecot https://doc.dovecot.org/configuration_manual/fts/ I am currently working hard to push it to RPM package, and plugin is already approved by ArchLinux and Debian Isn't there double work here ? Thanks JM

7 9

User deleted the folder
by Казанцев Владимир Серге евич 01 Sep '21

01 Sep '21

Hello, please tell me what kind of information is stored in this file: doveadm dump -t mailboxlog dovecot.mailbox.log -- С уважением, Казанцев Владимир Сергеевич системный администратор отдела ИТ АО «Елецгидроагрегат» Тел. +7 (47467) 78-1-16, Моб. +7 980 263 26 69 kazantsev.vs(a)gidroagregat.ru <mailto:kazantsev.vs@gidroagregat.ru> /Настоящее почтовое сообщение является собственностью АО «Елецгидроагрегат», конфиденциально и предназначено для получателя письма. Если Вы не являетесь получателем, вероятнее всего Вы получили письмо по ошибке и в этом случае любое его использование, перенаправление, вывод на печать или копирование данного сообщения запрещаются. Если Вы получили сообщение по ошибке, пожалуйста свяжитесь с отправителем письма. Любые взгляды или мнения, представленные в письме, могут не совпадать с точкой зрения АО «Елецгидроагрегат» и отражают только точку зрения отправителя. Однако настоящее почтовое сообщение и любые вложения в него не содержат вирусов или каких-то других недостатков, которые могли бы причинить вред Вашей системе; тем не менее, АО «Елецгидроагрегат» не несет никакой ответственности за причинение ущерба результате получения данного письма./

1 0

User deleted the folder
by Казанцев Владимир Серге евич 01 Sep '21

01 Sep '21

Hello, please tell me what kind of information is stored in this file: doveadm dump -t mailboxlog dovecot.mailbox.log -- С уважением, Казанцев Владимир Сергеевич системный администратор отдела ИТ АО «Елецгидроагрегат» Тел. +7 (47467) 78-1-16, Моб. +7 980 263 26 69 kazantsev.vs(a)gidroagregat.ru <mailto:kazantsev.vs@gidroagregat.ru> /Настоящее почтовое сообщение является собственностью АО «Елецгидроагрегат», конфиденциально и предназначено для получателя письма. Если Вы не являетесь получателем, вероятнее всего Вы получили письмо по ошибке и в этом случае любое его использование, перенаправление, вывод на печать или копирование данного сообщения запрещаются. Если Вы получили сообщение по ошибке, пожалуйста свяжитесь с отправителем письма. Любые взгляды или мнения, представленные в письме, могут не совпадать с точкой зрения АО «Елецгидроагрегат» и отражают только точку зрения отправителя. Однако настоящее почтовое сообщение и любые вложения в него не содержат вирусов или каких-то других недостатков, которые могли бы причинить вред Вашей системе; тем не менее, АО «Елецгидроагрегат» не несет никакой ответственности за причинение ущерба результате получения данного письма./

1 0

indexer crash
by Onno Molenkamp 31 Aug '21

31 Aug '21

Hi, Because I was getting segfaults in libc in calloc calls by the indexer process of Dovecot 2.3.16, I ran indexer with valgrind to look for possible memory corruption. It did indeed find that indexer was accessing memory that had already been freed, I've attached the log file. I've then tried running Dovecot with the fix in commit 97367ef61784a364ccf615cb816be6492329050d, but that didn't make any difference. Reverting (just the code in src/indexer) to the last revision before the recent rewrite to use connection.c (d76761698a06bab60a741c6794252fddec4292ef) did: valgrind doesn't log any errors anymore, and indexer has stopped crashing. Onno

3 3

Dovecot Director: Preferred backend server
by Steven Varco 31 Aug '21

31 Aug '21

Hi All I have a dovecot cluster with directror and two IMAP Servers behind. Since they are in geographical different locations I would like to have users to go to a specific IMAP backend server (if both are up) and only switch to the other if one goes down (failover). As to my current knowledge the PassDB extra field „host=„ is not suitable in this case as it would never route the client to a different backend, even if the „user specific backend“ would be down. Is their a way in dovecot to achive this? As far as I searched the documentation I could not find any information on this so far. If not, it may also help if I could get certain users to „initially" go to a specific backend (since director usually routes a client/user to the same backend server it initially connects) and therefore it would be interesting to know how dovecot director chooses wether a user goes to server1 or server2? And if a client already gets to server2, how to bring it „back“ to server1? thanks in advance, Steven -- https://steven.varco.ch/ https://www.tech-island.com/

4 7

lmtp panic with 2.3.16 (runnung ubuntu) and larger mails
by Friedhelm Buescher 30 Aug '21

30 Aug '21

Hi, when sending larger Mails (> 1MB, for example a jpg attachment), the lmtp crashes: ######################################################################### syslog: Aug 29 17:05:34 mail dovecot: lmtp(xxxx)<720677><5RuZHDCiK2El/woAkAJtwA>: Panic: Buffer write out of range (0 + 1) Aug 29 17:05:34 mail dovecot: lmtp(xxxx)<720677><5RuZHDCiK2El/woAkAJtwA>: Error: Raw backtrace: /usr/lib/dovecot/libdovecot.so.0(backtrace_append+0x41) [0x7f10ae1fb151] -> /usr/lib/dovecot/libdovecot.so.0(backtrace_get+0x22) [0x7f10ae1fb272] -> /usr/lib/dovecot/libdovecot.so.0(+0x1092eb) [0x7f10ae2082eb] -> /usr/lib/dovecot/libdovecot.so.0(+0x109387) [0x7f10ae208387] -> /usr/lib/dovecot/libdovecot.so.0(+0x5d018) [0x7f10ae15c018] -> /usr/lib/dovecot/libdovecot.so.0(+0x5bee1) [0x7f10ae15aee1] -> /usr/lib/dovecot/libdovecot-sieve.so.0(sieve_binary_emit_integer+0x6a) [0x7f10ad79dfea] -> /usr/lib/dovecot/libdovecot-sieve.so.0(sieve_binary_save+0x1e3) [0x7f10ad79c553] -> /usr/lib/dovecot/libdovecot-sieve.so.0(sieve_binary_file_update_resource_usage+0x128) [0x7f10ad79dcc8] -> /usr/lib/dovecot/libdovecot-sieve.so.0(sieve_binary_close+0x7d) [0x7f10ad79ab4d] -> /usr/lib/dovecot/modules/lib90_sieve_plugin.so(+0x3f65) [0x7f10ae0f3f65] -> /usr/lib/dovecot/libdovecot-lda.so.0(mail_deliver+0x17a) [0x7f10ae4490ea] -> dovecot/lmtp(lmtp_local_default_deliver+0x1d8) [0x557cc4da83c8] -> dovecot/lmtp(lmtp_local_data+0x5ac) [0x557cc4da8b1c] -> dovecot/lmtp(client_default_cmd_data+0x191) [0x557cc4da74a1] -> dovecot/lmtp(cmd_data_continue+0x180) [0x557cc4da7230] -> /usr/lib/dovecot/libdovecot.so.0(+0x7c286) [0x7f10ae17b286] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_call_io+0x6d) [0x7f10ae21e67d] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run_internal+0x145) [0x7f10ae21fd15] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run+0x54) [0x7f10ae21e724] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_run+0x40) [0x7f10ae21e890] -> /usr/lib/dovecot/libdovecot.so.0(master_service_run+0x17) [0x7f10ae1913a7] -> dovecot/lmtp(main+0x22f) [0x557cc4da5edf] -> /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xf3) [0x7f10adf250b3] -> dovecot/lmtp(_start+0x2e) [0x557cc4da5fee] Aug 29 17:05:34 mail dovecot: lmtp(xxxx)<720677><5RuZHDCiK2El/woAkAJtwA>: Fatal: master: service(lmtp): child 720677 killed with signal 6 (core dumped) ######################################################################### uname -a Linux mail 5.4.0-81-generic #91-Ubuntu SMP Thu Jul 15 19:09:17 UTC 2021 x86_64 x86_64 x86_64 GNU/Linux Installed Packages: dovecot-lmtpd=2:2.3.16-2+ubuntu20.04 dovecot-mysql=2:2.3.16-2+ubuntu20.04 dovecot-imapd=2:2.3.16-2+ubuntu20.04 dovecot-sieve=2:2.3.16-2+ubuntu20.04 dovecot-pop3d=2:2.3.16-2+ubuntu20.04 dovecot-lucene=2:2.3.16-2+ubuntu20.04 dovecot-core=2:2.3.16-2+ubuntu20.04 dovecot-managesieved=2:2.3.16-2+ubuntu20.04 dovecot-solr=2:2.3.16-2+ubuntu20.04 postfix=3.4.13-0ubuntu1.1 Tried to downgrade to dovecot-lmtpd=2:2.3.15-1+ubuntu20.04 dovecot-mysql=2:2.3.15-1+ubuntu20.04 dovecot-imapd=2:2.3.15-1+ubuntu20.04 dovecot-sieve=2:2.3.15-1+ubuntu20.04 dovecot-pop3d=2:2.3.15-1+ubuntu20.04 dovecot-lucene=2:2.3.15-1+ubuntu20.04 dovecot-core=2:2.3.15-1+ubuntu20.04 dovecot-managesieved=2:2.3.15-1+ubuntu20.04 dovecot-solr=2:2.3.15-1+ubuntu20.04 postfix=3.4.10-1ubuntu1 , which does not solve the error. ######################################################################### config: # 2.3.16 (7e2e900c1a): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.16 (09c29328) # OS: Linux 5.4.0-81-generic x86_64 Ubuntu 20.04.3 LTS ext4 # Hostname: xxxx auth_verbose_passwords = plain lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes mail_location = maildir:/var/maildirs/%u mail_plugins = " quota acl fts fts_solr" mail_privileged_group = mail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext namespace { list = children location = maildir:%%h:INDEX=%h/shared/%%u:CONTROL=%h/shared/%%u prefix = shared.%%u. separator = . subscriptions = no type = shared } namespace inbox { inbox = yes location = prefix = separator = . type = private } passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } plugin { acl = vfile fts = solr fts_autoindex = yes fts_solr = url=http://127.0.0.1:8983/solr/dovecot/ recipient_delimiter = . sieve = file:~/sieve;active=~/.dovecot.sieve } protocols = " imap lmtp sieve pop3" recipient_delimiter = . service auth-worker { user = $default_internal_user } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } unix_listener auth-userdb { group = postfix user = postfix } } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0660 user = postfix } vsz_limit = 1 G } ssl = required ssl_cert = </etc/letsencrypt/live/xxx/fullchain.pem ssl_cipher_list = ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA ssl_client_ca_dir = /etc/ssl/certs ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it ssl_prefer_server_ciphers = yes userdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } protocol lmtp { mail_plugins = " quota acl fts fts_solr sieve notify push_notification" postmaster_address = postmaster@xxx } protocol lda { mail_plugins = " quota acl fts fts_solr sieve fts fts_solr notify push_notification" } protocol imap { mail_plugins = quota imap_quota fts fts_solr } ######################################################################### sieve-file involved: # Sieve Filter # Generated by Ingo (http://www.horde.org/apps/ingo/) (05/17/2019, 06:17:18 PM) require ["fileinto", "imap4flags", "mailbox", "subaddress", "envelope", "variables", "body", "regex", "copy"]; # PDFs nach attachments speichern, damit diese lokal gespeichert werden koennen .. if body :raw :regex ["filename=.+\\.pdf"] { fileinto :create :copy "INBOX.attachments"; }

2 2

Local auth works with dovecot-proxy, remote does not
by Camilo Sperberg 30 Aug '21

30 Aug '21

Hi list! I've configured dovecot-proxy to redirect users to another server if their data is indeed on that other server. Webmail (which runs on the same machine) works perfectly fine, but clients such as Thunderbird and Outlook do not work as intended, I suspect it to be a problem with the IP that dovecot-proxy sees, but I can't figure out what is wrong: I've already done a lot of Googling and also tried to change the login_trusted_networks value, but to no avail. I've enabled debug log and here is the relevant part of a call that fails and another one that succeeds (FYI 10.164.0.3 is the machine that is doing the proxying and where webmail is located, 10.164.0.20 is the 'node', these logs come from that node, doveconf -n is also provided in the gist): https://gist.github.com/unreal4u/64de0f05b6e3b98034cdb0ae52ce1196 So as far as I can interpret the logs, in the failure case it is basically saying it should go to the node, despite it already being on that node: Aug 24 11:29:07 mail-node-2 dovecot: auth: Debug: client passdb out: OK#0112#011user=me(a)XXXXXX.XX #011host=10.164.0.20#011port=143#011proxy#011pass=<hidden> In the success case, I don't see any mention of a proxy: Aug 24 11:35:21 mail-node-2 dovecot: auth: Debug: client passdb out: OK#0116#011user=me(a)XXXXXXXXX.XX What am I missing here? Has this something to do with authentication-allow-nets or authentication-allow-real-nets ? If so: where to define it? Is there something else I'm missing? Thanks in advance for your help, Camilo Sperberg

1 1

tls_early_post_process_client_hello:unsupported protocol
by Elise 30 Aug '21

30 Aug '21

I just read a line in my logfile that I haven't noticed before: Aug 29 22:17:23 <myserver> dovecot[50098]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=104.152.52.31, lip=10.10.10.37, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=</w+MZ7jKvLhomDQf> Is this a TLS 1.3 related issue? /elise

2 1

%{cert} variable
by Andrea Gabellini 27 Aug '21

27 Aug '21

Hello, I am using Dovecot version 2.3.16. I'm experimenting with client certificates and the "ssl_verify_client_cert = yes" option. By putting the server in debug mode, I can verify that the client is correctly providing the certificate. I am trying to log using %{cert} adding it to login_log_format_elements, as per the documentation, but I get the error: "Failed to expand log_format_elements=cert=%{cert}: Unknown variable '%cert'" Also the documentation says that the short name is %k, but it overlaps with %{ssl_security}. Is the documentation wrong or is there a bug? Thanks, Andrea -- __________________________ One of the things we can do to help the poor is not to become one of them. __________________________ TIM San Marino S.p.A. Andrea Gabellini Engineering R&D TIM San Marino S.p.A. - https://www.telecomitalia.sm Via Ventotto Luglio, 212 - Piano -2 47893 - Borgo Maggiore - Republic of San Marino Tel: (+378) 0549 886237 Fax: (+378) 0549 886188 -- Informativa Privacy Questa email ha per destinatari dei contatti presenti negli archivi di TIM San Marino S.p.A.. Tutte le informazioni vengono trattate e tutelate nel rispetto della normativa vigente sulla protezione dei dati personali (Reg. EU 2016/679). Per richiedere informazioni e/o variazioni e/o la cancellazione dei vostri dati presenti nei nostri archivi potete inviare una email a privacy(a)telecomitalia.sm. Avviso di Riservatezza Il contenuto di questa e-mail e degli eventuali allegati e' strettamente confidenziale e destinato alla/e persona/e a cui e' indirizzato. Se avete ricevuto per errore questa e-mail, vi preghiamo di segnalarcelo immediatamente e di cancellarla dal vostro computer. E' fatto divieto di copiare e divulgare il contenuto di questa e-mail. Ogni utilizzo abusivo delle informazioni qui contenute da parte di persone terze o comunque non indicate nella presente e-mail potra' essere perseguito ai sensi di legge.

1 0

Logging to remote server
by James Brown 26 Aug '21

26 Aug '21

My Google searches must be off, I couldn’t see how to do this. Is there a way to log to a local file, but also send to a remote server? Eg: Log_path = /var/log/dovecot.log, @mylogserver.example.com:514 Thanks, James

3 2

Creating/Learning about services
by Dan Conway 25 Aug '21

25 Aug '21

Hello, I'm currently researching how services work within Dovecot and what scope these services are capable of. For example, I created a service as such: service myservice { executable = /home/me/executable type = worker unix_listener myservice { mode = 0666 } } When data is provided to the myservice unix socket, Dovecot appears to create a new process by executing "/home/me/executable". I found out about "status updates" through examining the logs. At first I received this: master: Error: service(myservice): Initial status notification not received in 30 seconds, killing the process What is this status notification? I found out that writing to file descriptor 5 from the executable does seem to be valid. When I write out 12 bytes I don't get an error, but when I write out 13 bytes I get the following: master: Error: service(dmon): service sent partial status update (13 bytes) What I've also noticed is that exiting 0 will cause Dovecot to spawn the process again, in what appears to be infinitely. Are there any resources/documentation that I could reference to learn more about how services work on a lower level besides just looking at the source code? Thanks.

2 2

What kind of search response time are you setting with solr full text search?
by Steve Dondley 25 Aug '21

25 Aug '21

MY SETUP: I have apache solr full text search enabled with dovecot. I have an inbox with about 40 subfolders. I'm using the roundcube web-based mail client. The find command is showing 15823 email files and apache solr reports the same number. I'm running a dedicated mail server with a 1 GB of ram. The solr machine is running on a separate machine with 4 GB ram. THE PROBLEM: When I do a full text search through all my inbox and all subfolders on a single word, search results are returned in about 10 to 15 seconds. This is better than the 40 seconds or so I'm getting when I turn off the fts and fts_solr plugins but still a little disappointing. WHAT I'D LIKE: Now, I don't expect instant search results like gmail, but getting the search results to display in less than 5 seconds would be a lot less painful that 10 to 15 seconds. WHAT I'VE TRIED: I have reindexed the emails on solr to try to speed things upit up. ANY ADVICE? Curious to know what response times others are seeing and if there is anything else I might try to speed things up. Maybe the number of subfolders is slowing things down?

6 23

JMAP Support Status
by David Klingenberg 25 Aug '21

25 Aug '21

Hello, what is the current status of JMAP support in Dovecot? Is it already supported or is there any ongoing work on it? I have found some older threads mentioning it as planned, but they are quite old and I haven't found anything new on that topic. Best Regards, David

1 0