- dovecot - dovecot.org

quota-status fails when size=0 from Postfix
by Christoph Haas 30 Jul '21

30 Jul '21

Dear list, I've been pulling my hair out today and kindly ask you for help. I'm on Debian Bullseye with Dovecot 2.3.13 and Postfix 3.5.6. Users are stored in SQL and I want to use quotas. Basically I followed https://doc.dovecot.org/configuration_manual/quota_plugin/#quota-service With mail_debug enabled I see that the information from SQL is fetched correctly: dovecot: quota-status(test(a)bullseye.example.org)<45148><>: Debug: auth-master: userdb lookup(test(a)bullseye.example.org): auth USER input: test(a)bullseye.example.org quota_rule=*:bytes=1000 home=/var/vmail/bullseye.example.org/test uid=5000 gid=5000 So the quota rule "*:bytes=1000" is loaded as intended for testing. Before handing the email over to Dovecot through LMTP Postfix should call the quota-service (policy daemon) to determine if the user is over quota: smtpd_recipient_restrictions = \ reject_unauth_destination \ check_policy_service inet:localhost:12340 This is still by the book. What I found: - sending a test mail with Thunderbird properly returns a 5xx status (over quota) - sending a test mail with SWAKS returns DUNNO (swaks is an SMTP test tool) I have used tcpdump to look into the communication on port 12340 and the difference appears to be the "size=0" line that Postfix sends if I use SWAKS. Output from SWAKS: -> RCPT TO:<test(a)bullseye.example.org> <- 250 2.1.5 Ok However if Thunderbird sends an email it uses something like -> RCPT TO:<test(a)bullseye.example.org> SIZE=12345 If I understand the situation correctly then Postfix extracts the SIZE=… value and uses that to send it to the quota-status policy daemon. The user however is definitely over quota: $> doveadm quota get -u test(a)bullseye.example.org Quota name Type Value Limit % User quota STORAGE 1 1 100 User quota MESSAGE 1 - 0 So whatever the size of the incoming email is, it should be rejected. As quota-status returns DUNNO, Postfix will send the email to Dovecot through LMTP. And LMTP in turn does another quota check and correctly rejects the email: postfix/lmtp[45153]: 573419D6A3: to=<test(a)bullseye.example.org>, relay=iredmail-test[private/dovecot-lmtp], delay=0.08, delays=0.05/0.01/0.01/0.01, dsn=5.2.2, status=bounced (host iredmail-test[private/dovecot-lmtp] said: 552 5.2.2 <test(a)bullseye.example.org> Quota exceeded (mailbox for user is full) (in reply to end of DATA command)) Problem here is that a bounce is created and Postfix is sending backscatter. Had "quota-service" indicated that the mailbox is over quota then Postfix had instantly rejected the email without any bounce. I can also reproduce this effect by talking to the quota-status daemon: printf "recipient=test(a)bullseye.example.org\nsize=0\n\n" | nc localhost 12340 action=DUNNO printf "recipient=test(a)bullseye.example.org\nsize=10000\n\n" | nc localhost 12340 action=554 5.2.2 Quota exceeded (mailbox for user is full) Is this a feature? A bug? An evil coincidence? Thanks for reading this far. I know that this matter seems a bit complicated. But it feels like Dovecot's behavior leads to backscatter and of course I'd like to avoid that. Kindly… Christoph

4 14

[bug 2.3.15] seeing user-shared mailboxes across different storage types requires manual change to subscriptions
by Michal Soltys 29 Jul '21

29 Jul '21

Hi, While I was checking old bug I once reported (that one seems to be fixed, https://www.dovecot.org/list/dovecot/2017-January/106593.html) I discovered another issue happening under current version when user sharing his mailbox (with Maildir storage) is not visible under user using mdbox (or sdbox, also tested) - unless subscriptions file is manually adjusted (after subscribing). Consider following config: # 2.3.15 (0503334ab1): /etc/dovecot/dovecot.conf # OS: Linux 5.12.14-arch1-1 x86_64 Arch Linux btrfs # Hostname: hakai auth_debug = yes auth_mechanisms = plain login disable_plaintext_auth = no first_valid_uid = 1 listen = * mail_debug = yes mail_gid = dovecot mail_location = maildir:/var/mail1/%n/Maildir mail_plugins = acl mail_uid = dovecot namespace { inbox = yes location = prefix = separator = / type = private } namespace shared1 { inbox = no list = yes location = maildir:%%h/Maildir/ prefix = shared1/%%n/ separator = / subscriptions = no type = shared } namespace shared2 { inbox = no list = yes location = mdbox:%%h/mdbox/ prefix = shared2/%%n/ separator = / subscriptions = no type = shared } passdb { args = /etc/dovecot/local-maildir driver = passwd-file } passdb { args = /etc/dovecot/local-mdbox driver = passwd-file } plugin { acl = vfile acl_shared_dict = file:/var/mail-data/shared-database/shared-mailboxes.db } protocols = imap service auth { unix_listener auth-userdb { group = mail mode = 0660 user = dovecot } user = dovecot } service imap-login { inet_listener imap { address = * port = 143 } inet_listener imaps { address = * port = 993 } user = dovecot } service imap { executable = /usr/lib/dovecot/imap } userdb { driver = prefetch } userdb { args = /etc/dovecot/local-maildir driver = passwd-file } userdb { args = /etc/dovecot/local-mdbox driver = passwd-file } protocol imap { mail_max_userip_connections = 100 mail_plugins = acl imap_acl } /etc/dovecot/local-maildir: user1:{PLAIN}test:::user1:/var/mail1/user1::userdb_mail=maildir:/var/mail1/user1/Maildir userdb_home=/var/mail1/user1 user2:{PLAIN}test:::user2:/var/mail1/user2::userdb_mail=maildir:/var/mail1/user2/Maildir userdb_home=/var/mail1/user2 /etc/dovecot/local-mdbox: user3:{PLAIN}test:::user3:/var/mail2/user3::userdb_mail=mdbox:/var/mail2/user3/mdbox userdb_home=/var/mail2/user3 There are two shared namespaces - shared1 for Maildir mailboxes and shared2 for mdbox ones. 'user1' is sharing his 'qwer' folder to user3. doveadm mailbox create -u user1 -s qwer doveadm acl add -u user1 qwer user=user3 read lookup doveadm mailbox subscribe -u user3 shared1/user1/qwer This produces subscriptions file such as: 14:44 # cat /var/mail2/user3/mdbox/subscriptions V 2 Trash shared1 user1 qwer With all that in place, 'qwer' won't be visible to user3. But if we change the 'shared1 user1 qwer' to shared1/user1/qwer - then everything will be working fine. Sharing mdbox folder to maildir user (user3 -> user1) as well as maildir to maildir (user1 -> user2) works without issues.

1 1

Shared mailbox strange behaviors
by Ervin Hegedüs 27 Jul '21

27 Jul '21

Hi there, I've set up my Dovecot instance for shared mail accounts. I'm using Debian 10, Dovecot 2.3.4. This is what I did: #namespace { # type = private # separator = / # prefix = # location = # inbox = yes #} namespace { type = shared separator = / prefix = Osztott/%%u/ location = maildir:%%h:INDEX=~/shared/%%u subscriptions = no list = yes } Note, the word "Osztott" means "Shared" in my language. The strange behaviors: 1: as you can see, the first empty namespace is commented. This is because when I restarted the Dovecot instance, it sent this message to the log: Error: namespace configuration error: Duplicate namespace prefix: "" When I commented out these lines, the error message left. Why did that happen? What's the real solution? 2: with this config, I see the shared accounts under my account, with prefix "Osztott" - but the shared account is duplicated. There are two instances with similar names. In first mailbox I see the e-mails, this is fine. But under the "regular" name of the shared mailbox, there is the other mailbox with the same name + a suffix "-1", which is empty. Why is that second maildir there? Thank you for your help, a.

1 0

Submission server and Outlook delivery notification
by Tobia Grosselle [ Terralink ] 26 Jul '21

26 Jul '21

Version: 2.3.15 (0503334ab1) Hello everyone, it seems that the delivery notification function on Outlook doesn't work with Dovecot Submission service, is expected? Will it be implemented? Thanks in advance

1 0

Dovecot and Android's Gmail app
by Jakub Filo 26 Jul '21

26 Jul '21

Hello, does anyone else have this problem with connecting to dovecot (imap) via gmail app on Android, where after removing messages, they reappear shortly after? It happens seemingly randomly, not always. -- Jakub Filo jakub(a)plantroon.com

2 1

Set vhost count in config
by William Edwards 23 Jul '21

23 Jul '21

Hi, Can we do `doveadm director update ... 100` in the on-disk config, so the vhost count is retained after the ring goes down? I could not find such an option in doveconf. -- With kind regards, William Edwards

1 0

Quick Question
by Stephane Magnier 23 Jul '21

23 Jul '21

Hi, Is there a way to transform a "*mbox*" structure ( in the folder : like /var/spool/mail/........ ) into a *maildir* structure ? I would dream to see a doveadm instruction doing something like : */doveadm /var/spool/mail/%u /var/spool2/./*...... something like this.. That would be great !! :-) Thanks and regards

2 2

dovecot and auth cache
by Maciej Milaszewski 23 Jul '21

23 Jul '21

Hi In my lab I have tested auth cache in dovecot like: 1) test auth doveadm auth login ala(a)domain.ltd pass passdb: ala(a)domain.ltd auth succeeded - user ala(a)domain.ltd is in mysql (klater galera) 2)I stop the galley cluster 3)test auth - via cache doveadm auth login ala(a)domain.ltd pass passdb: ala(a)domain.ltd auth succeeded 4)flush cache root@msmtp3:~# doveadm auth cache flush 2 cache entries flushed root@msmtp3:~# doveadm auth cache flush 0 cache entries flushed - cache is emty 5)test auth doveadm auth login ala(a)domain.ltd pass passdb: ala(a)domain.ltd auth succeeded Why 5 step give - successed ? doveconf -n # 2.3.4.1 (f79e8e7e4): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.4 () # OS: Linux 4.19.0-12-amd64 x86_64 Debian 10.9 ... auth_cache_negative_ttl = 5 mins auth_cache_ttl = 5 mins ... If I restart dovecot works correctly - I mean: doveadm auth login ala(a)domain.ltd pass not auth I dont have any idea

1 1

BDAT to DATA translation on submission service when checkpassword is involved
by Dan Conway 23 Jul '21

23 Jul '21

Hello, I'm having issues with Dovecot translating "BDAT" commands (CHUNKING) into "DATA" commands when the backend does not support it in the submission service. I use "checkpassword" to authenticate users and judging by older mailing list entries the presence of "submission_*" directives must be in place for Dovecot to translate. Even with these directives set, the translation doesn't seem to occur. checkpassword returns "director_tag=remote_smtp" (along with other fields such as nopassword=y proxy=y) which in turn sets the backend host to relay the connection to. I have a feeling the use of checkpassword has something to do with this lack of translation. If the "submission_*" directives must be in place for this translation to occur, which ones are they? Can I return these fields from checkpassword? Output of doveconf -n: # 2.3.15 (0503334ab1): /etc/dovecot/dovecot.conf # OS: Linux 4.15.0-147-generic x86_64 Ubuntu 18.04.5 LTS # Hostname: xyz auth_debug = yes auth_debug_passwords = yes auth_mechanisms = plain login auth_verbose = yes director_mail_servers = x.x.x.x@remote_smtp director_servers = x.x.x.x disable_plaintext_auth = no mail_log_prefix = "%Us(%u) [%r]: " passdb { args = /usr/local/bin/checkpassword driver = checkpassword } protocols = " imap pop3 submission" service anvil { client_limit = 3553 } service auth { client_limit = 3550 } service director { fifo_listener login/proxy-notify { mode = 0600 user = $default_login_user } inet_listener { address = x.x.x.x port = 9090 } unix_listener director-admin { mode = 0600 } unix_listener login/director { mode = 0666 } } service imap-login { executable = imap-login director inet_listener imap { address = x.x.x.x port = 143 } inet_listener imaps { address = x.x.x.x port = 993 ssl = yes } process_limit = 1000 process_min_avail = 0 service_count = 1 } service imap { process_limit = 2048 process_min_avail = 0 service_count = 1 vsz_limit = 384 M } service pop3-login { executable = pop3-login director inet_listener pop3 { address = x.x.x.x port = 110 } inet_listener pop3s { address = x.x.x.x port = 995 ssl = yes } process_limit = 450 } service pop3 { process_limit = 190 process_min_avail = 0 service_count = 1 } service submission-login { executable = submission-login director inet_listener smtp { address = x.x.x.x port = 25 } inet_listener smtps { address = x.x.x.x port = 465 ssl = yes } inet_listener submission { address = x.x.x.x port = 587 } process_limit = 2000 } ssl_cert = </etc/... ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it ssl_min_protocol = TLSv1.1 submission_backend_capabilities = submission_host = x.x.x.x submission_relay_host = x.x.x.x submission_relay_port = 465 submission_relay_ssl = smtps submission_relay_trusted = yes userdb { args = /etc/dovecot/userdb.conf driver = ldap } protocol imap { imap_logout_format = bytes=%i/%o, del=%e mail_max_userip_connections = 20 } protocol pop3 { mail_max_userip_connections = 20 pop3_logout_format = top=%t/%p, retr=%r/%b, del=%d/%m, size=%s } protocol submission { mail_max_userip_connections = 10 } local_name *.domain.com { ssl_cert = </etc/... ssl_key = # hidden, use -P to show it }

2 1

folders and subfolders
by Stephane Magnier 22 Jul '21

22 Jul '21

Hi, Still looking for the way to create folders and sub folders.. Today, I am using "mbox", which apparently doesn't work for this ? correct ? So, I would probably need to use maildir.. ( https://doc.dovecot.org/configuration_manual/mail_location/Maildir/ ] Today, what I am using is :*mbox, *which is gather all the mailboxes of user 1, user 2 in one folder... like : mbox:/var/spool2/mail/%u 1) I suppose, that If I am using "mbox" with .. : LAYOUT=fs, I won't get these folders and subfolders ? - Correct ? 2) Instead of having : "maildir:~/Maildir " which, I suppose got each_user folder into their own home directory_ .. correct ? Can I have : *maildir:/var/spool2/mail/%u *? ( I would prefer to gather all users' mailbox into one folder like /var/spool2/mail/ ) 3) if so, *mbox:/var/spool2/mail/%u:INBOX=/var/spool/mail/%u* => can become : *maildir:/var/spool2/mail/%u:LAYOUT=fs:INBOX=/var/spool/mail/%u* What do you think ?... before trying and breaking everything :-)... if so, I will be killed Thanks and regards

5 20

Doveadm encrypt/decrypt files manually with per-user folder keys
by Ben Burk 21 Jul '21

21 Jul '21

There is an example of manually encrypting/decrypting mail processed by the mail_crypt plugin here: https://doc.dovecot.org/configuration_manual/mail_crypt_plugin/ It outlines how one would manually encrypt/decrypt messages using global keys: doveadm fs get/put crypt private_key_path=foo:public_key_path=foo2:posix:prefix=/path/to/files/root path/to/file Is there a way to accomplish this using per-user folder keys? Is there some way of making sense of the information in the dovecot-attributes file to accomplish this? -- Ben Burk BURK.TECH System Administrator

2 6

Traffic accounting
by Jesús Ángel del Pozo Domínguez 20 Jul '21

20 Jul '21

Hello, Could you please tell me whether is it possible to do traffic accounting using Dovecot 2.3.4? What I'd like to do is to collect network traffic (both in & out) for each user (both POP and IMAP traffic). Regards,

4 4

dovecot-lmtp crashing when setting lmtp_proxy=yes
by Camilo Sperberg 19 Jul '21

19 Jul '21

Hi all: We are currently in the process of setting up dovecot proxy so that we can deploy multiple machines in order to keep growing. We are trying now to create an entry point, and from there send the traffic to either the same machine or another node. For this, we are using a MySQL database with information about which server hosts which mailboxes, which turns out to be working great for sending out mail and general authentification. This was really simple to set up, kudos for that! However, whenever I want to *receive* email, I just have to enable the lmtp_proxy setting which makes the lmtp process segfault. This happens everytime as I can reliable reproduce it + get a stack trace of it. The process will crash on every incoming email. I have attached: - Complete output of dovecot-sysreport - A core dump of the crashed process Main information: Using dovecot v2.3.14 (cee3cbc0d) on Ubuntu 18.04 LTS: Linux 5.4.0-1046-gcp x86_64 Ubuntu 18.04.5 LTS. Our MTA is postfix. Logs around the crashed process: Jul 15 14:53:21 server postfix/postscreen[19402]: CONNECT from [XX.XX.XX.XX]:36411 to [10.164.0.18]:25 Jul 15 14:53:22 server postfix/dnsblog[19406]: addr XX.XX.XX.XX listed by domain dnsbl.sorbs.net as 127.0.0.6 Jul 15 14:53:27 server postfix/postscreen[19402]: PASS NEW [XX.XX.XX.XX]:36411 Jul 15 14:53:27 server postfix/smtpd[19408]: connect from mail-XX.google.com [XX.XX.XX.XX] Jul 15 14:53:28 server postfix/smtpd[19408]: B765F401DB: client= mail-XX.google.com[XX.XX.XX.XX] Jul 15 14:53:28 server postfix/cleanup[19411]: B765F401DB: message-id=< XX+5j3RpXXXXXOK7GHdiDSGSPXXXX(a)mail.gmail.com> Jul 15 14:53:29 server postfix/qmgr[1414]: B765F401DB: from=< unreal4u(a)gmail.com>, size=2815, nrcpt=1 (queue active) Jul 15 14:53:29 server dovecot: lmtp(19413): Connect from local Jul 15 14:53:29 server kernel: [1738624.857507] lmtp[19413]: segfault at 0 ip 00007fd486cd0a37 sp 00007ffc12a6c118 error 4 in libdovecot.so.0.0.0[7fd486ba1000+1aa000] Jul 15 14:53:29 server kernel: [1738624.857514] Code: eb de 90 48 85 d2 75 1e eb 33 66 0f 1f 84 00 00 00 00 00 84 c0 74 18 48 83 c7 01 48 83 c6 01 88 47 ff 48 83 ea 01 48 83 fa 01 <0f> b6 06 77 e4 c6 07 00 31 c0 80 3e 00 0f 95 c0 f7 d8 c3 b8 ff ff Jul 15 14:53:29 server dovecot: lmtp(19413): Fatal: master: service(lmtp): child 19413 killed with signal 11 (core dumped) Jul 15 14:53:29 server postfix/lmtp[19412]: B765F401DB: to=<YYY(a)YYYY.YY>, relay=ZZZ.ZZZ.ZZ[private/dovecot-lmtp], delay=0.88, delays=0.84/0.01/0.01/0.03, dsn=4.4.2, status=deferred (lost connection with ZZZ.ZZZ.ZZ[private/dovecot-lmtp] while sending RCPT TO) Jul 15 14:53:29 server postfix/smtpd[19408]: disconnect from mail-XX.google.com[XX.XX.XX.XX] ehlo=2 starttls=1 mail=1 rcpt=1 data=1 quit=1 commands=7 Am I missing something in the conf? Did I encounter a bug? If you need more information, please let me know. Greetings, Camilo Sperberg

2 2

Major upgrade of mail server
by Shawn Heisey 18 Jul '21

18 Jul '21

I have a mail server in AWS that is currently running Ubuntu 18. Every time I log in, I am reminded that I can upgrade to Ubuntu 20. On Ubuntu 18, the dovecot version is 3.3.0-1ubuntu0.3. On Ubuntu 20, it is 2.3.7.2-1ubuntu3. Many other packages, probably including the mysql server, would also be upgraded. Dovecot and Postfix use a postfixadmin database in mysql for users, and postfix is using dovecot-lda to deliver mail. I am using managesieve from dovecot on roundcube webmail. As far as I know, my own user is the only one with sieve scripts actually in use ... and I have a LOT of filters/folders for various mailing lists. I've been a little bit terrified of doing an upgrade, because I do have a couple of people using my mail server for real work email and I don't want to disrupt them. I'm writing today to find out what are the likely pain points I might encounter when doing this kind of major upgrade, and if there is any helpful information that can help me get through those problems. I'm hoping that it will go smoothly and everything just works. Here's the doveconf -n output: https://apaste.info/FUgF If I have been silly enough to include sensitive data from the config, I would appreciate a heads up so I know what passwords to change. I did a quick glance and didn't see anything. Thanks, Shawn

5 5

Dovecot book for a newbie
by techlists＠phpcoderusa.com 16 Jul '21

16 Jul '21

Hi, Please recommend a Dovecot book for a newbie... I have a fair amount of Linux PHP hosting experience - LAMP virtual host configurations. I'm new to BIND, Postfix, and Dovecot. I'm running Ubuntu 20.04lts. I have a test server almost working. Can send but not receive. Would like to understand more. I'm guessing it is a Zone (MX) / SSL / Client configuration issue. Thanks in advance!!

5 8

OT somewhat, how to unsubscribe?
by Christy S 16 Jul '21

16 Jul '21

Hi folks, It's been a while since I've subscribed and I don't remember how to get off the mailing list. We've changed how we're handling mail now, so dovecot is no longer being used. Can anyone help? MOst mailing lists have a blurb at the bottom with instructions but this one doesn't seem to. Thanks Christy

3 2

Dovecot geographically distributed
by Claudio Corvino 16 Jul '21

16 Jul '21

Hi, I have a single Dovecot (2.3.4.1) IMAP/LMTP server on HQ "A" and I would like to create a backup server distributed to HQ "B", two HQ are connected through an IPsec tunnel. User mailboxes (type mbox) are on NFS storage. I don't need HA, it could even be an active / passive configuration with a floating IP, but I don't know how to keep in sync the two remote NFS filesystems. I don't know if Dovecot replication is suitable for me. Thanks -- *Claudio Corvino IT Systems Administrator*

1 0

2FA/MFA with IMAP & postfix/submission
by Alex 16 Jul '21

16 Jul '21

Hi, I have a dovecot-2.3.13 system on fedora34 with a few hundred IMAP4 accounts, as well as postfix users using submission. Clients are using primarily Outlook on Windows and old squirrelmail. Are there multi-factor options available? If it is not available, do you have any recommendations on where I should look to do this? All of the links related to this topic appear to be very old, or limited to Linux PAM users.

12 19

function for whitelisting IPs
by White, Daniel E. (GSFC-770.0)[NICS] 16 Jul '21

16 Jul '21

Sebastian, Do you have any examples of such a function and how/where it is used ? -----Original Message----- From: dovecot <dovecot-bounces(a)dovecot.org> on behalf of Sebastian <sebastian(a)sebbe.eu> Reply-To: Dovecot Mailing List <dovecot(a)dovecot.org> Date: Thursday, July 15, 2021 at 01:19 To: 'Mailing List' <dovecot(a)dovecot.org> Subject: [EXTERNAL] Sv: 2FA/MFA with IMAP & postfix/submission Main problem is that not many clients do natively support multifactor. Some clients, do popup a login dialog if the server rejects the password as invalid, which can be used to create a "cheaty variant" of multifactor, but some clients just popup an error dialog and tell the user to just correct password in settings. Some clients even go as long as requiring the user to delete the account with wrong password and set up a new connection. So no, it cannot be relied upon. I have a better idea: Have a function for whitelisting IPs, possible /24's or similiar, where a login to roundcube or other webmail client (with 2FA) will add the IP onto a whitelist for that account. Or perhaps, just "set" the country of the account based on GeoIP. When an account tries to login via IMAP or SMTP, you just check if IP and/or GeoIP country is right, and reject the login as invalid if so not. The only thing a client needs to do to get his IMAP or SMTP client to work again if it stops working, is to login once via the web client. -----Ursprungligt meddelande----- Från: dovecot-bounces(a)dovecot.org <dovecot-bounces(a)dovecot.org> För Alex Skickat: den 15 juli 2021 02:10 Till: dovecot(a)dovecot.org Ämne: 2FA/MFA with IMAP & postfix/submission Hi, I have a dovecot-2.3.13 system on fedora34 with a few hundred IMAP4 accounts, as well as postfix users using submission. Clients are using primarily Outlook on Windows and old squirrelmail. Are there multi-factor options available? If it is not available, do you have any recommendations on where I should look to do this? All of the links related to this topic appear to be very old, or limited to Linux PAM users.

7 10

TLS Security
by Stefan Schumacher 15 Jul '21

15 Jul '21

Hi, I wish to build a new secure email server. It seems I am on the right way – at least I get no more error messages for Postfix – but Dovecot is still making trouble. I am using Dovecot 1:2.3.4.1-5+deb10u6 and I am using ISPconfig 3.25 to do the rough configuring and nano and whats left of my brain to do the finer details. Lets start with what I added to conf.d/10-ssl.conf ssl_cert = </etc/letsencrypt/live/servername/fullchain.pem ssl_key = </etc/letsencrypt/live/servername/privkey.pem ssl_cipher_list = EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aR$ ssl_protocols = !SSLv2 !SSLv3 !TLSv1 !TLSv1.1 ssl_min_protocol = TLSv1.2 As you can see, I clearly do not want to use TLS before v1.2. I think this is not unreasonable in the year 2021. Now, after the changes I ran Kali (I use it to verify the results of my experiments) and - this is a mailing list, so no screenshots: It says: SSL/TLS Deprecated TLS v1.0 and TLS v1.1 Detection. I get this for the ports 143, 110, 993 and 995. I thought I had done everything one could to disable old TLS-Versions. What am I doing wrong? Yours sincerely Stefan Schumacher

4 6

AW: TLS Security
by Stefan Schumacher 15 Jul '21

15 Jul '21

Hi Justina, Kali tools is of course extremly unprecise. Excuse me, I had a long stressful day and wanted to get this out before the end of the Day. Kali is a rolling release and I keep it up to date by upgrading every few days. I also update the feeds. What I actually use for security scans is the former OpenVAS, which now has been relegated to being a part of the Community Edition of the Greenbone suite. You have seen the values I have in Dovecot. What follows now are my settings in the postfix main.cf. As you can clearly see it, it should prevent connections from TLS below 1.2. Dovecot is of course not very fresh because it's Debian 10 and Debian 11 is just around the corner (a few days). These are the settings of my postfix main.cf. I am very tempted to grab an Image of Debian 11 and install ISPConfig and my Dovecot and Postfix settings there. I am of course open to any other suggestions. A the moment I consider to install a new Bullseye RC2 and then put my configuration on it. I am of course open for any other suggestions. Yours sincerely Stefan smtpd_use_tls = yes smtpd_tls_cert_file = /etc/postfix/smtpd.cert smtpd_tls_key_file = /etc/postfix/smtpd.key smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache smtpd_tls_eecdh_grade = strong smtpd_tls_protocols= !SSLv2, !SSLv3, !TLSv1, !TLSv1.1 smtpd_tls_mandatory_protocols= !SSLv2, !SSLv3, !TLSv1, !TLSv1.1 smtpd_tls_mandatory_ciphers = high smtpd_tls_security_level=may smtpd_tls_ciphers = high tls_preempt_cipherlist = yes smtpd_tls_mandatory_exclude_ciphers = aNULL, MD5 , DES, ADH, RC4, PSD, SRP, 3DES, eNULL smtpd_tls_exclude_ciphers = aNULL, MD5 , DES, ADH, RC4, PSD, SRP, 3DES, eNULL smtp_tls_mandatory_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1 smtp_tls_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1 ________________________________ Von: justina colmena ~biz <justina(a)colmena.biz> Gesendet: Mittwoch, 14. Juli 2021 18:50 An: dovecot(a)dovecot.org <dovecot(a)dovecot.org>; Stefan Schumacher <s.schumacher(a)consulting1x1.com> Betreff: Re: TLS Security Interesting. Assuming your "Kali" tools are in fact up to date to test with newer protocols TLS1.2+, is Dovecot compiled against a recent version of the OpenSSL or GnuTLS library or whatever it uses to support the newer TLS protocols? Definitely an outdated cipher issue, on Postfix as well as Dovecot.... On July 14, 2021 6:55:19 AM AKDT, Stefan Schumacher <s.schumacher(a)consulting1x1.com> wrote: Hi, I wish to build a new secure email server. It seems I am on the right way – at least I get no more error messages for Postfix – but Dovecot is still making trouble. I am using Dovecot 1:2.3.4.1-5+deb10u6 and I am using ISPconfig 3.25 to do the rough configuring and nano and whats left of my brain to do the finer details. Lets start with what I added to conf.d/10-ssl.conf ssl_cert = </etc/letsencrypt/live/servername/fullchain.pem ssl_key = </etc/letsencrypt/live/servername/privkey.pem ssl_cipher_list = EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aR$ ssl_protocols = !SSLv2 !SSLv3 !TLSv1 !TLSv1.1 ssl_min_protocol = TLSv1.2 As you can see, I clearly do not want to use TLS before v1.2. I think this is not unreasonable in the year 2021. Now, after the changes I ran Kali (I use it to verify the results of my experiments) and - this is a mailing list, so no screenshots: It says: SSL/TLS Deprecated TLS v1.0 and TLS v1.1 Detection. I get this for the ports 143, 110, 993 and 995. I thought I had done everything one could to disable old TLS-Versions. What am I doing wrong? Yours sincerely Stefan Schumacher -- Sent from my Android device with K-9 Mail. Please excuse my brevity.

1 0

Verifying replication
by Arnold Hendriks 15 Jul '21

15 Jul '21

Dear Dovecot people, I've set up Dovecot replication a couple of years ago. I'm watching the general server health and having Nagios check doveadm replicator status regularly. I'm seeing accounts replicating, disk space usage obviously shows that things work in principle, however, I still wonder whether the replication actually works properly. Accounts I check work, but 1-5% of the messages could easily be missing without me noticing it. These servers have I think about 50K accounts (a lot of them dormant) and between 1 to 2TB of mail. I'm trying to get some more confidence as to whether replication is actually working properly and whether I'm not missing anything that will burn me if I ever have to 'fallback'. Has anyone ever done some verification outside of simply watching doveadm replication stats, to see if they are missing anything ? Eg, I could imagine a process that generates a list of accounts, and then generates hashes on both sides of the replication for each mailbox folder. If the hashes match, the folder gets removed from the list, and once all folders are removed, the account gets removed. Iterating the account list should finally reduce it to 0, or a few extremely high traffic accounts which can be checked manually or be ignored. But I'm trying to avoid reinventing the wheel. Has anyone done anything like this, or can suggest a different approach? With regards, Arnold Hendriks

1 1

Forcing replication - difference is a 0x0D 0x0D 0xA sequence?
by Arnold Hendriks 15 Jul '21

15 Jul '21

I've found a few mailboxes on my system that were being replicated where the mailboxes are not in sync. On server 1 I see: dovecot1:/# doveadm fetch -u s0000000 "size.physical size.virtual" mailbox-guid c92f64f79f0d1ed01e6d5b314f04886c uid 115 size.physical: 1815 size.virtual: 1843 On server 2 I see: dovecot2:/# doveadm fetch -u s0000000 "size.physical size.virtual" mailbox-guid c92f64f79f0d1ed01e6d5b314f04886c uid 115 size.physical: 1805 size.virtual: 1833 Running ' doveadm replicator replicate -f s0000000 "*" ' does not fix the issue. I've compared the mails and the difference appears to be that the primary server (where the mail comes in) has a few occurences of "0D 0D 0A" (hex) which on the replicated server looks like "0D 0A". (ie, \r\r\n was replicated as \r\n ?) Is there a way to force these two messages to be in sync again ? Is the \r\r\n being replicated as \r\n a known issue ? (I'm not sure if I could replicate this, this message dates back to 2007 so probably wasn't even received originally on this server. Replication was configured much later than 2007)

1 0

folders management
by Stephane Magnier 15 Jul '21

15 Jul '21

Hi, Sorry to ask you , maybe a silly question :-) On my folders' architecture, I can see all the folders underneeth each other fodler1 folder2 etc.... I would like to have the possibility to have _folders INTO folders_, like Folder1 Folder2 .......folder 21 ......folder 22 Folders 3 Apparently, this is link to this déclaration :__*_mbox_:/var/spool2/mail/%u. *Is that correct ? is that the "mbox" declaration? or Am I complety wrong ? If I have need to change...I have to change it for what ? * Can I use this new structure with NFS shares ? * What is the backside of it ? Now, if I make this modification.. on an existing dovecot system... , Will it make a true disaster ? or I can change the declaration easily? Thanks and regards,

2 1

Restrict number of mail moved/copied
by Amol Kulkarni 14 Jul '21

14 Jul '21

Hello, I need to restrict number of mail moved/copied by end user using imap in operation. Is there any configuration for that ? Thanks and regards, Amol

1 0