- dovecot - dovecot.org

Dovecot v2.3.15 released
by Timo Sirainen 23 Jun '21

23 Jun '21

Hi, Here's a new release with some security fixes and quite a lot of other changes as well. https://dovecot.org/releases/2.3/dovecot-2.3.15.tar.gz <https://dovecot.org/releases/2.3/dovecot-2.3.15.tar.gz> https://dovecot.org/releases/2.3/dovecot-2.3.15.tar.gz.sig <https://dovecot.org/releases/2.3/dovecot-2.3.15.tar.gz.sig> Binary packages in https://repo.dovecot.org/ <https://repo.dovecot.org/> Docker images in https://hub.docker.com/r/dovecot/dovecot <https://hub.docker.com/r/dovecot/dovecot> * CVE-2021-29157: Dovecot does not correctly escape kid and azp fields in JWT tokens. This may be used to supply attacker controlled keys to validate tokens, if attacker has local access. * CVE-2021-33515: On-path attacker could have injected plaintext commands before STARTTLS negotiation that would be executed after STARTTLS finished with the client. * Disconnection log messages are now more standardized across services. They also always now start with "Disconnected" prefix. * Dovecot now depends on libsystemd for systemd integration. * Removed support for Lua 5.2. Use version 5.1 or 5.3 instead. * config: Some settings are now marked as "hidden". It's discouraged to change these settings. They will no longer be visible in doveconf output, except if they have been changed or if doveconf -s parameter is used. See https://doc.dovecot.org/settings/advanced/ for details. * imap-compress: Compression level is now algorithm specific. See https://doc.dovecot.org/settings/plugin/compress-plugin/ * indexer-worker: Convert "Indexed" info logs to an event named "indexer_worker_indexing_finished". See https://doc.dovecot.org/admin_manual/list_of_events/#indexer-worker-indexin… + Add TSLv1.3 support to min_protocols. + Allow configuring ssl_cipher_suites. (for TLSv1.3+) + acl: Add acl_ignore_namespace setting which allows to entirely ignore ACLs for the listed namespaces. + imap: Support official RFC8970 preview/snippet syntax. Old methods of retrieving preview information via IMAP commands ("SNIPPET and PREVIEW with explicit algorithm selection") have been deprecated. + imapc: Support INDEXPVT for imapc storage to enable private message flags for cluster wide shared mailboxes. + lib-storage: Add new events: mail_opened, mail_expunge_requested, mail_expunged, mail_cache_lookup_finished. See https://doc.dovecot.org/admin_manual/list_of_events/#mail + zlib, imap-compression, fs-compress: Support compression levels that the algorithm supports. Before, we would allow hardcoded value between 1 to 9 and would default to 6. Now we allow using per-algorithm value range and default to whatever default the algorithm specifies. - *-login: Commands pipelined together with and just after the authenticate command cause these commands to be executed twice. This applies to all protocols that involve user login, which currently comprises of imap, pop3, submisision and managesieve. - *-login: Processes are supposed to disconnect the oldest non-logged in connection when process_limit was reached. This didn't actually happen with the default "high-security mode" (with service_count=1) where each connection is handled by a separate process. - *-login: When login process reaches client/process limits, oldest client connections are disconnected. If one of these was still doing anvil lookup, this caused a crash. This could happen only if the login process limits were very low or if the server was overloaded. - Fixed building with link time optimizations (-flto). - auth: Userdb iteration with passwd driver does not always return all users with some nss drivers. - dsync: Shared INBOX not synced when "mail_shared_explicit_inbox" was disabled. If a user has a shared mailbox which is another user's INBOX, dsync didn't include the mailbox in syncing unless explicit naming is enabled with "mail_shared_explicit_inbox" set to "yes". - dsync: Shared namespaces were not synced with "-n" flag. - dsync: Syncing shared INBOX failed if mail_attribute_dict was not set. If a user has a shared mailbox that is another user's INBOX, dsync failed to export the mailbox if mail attributes are disabled. - fts-solr, fts-tika: Using both Solr FTS and Tika may have caused HTTP requests to assert-crash: Panic: file http-client-request.c: line 1232 (http_client_request_send_more): assertion failed: (req->payload_input != NULL) - fts-tika: 5xx errors returned by Tika server as indexing failures. However, Tika can return 5xx for some attachments every time. So the 5xx error should be retried once, but treated as success if it happens on the retry as well. v2.3 regression. - fts-tika: v2.3.11 regression: Indexing messages with fts-tika may have resulted in Panic: file message-parser.c: line 802 (message_parser_deinit_from_parts): assertion failed: (ctx->nested_parts_count == 0 || i_stream_have_bytes_left(ctx->input)) - imap: SETMETADATA could not be used to unset metadata values. Instead NIL was handled as a "NIL" string. v2.3.14 regression. - imap: IMAP BINARY FETCH crashes at least on empty base64 body: Panic: file index-mail-binary.c: line 358 (blocks_count_lines): assertion failed: (block_count == 0 || block_idx+1 == block_count) - imap: If IMAP client using the NOTIFY command was disconnected while sending FETCH notifications to the client, imap could crash with Panic: Trying to close mailbox INBOX with open transactions. - imap: Using IMAP COMPRESS extension can cause IMAP connection to hang when IMAP commands are >8 kB long. - imapc: If remote server sent BYE but didn't immediately disconnect, it could cause infinite busy-loop. - lib-index: Corrupted cache record size in dovecot.index.cache file could have caused a crash (segfault) when accessing it. - lib-oauth2: JWT token time validation now works correctly with 32-bit systems. - lib-ssl-iostream: Checking hostnames against an SSL certificate was case-sensitive. - lib-storage: Corrupted mime.parts in dovecot.index.cache may have resulted in Panic: file imap-bodystructure.c: line 206 (part_write_body): assertion failed: (text == ((part->flags & MESSAGE_PART_FLAG_TEXT) != 0)) - lib-storage: Index rebuilding (e.g. via doveadm force-resync) didn't preserve the "hdr-pop3-uidl" header. Because of this, the next pop3 session could have accessed all of the emails' metadata to read their POP3 UIDL (opening dbox files). - listescape: When using the listescape plugin and a shared namespace the plugin didn't work properly anymore resulting in errors like: "Invalid mailbox name: Name must not have '/' character." - lmtp: Connection crashes if connection gets disconnected due to multiple bad commands and the last bad command is BDAT. - lmtp: The Dovecot-specific LMTP parameter XRCPTFORWARD was blindly forwarded by LMTP proxy without checking that the backend has support. This caused a command parameter error from the backend if it was running an older Dovecot release. This could only occur in more complex setups where the message was proxied twice; when the proxy generated the XRCPTFORWARD parameter itself the problem did not occur, so this only happened when it was forwarded. - lmtp: The LMTP proxy crashes with a panic when the remote server replies with an error while the mail is still being forwarded through a DATA/BDAT command. - lmtp: Username may have been missing from lmtp log line prefixes when it was performing autoexpunging. - master: Dovecot would incorrectly fail with haproxy 2.0.14 service checks. - master: Systemd service: Dovecot announces readiness for accepting connections earlier than it should. The following environment variables are now imported automatically and can be omitted from import_environment setting: NOTIFY_SOCKET LISTEN_FDS LISTEN_PID. - master: service { process_min_avail } was launching processes too slowly when master was forking a lot of processes. - util: Make the health-check.sh example script POSIX shell compatible.

4 4

Quota warning script is never sent when reverse=yes
by Jesús Ángel del Pozo Domínguez 23 Jun '21

23 Jun '21

Hi there, I set up Dovecot to call a quota warning script: plugin { quota_warning = storage=100%% quota-warning 100 %u quota_warning2 = storage=95%% quota-warning 95 %u quota_warning3 = storage=80%% quota-warning 80 %u quota_warning4 = -storage=100%% quota-warning below %u } The script is called whenever the quota exceeds the corresponding amount (80%, 95% and 100%). However, on deleting messages to free space, the script is not being called even though the quota drops below 100%. I have manually tested the script, and it works: $ /usr/local/bin/quota-warning.sh below user(a)foo.bar Could you please give me any hint to fix this. I would like to call the quota-warning script so that I can clear the over_quota_flag field in the database. Regards,

1 0

ssl_min_protocol v2.3.15
by Theo Pannen 23 Jun '21

23 Jun '21

Hello, it seems that the default value for ssl_min_protocol has changed from TLSv1 to TLSv1.2, right? After upgrading to v2.3.15 and with ssl_min_protocol commented out, the server no longer offers TLSv1 and TLSv1.1. This is a good idea, but should be documented. Theo

2 1

CVE-2021-33515: SMTP Submission service STARTTLS injection
by Timo Sirainen 22 Jun '21

22 Jun '21

Open-Xchange Security Advisory 2021-06-21 Product: Dovecot Vendor: OX Software GmbH Internal reference: DOV-4583 (Bug ID) Vulnerability type: CWE-74: Failure to Sanitize Data into a Different Plane ('Injection') Vulnerable version: 2.3.0-2.3.14 Vulnerable component: submission Report confidence: Confirmed Solution status: Fixed by Vendor Fixed version: 2.3.14.1 Vendor notification: 2021-05-21 Solution date: 2021-05-22 Public disclosure: 2021-06-21 CVE reference: CVE-2021-33515 CVSS: 4.2 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N) Researcher credit: Fabian Ising and Damian Poddebniak of Münster University of Applied Sciences Vulnerability Details: On-path attacker could inject plaintext commands before STARTTLS negotiation that would be executed after STARTTLS finished with the client. Only the SMTP submission service is affected. Risk: Attacker can potentially steal user credentials and mails. The attacker needs to have sending permissions on the submission server (a valid username and password). Workaround: None. Solution: Operators should update to 2.3.14.1 or later version.

3 3

Dovecot deliver and imap process hangs
by Rok Saksida 22 Jun '21

22 Jun '21

Hello. Dovecot version: 2.2.36 OS: CentOS Linux release 7.9.2009 (Core) Kernel: 3.10.0-1160.11.1.el7.x86_64 I have two dovecot servers in replication master/master. Sometimes happens that deliver or imap process hangs and causing high CPU usage. In log's I only see locking failures but not initial cause why this happened. For mail storage I use ZFS pool with compression enabled. I made some digging and find this option: mmap_disable = yes. I will try this setting today evening. But I wondering if you have any idea why this happening and how to start solving this problems? Is there any additional setting like mmap_disable that can help solved this issues? -- BR

1 0

Upgrade path
by Andrea Gabellini 22 Jun '21

22 Jun '21

Hello, I have a configuration with two proxy/director and two backend with replication. All at version 2.3.10.1. What is the suggested upgrade path to 2.3.15? I think to switch traffic to only one proxy and one backend and upgrade the two servers that remain without traffic. Then I switch the traffic to these upgraded servers and proceed with the upgrade of the others two. Is this correct? Or is best to upgrade first the two proxy/director and next the two backend? Thanks, Andrea -- __________________________ Business is like riding a bicycle. Either you keep moving or you fall down. __________________________ TIM San Marino S.p.A. Andrea Gabellini Engineering R&D TIM San Marino S.p.A. - https://www.telecomitalia.sm Via Ventotto Luglio, 212 - Piano -2 47893 - Borgo Maggiore - Republic of San Marino Tel: (+378) 0549 886237 Fax: (+378) 0549 886188 -- Informativa Privacy Questa email ha per destinatari dei contatti presenti negli archivi di TIM San Marino S.p.A.. Tutte le informazioni vengono trattate e tutelate nel rispetto della normativa vigente sulla protezione dei dati personali (Reg. EU 2016/679). Per richiedere informazioni e/o variazioni e/o la cancellazione dei vostri dati presenti nei nostri archivi potete inviare una email a privacy(a)telecomitalia.sm. Avviso di Riservatezza Il contenuto di questa e-mail e degli eventuali allegati e' strettamente confidenziale e destinato alla/e persona/e a cui e' indirizzato. Se avete ricevuto per errore questa e-mail, vi preghiamo di segnalarcelo immediatamente e di cancellarla dal vostro computer. E' fatto divieto di copiare e divulgare il contenuto di questa e-mail. Ogni utilizzo abusivo delle informazioni qui contenute da parte di persone terze o comunque non indicate nella presente e-mail potra' essere perseguito ai sensi di legge.

1 0

CVE-2021-29157: oauth2 JWT local validation path traversal
by Timo Sirainen 21 Jun '21

21 Jun '21

Open-Xchange Security Advisory 2021-06-21 Product: Dovecot Vendor: OX Software GmbH Internal reference: DOV-4476 (Bug ID) Vulnerability type: CWE-24: Path Traversal: '../filedir' Vulnerable version: 2.3.11-2.3.14 Vulnerable component: imap, pop3, submission, managesieve Report confidence: Confirmed Solution status: Fixed by Vendor Fixed version: 2.3.14.1 Vendor notification: 2021-03-22 Solution date: 2021-04-14 Public disclosure: 2021-06-21 CVE reference: CVE-2021-29157 CVSS: 6.7 (CVSS3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) Researcher credit: Kirin of Tencent Security Xuanwu Lab Vulnerability Details: Dovecot does not correctly escape kid and azp fields in JWT tokens. This may be used to supply attacker controlled keys to validate tokens in some configurations. This requires attacker to be able to write files to local disk. Risk: Local attacker can login as any user and access their emails. Workaround: Disable local JWT validation in oauth2, or use a different dict driver than fs:posix. Solution: Operators should update to 2.3.14.1 or later version.

1 0

CVE-2020-28200: Sieve excessive resource usage
by Timo Sirainen 21 Jun '21

21 Jun '21

Open-Xchange Security Advisory 2021-06-21 Product: Dovecot Vendor: OX Software GmbH Internal reference: DOV-4159 (Bug ID) Vulnerability type: CWE-400 Vulnerable version: 1.2.0-2.3.14 Vulnerable component: lmtp, lda Report confidence: Confirmed Solution status: Fixed by Vendor Fixed version: 2.3.15 Vendor notification: 2020-09-23 Solution date: 2020-12-07 Public disclosure: 2021-06-21 CVE reference: CVE-2020-28200 CVSS: 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Researcher credit: Innokentii Sennovskii from BI.ZONE Vulnerability Details: Sieve interpreter is not protected against abusive scripts that claim excessive resource usage. Especially scripts using massive amounts of regexps. Risk: Attacker can DoS the mail delivery system by using excessive amount of CPU and/or reaching the lmtp/lda process limits. Workaround: Disabling the regex sieve extension avoids the worst problems. lmtp_user_concurrency_limit may also be helpful. Solution: Operators should update to 2.3.15 or later version.

1 0

Pigeonhole v0.5.15 released
by Timo Sirainen 21 Jun '21

21 Jun '21

Hi, Pigeonhole release for Dovecot v2.3.15. One thing we noticed a bit before release is that if you're using imap_sieve_filter plugin, the IMAP FILTER command may trigger the new excessive resource usage check since it can be processing many messages rapidly. You may want to prevent this with protocol imap { sieve_max_cpu_time=0 } https://pigeonhole.dovecot.org/releases/2.3/dovecot-2.3-pigeonhole-0.5.15.t… <https://pigeonhole.dovecot.org/releases/2.3/dovecot-2.3-pigeonhole-0.5.15.t…> https://pigeonhole.dovecot.org/releases/2.3/dovecot-2.3-pigeonhole-0.5.15.t… <https://pigeonhole.dovecot.org/releases/2.3/dovecot-2.3-pigeonhole-0.5.15.t…> Binary packages in https://repo.dovecot.org/ <https://repo.dovecot.org/> Docker images in https://hub.docker.com/r/dovecot/dovecot <https://hub.docker.com/r/dovecot/dovecot> * CVE-2020-28200: Sieve interpreter is not protected against abusive scripts that claim excessive resource usage. Fixed by limiting the user CPU time per single script execution and cumulatively over several script runs within a configurable timeout period. Sufficiently large CPU time usage is summed in the Sieve script binary and execution is blocked when the sum exceeds the limit within that time. The block is lifted when the script is updated after the resource usage times out. * Disconnection log messages are now more standardized across services. They also always now start with "Disconnected" prefix. - managesieve: Commands pipelined together with and just after the authenticate command cause these commands to be executed twice.

1 0

error: "The certificate is empty"
by A. Schulze 18 Jun '21

18 Jun '21

Hello, on a farm of multiple identical dovecot servers I start seeing this error on usual POP3S access on one of many servers: pop3-login: Error: Failed to initialize SSL server context: Can't load SSL certificate (ssl_cert setting): The certificate is empty: I'm running 2.3.14 compiled against openssl-1.1.1k on Debian Buster Looks like it's this code: https://github.com/dovecot/core/blob/a5209c83c3a82386c94d466eec5fea394973e8… called from here: https://github.com/dovecot/core/blob/a5209c83c3a82386c94d466eec5fea394973e8… To me it /looks/ like a resource problem. The farm handle a million pop3 sessions per hour while only 50k (5%) are using TLS. The farm is up and running since ~2 weeks. When started, the automatic deployment *did* check that pop3s was working well. Also today on all farmservers the certificate file is valid, contain expected content. the server is currently offline but not restarted to allow further investigation. the setup is quite normal just checked over all Farmservers: - doveconf | grep ssl | sha256sum - sha256sum $( doveconf | grep 'ssl_cert = <' | awk -F\< '{ print $2 }' ) the output is identical. Any idea is appreciated ... Andreas

1 0

Maildir to Mdbox and folder structure after the conversion
by Marco Usai 18 Jun '21

18 Jun '21

Using the dsync command I've converted a Dovecot mail folder from Maildir to Mdbox format. (see https://dovecot.org/pipermail/dovecot/2021-June/122304.html) The folder resulting from the conversion (see https://pastebin.com/6U4CDTQi ), however, has a completely different directory structure from the one used by the destination server where it will be transferred (see https://pastebin.com/nMEvqmqp ) What do I have to do to make the folder obtained after the conversion have a directory structure identical to the one used by the destination server ? Thank You.

3 4

Empty response with userFile from doveadm HTTP API
by lab＠403.sk 18 Jun '21

18 Jun '21

Hi, I must be doing something terribly wrong, but I am not able to get a non empty response from doveadm HTTP API when using userFile parameter. E. g. in getQuota or search command. Single user or wildcard working as expected. ./doveadm_cli.py --apikey $key --apiurl http://localhost:8180/doveadm/v1 (doveadm) quotaGet userFile=/tmp/f [] Results: 0 cat /tmp/f box1(a)domain.tld box2(a)domain.tld Result with plain cURL is exactly the same. curl -X POST http://localhost:8180/doveadm/v1 -H "Content-Type: application/json" -H "Authorization: X-Dovecot-API xxx" -d '[["quotaGet",{"userFile":"/tmp/f"},"tag1"]]' [["doveadmResponse",[],"tag1"]] Doveadm binary has no problem of reading that file. In a debug log I can see request finishes after "Handling LIST request" and does not jump to "Handling USER request" as in doveadm (binary) case. Am I missing something? dovecot: doveadm(::1): Executing command quota get dovecot: doveadm: Debug: auth-master: userdb list: Started listing users (user_mask=*) dovecot: doveadm: Debug: auth-master: conn unix:/var/run/dovecot/auth-userdb: Connecting dovecot: doveadm: Debug: auth-master: conn unix:/var/run/dovecot/auth-userdb (pid=13811,uid=0): Client connected (fd=8) dovecot: doveadm(::1): Debug: auth-master: userdb list: Finished listing users dovecot: doveadm(::1): Debug: auth-master: conn unix:/var/run/dovecot/auth-userdb (pid=13811,uid=0): Disconnected: Connection closed (fd=8) dovecot: auth: Debug: master in: LIST#0111#011user=* dovecot: doveadm(::1): doveadm: ::1 - - "POST /doveadm/v1 HTTP/1.1" 200 77 "http://localhost:8180/doveadm/v1" "python-requests/2.6.0 CPython/2.7.5" dovecot: auth-worker(13875): Debug: Loading modules from directory: /usr/lib64/dovecot/auth dovecot: auth-worker(13875): Debug: Module loaded: /usr/lib64/dovecot/auth/lib20_auth_var_expand_crypt.so dovecot: auth-worker(13875): Debug: Module loaded: /usr/lib64/dovecot/auth/libdriver_mysql.so dovecot: auth-worker(13875): Debug: Module loaded: /usr/lib64/dovecot/auth/libdriver_sqlite.so dovecot: auth-worker(13875): Debug: conn unix:auth-worker (pid=13839,uid=97): Server accepted connection (fd=15) dovecot: auth-worker(13875): Debug: conn unix:auth-worker (pid=13839,uid=97): Sending version handshake dovecot: auth-worker(13875): Debug: conn unix:auth-worker (pid=13839,uid=97): auth-worker<1>: Handling LIST request dovecot: auth-worker(13875): Debug: conn unix:auth-worker (pid=13839,uid=97): auth-worker<1>: sql(*): Performing userdb lookup dovecot: auth-worker(13875): Debug: conn unix:auth-worker (pid=13839,uid=97): auth-worker<1>: sql(*): SELECT email AS user FROM mailbox WHERE active=1 dovecot: auth-worker(13875): Debug: conn unix:auth-worker (pid=13839,uid=97): auth-worker<1>: sql(*): Finished userdb lookup dovecot: auth-worker(13875): Debug: conn unix:auth-worker (pid=13839,uid=97): auth-worker<1>: Finished doveconf -n # 2.3.14 (cee3cbc0d): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.14 (1b5c82b2) # OS: Linux 3.10.0-862.2.3.el7.x86_64 x86_64 CentOS Linux release 7.5.1804 (Core) # Hostname: xxx auth_debug = yes auth_mechanisms = plain login cram-md5 auth_verbose = yes default_client_limit = 6000 default_process_limit = 512 disable_plaintext_auth = no doveadm_api_key = # hidden, use -P to show it mail_debug = yes mail_home = /h/v/%d/%n mail_location = maildir:~/Maildir mail_plugins = quota managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext mbox_write_locks = fcntl namespace inbox { inbox = yes list = yes location = mailbox "Deleted Items" { special_use = \Trash } mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Items" { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Spam { special_use = \Junk } mailbox Trash { special_use = \Trash } prefix = type = private } passdb { args = /etc/dovecot/local-sql.conf driver = sql } plugin { quota = maildir quota_grace = 10M quota_rule2 = Kos:storage=+100M quota_rule3 = Trash:storage=+100M quota_rule4 = Deleted Messages:storage=+100M quota_status_nouser = DUNNO quota_status_overquota = 552 5.2.2 Mailbox is full quota_status_success = DUNNO sieve = file:~/sieve;active=~/.dovecot.sieve } service auth-worker { idle_kill = 30 secs } service auth { unix_listener /var/spool/postfix/private/auth { group = mail mode = 0660 user = postfix } unix_listener auth-userdb { mode = 0600 user = vmail } } service doveadm { client_limit = 1 inet_listener http { address = localhost port = 8180 } process_min_avail = 1 unix_listener doveadm-server { mode = 0600 user = vmail } user = vmail } service imap-login { process_limit = 4096 process_min_avail = 10 service_count = 1 } service imap { process_limit = 4096 } service lmtp { process_min_avail = 5 unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } user = vmail } service pop3-login { client_limit = 2048 } service quota-status { client_limit = 1 executable = quota-status -p postfix process_min_avail = 5 unix_listener /var/spool/postfix/private/dovecot-quota-status { group = postfix mode = 0600 user = postfix } user = vmail } ssl_ca = </etc/pki/tls/cert.pem ssl_cert = </etc/pki/o/default.pem ssl_cipher_list = HIGH:!aNULL:!SSLv2:!ADH:!EXP:!eNULL:!RC4:!MEDIUM:!LOW ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it ssl_prefer_server_ciphers = yes userdb { driver = prefetch } userdb { args = /etc/dovecot/local-sql.conf driver = sql } verbose_proctitle = yes protocol lmtp { mail_plugins = quota sieve } protocol imap { mail_max_userip_connections = 50 mail_plugins = quota imap_quota } Kind regards, Libor

1 0

Question Regarding The 'poolp' Guide On How To Deploy A Mail Server's Last Portion Regarding Dovecot With 'sieve' Scripts
by Samuel Banya 18 Jun '21

18 Jun '21

Hello everyone, I've been following the "poolp" guide on how to deploy an email server on OpenBSD: - https://poolp.org/posts/2019-09-14/setting-up-a-mail-server-with-opensmtpd-… I'm currently at the very end of the guide in which he is using sieve with Dovecot to do some final filtering. The unfortunate thing is that when I run these two commands in the '/usr/local/lib/dovecot/sieve' directory: sievec report-ham.sieve sievec report-spam.sieve I'm getting the following error: # sievec report-ham.sieve report-ham: line 1: error: require command: unknown Sieve capability `vnd.dovecot.pipe'. report-ham: line 1: error: require command: unknown Sieve capability `imapsieve'. report-ham: line 15: error: unknown command 'pipe' (only reported once at first occurrence). report-ham: error: validation failed. sievec(root): Fatal: failed to compile sieve script 'report-ham.sieve' # sievec report-spam.sieve report-spam: line 1: error: require command: unknown Sieve capability `vnd.dovecot.pipe'. report-spam: line 1: error: require command: unknown Sieve capability `imapsieve'. report-spam: line 7: error: unknown command 'pipe' (only reported once at first occurrence). report-spam: error: validation failed. sievec(root): Fatal: failed to compile sieve script 'report-spam.sieve' What's interesting is that this same post has the same exact error, and I tried his workaround which did NOT work unfortunately: - http://dovecot.2317879.n4.nabble.com/sieve-compile-error-td70414.html This is what was present BEFORE my changes in ' plugin { sieve_plugins = sieve_imapsieve sieve_extprograms sieve_global_extensions = +vnd.dovecot.pipe +vnd.dovecot.environment imapsieve_mailbox1_name = Junk imapsieve_mailbox1_causes = COPY APPEND imapsieve_mailbox1_before = file:/usr/local/lib/dovecot/sieve/report-spam.sieve imapsieve_mailbox2_name = * imapsieve_mailbox2_from = Junk imapsieve_mailbox2_causes = COPY imapsieve_mailbox2_before = file:/usr/local/lib/dovecot/sieve/report-ham.sieve imapsieve_mailbox3_name = Inbox imapsieve_mailbox3_causes = APPEND imapsieve_mailbox3_before = file:/usr/local/lib/dovecot/sieve/report-ham.sieve sieve_pipe_bin_dir = /usr/local/lib/dovecot/sieve } This is what was present AFTER my changes in '/etc/dovecot/conf.d/90-plugin.conf' (aka I followed this post's workaround http://dovecot.2317879.n4.nabble.com/sieve-compile-error-td70414.html) plugin { sieve_plugins = sieve_imapsieve sieve_extprograms sieve_global_extensions = +vnd.dovecot.environment +vnd.dovecot.debug +vnd.dovecot.pipe imapsieve_mailbox1_name = Junk imapsieve_mailbox1_causes = COPY APPEND imapsieve_mailbox1_before = file:/usr/local/lib/dovecot/sieve/report-spam.sieve imapsieve_mailbox2_name = * imapsieve_mailbox2_from = Junk imapsieve_mailbox2_causes = COPY imapsieve_mailbox2_before = file:/usr/local/lib/dovecot/sieve/report-ham.sieve imapsieve_mailbox3_name = Inbox imapsieve_mailbox3_causes = APPEND imapsieve_mailbox3_before = file:/usr/local/lib/dovecot/sieve/report-ham.sieve sieve_pipe_bin_dir = /usr/local/lib/dovecot/sieve } Any ideas on what I can do? Please let me know if this is better suited for the OpenSMTPD mailing list instead though.

1 0

Multiple non-plaintext mechanisms using multiple passdbs.
by Jesús Ángel del Pozo Domínguez 17 Jun '21

17 Jun '21

Hi there, Although I have set up TLS in my Dovecot installation, I would like to also set up some non-plaintext authentication mechanism, specifically CRAM-MD5 and SCRAM-SHA-1. As I read in the documents, "The problem with non-plaintext auth mechanisms is that the password must be stored either in plaintext, or using a mechanism-specific scheme that’s incompatible with all other non-plaintext mechanisms". I will not be storing the user's passwords in plaintext, so I will have to use different mechanism-specific hash schemes. I was wondering whether it would be possible to have several auth databases, one for each non-plaintext mechanism. Well, in reality, I will have just one database with multiple hashes: SHA512-CRYPT, CRAM-MD5 and SCRAM-SHA-1 but then I am going to set up three different passdb instances in dovecot, each one with its own SQL configuration. For example: passdb { driver = sql args = /etc/dovecot/dovecot-sql-plain.conf.ext } passdb { driver = sql args = /etc/dovecot/dovecot-sql-cram-md5.conf.ext } passdb { driver = sql args = /etc/dovecot/dovecot-sql-scram-sha-1.conf.ext } Most users would use TLS and PLAIN as authentication mechanism so the last two password databases will not be used at all. However, those users using CRAM-MD5 or SCRAM-SHA-1 would try the other databases. My users table would be somewhat like this: CREATE TABLE users ( username VARCHAR(128) NOT NULL, domain VARCHAR(128) NOT NULL, password VARCHAR(77) NOT NULL, password_cram_md5 VARCHAR(74) NOT NULL, password_scram_sha_1 VARCHAR(100) NOT NULL, home VARCHAR(255) NOT NULL, uid INTEGER NOT NULL, gid INTEGER NOT NULL, active CHAR(1) DEFAULT 'Y' NOT NULL ); username: foo(a)bar.com domain: bar.com password: {SHA512-CRYPT}$6$Mih5.y90z...CqxX2LxfMJMqoC42NvBK1 password_cram_md5: {CRAM-MD5}a457...2a74f63442e7473e9576cf2e password_scram_sha_1: {SCRAM-SHA-1}4096,4...9AYjadouwXqiqc3UM= Obviously, the SQL query in each dovecot-sql-....ext file would be different. For instance: /etc/dovecot/dovecot-sql-plain.conf.ext default_pass_scheme = SHA512-CRYPT password_query = \ SELECT username, domain, password, home AS userdb_home, uid AS userdb_uid FROM users WHERE username = '%n' AND domain = '%d' /etc/dovecot/dovecot-sql-cram-md5.conf.ext default_pass_scheme = CRAM-MD5 password_query = \ SELECT username, domain, password_cram_md5 AS password, home AS userdb_home, uid AS userdb_uid FROM users WHERE username = '%n' AND domain = '%d' /etc/dovecot/dovecot-sql-scram-sha-1.conf.ext default_pass_scheme = SCRAM-SHA-1 password_query = \ SELECT username, domain, password_scram_sha_1 AS password, home AS userdb_home, uid AS userdb_uid FROM users WHERE username = '%n' AND domain = '%d' Could you please tell me whether this set up would work? Do you believe is worth the complexity or maybe I had better keep it more simple and use just PLAIN auth with TLS? Cheers, Jesús Ángel

1 0

Mapping usernames used for authentication to UNIX usernames
by Frank Volf 17 Jun '21

17 Jun '21

Hi, I'm looking for some advice or pointers how to best solve a small problem that I have. I have no doubt that this can be done in dovecot, but I'm struggling to find the easiest way to implement it. First of all, what I have: I have a relative small dovecot setup for a dozen domains, and about 50 users in total. All users use IMAP to retrieve mail, and SMTP submission protocol to submit email. Because of the small size, every user has its own UNIX account, authentication is done using PAM and mail is stored in a Maildir folder in their home directory. Works perfectly! There is one minor inconvenience. When a new mail client is configured, users (often guided by the auto config generator of the mail client) tend to use their email address as the username to authenticate instead of their UNIX account name, which fails of course. Would it be possible to configure something that will map an email address to the UNIX account name and use the account name for authentication and obtaining the related information (uid, gid, home dir)? I do have two concerns: 1) I do not want to break existing mail configurations, so authentication with the UNIX username should still be possible. 2) I cannot do a simple reg. exp for the translation because every email domain has e.g. an info(a)domain.com mailbox, and I do not want them all to go to UNIX user "info". As said, I would appreciate any advice on how this can be configured the easiest. Thanks in advance. Kind regards, Frank

4 3

Re: N-way replication, multiple masters
by Henry 17 Jun '21

17 Jun '21

1 GB data per day is very little volume ,I think dovecot replication, rsync also suitable. Hi Mail replication – honestly, I don’t have any hard metrics for that. I’m anticipating its less than 1 GB per day. Link speed – being AWS inter AZ its 100Mbps-1GBps. I’m conscious if I go inter region the strategy may need to change. Thanks Raymond Raymond Sellars (<raymond.sellars(a)orionhealth.com>) 在 2021年6月17日星期四上午11:30:23 [GMT+8] 寫道： #yiv6469694122 #yiv6469694122 -- _filtered {} _filtered {} _filtered {} _filtered {} _filtered {}#yiv6469694122 #yiv6469694122 p.yiv6469694122MsoNormal, #yiv6469694122 li.yiv6469694122MsoNormal, #yiv6469694122 div.yiv6469694122MsoNormal {margin:0cm;font-size:11.0pt;font-family:sans-serif;}#yiv6469694122 a:link, #yiv6469694122 span.yiv6469694122MsoHyperlink {color:blue;text-decoration:underline;}#yiv6469694122 span.yiv6469694122EmailStyle19 {font-family:sans-serif;color:#1F497D;font-weight:normal;font-style:normal;}#yiv6469694122 .yiv6469694122MsoChpDefault {font-size:10.0pt;} _filtered {}#yiv6469694122 div.yiv6469694122WordSection1 {}#yiv6469694122 Hi Mail replication – honestly, I don’t have any hard metrics for that. I’m anticipating its less than 1 GB per day. Link speed – being AWS inter AZ its 100Mbps-1GBps. I’m conscious if I go inter region the strategy may need to change. Thanks Raymond From: Henry <hl1723(a)yahoo.com.hk> Sent: Thursday, 17 June 2021 3:20 PM To: Raymond Sellars <raymond.sellars(a)orionhealth.com> Subject: Re: N-way replication, multiple masters How many data for mail replication ? and the link speed? Raymond Sellars (<raymond.sellars(a)orionhealth.com>) 在 2021年6月17日星期四上午11:10:23 [GMT+8] 寫道：

1 0

N-way replication, multiple masters
by Raymond Sellars 17 Jun '21

17 Jun '21

Hi Looking for some guidance on how to setup a dovecot cluster with more than 2 servers. Ideally as multiple masters so I don't have the complexity of back recovery/synchronisation in failover situations. And I can utilised upstream load balancers (director or other) to automatically move between available nodes. Current pattern is: High availability at one site (AWS availability zone) with two active servers behind dovecot directors and an AWS network load balancer in front of the directors. A third dovecot server as a disaster recovery instance (another availability zone or region), with ideally real time and bidirectional replication. Behind a different network and NLB access path. Dovecot --version = 2.3.14 Centos 7 Previously for the HA pair we utilised NFS but the AWS EFS equivalent doesn't perform ( very high latency and NFS meta data caching required). And then for DR we utilised the dovecot replication. 2 way so I have automated recovery and could do active active testing/verification as required with no down time. This help verify recovery pathways. https://doc.dovecot.org/configuration_manual/replication/# - reading the documentation is seems clear that replication only supports a PAIR of masters. Any ideas on how I can add in a 3rd replication node? Two pairs? I'm happy to utilise a star pattern. HA 1 <-> HA2, HA 1 <-> DR. Not possible? Can I run more than one replicator? Or should I utilise doveadm sync via cron jobs and 2-way sync. Any thoughts, suggestions most welcome. How are others achieving > 2 clusters for dovecot servers supporting the same domain? Most of this is for availability rather than purely performance scaling. Thanks Raymond

1 0

working locally not externally, how to check what failed?
by Voytek Eymont 17 Jun '21

17 Jun '21

this morning I noticed not getting any email on remote to server mail client, though, in webmail/squirellmail on mail host there were new emails restarting with doveadm stop/dovecot 'fixed it' what could've gone wrong, what to look for in the logs ? thanks for any pointers long running dovecot/postfix/mysql setup dovecot --version 2.3.14 (cee3cbc0d)

1 0

Piping to doveadm pw
by Kevin N. 16 Jun '21

16 Jun '21

Hello everybody, I am using 'doveadm pw' from inside a bash script to generate the salted hash for a user provided password. I call it like: doveadm pw -s SHA256-CRYPT -u $user -p $password Is there any possible way to use piping (so it won't show up in ps for example) to pass the username and password to 'doveadm pw' instead of using arguments? Dovecot version: 2.3.14 Many thanks, Kevin

3 4

LMTP with hardlinks ?
by Vladislav Kurz 16 Jun '21

16 Jun '21

Hello, I'm looking for deduplication of mails via hardlinks during delivery. I.e. a mail that is sent to multiple recipients (to, cc, bcc) should be stored only once. I did some search and found only some non-complete information. dovecot-lda has a "-p path" option that does the delivery using symlinks if possible (i.e. same uid/gid and same filesystem). This is working by hand, but could not find any hints how to use this with postfix. Found only suggestion of a wrapper, that was probably never implemented - in this thread: https://dovecot.org/pipermail/dovecot/2008-June/031158.html In this message: https://dovecot.org/list/dovecot/2013-February/088540.html there is statement that: LMTP always delivers the mail to the first user. Then it tries to copy the first mail to the second user, because in some setups this can be done using hard links. I was not able to get this in my setup, and I'd like to know if this statement is really true. I have all mail in /var/vmail, all owned by vmail user, but still mail delivered to multiple users is duplicated. If this is really supposed to make hardlinks (which would be great), is there any way to debug it? E.g. see if the hardlink was attempted but failed for some reason, or if the message was delivered in the same LMTP session ? -- Best Regards Vladislav Kurz

1 1

lda to lmtp
by Laura Steynes 14 Jun '21

14 Jun '21

Hi, Although dovecot-lda serves us fine, we only average 8k messages an hour, peaking at 11k, over 4 machines (mostly for redundancy, we've run this fine on just 1 machine, but sometimes clamav makes things get upset, so we added some more especially since we are growing rapidly, we decided to see if lmtp would be of benefit, so far, we cant tell any difference, I guess it is only 120-130 messages a minute, maybe if we were doing 200 a minute we might see gain? The question is with lda we used postfix settings destination_recipient_limit=1, we have not added this with lmtp,is this needed?

6 9

sieve not updating headers?
by Daniel J. Luke 13 Jun '21

13 Jun '21

Hello, I've recently converted from using procmail as an lda to using lmtp+sieve (and it's overall great). My setup is currently doing post-queue spamassassin to pickup user rules (and to be substantially similar to how it worked before). It mostly works, but I get some mail forwarded from another host that also runs spamassassin, so the mail comes with X-Spam headers already set. I can see that my sieve_before script successfully sends the message off to spamc/spamd - however the message ends up in my mailbox with only the pre-existing X-Spam headers (I had expected them to be replaced or to see duplicates). I thought I'd try to just strip them from incoming mail so I used deleteheader, I got a trace saying it matches and deletes the headers, then sends the mail off to spamc/spamd - but the message that ends up in my mailbox has the headers that were presumably deleted. My before.sieve looks like this: require ["vnd.dovecot.filter","editheader"]; # rule:[spamfilter] if size :under 10485760 { deleteheader :matches "X-Spam-Flag" "*"; deleteheader :matches "X-Spam-Status" "*"; deleteheader :matches "X-Spam-Level" "*"; deleteheader :matches "X-Spam-Checker-Version" "*"; filter "spamc" ["-s","10485760","-U","/var/run/spamd.sock"]; } Trace file says: ## Started executing script 'before' 6: size :under test 6: comparing message size 4197 6: with lower limit 10485760 6: jump if result is false 6: not jumping 11: deleteheader command 11: deleting matching occurrences of header `X-Spam-Flag' 11: header `X-Spam-Flag' not found 12: deleteheader command 12: deleting matching occurrences of header `X-Spam-Status' 12: starting `:matches' match with `i;ascii-casemap' comparator: 12: matching value `No, score=-0.2 required=5.0 tests=DKIM_SIGNED,DKIM_VALID, DKIM_VALID_AU,DKIM_.. .' 12: with key `*' => 1 12: deleting header with value `No, score=-0.2 required=5.0 tests=DKIM_SIGNED,DKIM_VALID, DKIM_VALI D_AU,DKIM_VALID_EF,FREEMAIL_FROM,HTML_MESSAGE, RCVD_IN_DNSWL_NONE,SPF_HELO_NONE,SPF_PASS autolearn=ham au tolearn_force=no version=3.4.2' 12: finishing match with result: matched 13: deleteheader command 13: deleting matching occurrences of header `X-Spam-Level' 13: header `X-Spam-Level' not found 14: deleteheader command 14: deleting matching occurrences of header `X-Spam-Checker-Version' 14: starting `:matches' match with `i;ascii-casemap' comparator: 14: matching value `SpamAssassin 3.4.2 (2018-09-13) on braeburn.macports.org' 14: with key `*' => 1 14: deleting header with value `SpamAssassin 3.4.2 (2018-09-13) on braeburn.macports.org' 14: finishing match with result: matched 16: filter action 16: execute program `spamc' 16: executed program successfully 16: changed message ## Finished executing script 'before' It then falls through my personal sieve filter and hits the implicit keep at the end and ends up in my inbox - with the original headers. So, two questions: 1. What am I missing? 2. Is there a way to match any X-Spam-* header? (when I tried deleteheader :matches "X-Spam*" it didn't match anything). Thanks. -- Daniel J. Luke

4 6

Use of Sieve with Dovecot not possible cause of error
by DarkFish82 12 Jun '21

12 Jun '21

**What happened?** The description of the problem concerns the Thunderbird but also the stand alone version and other sieve editors. I would like to edit Sieve via the plugin/program. My mail account works without problems and can also send/receive. Creating a new account is possible without any problems. As soon as I click on "Connect", the loading bar is permanently there and nothing happens. I have activated debugging in the settings, but I don't know where it is saved. if someone tells me, I can submit the required log later. **Settings** Settings from Sieve: Server imap.xxxxxx.eu: 4190 (Secured connection) Username my(a)fancydomain.eu **Logs** dovecot-mailcow_1 | May 9 02:47:16 04888203e1b5 dovecot: managesieve-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=92.123.123.123, lip=123.123.123.123, TLS handshaking: SSL_accept() failed: error:14094412:SSL routines:ssl3_read_bytes:sslv3 alert bad certificate: SSL alert number 42 **What i tried?** 1. gnutls-cli --starttls -p 4190 imap.xxxxxx.eu Output: `Processed 129 CA certificate(s). Resolving "imap.xxxxxxxxx.eu:4190"... Connecting to "2a03:4000:34:522:981b:xxxx:xxxx:xxxx:4190"... Simple Client Mode: "IMPLEMENTATION" "Dovecot Pigeonhole" "SIEVE" "fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext vacation-seconds editheader imapflags notify imapsieve vnd.dovecot.imapsieve" "NOTIFY" "mailto" "SASL" "" "STARTTLS" "VERSION" "1.0" OK "Dovecot ready."` 2. telnet xxx.xxx.xxx.xxx 4190 output: Connected to xxx.xxx.xxx.xxx. Escape character is "^]". "IMPLEMENTATION" "Dovecot Pigeonhole" "SIEVE" "fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext vacation-seconds editheader imapflags notify imapsieve vnd.dovecot.imapsieve" "NOTIFY" "mailto" "SASL" "" "STARTTLS" "VERSION" "1.0" OK "Dovecot ready." 3. Added in dovecot.conf in "service managesieve-login" "ssl = no" and after that "ssl = true" but also not working. dovecot config: service managesieve-login { inet_listener sieve { port = 4190 ssl = no } inet_listener sieve_haproxy { port = 14190 haproxy = yes } service_count = 1 process_min_avail = 2 vsz_limit = 1G } **OS/Software Informations** Client Thunderbird: OS: Windows 10 Sieve Version: 0.5.3 Thunderbird Version: 78.11.0 Client Standalone: OS: Windows 10 Sieve Version: 0.5.2 Mailcow: OS: Ubuntu 20.04 Mailcow Versions: acme-mailcow (mailcow/acme:1.78) clamd-mailcow (mailcow/clamd:1.39) dockerapi-mailcow (mailcow/dockerapi:1.38) dovecot-mailcow (mailcow/dovecot:1.145) ejabberd-mailcow (mailcow/ejabberd:1.5) ipv6nat-mailcow (robbertkl/ipv6nat) memcached-mailcow (memcached:alpine) mysql-mailcow (mariadb:10.5) netfilter-mailcow (mailcow/netfilter:1.41) nginx-mailcow (nginx:mainline-alpine) olefy-mailcow (mailcow/olefy:1.7) php-fpm-mailcow (mailcow/phpfpm:1.74) postfix-mailcow (mailcow/postfix:1.61) redis-mailcow (redis:5-alpine) rspamd-mailcow (mailcow/rspamd:1.76) sogo-mailcow (mailcow/sogo:1.98) solr-mailcow (mailcow/solr:1.7) unbound-mailcow (mailcow/unbound:1.13) watchdog-mailcow (mailcow/watchdog:1.91) -- Sent from: http://dovecot.2317879.n4.nabble.com/

1 0

Shared Mailboxes in Dovecot Cluster & director configuration
by Vincent Brillault 10 Jun '21

10 Jun '21

Hi! I've been trying to set a shared namespace on a test dovecot cluster and I've had some weird issues. I'm not sure if this is a feature or a bug, so please advice. As some features (like acl_ignore_namespace) are only in the upcoming 2.3.15, after some initial debugging, I've update the system I'm using to the master branches (df1b4b8750fdb87d38ac9accb8a1dea02ac3ce2e for core and 7090e62564bcb7bff7efc89bd2a42b1d32d9e475 for pigeonhole), but it didn't change the initial issues I was having. I've been following https://doc.dovecot.org/configuration_manual/shared_mailboxes/cluster_setup/ and linked documentations to set up the cluster. You'll find at the end of the mail the parts of the configuration that seems to be relevant. The issues I've had was with the `You’ll need to setup master user logins to work for all the users.` and `imapc_master_user` (for which the bullet points recommend to use `%{userdb:sharing_user}` but is then set to `%u` in the example. For the sake of the tests, I'm using one director and one backend. On this installation: - user1 shared the folder 'Junk' with user2 - after logging as user2, I run `a2 SELECT shared/user1/Junk` Initially on the director, I had (excluding other, unrelated configuration): ``` # Connection back from backends for shared mailbox access passdb { args = password=XXXX allow_nets=${IPs of backend} driver = static master = yes mechanisms = plain result_success = continue } ``` However, this lead to login failures on the director as the backend was logging directly as user1, without master user set! After further debugging, I now have on the director: ``` # Connection back from backends for shared mailbox access passdb { args = password=XXXX allow_nets=${IPs of backend} driver = static master = yes mechanisms = plain result_success = continue } passdb { args = password=XXXX allow_nets=${IPs of backend} driver = static mechanisms = plain result_success = continue } ``` And this works! Looking at the log, it's not that my `imapc_master_user` is not recognized, just that there are two imapc connections from the backend to the frontend. - The first one logs as user1 directly, with no master user set: ``` ${backend} dovecot[29900]: imap(user2)<29917><Mi/7WD/EgYi8uE1E>: Debug: imapc(${director}:993): Authenticating as user1 ``` - The second connection logs as expected, as user1 with user2 set as the master user: ``` ${backend} dovecot[29900]: imap(user2)<29917><Mi/7WD/EgYi8uE1E>: Debug: imapc(${director}:993): Authenticating as user2 for user user1 ``` Is it normal to have these two connections back to the director? From the documentation, I would have only expected the 2nd one. Going further, if I add a static part to imapc_master_user, like for example `imapc_master_user = X%{userdb:sharing_user}`, the logged authentications become: ``` ${backend} dovecot: imap(user2)<31073><xu94pz/EqYi8uE1E>: Debug: imapc(${director}:993): Authenticating as X for user user1 [...] ${backend} dovecot: imap(user2)<31073><xu94pz/EqYi8uE1E>: Debug: imapc(${director}:993): Authenticating as Xuser2 for user user1 ``` It looks to me that for the first connection, imapc_master_user is resolved with the wrong context, without `userdb:sharing_user` resolving to anything? Thanks in advance, let me know if you need more details. Vincent Brillault PS configuration details (relevant parts of doveconf -n): - Backend: ``` auth_master_user_separator = * imapc_features = fetch-bodystructure fetch-headers rfc822.size search modseq imapc_host = ${director} imapc_master_user = %{userdb:sharing_user} imapc_password = # hidden, use -P to show it imapc_port = 993 imapc_sasl_mechanisms = plain imapc_ssl = imaps imapc_ssl_verify = no mail_plugins = acl zlib virtual fts fts_solr namespace { list = children location = imapc:~/shared/%%u prefix = shared/%%u/ type = shared } namespace Virtual { hidden = yes list = no location = virtual:/etc/dovecot/virtual:INDEX=~/virtual prefix = Virtual/ separator = / subscriptions = no } namespace inbox { inbox = yes location = mailbox "Deleted Items" { auto = subscribe special_use = \Trash } mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox "Sent Items" { auto = subscribe special_use = \Sent } mailbox Spam { auto = create special_use = \Junk } prefix = } passdb { args = password=#hidden_use-P_to_show# allow_nets=${IPs of director} userdb_namespace/shared/disabled=yes driver = static master = yes } passdb { args = password=#hidden_use-P_to_show# allow_nets=${IPs of director} userdb_sharing_user=%u driver = static } plugin { acl = vfile:/etc/dovecot/dovecot-acl acl_ignore_namespace = Virtual/ acl_ignore_namespace2 = shared/* acl_shared_dict = file:/mail/sharing/shared-mailboxes [...] } ``` - Director (final & working version): ``` auth_master_user_separator = * auth_mechanisms = plain login xoauth2 oauthbearer gssapi auth_socket_path = director-userdb passdb { args = /etc/dovecot/passdb-masterusers.conf.ext driver = ldap master = yes mechanisms = plain login result_success = continue } passdb { args = password=#hidden_use-P_to_show# allow_nets=${IPs of backend} driver = static master = yes mechanisms = plain result_success = continue } passdb { args = password=#hidden_use-P_to_show# allow_nets=${IPs of backend} driver = static mechanisms = plain result_success = continue } passdb { args = /etc/dovecot/passdb-oauth2.conf.ext driver = oauth2 mechanisms = xoauth2 oauthbearer result_failure = return-fail result_internalfail = return-fail result_success = continue } passdb { args = /etc/dovecot/passdb-cerndc.conf.ext driver = ldap } ```

2 2

2.3.13 broken submission relay smtp parser
by Tony Hain 09 Jun '21

09 Jun '21

I have a new install of dovecot 2.3.13, along with exim 4.94, in an Azure hosted FreeBSD 12.2 VM. I have been running exim on local hardware with FreeBSD for 15+ years, but dovecot and Azure are a new "learning experience". I am getting an error response in dovecot.log when trying to use the submission relay function, which is apparently new in 2.3... It would appear the parser is either broken or has a character set limitation that no other smtp implementation has. I finally gave up trying to figure out what I might have done wrong in setting up exim and pointed dovecot at mailjet and got the same error. Jun 08 19:39:42 submission(testing(a)dispatch.tndh.net)<89538><lOfAL0zEFNmsOCrh>: Warning: smtp-client: conn in-v3.mailjet.com:587 (104.199.96.85:587) [1]: Received invalid EHLO response line: Unexpected character in EHLO keyword Jun 08 19:39:42 submission(testing(a)dispatch.tndh.net)<89538><lOfAL0zEFNmsOCrh>: Warning: smtp-client: conn in-v3.mailjet.com:587 (104.199.96.85:587) [1]: Received invalid EHLO response line: Unexpected character in EHLO keyword I didn't try the mailjet path with telnet, but I had done that earlier with the local exim server and I can't see any invalid characters, even in the tcpdump pcap file. Jun 08 10:49:42 submission(testing(a)dispatch.tndh.net)<29791><j8NnyETEqV2sOCq3>: Warning: smtp-client: conn 127.0.0.1:58 [1]: Received invalid EHLO response line: Unexpected character in EHLO keyword # telnet localhost 58 Trying 127.0.0.1... Connected to localhost. Escape character is '^]'. 220 secure smtp server ehlo dovecot.tndh.net 250-exim.tndh.net Hello dovecot.tndh.net [127.0.0.1] 250-SIZE 536870912 250-8BITMIME 250-VRFY 250-PIPELINING 250-X_PIPE_CONNECT 250-AUTH CRAM-MD5 250-CHUNKING 250-SMTPUTF8 250 HELP This might be some confusion about starttls on the mailjet path, but if that is true the error message is wrong; and it wouldn't be true for the local exim open smtp port. If it really is smtp, it would be most helpful if the error message actually reported what string it is taking issue with. I have the dovecot-sysreport, but I am not encouraged about sending it when stdout presented: # dovecot-sysreport Gathering configurations ... grep: The -P option is not supportedgrep: The -P option is not supported grep: The -P option is not supported Gathering system informations ... Creating archive ... All done! Please report file dovecot-sysreport-TNDH-mail-1623209001.tar.gz Removing temp files at /tmp/tmp.kphlba44 ... # While dovecot -n stdout presented the line: ssl_key = # hidden, use -P to show it expecting people to put sensitive configuration on a public mail list without knowing what the tool is including is a challenge, but when the tool is errantly using the command line option that is also used for exposing the private data by a related tool, it is even less likely that I want to do that. While the dovecot -n option did hide passwords, it did not hide the username associated with that. I will put dovecot -n (redacted) here, but until I have time to see exactly what the sysreport included, I am not releasing that. # 2.3.13 (89f716dc2): /usr/local/etc/dovecot/dovecot.conf # Pigeonhole version 0.5.13 (cdd19fe3) # OS: FreeBSD 12.2-RELEASE-p4 amd64 ufs # Hostname: TNDH-mail.g4msrgoph2uevil3ys5jvbbpza.jx.internal.cloudapp.net auth_debug = yes auth_debug_passwords = yes auth_verbose = yes debug_log_path = /var/log/dovecot-debug.log disable_plaintext_auth = no first_valid_uid = 220 hostname = dispatch.tndh.net imap_idle_notify_interval = 20 mins info_log_path = /var/log/dovecot-info.log last_valid_uid = 220 log_debug = (event=* AND cat=*) log_path = /var/log/dovecot.log login_greeting = tndh.net Mailer Server Ready ... login_trusted_networks = 127.0.0.1 10.0.0.4 mail_debug = yes mail_location = maildir:/usr/local/var/dovecot/vhosts/%d/%n mail_plugins = mail_log notify notify_status managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext namespace inbox { inbox = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk { auto = subscribe special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox Trash { auto = subscribe special_use = \Trash } mailbox virtual/Flagged { auto = subscribe special_use = \Flagged } prefix = separator = / type = private } passdb { args = username_format=%n /usr/local/var/dovecot/db/%d/passwd driver = passwd-file } plugin { expire = Trash mail_home = /usr/local/var/dovecot/vhosts/%d/%n mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename mail_log_fields = uid box msgid size recipient_delimiter = + sieve = /usr/local/var/dovecot/vhosts/%d/%n/sieve/.dovecot.sieve sieve_after = /usr/local/var/dovecot/vhosts/%d/%n/sieve/sieve-after.d sieve_before = /usr/local/var/dovecot/vhosts/%d/%n/sieve/sieve-before.d sieve_dir = /usr/local/var/dovecot/vhosts/%d/%n/sieve sieve_global_path = /usr/local/var/dovecot/vhosts/sieve/default.sieve } pop3_client_workarounds = outlook-no-nuls oe-ns-eoh protocols = imap pop3 lmtp submission service auth-worker { user = vmail } service imap-login { inet_listener imap { port = 143 } inet_listener imaps { port = 993 ssl = yes } } service stats { unix_listener stats-writer { mode = 0666 } } service submission-login { inet_listener submission { port = 465 ssl = yes } } ssl_cert = </usr/local/etc/dovecot/ssl/certs/dovecot.pem ssl_key = # hidden, use -P to show it submission_relay_host = in-v3.mailjet.com submission_relay_password = # hidden, use -P to show it submission_relay_port = 587 submission_relay_rawlog_dir = /var/log submission_relay_ssl = starttls submission_relay_user = **-as-if-I-want-this-on-a-public-list-** userdb { args = username_format=%n /usr/local/var/dovecot/db/%d/passwd driver = passwd-file } verbose_ssl = yes protocol lmtp { mail_fsync = optimized mail_plugins = mail_log notify notify_status sieve } protocol imap { mail_max_userip_connections = 10 mail_plugins = mail_log notify notify_status imap_sieve } protocol pop3 { mail_max_userip_connections = 10 mail_plugins = mail_log notify notify_status } protocol lda { mail_fsync = optimized mail_plugins = mail_log notify notify_status sieve }

3 5