- dovecot - dovecot.org

AW: TLS Security
by Stefan Schumacher 15 Jul '21

15 Jul '21

Hi Justina, Kali tools is of course extremly unprecise. Excuse me, I had a long stressful day and wanted to get this out before the end of the Day. Kali is a rolling release and I keep it up to date by upgrading every few days. I also update the feeds. What I actually use for security scans is the former OpenVAS, which now has been relegated to being a part of the Community Edition of the Greenbone suite. You have seen the values I have in Dovecot. What follows now are my settings in the postfix main.cf. As you can clearly see it, it should prevent connections from TLS below 1.2. Dovecot is of course not very fresh because it's Debian 10 and Debian 11 is just around the corner (a few days). These are the settings of my postfix main.cf. I am very tempted to grab an Image of Debian 11 and install ISPConfig and my Dovecot and Postfix settings there. I am of course open to any other suggestions. A the moment I consider to install a new Bullseye RC2 and then put my configuration on it. I am of course open for any other suggestions. Yours sincerely Stefan smtpd_use_tls = yes smtpd_tls_cert_file = /etc/postfix/smtpd.cert smtpd_tls_key_file = /etc/postfix/smtpd.key smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache smtpd_tls_eecdh_grade = strong smtpd_tls_protocols= !SSLv2, !SSLv3, !TLSv1, !TLSv1.1 smtpd_tls_mandatory_protocols= !SSLv2, !SSLv3, !TLSv1, !TLSv1.1 smtpd_tls_mandatory_ciphers = high smtpd_tls_security_level=may smtpd_tls_ciphers = high tls_preempt_cipherlist = yes smtpd_tls_mandatory_exclude_ciphers = aNULL, MD5 , DES, ADH, RC4, PSD, SRP, 3DES, eNULL smtpd_tls_exclude_ciphers = aNULL, MD5 , DES, ADH, RC4, PSD, SRP, 3DES, eNULL smtp_tls_mandatory_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1 smtp_tls_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1 ________________________________ Von: justina colmena ~biz <justina(a)colmena.biz> Gesendet: Mittwoch, 14. Juli 2021 18:50 An: dovecot(a)dovecot.org <dovecot(a)dovecot.org>; Stefan Schumacher <s.schumacher(a)consulting1x1.com> Betreff: Re: TLS Security Interesting. Assuming your "Kali" tools are in fact up to date to test with newer protocols TLS1.2+, is Dovecot compiled against a recent version of the OpenSSL or GnuTLS library or whatever it uses to support the newer TLS protocols? Definitely an outdated cipher issue, on Postfix as well as Dovecot.... On July 14, 2021 6:55:19 AM AKDT, Stefan Schumacher <s.schumacher(a)consulting1x1.com> wrote: Hi, I wish to build a new secure email server. It seems I am on the right way – at least I get no more error messages for Postfix – but Dovecot is still making trouble. I am using Dovecot 1:2.3.4.1-5+deb10u6 and I am using ISPconfig 3.25 to do the rough configuring and nano and whats left of my brain to do the finer details. Lets start with what I added to conf.d/10-ssl.conf ssl_cert = </etc/letsencrypt/live/servername/fullchain.pem ssl_key = </etc/letsencrypt/live/servername/privkey.pem ssl_cipher_list = EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aR$ ssl_protocols = !SSLv2 !SSLv3 !TLSv1 !TLSv1.1 ssl_min_protocol = TLSv1.2 As you can see, I clearly do not want to use TLS before v1.2. I think this is not unreasonable in the year 2021. Now, after the changes I ran Kali (I use it to verify the results of my experiments) and - this is a mailing list, so no screenshots: It says: SSL/TLS Deprecated TLS v1.0 and TLS v1.1 Detection. I get this for the ports 143, 110, 993 and 995. I thought I had done everything one could to disable old TLS-Versions. What am I doing wrong? Yours sincerely Stefan Schumacher -- Sent from my Android device with K-9 Mail. Please excuse my brevity.

1 0

Verifying replication
by Arnold Hendriks 15 Jul '21

15 Jul '21

Dear Dovecot people, I've set up Dovecot replication a couple of years ago. I'm watching the general server health and having Nagios check doveadm replicator status regularly. I'm seeing accounts replicating, disk space usage obviously shows that things work in principle, however, I still wonder whether the replication actually works properly. Accounts I check work, but 1-5% of the messages could easily be missing without me noticing it. These servers have I think about 50K accounts (a lot of them dormant) and between 1 to 2TB of mail. I'm trying to get some more confidence as to whether replication is actually working properly and whether I'm not missing anything that will burn me if I ever have to 'fallback'. Has anyone ever done some verification outside of simply watching doveadm replication stats, to see if they are missing anything ? Eg, I could imagine a process that generates a list of accounts, and then generates hashes on both sides of the replication for each mailbox folder. If the hashes match, the folder gets removed from the list, and once all folders are removed, the account gets removed. Iterating the account list should finally reduce it to 0, or a few extremely high traffic accounts which can be checked manually or be ignored. But I'm trying to avoid reinventing the wheel. Has anyone done anything like this, or can suggest a different approach? With regards, Arnold Hendriks

1 1

Forcing replication - difference is a 0x0D 0x0D 0xA sequence?
by Arnold Hendriks 15 Jul '21

15 Jul '21

I've found a few mailboxes on my system that were being replicated where the mailboxes are not in sync. On server 1 I see: dovecot1:/# doveadm fetch -u s0000000 "size.physical size.virtual" mailbox-guid c92f64f79f0d1ed01e6d5b314f04886c uid 115 size.physical: 1815 size.virtual: 1843 On server 2 I see: dovecot2:/# doveadm fetch -u s0000000 "size.physical size.virtual" mailbox-guid c92f64f79f0d1ed01e6d5b314f04886c uid 115 size.physical: 1805 size.virtual: 1833 Running ' doveadm replicator replicate -f s0000000 "*" ' does not fix the issue. I've compared the mails and the difference appears to be that the primary server (where the mail comes in) has a few occurences of "0D 0D 0A" (hex) which on the replicated server looks like "0D 0A". (ie, \r\r\n was replicated as \r\n ?) Is there a way to force these two messages to be in sync again ? Is the \r\r\n being replicated as \r\n a known issue ? (I'm not sure if I could replicate this, this message dates back to 2007 so probably wasn't even received originally on this server. Replication was configured much later than 2007)

1 0

folders management
by Stephane Magnier 15 Jul '21

15 Jul '21

Hi, Sorry to ask you , maybe a silly question :-) On my folders' architecture, I can see all the folders underneeth each other fodler1 folder2 etc.... I would like to have the possibility to have _folders INTO folders_, like Folder1 Folder2 .......folder 21 ......folder 22 Folders 3 Apparently, this is link to this déclaration :__*_mbox_:/var/spool2/mail/%u. *Is that correct ? is that the "mbox" declaration? or Am I complety wrong ? If I have need to change...I have to change it for what ? * Can I use this new structure with NFS shares ? * What is the backside of it ? Now, if I make this modification.. on an existing dovecot system... , Will it make a true disaster ? or I can change the declaration easily? Thanks and regards,

2 1

Restrict number of mail moved/copied
by Amol Kulkarni 14 Jul '21

14 Jul '21

Hello, I need to restrict number of mail moved/copied by end user using imap in operation. Is there any configuration for that ? Thanks and regards, Amol

1 0

dsync I/O Stalled
by Paolo Daniele 14 Jul '21

14 Jul '21

Hi guys, i've a strange problem between 2 servers. It happened after a changing on our network core routing infrastructure. We've moved to Juniper network and eBGP and iBGP of our server. One of this server is behind a firewall and communicate with another server in another country to sync our emails. Doveadmin replica seems to be fine, but sometimes i get this error message: dsync-server(aaaaa(a)bbb.bb): Error: Timeout during state=sync_mails (send=done recv=mails) It seems like the remote server has troubles to reach our local server but if i do a stupid ping i'm not losing anything. Maybe is there something am i missing? I thought that it could be related to a MTU problem but i'm not so sure and i've increased MTU on the routers involved in routing process without success. I wa missing that both servers are behind a load balancer wich is in our local DC. Can you give me some hints? Regards, Paolo -- Paolo Daniele Intendo s.r.l. E-mail: paolo.daniele(a)intendo.it Business Unit TLCWEB Tel.: +39 0968 430786 Via Coschi, 11 Skype: paolo_daniele1 88046 - Lamezia Terme, Cz Web: http://www.tlcweb.it Italia Web: http://www.intendo.it

2 2

Potential bug: Assumption that POSIX time functions do not clobber errno
by Florian Weimer 13 Jul '21

13 Jul '21

We accidentally ran the dovecot 2.3.14 testsuite on a host where clock_gettime (and probably time and gettimeofday) succeed, but set errno to ENOSYS. This behavior is unusual, but permitted by POSIX: successful function calls can overwrite errno, as long as they don't set it to 0. The relevant log excerpt looks like this: make[3]: Entering directory '/builddir/build/BUILD/dovecot-2.3.14/src/master' for bin in test-auth-client test-auth-master test-master-login-auth; do \ if ! ./$bin; then exit 1; fi; \ done test-common.c:200: Assert failed: suppress == TRUE connection refused: run (ret == -1) .................................. : ok: Connection failed CLIENT: Error: auth-client: conn unix:./auth-client-test: connect(./auth-client-test) failed: Function not implemented connection refused ................................................... : FAILED connection timed out: run (ret == -1) ................................ : ok: Connection failed connection timed out: timeout ........................................ : ok connection timed out ................................................. : ok bad version: run (ret == -1) ......................................... : ok: Connection failed bad version .......................................................... : ok disconnect version: run (ret == -1) .................................. : ok: Internal failure disconnect version ................................................... : ok auth PLAIN disconnect: run (ret < 0) ................................. : ok auth PLAIN disconnect ................................................ : ok auth PLAIN reconnect: run (ret < 0) .................................. : ok auth PLAIN reconnect ................................................. : ok auth PLAIN failure: run (ret < 0) .................................... : ok auth PLAIN failure ................................................... : ok auth PLAIN success: run (ret == 0) ................................... : ok auth PLAIN success ................................................... : ok auth LOGIN failure 1: run (ret < 0) .................................. : ok auth LOGIN failure 1 ................................................. : ok auth LOGIN failure 2: run (ret < 0) .................................. : ok auth LOGIN failure 2 ................................................. : ok auth LOGIN success: run (ret == 0) ................................... : ok auth LOGIN success ................................................... : ok auth PLAIN parallel failure: run (ret < 0) ........................... : ok auth PLAIN parallel failure .......................................... : ok auth PLAIN parallel success: run (ret == 0) .......................... : ok auth PLAIN parallel success .......................................... : ok auth LOGIN parallel failure 1: run (ret < 0) ......................... : ok auth LOGIN parallel failure 1 ........................................ : ok auth LOGIN parallel failure 2: run (ret < 0) ......................... : ok auth LOGIN parallel failure 2 ........................................ : ok auth LOGIN parallel success: run (ret == 0) .......................... : ok auth LOGIN parallel success .......................................... : ok 1 / 49 tests failed make[3]: Leaving directory '/builddir/build/BUILD/dovecot-2.3.14/src/master' “Function not implemented” suggests that dovecot somehow used the clock_gettime (or gettimeofday) ENOSYS error instead of the expected ECONNREFUSED error code. Unfortunately, I have not figured out where this exactly happens. I don't expect that the problematic glibc build escapes to the wild It was a glibc 2.34 development snapshot, and this particular source of ENOSYS errors is gone again. So fixing this is not urgent. Thanks, Florian

1 0

move mails between mailboxes
by Tom Doenen 13 Jul '21

13 Jul '21

Hello, i am using dovecot 2.3.4.1 I am tyring to make a script using the doveadm move command to move old emails into a subfolder of the users INBOX ; say all mails from 2016 into INBOX/2016. Selecting and moving is not the issue; everything works just i am amazed that the (test) mail client Thunderbird downloads all mails in INBOX/2016 after the move. When i make an IMAP move of all 2016-mails in Thunderbird; mails are moved between the mailboxes without any mails being (re-)downloaded. So what am i missing here? Thank for the tip :) Kind regards, Tom the doveadm move debug output is : Debug: Loading modules from directory: /usr/lib/dovecot/modules Debug: Module loaded: /usr/lib/dovecot/modules/lib10_quota_plugin.so Debug: Module loaded: /usr/lib/dovecot/modules/lib20_listescape_plugin.so Debug: Module loaded: /usr/lib/dovecot/modules/lib20_zlib_plugin.so Debug: Loading modules from directory: /usr/lib/dovecot/modules/doveadm Debug: Skipping module doveadm_acl_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/lib10_doveadm_acl_plugin.so: undefined symbol: acl_user_module (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_expire_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/lib10_doveadm_expire_plugin.so: undefined symbol: expire_set_deinit (this is usually intentional, so just ignore this message) Debug: Module loaded: /usr/lib/dovecot/modules/doveadm/lib10_doveadm_quota_plugin.so Debug: Module loaded: /usr/lib/dovecot/modules/doveadm/lib10_doveadm_sieve_plugin.so Debug: Skipping module doveadm_fts_lucene_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/lib20_doveadm_fts_lucene_plugin.so: undefined symbol: lucene_index_iter_deinit (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_fts_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/lib20_doveadm_fts_plugin.so: undefined symbol: fts_user_get_language_list (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_mail_crypt_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/libdoveadm_mail_crypt_plugin.so: undefined symbol: mail_crypt_box_get_pvt_digests (this is usually intentional, so just ignore this message) doveadm(tom(a)somedomain.org)<17541><>: Debug: auth USER input: tom(a)somedomain.org uid=5000 gid=5000 home=/mailstore/somedomain.org/to/tom/ doveadm(tom(a)somedomain.org): Debug: Effective uid=5000, gid=5000, home=/mailstore/somedomain.org/to/tom/ doveadm(tom(a)somedomain.org): Debug: Quota root: name=User quota backend=maildir args= doveadm(tom(a)somedomain.org): Debug: Quota rule: root=User quota mailbox=* bytes=8589934592 messages=0 doveadm(tom(a)somedomain.org): Debug: Quota rule: root=User quota mailbox=Trash bytes=+104857600 messages=0 doveadm(tom(a)somedomain.org): Debug: Quota warning: bytes=8589934592 (100%) messages=0 reverse=no command=quota-warning 100 tom(a)somedomain.org doveadm(tom(a)somedomain.org): Debug: Quota warning: bytes=8504035246 (99%) messages=0 reverse=no command=quota-warning 99 tom(a)somedomain.org doveadm(tom(a)somedomain.org): Debug: Quota warning: bytes=8418135900 (98%) messages=0 reverse=no command=quota-warning 98 tom(a)somedomain.org doveadm(tom(a)somedomain.org): Debug: Quota warning: bytes=8246337208 (96%) messages=0 reverse=no command=quota-warning 96 tom(a)somedomain.org doveadm(tom(a)somedomain.org): Debug: Quota warning: bytes=8074538516 (94%) messages=0 reverse=no command=quota-warning 94 tom(a)somedomain.org doveadm(tom(a)somedomain.org): Debug: Quota warning: bytes=7902739824 (92%) messages=0 reverse=no command=quota-warning 92 tom(a)somedomain.org doveadm(tom(a)somedomain.org): Debug: Quota warning: bytes=7730941132 (90%) messages=0 reverse=no command=quota-warning 90 tom(a)somedomain.org doveadm(tom(a)somedomain.org): Debug: Quota warning: bytes=7301444403 (85%) messages=0 reverse=no command=quota-warning 85 tom(a)somedomain.org doveadm(tom(a)somedomain.org): Debug: Quota warning: bytes=6871947673 (80%) messages=0 reverse=no command=quota-warning 80 tom(a)somedomain.org doveadm(tom(a)somedomain.org): Debug: Quota warning: bytes=6012954214 (70%) messages=0 reverse=no command=quota-warning 70 tom(a)somedomain.org doveadm(tom(a)somedomain.org): Debug: Quota warning: bytes=8589934592 (100%) messages=0 reverse=yes command=quota-warning 0 tom(a)somedomain.org doveadm(tom(a)somedomain.org): Debug: Quota grace: root=User quota bytes=47185920 doveadm(tom(a)somedomain.org): Debug: Namespace inbox: type=private, prefix=, sep=/, inbox=yes, hidden=no, list=yes, subscriptions=yes location=maildir:/mailstore/somedomain.org/to/tom:INDEX=/indexes/somedomain… doveadm(tom(a)somedomain.org): Debug: maildir++: root=/mailstore/somedomain.org/to/tom, index=/indexes/somedomain.org/to/tom, indexpvt=, control=, inbox=/mailstore/somedomain.org/to/tom/.INBOX, alt= doveadm(tom(a)somedomain.org): Debug: quota: quota_over_flag check: quota_over_script unset - skipping doveadm(tom(a)somedomain.org): Debug: Mailbox INBOX/2016: Mailbox opened because: move doveadm(tom(a)somedomain.org): Debug: Mailbox INBOX: Mailbox opened because: move doveadm(tom(a)somedomain.org): Debug: Mailbox INBOX/2016: saving UID 0: Opened mail because: mail stream doveadm(tom(a)somedomain.org): Debug: Mailbox INBOX: UID 52642: Opened mail because: mail stream doveadm(tom(a)somedomain.org): Debug: Mailbox INBOX/2016: saving UID 0: Opened mail because: mail stream doveadm(tom(a)somedomain.org): Debug: Mailbox INBOX: UID 52643: Opened mail because: mail stream doveadm(tom(a)somedomain.org): Debug: Mailbox INBOX/2016: saving UID 0: Opened mail because: mail stream doveadm(tom(a)somedomain.org): Debug: Mailbox INBOX: UID 52644: Opened mail because: mail stream doveadm(tom(a)somedomain.org): Debug: Mailbox INBOX/2016: saving UID 0: Opened mail because: mail stream doveadm(tom(a)somedomain.org): Debug: Mailbox INBOX: UID 52645: Opened mail because: mail stream doveadm(tom(a)somedomain.org): Debug: Mailbox INBOX/2016: saving UID 0: Opened mail because: mail stream doveadm(tom(a)somedomain.org): Debug: Mailbox INBOX: UID 52646: Opened mail because: mail stream doveadm(tom(a)somedomain.org): Debug: Mailbox INBOX/2016: saving UID 0: Opened mail because: mail stream doveadm(tom(a)somedomain.org): Debug: Mailbox INBOX: UID 52963: Opened mail because: mail stream doveadm(tom(a)somedomain.org): Debug: Mailbox INBOX/2016: saving UID 0: Opened mail because: mail stream doveadm(tom(a)somedomain.org): Debug: Mailbox INBOX: UID 52964: Opened mail because: mail stream doveadm(tom(a)somedomain.org): Debug: Mailbox INBOX/2016: saving UID 0: Opened mail because: mail stream doveadm(tom(a)somedomain.org): Debug: Mailbox INBOX: UID 52965: Opened mail because: mail stream doveadm(tom(a)somedomain.org): Debug: Mailbox INBOX/2016: saving UID 0: Opened mail because: mail stream doveadm(tom(a)somedomain.org): Debug: Mailbox INBOX: UID 52967: Opened mail because: mail stream doveadm(tom(a)somedomain.org): Debug: Mailbox INBOX/2016: saving UID 0: Opened mail because: mail stream doveadm(tom(a)somedomain.org): Debug: Mailbox INBOX: UID 52968: Opened mail because: mail stream doveadm(tom(a)somedomain.org): Debug: Mailbox INBOX/2016: saving UID 0: Opened mail because: mail stream doveadm(tom(a)somedomain.org): Debug: Mailbox INBOX: UID 52969: Opened mail because: mail stream doveadm(tom(a)somedomain.org): Debug: Mailbox INBOX/2016: saving UID 0: Opened mail because: mail stream doveadm(tom(a)somedomain.org): Debug: Mailbox INBOX: UID 52970: Opened mail because: mail stream doveadm(tom(a)somedomain.org): Debug: Mailbox INBOX/2016: saving UID 0: Opened mail because: mail stream doveadm(tom(a)somedomain.org): Debug: Mailbox INBOX: UID 52972: Opened mail because: mail stream etc etc... obscured config : # 2.3.4.1 (f79e8e7e4): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.4 () # OS: Linux 4.19.194-rt81 x86_64 Debian 10.0 ext4 # Hostname: hardy.somedomain.org auth_cache_negative_ttl = 7 mins auth_cache_size = 20 M auth_cache_ttl = 12 mins auth_cache_verify_password_with_worker = yes auth_failure_delay = 9 secs auth_mechanisms = plain login auth_username_chars = auth_worker_max_count = 90 default_client_limit = 2500 default_process_limit = 500 default_vsz_limit = 4 G hostname = post.somedomain.org imap_capability = +SPECIAL_USE imap_fetch_failure = no-after imap_hibernate_timeout = 15 secs imap_idle_notify_interval = 4 mins imap_max_line_length = 512 k lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes lda_original_recipient_header = X-Original-To listen = * lmtp_rcpt_check_quota = yes login_log_format_elements = user=<%u> method=%m rip=%r lip=%l mpid=%e %c %k mail_cache_min_mail_count = 15 mail_fsync = never mail_location = maildir:/mailstore/%d/%2n/%n:INDEX=/indexes/%d/%2n/%n:INBOX=/mailstore/%d/%2n/%n/.INBOX:VOLATILEDIR=/tmp/dovecot:NO-NOSELECT:UTF-8 mail_max_keyword_length = 100 mail_plugins = quota zlib listescape mail_prefetch_count = 20 mail_privileged_group = mail mail_temp_scan_interval = 0 mailbox_idle_check_interval = 55 secs mailbox_list_index_include_inbox = yes mailbox_list_index_very_dirty_syncs = yes maildir_broken_filename_sizes = yes maildir_very_dirty_syncs = yes namespace inbox { inbox = yes location = mailbox Concepts { auto = no special_use = \Drafts } mailbox "Deleted Messages" { auto = no special_use = \Trash } mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk { auto = no special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Messages" { auto = no special_use = \Sent } mailbox Trash { auto = subscribe special_use = \Trash } prefix = separator = / type = private } passdb { args = /etc/dovecot/passwd--%d driver = passwd-file } plugin { listescape_char = } quota = maildir:User quota quota_grace = 45M quota_rule = *:storage=8G quota_rule2 = Trash:storage=+100M quota_status_overquota = 552 5.2.2 User mailbox is full.. quota_status_succes = DUNNO quota_warning = storage=100%% quota-warning 100 %u quota_warning10 = storage=70%% quota-warning 70 %u quota_warning11 = -storage=100%% quota-warning 0 %u quota_warning2 = storage=99%% quota-warning 99 %u quota_warning3 = storage=98%% quota-warning 98 %u quota_warning4 = storage=96%% quota-warning 96 %u quota_warning5 = storage=94%% quota-warning 94 %u quota_warning6 = storage=92%% quota-warning 92 %u quota_warning7 = storage=90%% quota-warning 90 %u quota_warning8 = storage=85%% quota-warning 85 %u quota_warning9 = storage=80%% quota-warning 80 %u sieve = ~/dovecot.sieve sieve_extensions = +notify +imapflags +envelope +vacation +fileinto +date +relational +vacation-seconds sieve_user_log = /dev/null sieve_vacation_min_period = 1h sieve_vacation_send_from_recipient = yes virtual_overquota_bounce = yes zlib_save = gz zlib_save_level = 3 } pop3_fast_size_lookups = yes protocols = imap lmtp pop3 service auth-worker { user = $default_internal_user } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } } service imap-hibernate { unix_listener imap-hibernate { group = $default_internal_group mode = 0660 } } service imap-login { inet_listener imap { port = 0 } inet_listener imaps { address = 100.100.100.104 port = 993 ssl = yes } process_min_avail = 20 service_count = 0 } service imap { extra_groups = $default_internal_group process_limit = 5000 unix_listener imap-master { user = $default_internal_user } } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } service pop3-login { inet_listener pop3 { port = 0 } inet_listener pop3s { address = 100.100.100.99 port = 995 ssl = yes } process_min_avail = 10 service_count = 0 } service pop3 { process_limit = 1000 } service quota-warning { executable = script /etc/dovecot/quota-warning.sh unix_listener quota-warning { user = vmail } user = vmail } service submission-login { inet_listener submission { address = 127.0.0.1 port = 587 ssl = yes } process_min_avail = 5 service_count = 1 } service submission { process_limit = 150 } ssl = required ssl_cert = </etc/ssl/private/somedomain.org.crta ssl_cipher_list = ALL:!SSLv2:!SSLv3:!DH:!kRSA:!SRP:!kDHd:!DSS:!aNULL:!eNULL:!EXPORT:!DES:!3DES:!MD5:!PSK:!RC4:!ADH:!LOW@STRENGTH:!EXP:!SEED:!IDEA:!RSA:!CAMELLIA:!SHA1:!SHA256:!SHA384 ssl_client_ca_dir = /etc/ssl/certs ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it ssl_min_protocol = TLSv1.2 ssl_prefer_server_ciphers = yes submission_host = 127.0.0.1 syslog_facility = local2 userdb { args = /etc/dovecot/passwd--%d driver = passwd-file result_failure = return-fail result_internalfail = return-fail } valid_chroot_dirs = /var/spool/vmail verbose_proctitle = yes protocol lmtp { mail_fsync = optimized mail_plugins = quota zlib listescape quota sieve zlib postmaster_address = postmaster(a)somedomain.org } protocol lda { mail_fsync = optimized } protocol imap { mail_max_userip_connections = 25 mail_plugins = quota zlib listescape imap_quota zlib } protocol pop3 { mail_max_userip_connections = 6 }

2 1

doveadm backup Error: Mailbox INBOX sync
by Pierre Sablé 13 Jul '21

13 Jul '21

Hi, the command "doveadm backup -u {user@mail} maildir:/home/backup/{user@mail}/mails/" returns the following error : dsync(user@mail): Error: Mailbox INBOX sync: mailbox_delete failed: INBOX can't be deleted. ...and nothing in dovecot logs dovecot actual version 2.3.15 I did not have this pb in dovecot 2.3.2 /Should this be considered a bug report?/ -- Pierre Sablé Formateur & Administrateur Systèmes Linux - DevOps Tel : 07.63.88.76.21 psable(a)dawan.fr www.dawan.fr

1 0

[ENHANCEMENT] Doveadm HTTP API and the mail-crypt plugin
by Kevin N. 13 Jul '21

13 Jul '21

Hello everybody, I was wondering, are there any plans for the near future to include the mail-crypt plugin related functions, like changing the user key password, into the doveadm http api? It would probably be possible to implement it in a more secure way than any other external ad-hoc solution. Wouldn't it? Cheers, K.

2 2

getting rid of the passwd file unknown user messages
by Marc 12 Jul '21

12 Jul '21

I have configured a userdb file, so I can test with some accounts and override settings. But it is a bit annoying getting unkown user messages for the majority of accounts not in this userdb. Is there a way to skip this reporting? dovecot: auth: passwd-file(aaaaaaaaaaaa,X.X.X.X,<lGapvOzGS5tNPz8/>): unknown user

2 3

Mailbox lost
by Stephane Magnier 12 Jul '21

12 Jul '21

Hi, Any idea why * * *list "" * *-> displays all I want to see but *lsub "" ** -> doesn't display anything ? and AFAIK, this is what I need to get in order any Email clients see my folders ? - Correct ? how can I make visible, by "lsub" all my folders ? Thanks and regards,

4 4

doveadm altmove -r still broken in 2.3.15
by María Arrea 12 Jul '21

12 Jul '21

2 1

High Availability Dovecot / Roundcube / PostfixAdmin ?
by White, Daniel E. (GSFC-770.0)[NICS] 12 Jul '21

12 Jul '21

This is a new setup, running on RHEL 8 with the latest everything. Has anyone out there set up a high availability pair of Dovecot servers - with Roundcube and PostfixAdmin - successfully ? "Callahan's Law: Shared pain is lessened; shared joy, increased — thus do we refute entropy" (Spider Robinson)

4 3

Sieve vacation + SRS + forwarded e-mail
by Saarts, Erik 10 Jul '21

10 Jul '21

Hello! Having a problem here and am unable to solve it on my own and even dr Google is unable to help. We have domain A on cloud, from where mail gets forwarded to our local server to domain B. Forwarding is done in SPF-compliant way by using SRS (this part we have no control over). This SRS address ends up in Return-Path header, and sieve vacation replies to this address. This is all absolutely correct, but also useless, as sending mail to SRS address leads nowhere. I've tried to edit headers in sieve before passing control to vacation, but that does not work. I tried modifying Return-Path to the value of X-Original-Sender (both in user's sieve file and using scripts in "sieve_before" parameter). Mail gets delivered with changed headers, but vacation acts upon original headers. Is there a workaround? MTA is postfix (3.1.15), dovecot is version 2.3.4.1 (f79e8e7e4), Pigeonhole version 0.5.4 LMTP as local delivery agent. Erik

2 1

Nabble
by Plutocrat 10 Jul '21

10 Jul '21

Not sure if this is an issue, but Nabble seems to have stopped archiving this newsgroup around 22 Jun. http://dovecot.2317879.n4.nabble.com/ Thought I should probably tell someone P.

1 0

Dovecot silently discards duplicates?
by dovecot＠ptld.com 09 Jul '21

09 Jul '21

I setup an alias(a)example.com in postfix to point at me(a)example.com I send one email to me(a)example.com and alias(a)example.com, tried both ways of using CC and putting both addresses in the To field. I see in postfix logs that it delivers two messages to dovecot-lmtp. However i only get one copy of the email in my inbox. I assume dovecot is detecting duplicate emails going to the same location and just discarding one of them. Is there a setting to control this behavior? Can dovecot be told to deliver what it was given and not decide to discard?

1 0

dsync replication fails with No space left on device / Out of memory
by Steven Varco 08 Jul '21

08 Jul '21

Hi All Since I configured dsync replication I get strange errors in the maillog on my two mail dovecot nodes: PRIMARY: Jul 2 01:21:42 mx01.example.com dovecot: doveadm: Error: read(mx02.example.com) failed: read(size=3148) failed: Connection reset by peer (last sent=mail, last recv=mail (EOL)) The secondary is more interesting: SECONDARY Jul 2 01:21:42 mx02 dovecot: doveadm: Error: close(-1[istream-seekable.c:237]) failed: No space left on device Jul 2 01:21:43 mx02 dovecot: doveadm: Fatal: pool_system_realloc(268435456): Out of memory Jul 2 01:21:43 mx02 dovecot: doveadm: Error: Raw backtrace: /usr/lib64/dovecot/libdovecot.so.0(+0xa192e) [0x7f2e9be4c92e] -> /usr/lib64/dovecot/libdovecot.so.0(+0xa1a0e) [0x7f2e9be4ca0e] -> /usr/lib64/dovecot/libdovecot.so.0(i_error+0) [0x7f2e9bddc3d3] -> /usr/lib64/dovecot/libdo Jul 2 01:21:43 mx02 dovecot: doveadm: Fatal: master: service(doveadm): child 2876 returned error 83 (Out of memory (service doveadm { vsz_limit=256 MB }, you may need to increase it) - set CORE_OUTOFMEM=1 environment to get core dump) Jul 2 01:21:51 mx02 dovecot: dsync-local(user(a)example.com): Error: Raw backtrace: /usr/lib64/dovecot/libdovecot.so.0(+0xa192e) [0x7fd56e17e92e] -> /usr/lib64/dovecot/libdovecot.so.0(+0xa1a0e) [0x7fd56e17ea0e] -> /usr/lib64/dovecot/libdovecot.so.0(i_error+0) [0x7fd56e10e3d3] -> /us Jul 2 01:21:51 mx02 dovecot: dsync-local(user(a)example.com): Fatal: master: service(doveadm): child 2882 returned error 83 (Out of memory (service doveadm { vsz_limit=256 MB }, you may need to increase it) - set CORE_OUTOFMEM=1 environment to get core dump) The error messages state that disk space and/or memory is a problem, but disk space and memory is enough available: mx02 [~] # df -h /srv/mail/ Filesystem Size Used Avail Use% Mounted on /dev/mapper/system-mail 10G 5.7G 4.3G 58% /srv/mail mx02 [~] # free -m total used free shared buff/cache available Mem: 3789 1602 1088 199 1097 1759 Swap: 471 93 378 I also tried to increase vsz_limit from 256 MB to 512 MB, which did not help. And for the sake of completness also the connection to the doveadm port works well from both nodes: mx01-prod [~] # telnet mx02 14310 Trying 172.20.19.225... Connected to mx02. Escape character is '^]'. ^] mx02 [~] # telnet mx01 14310 Trying 172.20.19.251... Connected to mx01. Escape character is '^]'. ^] Although mail replication seems to be working properly and mails are in sync on both nodes (as what I could see), I would like to find the cause of this messages, as this does definetely don’t look normal… I’m grateful for any help, since I’m quite on a struggle now… Steven Here’s my config -------------------------------------------------------------------------------- # doveconf -n # 2.2.36 (1f10bfa63): /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.24 (124e06aa) # OS: Linux 3.10.0-1160.31.1.el7.x86_64 x86_64 CentOS Linux release 7.9.2009 (Core) # Hostname: mx01.example.com auth_mechanisms = plain login auth_verbose = yes dict { sqlquota = mysql:/etc/dovecot/dict-sqlquota.conf.ext } doveadm_password = # hidden, use -P to show it doveadm_port = 14310 first_valid_uid = 1000 mail_plugins = quota notify replication managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext mbox_write_locks = fcntl namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = separator = / type = private } passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } plugin { mail_replica = tcp:mx02.example.com quota = maildir:User quota quota_exceeded_message = Quota exceeded, please go to http://www.example.com/over_quota_help for instructions on how to fix this. quota_rule2 = INBOX.Trash:storage=+100M quota_status_nouser = DUNNO quota_status_overquota = 552 5.2.2 Mailbox is full / Mailbox ist voll quota_status_success = DUNNO quota_warning = storage=90%% quota-warning 90 %u quota_warning2 = -storage=90%% quota-warning below %u sieve = file:~/sieve;active=~/.dovecot.sieve } postmaster_address = postmaster(a)example.com protocols = imap pop3 lmtp sieve replication_dsync_parameters = -d -l 30 -U service aggregator { fifo_listener replication-notify-fifo { user = vmail } unix_listener replication-notify { user = vmail } } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } unix_listener auth-userdb { user = vmail } } service dict { unix_listener dict { user = vmail } } service doveadm { inet_listener { port = 14310 ssl = no } } service managesieve-login { inet_listener sieve { port = 4190 } } service quota-status { client_limit = 1 executable = quota-status -p postfix inet_listener { port = 14340 } } service quota-warning { executable = script /usr/local/libexec/dovecot/quota-warning.sh unix_listener quota-warning { user = vmail } user = vmail } service replicator { process_min_avail = 1 unix_listener replicator-doveadm { mode = 0600 user = vmail } } ssl = required ssl_cert = </etc/ssl/acme/certs/mail.example.com.chain.crt ssl_key = # hidden, use -P to show it userdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } verbose_proctitle = yes protocol lmtp { mail_plugins = quota notify replication sieve } protocol lda { mail_plugins = quota notify replication sieve } protocol imap { mail_max_userip_connections = 20 mail_plugins = quota notify replication imap_quota } -------------------------------------------------------------------------------- mx02.example.com has exact the same config, except of: -------------------------------------------------------------------------------- plugin { mail_replica = tcp:mx01.example.com -------------------------------------------------------------------------------- — https://steven.varco.ch/ https://www.tech-island.com/

5 6

Deleting an active sieve script leaves sieve unfunctional
by Tobias Leupold 07 Jul '21

07 Jul '21

Dear devs, I noticed this using Dovecot 2.3.7.2, set up on a newly created Ubuntu 20.04 server. If I delete a sieve script via KMail's managesieve interface, and the script is active, it leaves sieve unfunctional afterwards. What's happening is this: Dovecot creates a USER.sieve script containing all active scripts, e. g.: require ["include"]; include :personal "some-script"; include :personal "some-other-script"; Now if I delete "some-script", it's actually deleted, but USER.sieve is not updated (and still contains 'include :personal "some-script";'). So next time an email is filtered, this happens: mail log: Jul 5 15:20:01 server dovecot: lda(user@domain)<123456> <xxxxxxxxxxxxxxxxxxxxxx>: sieve: Failed to compile script `/srv/sieve/user(a)domain/active-script.sieve' (view user logfile `/srv/sieve/user(a)domain/active-script.sieve.log' for more information) active-script.sieve.log: sieve: info: started log at Jul 05 14:57:54. USER: line 12: error: included personal script 'some_script' does not exist. USER: error: validation failed. So, to avoid this, one has to FIRST deactivate the respectice script, so that USER.sieve is updated and THEN delete the script. Or to manually fix USER.sieve on the server, which is surely not what's intended. So the question is now: Is this a KMail bug, a Doveceot bug, or is the server misconfigured?! Thanks for all help! Cheers, Tobias

6 13

Postfix / Dovecot Not Able to Authenticate
by techlists＠phpcoderusa.com 06 Jul '21

06 Jul '21

Hi My name is Keith Smith. I am a PHP developer and have been a freelance PHP developer since 2006. I have been working on a PHP web server in the hope of learning more about Linux hosting server administration. Over the years I have had the opportunity to create many PHP virtual hosts. I have not worked with or configured BIND, Postfix, and Dovecot before about 3 weeks ago. My home server is connected to the Internet via my home office business cable account. No blocked ports and I am able run one or more servers. I am running Ubuntu 20.04lts / Apache / MySql (or a clone) / PHP / BIND9 / Postfix / Dovecot / Let's Encrypt SSL. My server’s FQDN is : soho.keiththewebguy.com as is my reverse lookup on my IP : 98.191.108.149. The purpose is for learning. I intend to run one such configured server out of my home office running one domain or more (virtual hosts) and would like to configure Postfix/Dovecot to service one or more email addresses per virtual hosting. I have BIND working. At least enough that a simple web page can be displayed. I've installed Postfix and Dovecot and am getting an authentication issue that shows up in the logs. I do not know all that you might need. Please let me know. I admit I find Postfix and Dovecot difficult to understand. I am at the newbie stage. I've scoured the Internet looking for answers. After I configured Postfix and Dovecot I issued the commend : telnet keiththewebguy.com 25 on my web server. It returned: Trying 98.191.108.149... Connected to keiththewebguy.com. Escape character is '^]'. 220 soho.keiththewebguy.com ESMTP Postfix I issued : ehlo soho.keiththewebguy.com 250-soho.keiththewebguy.com 250-PIPELINING 250-SIZE 10240000 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING I issued : quit 221 2.0.0 Bye Connection closed by foreign host. --- I assume this means things are configured correctly. I am looking at both logs: 1) /var/log/mail.err which contains no content. 2) /var/log/mail.log which is verbose. To /etc/dovecot/dovecot.conf I added the following for debugging: auth_verbose = yes auth_verbose_passwords = no auth_debug = yes auth_debug_passwords = yes mail_debug = yes verbose_ssl = yes I am trying to connect using Thunderbird. Config: IMAP port 993 / ssl/TLS / Normal Password / username : keith(a)keiththewebguy.com and password that is in /etc/dovecot/dovecot-users SMTP port 25 / STARTTLS / Normal Password / username : keith(a)keiththewebguy.com and password that is in /etc/dovecot/dovecot-users Thunderbird tests these configurations and reports them as found on the server. When I press the done button to create the email account I get a message "Unable to log into the server. Probably wrong configuration, username, or password.". The output when trying to create the Thunderbird account: /var/log/mail.log =============== Jul 5 18:58:35 soho dovecot: imap-login: Debug: SSL: where=0x10, ret=1: before SSL initialization Jul 5 18:58:35 soho dovecot: imap-login: Debug: SSL: where=0x2001, ret=1: before SSL initialization Jul 5 18:58:35 soho dovecot: imap-login: Debug: SSL: where=0x2002, ret=-1: before SSL initialization Jul 5 18:58:35 soho dovecot: imap-login: Debug: SSL: where=0x2001, ret=1: before SSL initialization Jul 5 18:58:35 soho dovecot: imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3/TLS read client hello Jul 5 18:58:35 soho dovecot: imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3/TLS write server hello Jul 5 18:58:35 soho dovecot: imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3/TLS write certificate Jul 5 18:58:35 soho dovecot: imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3/TLS write key exchange Jul 5 18:58:35 soho dovecot: imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3/TLS write server done Jul 5 18:58:35 soho dovecot: imap-login: Debug: SSL: where=0x2002, ret=-1: SSLv3/TLS write server done Jul 5 18:58:35 soho dovecot: message repeated 2 times: [ imap-login: Debug: SSL: where=0x2002, ret=-1: SSLv3/TLS write server done] Jul 5 18:58:35 soho dovecot: imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3/TLS write server done Jul 5 18:58:35 soho dovecot: imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3/TLS read client key exchange Jul 5 18:58:35 soho dovecot: imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3/TLS read change cipher spec Jul 5 18:58:35 soho dovecot: imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3/TLS read finished Jul 5 18:58:35 soho dovecot: imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3/TLS write session ticket Jul 5 18:58:35 soho dovecot: imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3/TLS write change cipher spec Jul 5 18:58:35 soho dovecot: imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3/TLS write finished Jul 5 18:58:35 soho dovecot: imap-login: Debug: SSL: where=0x20, ret=1: SSL negotiation finished successfully Jul 5 18:58:35 soho dovecot: imap-login: Debug: SSL: where=0x2002, ret=1: SSL negotiation finished successfully Jul 5 18:58:35 soho dovecot: auth: Debug: Loading modules from directory: /usr/lib/dovecot/modules/auth Jul 5 18:58:35 soho dovecot: auth: Debug: Module loaded: /usr/lib/dovecot/modules/auth/lib20_auth_var_expand_crypt.so Jul 5 18:58:35 soho dovecot: auth: Debug: Read auth token secret from /var/run/dovecot/auth-token-secret.dat Jul 5 18:58:35 soho dovecot: auth: Debug: passwd-file /etc/dovecot/dovecot-users: Read 1 users in 0 secs Jul 5 18:58:35 soho dovecot: auth: Debug: auth client connected (pid=2021) Jul 5 18:58:35 soho dovecot: auth: Debug: client in: AUTH#0111#011PLAIN#011service=imap#011secured=tls#011session=wVJ55GTGvspiv2yV#011lip=192.168.1.10#011rip=98.191.108.149#011lport=993#011rport=51902#011local_name=mail.keiththewebguy.com#011ssl_cipher=ECDHE-RSA-AES128-GCM-SHA256#011ssl_cipher_bits=128#011ssl_pfs=KxECDHE#011ssl_protocol=TLSv1.2 Jul 5 18:58:35 soho dovecot: auth: Debug: client passdb out: CONT#0111#011 Jul 5 18:58:35 soho dovecot: auth: Debug: client in: CONT#0111#011AGtlaXRoQGtlaXRodGhld2ViZ3V5LmNvbQBJY2VjcmVhbS1Db25lXjIx (previous base64 data may contain sensitive data) Jul 5 18:58:35 soho dovecot: auth: Debug: passwd-file(keith(a)keiththewebguy.com,98.191.108.149,<wVJ55GTGvspiv2yV>): Performing passdb lookup Jul 5 18:58:35 soho dovecot: auth: Debug: passwd-file(keith(a)keiththewebguy.com,98.191.108.149,<wVJ55GTGvspiv2yV>): lookup: user=keith(a)keiththewebguy.com file=/etc/dovecot/dovecot-users Jul 5 18:58:35 soho dovecot: auth: passwd-file(keith(a)keiththewebguy.com,98.191.108.149,<wVJ55GTGvspiv2yV>): unknown user Jul 5 18:58:35 soho dovecot: auth: Debug: passwd-file(keith(a)keiththewebguy.com,98.191.108.149,<wVJ55GTGvspiv2yV>): Finished passdb lookup Jul 5 18:58:35 soho dovecot: auth: Debug: auth(keith(a)keiththewebguy.com,98.191.108.149,<wVJ55GTGvspiv2yV>): Auth request finished Jul 5 18:58:37 soho dovecot: auth: Debug: client passdb out: FAIL#0111#011user=keith(a)keiththewebguy.com Jul 5 18:58:37 soho dovecot: auth: Debug: client in: AUTH#0112#011LOGIN#011service=imap#011secured=tls#011session=wVJ55GTGvspiv2yV#011lip=192.168.1.10#011rip=98.191.108.149#011lport=993#011rport=51902#011local_name=mail.keiththewebguy.com#011ssl_cipher=ECDHE-RSA-AES128-GCM-SHA256#011ssl_cipher_bits=128#011ssl_pfs=KxECDHE#011ssl_protocol=TLSv1.2 Jul 5 18:58:41 soho dovecot: auth: Debug: client passdb out: CONT#0112#011VXNlcm5hbWU6 Jul 5 18:58:41 soho dovecot: auth: Debug: client in: CONT#0112#011a2VpdGhAa2VpdGh0aGV3ZWJndXkuY29t (previous base64 data may contain sensitive data) Jul 5 18:58:41 soho dovecot: auth: Debug: client passdb out: CONT#0112#011UGFzc3dvcmQ6 Jul 5 18:58:41 soho dovecot: auth: Debug: client in: CONT#0112#011SWNlY3JlYW0tQ29uZV4yMQ== (previous base64 data may contain sensitive data) Jul 5 18:58:41 soho dovecot: auth: Debug: passwd-file(keith(a)keiththewebguy.com,98.191.108.149,<wVJ55GTGvspiv2yV>): Performing passdb lookup Jul 5 18:58:41 soho dovecot: auth: Debug: passwd-file(keith(a)keiththewebguy.com,98.191.108.149,<wVJ55GTGvspiv2yV>): lookup: user=keith(a)keiththewebguy.com file=/etc/dovecot/dovecot-users Jul 5 18:58:41 soho dovecot: auth: passwd-file(keith(a)keiththewebguy.com,98.191.108.149,<wVJ55GTGvspiv2yV>): unknown user Jul 5 18:58:41 soho dovecot: auth: Debug: passwd-file(keith(a)keiththewebguy.com,98.191.108.149,<wVJ55GTGvspiv2yV>): Finished passdb lookup Jul 5 18:58:41 soho dovecot: auth: Debug: auth(keith(a)keiththewebguy.com,98.191.108.149,<wVJ55GTGvspiv2yV>): Auth request finished Jul 5 18:58:43 soho dovecot: auth: Debug: client passdb out: FAIL#0112#011user=keith(a)keiththewebguy.com Jul 5 18:58:43 soho dovecot: auth: Debug: client in: AUTH#0113#011PLAIN#011service=imap#011secured=tls#011session=wVJ55GTGvspiv2yV#011lip=192.168.1.10#011rip=98.191.108.149#011lport=993#011rport=51902#011local_name=mail.keiththewebguy.com#011ssl_cipher=ECDHE-RSA-AES128-GCM-SHA256#011ssl_cipher_bits=128#011ssl_pfs=KxECDHE#011ssl_protocol=TLSv1.2#011resp=AGtlaXRoQGtlaXRodGhld2ViZ3V5LmNvbQBJY2VjcmVhbS1Db25lXjIx (previous base64 data may contain sensitive data) Jul 5 18:58:47 soho dovecot: auth: Debug: passwd-file(keith(a)keiththewebguy.com,98.191.108.149,<wVJ55GTGvspiv2yV>): Performing passdb lookup Jul 5 18:58:47 soho dovecot: auth: Debug: passwd-file(keith(a)keiththewebguy.com,98.191.108.149,<wVJ55GTGvspiv2yV>): lookup: user=keith(a)keiththewebguy.com file=/etc/dovecot/dovecot-users Jul 5 18:58:47 soho dovecot: auth: passwd-file(keith(a)keiththewebguy.com,98.191.108.149,<wVJ55GTGvspiv2yV>): unknown user Jul 5 18:58:47 soho dovecot: auth: Debug: passwd-file(keith(a)keiththewebguy.com,98.191.108.149,<wVJ55GTGvspiv2yV>): Finished passdb lookup Jul 5 18:58:47 soho dovecot: auth: Debug: auth(keith(a)keiththewebguy.com,98.191.108.149,<wVJ55GTGvspiv2yV>): Auth request finished Jul 5 18:58:49 soho dovecot: auth: Debug: client passdb out: FAIL#0113#011user=keith(a)keiththewebguy.com Jul 5 18:58:49 soho dovecot: imap-login: Debug: SSL alert: close notify Jul 5 18:58:49 soho dovecot: imap-login: Disconnected (auth failed, 3 attempts in 14 secs): user=<keith(a)keiththewebguy.com>, method=PLAIN, rip=98.191.108.149, lip=192.168.1.10, TLS, session=<wVJ55GTGvspiv2yV> Jul 5 18:58:49 soho dovecot: imap-login: Debug: SSL alert: close notify ================== I see the following lines: passwd-file /etc/dovecot/dovecot-users: Read 1 users in 0 secs passwd-file(keith(a)keiththewebguy.com,98.191.108.149,<wVJ55GTGvspiv2yV>): Performing passdb lookup passwd-file(keith(a)keiththewebguy.com,98.191.108.149,<wVJ55GTGvspiv2yV>): lookup: user=keith(a)keiththewebguy.com file=/etc/dovecot/dovecot-users file(keith(a)keiththewebguy.com,98.191.108.149,<wVJ55GTGvspiv2yV>): unknown user passwd-file(keith(a)keiththewebguy.com,98.191.108.149,<wVJ55GTGvspiv2yV>): Finished passdb lookup auth(keith(a)keiththewebguy.com,98.191.108.149,<wVJ55GTGvspiv2yV>): Auth request finished client passdb out: FAIL#0111#011user=keith(a)keiththewebguy.com - - - - dovecot -n : # 2.3.7.2 (3c910f64b): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.7.2 () # OS: Linux 5.4.0-77-generic x86_64 Ubuntu 20.04.2 LTS ext4 # Hostname: soho.keiththewebguy.com auth_debug = yes auth_debug_passwords = yes auth_mechanisms = plain login auth_verbose = yes mail_debug = yes mail_location = maildir:/var/mail/vhosts/%d/%n mail_privileged_group = mail namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = scheme=PLAIN username_format=%u /etc/dovecot/dovecot-users driver = passwd-file } protocols = " imap lmtp pop3" service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0666 user = postfix } } service imap-login { inet_listener imaps { port = 993 ssl = yes } } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } ssl = required ssl_cert = </etc/letsencrypt/live/keiththewebguy.com/fullchain.pem ssl_client_ca_dir = /etc/ssl/certs ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { args = uid=vmail gid=vmail home=/var/mail/vhosts/%d/%n driver = static } verbose_ssl = yes - - - Any thoughts are most welcome!! Thanks in advance!!

2 5

master - master syncronization: *-temp-1-temp-1-temp-2-* recursion
by Heiko Schlittermann 05 Jul '21

05 Jul '21

Hi, I'm using dovecot 2.3.4.1 (f79e8e7e4) (Debian Build) and doing master/master replication. Recently we added a huuge .Archive* folder structure to the items being replicated. And now, suddenly we see new folders with a naming like *-temp-1-temp-1-temp-2-* appearing. This finally lead to infinite recursion until the replicator crashed. I've a theory, but please see below (**) for influence from outside of dovecot: SiteA starts replication of a huge .Archive folder, which doesn't exist on siteB yet A B .Archive ----> .Archive-temp-1 Because it takes ages to sync, the replicator on siteB now sees the new .Archive-temp-1 folder and starts replicating this back to siteA .Archive-temp-1-temp-1 <----- .Archive-temp-1 If now the replicator on siteA hits that new folder, it starts replicating it to site B .Archive-temp-1-temp-1 ----> .Archive-temp-1-temp-1-temp-2 … and so on. Sometimes the digit is "2", or even "3". I didn't check the Dovecot source yet, if the Replicator fails to skip the temporary folders it gets "injected" from the other side. (**) Possible external influence: On siteA a cronjob once per day moves the .Archive* folders to another filesystem and replaces the .Archive* directory with a symlink. This script "touches" the dovecot-uidlist.lock prior to its action (but doesn't check if there is already a lock). Could this mailbox move *behind* the back of the replicator be a reason for the odd behaviour? Additional info: On *both* nodes the config looks like this: doveadm_password = <password> service doveadm { inet_listener { port = 9090 ssl = yes } } replication_max_conns = 16 plugin { mail_replica = tcps:<other site>:9090 } service replicator { process_min_avail = 1 unix_listener replicator-doveadm { mode = 0666 user = dovecot } } service aggregator { fifo_listener replication-notify-fifo { mode = 0666 user = dovecot } unix_listener replication-notify { mode = 0666 user = dovecot } }

1 0

Duplicate users with multiple userdb iteration
by Slavko 05 Jul '21

05 Jul '21

Hi, recently i decided to use quota_over_flag with passwd_file userdb. The main idea is to prevent dovecot (or vmail) user to have write access to file with passwords. To do it, i setup separate userdb as this (SQL userdb is SQLite based, thus the same problem with write): passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } userdb { args = username_format=%u /etc/dovecot/over_quota default_fields = quota_over_flag=1 driver = passwd-file result_internalfail = continue-fail result_success = continue-fail } userdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } For testing i add one user into over_quota file: slavko(a)slavino.eu::::::: With this setting the doveadm user with user in over_quota seems to work: doveadm user slavko(a)slavino.eu field value uid 20000 gid 20000 home /srv/vmail/slavino.eu/slavko mail maildir:~/Maildir quota_over_flag 1 quota_rule *:storage=0M quota2_rule *:storage=0M But the user iteration shows duplicate users: doveadm user '*' slavko(a)slavino.eu slavko(a)slavino.eu ... As we discussed on IRC, it is how iteration works, as it emit users as soon as it meet it, but this doesn't correspond with "multiple userdb are merged" in docs (for iteration). I am surprised by this mainly because the particular userdb has set result_success to "continue-fail" and thus have to set user not found as with any user, which is not in this db. But it seems, that iteration ignores this result. I wrote this as we discussed via IRC, i am not subscribed, thus please CC me. regards -- Slavko http://slavino.sk

1 0

Re: Re: lost mailbox
by Stephane Magnier 05 Jul '21

05 Jul '21

Hi , Thanks Erwan, Yes I did it.. what worries me is, that that instruction lsub "" * seems not to work.. I mean I am not allowed to see it b lsub "" * b NO [NOPERM] No permission to read subscriptions (0.001 + 0.000 secs). So not sure that this is the fault of Thunderbird :-) Thanks for your help

2 1

Pb with Dovecot and visble folders
by Stephane Magnier 04 Jul '21

04 Jul '21

Hi, I've got a problem with my Dovecot installation.. Up to now, that was working fine.but today [root@mbox admin]# telnet localhost 143 Trying ::1... telnet: connect to address ::1: Connection refused Trying 127.0.0.1... Connected to localhost. Escape character is '^]'. * OK [CAPABILITY IMAP4rev1 SASL-IR LOGIN-REFERRALS ID ENABLE IDLE LITERAL+ STARTTLS AUTH=PLAIN] Dovecot ready. a login azt000 xxxxxx a OK [CAPABILITY IMAP4rev1 SASL-IR LOGIN-REFERRALS ID ENABLE IDLE SORT SORT=DISPLAY THREAD=REFERENCES THREAD=REFS THREAD=ORDEREDSUBJECT MULTIAPPEND URL-PARTIAL CATENATE UNSELECT CHILDREN NAMESPACE UIDPLUS LIST-EXTENDED I18NLEVEL=1 CONDSTORE QRESYNC ESEARCH ESORT SEARCHRES WITHIN CONTEXT=SEARCH LIST-STATUS BINARY MOVE SNIPPET=FUZZY PREVIEW=FUZZY LITERAL+ NOTIFY SPECIAL-USE QUOTA] Logged in b list "" * * LIST (\NoInferiors \UnMarked) "/" ssss * LIST (\NoInferiors \UnMarked) "/" 2021-TEST * LIST (\NoInferiors \UnMarked) "/" 2015 * LIST (\NoInferiors \UnMarked) "/" 2020-IT * LIST (\NoInferiors \UnMarked) "/" 2018-PERSO * LIST (\NoInferiors \UnMarked) "/" 2017 * LIST (\NoInferiors \UnMarked) "/" 2020-MARKETING * LIST (\NoInferiors \UnMarked) "/" 2019-AZT * LIST (\NoInferiors \UnMarked) "/" 2019-ADMIN * LIST (\NoInferiors \UnMarked) "/" "2020- PERSO" * LIST (\NoInferiors \UnMarked) "/" sss * LIST (\NoInferiors \UnMarked) "/" 2019-COMPTA * LIST (\NoInferiors \UnMarked) "/" 2019-PERSO * LIST (\NoInferiors \UnMarked) "/" 2017-ADMIN * LIST (\NoInferiors \UnMarked) "/" 2016 * LIST (\NoInferiors \UnMarked) "/" 2020-compta * LIST (\NoInferiors \Marked \Trash) "/" Trash * LIST (\NoInferiors \UnMarked) "/" Archives * LIST (\NoInferiors \UnMarked \Sent) "/" Sent * LIST (\NoInferiors \Marked \Junk) "/" Junk * LIST (\NoInferiors \UnMarked \Drafts) "/" Drafts * LIST (\NoInferiors \UnMarked \Sent) "/" "Sent Messages" * LIST (\NoInferiors \UnMarked) "/" INBOX/2021-AZT * LIST (\NoInferiors \UnMarked) "/" INBOX/2021-WebMEETING * LIST (\NoInferiors \UnMarked) "/" INBOX/2021-zezez * LIST (\NoInferiors \UnMarked) "/" INBOX/2021-PERSO * LIST (\NoInferiors \UnMarked) "/" INBOX/2021-MARKETING * LIST (\NoInferiors \UnMarked) "/" INBOX/2021-COMPTA * LIST (\NoInferiors \UnMarked) "/" INBOX/2021-ADMIN * LIST (\NoInferiors \UnMarked) "/" INBOX/2021-ATV * LIST (\NoInferiors \UnMarked) "/" INBOX/2021-test * LIST (\HasChildren) "/" INBOX b OK List completed (0.016 + 0.000 + 0.015 secs). *c lsub "" ** c NO [NOPERM] No permission to read subscriptions (0.001 + 0.000 secs). If I understand correctly, lsub should see what is visible by the Email client ? How can I let all the folders visible ? [root@mbox dovecot]# cat dovecot-new.conf # 2.3.8 (9df20d2db): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.8 (b7b03ba2) # OS: Linux 4.18.0-305.3.1.el8.x86_64 x86_64 CentOS Linux release 8.4.2105 nfs4 # Hostname: mbox1.aztgrp.net auth_debug_passwords = yes auth_username_format = %n disable_plaintext_auth = no login_trusted_networks = 177.18.0.0/16 127.0.0.1 ::1 mail_access_groups = mail mail_fsync = always mail_location = mbox:/var/spool2/mail/%u:INBOX=/var/spool/mail/%u:INDEX=/var/indexes/%u:CONTROL=/var/spool/mail-control mail_plugins = " quota" mail_privileged_group = mail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave mbox_very_dirty_syncs = yes mbox_write_locks = fcntl namespace inbox { inbox = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk { auto = subscribe special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Messages" { auto = subscribe special_use = \Sent } mailbox Trash { auto = no special_use = \Trash } mailbox virtual/All { auto = no special_use = \All } prefix = } passdb { driver = pam } plugin { quota_grace = 10%% quota_max_mail_size = 100M quota_rule = *:storage=10000M quota_rule2 = Trash:Storage=+100M quota_status_nouser = DUNNO quota_status_overquota = 552 5.2.2 Mailbox is full quota_status_success = DUNNO quota_warning = storage=95%% quota-warning 95 %u quota_warning2 = storage=80%% quota-warning 80 %u sieve = file:~/sieve;active=~/.dovecot.sieve } pop3_uidl_format = %v-%u service auth { unix_listener auth-master { mode = 0666 } } service dict { unix_listener dict { mode = 0600 user = mail } } service imap-login { inet_listener imap { address = * port = 143 } inet_listener imaps { address = * port = 993 ssl = yes } } service lmtp { inet_listener lmtp { address = ::1, 127.0.0.1 port = 24 } } service pop3-login { inet_listener pop3 { address = * port = 110 } inet_listener pop3s { address = * port = 995 ssl = yes } } service quota-warning { executable = script /usr/local/bin/quota-warning.sh unix_listener quota-warning { user = mail } user = dovecot } ssl = required ssl_ca = </etc/mail/ssl/ssl1/STAR_xxxxp_net.ca-bundle ssl_cert = </etc/mail/ssl/ssl1/STAR_xxxp_net.crt ssl_key = # hidden, use -P to show it userdb { driver = passwd } verbose_proctitle = yes protocol lmtp { mail_plugins = autocreate quota acl fts fts_solr zlib mail_log notify sieve } protocol lda { mail_plugins = " quota sieve quota" } protocol imap { mail_max_userip_connections = 80 mail_plugins = " quota quota imap_quota" ssl_cert = </etc/mail/ssl/ssl1/STAR_xxxp_net.crt ssl_key = # hidden, use -P to show it } protocol pop3 { mail_max_userip_connections = 10 mail_plugins = " quota" } protocol submission { mail_max_userip_connections = 10 mail_plugins = " quota" } My dovecot config Thanks and regards,

1 0

Bypass Trash Folder Sometimes.
by dovecot＠ptld.com 04 Jul '21

04 Jul '21

Is there a way, or a config setting, that would allow you to for-reals delete an email from the inbox instead of sending it to the Trash folder? Not always, the default behavior should still send deleted emails to the trash folder, but on a per case bases be able to just delete an email without it going to the trash folder. Same like how the windows desktop works. If you Delete a file on your desktop it goes to the recycle bin. However if you do Shift + Delete the file gets deleted without going to the recycle bin.

3 3